fix(node): read marker refs via rev-parse so present refs return their oid (#558)

- One post_receive_replication_tail per push: the carve-out spawn and the
  durability-bound spawn are mutually exclusive positions on the same
  proven-landed ref set; inv22 now fails on any unfiltered or ungated spawn.
- Marker reconcile: bounded-read errors (git Err/deadline) stay prepared
  and retry instead of quarantining as 'missing marker ref'; only a
  successfully read marker proves missing or mismatch. Err-injection test
  pins no-quarantine on unproven reads.
- Claimed webhook delivery: the synchronous claim phase returns the
  claimed Webhook rows so the send task never re-lists; a list failure
  after claim can no longer drop claimed deliveries. Source gate pins it.

.env.example

@@ -347,14 +347,6 @@ GITLAWB_TASK_READ_RATE_LIMIT=1200
 # brake caps a single-source flood. Uses GITLAWB_TRUSTED_PROXY below to resolve
 # the client IP. 0 disables. Default 120.
 GITLAWB_CREATE_RATE_LIMIT=120
-# Per-DID creation requests allowed inside the window below (repo create,
-# issue create, PR create, register, fork). 0 is rejected at startup: it would
-# silently disable the limiter. Default 10.
-GITLAWB_RATE_LIMIT_MAX=10
-# Window the per-DID creation count above applies over, in seconds. 0 is
-# rejected at startup: every timestamp would prune immediately, disabling the
-# limiter. Default 3600.
-GITLAWB_RATE_LIMIT_WINDOW_SECS=3600
 
 # ── Peer-sync rate limiting (per client IP, uses GITLAWB_TRUSTED_PROXY below) ─
 # /api/v1/peers/announce and /api/v1/sync/notify accept unsigned requests from
@@ -380,21 +372,6 @@ GITLAWB_TRUSTED_PROXY=
 # Enable automatic background sync from known peers
 GITLAWB_AUTO_SYNC=false
 
-# ── External upstream mirroring ───────────────────────────────────────────
-# Default-off scheduled fetch worker for repositories configured as INBOUND.
-# Enabling requires GITLAWB_ENFORCE_OWNER_PUSH=true; the node refuses to start
-# otherwise. The worker updates branches and tags atomically while preserving
-# Gitlawb-owned review/internal refs. Enabling also requires Git >= 2.37 on
-# the host for http.curloptResolve DNS pinning; the node refuses to start
-# when the installed Git is older.
-GITLAWB_UPSTREAM_MIRROR_ENABLED=false
-# Pause after each complete scan. Must be 5..=86400 seconds.
-GITLAWB_UPSTREAM_MIRROR_INTERVAL_SECS=300
-# Deadline for the external fetch child only; the preflight probes run on
-# their own short bound. Must be 1..=3153600000 seconds.
-GITLAWB_UPSTREAM_MIRROR_FETCH_TIMEOUT_SECS=600
-# Keyset page size; every page is processed before the next scan delay.
-GITLAWB_UPSTREAM_MIRROR_PAGE_SIZE=100
 # ── Reconciliation sweep ─────────────────────────────────────────────────
 # Periodic durability sweep: re-derives the public pin set and the withheld-blob
 # recovery set each hour and fills gaps so a dropped replication job never means

.github/workflows/codeql.yml

@@ -1,100 +0,0 @@
-name: CodeQL
-
-# Advanced-setup replacement for CodeQL default setup. Default setup analyzes
-# every detected language on every PR, including Swift (macos-app/), which
-# autobuilds on a macOS runner for ~13 minutes per PR and has hung for 55 on
-# main; that single job was the longest check on most PRs. Here a PR analyzes
-# only the languages it touches (scripts/ci-surfaces.sh), while push to main
-# and the weekly schedule analyze every language, so main's code-scanning
-# baseline stays complete.
-#
-# Requires CodeQL default setup to be DISABLED (Settings -> Code security ->
-# Code scanning): GitHub rejects advanced-setup uploads while it is enabled.
-#
-# A PR that skips a language may show "configuration not found" on the CodeQL
-# check for that language; that is informational and expected.
-
-on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-  schedule:
-    - cron: "17 4 * * 1"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: codeql-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  changes:
-    name: changed languages
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      codeql: ${{ steps.surfaces.outputs.codeql }}
-      matrix: ${{ steps.surfaces.outputs.codeql_matrix }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          fetch-depth: 2
-
-      - name: Map changed paths to languages
-        id: surfaces
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -euo pipefail
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            # -z: literal paths; plain --name-only C-quotes unusual names.
-            git diff -z --name-only --no-renames HEAD^1 HEAD > changed-paths
-            tr '\0' '\n' < changed-paths >&2
-            scripts/ci-surfaces.sh < changed-paths > surfaces.out
-          else
-            scripts/ci-surfaces.sh --all > surfaces.out
-          fi
-          cat surfaces.out
-          grep -E '^(codeql|codeql_matrix)=' surfaces.out >> "$GITHUB_OUTPUT"
-
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    needs: changes
-    if: needs.changes.outputs.codeql == 'true'
-    runs-on: ${{ matrix.runner }}
-    # Normal runs take <=14 min (Swift autobuild is the longest); cap a hung
-    # autobuild instead of letting it hold a runner for an hour.
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-      packages: read
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.changes.outputs.matrix) }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-
-      - name: Autobuild
-        if: matrix.build-mode == 'autobuild'
-        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          category: "/language:${{ matrix.language }}"

.github/workflows/pr-checks.yml

@@ -30,62 +30,8 @@ env:
   RUST_BACKTRACE: 1
 
 jobs:
-  # Decide which checks this event needs. On pull_request, each job below runs
-  # only when the PR touches the surface it validates, and the cargo test /
-  # release-build jobs are scoped to the touched crates plus their reverse
-  # dependencies (scripts/ci-surfaces.sh). Every other event (push to main,
-  # merge_group, the release flow's workflow_dispatch) runs the full suite, so
-  # main and the merge queue keep whole-workspace coverage and main-red-alert
-  # still sees a complete run. A skipped job reports as "skipped", not green.
-  changes:
-    name: changed surfaces
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      rust: ${{ steps.surfaces.outputs.rust }}
-      rust_packages: ${{ steps.surfaces.outputs.rust_packages }}
-      windows: ${{ steps.surfaces.outputs.windows }}
-      windows_packages: ${{ steps.surfaces.outputs.windows_packages }}
-      docker: ${{ steps.surfaces.outputs.docker }}
-      audit: ${{ steps.surfaces.outputs.audit }}
-      core_deps: ${{ steps.surfaces.outputs.core_deps }}
-      release_versioning: ${{ steps.surfaces.outputs.release_versioning }}
-      release_tag: ${{ steps.surfaces.outputs.release_tag }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          # The pull_request checkout is the test-merge commit; depth 2 brings
-          # its first parent (the base tip) so the diff is exactly this PR.
-          fetch-depth: 2
-
-      # Every job's gate comes from the mapper, so pin its mapping first; a
-      # failure here fails this job and the run is red, not silently narrowed.
-      - name: Test the surface mapper
-        run: scripts/test-ci-surfaces.sh
-
-      - name: Map changed paths to surfaces
-        id: surfaces
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -euo pipefail
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            # -z: literal paths; plain --name-only C-quotes unusual names.
-            git diff -z --name-only --no-renames HEAD^1 HEAD > changed-paths
-            tr '\0' '\n' < changed-paths >&2
-            scripts/ci-surfaces.sh < changed-paths > surfaces.out
-          else
-            scripts/ci-surfaces.sh --all > surfaces.out
-          fi
-          cat surfaces.out
-          cat surfaces.out >> "$GITHUB_OUTPUT"
-
   fmt-clippy:
     name: fmt + clippy
-    needs: changes
-    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -111,8 +57,6 @@ jobs:
 
   release-tag-validation:
     name: release tag validation
-    needs: changes
-    if: needs.changes.outputs.release_tag == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -142,8 +86,6 @@ jobs:
 
   test:
     name: test (${{ matrix.toolchain }})
-    needs: changes
-    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     strategy:
@@ -188,17 +130,10 @@ jobs:
       - name: cargo test
         env:
           DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
-          # `--workspace`, or `-p <crate>...` for the crates a PR touches plus
-          # every crate that depends on them.
-          PACKAGES: ${{ needs.changes.outputs.rust_packages }}
-        run: |
-          # shellcheck disable=SC2086 # PACKAGES is a word list by design
-          cargo test --locked $PACKAGES
+        run: cargo test --locked --workspace
 
   build-release:
     name: build --release
-    needs: changes
-    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
@@ -218,20 +153,10 @@ jobs:
           key: release
 
       - name: cargo build --release
-        env:
-          PACKAGES: ${{ needs.changes.outputs.rust_packages }}
-        run: |
-          # shellcheck disable=SC2086 # PACKAGES is a word list by design
-          cargo build --locked --release $PACKAGES
+        run: cargo build --locked --release --workspace
 
   audit:
     name: cargo audit
-    # cargo audit reads only Cargo.lock (+ .cargo/audit.toml), so a PR that
-    # leaves both unchanged cannot change its verdict; a newly published
-    # advisory against main is caught by the push-to-main run and the weekly
-    # Scheduled Audit instead of turning every unrelated PR red.
-    needs: changes
-    if: needs.changes.outputs.audit == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -291,8 +216,6 @@ jobs:
 
   msrv:
     name: MSRV (Rust 1.91)
-    needs: changes
-    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -316,12 +239,6 @@ jobs:
 
   docker-build:
     name: Docker build smoke test
-    # Runs when the image's own inputs change: the Dockerfile, the manifests
-    # its dependency layer copies, the lockfile, bootstrap-peers.json. A
-    # source-only Rust change is already compiled by `build --release` (stable)
-    # and `MSRV` (1.91, the image's toolchain); push to main still runs this.
-    needs: changes
-    if: needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -338,8 +255,6 @@ jobs:
 
   test-windows:
     name: test (windows, non-blocking)
-    needs: changes
-    if: needs.changes.outputs.windows == 'true'
     runs-on: windows-latest
     timeout-minutes: 45
     # Non-blocking, mirroring the informational `beta` lane above. We ship `gl`
@@ -367,13 +282,7 @@ jobs:
           key: windows
 
       - name: cargo test (shipped Windows crates)
-        shell: bash
-        env:
-          # `-p gl -p git-remote-gitlawb`, or whichever of the two a PR affects.
-          PACKAGES: ${{ needs.changes.outputs.windows_packages }}
-        run: |
-          # shellcheck disable=SC2086 # PACKAGES is a word list by design
-          cargo test --locked $PACKAGES
+        run: cargo test --locked -p gl -p git-remote-gitlawb
 
   # gitlawb-core is embedded by every consumer (gl, git-remote-gitlawb, the node
   # daemon), so it must stay lean. This gate fails if gitlawb-core's normal
@@ -383,8 +292,6 @@ jobs:
   # cannot do. Regen instructions live in the allowlist header.
   core-deps-purity:
     name: gitlawb-core dependency purity
-    needs: changes
-    if: needs.changes.outputs.core_deps == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -417,8 +324,6 @@ jobs:
   # not its author knew this gate existed.
   release-versioning:
     name: release versioning coverage
-    needs: changes
-    if: needs.changes.outputs.release_versioning == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

AGENTS.md

@@ -40,5 +40,5 @@ When a node denies a request, surface the denial to the user. Never render a den
 ## Toolchain and CI reality
 
 - MSRV is Rust 1.91 (`rust-version` in the workspace `Cargo.toml`). The MSRV CI job runs `cargo check --workspace --all-targets` on exactly 1.91, so check that an API you rely on is stable there; the full test suite runs on stable.
-- The PR workflow's jobs are `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test` (against Postgres), a release build, `cargo audit`, the MSRV check, and a Docker build. On a PR, `scripts/ci-surfaces.sh` runs each job only when the PR touches its inputs, and scopes `cargo test` and the release build to the touched crates plus every crate that depends on them. Root `Cargo.toml`/`Cargo.lock`/`.cargo/` changes run the Rust jobs (fmt, clippy, tests, release build, MSRV) on the whole workspace; every other job still runs only when its own inputs change. Edits to the CI wiring itself (`pr-checks.yml`, `codeql.yml`, `scripts/ci-surfaces.sh`), push to `main`, and the merge queue run every job on the whole workspace. Edits to any other workflow run none of these jobs on a PR; CodeQL only analyzes them as Actions code. Run `cargo test --workspace` locally regardless. The same script limits CodeQL (`codeql.yml`) to the languages a PR touches. The `main` branch ruleset currently requires one approving review but does not require these checks to pass before merge; a failing job should block review approval in practice, but nothing enforces that mechanically today.
+- The PR workflow runs these jobs on every PR: `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace` (against Postgres), a release build, `cargo audit`, the MSRV check, and a Docker build. The `main` branch ruleset currently requires one approving review but does not require these checks to pass before merge; a failing job should block review approval in practice, but nothing enforces that mechanically today.
 - Conventional commit titles (`feat:`, `fix:`, `docs:`, ...) are required by convention and drive releases, but no CI job checks them; a bad title fails review, not the pipeline.

Cargo.lock

@@ -3601,7 +3601,6 @@ dependencies = [
  "ed25519-dalek 2.2.0",
  "gitlawb-core",
  "icaptcha-client",
- "libc",
  "mockito",
  "percent-encoding",
  "reqwest",

crates/gitlawb-node/src/api/peers.rs

@@ -84,7 +84,7 @@ pub(crate) const PUBLIC_HTTP_URL_REQUIREMENT: &str = "must be a public http(s) U
 /// sits at a prefix-length-dependent offset (RFC 6052 §2.2) — so they return
 /// `None`. Any caller that needs them blocked must reject the wider
 /// `64:ff9b::/32` itself; `is_public_http_url` does this in its native-v6 arm.
-pub(crate) fn embedded_ipv4(v6: std::net::Ipv6Addr) -> Option<std::net::Ipv4Addr> {
+fn embedded_ipv4(v6: std::net::Ipv6Addr) -> Option<std::net::Ipv4Addr> {
     if let Some(v4) = v6.to_ipv4_mapped().or_else(|| v6.to_ipv4()) {
         return Some(v4);
     }
@@ -104,116 +104,6 @@ pub(crate) fn embedded_ipv4(v6: std::net::Ipv6Addr) -> Option<std::net::Ipv4Addr
     None
 }
 
-/// Whether an IP literal is outside the local/private ranges that an
-/// attacker-controlled outbound URL must never reach. Kept separate from URL
-/// parsing so callers that resolve a DNS name themselves can apply the same
-/// classification to every answer and then pin the approved addresses.
-pub(crate) fn is_public_ip(ip: std::net::IpAddr) -> bool {
-    // Reject loopback/unspecified on the literal as given — catches `::1` and
-    // `::` before the IPv4-folding below (`::1`.to_ipv4() would otherwise map
-    // to a non-loopback `0.0.0.1`).
-    if ip.is_loopback() || ip.is_unspecified() {
-        return false;
-    }
-    // Fold any IPv6 literal that embeds an IPv4 address (mapped, compatible,
-    // 6to4, NAT64) down to that IPv4 so the v4 range checks catch
-    // loopback/private addresses smuggled in via an IPv6 encoding, then
-    // re-check loopback/unspecified.
-    let ip = match ip {
-        std::net::IpAddr::V6(v6) => embedded_ipv4(v6).map(std::net::IpAddr::V4).unwrap_or(ip),
-        v4 => v4,
-    };
-    if ip.is_loopback() || ip.is_unspecified() {
-        return false;
-    }
-    match ip {
-        std::net::IpAddr::V4(v4) => {
-            let o = v4.octets();
-            // RFC1918 private, link-local, CGNAT (100.64.0.0/10), or the
-            // RFC1122 "this host" block 0.0.0.0/8 (never a valid destination;
-            // 0.0.0.0 itself is already caught by the is_unspecified check).
-            if v4.is_private()
-                || v4.is_link_local()
-                || (o[0] == 100 && (o[1] & 0xc0) == 64)
-                || o[0] == 0
-            {
-                return false;
-            }
-        }
-        std::net::IpAddr::V6(v6) => {
-            let s = v6.segments();
-            // fc00::/7 (unique-local), fe80::/10 (link-local), or fec0::/10
-            // (site-local, deprecated by RFC 3879; the link-local mask does
-            // not cover it).
-            if (s[0] & 0xfe00) == 0xfc00 || (s[0] & 0xffc0) == 0xfe80 || (s[0] & 0xffc0) == 0xfec0 {
-                return false;
-            }
-            // Any NAT64 address (64:ff9b::/32) that is not the cleanly
-            // decodable well-known /96 — e.g. the RFC 8215 local-use
-            // 64:ff9b:1::/48 — carries a translated target whose embedded v4
-            // sits at a prefix-length-dependent offset (RFC 6052 §2.2).
-            // Rather than risk a wrong decode across every prefix length we
-            // reject the whole NAT64 space here. The well-known /96 was already
-            // folded to its v4 above and never reaches this arm.
-            if s[0] == 0x0064 && s[1] == 0xff9b {
-                return false;
-            }
-        }
-    }
-    true
-}
-
-/// Mirror-upstream variant of [`is_public_ip`]: in addition to the shared
-/// peer classification, rejects IANA special-purpose ranges that are
-/// non-global, locally meaningful, or unsafe as owner-controlled outbound
-/// fetch endpoints. For IP-literal upstreams, configure-time URL validation
-/// and the fetch-time egress policy share this classifier, so a stored
-/// literal can never fail the worker it is scheduled for. Hostname upstreams
-/// are only shape-checked at configure time: each fetch resolves DNS and
-/// applies this classifier to the answers, so a hostname whose answers turn
-/// non-public still fails at fetch time.
-pub(crate) fn mirror_upstream_ip_permitted(ip: std::net::IpAddr) -> bool {
-    if !is_public_ip(ip) {
-        return false;
-    }
-    let classified = match ip {
-        std::net::IpAddr::V6(v6) => embedded_ipv4(v6).map(std::net::IpAddr::V4).unwrap_or(ip),
-        _ => ip,
-    };
-    match classified {
-        std::net::IpAddr::V4(v4) => {
-            let [a, b, c, _] = v4.octets();
-            // IANA special-purpose ranges that are not globally reachable but
-            // may be routed inside labs, clouds, or operator networks. They are
-            // unsuitable for an owner-controlled outbound fetch even though
-            // `Ipv4Addr::is_private` does not classify them as RFC1918.
-            !(a >= 224
-                || (a == 192 && b == 0 && c == 0)
-                || (a == 192 && b == 0 && c == 2)
-                || (a == 192 && b == 88 && c == 99)
-                || (a == 198 && matches!(b, 18 | 19))
-                || (a == 198 && b == 51 && c == 100)
-                || (a == 203 && b == 0 && c == 113))
-        }
-        std::net::IpAddr::V6(v6) => {
-            let s = v6.segments();
-            // IANA special-purpose ranges that are non-global, locally
-            // meaningful, or unsafe to treat as ordinary forge endpoints.
-            // Reject the complete IETF protocol-assignment /23 rather than
-            // trying to maintain its narrow globally reachable exceptions;
-            // a public forge has no reason to depend on those anycast ranges.
-            !(v6.is_multicast()
-                || (s[0] & 0xffc0) == 0xfec0
-                || (s[0] == 0x0100 && s[1] == 0 && s[2] == 0 && s[3] == 0)
-                || (s[0] == 0x0100 && s[1] == 0 && s[2] == 0 && s[3] == 1)
-                || (s[0] == 0x2001 && (s[1] & 0xfe00) == 0)
-                || (s[0] == 0x2001 && s[1] == 0x0db8)
-                || (s[0] == 0x3fff && (s[1] & 0xf000) == 0)
-                || s[0] == 0x5f00)
-        }
-    }
-}
-
 /// Whether a peer `http_url` is a public http(s) endpoint safe to register.
 /// Rejects non-http(s) schemes, loopback/unspecified/private/link-local IPs,
 /// and `localhost` / `.localhost` / `.local` / `.internal` hostnames. Used at
@@ -247,9 +137,60 @@ pub fn is_public_http_url(raw: &str) -> bool {
     // before parsing as an IP.
     let ip_candidate = host.trim_start_matches('[').trim_end_matches(']');
     if let Ok(ip) = ip_candidate.parse::<std::net::IpAddr>() {
-        // IP literals share the single DNS/literal classification in
-        // `is_public_ip`; hostname-only rules stay local to this function.
-        return is_public_ip(ip);
+        // Reject loopback/unspecified on the literal as given — catches `::1`
+        // and `::` before the IPv4-folding below (`::1`.to_ipv4() would
+        // otherwise map to a non-loopback `0.0.0.1`).
+        if ip.is_loopback() || ip.is_unspecified() {
+            return false;
+        }
+        // Fold any IPv6 literal that embeds an IPv4 address (mapped, compatible,
+        // 6to4, NAT64) down to that IPv4 so the v4 range checks catch
+        // loopback/private addresses smuggled in via an IPv6 encoding, then
+        // re-check loopback/unspecified.
+        let ip = match ip {
+            std::net::IpAddr::V6(v6) => embedded_ipv4(v6).map(std::net::IpAddr::V4).unwrap_or(ip),
+            v4 => v4,
+        };
+        if ip.is_loopback() || ip.is_unspecified() {
+            return false;
+        }
+        match ip {
+            std::net::IpAddr::V4(v4) => {
+                let o = v4.octets();
+                // RFC1918 private, link-local, CGNAT (100.64.0.0/10), or the
+                // RFC1122 "this host" block 0.0.0.0/8 (never a valid destination;
+                // 0.0.0.0 itself is already caught by the is_unspecified check).
+                if v4.is_private()
+                    || v4.is_link_local()
+                    || (o[0] == 100 && (o[1] & 0xc0) == 64)
+                    || o[0] == 0
+                {
+                    return false;
+                }
+            }
+            std::net::IpAddr::V6(v6) => {
+                let s = v6.segments();
+                // fc00::/7 (unique-local), fe80::/10 (link-local), or fec0::/10
+                // (site-local, deprecated by RFC 3879 and so never a legitimate
+                // peer address, but still routable on networks that kept it).
+                if (s[0] & 0xfe00) == 0xfc00
+                    || (s[0] & 0xffc0) == 0xfe80
+                    || (s[0] & 0xffc0) == 0xfec0
+                {
+                    return false;
+                }
+                // Any NAT64 address (64:ff9b::/32) that is not the cleanly
+                // decodable well-known /96 — e.g. the RFC 8215 local-use
+                // 64:ff9b:1::/48 — carries a translated target whose embedded v4
+                // sits at a prefix-length-dependent offset (RFC 6052 §2.2).
+                // Rather than risk a wrong decode across every prefix length we
+                // reject the whole NAT64 space here. The well-known /96 was
+                // already folded to its v4 above and never reaches this arm.
+                if s[0] == 0x0064 && s[1] == 0xff9b {
+                    return false;
+                }
+            }
+        }
     } else if !host.contains('.') {
         // A name with no dot at all. The `.local` / `.internal` rules above are
         // suffix checks, so a single label slips both, and the resolver decides
@@ -675,8 +616,6 @@ mod tests {
     fn rejects_deprecated_site_local_v6() {
         // fec0::/10, deprecated by RFC 3879. The link-local mask (0xffc0 ==
         // 0xfe80) does not cover it: 0xfec0 & 0xffc0 is 0xfec0.
-        assert!(!super::is_public_ip("fec0::1".parse().unwrap()));
-        assert!(!super::is_public_ip("feff:ffff::1".parse().unwrap()));
         for bad in ["http://[fec0::1]/", "http://[feff:ffff::1]:7545"] {
             assert!(!is_public_http_url(bad), "{bad:?} must be rejected");
         }

crates/gitlawb-node/src/config.rs

@@ -152,46 +152,6 @@ pub struct Config {
     #[arg(long, env = "GITLAWB_AUTO_SYNC", default_value_t = false)]
     pub auto_sync: bool,
 
-    /// Periodically fetch configured INBOUND repositories from their external
-    /// HTTPS upstream. Disabled by default: enabling this also requires
-    /// `GITLAWB_ENFORCE_OWNER_PUSH=true`, so an upstream-authoritative mirror
-    /// cannot accept writes from arbitrary signed identities between fetches.
-    #[arg(long, env = "GITLAWB_UPSTREAM_MIRROR_ENABLED", default_value_t = false)]
-    pub upstream_mirror_enabled: bool,
-
-    /// Pause between complete upstream-mirror scans. A scan is sequential and
-    /// paginated; the pause begins only after the prior scan has finished, so a
-    /// slow forge cannot create overlapping worker cycles.
-    #[arg(
-        long,
-        env = "GITLAWB_UPSTREAM_MIRROR_INTERVAL_SECS",
-        default_value_t = 300,
-        value_parser = clap::value_parser!(u64).range(5..=86_400)
-    )]
-    pub upstream_mirror_interval_secs: u64,
-
-    /// Maximum wall-clock time for one external `git fetch`. The child runs in
-    /// its own process group and is fully reaped on timeout. The preflight
-    /// URL-rewrite and local-config probes run on their own short bounds and
-    /// do not consume this budget.
-    #[arg(
-        long,
-        env = "GITLAWB_UPSTREAM_MIRROR_FETCH_TIMEOUT_SECS",
-        default_value_t = 600,
-        value_parser = clap::value_parser!(u64).range(1..=GIT_SERVICE_TIMEOUT_SECS_MAX)
-    )]
-    pub upstream_mirror_fetch_timeout_secs: u64,
-
-    /// Number of durable INBOUND rows read per database page. Every page is
-    /// processed before the scan sleeps; this bounds query memory without
-    /// permanently starving repositories beyond the first page.
-    #[arg(
-        long,
-        env = "GITLAWB_UPSTREAM_MIRROR_PAGE_SIZE",
-        default_value_t = 100,
-        value_parser = clap::builder::RangedU64ValueParser::<usize>::new().range(1..=1_000)
-    )]
-    pub upstream_mirror_page_size: usize,
     /// Enable the periodic reconciliation sweep that re-derives pin/seal sets
     /// and fills durability gaps.  Defaults to true; set to false to disable
     /// the sweep even when a pin backend (IPFS/Pinata) is configured.
@@ -284,29 +244,6 @@ pub struct Config {
     #[arg(long, env = "GITLAWB_SHUTDOWN_GRACE_SECS", default_value_t = 30)]
     pub shutdown_grace_secs: u64,
 
-    /// Maximum number of creation requests (repo create, issue create, PR
-    /// create, register, fork) allowed per DID within the rate-limit window.
-    /// 0 is rejected at parse time: it would silently disable the limiter
-    /// (RateLimiter treats max_requests == 0 as allow-all), not block every
-    /// creation request.
-    #[arg(
-        long,
-        env = "GITLAWB_RATE_LIMIT_MAX",
-        default_value_t = 10,
-        value_parser = clap::value_parser!(u32).range(1..)
-    )]
-    pub rate_limit_max_requests: u32,
-
-    /// Rate-limit window size, in seconds, over which
-    /// `rate_limit_max_requests` applies. 0 is rejected at parse time: every
-    /// timestamp would prune immediately, silently disabling the limiter.
-    #[arg(
-        long,
-        env = "GITLAWB_RATE_LIMIT_WINDOW_SECS",
-        default_value_t = 3600,
-        value_parser = clap::value_parser!(u64).range(1..)
-    )]
-    pub rate_limit_window_secs: u64,
     /// Maximum wall-clock time a single served git operation (upload-pack /
     /// receive-pack through `run_git_service`) may run before it is aborted and
     /// its process group torn down, in seconds. Bounds a git that neither
@@ -960,13 +897,6 @@ impl Config {
                 Self::DB_LOCK_POOL_NON_PUSH_HEADROOM
             ));
         }
-        if self.upstream_mirror_enabled && !self.enforce_owner_push {
-            return Err(
-                "GITLAWB_UPSTREAM_MIRROR_ENABLED requires GITLAWB_ENFORCE_OWNER_PUSH=true: \
-                 an upstream-authoritative mirror must not accept writes from arbitrary signed identities"
-                    .to_string(),
-            );
-        }
         let main_floor = Self::DB_POOL_APP_HEADROOM as u64;
         if (self.db_max_connections as u64) < main_floor {
             return Err(format!(
@@ -1166,51 +1096,6 @@ pub(crate) fn validate_web_url(raw: &str) -> Result<(), String> {
 mod tests {
     use super::*;
 
-    #[test]
-    fn upstream_mirror_worker_is_default_off_and_bounded() {
-        let mut config = Config::parse_from(["gitlawb-node"]);
-        assert!(!config.upstream_mirror_enabled);
-        assert_eq!(config.upstream_mirror_interval_secs, 300);
-        assert_eq!(config.upstream_mirror_fetch_timeout_secs, 600);
-        assert_eq!(config.upstream_mirror_page_size, 100);
-        config.validate().unwrap();
-
-        assert!(
-            Config::try_parse_from(["gitlawb-node", "--upstream-mirror-interval-secs", "4",])
-                .is_err()
-        );
-        assert!(
-            Config::try_parse_from(["gitlawb-node", "--upstream-mirror-page-size", "0",]).is_err()
-        );
-    }
-
-    #[test]
-    fn upstream_mirror_worker_requires_owner_push_enforcement() {
-        // enforce_owner_push defaults true on main, so the only unsafe shape
-        // is the explicit opt-out: mirror enabled plus enforcement refused.
-        let mut unsafe_config = Config::parse_from([
-            "gitlawb-node",
-            "--upstream-mirror-enabled",
-            "--enforce-owner-push",
-            "false",
-        ]);
-        let error = unsafe_config.validate().unwrap_err();
-        assert!(error.contains("GITLAWB_ENFORCE_OWNER_PUSH=true"));
-
-        Config::parse_from([
-            "gitlawb-node",
-            "--upstream-mirror-enabled",
-            "--enforce-owner-push",
-            "true",
-        ])
-        .validate()
-        .unwrap();
-        // The default posture alone also validates: enforcement is on.
-        Config::parse_from(["gitlawb-node", "--upstream-mirror-enabled"])
-            .validate()
-            .unwrap();
-    }
-
     #[test]
     fn lock_pool_size_defaults_to_40_and_rejects_zero() {
         assert_eq!(

crates/gitlawb-node/src/db/mod.rs

@@ -119,17 +119,6 @@ pub struct RepoMirrorState {
     pub updated_at: DateTime<Utc>,
 }
 
-/// One canonical repository eligible for a scheduled external-forge fetch.
-/// The worker keyset-pages these rows by `repo_id`; transition metadata is not
-/// exposed because the selecting query admits only stable INBOUND state.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct InboundMirrorTarget {
-    pub repo_id: String,
-    pub owner_did: String,
-    pub name: String,
-    pub upstream_url: String,
-}
-
 #[cfg_attr(not(test), allow(dead_code))]
 impl RepoMirrorState {
     fn validate(&self) -> Result<()> {
@@ -149,7 +138,7 @@ impl RepoMirrorState {
 }
 
 #[cfg_attr(not(test), allow(dead_code))]
-pub(crate) fn validate_mirror_upstream_url(raw: &str) -> Result<reqwest::Url> {
+fn validate_mirror_upstream_url(raw: &str) -> Result<reqwest::Url> {
     if raw.is_empty() || raw.len() > 2048 {
         anyhow::bail!("mirror upstream URL must contain 1 to 2048 bytes");
     }
@@ -164,16 +153,6 @@ pub(crate) fn validate_mirror_upstream_url(raw: &str) -> Result<reqwest::Url> {
     if !crate::api::peers::is_public_http_url(raw) {
         anyhow::bail!("mirror upstream URL must use a public host");
     }
-    // An IP-literal host must also pass the fetch worker's stricter permit;
-    // otherwise the row stores fine but every scheduled fetch hard-fails.
-    if let Some(host) = url.host_str() {
-        let literal = host.trim_start_matches('[').trim_end_matches(']');
-        if let Ok(ip) = literal.parse::<std::net::IpAddr>() {
-            if !crate::api::peers::mirror_upstream_ip_permitted(ip) {
-                anyhow::bail!("mirror upstream URL uses an unsuitable literal host");
-            }
-        }
-    }
     if url.host_str().is_none() || url.path().trim_matches('/').is_empty() {
         anyhow::bail!("mirror upstream URL must include a host and repository path");
     }
@@ -2602,54 +2581,6 @@ impl Db {
         row.map(row_to_repo_mirror_state).transpose()
     }
 
-    /// Keyset-page stable INBOUND mirrors for the external-forge worker.
-    /// Transitioning/outbound rows are excluded at the database boundary so a
-    /// cycle cannot intentionally schedule them. The worker rechecks the state
-    /// after taking the repo write lock to close the selection-to-fetch window.
-    pub async fn list_inbound_mirror_targets(
-        &self,
-        after_repo_id: Option<&str>,
-        limit: i64,
-    ) -> Result<Vec<InboundMirrorTarget>> {
-        let rows = sqlx::query(
-            "SELECT id, owner_did, name, upstream_url
-             FROM repos
-             WHERE mirror_status = 'inbound'
-               AND upstream_url IS NOT NULL
-               AND (
-                    (mirror_transition_id IS NULL AND mirror_transition_phase IS NULL)
-                    OR (mirror_transition_id IS NOT NULL
-                        AND mirror_transition_phase = 'completed')
-               )
-               AND ($1::text IS NULL OR id > $1)
-             ORDER BY id ASC
-             LIMIT $2",
-        )
-        .bind(after_repo_id)
-        .bind(limit.clamp(1, 1_000))
-        .fetch_all(&self.pool)
-        .await?;
-
-        rows.into_iter()
-            .map(|row| {
-                Ok(InboundMirrorTarget {
-                    repo_id: row
-                        .try_get("id")
-                        .context("reading inbound mirror repository id")?,
-                    owner_did: row
-                        .try_get("owner_did")
-                        .context("reading inbound mirror owner DID")?,
-                    name: row
-                        .try_get("name")
-                        .context("reading inbound mirror repository name")?,
-                    upstream_url: row
-                        .try_get("upstream_url")
-                        .context("reading inbound mirror upstream URL")?,
-                })
-            })
-            .collect()
-    }
-
     /// Register a mirrored repo from a peer in the local DB so git smart HTTP can serve it.
     /// Uses INSERT OR IGNORE (SQLite) / ON CONFLICT DO NOTHING (Postgres) so it's idempotent.
     pub async fn upsert_mirror_repo(
@@ -8554,12 +8485,6 @@ mod mirror_state_tests {
             "https://forge.internal/Gitlawb/node.git",
             "https://[::ffff:127.0.0.1]/Gitlawb/node.git",
             "https://[64:ff9b::7f00:1]/Gitlawb/node.git",
-            // Special-use literals the peer classifier accepts but the fetch
-            // worker's stricter permit denies; configure and fetch must agree.
-            "https://192.0.2.1/org/repo.git",
-            "https://198.18.0.1/org/repo.git",
-            "https://203.0.113.5/org/repo.git",
-            "https://[2001:db8::1]/org/repo.git",
         ] {
             assert!(
                 validate_mirror_upstream_url(invalid).is_err(),
@@ -8776,101 +8701,6 @@ mod mirror_state_tests {
         assert_eq!(stored.updated_at, original_updated_at);
     }
 
-    #[sqlx::test]
-    async fn inbound_worker_pages_all_and_only_stable_inbound_mirrors(pool: PgPool) {
-        let db = migrated_db(pool).await;
-        let ids = [
-            Uuid::parse_str("00000000-0000-0000-0000-000000000001").unwrap(),
-            Uuid::parse_str("00000000-0000-0000-0000-000000000002").unwrap(),
-            Uuid::parse_str("00000000-0000-0000-0000-000000000003").unwrap(),
-        ];
-        for (index, id) in ids.into_iter().enumerate() {
-            let mut existing = repo(id);
-            existing.name = format!("mirror-{index}");
-            db.create_repo(&existing).await.unwrap();
-            db.configure_inbound_mirror(
-                &existing.id,
-                &format!("https://github.example/org/mirror-{index}.git"),
-            )
-            .await
-            .unwrap();
-        }
-
-        // The middle row simulates a transition selected by the next B1 slice.
-        // It must not be scheduled while authority is changing.
-        sqlx::query(
-            "UPDATE repos
-             SET mirror_status = 'transitioning_inbound_to_outbound',
-                 mirror_transition_id = $2,
-                 mirror_transition_phase = 'queued'
-             WHERE id = $1",
-        )
-        .bind(ids[1].to_string())
-        .bind(Uuid::new_v4())
-        .execute(db.pool())
-        .await
-        .unwrap();
-
-        let first = db.list_inbound_mirror_targets(None, 1).await.unwrap();
-        assert_eq!(first.len(), 1);
-        assert_eq!(first[0].repo_id, ids[0].to_string());
-        assert_eq!(first[0].name, "mirror-0");
-        assert_eq!(first[0].owner_did, "did:key:z6MkMirrorOwner");
-        assert_eq!(
-            first[0].upstream_url,
-            "https://github.example/org/mirror-0.git"
-        );
-
-        let second = db
-            .list_inbound_mirror_targets(Some(&first[0].repo_id), 1)
-            .await
-            .unwrap();
-        assert_eq!(second.len(), 1);
-        assert_eq!(second[0].repo_id, ids[2].to_string());
-
-        let exhausted = db
-            .list_inbound_mirror_targets(Some(&second[0].repo_id), 1)
-            .await
-            .unwrap();
-        assert!(exhausted.is_empty());
-    }
-
-    /// The second stable shape the CHECK admits: an inbound row whose
-    /// transition completed keeps its audit metadata and must still be
-    /// scheduled. Only in-flight phases make a row unstable.
-    #[sqlx::test]
-    async fn inbound_worker_pages_completed_stable_mirror_rows(pool: PgPool) {
-        let db = migrated_db(pool).await;
-        let id = Uuid::parse_str("00000000-0000-0000-0000-000000000004").unwrap();
-        let mut existing = repo(id);
-        existing.name = "mirror-completed".to_string();
-        db.create_repo(&existing).await.unwrap();
-        db.configure_inbound_mirror(
-            &existing.id,
-            "https://github.example/org/mirror-completed.git",
-        )
-        .await
-        .unwrap();
-
-        sqlx::query(
-            "UPDATE repos
-             SET mirror_transition_id = $2,
-                 mirror_transition_phase = 'completed'
-             WHERE id = $1",
-        )
-        .bind(id.to_string())
-        .bind(Uuid::new_v4())
-        .execute(db.pool())
-        .await
-        .unwrap();
-
-        let page = db.list_inbound_mirror_targets(None, 10).await.unwrap();
-        assert!(
-            page.iter().any(|t| t.repo_id == id.to_string()),
-            "completed-stable inbound row must be scheduled: {page:?}"
-        );
-    }
-
     #[sqlx::test]
     async fn malformed_mirror_row_returns_an_error_instead_of_panicking(pool: PgPool) {
         let row = sqlx::query(

crates/gitlawb-node/src/git/visibility_pack.rs

@@ -43,53 +43,6 @@ const WALK_TIMEOUT: Duration = Duration::from_secs(600);
 #[cfg(unix)]
 const WATCHDOG_TERM_GRACE: Duration = Duration::from_secs(1);
 
-/// Build a Git child command, optionally with an isolated environment for an
-/// owner-selected HTTPS destination. The isolated form intentionally drops
-/// ambient proxy, credential-helper, askpass, and Git config environment that
-/// could otherwise forward node-operator secrets to the selected upstream.
-fn git_child_command(
-    git_bin: &str,
-    args: &[&str],
-    repo_path: &Path,
-    isolated_https: bool,
-    isolated_config: &[(&str, &str)],
-) -> std::process::Command {
-    let mut command = std::process::Command::new(git_bin);
-    command
-        .args(args)
-        .current_dir(repo_path)
-        .stdin(Stdio::piped())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
-    if isolated_https {
-        let path = std::env::var_os("PATH");
-        command.env_clear();
-        if let Some(path) = path {
-            command.env("PATH", path);
-        }
-        command
-            .env("GIT_CONFIG_NOSYSTEM", "1")
-            .env(
-                "GIT_CONFIG_GLOBAL",
-                if cfg!(windows) { "NUL" } else { "/dev/null" },
-            )
-            .env("GIT_TERMINAL_PROMPT", "0")
-            .env("GIT_ASKPASS", "false")
-            .env("SSH_ASKPASS", "false")
-            .env("LANG", "C")
-            .env("LC_ALL", "C");
-        if !isolated_config.is_empty() {
-            command.env("GIT_CONFIG_COUNT", isolated_config.len().to_string());
-            for (index, (key, value)) in isolated_config.iter().enumerate() {
-                command
-                    .env(format!("GIT_CONFIG_KEY_{index}"), key)
-                    .env(format!("GIT_CONFIG_VALUE_{index}"), value);
-            }
-        }
-    }
-    command
-}
-
 /// Run one git child under a shared `deadline` with process-group teardown,
 /// BLOCKING, and return its stdout. The child runs in its own process group; a
 /// watchdog thread SIGTERMs (lets git clean up its `*.lock` files), then SIGKILLs,
@@ -128,22 +81,24 @@ fn child_terminated_without_reaping(pid: i32) -> bool {
 }
 
 #[cfg(unix)]
-fn run_bounded_git_raw_impl(
+pub(crate) fn run_bounded_git_raw(
     git_bin: &str,
     args: &[&str],
     repo_path: &Path,
     stdin_bytes: &[u8],
     deadline: Instant,
-    isolated_https: bool,
-    isolated_config: &[(&str, &str)],
 ) -> Result<(std::process::ExitStatus, Vec<u8>, Vec<u8>)> {
     use std::io::{Read, Write};
     use std::os::unix::process::CommandExt;
     use std::sync::mpsc::RecvTimeoutError;
 
     let label = args.first().copied().unwrap_or("git");
-    let mut command = git_child_command(git_bin, args, repo_path, isolated_https, isolated_config);
-    let mut child = command
+    let mut child = std::process::Command::new(git_bin)
+        .args(args)
+        .current_dir(repo_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
         .process_group(0)
         .spawn()
         .with_context(|| format!("failed to spawn git {label}"))?;
@@ -253,51 +208,6 @@ fn run_bounded_git_raw_impl(
     Ok((status, out, err))
 }
 
-pub(crate) fn run_bounded_git_raw(
-    git_bin: &str,
-    args: &[&str],
-    repo_path: &Path,
-    stdin_bytes: &[u8],
-    deadline: Instant,
-) -> Result<(std::process::ExitStatus, Vec<u8>, Vec<u8>)> {
-    run_bounded_git_raw_impl(git_bin, args, repo_path, stdin_bytes, deadline, false, &[])
-}
-
-/// Run a bounded Git child without inheriting ambient Git/proxy/credential
-/// configuration. Reserved for owner-selected external HTTPS destinations;
-/// ordinary local Git operations retain their existing environment.
-pub(crate) fn run_bounded_git_raw_isolated_https(
-    git_bin: &str,
-    args: &[&str],
-    repo_path: &Path,
-    stdin_bytes: &[u8],
-    deadline: Instant,
-) -> Result<(std::process::ExitStatus, Vec<u8>, Vec<u8>)> {
-    run_bounded_git_raw_impl(git_bin, args, repo_path, stdin_bytes, deadline, true, &[])
-}
-
-/// Isolated HTTPS runner with command-scope Git configuration supplied as
-/// separate key/value environment entries. Unlike `git -c key=value`, this
-/// preserves valid URL subsection keys whose path contains `=`.
-pub(crate) fn run_bounded_git_raw_isolated_https_with_config(
-    git_bin: &str,
-    args: &[&str],
-    repo_path: &Path,
-    stdin_bytes: &[u8],
-    deadline: Instant,
-    config: &[(&str, &str)],
-) -> Result<(std::process::ExitStatus, Vec<u8>, Vec<u8>)> {
-    run_bounded_git_raw_impl(
-        git_bin,
-        args,
-        repo_path,
-        stdin_bytes,
-        deadline,
-        true,
-        config,
-    )
-}
-
 /// Bounded git returning only stdout, `bail!`ing on any nonzero exit. The thin
 /// wrapper the walk callers use. Probes that must distinguish exit classes —
 /// `git cat-file` absence vs an object-store access failure — call
@@ -331,20 +241,23 @@ pub(crate) fn run_bounded_git(
 /// the Unix version's signature and result semantics so every caller compiles on all
 /// targets (#174).
 #[cfg(not(unix))]
-fn run_bounded_git_raw_impl(
+pub(crate) fn run_bounded_git_raw(
     git_bin: &str,
     args: &[&str],
     repo_path: &Path,
     stdin_bytes: &[u8],
     deadline: Instant,
-    isolated_https: bool,
-    isolated_config: &[(&str, &str)],
 ) -> Result<(std::process::ExitStatus, Vec<u8>, Vec<u8>)> {
     use std::io::{Read, Write};
     use std::sync::mpsc::RecvTimeoutError;
 
     let label = args.first().copied().unwrap_or("git");
-    let mut child = git_child_command(git_bin, args, repo_path, isolated_https, isolated_config)
+    let mut child = std::process::Command::new(git_bin)
+        .args(args)
+        .current_dir(repo_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
         .spawn()
         .with_context(|| format!("failed to spawn git {label}"))?;
 

crates/gitlawb-node/src/main.rs

@@ -25,7 +25,6 @@ mod state;
 mod sync;
 #[cfg(test)]
 mod test_support;
-mod upstream_mirror;
 mod visibility;
 mod webhooks;
 
@@ -358,14 +357,9 @@ async fn main() -> Result<()> {
     );
 
     // Per-DID limiter for the creation endpoints. Keyed on the authenticated
-    // DID (attacker-varied), so bound its key set to cap memory. Max and window
-    // are operator-configurable via GITLAWB_RATE_LIMIT_MAX /
-    // GITLAWB_RATE_LIMIT_WINDOW_SECS; both reject 0 at parse time.
-    let rate_limiter = rate_limit::RateLimiter::new_bounded(
-        config.rate_limit_max_requests as usize,
-        std::time::Duration::from_secs(config.rate_limit_window_secs),
-        200_000,
-    );
+    // DID (attacker-varied), so bound its key set to cap memory.
+    let rate_limiter =
+        rate_limit::RateLimiter::new_bounded(10, std::time::Duration::from_secs(3600), 200_000);
 
     // Per-client-IP flood brake for the creation endpoints. The per-DID limiter
     // above is bypassed by a DID farm (one throwaway did:key per repo), which is
@@ -695,22 +689,6 @@ async fn main() -> Result<()> {
         info!("auto-sync worker started");
     }
 
-    // External-forge mirroring is a separate, default-off worker. Startup
-    // validation already requires owner-only pushes when it is enabled; the
-    // worker additionally verifies the Git runtime can pin DNS answers before
-    // any URL reaches `git fetch`.
-    if config.upstream_mirror_enabled {
-        upstream_mirror::start(
-            Arc::clone(&state.db),
-            Arc::clone(&state.config),
-            state.repo_store.clone(),
-            state.repo_write_leases.clone(),
-            Arc::clone(&state.git_write_semaphore),
-            state.subscribe_shutdown(),
-        )
-        .context("starting upstream mirror worker")?;
-    }
-
     // Periodic reconciliation sweep: re-derives pin/seal sets and fills gaps
     // so a dropped replication job never means data loss.
     {

crates/gitlawb-node/src/rate_limit.rs

@@ -70,14 +70,6 @@ impl RateLimiter {
         self.window.min(Duration::from_secs(1))
     }
 
-    /// The configured window, exposed so a 429 can carry an honest
-    /// `retry-after`: a hardcoded value lies when the operator retunes the
-    /// window, and a client that honors the header would retry into another
-    /// 429 until the real window elapses.
-    pub fn window(&self) -> Duration {
-        self.window
-    }
-
     pub(crate) async fn check(&self, key: &str) -> bool {
         // max_requests == 0 means the limiter is disabled, not "block all".
         if self.max_requests == 0 {
@@ -301,7 +293,12 @@ pub async fn rate_limit_by_did(request: Request, next: Next) -> Response {
 
     if let (Some(limiter), Some(did)) = (limiter, did) {
         if !limiter.check(&did).await {
-            return too_many_requests(limiter.window().as_secs());
+            return (
+                StatusCode::TOO_MANY_REQUESTS,
+                [("retry-after", "60")],
+                RATE_LIMIT_MESSAGE,
+            )
+                .into_response();
         }
     }
 
@@ -412,10 +409,10 @@ pub const RATE_LIMIT_MESSAGE: &str = "rate limit exceeded — try again later";
 /// The shared 429 response for the per-IP flood brakes. Route-agnostic: this
 /// middleware now serves the push path AND the peer-sync routes, so the message
 /// stays generic (the offending path is recorded in the warn log below).
-pub fn too_many_requests(retry_after_secs: u64) -> Response {
+pub fn too_many_requests() -> Response {
     (
         StatusCode::TOO_MANY_REQUESTS,
-        [("retry-after", retry_after_secs.to_string())],
+        [("retry-after", "60")],
         RATE_LIMIT_MESSAGE,
     )
         .into_response()
@@ -484,7 +481,7 @@ pub async fn rate_limit_by_ip(request: Request, next: Next) -> Response {
         if let Some(key) = client_key(request.headers(), peer, limiter.trust) {
             if !limiter.limiter.check(&key).await {
                 tracing::warn!(key = %key, path = %request.uri().path(), "per-IP rate limit exceeded");
-                return too_many_requests(limiter.limiter.window().as_secs());
+                return too_many_requests();
             }
         }
     }

crates/gitlawb-node/src/upstream_mirror.rs

@@ -1,968 +0,0 @@
-//! Scheduled external-forge fetches for canonical INBOUND mirrors.
-//!
-//! This worker is deliberately separate from `sync`, which mirrors repositories
-//! between Gitlawb peers. External upstream URLs are owner-controlled data that
-//! eventually reach `git fetch`, so each cycle resolves DNS itself, validates
-//! every address, and pins the approved answers into Git/libcurl with
-//! `http.curloptResolve`. Redirects, proxies, credential helpers, submodule
-//! recursion, and non-HTTPS protocols are disabled at the command boundary.
-
-use anyhow::{Context, Result};
-use std::collections::BTreeSet;
-use std::net::IpAddr;
-use std::path::Path;
-use std::sync::Arc;
-use std::time::{Duration, Instant};
-use tracing::{info, warn};
-
-use crate::config::Config;
-use crate::db::{Db, InboundMirrorTarget, MirrorStatus, MirrorTransitionPhase};
-use crate::git::repo_store::RepoStore;
-use crate::state::{repo_identity_key, RepoWriteLeases};
-
-const DNS_TIMEOUT: Duration = Duration::from_secs(10);
-const MAX_PINNED_ADDRESSES: usize = 32;
-const MIN_CURL_OPT_RESOLVE_GIT: (u64, u64) = (2, 37);
-
-#[derive(Debug, Clone, Copy)]
-struct EgressPolicy;
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct PinnedUpstream {
-    url: String,
-    curlopt_resolve: Option<String>,
-}
-
-impl EgressPolicy {
-    async fn resolve(&self, url: reqwest::Url) -> Result<PinnedUpstream> {
-        let raw_host = url.host_str().context("mirror upstream URL has no host")?;
-        let connect_host = raw_host
-            .trim_start_matches('[')
-            .trim_end_matches(']')
-            .to_ascii_lowercase();
-        let policy_host = normalize_policy_host(&connect_host);
-        reject_always_local_hostname(&policy_host)?;
-        let port = url
-            .port_or_known_default()
-            .context("mirror upstream URL has no known port")?;
-
-        if let Ok(ip) = connect_host.parse::<IpAddr>() {
-            self.validate_addresses(&policy_host, &[ip])?;
-            return Ok(PinnedUpstream {
-                url: url.to_string(),
-                // An IP literal performs no DNS lookup, so there is no rebinding
-                // window to pin. TLS still verifies the literal from the URL.
-                curlopt_resolve: None,
-            });
-        }
-
-        let resolved = tokio::time::timeout(
-            DNS_TIMEOUT,
-            tokio::net::lookup_host((connect_host.as_str(), port)),
-        )
-        .await
-        .context("mirror upstream DNS lookup timed out")?
-        .context("resolving mirror upstream host")?;
-        let addresses: BTreeSet<IpAddr> = resolved.map(|addr| addr.ip()).collect();
-        if addresses.is_empty() {
-            anyhow::bail!("mirror upstream host resolved to no addresses");
-        }
-        let addresses: Vec<IpAddr> = addresses.into_iter().collect();
-        self.validate_addresses(&policy_host, &addresses)?;
-
-        let pinned = addresses
-            .iter()
-            .map(|ip| match ip {
-                IpAddr::V4(v4) => v4.to_string(),
-                IpAddr::V6(v6) => format!("[{v6}]"),
-            })
-            .collect::<Vec<_>>()
-            .join(",");
-        Ok(PinnedUpstream {
-            url: url.to_string(),
-            curlopt_resolve: Some(format!("+{connect_host}:{port}:{pinned}")),
-        })
-    }
-
-    fn validate_addresses(&self, host: &str, addresses: &[IpAddr]) -> Result<()> {
-        if addresses.is_empty() || addresses.len() > MAX_PINNED_ADDRESSES {
-            anyhow::bail!(
-                "mirror upstream host must resolve to 1..={MAX_PINNED_ADDRESSES} addresses"
-            );
-        }
-        for &ip in addresses {
-            if !address_is_permitted(ip) {
-                anyhow::bail!("mirror upstream host {host:?} resolved to disallowed address {ip}");
-            }
-        }
-        Ok(())
-    }
-}
-
-fn normalize_policy_host(host: &str) -> String {
-    host.trim_end_matches('.').to_ascii_lowercase()
-}
-
-fn reject_always_local_hostname(host: &str) -> Result<()> {
-    if host.is_empty()
-        || host == "localhost"
-        || host.ends_with(".localhost")
-        || host.ends_with(".local")
-        || host.ends_with(".internal")
-    {
-        anyhow::bail!("mirror upstream host is local-only and cannot be fetched");
-    }
-    Ok(())
-}
-
-fn address_is_permitted(ip: IpAddr) -> bool {
-    crate::api::peers::mirror_upstream_ip_permitted(ip)
-}
-
-fn parse_git_version(output: &str) -> Option<(u64, u64)> {
-    let version = output.split_whitespace().find(|part| {
-        part.as_bytes()
-            .first()
-            .is_some_and(|byte| byte.is_ascii_digit())
-    })?;
-    let mut parts = version.split('.');
-    Some((parts.next()?.parse().ok()?, parts.next()?.parse().ok()?))
-}
-
-fn ensure_safe_git_runtime(git_bin: &str) -> Result<()> {
-    // Bounded runner like every other git spawn on this path: --version does
-    // no I/O of its own, but the child still takes a permit and the deadline.
-    let (status, stdout, stderr) = crate::git::visibility_pack::run_bounded_git_raw_isolated_https(
-        git_bin,
-        &["--version"],
-        &std::env::temp_dir(),
-        b"",
-        Instant::now() + Duration::from_secs(10),
-    )?;
-    if !status.success() {
-        anyhow::bail!(
-            "{git_bin} --version failed: {}",
-            String::from_utf8_lossy(&stderr)
-                .chars()
-                .take(256)
-                .collect::<String>()
-        );
-    }
-    let stdout = String::from_utf8_lossy(&stdout);
-    let version = parse_git_version(&stdout).context("parsing git version")?;
-    if version < MIN_CURL_OPT_RESOLVE_GIT {
-        anyhow::bail!(
-            "upstream mirroring requires Git 2.37+ for DNS pinning; found {}.{}",
-            version.0,
-            version.1
-        );
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-struct FetchCommand {
-    config: Vec<(String, String)>,
-    args: Vec<String>,
-}
-
-fn fetch_command(upstream: &PinnedUpstream) -> FetchCommand {
-    let http_scope = |name: &str| format!("http.{}.{name}", upstream.url);
-    let credential_scope = |name: &str| format!("credential.{}.{name}", upstream.url);
-    let mut config = vec![
-        ("http.proxy".to_string(), "".to_string()),
-        ("http.followRedirects".to_string(), "false".to_string()),
-        // Reset any inherited multi-valued resolver entries before adding the
-        // address set validated for this exact fetch.
-        ("http.curloptResolve".to_string(), "".to_string()),
-        // Never forward operator or repository-scoped HTTP credentials to an
-        // owner-selected forge. Empty values reset Git's multi-valued headers
-        // and disable cookie state for this invocation.
-        ("http.extraHeader".to_string(), "".to_string()),
-        ("http.cookieFile".to_string(), "".to_string()),
-        ("http.saveCookies".to_string(), "false".to_string()),
-        ("http.sslVerify".to_string(), "true".to_string()),
-        // URL-specific configuration outranks generic `http.*` values even
-        // when the generic value is command-scoped. Repeat every security
-        // control at the exact validated URL so a repository-local scoped
-        // setting cannot re-enable redirects/proxies/headers/cookies or disable
-        // TLS. Key/value environment entries avoid `git -c` splitting a valid
-        // URL path that contains `=`.
-        (http_scope("proxy"), "".to_string()),
-        (http_scope("followRedirects"), "false".to_string()),
-        (http_scope("curloptResolve"), "".to_string()),
-        (http_scope("extraHeader"), "".to_string()),
-        (http_scope("cookieFile"), "".to_string()),
-        (http_scope("saveCookies"), "false".to_string()),
-        (http_scope("sslVerify"), "true".to_string()),
-    ];
-    if let Some(resolve) = &upstream.curlopt_resolve {
-        config.extend([
-            ("http.curloptResolve".to_string(), resolve.clone()),
-            (http_scope("curloptResolve"), resolve.clone()),
-        ]);
-    }
-    config.extend([
-        ("credential.helper".to_string(), "".to_string()),
-        (credential_scope("helper"), "".to_string()),
-        ("credential.interactive".to_string(), "false".to_string()),
-        ("core.askPass".to_string(), "false".to_string()),
-        ("fetch.recurseSubmodules".to_string(), "false".to_string()),
-        // Do not let a smart server or repository-local config introduce a
-        // second, unvalidated pack/bundle URL outside the pinned upstream.
-        ("fetch.uriprotocols".to_string(), "".to_string()),
-        ("fetch.bundleURI".to_string(), "".to_string()),
-        ("protocol.allow".to_string(), "never".to_string()),
-        ("protocol.https.allow".to_string(), "always".to_string()),
-    ]);
-    let args = vec![
-        "fetch".to_string(),
-        "--atomic".to_string(),
-        "--force".to_string(),
-        "--prune".to_string(),
-        "--prune-tags".to_string(),
-        "--no-auto-maintenance".to_string(),
-        "--no-recurse-submodules".to_string(),
-        "--no-write-fetch-head".to_string(),
-        upstream.url.clone(),
-        "+refs/heads/*:refs/heads/*".to_string(),
-        "+refs/tags/*:refs/tags/*".to_string(),
-    ];
-    FetchCommand { config, args }
-}
-
-fn reject_local_url_rewrite(
-    git_bin: &str,
-    repo_path: &Path,
-    upstream_url: &str,
-    deadline: Instant,
-) -> Result<()> {
-    let args = ["ls-remote", "--get-url", upstream_url];
-    let (status, stdout, stderr) = crate::git::visibility_pack::run_bounded_git_raw_isolated_https(
-        git_bin, &args, repo_path, b"", deadline,
-    )?;
-    if !status.success() {
-        let stderr = String::from_utf8_lossy(&stderr);
-        anyhow::bail!(
-            "checking mirror upstream URL rewrite failed: {}",
-            stderr.chars().take(4_096).collect::<String>()
-        );
-    }
-    let expanded = std::str::from_utf8(&stdout)
-        .context("Git returned a non-UTF-8 expanded mirror upstream URL")?
-        .trim_end_matches(['\r', '\n']);
-    if expanded != upstream_url {
-        anyhow::bail!("repository-local Git config attempted to rewrite the mirror upstream URL");
-    }
-    Ok(())
-}
-
-fn reject_sensitive_local_config(git_bin: &str, repo_path: &Path, deadline: Instant) -> Result<()> {
-    let args = [
-        "config",
-        "--local",
-        "--includes",
-        "--get-regexp",
-        r"^(http|credential|url)\.",
-    ];
-    let (status, stdout, stderr) = crate::git::visibility_pack::run_bounded_git_raw_isolated_https(
-        git_bin, &args, repo_path, b"", deadline,
-    )?;
-    match status.code() {
-        Some(1) if stdout.is_empty() => Ok(()),
-        Some(0) => anyhow::bail!(
-            "repository-local network or credential Git config is not allowed for upstream mirrors"
-        ),
-        _ => {
-            let stderr = String::from_utf8_lossy(&stderr);
-            anyhow::bail!(
-                "checking repository-local Git config failed: {}",
-                stderr.chars().take(4_096).collect::<String>()
-            )
-        }
-    }
-}
-
-/// Budget for each preflight probe inside [`run_fetch`] (the URL-rewrite
-/// check and the sensitive-local-config scan). Both run local git children
-/// against the on-disk repo, so a short bound is generous; keeping them on
-/// their own deadlines means `upstream_mirror_fetch_timeout_secs` covers
-/// only the external pack transfer it documents.
-const PREFLIGHT_PROBE_TIMEOUT: Duration = Duration::from_secs(30);
-
-fn run_fetch(
-    git_bin: &str,
-    repo_path: &Path,
-    upstream: &PinnedUpstream,
-    timeout: Duration,
-) -> Result<()> {
-    let command = fetch_command(upstream);
-    let args: Vec<&str> = command.args.iter().map(String::as_str).collect();
-    let config: Vec<(&str, &str)> = command
-        .config
-        .iter()
-        .map(|(key, value)| (key.as_str(), value.as_str()))
-        .collect();
-    let rewrite_deadline = Instant::now()
-        .checked_add(PREFLIGHT_PROBE_TIMEOUT)
-        .context("mirror URL-rewrite probe timeout is not representable")?;
-    reject_local_url_rewrite(git_bin, repo_path, &upstream.url, rewrite_deadline)?;
-    let config_deadline = Instant::now()
-        .checked_add(PREFLIGHT_PROBE_TIMEOUT)
-        .context("mirror local-config probe timeout is not representable")?;
-    reject_sensitive_local_config(git_bin, repo_path, config_deadline)?;
-    let deadline = Instant::now()
-        .checked_add(timeout)
-        .context("upstream mirror fetch timeout is not representable")?;
-    let (status, _stdout, stderr) =
-        crate::git::visibility_pack::run_bounded_git_raw_isolated_https_with_config(
-            git_bin, &args, repo_path, b"", deadline, &config,
-        )?;
-    if !status.success() {
-        let stderr = String::from_utf8_lossy(&stderr);
-        let stderr = stderr.chars().take(4_096).collect::<String>();
-        anyhow::bail!("git upstream fetch failed: {stderr}");
-    }
-    Ok(())
-}
-
-#[derive(Clone)]
-struct Worker {
-    db: Arc<Db>,
-    config: Arc<Config>,
-    repo_store: RepoStore,
-    repo_write_leases: RepoWriteLeases,
-    git_write_semaphore: Arc<tokio::sync::Semaphore>,
-    policy: EgressPolicy,
-    git_bin: String,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum FetchOutcome {
-    Updated,
-    SkippedStale,
-}
-
-impl Worker {
-    async fn fetch_target(&self, target: InboundMirrorTarget) -> Result<FetchOutcome> {
-        let url = crate::db::validate_mirror_upstream_url(&target.upstream_url)?;
-        let upstream = self.policy.resolve(url).await?;
-
-        let repo_identity = repo_identity_key(&target.owner_did, &target.name);
-        let steal_after = Duration::from_secs(
-            self.config
-                .upstream_mirror_fetch_timeout_secs
-                .saturating_mul(2)
-                .saturating_add(60),
-        );
-        let _lease = self
-            .repo_write_leases
-            .acquire(&repo_identity, steal_after)
-            .await
-            .context("upstream mirror write-lease waiter cap reached")?;
-
-        let _write_permit = Arc::clone(&self.git_write_semaphore)
-            .acquire_owned()
-            .await
-            .context("upstream mirror write semaphore closed")?;
-        let acquire_timeout = Duration::from_secs(self.config.git_acquire_timeout_secs);
-        let guard = tokio::time::timeout(
-            acquire_timeout,
-            self.repo_store
-                .acquire_write(&target.owner_did, &target.name),
-        )
-        .await
-        .context("upstream mirror write-lock acquisition timed out")??;
-        let repo_path = guard.path().to_path_buf();
-
-        // A row can leave INBOUND state after selection. Recheck only after
-        // both the process-local lease and the cluster-wide advisory write lock
-        // are held. Every future transition path must take these same locks
-        // before changing authority, so no other node can commit a transition
-        // between this check and the fetch.
-        let current = match self.db.get_repo_mirror_state(&target.repo_id).await {
-            Ok(Some(current)) => current,
-            Ok(None) => {
-                let _ = guard.release(false).await;
-                anyhow::bail!("inbound mirror state disappeared before fetch");
-            }
-            Err(error) => {
-                let _ = guard.release(false).await;
-                return Err(error);
-            }
-        };
-        // Both stable shapes the CHECK admits: never transitioned, or a
-        // completed transition whose metadata is retained as audit. Only an
-        // in-flight transition makes the target stale.
-        let stable = (current.transition_id.is_none() && current.transition_phase.is_none())
-            || (current.transition_id.is_some()
-                && current.transition_phase == Some(MirrorTransitionPhase::Completed));
-        if current.status != MirrorStatus::Inbound
-            || !stable
-            || current.upstream_url != target.upstream_url
-        {
-            let _ = guard.release(false).await;
-            info!(repo_id = %target.repo_id, "upstream mirror state changed before fetch; skipping stale target");
-            return Ok(FetchOutcome::SkippedStale);
-        }
-
-        let git_bin = self.git_bin.clone();
-        let fetch_timeout = Duration::from_secs(self.config.upstream_mirror_fetch_timeout_secs);
-        let fetch = tokio::task::spawn_blocking(move || {
-            run_fetch(&git_bin, &repo_path, &upstream, fetch_timeout)
-        })
-        .await
-        .context("upstream mirror fetch task panicked")?;
-        let success = fetch.is_ok();
-        let outcome = guard.release(success).await;
-        // A refused publish (fenced or unknowable upload) must not report
-        // Updated; surface it as the failure it is before mapping the fetch.
-        outcome.into_result()?;
-        fetch.map(|()| FetchOutcome::Updated)
-    }
-
-    async fn scan_once(&self) {
-        let mut cursor: Option<String> = None;
-        loop {
-            let targets = match self
-                .db
-                .list_inbound_mirror_targets(
-                    cursor.as_deref(),
-                    self.config.upstream_mirror_page_size as i64,
-                )
-                .await
-            {
-                Ok(targets) => targets,
-                Err(error) => {
-                    warn!(err = %error, "failed to list inbound mirror targets");
-                    return;
-                }
-            };
-            if targets.is_empty() {
-                return;
-            }
-            let page_len = targets.len();
-            cursor = targets.last().map(|target| target.repo_id.clone());
-            for target in targets {
-                let repo_id = target.repo_id.clone();
-                let upstream_url = target.upstream_url.clone();
-                match self.fetch_target(target).await {
-                    Ok(FetchOutcome::Updated) => {
-                        info!(repo_id, upstream = %upstream_url, "upstream mirror fetch completed")
-                    }
-                    Ok(FetchOutcome::SkippedStale) => {}
-                    Err(error) => {
-                        warn!(repo_id, upstream = %upstream_url, err = %error, "upstream mirror fetch failed")
-                    }
-                }
-            }
-            if page_len < self.config.upstream_mirror_page_size {
-                return;
-            }
-        }
-    }
-}
-
-/// Validate the opt-in runtime and spawn the scheduled worker. The worker runs
-/// one scan immediately, sleeps only after a complete scan, and exits between
-/// scans when graceful shutdown is signalled. An in-flight Git child is bounded
-/// and reaped before the worker observes shutdown.
-pub fn start(
-    db: Arc<Db>,
-    config: Arc<Config>,
-    repo_store: RepoStore,
-    repo_write_leases: RepoWriteLeases,
-    git_write_semaphore: Arc<tokio::sync::Semaphore>,
-    mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
-) -> Result<()> {
-    ensure_safe_git_runtime("git")?;
-    let policy = EgressPolicy;
-    let worker = Worker {
-        db,
-        config: Arc::clone(&config),
-        repo_store,
-        repo_write_leases,
-        git_write_semaphore,
-        policy,
-        git_bin: "git".to_string(),
-    };
-    tokio::spawn(async move {
-        info!(
-            interval_secs = config.upstream_mirror_interval_secs,
-            "upstream mirror worker started"
-        );
-        loop {
-            worker.scan_once().await;
-            tokio::select! {
-                _ = tokio::time::sleep(Duration::from_secs(config.upstream_mirror_interval_secs)) => {}
-                changed = shutdown_rx.changed() => {
-                    if changed.is_err() || *shutdown_rx.borrow() {
-                        info!("upstream mirror worker stopped");
-                        return;
-                    }
-                }
-            }
-        }
-    });
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use clap::Parser;
-    use std::path::PathBuf;
-
-    async fn test_worker(
-        pool: sqlx::PgPool,
-        git_bin: PathBuf,
-        page_size: usize,
-    ) -> (Worker, Arc<Db>, tempfile::TempDir) {
-        let db = Arc::new(Db::for_testing(pool.clone()));
-        db.run_migrations().await.unwrap();
-        let repos = tempfile::tempdir().unwrap();
-        let mut config = Config::parse_from([
-            "gitlawb-node".to_string(),
-            "--upstream-mirror-enabled".to_string(),
-            "--enforce-owner-push".to_string(),
-            "--upstream-mirror-fetch-timeout-secs".to_string(),
-            "5".to_string(),
-            "--upstream-mirror-page-size".to_string(),
-            page_size.to_string(),
-        ]);
-        config.validate().unwrap();
-        let config = Arc::new(config);
-        let worker = Worker {
-            db: Arc::clone(&db),
-            config,
-            repo_store: RepoStore::for_testing(repos.path().to_path_buf(), pool),
-            repo_write_leases: RepoWriteLeases::new(8),
-            git_write_semaphore: Arc::new(tokio::sync::Semaphore::new(4)),
-            policy: EgressPolicy,
-            git_bin: git_bin.to_string_lossy().into_owned(),
-        };
-        (worker, db, repos)
-    }
-
-    async fn add_inbound_mirror(
-        worker: &Worker,
-        db: &Db,
-        id: &str,
-        name: &str,
-        upstream_url: &str,
-    ) -> InboundMirrorTarget {
-        let now = chrono::Utc::now();
-        let record = crate::db::RepoRecord {
-            id: id.to_string(),
-            name: name.to_string(),
-            owner_did: "did:key:z6MkMirrorWorker".to_string(),
-            description: None,
-            is_public: true,
-            default_branch: "main".to_string(),
-            created_at: now,
-            updated_at: now,
-            disk_path: format!("/test/{id}.git"),
-            forked_from: None,
-            machine_id: None,
-        };
-        db.create_repo(&record).await.unwrap();
-        worker
-            .repo_store
-            .init(&record.owner_did, &record.name)
-            .await
-            .unwrap();
-        let state = db
-            .configure_inbound_mirror(&record.id, upstream_url)
-            .await
-            .unwrap();
-        InboundMirrorTarget {
-            repo_id: record.id,
-            owner_did: record.owner_did,
-            name: record.name,
-            upstream_url: state.upstream_url,
-        }
-    }
-
-    #[cfg(unix)]
-    fn fake_git(repos: &tempfile::TempDir) -> (PathBuf, PathBuf) {
-        use std::os::unix::fs::PermissionsExt;
-
-        let git = repos.path().join("fake-git");
-        let calls = repos.path().join("fetch-calls");
-        let script = format!(
-            r#"#!/bin/sh
-if [ "$1" = "ls-remote" ]; then
-  printf '%s\n' "$3"
-  exit 0
-fi
-if [ "$1" = "config" ]; then
-  # Match real Git when no sensitive repository-local keys are configured.
-  exit 1
-fi
-case "$*" in
-  *fail.git*) printf '%s\n' fail >> '{}'; exit 7 ;;
-  *) printf '%s\n' ok >> '{}'; exit 0 ;;
-esac
-"#,
-            calls.display(),
-            calls.display()
-        );
-        std::fs::write(&git, script).unwrap();
-        let mut permissions = std::fs::metadata(&git).unwrap().permissions();
-        permissions.set_mode(0o700);
-        std::fs::set_permissions(&git, permissions).unwrap();
-        (git, calls)
-    }
-
-    #[test]
-    fn git_version_gate_requires_curlopt_resolve_support() {
-        assert_eq!(parse_git_version("git version 2.37.0"), Some((2, 37)));
-        assert_eq!(
-            parse_git_version("git version 2.39.5 (Apple Git-154)"),
-            Some((2, 39))
-        );
-        assert_eq!(parse_git_version("not git"), None);
-        assert!((2, 36) < MIN_CURL_OPT_RESOLVE_GIT);
-    }
-
-    #[test]
-    fn every_resolved_address_must_be_public() {
-        let policy = EgressPolicy;
-        let public_v4: IpAddr = "8.8.8.8".parse().unwrap();
-        let private_v4: IpAddr = "10.2.3.4".parse().unwrap();
-        let private_v6: IpAddr = "fd00::20".parse().unwrap();
-        assert!(policy
-            .validate_addresses("public.example", &[public_v4])
-            .is_ok());
-        assert!(policy
-            .validate_addresses("private.example", &[private_v4, private_v6])
-            .is_err());
-        assert!(policy
-            .validate_addresses("mixed.example", &[public_v4, private_v4])
-            .is_err());
-        let too_many = (1..=MAX_PINNED_ADDRESSES + 1)
-            .map(|last| IpAddr::V4(std::net::Ipv4Addr::new(8, 8, 0, last as u8)))
-            .collect::<Vec<_>>();
-        assert!(policy
-            .validate_addresses("oversized.example", &too_many)
-            .is_err());
-
-        for never in [
-            "127.0.0.1",
-            "169.254.169.254",
-            "192.0.2.1",
-            "198.18.0.1",
-            "198.51.100.1",
-            "203.0.113.10",
-            "::1",
-            "::ffff:198.18.0.1",
-            "2002:c612:1::",
-            "64:ff9b::c612:1",
-            "100::1",
-            "100:0:0:1::1",
-            "2001::1",
-            "2001:2::1",
-            "2001:db8::1",
-            "fec0::1",
-            "fe80::1",
-            "3fff::1",
-            "5f00::1",
-        ] {
-            let ip = never.parse().unwrap();
-            assert!(!address_is_permitted(ip), "{never} must stay denied");
-        }
-    }
-
-    #[test]
-    fn local_only_hostnames_are_always_rejected() {
-        for invalid in [
-            "",
-            "localhost",
-            "forge.localhost",
-            "forge.local",
-            "ghe.internal",
-        ] {
-            assert!(
-                reject_always_local_hostname(invalid).is_err(),
-                "{invalid:?}"
-            );
-        }
-        assert!(reject_always_local_hostname("github.example").is_ok());
-    }
-
-    #[test]
-    fn fetch_command_pins_dns_and_only_updates_branches_and_tags() {
-        let upstream = PinnedUpstream {
-            url: "https://github.example/org/repo.git".to_string(),
-            curlopt_resolve: Some("+github.example:443:8.8.8.8,[2606:4700:4700::1111]".to_string()),
-        };
-        let command = fetch_command(&upstream);
-        let has_config = |key: &str, value: &str| {
-            command
-                .config
-                .contains(&(key.to_string(), value.to_string()))
-        };
-        assert!(has_config("http.followRedirects", "false"));
-        assert!(has_config("http.proxy", ""));
-        assert!(has_config("http.extraHeader", ""));
-        assert!(has_config("http.cookieFile", ""));
-        assert!(has_config("http.saveCookies", "false"));
-        assert!(has_config("http.sslVerify", "true"));
-        assert!(has_config(
-            "http.curloptResolve",
-            "+github.example:443:8.8.8.8,[2606:4700:4700::1111]"
-        ));
-        assert!(has_config(
-            "http.https://github.example/org/repo.git.followRedirects",
-            "false"
-        ));
-        assert!(has_config(
-            "http.https://github.example/org/repo.git.proxy",
-            ""
-        ));
-        assert!(has_config(
-            "http.https://github.example/org/repo.git.extraHeader",
-            ""
-        ));
-        assert!(has_config(
-            "http.https://github.example/org/repo.git.curloptResolve",
-            "+github.example:443:8.8.8.8,[2606:4700:4700::1111]"
-        ));
-        assert!(has_config(
-            "credential.https://github.example/org/repo.git.helper",
-            ""
-        ));
-        assert!(has_config("protocol.allow", "never"));
-        assert!(has_config("protocol.https.allow", "always"));
-        assert!(has_config("fetch.uriprotocols", ""));
-        assert!(has_config("fetch.bundleURI", ""));
-        assert!(!command
-            .config
-            .iter()
-            .any(|(key, _)| key.ends_with("sslCert") || key.ends_with("sslKey")));
-        assert!(command.args.contains(&"--atomic".to_string()));
-        assert!(command
-            .args
-            .contains(&"+refs/heads/*:refs/heads/*".to_string()));
-        assert!(command
-            .args
-            .contains(&"+refs/tags/*:refs/tags/*".to_string()));
-        assert!(!command.args.iter().any(|arg| arg == "+refs/*:refs/*"));
-    }
-
-    /// Spawn `git` inside a fixture repo with inherited repository-location
-    /// and config environment scrubbed, so a test run inside an outer Git
-    /// checkout or custom config can never leak into the fixture.
-    fn fixture_git(dir: &std::path::Path) -> std::process::Command {
-        let mut cmd = std::process::Command::new("git");
-        cmd.current_dir(dir);
-        for var in [
-            "GIT_DIR",
-            "GIT_WORK_TREE",
-            "GIT_CONFIG",
-            "GIT_CONFIG_GLOBAL",
-            "GIT_CONFIG_SYSTEM",
-            "GIT_CONFIG_NOSYSTEM",
-            "GIT_CONFIG_COUNT",
-            "GIT_EXEC_PATH",
-            "GIT_SSH",
-            "GIT_SSH_COMMAND",
-            "GIT_ASKPASS",
-            "SSH_ASKPASS",
-        ] {
-            cmd.env_remove(var);
-        }
-        cmd
-    }
-
-    #[test]
-    fn repository_local_instead_of_rewrite_is_rejected() {
-        let repo = tempfile::tempdir().unwrap();
-        let init = fixture_git(repo.path())
-            .args(["init", "--bare"])
-            .output()
-            .unwrap();
-        assert!(init.status.success());
-        let config = fixture_git(repo.path())
-            .args([
-                "config",
-                "url.https://evil.example/.insteadOf",
-                "https://github.example/",
-            ])
-            .output()
-            .unwrap();
-        assert!(config.status.success());
-
-        let error = reject_local_url_rewrite(
-            "git",
-            repo.path(),
-            "https://github.example/org/repo.git",
-            Instant::now() + Duration::from_secs(5),
-        )
-        .unwrap_err();
-        assert!(error.to_string().contains("attempted to rewrite"));
-    }
-
-    #[test]
-    fn repository_local_network_and_credential_config_is_rejected() {
-        let repo = tempfile::tempdir().unwrap();
-        let init = fixture_git(repo.path())
-            .args(["init", "--bare"])
-            .output()
-            .unwrap();
-        assert!(init.status.success());
-
-        reject_sensitive_local_config("git", repo.path(), Instant::now() + Duration::from_secs(5))
-            .unwrap();
-
-        let config = fixture_git(repo.path())
-            .args(["config", "http.sslCert", "/tmp/untrusted-client.pem"])
-            .output()
-            .unwrap();
-        assert!(config.status.success());
-
-        let error = reject_sensitive_local_config(
-            "git",
-            repo.path(),
-            Instant::now() + Duration::from_secs(5),
-        )
-        .unwrap_err();
-        assert!(error.to_string().contains("network or credential"));
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn hardened_real_git_reaches_https_transport_for_equals_path() {
-        let repo = tempfile::tempdir().unwrap();
-        let init = fixture_git(repo.path())
-            .args(["init", "--bare"])
-            .output()
-            .unwrap();
-        assert!(init.status.success());
-
-        // This is intentionally a loopback test seam around `run_fetch`, below
-        // the egress-policy layer. Reaching the listener proves the generated
-        // Git config neither dies on an empty client certificate nor splits the
-        // valid `=` path at the command-config boundary. The listener closes
-        // immediately, so the expected final result is a TLS transport error.
-        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
-        let port = listener.local_addr().unwrap().port();
-        listener.set_nonblocking(true).unwrap();
-        let accepted = std::thread::spawn(move || {
-            let deadline = Instant::now() + Duration::from_secs(3);
-            while Instant::now() < deadline {
-                match listener.accept() {
-                    Ok((_stream, _address)) => return true,
-                    Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
-                        std::thread::sleep(Duration::from_millis(10));
-                    }
-                    Err(error) => panic!("accepting real-Git transport probe: {error}"),
-                }
-            }
-            false
-        });
-        let upstream = PinnedUpstream {
-            url: format!("https://127.0.0.1:{port}/org/repo=mirror.git"),
-            curlopt_resolve: None,
-        };
-        let error = run_fetch("git", repo.path(), &upstream, Duration::from_secs(5)).unwrap_err();
-        assert!(
-            accepted.join().unwrap(),
-            "real Git must reach the HTTPS transport; got {error:#}"
-        );
-        let error = error.to_string();
-        assert!(!error.contains("credential missing host field"));
-        assert!(!error.contains("invalid key"));
-    }
-
-    #[tokio::test]
-    async fn literal_addresses_are_checked_without_dns() {
-        let policy = EgressPolicy;
-        let allowed = policy
-            .resolve(reqwest::Url::parse("https://8.8.8.8/org/repo.git").unwrap())
-            .await
-            .unwrap();
-        assert_eq!(allowed.curlopt_resolve, None);
-
-        for denied in [
-            "127.0.0.1",
-            "10.2.3.4",
-            "169.254.169.254",
-            "192.0.2.1",
-            "198.18.0.1",
-            "203.0.113.10",
-            "[::1]",
-            "[100::1]",
-            "[100:0:0:1::1]",
-            "[2001::1]",
-            "[2001:db8::1]",
-            "[fec0::1]",
-            "[fd00::20]",
-            "[3fff::1]",
-            "[5f00::1]",
-        ] {
-            let url = reqwest::Url::parse(&format!("https://{denied}/org/repo.git")).unwrap();
-            assert!(
-                policy.resolve(url).await.is_err(),
-                "{denied} must stay denied"
-            );
-        }
-    }
-
-    #[sqlx::test]
-    async fn stale_target_is_rechecked_under_the_write_locks(pool: sqlx::PgPool) {
-        let missing_git = PathBuf::from("/definitely/missing/git");
-        let (worker, db, _repos) = test_worker(pool, missing_git, 1).await;
-        let target = add_inbound_mirror(
-            &worker,
-            &db,
-            "00000000-0000-0000-0000-000000000001",
-            "stale",
-            "https://8.8.8.8/org/stale.git",
-        )
-        .await;
-        sqlx::query(
-            "UPDATE repos
-             SET mirror_status = 'outbound'
-             WHERE id = $1",
-        )
-        .bind(&target.repo_id)
-        .execute(db.pool())
-        .await
-        .unwrap();
-
-        let outcome = worker.fetch_target(target).await.unwrap();
-        assert_eq!(outcome, FetchOutcome::SkippedStale);
-        assert!(worker.repo_write_leases.is_empty());
-    }
-
-    #[cfg(unix)]
-    #[sqlx::test]
-    async fn scan_pages_past_one_failure_and_fetches_the_next_repo(pool: sqlx::PgPool) {
-        let bootstrap = tempfile::tempdir().unwrap();
-        let (git, calls) = fake_git(&bootstrap);
-        let (worker, db, _repos) = test_worker(pool, git, 1).await;
-        add_inbound_mirror(
-            &worker,
-            &db,
-            "00000000-0000-0000-0000-000000000001",
-            "fails",
-            "https://8.8.8.8/org/fail.git",
-        )
-        .await;
-        add_inbound_mirror(
-            &worker,
-            &db,
-            "00000000-0000-0000-0000-000000000002",
-            "succeeds",
-            "https://8.8.8.8/org/ok.git",
-        )
-        .await;
-
-        worker.scan_once().await;
-
-        let calls = std::fs::read_to_string(calls).unwrap();
-        assert_eq!(calls.lines().collect::<Vec<_>>(), ["fail", "ok"]);
-        assert!(worker.repo_write_leases.is_empty());
-    }
-}

crates/gl/Cargo.toml

@@ -29,7 +29,6 @@ uuid = { workspace = true }
 url = { workspace = true }
 percent-encoding = { workspace = true }
 urlencoding = "2"
-libc = "0.2"
 alloy = { version = "1", default-features = false, features = [
     "contract",
     "provider-http",

crates/gl/src/identity.rs

@@ -152,13 +152,23 @@ async fn cmd_new_with_reader(
         }
     }
 
-    crate::secret_file::create_dir(&dir)
+    fs::create_dir_all(&dir)
         .with_context(|| format!("failed to create directory {}", dir.display()))?;
 
     let keypair = Keypair::generate();
     let pem = keypair.to_pem()?;
 
-    crate::secret_file::write(&path, pem.as_bytes())?;
+    // Write with restricted permissions
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        fs::write(&path, pem.as_bytes())?;
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;
+    }
+    #[cfg(not(unix))]
+    {
+        fs::write(&path, pem.as_bytes())?;
+    }
 
     let did = keypair.did();
     println!("✓ Generated new identity");
@@ -213,7 +223,16 @@ async fn cmd_backup(out: Option<PathBuf>, dir: Option<PathBuf>) -> Result<()> {
             .join("identity.pem.bak")
     });
 
-    crate::secret_file::write(&dest, pem.as_bytes())?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        fs::write(&dest, pem.as_bytes())?;
+        fs::set_permissions(&dest, fs::Permissions::from_mode(0o600))?;
+    }
+    #[cfg(not(unix))]
+    {
+        fs::write(&dest, pem.as_bytes())?;
+    }
 
     println!("✓ Identity backed up");
     println!("  DID:  {}", keypair.did());
@@ -264,10 +283,19 @@ async fn cmd_restore_with_reader(
         }
     }
 
-    crate::secret_file::create_dir(&base)
+    fs::create_dir_all(&base)
         .with_context(|| format!("failed to create directory {}", base.display()))?;
 
-    crate::secret_file::write(&dest, pem.as_bytes())?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        fs::write(&dest, pem.as_bytes())?;
+        fs::set_permissions(&dest, fs::Permissions::from_mode(0o600))?;
+    }
+    #[cfg(not(unix))]
+    {
+        fs::write(&dest, pem.as_bytes())?;
+    }
 
     println!("✓ Identity restored");
     println!("  DID:  {}", keypair.did());

crates/gl/src/init.rs

@@ -109,16 +109,16 @@ pub async fn run(args: InitArgs) -> Result<()> {
                 .dir
                 .clone()
                 .unwrap_or_else(|| dirs::home_dir().unwrap_or_default().join(".gitlawb"));
-            crate::secret_file::create_dir(&ucan_dir)?;
+            std::fs::create_dir_all(&ucan_dir)?;
             let record = json!({
                 "ucan": ucan,
                 "node": args.node,
                 "did": did.to_string(),
                 "saved_at": chrono::Utc::now().to_rfc3339(),
             });
-            crate::secret_file::write(
-                &ucan_dir.join("ucan.json"),
-                serde_json::to_string_pretty(&record)?.as_bytes(),
+            std::fs::write(
+                ucan_dir.join("ucan.json"),
+                serde_json::to_string_pretty(&record)?,
             )?;
         }
     }
@@ -232,13 +232,22 @@ fn generate_identity(dir: Option<&std::path::Path>) -> Result<gitlawb_core::iden
             .context("could not determine home directory")?
             .join(".gitlawb")
     };
-    crate::secret_file::create_dir(&base)?;
+    std::fs::create_dir_all(&base)?;
 
     let keypair = gitlawb_core::identity::Keypair::generate();
     let pem = keypair.to_pem()?;
     let path = base.join("identity.pem");
 
-    crate::secret_file::write(&path, pem.as_bytes())?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::write(&path, pem.as_bytes())?;
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
+    }
+    #[cfg(not(unix))]
+    {
+        std::fs::write(&path, pem.as_bytes())?;
+    }
 
     Ok(keypair)
 }

crates/gl/src/main.rs

@@ -26,7 +26,6 @@ mod protect;
 mod quickstart;
 mod register;
 mod repo;
-mod secret_file;
 mod star;
 mod status;
 mod sync;

crates/gl/src/quickstart.rs

@@ -100,17 +100,14 @@ pub async fn run(args: QuickstartArgs) -> Result<()> {
                 let payload: Value = resp.json().await.unwrap_or_default();
                 let ucan = payload["ucan"].as_str().unwrap_or("");
                 if !ucan.is_empty() {
-                    crate::secret_file::create_dir(&dir)?;
+                    std::fs::create_dir_all(&dir)?;
                     let record = json!({
                         "ucan": ucan,
                         "node": args.node,
                         "did": did,
                         "saved_at": chrono::Utc::now().to_rfc3339(),
                     });
-                    crate::secret_file::write(
-                        &ucan_path,
-                        serde_json::to_string_pretty(&record)?.as_bytes(),
-                    )?;
+                    std::fs::write(&ucan_path, serde_json::to_string_pretty(&record)?)?;
                     let trust = payload["trust_score"].as_f64().unwrap_or(0.0);
                     println!("  ✓  Registered successfully");
                     println!("     Trust score: {trust:.2}");
@@ -236,15 +233,23 @@ pub async fn run(args: QuickstartArgs) -> Result<()> {
 
 // ── Helpers ───────────────────────────────────────────────────────────────
 
-fn generate_identity(dir: &std::path::Path) -> Result<gitlawb_core::identity::Keypair> {
-    crate::secret_file::create_dir(dir)
-        .with_context(|| format!("failed to create {}", dir.display()))?;
+fn generate_identity(dir: &PathBuf) -> Result<gitlawb_core::identity::Keypair> {
+    std::fs::create_dir_all(dir).with_context(|| format!("failed to create {}", dir.display()))?;
 
     let keypair = gitlawb_core::identity::Keypair::generate();
     let pem = keypair.to_pem()?;
     let path = dir.join("identity.pem");
 
-    crate::secret_file::write(&path, pem.as_bytes())?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::write(&path, pem.as_bytes())?;
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
+    }
+    #[cfg(not(unix))]
+    {
+        std::fs::write(&path, pem.as_bytes())?;
+    }
 
     let did = keypair.did();
     println!("  ✓  Generated new identity");

crates/gl/src/register.rs

@@ -72,10 +72,7 @@ pub async fn run(args: RegisterArgs) -> Result<()> {
             "did": did.to_string(),
             "saved_at": chrono::Utc::now().to_rfc3339(),
         });
-        crate::secret_file::write(
-            &ucan_path,
-            serde_json::to_string_pretty(&record)?.as_bytes(),
-        )?;
+        std::fs::write(&ucan_path, serde_json::to_string_pretty(&record)?)?;
         tracing::debug!("saved UCAN to {}", ucan_path.display());
     }
 
@@ -111,7 +108,7 @@ fn ucan_path(dir: Option<&std::path::Path>) -> Result<PathBuf> {
             .context("could not determine home directory")?
             .join(".gitlawb")
     };
-    crate::secret_file::create_dir(&base)?;
+    std::fs::create_dir_all(&base)?;
     Ok(base.join("ucan.json"))
 }
 

crates/gl/src/secret_file.rs

@@ -1,180 +0,0 @@
-//! Writes and directories that hold key material or bearer tokens.
-
-use std::io::Write;
-use std::path::Path;
-
-/// Write `contents` to `path` with owner-only permissions.
-///
-/// On unix the mode is pinned at creation, so the file never exists with a
-/// permissive mode between open and chmod. `O_NOFOLLOW` refuses to write
-/// through a pre-planted symlink. `mode()` applies only when the file is
-/// created, so the mode is pinned on the descriptor before the file is
-/// truncated: a pre-existing loose file is tightened before, not after, the
-/// new contents land in it.
-pub(crate) fn write(path: &Path, contents: &[u8]) -> std::io::Result<()> {
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
-        let mut f = std::fs::OpenOptions::new()
-            .write(true)
-            .create(true)
-            .mode(0o600)
-            .custom_flags(libc::O_NOFOLLOW)
-            .open(path)?;
-        f.set_permissions(std::fs::Permissions::from_mode(0o600))?;
-        f.set_len(0)?;
-        f.write_all(contents)?;
-    }
-    #[cfg(not(unix))]
-    std::fs::write(path, contents)?;
-    Ok(())
-}
-
-/// Create `path` (and missing parents) as an owner-only directory.
-///
-/// An existing directory is also re-pinned: a `~/.gitlawb` created before
-/// this helper stays group- and world-listable otherwise. A symlinked
-/// `path` is left alone rather than chmodded through, which would strip
-/// group and world access from whatever the link points at.
-pub(crate) fn create_dir(path: &Path) -> std::io::Result<()> {
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::{DirBuilderExt, OpenOptionsExt};
-        std::fs::DirBuilder::new()
-            .recursive(true)
-            .mode(0o700)
-            .create(path)?;
-        // Re-pin through the opened directory, not the path: O_NOFOLLOW
-        // refuses a swapped-in symlink and fchmod acts on the checked inode,
-        // so a final-component swap between check and chmod cannot retarget
-        // the mode change at whatever the link points at.
-        match std::fs::OpenOptions::new()
-            .read(true)
-            .custom_flags(libc::O_NOFOLLOW)
-            .open(path)
-        {
-            Ok(dir) => {
-                use std::os::unix::io::AsRawFd;
-                let fd = dir.as_raw_fd();
-                // Re-pin only a leaf this process owns. A --dir the caller
-                // can write but cannot chmod (foreign-owned 0775 leaf, ACL
-                // grant) is adopted unchanged: create_dir_all allowed the
-                // write before, and aborting turns a usable directory into
-                // a command failure. An owned directory that still refuses
-                // chmod (EPERM) is adopted the same way.
-                let owned = unsafe {
-                    let mut st: libc::stat = std::mem::zeroed();
-                    libc::fstat(fd, &mut st) == 0 && st.st_uid == libc::geteuid()
-                };
-                if owned && unsafe { libc::fchmod(fd, 0o700) } != 0 {
-                    let e = std::io::Error::last_os_error();
-                    if e.raw_os_error() != Some(libc::EPERM) {
-                        return Err(e);
-                    }
-                }
-            }
-            // ELOOP: the path is a symlink and is left alone per contract.
-            Err(e) if e.raw_os_error() == Some(libc::ELOOP) => {}
-            Err(e) => return Err(e),
-        }
-    }
-    #[cfg(not(unix))]
-    std::fs::create_dir_all(path)?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use tempfile::TempDir;
-
-    #[test]
-    #[cfg(unix)]
-    fn create_dir_adopts_writable_leaf_it_cannot_chmod() {
-        use std::os::unix::fs::PermissionsExt;
-        // /tmp is root-owned 1777: writable by this euid, not chmod-able.
-        // The pre-helper create_dir_all allowed the write; the re-pin must
-        // adopt the leaf unchanged rather than abort on EPERM.
-        let before = std::fs::metadata("/tmp").unwrap().permissions().mode();
-        super::create_dir(std::path::Path::new("/tmp")).unwrap();
-        let after = std::fs::metadata("/tmp").unwrap().permissions().mode();
-        assert_eq!(before, after);
-    }
-
-    #[test]
-    #[cfg(unix)]
-    fn write_creates_file_with_0600() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("key.pem");
-        super::write(&path, b"secret").unwrap();
-        assert_eq!(std::fs::read(&path).unwrap(), b"secret");
-        assert_eq!(
-            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
-            0o600
-        );
-    }
-
-    #[test]
-    #[cfg(unix)]
-    fn write_tightens_preexisting_loose_file() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("key.pem");
-        std::fs::write(&path, b"old").unwrap();
-        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o644)).unwrap();
-        super::write(&path, b"new").unwrap();
-        assert_eq!(std::fs::read(&path).unwrap(), b"new");
-        assert_eq!(
-            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
-            0o600
-        );
-    }
-
-    #[test]
-    #[cfg(unix)]
-    fn write_refuses_symlink() {
-        let dir = TempDir::new().unwrap();
-        let target = dir.path().join("target.pem");
-        std::fs::write(&target, b"planted").unwrap();
-        let link = dir.path().join("link.pem");
-        std::os::unix::fs::symlink(&target, &link).unwrap();
-        assert!(super::write(&link, b"secret").is_err());
-        assert_eq!(std::fs::read(&target).unwrap(), b"planted");
-    }
-
-    #[test]
-    #[cfg(unix)]
-    fn create_dir_modes_0700_and_tightens_existing() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("a").join("b");
-        super::create_dir(&path).unwrap();
-        assert_eq!(
-            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
-            0o700
-        );
-        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o755)).unwrap();
-        super::create_dir(&path).unwrap();
-        assert_eq!(
-            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
-            0o700
-        );
-    }
-
-    #[test]
-    #[cfg(unix)]
-    fn create_dir_does_not_chmod_through_symlink() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = TempDir::new().unwrap();
-        let target = dir.path().join("shared");
-        std::fs::create_dir(&target).unwrap();
-        std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o755)).unwrap();
-        let link = dir.path().join("link");
-        std::os::unix::fs::symlink(&target, &link).unwrap();
-        super::create_dir(&link).unwrap();
-        assert_eq!(
-            std::fs::metadata(&target).unwrap().permissions().mode() & 0o777,
-            0o755
-        );
-    }
-}

crates/gl/src/ucan_cmd.rs

@@ -90,7 +90,7 @@ async fn cmd_delegate(
     let encoded = ucan.encode()?;
 
     if let Some(path) = out {
-        crate::secret_file::write(&path, encoded.as_bytes())?;
+        std::fs::write(&path, &encoded)?;
         println!("UCAN saved to {}", path.display());
         return Ok(());
     }

scripts/ci-surfaces.sh

@@ -1,221 +0,0 @@
-#!/usr/bin/env bash
-#
-# Map a pull request's changed paths to the CI surfaces they touch, so each
-# check in pr-checks.yml and codeql.yml runs only when its inputs changed and
-# Rust jobs test only the affected crates.
-#
-# Usage:
-#   git diff -z --name-only --no-renames BASE HEAD | scripts/ci-surfaces.sh
-#   scripts/ci-surfaces.sh --all      # every surface, whole workspace
-#
-# Input is NUL-terminated paths (`git diff -z`). Without -z, git C-quotes any
-# path with non-ASCII, tab, quote or newline characters ("crates/gl/\303\251.rs"),
-# which would match no surface and skip every job; newline-delimited input
-# also cannot carry a path that contains a newline. Input that does not end in
-# NUL (e.g. a plain `git diff --name-only`) is rejected rather than misread.
-# scripts/test-ci-surfaces.sh pins the mapping.
-#
-# Prints GITHUB_OUTPUT lines (key=value). Each surface runs only for the paths
-# listed for it below, so a path no surface lists (docs, README, infra/, any
-# other workflow) runs no PR Checks job. Within the Rust surface, a change this
-# script cannot attribute to specific crates widens rather than narrows: a
-# global Rust input or an unknown crate directory runs the Rust jobs on the
-# whole workspace. The CI wiring itself (pr-checks.yml, codeql.yml, this
-# script) runs every surface.
-# Non-PR events (push to main, merge_group, workflow_dispatch, schedule) are
-# expected to pass --all, so main and the merge queue keep full coverage.
-#
-# Runnable from anywhere in the repo.
-set -euo pipefail
-
-ROOT="$(git rev-parse --show-toplevel)"
-
-all=false
-if [ "${1:-}" = "--all" ]; then
-  all=true
-elif [ "$#" -ne 0 ]; then
-  echo "usage: $0 [--all] < NUL-terminated-changed-paths" >&2
-  exit 2
-fi
-
-changed=()
-if [ "$all" = false ]; then
-  path=""
-  while IFS= read -r -d '' path; do
-    [ -n "$path" ] && changed+=("$path")
-  done
-  # read leaves any unterminated tail in $path.
-  if [ -n "$path" ]; then
-    echo "ci-surfaces.sh: input is not NUL-terminated; pipe \`git diff -z --name-only\`" >&2
-    exit 2
-  fi
-fi
-
-# Workspace crates, derived from crates/*/Cargo.toml so a new crate is picked
-# up without editing this script. dir -> package name, and dir -> the crate
-# dirs it depends on through `path = "../<dir>"` (normal, dev, or build deps).
-declare -A pkg_of=() deps_of=()
-for manifest in "$ROOT"/crates/*/Cargo.toml; do
-  dir="$(basename "$(dirname "$manifest")")"
-  pkg_of[$dir]="$(sed -n 's/^name *= *"\([^"]*\)".*/\1/p' "$manifest" | head -n1)"
-  deps_of[$dir]="$(sed -n 's#.*path *= *"\.\./\([^"/]*\)".*#\1#p' "$manifest" | tr '\n' ' ')"
-done
-
-# Files outside crates/ that a crate compiles in (include_str!/include_bytes!),
-# path -> crate dir. A change to one is a change to that crate, so its tests
-# run. Candidates (keep those that resolve outside crates/<dir>/):
-#   git grep -nE 'include_(str|bytes)!\("(\.\./){2,}' crates
-declare -A embedded_in=(
-  [bootstrap-peers.json]=gitlawb-node
-)
-
-# Mark a crate dir as touched; a dir this checkout does not know (removed or
-# renamed crate) widens the Rust jobs to the whole workspace.
-touch_crate() {
-  if [ -n "${pkg_of[$1]:-}" ]; then
-    touched[$1]=1
-  else
-    full_rust=true
-  fi
-}
-
-full_rust=false
-rust=false
-docker=false
-audit=false
-core_deps=false
-release_versioning=false
-release_tag=false
-cq_actions=false
-cq_js=false
-cq_rust=false
-cq_swift=false
-declare -A touched=()
-
-for path in "${changed[@]}"; do
-  case "$path" in
-    # The CI wiring itself: validate everything it gates.
-    .github/workflows/pr-checks.yml | .github/workflows/codeql.yml | scripts/ci-surfaces.sh)
-      all=true ;;
-    # Workspace-wide Rust inputs.
-    Cargo.toml | Cargo.lock | .cargo/* | rust-toolchain | rust-toolchain.toml \
-      | rustfmt.toml | .rustfmt.toml | clippy.toml | .clippy.toml)
-      full_rust=true ;;
-    crates/*/*)
-      dir="${path#crates/}"
-      touch_crate "${dir%%/*}" ;;
-    *)
-      if [ -n "${embedded_in[$path]:-}" ]; then
-        touch_crate "${embedded_in[$path]}"
-      fi ;;
-  esac
-
-  case "$path" in
-    Dockerfile | .dockerignore | bootstrap-peers.json | Cargo.toml | Cargo.lock \
-      | .cargo/* | rust-toolchain | rust-toolchain.toml | crates/*/Cargo.toml)
-      docker=true ;;
-  esac
-  case "$path" in
-    Cargo.lock | .cargo/audit.toml) audit=true ;;
-  esac
-  case "$path" in
-    Cargo.toml | Cargo.lock | crates/gitlawb-core/Cargo.toml \
-      | ci/gitlawb-core-allowed-deps.txt | scripts/check-gitlawb-core-deps.sh)
-      core_deps=true ;;
-  esac
-  case "$path" in
-    Cargo.toml | crates/*/Cargo.toml | release-please-config.json \
-      | .release-please-manifest.json | scripts/check-release-versioning.sh)
-      release_versioning=true ;;
-  esac
-  case "$path" in
-    scripts/resolve-release-tag.sh | scripts/test-resolve-release-tag.sh)
-      release_tag=true ;;
-  esac
-
-  case "$path" in
-    .github/workflows/* | .github/actions/*) cq_actions=true ;;
-  esac
-  case "$path" in
-    npm/* | *.js | *.mjs | *.cjs | *.jsx | *.ts | *.mts | *.cts | *.tsx) cq_js=true ;;
-  esac
-  case "$path" in
-    macos-app/* | *.swift) cq_swift=true ;;
-  esac
-done
-
-if [ "$all" = true ]; then
-  full_rust=true
-  docker=true
-  audit=true
-  core_deps=true
-  release_versioning=true
-  release_tag=true
-  cq_actions=true
-  cq_js=true
-  cq_swift=true
-fi
-
-# Affected crates: the touched ones plus everything that depends on them,
-# transitively, so a gitlawb-core change still tests every consumer.
-declare -A affected=()
-for dir in "${!touched[@]}"; do affected[$dir]=1; done
-grew=true
-while [ "$grew" = true ]; do
-  grew=false
-  for dir in "${!deps_of[@]}"; do
-    [ -n "${affected[$dir]:-}" ] && continue
-    for dep in ${deps_of[$dir]}; do
-      if [ -n "${affected[$dep]:-}" ]; then
-        affected[$dir]=1
-        grew=true
-        break
-      fi
-    done
-  done
-done
-
-if [ "$full_rust" = true ] || [ "${#affected[@]}" -gt 0 ]; then
-  rust=true
-  cq_rust=true
-fi
-
-rust_packages=""
-windows_packages=""
-if [ "$full_rust" = true ]; then
-  rust_packages="--workspace"
-  windows_packages="-p gl -p git-remote-gitlawb"
-elif [ "$rust" = true ]; then
-  for dir in $(printf '%s\n' "${!affected[@]}" | sort); do
-    rust_packages+="${rust_packages:+ }-p ${pkg_of[$dir]}"
-    case "${pkg_of[$dir]}" in
-      gl | git-remote-gitlawb) windows_packages+="${windows_packages:+ }-p ${pkg_of[$dir]}" ;;
-    esac
-  done
-fi
-
-windows=false
-[ -n "$windows_packages" ] && windows=true
-
-languages=()
-[ "$cq_actions" = true ] && languages+=('{"language":"actions","build-mode":"none","runner":"ubuntu-latest"}')
-[ "$cq_js" = true ] && languages+=('{"language":"javascript-typescript","build-mode":"none","runner":"ubuntu-latest"}')
-[ "$cq_rust" = true ] && languages+=('{"language":"rust","build-mode":"none","runner":"ubuntu-latest"}')
-[ "$cq_swift" = true ] && languages+=('{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}')
-codeql_matrix="{\"include\":[$(IFS=,; echo "${languages[*]}")]}"
-codeql=false
-[ "${#languages[@]}" -gt 0 ] && codeql=true
-
-cat <<EOF
-rust=$rust
-rust_packages=$rust_packages
-windows=$windows
-windows_packages=$windows_packages
-docker=$docker
-audit=$audit
-core_deps=$core_deps
-release_versioning=$release_versioning
-release_tag=$release_tag
-codeql=$codeql
-codeql_matrix=$codeql_matrix
-EOF

scripts/test-ci-surfaces.sh

@@ -1,121 +0,0 @@
-#!/usr/bin/env bash
-# Fixture test for scripts/ci-surfaces.sh, which alone decides which PR Checks
-# jobs and CodeQL languages run. Pins at least one must-not-skip case per
-# surface row, the crate fan-out and widening rules, and paths that git would
-# C-quote without -z. Run from pr-checks.yml before the mapper is used.
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-mapper="$repo_root/scripts/ci-surfaces.sh"
-failures=0
-
-# map PATH... : run the mapper on the paths as `git diff -z` would emit them.
-map() {
-  if [ "$#" -gt 0 ]; then printf '%s\0' "$@"; fi | "$mapper"
-}
-
-# check CASE OUTPUT KEY=VALUE... : each KEY must have exactly VALUE.
-check() {
-  local name="$1" out="$2" want key
-  shift 2
-  for want in "$@"; do
-    key="${want%%=*}"
-    if ! grep -qxF -- "$want" <<<"$out"; then
-      printf 'FAIL %s: want %s, got %s\n' "$name" "$want" \
-        "$(grep -E "^${key}=" <<<"$out" || echo '<missing>')" >&2
-      failures=$((failures + 1))
-    fi
-  done
-}
-
-# has_packages CASE OUTPUT PKG... : rust_packages must include each -p PKG.
-has_packages() {
-  local name="$1" out="$2" pkgs pkg
-  shift 2
-  pkgs=" $(sed -n 's/^rust_packages=//p' <<<"$out") "
-  for pkg in "$@"; do
-    if [[ "$pkgs" != *" -p $pkg "* ]]; then
-      printf 'FAIL %s: rust_packages lacks -p %s (got%s)\n' "$name" "$pkg" "$pkgs" >&2
-      failures=$((failures + 1))
-    fi
-  done
-}
-
-nothing=(rust=false rust_packages= windows=false windows_packages= docker=false
-  audit=false core_deps=false release_versioning=false release_tag=false
-  codeql=false 'codeql_matrix={"include":[]}')
-everything=(rust=true rust_packages=--workspace windows=true
-  'windows_packages=-p gl -p git-remote-gitlawb' docker=true audit=true
-  core_deps=true release_versioning=true release_tag=true codeql=true)
-all_languages='codeql_matrix={"include":[{"language":"actions","build-mode":"none","runner":"ubuntu-latest"},{"language":"javascript-typescript","build-mode":"none","runner":"ubuntu-latest"},{"language":"rust","build-mode":"none","runner":"ubuntu-latest"},{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}]}'
-rust_only='codeql_matrix={"include":[{"language":"rust","build-mode":"none","runner":"ubuntu-latest"}]}'
-
-# Docs-only and empty input run nothing.
-check "docs only" "$(map README.md docs/x.md infra/x.tf)" "${nothing[@]}"
-check "empty input" "$(map)" "${nothing[@]}"
-
-# A crate change tests that crate and its reverse deps, nothing else.
-check "gl source" "$(map crates/gl/src/main.rs)" \
-  rust=true 'rust_packages=-p gl' windows=true 'windows_packages=-p gl' \
-  docker=false audit=false "$rust_only"
-out="$(map crates/gitlawb-core/src/lib.rs)"
-check "gitlawb-core source" "$out" rust=true windows=true \
-  'windows_packages=-p git-remote-gitlawb -p gl' "$rust_only"
-has_packages "gitlawb-core fan-out" "$out" gitlawb-core icaptcha-client \
-  gitlawb-attest git-remote-gitlawb gl gitlawb-node
-check "icaptcha-client source" "$(map crates/icaptcha-client/src/lib.rs)" \
-  'rust_packages=-p gl -p icaptcha-client' 'windows_packages=-p gl'
-
-# Anything the Rust surface cannot attribute to known crates widens.
-check "unknown crate dir" "$(map crates/no-such-crate/src/lib.rs)" \
-  rust=true rust_packages=--workspace docker=false
-check "root Cargo.lock" "$(map Cargo.lock)" \
-  rust=true rust_packages=--workspace docker=true audit=true core_deps=true \
-  release_versioning=false
-check "toolchain file" "$(map rust-toolchain.toml)" rust=true rust_packages=--workspace
-
-# Files compiled into a crate from outside crates/.
-check "bootstrap-peers.json" "$(map bootstrap-peers.json)" \
-  rust=true 'rust_packages=-p gitlawb-node' windows=false docker=true
-
-# One must-not-skip trigger per non-Rust row.
-check "Dockerfile" "$(map Dockerfile)" docker=true rust=false
-check "crate manifest" "$(map crates/gl/Cargo.toml)" \
-  docker=true release_versioning=true 'rust_packages=-p gl'
-check "audit config" "$(map .cargo/audit.toml)" audit=true rust_packages=--workspace
-check "core allowlist" "$(map ci/gitlawb-core-allowed-deps.txt)" core_deps=true rust=false
-check "release-please config" "$(map release-please-config.json)" \
-  release_versioning=true rust=false
-check "release tag resolver" "$(map scripts/resolve-release-tag.sh)" release_tag=true rust=false
-check "other workflow" "$(map .github/workflows/release.yml)" "${nothing[@]:0:9}" \
-  codeql=true 'codeql_matrix={"include":[{"language":"actions","build-mode":"none","runner":"ubuntu-latest"}]}'
-check "npm" "$(map npm/package.json)" codeql=true \
-  'codeql_matrix={"include":[{"language":"javascript-typescript","build-mode":"none","runner":"ubuntu-latest"}]}'
-check "swift" "$(map macos-app/Sources/App.swift)" rust=false codeql=true \
-  'codeql_matrix={"include":[{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}]}'
-
-# Editing the CI wiring runs every surface, exactly like --all.
-for wiring in .github/workflows/pr-checks.yml .github/workflows/codeql.yml scripts/ci-surfaces.sh; do
-  check "wiring $wiring" "$(map "$wiring")" "${everything[@]}" "$all_languages"
-done
-check "--all" "$("$mapper" --all </dev/null)" "${everything[@]}" "$all_languages"
-
-# Names git C-quotes without -z (non-ASCII, tab, quote, newline) still map.
-for name in $'\xc3\xa9.rs' $'a\tb.rs' 'a"b.rs' $'a\nb.rs'; do
-  check "quoted name $(printf %q "$name")" "$(map "crates/gl/src/$name")" \
-    rust=true 'rust_packages=-p gl'
-done
-check "non-ASCII swift" "$(map $'macos-app/Sources/Caf\xc3\xa9.swift')" codeql=true \
-  'codeql_matrix={"include":[{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}]}'
-
-# Newline-delimited input (git diff without -z) is rejected, not misread.
-if printf 'crates/gl/src/main.rs\n' | "$mapper" >/dev/null 2>&1; then
-  echo "FAIL newline-delimited input: mapper accepted it" >&2
-  failures=$((failures + 1))
-fi
-
-if [ "$failures" -ne 0 ]; then
-  echo "$failures ci-surfaces mapping check(s) failed" >&2
-  exit 1
-fi
-echo "ci-surfaces mapping: all checks passed"