Resolves review 001 finding A-1 (critical): ADR-012 §3's "scope
git:admin OR ownership" gate is not expressible in alkcall's
AccessControl (AND-composition). Resolution is the review's option (a)
shape with the OR-term generalized: the per-repo grant action set gains
manage, authorize(record, identity, read|write|manage) becomes the
single policy function for git access and repo administration, and the
delete/update/get gate is admin scope OR manage grant (handler-side,
generic FORBIDDEN, unknown-repo = unauthorized per ADR-008). Repo
create seeds the creator's {read, write, manage} grants —
administration is grantable, so collaborators/bots/app-compiled roles
work without global scopes. Ownership stays as alkcall spawn-tracking
(mint at create unchanged); "ownership never implies git access" is
superseded.
- ADR-015 (new): manage grant tier, op gate, flat-grants-as-replication-
substrate, opaque grant-key rule
- ADR-011: action set + policy domain amended, references updated
- ADR-012 §3: gate table replaced, two-tier paragraph superseded
- backend.md/doors.md/overview.md: gate + grant restatements, ADR tables
- OQ-16 (new, deferred(scope)): grant-key identity namespace —
globally-comparable ids for cross-assembly/replicator grant state;
tracker task tasks/architecture/oq-16-grant-identity-namespace.md
- review 001: A-1 marked resolved (ADR-015)
- vision.md: supersession notes (Internal-ops framing, v1 grant set)
Verification: cargo test, clippy -D warnings, fmt --check, doc --no-deps
all clean.
- ADR-014: the multi-round ack loop, grounded in duplex git 2.43.0
captures cross-checked against fetch-pack.c: no-done rounds get
acknowledgments (ACK <oid> per recognized have, NAK when none, flush;
never ready so FLUSH is always the terminator), the done round
generates closure(wants) - closure(haves) with no cross-round server
state (clients re-send wants + commons every round), wait-for-done
stays (no capability change), want-less rounds answered empty, the
ack check is a new GitPackGen::common_haves seam (honest boundary at
the trait), budgets unchanged kinds
- docs/research/negotiation-captures.md: the normative negotiation
record (grammar, client behavior, malformed-section failure modes)
- transport.md: fetch section rewritten to the decided loop; references
updated
- OQ-02 resolved
Verification: cargo test / clippy -D warnings / fmt --check / doc pass
Structural decision (OQ-09 resolved): alkgit follows the alktty/
alktunnels template — a single published protocol crate on alkcall
channels, no binary, no front doors.
- ADR-010 supersedes ADR-001 (crate decomposition) and ADR-006
(http router factory); both marked Superseded
- Single crate at repo root: Cargo.toml with gix feature (default-on
backend implementations; wire layer compiles without it —
gix-hash always-on with sha1 per the compile-time-rejected
invariant), crates/ workspace deleted, src/lib.rs stub in place
- doors.md replaces http.md/ssh.md/alkgitd.md: alkhttp git-feature
sequencing (after first publish), alkssh requirement (fixed-grammar
exec dispatch), native alk/git path, downstream assembly
- backend.md replaces storage.md: GitRegistry/GitRefs/GitPackGen/
GitPackIngest traits (ingest validates, refs commits — single CAS
home), gix feature encodes POC-2 prerequisites
- transport.md reframed for the single crate; backend traits replace
hook traits in the public API
- OQ-09 resolved (all five sub-decisions in ADR-010), OQ-01 resolved
(subsumed), OQ-03 narrowed to publish-freeze, OQ-08 narrowed to
registry identity + vault placement, OQ-07 rescoped to the gix
feature's registry impl
- vision.md v2: single-binary/monorepo framing corrected as
init-agent artifact; POC checklist marked complete
- AGENTS.md + .opencode agent specs updated to the new shape
Verification: cargo build (default + no-default-features), cargo test
--all-features, clippy --all-features -D warnings, fmt --check all
pass. Third review round: zero critical, all warnings/suggestions
addressed (GitPackGen signature amended in ADR-004, stale anchors
fixed, ADR-006 body tense normalized, CAS split stated, vision
residuals cleaned).
- real git 2.43 clones/fetches/tag-checkouts over http:// through the full
alkcall -> alkhttp path (Connection::from_bidi(http/1.1) -> HttpAdapter ->
axum custom routes); h2c clone also verified
- request bodies stream (measured): BodyDataStream yields one hyper-read
chunk per poll_next; dribble probe + git's forced-chunked POST path
- pack responses stream under back pressure: bounded mpsc -> Body::from_stream,
O(counts) RSS on a 60k-object clone (peak ~8 MB above idle at 5.33 MB pack)
- protocol correction for git-protocol.md: http V2 responses end at the
flush; the 0002 response-end pkt is synthesized by remote-curl, never on
the wire; first POST carries the cached capability dump; flush-only POST
(probe_rpc) wants 200 + empty body
- POC-3 outcome recorded in pocs.md; alk-stack.md item 2 resolved
Verification: cargo test / clippy -D warnings / fmt --check clean
- pocs.md: define both modes + per-POC assignment (POC-1/2 standalone at
/workspace/alkgit-pocN, POC-3 branch mode); findings are the
deliverable, POC source never merges to main
- sdd_process.md: phase 0 + POC Specialist sections cover both modes
- poc-specialist.md: mode determination up front, standalone environment
section, 'stay in your lane' principle updated
- AGENTS.md: lifecycle status describes the two modes
Verified: none needed (markdown only)
glm-5.3-flash