Crate alkgit 

alkgit: git smart protocol for the alk family.

A pure protocol crate (ADR-010, the alktty/alktunnels template) on alkcall channels — the alk/git ALPN: the git smart protocol as producer/consumer halves over the alk-family call fabric. The crate carries no binary and no front doors — the alkhttp git/lfs features and alkssh are family infrastructure (docs/architecture/ doors.md); a downstream app embeds this crate, brings its own door, and supplies the backends. The shipped substrate composition is the separate alkgit-substrate crate; this crate is substrate-free by construction. The architecture specs are docs/architecture/ (transport.md, backend.md, doors.md + the ADRs); each API’s contract stamps are on the items themselves.

The backend seam (ADR-018)

Everything the wire layer runs through: the #[async_trait] + Send + Sync trait family every backend implements (the shipped impls are the substrate crate’s) — GitRegistry / GitRegistryStore (the registry family) and GitRefs / GitPackGen / GitPackIngest (the object-storage family, the prepare/apply split with the PreparedPush seam); the repo record family (RepoRecord, the repo-id grammar validate_repo_id); the error model (RegistryError + StorageError); the budget model (Limits, ADR-009 — wall clock, request bodies, advertisement refs, negotiation rounds, haves per round, the pack size, the packless peek window, the blocking-pool concurrency); and the wire shapes both transport directions speak (RefLine, RefUpdate, RefOutcome, PushOptions).

The session substrates and serving entries (ADR-005)

Two substrate mechanisms, both taking the ADR-007 AuthorizedRepo marker by type so a session cannot reach the wire unchecked:

• duplex (§1, the pkt-line framing layer the native transport drives): Session (the request reader with the stop-delimiter discipline, the writer machinery, the RawTail raw-tail escape), the Sideband blocking-side sink, and the serving entries — serve_duplex (advertisement-once + command loop / one-request push, under the wall clock) with the resolve→authorize front serve_duplex_resolved.
• stateless (§2, the smart-http framing facts the http door mounts): StatelessRequest (the capability-dump skip, the delim-aware split, the flush-only probe, the raw-tail escape), StatelessResponse (one-shot flush, never 0002), the BodyReader door-body adapter, and the entries — serve_stateless_post (one POST = one command invocation) and serve_stateless_advertisement (the info/refs GET emission).

The protocol machines

V2 fetch (advertise_v2 — the honest capability list; serve_ls_refs — the ls-refs grammar; serve_fetch_round + parse_fetch_args — ADR-014’s ack loop and argument grammar with the rounds/haves/pack budgets) and receive-pack (advertise_v0 — the V0 push advertisement; parse_push_request + serve_receive_pack — ADR-013 §3–11 as amended by ADR-020 §1: command grammar, the bounded packless peek with the duplex/stateless tail disciplines, prepare-under-permit ingestion with the single CAS home, and the substrate-owned status report framing via bridge_pack_source, the pack stream the raw tail hands through — PackSourceFault is its typed budget class). The transport-side ACL completes the layer: authorize (the ADR-011/015 policy), validate_ref_name (ADR-013 §9’s deny-list).

The transport (producer half)

The direct-ALPN GitAdapter — the alk/git ProtocolHandler whose session boundary is the ADR-016 preamble: the request-line grammar (RequestLine, parse_request_line, read_request_line) and the channels open op (register_openable — the channels/git/sub establisher gate, ADR-016 §1). The git/repo/* op family (register_repo_ops, ADR-012 §3/§5 with the ADR-015 two-tier gate) rides the same registry.

The consumer half

GitSession (ADR-017, in the POC-X-validated shape of ADR-023): a typed git client over gix-transport’s git-daemon Connection on the alkcall BiStream compat halves, split into flat sibling modules (one workstream one file): session carries the construction + handshake workstream and the shared drain helpers both clients build on; session_fetch the fetch workstream — GitSession::ls_refs / GitSession::fetch, the client side of the V2 grammar above; session_push the hand-rolled push workstream (GitSession::push_advertisement, GitSession::push) — all bounded by the client-direction budget kinds, no credentials on the session surface (their types re-export through session, so the crate’s public paths are unchanged).

Structs

AuthorizedRepo

The authorized-repo marker (ADR-007 step 3; the marker transport.md’s session substrate layer places in the session tuples, front-door-blind per ADR-002).

BodyReader

The generic request-body adapter (POC-3’s BodyReader): bridges a byte-chunk stream into the futures::io::AsyncRead end the pkt-line codec consumes.

FetchArgs

The parsed command=fetch request (transport.md §fetch; the negotiation-captures.md round grammar): wants/haves/done and the honored args, with the request’s capability lines validated.

FetchRound

One round of the client-side fetch negotiation (GitSession::fetch): wants + haves + the done flag — a full stateless command (the caller re-sends its accumulated commons every round; ADR-014 §7, ADR-023 §6’s recorded round structure).

FetchRoundReport

One round’s parsed outcome (GitSession::fetch).

FetchRounds

The negotiation-rounds budget counter (ADR-009, ADR-014 §6): one per session (duplex) or per connection (stateless), held by the serving entries and handed to serve_fetch_round — this is budget accounting, not negotiation state: the client re-sends wants + commons every round (ADR-014 §7), and the counter only bounds a client that keeps sending rounds without progressing.

GitAdapter

The ProtocolHandler for alk/git. Construction takes the backend handles (Arc<dyn GitRegistry> + the fetch-surface and push-surface traits), Limits, the push-options negotiated-gate flag (ADR-013 §11 — default off in v1), and the server-wide pipeline-concurrency semaphore (shared across every session this adapter drives — ADR-009’s server-wide wording; the assembler’s config origin even on the in-crate adapter path).

GitSession

The typed git session — the consumer half (ADR-017 §1: the replicator’s primitive).

HandshakeResponse

The handshake’s outcome (ADR-017 §2): the protocol the peer negotiated, the capabilities it advertised, and — for the V0-framed push service — the remaining advertisement lines drained to owned payloads (gix hands the V0 reply’s refs as a borrowed reader; the borrow cannot be stored on the session, so the drain is the handshake’s tail, bounded like every read).

Limits

The per-session budget bundle (ADR-009 as amended by ADR-020 §1).

LsRefsArgs

The parsed ls-refs command arguments (the ls-refs grammar, wire side): the client-driven filtering and attribute requests.

PackSource

The blocking-side pack end (GitPackIngest::prepare’s Box<dyn io::Read + Send> filler): a std::io::Read over the bounded bridge channel. Reads serve the buffered chunk remainder first, then park on the channel (the blocking posture — futures::executor::block_on over the recv future, the wave-1/2 bridge choice, safe from any blocking thread with or without a runtime context); channel close reads as clean EOF; a relay failure reads as that io error (re-reported on later reads, the cached terminal form — no re-entry into the channel after it).

PackSourceBridge

The bridged pack source (bridge_pack_source’s output): the blocking end, the typed-failure handle, and the relay’s join handle.

PackSourceFault

The typed-failure handle the relay records through (the machine’s observable half of the failure taxonomy): a wire-side pack-size breach lands here as SubstrateError::Protocol (the client-fault budget class — 413-mapped at the door on stateless, session error on duplex, ADR-009), a transport failure as SubstrateError::Io. The handle clones cheaply (shared slot) so the machine can hold it while the boxed end moves into prepare.

PreparedPush

The prepare output of crate::GitPackIngest::prepare (ADR-018 §5).

PushAdvertisedRef

One advertised ref row of the push service’s V0 advertisement (GitSession::push_advertisement): the advertisement’s <oid> <ref> line parsed (the caps NUL-attachment rode HandshakeResponse::capabilities).

PushCapabilities

The client’s capability selection (ADR-013 §2, the parse side of the served set): every bool is the corresponding cap having been selected on the request’s first command line (NUL-attached caps).

PushOptions

Parsed push-options (ADR-018 §5) — (key, value) pairs verbatim, un-interpreted (ADR-013 §11; repeated keys preserved). None on prepare until the config gate opens; opening the gate later is value-additive.

PushReport

The push status report (GitSession::push, ADR-013 §8’s shapes parsed): the unpack ok|ng <reason> leg plus the per-ref ok|ng outcomes. The reasons are the peer’s text, verbatim (client-displayed; never rewritten).

PushRequest

The parsed receive-pack request (ADR-013 §3, ADR-020 §1):

PushSendOptions

The caller-supplied capability selections for GitSession::push (ADR-017 §3: options within the ADR-013 §2 grammar). The defaults are the plainest honest grammar: report-status only (always sent — the machine’s typed return is built on it), bare report framing, non-atomic, the crate’s own agent token.

RawTail

The raw read side the pkt-line machinery surrenders to the push machine (the raw-tail escape, ADR-013 §3 as amended by ADR-020 §1): an async reader over the bytes remaining after the request’s terminating flush — on the duplex substrate the transport’s read half past the flush, on the stateless substrate the POST body’s remaining bytes. Reads count into the substrate’s consumed-bytes counter, so the tail’s consumption reconciles against the session’s (the request-side counter) — the budget observability the wire-side pack-size relay rides (crate::pack_source::bridge_pack_source).

RefLine

RefOutcome

Per-ref CAS outcome (ADR-018 §5) — an outcome, not an error: a stale ref is a business result of receive-pack (ADR-013 §7–8). The reason string is the client-displayed ng <ref> <reason> text (server-chosen, verbatim).

RefUpdate

One prepared/applied ref update (ADR-018 §5).

RepoRecord

The per-repo registry record (backend.md §RepoRecord; ADR-011 §2 as amended by ADR-015).

Request

One parsed V2 command request (ADR-005 §1’s request reader shape): the command= line, any additional pre-delim lines, the argument lines after the 0001 delimiter, terminated by the client’s flush.

RequestLine

One parsed request line: the service the line selects and the (grammar-validated) repo id it resolves. The host= and version=2 extras are accepted verbatim and not carried — the service alone selects the state machine (ADR-016 §3).

ServiceParseError

The failure of Service::from_str: the wire value was not one of the ADR-016 enum strings.

Session

The duplex session substrate (ADR-005 §1).

Sideband

The blocking-side sideband sink (ADR-004/ADR-005 §1, POC-2’s SidebandSink): a std::io::Write end for pack generation that caps band-1 chunks at SIDEBAND_CHUNK_SIZE (65000; underneath the protocol’s own 65515 ceiling — headroom for the band byte and length prefix) and parks on a bounded channel (SIDEBAND_CHANNEL_CAPACITY) when the drain task falls behind.

StatelessRequest

The stateless request/response substrate per POST (ADR-005 §2): wraps (request-reader, response-writer, Limits, Service) into the machinery that performs the capability-dump skip, the delim-aware arg split, and the flush-only probe rule on the read side, and hands the response rules to the machine on the write side.

StatelessResponse

The stateless response end (ADR-005 §2): the http response body’s pkt-line writer, structurally confined to the response rules.

Enums

AccessAction

One grant action (ADR-015 §1 — the three-action set, lowercase serde). manage implies the lower actions per ADR-015 §2’s monotonicity; stored grant sets need not be closed under that implication — the authorize policy function (wave 2) evaluates it.

PackTailDiscipline

The pack-tail discipline the machine serves (ADR-020 §1 — one state-machine core, two tail disciplines): the two substrates differ only in how the pack’s absence is knowable below the command flush.

RegistryError

The error type of the registry family (traits 1–2: GitRegistry/GitRegistryStore) — every failure the registry family can produce, no catch-all (backend.md §RegistryError, review 002 R-2 re-scope).

RepoIdError

A precise repo-id grammar rejection (backend.md §Repo-id grammar, review 002 R-5): segment-level detail for the caller that needs to correct its id.

RequestLineError

Service

The git service a session serves (ADR-016 §3): the dimension that selects the advertisement and the state machine before any protocol byte flows.

SessionError

The typed session error (ADR-017 §6’s client-side failure vocabulary: every construction/handshake failure class one variant, no catch-all).

StatelessPost

One parsed POST body (ADR-005 §2): a command invocation, or a flush-only probe.

StorageError

The error type of the object-storage family (traits 3–5: GitRefs/GitPackGen/GitPackIngest) — the ADR-018 §7 sibling of RegistryError, no catch-all.

SubstrateError

The transport-level substrate error taxonomy (ADR-005 §4).

Visibility

Who can see a repo (backend.md §RepoRecord — public | private, lowercase serde).

Constants

ATOMIC_PUSH_FAILURE_REASON

The aborted-transaction denial of an atomic push (ADR-013 §10, observed live): on any denial of the whole-transaction CAS, the refs that would otherwise have succeeded report ng <ref> atomic push failure while the denied refs keep their own reasons (captured: ng refs/heads/dev deletion prohibited + ng refs/heads/main atomic push failure in one report). It maps twice — inside the CAS (the outcome data) and on the machine’s name-validation abort branch — where the same upstream shape holds: a name the validation rejects keeps its funny refname, the valid updates report this.

FUNNY_REFNAME_REASON

The pinned per-ref denial reason (ADR-013 §7/§9): the ng <ref> <reason> text for every validate_ref_name rejection, observed verbatim from real receive-pack (docs/research/ push-captures.md) — needs no config, exactly as upstream’s.

GIT_ADMIN_SCOPE

The platform admin scope that satisfies the op gate’s scope tier (ADR-015 §3).

GIT_ALPN

The data-plane ALPN the channel carries (ADR-010’s alk/git ALPN). Matches the ALPN returned by GitAdapter’s alpn().

LOCK_REFNAME_SUFFIX

The .lock deny-list rule (ADR-013 §9): a ref name ending in the lock suffix is the receive lockfile itself — always rejected. The rule rides the deny-list explicitly (see validate_ref_name for the double enforcement).

MAX_ADVERTISEMENT_REFS

Maximum advertisement refs in the ls-refs response (ADR-009: config-bound).

MAX_CONCURRENT_BLOCKING_TASKS

Maximum concurrent blocking pipeline tasks, server-wide (ADR-009: the blocking-pool budget — pack generation and pack ingestion alike are spawn_blocking consumers; enforced at acceptance time, not per-byte).

MAX_HAVES_PER_ROUND

Maximum haves per negotiation round (ADR-009). The client’s stateless doubling legitimately reaches 16384, so the default sits at or above it.

MAX_NEGOTIATION_ROUNDS

Maximum negotiation rounds on fetch (ADR-009): protocol V2 negotiation without done.

MAX_PACK_SIZE_BYTES

Maximum receive-pack size, in bytes (ADR-009: config-bound, tens of MB in v1; receive-pack is the untrusted-input path and carries the hard cap — fetch’s pack size is a function of the repo, not the request, and is not budgeted in v1).

MAX_REQUEST_BODY_BYTES

Maximum http POST request-body size, in bytes (ADR-009: the same budget as MAX_PACK_SIZE_BYTES).

MAX_REQUEST_LINE_BYTES

The request line’s byte cap (convention 11 — bounded resources): the grammar’s largest legitimate shape (a maximal two-segment repo id, a host, the version token) is far below this; the cap is the rejection surface, never a silent truncation.

OP_GIT_OPEN

The per-ALPN open operation name (channels/<alpn>/sub convention, ADR-047). Git is consumer-opens (the client requests a fetch/push session), so the op is sub.

OP_GIT_REPO_CREATE

The op name minting a repo record (ADR-012 §3; backend.md §git/repo/* op JSON schemas).

OP_GIT_REPO_DELETE

The op name removing a repo record (ADR-012 §3).

OP_GIT_REPO_GET

The op name reading a repo record (ADR-012 §3; single read; list is a v2 additive op).

OP_GIT_REPO_UPDATE

The op name patching a repo record (ADR-012 §3, review 002 R-3 — PATCH).

PACKLESS_PEEK

The packless-delete bounded-peek budget (ADR-020 §1): the POC-tested 750 ms — a fast push’s pack header is immediate, and a packless client is already waiting.

PACK_SOURCE_CHANNEL_CAPACITY

Bounded capacity of the pack-source bridge’s channel (ADR-005 §1’s bounded rule, the sideband sink’s posture mirrored onto the inbound stream): either side that falls behind parks — no unbounded buffer.

PACK_SOURCE_CHUNK_SIZE

The relay’s per-read chunk cap: reads through the tail request at most this many bytes, and each channel message carries at most this many — the buffer bound (ADR-009’s bounded-resources posture: budgets bound aggregate work, internal buffering stays capped).

PUSH_SERVED_CAPABILITIES

The honest V0 push served set (ADR-013 §2): exactly what the wire layer serves — nothing unimplemented advertised. quiet is absent by decision (a client-side preference; ADR-013 §2), push-options rides the gate (ADR-013 §11, appended when the assembler enables it), and agent=alkgit/<crate version> appends per the upstream agent convention.

REPO_ID_MAX_BYTES

The maximum serialized length of a repo id, in bytes (backend.md §Repo-id grammar).

REPO_RESOURCE_TYPE

The alkcall ownership resource type the create op’s mint records (alkcall ADR-011 OwnershipStore::record — spawn-tracking).

RESERVED_REF_NAMESPACES

The reserved refs/ prefixes of the deny-list (ADR-013 §9): the namespaces alkgit’s own host metadata reserves inside the ref table. Wire pushes can never create a ref under them — the reservation is the point. Exact contents are the ADR’s implementation-time detail, not an architecture variable.

SESSION_WALL_CLOCK

Session wall-clock budget (ADR-009: all sessions, tens of minutes — enforced by transport’s session loop on every door; alkcall channel caps add a second bound where channels exist).

SIDEBAND_CHANNEL_CAPACITY

Bounded capacity of the sideband sink’s channel (ADR-005 §1: the sink parks on a bounded channel — no unbounded buffer). Small by construction: the driver parks when the drain falls behind, which is the intended backpressure.

SIDEBAND_CHUNK_SIZE

Sideband chunk size, in bytes (ADR-009): fixed per protocol at 65000 — not a Limits field. The substrate task consumes it.

UNPACKER_ERROR_REASON

The all-refs denial of an unpack ng leg (ADR-013 §8, the observed raw-stdio shape): a pack-level failure reports ng <ref> unpacker error for every ref — no per-ref reason survives a failed unpack. Constant because the reasons clients display must be stable.

Traits

GitPackGen

Pack generation + the negotiation ack seam (ADR-018 §4; object-storage trait 4). Generation is negotiation-agnostic (ADR-004’s pipeline; backend.md authoritative).

GitPackIngest

Pack ingestion (ADR-018 §4; object-storage trait 5).

GitRefs

Ref listing + ref transactions (ADR-018 §4; object-storage trait 3 — StorageError).

GitRegistry

The registry read trait (ADR-012 §1 as amended by review 001 A-2) — repo id → RepoRecord, the authoritative mapping (ADR-008).

GitRegistryStore

The registry write supertrait (ADR-012 §1; alknet ADR-035’s read/write split shape — read on the wire hot path, write on the management path).

PktLineWriter

The pkt-line text/flush framing plus the packfile section’s data band — both substrates expose the same surface (ADR-005 §3’s substrate-agnostic shape): the machines write through this surface and never see a duplex- or stateless-specific type.

Functions

advertise_v0

Writes the V0 push ref advertisement (ADR-013 §2), capture-exact against push-captures.md §Advertisement: capabilities NUL-attached on the first emitted ref line, remaining ref lines bare, flush-terminated; the capabilities^{} sentinel with the caps NUL-attached replaces the ref lines exactly when the listed set (after the no-oid filter) is empty.

advertise_v2

Writes the V2 capability advertisement (ADR-003): version 2, the honest capability list, flush. Emitted once per duplex session / per-request-set on the stateless substrate — the once-only discipline is the serving entries’ (the machine writes one advertisement, on call).

authorize

The per-repo policy function (ADR-011 §3 as amended by ADR-015 §2).

authorize_repo_op

The two-tier repo-op gate (ADR-015 §3): the delete/update/get ops’ handler-side rule — global admin scope OR manage grant.

bridge_pack_source

Bridges the async pack-tail reader into the blocking end prepare consumes: spawns the relay task over a bounded channel and returns the bridge triple — the blocking end (box it for the Box<dyn io::Read + Send> parameter), the PackSourceFault handle (clone it into the machine), and the relay join handle (await it only after the ingestion has finished with the blocking end — dropping or exhausting the end is what breaks the relay, the break-before-join discipline).

git_open_spec

Builds the OperationSpec for channels/git/sub.

git_repo_create_spec

Builds the OperationSpec for git/repo/create (backend.md §git/repo/* op JSON schemas): {repo_id, visibility} in — no placement fields (ADR-019 §8), no grants field (an explicit grants field is an admin-shape extension, NOT v1) — and {repo_id, visibility} out. The gate is the pure-scope AccessControl (required_scopes: ["git:repo:create"], ADR-015 §3); additionalProperties: false (the extension rule).

git_repo_delete_spec

Builds the OperationSpec for git/repo/delete: {repo_id} in, {} out. Empty AccessControl — the handler evaluates authorize_repo_op (ADR-015 §3). The declared error set is the backend.md delete row: unauthorized (the collapsed denial) + io.

git_repo_get_spec

Builds the OperationSpec for git/repo/get: {repo_id} in, the record {repo_id, visibility, grants} out (no placement fields — ADR-019 §8). Empty AccessControl — the handler evaluates authorize_repo_op. The declared error set is the backend.md get row: unauthorized (collapsed), io.

git_repo_update_spec

Builds the OperationSpec for git/repo/update: {repo_id, visibility?, grants?} in (both optional — PATCH, review 002 R-3; grants present replaces the whole map), the post-write record {repo_id, visibility, grants} out. Empty AccessControl — the handler evaluates authorize_repo_op. The declared error set is the backend.md update row: unauthorized (collapsed), invalid, io.

parse_fetch_args

Parses command=fetch request lines (transport.md §fetch): the capability lines (agent / object-format) and the argument lines.

parse_ls_refs_args

Parses the ls-refs argument lines (the args after the 0001 delimiter of a command=ls-refs request — one argument per pkt-line, ref-prefix <prefix> riding one line with its value). Unknown arguments, a missing ref-prefix value, and an empty prefix are session errors — fail closed (ADR-009’s posture: never guess at what was meant).

parse_push_request

Parses a receive-pack request (ADR-013 §3, as amended by ADR-020 §1; grammar-exact against push-captures.md §Request):

parse_request_line

Parses one request-line payload (the bytes inside the pkt-line frame, without the length prefix) into the session-establishment inputs. Both ADR-016 service shapes parse; the version dispatch rides the parse too — a fetch line without version=2 or with an unrecognized version token is the V0/V1-decline path (ADR-003), before any advertisement.

read_request_line

Reads the request line off the stream start — the direct-ALPN path’s first frame, consumed before any server byte (the connection is symmetric; without this in-band carrier the path would deadlock, ADR-016 §2).

register_openable

Registers the channels/git/sub open op on a per-connection ChannelCore — the assembly layer’s one-call registration of the spec + establisher + open handler (register_openable from the git adapter’s shared backend handles; typically the same handles, push-options negotiated-gate flag (ADR-013 §11), Limits, and pipeline semaphore the direct-ALPN GitAdapter holds).

register_repo_ops

Registers all four git/repo/* op pairs on an OperationRegistry (ADR-012 §3 — the assembler’s entry, mirroring register_openable’s one-call pattern). Takes the Arc<dyn GitRegistryStore> the ops wrap and the Arc<dyn OwnershipStore> the create op’s mint records into (v1 keeps the mint — the recorded optional-downgrade is a future additive change, ADR-015 §4).

serve_duplex

The duplex serving entry (ADR-002’s first session entry point, as amended by ADR-016 §3): turns (authorization inputs, service, duplex stream, Limits, backend handles) into a running protocol session. This is the entry the GitAdapter and the channels open op drive (the wave-2 native transport), and the shape an embedder’s stream door drives directly.

serve_duplex_resolved

The ADR-007 front over the registry (steps 2–3, the duplex entry’s pre-protocol gate): resolves the wire-repo id against the GitRegistry, evaluates authorize with the action the service selects (read for fetch, write for push — ADR-011/015), constructs the AuthorizedRepo marker, and hands the established session to serve_duplex.

serve_fetch_round

Serves one command=fetch round (ADR-014): budgets, the request parse with the object-format check, the no-done acknowledgments shape, and the done round’s packfile section.

serve_ls_refs

Serves one ls-refs command (ADR-005 §3’s machine core): the listed ref set is capped fail-closed, filtered by the client’s ref-prefix, streamed as ref lines, and the response ends at flush.

serve_receive_pack

Serves one receive-pack invocation (ADR-013 §3–8, as amended by ADR-020 §1) — the push state machine, the substrate-agnostic core the serving entries call with the parsed request’s raw tail.

serve_stateless_advertisement

The door’s info/refs GET emission (doors.md’s advertisement route): the smart prefix (# service=git-{upload,receive}-pack, its flush) followed by the capability advertisement as a stateless response ending at flush — the shape the client caches and re-sends inside its first POST, and the door serves this entry without touching pkt-line APIs. The Content-Type is the door’s.

serve_stateless_post

The stateless serving entry (ADR-002’s second session entry point, the stateless tuple of ADR-016 §3): one POST body is one command invocation, the same machines as the duplex session run under it with no cross-request state (ADR-014 §7 — each POST re-derives cleanly, the client re-sends wants + commons every round, and this entry holds nothing between invocations).

validate_ref_name

The transport-side ref-name validation (ADR-013 §9): pass iff the name is a valid git refname under gix_validate::reference::name and outside alkgit’s deny-list — the reserved RESERVED_REF_NAMESPACES and the LOCK_REFNAME_SUFFIX rule.

validate_repo_id

Validate a repo id against the pinned grammar (backend.md §Repo-id grammar, review 002 R-5): one or two path segments (owner/name; a single segment is the valid legacy/local shape), lowercase alphanumerics and -/_ per segment, segments non-empty, at most REPO_ID_MAX_BYTES bytes total.

Type Aliases

GitTransport

The session’s gix-transport construction (ADR-023 §2): gix-transport’s git-daemon client Connection over the alkcall BiStream split halves, compat-wrapped — the POC-X-validated transport shape re-landed in-crate.