Artifact de5073dff2165bb989aff720a057fa7ea1b855734134836292fbaa5dabd693cb:
- File
cmd/quarry/main.go
-
2026-08-26 22:59:07
— part of check-in
[daa9fc84b5]
on branch protect-2
— RFC 0007 phase 2: the gate turns identity into a rule
The verified login — never the U card — becomes the per-request X-Zit-Protect the --fronted child enforces: the globs this pusher does not own, comma-separated as zit's glob lists are.
Sent on EVERY request, empty when nothing is refused. zit#151 reads an absent header as no rule, so absence is exactly what a forgotten code path would produce; here it cannot happen, and a test proves it against a fake child. The proxy builds a fresh request, so a client's header with that name never reaches the child. A rule source that cannot answer fails the push closed.
End to end with a real zit: a non-owner's push to trunk is refused with the branch named; the owner's identical push lands. (user: dmestas, size: 60589) [annotate] [blame] [check-ins using]
- 2026-08-26 23:51:51 — part of check-in [8c6e2b5b59] on branch trunk — Landed phase 2: identity becomes a rule, the child enforces it. (user: ai-local, size: 60589) [annotate] [blame] [check-ins using]
-
2026-08-26 22:59:07
— part of check-in
[daa9fc84b5]
on branch protect-2
— RFC 0007 phase 2: the gate turns identity into a rule