VersionControl:PRs/maybelle-config/289

maybelle-config#289: githouse: the merge button's orders, signed by memory-lane for whoever pressed

State	🟣 merged 2026-11-09 00:30:33
Worked on by	magent, justin, re
Moods	#ramp
Deploy	redeploy maybelle, with magenta#433
Branch	magent/device-merge → production, by magent-cryptograss
Opened · last pushed	2026-11-08 16:53:09 · 2026-11-08 16:57:23

githouse's half of the merge button (Plan, section 10). memory-lane's half is magenta#433.

A phone has no key, so memory-lane signs with its own. Justin made it on 8 Nov, and the private half is in the vault as `memory_lane_merge_key`. The order names whoever pressed in a `for` line.

**githouse:**
- `merge_signers` gains `memory-lane namespaces="magenta-merge" <its public key>`.
- An order with `for` merges only if the presser is listed in their own right.
- The brakes are asked about the presser, never about the key (re). Banning Skyler stops Skyler's presses at once.
- Only an order by `memory-lane` may carry `for`, and it must; `for: memory-lane` is refused.
- memory-lane's key can sign only as memory-lane.
- The merge commit says "Pressed by justin, signed by memory-lane" and is authored by the presser.

**memory-lane:**
- Gets the key at `/etc/magenta/merge_key`, as the vault holds it, base64 or not; memory-lane reads either. The file is uid 1000, mode 0400. If the vault has no key, the file is empty and there's no button.
- Gets `GITHOUSE_MERGERS`, which decides what it offers. githouse checks again either way.

Tests: 4 new (a press merges as the presser; someone who may not merge; a braked presser; who may carry `for`). githouse: 46, all pass. `render_diff`: 3 changed, 1 new, nothing failing to render.

Deploy: redeploy maybelle, with magenta#433
Worked on by: magent, justin, re, in #ramp