VersionControl:PRs/maybelle-config/286

maybelle-config#286: githouse merge: a branch merged without a pull request, on a signed order

State	🟣 merged 2026-11-08 02:05:44
Worked on by	magent, re, justin
Moods	#ramp
Deploy	redeploy maybelle, with magenta#426 merged first or alongside (githouse's image is rebuilt and its tests run in the build)
Branch	magent/githouse-merge → production, by magent-cryptograss
Opened · last pushed	2026-11-07 17:35:23 · 2026-11-08 00:28:15

The githouse half of [[Cryptograss:Moods/ramp/Plan]] section 8, as revised after re's review (rev 14974). The tool that signs orders (`magenta.sh merge`) and memory-lane telling the Moods are separate magenta PRs, next.

**The order.** A merge order is plain text. It names the repository, the branch, its head commit, the branch it goes into (`into`), who signs it (`by`), a nonce and an expiry, and it's signed with `ssh-keygen -Y sign -n magenta-merge`. To run it on maybelle:

```
ssh <maybelle> docker exec -i -u git githouse python3 /opt/githouse/githouse.py merge   # {"order", "signature"} on stdin
```

**githouse checks it**, not memory-lane, against `/etc/githouse/merge_signers`. Ansible writes that file from hunter's inventory, listing only `githouse_mergers`; that's `[justin, skyler]` (Justin, 7 Nov). skyler's key is ssh-rsa, and a test merges on an RSA-signed order. The namespace is separate from sign-ins, so a sign-in signature (`magenta-moods`) can never act as a merge order.

githouse refuses an order:
- not signed by a merger, in that namespace
- with any word changed after signing
- whose nonce is already spent. A refused order spends its nonce too, so it can't be replayed later.
- that has expired, or was made to last longer than two hours
- whose branch has moved on GitHub or on githouse since signing
- that targets anything but GitHub's own branches
- whose commit is already in the target
- that conflicts with the target

**The merge.** `merge-tree --write-tree` plus `commit-tree`, so no worktree is needed: `--no-ff`, exactly the signed commit, with "Merge <repo>:<branch> (<commit>)" and "Signed by <name>" in the message. **It's pushed to GitHub first.** Until the flip, githouse force-fetches GitHub's branches every minute, so a merge written into githouse first would be overwritten (re). The fetch then brings it back, and the branch name moves to `refs/merged/` as usual. A non-forced push means that if the target moved in the meantime, nothing merges.

**The record.** Each order, its signature and its outcome are kept as `/srv/git/.merges/<nonce>.json`, with spent nonces in `.merges/nonces/`. That's on `/mnt/persist` on maybelle, so a redeploy doesn't make an unexpired order valid again (re). memory-lane already mounts this directory read-only, and a magenta PR will have it tell the Moods.

**Said plainly (re):** the signature makes the transport irrelevant. "Over your own ssh to maybelle" is a convenience, not part of the trust. Justin's ssh to maybelle is root, so for Justin the check is a record and a guard against mistakes, not a barrier. It's a real barrier for any other merger, and for anything that reaches githouse without root.

**Not here:** the tool's rule that it shows `git log` and the diffstat it computed itself, never text a service hands it. re asked for a test of that; it belongs in the magenta PR for `magenta.sh merge`.

**Tests:** githouse is at 27 (17 existing + 10 new), on real repositories and with real ed25519 keys made in the test. They cover:
- a merge pushed to GitHub with the right parents
- an order that's good only once
- a refused order spending its nonce
- four kinds of wrong signer
- a changed word after signing
- expiry
- a branch that moved
- a conflict
- wrong targets
- something that isn't an order at all

I rendered `merge_signers` by hand against the inventory: one line, justin's. render-diff runs in CI; there's no ansible in my container.

**The brakes** (Plan, section 10; `61e88fe8`). Removing someone from the GitHub org stops them merging today. githouse pushes with its own deploy key, so once merges go through githouse, the org can't stop anyone, and these have to. An order is refused if any of these holds:
- **root has frozen merging.** The freeze is `/mnt/persist/githouse/etc/frozen`, and githouse sees that directory read-only, so only root on maybelle can make or remove it. A redeploy leaves it alone.
- **AZ5 is on.**
- **the signer is banned.**

githouse asks memory-lane's `/api/brakes/` (magenta#426) about AZ5 and bans at every order. Only an explicit "no" to both lets the merge go ahead. No answer, or an answer that leaves the signer out, refuses it. A braked order's nonce is spent. The deploy checks that githouse can reach `http://10.0.0.2:3000/api/brakes/`. Eight new tests, and each one fails with the brake call taken out.

Deploy: redeploy maybelle, with magenta#426 merged first or alongside (githouse's image is rebuilt and its tests run in the build)
Worked on by: magent, re, justin, in #ramp