Ting/Jostoph

Watch

Fork 2

remotes: SSH is read-write — drop the credential helper and the origin rewrite #100

Merged

larandar merged 1 commit from tango/99-ssh-is-rw into main

2026-08-28 21:15:54 +00:00

larandar commented

2026-08-28 21:04:36 +00:00

Owner

Owner ruling, 2026-08-28: SSH for read-write, HTTPS for shallow clone. Two things in this file contradict it, and #97/#98 made one of them worse.

Design

The credential row was not lost — it was removed on purpose

#97 read the absence of credential.https://jo.et0.pw.helper from check's settings table as an accident, on the evidence that config-get/config-set still carried a dead "git" scope, and #98 restored it. That reasoning was wrong. Under the transport split, a push authenticates with the machine's forge key; HTTPS is for taking a cheap read. Wiring a credential helper into every repo's local git config serves neither.

Removing it also deletes a failure mode this file had been spending effort on: a helper answering with an empty password when the token is unexported, which the forge reports as "credentials expired" rather than "credentials missing". ting:token existed only to explain that symptom, so it goes with the row. The "git" scope goes too — it has no rows again, and standing open as a capability nothing uses is exactly the dead code #97 complained about.

`remotes` must stop rewriting origin to HTTPS

The rewrite's own comment gave its reason as "the same host the credential helper above already trusts, so HTTPS with that helper is enough; no ssh key negotiation needed for a plain clone/push." With the helper gone, that premise is void — and the rewrite was actively harmful: it took repos that could push with the machine's forge key and left them unable to push without an exported token.

Measured 2026-08-28: lar.ad/flake-ops, whose origin this task had rewritten to HTTPS, failed jj git push with Authentication failed, while lar.ad/dendrite, swarm/hydramem and Ting/Jostoph — still on ssh — pushed fine.

The URL becomes a report, in the same family as governance and default-branch: a repo on HTTPS is told it cannot be pushed to without a token, and the operator decides. Rewriting someone's remote is not a doctor's business when the transport is a deliberate choice.

sr removal is untouched — sr.ht is retired and a leftover mirror remote is real drift.

default-branch keeps the stderr fix from #98; that part stands on its own, and over ssh it now resolves with no token at all.

Specification Delta

REMOVED the [git, 'credential.https://...'] row, the "git" scope in config-get/config-set, and ting:token
CHANGED ting:remotes: origin URL reported, never rewritten; chain returns to config -> remotes
UNCHANGED sr removal, and default-branch's stderr fix

Verification

lar.ad/flake-ops, origin still HTTPS from the old rewrite:

WARN ⚠ origin — https://jo.et0.pw/lar.ad/flake-ops.git is HTTPS; read-write wants ssh,
     and a push here needs an exported token

After jj git remote set-url origin ssh://[email protected]/lar.ad/flake-ops.git, with no token in the environment:

INFO ✅ origin — ssh://[email protected]/lar.ad/flake-ops.git
INFO ✅ default-branch — fastlane
INFO ✅ doctor — reconciliation complete

A clean run needing no token at all is the point of the ruling, and it is what the file now produces.

Closes #99

Owner ruling, 2026-08-28: **SSH for read-write, HTTPS for shallow clone.** Two things in this file contradict it, and #97/#98 made one of them worse. ## Design ### The credential row was not lost — it was removed on purpose #97 read the absence of `credential.https://jo.et0.pw.helper` from `check`'s settings table as an accident, on the evidence that `config-get`/`config-set` still carried a dead `"git"` scope, and #98 restored it. That reasoning was wrong. Under the transport split, a push authenticates with the machine's forge key; HTTPS is for taking a cheap read. Wiring a credential helper into every repo's local git config serves neither. Removing it also deletes a failure mode this file had been spending effort on: a helper answering with an **empty password** when the token is unexported, which the forge reports as *"credentials expired"* rather than *"credentials missing"*. `ting:token` existed only to explain that symptom, so it goes with the row. The `"git"` scope goes too — it has no rows again, and standing open as a capability nothing uses is exactly the dead code #97 complained about. ### `remotes` must stop rewriting origin to HTTPS The rewrite's own comment gave its reason as *"the same host the credential helper above already trusts, so HTTPS with that helper is enough; no ssh key negotiation needed for a plain clone/push."* With the helper gone, that premise is void — and the rewrite was actively harmful: it took repos that could push with the machine's forge key and left them unable to push without an exported token. Measured 2026-08-28: `lar.ad/flake-ops`, whose origin this task had rewritten to HTTPS, failed `jj git push` with `Authentication failed`, while `lar.ad/dendrite`, `swarm/hydramem` and `Ting/Jostoph` — still on ssh — pushed fine. The URL becomes a **report**, in the same family as `governance` and `default-branch`: a repo on HTTPS is told it cannot be pushed to without a token, and the operator decides. Rewriting someone's remote is not a doctor's business when the transport is a deliberate choice. `sr` removal is untouched — sr.ht is retired and a leftover mirror remote is real drift. `default-branch` keeps the stderr fix from #98; that part stands on its own, and over ssh it now resolves with no token at all. ## Specification Delta - **REMOVED** the `[git, 'credential.https://...']` row, the `"git"` scope in `config-get`/`config-set`, and `ting:token` - **CHANGED** `ting:remotes`: origin URL reported, never rewritten; chain returns to `config -> remotes` - **UNCHANGED** `sr` removal, and `default-branch`'s stderr fix ## Verification `lar.ad/flake-ops`, origin still HTTPS from the old rewrite: ``` WARN ⚠ origin — https://jo.et0.pw/lar.ad/flake-ops.git is HTTPS; read-write wants ssh, and a push here needs an exported token ``` After `jj git remote set-url origin ssh://[email protected]/lar.ad/flake-ops.git`, **with no token in the environment**: ``` INFO ✅ origin — ssh://[email protected]/lar.ad/flake-ops.git INFO ✅ default-branch — fastlane INFO ✅ doctor — reconciliation complete ``` A clean run needing no token at all is the point of the ruling, and it is what the file now produces. Closes #99

larandar added 1 commit

2026-08-28 21:04:36 +00:00

remotes: SSH is read-write — drop the credential helper and the rewrite 40ed70b157

Owner ruling: SSH for read-write, HTTPS for shallow clone. #98 restored the
credential.https helper on the reasoning that its absence was an accident;
it was not. The helper, its dead "git" scope and ting:token all go.

remotes stops rewriting origin to HTTPS. Its reason was that HTTPS 'with the
credential helper above is enough' — void now, and the rewrite was harmful:
it left repos unable to push without an exported token, measured against
flake-ops while ssh repos pushed fine. The URL is reported instead.

sr removal and default-branch's stderr fix both stand.

Closes #99

Co-Authored-By: Claude Opus 5 <[email protected]>

larandar merged commit 40ed70b157 into main

2026-08-28 21:15:54 +00:00

larandar deleted branch tango/99-ssh-is-rw

2026-08-28 21:15:54 +00:00

larandar referenced this pull request from a commit

2026-08-28 21:19:12 +00:00

devenv: bump the doctor input to Jostoph 40ed70b1 (#423)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Ting/Jostoph!100

No description provided.

Rows
Columns

remotes: SSH is read-write — drop the credential helper and the origin rewrite #100

Design

The credential row was not lost — it was removed on purpose

remotes must stop rewriting origin to HTTPS

Specification Delta

Verification

`remotes` must stop rewriting origin to HTTPS