DrivingThatTrain: cryptograss/magenta#428, as GitHub has it

2026-11-09T16:06:20Z

cryptograss/magenta#428, as GitHub has it

← Older revision		Revision as of 16:06, 9 November 2026
Line 16:		Line 16:
	\|deploy=redeploy maybelle (after #426 and maybelle-config#286; with maybelle-config#287 for githouse to fetch orders)		\|deploy=redeploy maybelle (after #426 and maybelle-config#286; with maybelle-config#287 for githouse to fetch orders)
	}}		}}
			<pre class="pr-body">Stacked on #426 (the brakes): until #426 merges, this diff shows its three commits too. The githouse half is maybelle-config#287.

			`magenta.sh merge <repo>:<branch>` merges a branch with no pull request, on an order signed with your SSH key. memory-lane is the mailbox the order travels through. Only Justin has ssh to maybelle, as root; skyler doesn't, and no phone does. So the order needs a carrier, and the signature makes it irrelevant which one (re, 7 Nov). Plan, section 8: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan

			The tool (`tools/mood_merge.py`):
			- It fetches the branch and its target from GitHub itself, into a scratch repository.
			- It shows `git log` and the diffstat it computed from those commits. It never shows text a service handed it. That's re's test: the stand-in memory-lane offers a log and a diff of its own, and the test checks that neither one is printed. It also checks that the commit signed for is the one shown, and verifies the signature with `ssh-keygen -Y verify` in `magenta-merge`.
			- On a yes, it signs, posts the order, and waits up to 2 minutes for githouse's answer.
			- The target defaults to the branch each repository deploys from, from a table. It isn't guessed from which branches exist, because magenta has a `production` branch, dead since Nov 2025, and deploys from `main`.
			- Your name comes from `/api/merge-orders/whose/`, by your public key, or from `--as`. That lookup is only a convenience: githouse checks the signature against its own signers.

			memory-lane:
			- `POST /api/merge-orders/` keeps a well-formed order whose expiry is within 2 hours (`MergeOrder`, migration 0047), and refuses everything during AZ5. It keeps only orders signed by the claimed signer's key from `allowed_signers`, in `magenta-merge` (re's review). That's a screen, not the trust check: githouse still checks every order against its own signers. It keeps strangers out of the database. The limit is 20 a minute per signer, counted only after the signature checks out, plus 300 signature checks a minute overall, to cap the `ssh-keygen` runs a stranger can cause.
			- `GET /api/merge-orders/pending/` lists what githouse hasn't carried out yet, oldest first, at most 20 at a time.
			- `GET /api/merge-orders/<id>/` answers from githouse's own records: `.merges/<nonce>.json`, or `.merges/mailed/<sha256>.json` for an order refused before its signature checked out. The answer is waiting, merged, refused (with the reason) or expired.
			- A nonce isn't unique here. Otherwise a forgery posted first would take the nonce, and the real order couldn't be posted at all.
			- From re's review, merged in: the tool prints control characters as `?`, so commit text or memory-lane's name answer can't redraw the screen. I extended that to everything the tool prints. `pending()` now reads every unexpired order, so 200 already-answered ones can't hide a waiting one.

			Tried for real against GitHub, answering no: `magenta.sh merge magenta:magent/githouse-brakes` shows #426's three commits and "3 files changed, 54 insertions(+), 1 deletion(-)", into main, and signs nothing.

			Tests: 19 new. Full suite: 1784 tests, OK.

			Deploy: redeploy maybelle (after #426 and maybelle-config#286; with maybelle-config#287 for githouse to fetch orders)
			Worked on by: magent, re, justin, in #ramp</pre>

DrivingThatTrain: cryptograss/magenta#428, as GitHub has it

2026-11-08T02:05:36Z

cryptograss/magenta#428, as GitHub has it

← Older revision		Revision as of 02:05, 8 November 2026
Line 5:		Line 5:
	\|url=https://github.com/cryptograss/magenta/pull/428		\|url=https://github.com/cryptograss/magenta/pull/428
	\|author=magent-cryptograss		\|author=magent-cryptograss
	\|state=~~open~~		\|state=merged
	\|base=main		\|base=main
	\|branch=magent/merge-mailbox		\|branch=magent/merge-mailbox
	\|opened=2026-11-08 01:23:53		\|opened=2026-11-08 01:23:53
	\|pushed=2026-11-08 01:32:21		\|pushed=2026-11-08 01:32:21
	\|merged=		\|merged=2026-11-08 02:05:32
	\|closed=		\|closed=
	\|worked_on_by=magent, re, justin		\|worked_on_by=magent, re, justin

DrivingThatTrain: cryptograss/magenta#428, as GitHub has it

2026-11-08T01:32:29Z

cryptograss/magenta#428, as GitHub has it

← Older revision		Revision as of 01:32, 8 November 2026
Line 9:		Line 9:
	\|branch=magent/merge-mailbox		\|branch=magent/merge-mailbox
	\|opened=2026-11-08 01:23:53		\|opened=2026-11-08 01:23:53
	\|pushed=2026-11-08 01:23:24		\|pushed=2026-11-08 01:32:21
	\|merged=		\|merged=
	\|closed=		\|closed=

DrivingThatTrain: cryptograss/magenta#428, as GitHub has it

2026-11-08T01:23:57Z

cryptograss/magenta#428, as GitHub has it

New page

{{PR
|repo=magenta
|number=428
|title=magenta.sh merge, and memory-lane as the mailbox for merge orders
|url=https://github.com/cryptograss/magenta/pull/428
|author=magent-cryptograss
|state=open
|base=main
|branch=magent/merge-mailbox
|opened=2026-11-08 01:23:53
|pushed=2026-11-08 01:23:24
|merged=
|closed=
|worked_on_by=magent, re, justin
|moods=ramp
|deploy=redeploy maybelle (after #426 and maybelle-config#286; with maybelle-config#287 for githouse to fetch orders)
}}

VersionControl:PRs/magenta/428 - Revision history

DrivingThatTrain: cryptograss/magenta#428, as GitHub has it

DrivingThatTrain: cryptograss/magenta#428, as GitHub has it

DrivingThatTrain: cryptograss/magenta#428, as GitHub has it

DrivingThatTrain: cryptograss/magenta#428, as GitHub has it