VersionControl:PRs/magenta/428

magenta#428: magenta.sh merge, and memory-lane as the mailbox for merge orders

State	🟣 merged 2026-11-08 02:05:32
Worked on by	magent, re, justin
Moods	#ramp
Deploy	redeploy maybelle (after #426 and maybelle-config#286; with maybelle-config#287 for githouse to fetch orders)
Branch	magent/merge-mailbox → main, by magent-cryptograss
Opened · last pushed	2026-11-08 01:23:53 · 2026-11-08 01:32:21

**Stacked on #426** (the brakes): until #426 merges, this diff shows its three commits too. The githouse half is maybelle-config#287.

`magenta.sh merge <repo>:<branch>` merges a branch with no pull request, on an order signed with your SSH key. memory-lane is the mailbox the order travels through. Only Justin has ssh to maybelle, as root; skyler doesn't, and no phone does. So the order needs a carrier, and the signature makes it irrelevant which one (re, 7 Nov). Plan, section 8: https://pickipedia.xyz/wiki/Cryptograss:Moods/ramp/Plan

**The tool** (`tools/mood_merge.py`):
- It fetches the branch and its target from GitHub itself, into a scratch repository.
- It shows `git log` and the diffstat it computed from those commits. **It never shows text a service handed it.** That's re's test: the stand-in memory-lane offers a log and a diff of its own, and the test checks that neither one is printed. It also checks that the commit signed for is the one shown, and verifies the signature with `ssh-keygen -Y verify` in `magenta-merge`.
- On a yes, it signs, posts the order, and waits up to 2 minutes for githouse's answer.
- The target defaults to the branch each repository deploys from, from a table. It isn't guessed from which branches exist, because magenta has a `production` branch, dead since Nov 2025, and deploys from `main`.
- Your name comes from `/api/merge-orders/whose/`, by your public key, or from `--as`. That lookup is only a convenience: githouse checks the signature against its own signers.

**memory-lane:**
- `POST /api/merge-orders/` keeps a well-formed order whose expiry is within 2 hours (`MergeOrder`, migration 0047), and refuses everything during AZ5. **It keeps only orders signed by the claimed signer's key** from `allowed_signers`, in `magenta-merge` (re's review). That's a screen, not the trust check: githouse still checks every order against its own signers. It keeps strangers out of the database. The limit is 20 a minute per signer, counted only after the signature checks out, plus 300 signature checks a minute overall, to cap the `ssh-keygen` runs a stranger can cause.
- `GET /api/merge-orders/pending/` lists what githouse hasn't carried out yet, oldest first, at most 20 at a time.
- `GET /api/merge-orders/<id>/` answers from githouse's own records: `.merges/<nonce>.json`, or `.merges/mailed/<sha256>.json` for an order refused before its signature checked out. The answer is waiting, merged, refused (with the reason) or expired.
- A nonce isn't unique here. Otherwise a forgery posted first would take the nonce, and the real order couldn't be posted at all.
- **From re's review, merged in:** the tool prints control characters as `?`, so commit text or memory-lane's name answer can't redraw the screen. I extended that to everything the tool prints. `pending()` now reads every unexpired order, so 200 already-answered ones can't hide a waiting one.

Tried for real against GitHub, answering no: `magenta.sh merge magenta:magent/githouse-brakes` shows #426's three commits and "3 files changed, 54 insertions(+), 1 deletion(-)", into main, and signs nothing.

Tests: 19 new. Full suite: 1784 tests, OK.

Deploy: redeploy maybelle (after #426 and maybelle-config#286; with maybelle-config#287 for githouse to fetch orders)
Worked on by: magent, re, justin, in #ramp