VersionControl:PRs/maybelle-config/287

maybelle-config#287: githouse: merge orders by mail, from memory-lane

State	🟣 merged 2026-11-08 02:06:00
Worked on by	magent, re, justin
Moods	#ramp
Deploy	redeploy maybelle (with or after magenta#428; until memory-lane has the mailbox, githouse logs once that it didn't answer and merges nothing by mail)
Branch	magent/githouse-mailbox → production, by magent-cryptograss
Opened · last pushed	2026-11-08 01:24:03 · 2026-11-08 01:18:08

**Stacked on #286** (githouse merge and its brakes): until #286 merges, this diff shows its commits too. memory-lane's half is magenta#428.

githouse takes merge orders by mail. Only Justin has ssh to maybelle, as root; skyler doesn't, and no phone does. So memory-lane keeps signed orders, unread, and githouse fetches them from `/api/merge-orders/pending/` every 5 seconds. Each one goes through `merge()`, which checks the signature, the nonce, the expiry and the brakes exactly as for an order given at the command line. A compromised memory-lane can delay or drop an order, never forge one. Plan, section 8.

- **Tried once.** An order refused before its nonce is spent (unsigned, say) isn't tried again every 5 seconds. One whose nonce is spent is skipped. A refusal from before the signature checked out is kept as `.merges/mailed/<sha256 of order NUL signature>.json`, so memory-lane can tell the sender why.
- **One lock** around a merge and the minute's fetch of GitHub's branches, so neither trips over the other's refs.
- **memory-lane down** is logged once, not on every look.
- **ansible** sets `GITHOUSE_ORDERS` to `http://10.0.0.2:3000/api/merge-orders/pending/`.

Tests: 5 new (a mailed order merges once; a forgery ahead of the real order, with the real one's nonce; a mailed order is braked like any other; memory-lane down is logged once; no URL set). githouse: 42, all pass.

Deploy: redeploy maybelle (with or after magenta#428; until memory-lane has the mailbox, githouse logs once that it didn't answer and merges nothing by mail)
Worked on by: magent, re, justin, in #ramp