feat(git): establish Gitoxide repository admission and import

[zhiiw]

Summary

Establish one owner-bound Gitoxide repository admission and fresh source-import boundary without restoring bundled Git or discovering system Git.

• one-request/one-response Rust helper with isolated strict Gitoxide configuration;
• owner-bound helper artifact, invocation, and repository-admission capabilities;
• explicit checksum verification for every claimed commit, tree, and blob before parsing, recursion, or copy;
• one bounded verified tree walker shared by source preflight and copy;
• the sole managedTreePolicyVersion: 2, admitting only a deterministic .gitattributes subset and rejecting the retired version 1;
• fresh-only destination claim and deterministic zero-parent baseline publication;
• one absolute public-operation deadline covering artifact/path preflight and helper execution, followed by bounded process-tree termination and output drain;
• one exhaustive Rust/TypeScript helper error contract.

Primary invariant

Only an admitted short-lived Gitoxide helper invocation may establish the immutable repository identity and source graph used by later managed-workspace operations. A claimed Git OID is accepted only when the object bytes recompute to that exact SHA-1. The admission capability prevents later callers from resubmitting the source path, HEAD/tree identity, helper identity, or tree policy.

Source preflight and copy use the same bounded verified graph walker. Policy v2 rejects path components that cannot be safely materialized across Linux, macOS, and Windows, including Windows device names, reserved/control characters, trailing dots/spaces, .git aliases, and folded path collisions. Canonical .gitattributes files are bounded to 64 KiB and may contain only comments/blank lines, * text=auto eol=lf, and literal portable-path export-ignore rules; filters, encodings, ident expansion, wildcards, and unknown attributes fail closed before destination claim.

Failure and trust boundaries

• SHA-256 is explicitly rejected; unknown formats are normalized to unknown and fail closed without system-Git fallback.
• All source/ref/policy/object-graph preflight completes before an atomic create_dir() destination claim.
• Existing paths—including partial imports, foreign repositories, and the source itself—are rejected without takeover or deletion.
• Inspection has a 5-second deadline; source import has a 10-minute deadline. The deadline starts at the public entry before artifact/path preflight. Repository metadata is bounded before Gitoxide open by bytes, entry count, and depth; resource limits are admission limits, not an SLA.
• This PR verifies helper bytes immediately before path-based spawn, but does not claim resistance to malicious same-user replacement in the verify→exec window. Production use requires a packaged-release trust root and protected installation directory.
• Durable receipt/quarantine/recovery ownership and a state-root-bound destination capability remain follow-up work.
• No Desktop/CLI/Write/Edit consumer is included. This PR is merge-ready enabling infrastructure, not a claim that the managed-workspace product path is ready to enable.

Verification

• Rust 1.98 formatting and helper suites pass on Ubuntu, macOS, and Windows.
• Real-helper Runtime Host contracts pass on all three platforms.
• Regression coverage includes importing the real Maka attributes policy, rejection of retired policy v1, filters and oversized attributes before destination claim, mismatched commit/tree storage keys, unknown object formats, portable Unicode path policy, exact bare/worktree metadata admission, deterministic zero-parent baseline identity, destination races, foreign/aliased destinations, object/resource limits, and Linux/Windows timeout process-tree termination.
• Runtime Host build, Windows skip inventory, CI planner, Biome, and git diff --check pass locally.

中文说明

摘要

本 PR 建立一条 owner-bound 的 Gitoxide repository admission 与 fresh source-import 边界，不恢复 bundled Git，也不从系统 PATH 发现 Git。

• Rust helper 每次只处理一个请求，使用 isolated/strict Gitoxide 配置；
• helper artifact、invocation、repository admission 均使用 owner-bound opaque capability；
• claimed commit/tree/blob 在解析、递归或复制前都重新计算 SHA-1；
• source preflight 与 copy 共用同一个有界 verified tree walker；
• 只保留 managedTreePolicyVersion: 2；未发布的 version 1 已删除并明确拒绝；
• destination 通过原子 create_dir() 领取，并发布确定性的 zero-parent baseline；
• inspection/import 从公开入口使用同一个绝对 deadline，覆盖 artifact/path preflight、helper 执行以及有界进程回收；
• Rust/TypeScript 使用同一份穷举 error contract。

主要不变量

只有已 admission 的短生命周期 Gitoxide helper 才能建立后续 managed workspace 使用的 immutable repository identity 与 source graph。Git OID 不能自证身份：对象 bytes 必须重新计算得到 exact claimed SHA-1。

source preflight 和 copy 由同一 walker 执行相同的 checksum、资源预算与路径策略。portable policy v2 在所有平台统一拒绝 Windows device names、保留/控制字符、尾部点或空格、.git 别名以及折叠路径冲突；规范 .gitattributes 每个最多 64 KiB，只允许注释/空行、* text=auto eol=lf 与 literal portable-path export-ignore。filter、encoding、ident、wildcard 和未知 attribute 均在 destination claim 前 fail closed。本 PR 不宣称完整 Git attributes 兼容。

仍保留的边界

• SHA-256 明确不可用；未知格式统一返回 unknown 并 fail closed；
• helper 不接管或删除已有 destination，包括 partial/foreign artifact；
• 本 PR 不声称抵抗同一 OS 用户在 verify→exec 窗口替换 helper；正式使用需要 packaged-release trust root 和受保护安装目录；
• durable receipt/quarantine/recovery owner 与 state-root-bound destination capability 仍在后续切片；
• 当前没有 Desktop/CLI/Write/Edit 生产消费者；本 PR 是可合并的 enabling infrastructure，不代表 managed-workspace 产品能力已可启用。

验证

• Ubuntu、macOS、Windows 的 Rust 1.98 formatting、helper tests 与真实 Runtime Host helper contract 全部通过；
• 回归覆盖真实 Maka attributes 导入、旧 policy v1/外部 filter/超限 attributes 的 claim 前拒绝、错误 commit/tree 存储键、未知 object format、Unicode portable path policy、bare/worktree metadata admission、确定性 zero-parent baseline、destination 并发、foreign/alias destination、资源预算和 Linux/Windows timeout 进程树回收；
• 本地 Runtime Host build、Windows inventory、CI planner、Biome 与 git diff --check 通过。

[zhiiw]

Addressed the unsupported-format admission gap at the open-error boundary.

gix 0.86.0 rejects an unknown extensions.objectFormat while constructing the repository handle, before repository.object_hash() is reachable. The helper now classifies that specific typed configuration error as repository_rejected / unsupported_object_format with exit 2, while unrelated repository-open failures remain operational errors with exit 1.

I also tested the adjacent replacement-ref identity hypothesis. With refs/replace/<HEAD> present, the isolated helper returns the raw HEAD commit and raw tree identity, not the replacement commit's tree. A regression now pins that behavior.

Verification: 4/4 Rust protocol tests pass; ASF header audit and diff check pass.

中文说明

已在 repository open-error 边界修复未知 object format 的分类缺口。

gix 0.86.0 会在构造 repository handle 时拒绝未知的 extensions.objectFormat，因此旧代码确实无法进入 repository.object_hash() 的 unknown 分支。现在 helper 会把该特定 typed-config error 转换为 exit 2 的 repository_rejected / unsupported_object_format；其他 open 失败仍保持 exit 1 的 operational error。

同时验证了相邻的 replacement-ref 身份假设：存在 refs/replace/<HEAD> 时，isolated helper 返回 raw HEAD commit 与 raw tree，不会把 replacement commit 的 tree 混入 observation。对应回归测试已经加入。

验证结果：Rust 协议测试 4/4 通过，ASF header audit 与 diff check 通过。

[zhiiw]

The follow-up Gitoxide validation stack is now complete as three narrowly scoped stacked Drafts:

1. artifact identity → opaque invocation capability
2. bounded short-lived invocation owner
3. exact repository observation → opaque admission capability

The combined real-helper contract now covers, on the same Runtime Host path:

• forged release claims and wrong-owner capabilities fail closed;
• symlink/junction helper paths and post-admission byte changes fail closed;
• the helper runs with fixed argv, minimal environment, bounded I/O, timeout/cancellation, and no shell;
• exit 0/1/2 map strictly to SHA-1 observation / stable operational failure / unsupported-format policy rejection;
• raw repository paths and OIDs cannot self-authorize an admission capability;
• SHA-256 repositories remain explicitly unsupported and receive no capability.

The three-platform workflow builds the real Rust helper and runs the artifact, invocation, and admission contracts. These PRs intentionally remain Draft: they do not claim a signed packaged-release trust root, a protected installation root, Desktop/CLI consumption, T1 persistence, source import, projection, candidate, or ref CAS. Those are production integration gates, not hidden assumptions in the helper validation stack.

中文说明

Gitoxide 后续验证链已经按三个窄边界完成：

1. helper artifact identity → opaque invocation capability；
2. bounded short-lived invocation owner；
3. exact repository observation → opaque admission capability。

联合真实 helper 合同已经证明：伪造 claim、错误 owner、symlink/junction、admission 后字节变化全部 fail closed；helper 使用固定 argv、最小环境、I/O 上限、超时/取消且不经过 shell；exit 0/1/2 严格对应 SHA-1 observation、稳定 operational failure、unsupported-format policy rejection；裸 path/OID 不能自证 admission；SHA-256 默认拒绝且不签发 capability。

三平台 workflow 会构建真实 Rust helper，并运行 artifact、invocation、admission 合同。这些 PR 仍保持 Draft，因为正式发布签名信任根、受保护安装路径、Desktop/CLI、T1、source import、projection/candidate/ref CAS 尚未接入；这些是后续生产接线门槛，不是当前验证栈里的隐藏假设。

[zhiiw]

I expanded this Draft from the helper-only validation into one complete repository admission/import boundary.

The updated head now includes the previously isolated artifact authority, short-lived invocation owner, repository admission capability, and exact source-import data plane. The primary invariant is therefore reviewable end to end: only an admitted helper invocation can establish and import the immutable repository identity used by later managed-workspace work.

The branch was rebuilt from the latest main. Git range-diff reports all 12 extracted commits as patch-equivalent to the previously reviewed helper and fork PR #11-#14 slices. Successor publication, projection, packaging/product composition, Write/Edit, and resume remain out of scope.

Local Core/Storage/Runtime/Runtime Host builds pass. The dedicated Linux/macOS/Windows helper jobs are now running against the expanded head.

中文说明

我已经把这个 Draft 从“只有 helper 的验证切片”扩大成一条完整的 repository admission/import 边界。

当前 head 包含此前拆开的 artifact authority、短生命周期 invocation owner、repository admission capability 和 exact source-import data plane。现在可以端到端审查同一个主要不变量：只有经过 admission 的 helper invocation，才能确定并导入后续 managed workspace 使用的 immutable repository identity。

分支已经基于最新 main 重建。Git range-diff 显示 12 个提取提交与此前评审过的 helper 以及 fork #11-#14 patch 完全等价。Successor publication、projection、packaging/product composition、Write/Edit 和 resume 仍不在本 PR 范围内。

本地 Core、Storage、Runtime、Runtime Host 构建通过；Linux、macOS、Windows 专用 helper CI 正在针对新 head 运行。

[zhiiw]

Thanks for the adversarial review. I addressed the correctness findings in 13774374c and intentionally did not paper over the executable-identity limitation.

1. Import takeover / recovery authority: import is now strictly fresh-only. Any existing destination—including the source repository itself, a foreign bare repository, a non-bare directory, or partial crash residue—is rejected with import_destination_not_fresh and is neither repaired nor deleted. Destination parents are walked before creation and symlink/junction/reparse aliases fail closed. The docs now state that this Draft does not yet prove a Maka-owned destination: the future Storage owner must issue the state-root-bound destination capability and own receipt/quarantine/retry.
2. Verify-to-spawn TOCTOU: I did not add another hash check and call it solved. Node still performs a path-based spawn after closing the verified handle, so the Draft now explicitly excludes a malicious same-user replacement in that window. Production composition remains blocked on a packaged-release trust root and protected install directory.
3. Deadline/resource mismatch: inspection remains 5 seconds; source import now has an independent 10-minute deadline. The 2 GiB / 200,000-file limits are documented as admission bounds, not an SLA.
4. Admission binding: the opaque repository admission now binds the helper artifact digest and managedTreePolicyVersion: 1. Import requires the same helper identity and obtains the policy from the admission owner; callers cannot resubmit either value.
5. Error protocol drift: Rust and TypeScript now expose the same exhaustive v1 reason list. CI tests compare the two declarations exactly, unknown internal reasons normalize to internal_error_reason_invalid, and the impossible TS-only unsupported_operation reason was removed.

Regression coverage now includes source==destination, foreign bare/non-bare destinations, parent symlink/junction tampering, unsupported policy versions, helper-identity substitution, operation-specific deadlines, and Rust/TypeScript reason parity.

Local Core/Storage/Runtime/Runtime Host builds, focused Node tests, Biome, and diff checks pass. The real Gitoxide workflow is green on macOS and Windows; Ubuntu is currently waiting for a runner.

中文说明

感谢这次对抗性审查。13774374c 已处理实质 correctness 问题，同时没有用“再 hash 一次”伪装修复 executable identity。

1. import 接管/恢复权限：改成严格 fresh-only。source 自身、foreign bare repo、non-bare 目录和 crash residue 只要已经存在，一律 import_destination_not_fresh，不会修复或删除。创建前逐级检查父路径，symlink/junction/reparse alias 会 fail closed。文档也明确：当前 Draft 尚未证明 destination 是 Maka-owned；未来必须由 Storage owner 签发 state-root-bound capability，并负责 receipt/quarantine/retry。
2. verify→spawn TOCTOU：Node 关闭已验证 handle 后仍只能按 path spawn，所以当前实现不能抵抗同一 OS 用户在窗口内替换 executable。这个限制已经写进合同，production composition 必须等待 packaged-release trust root 与受保护安装目录。
3. deadline：repository inspection 保持 5 秒，source import 独立为 10 分钟。2 GiB/200,000 files 是输入上限，不是 SLA。
4. admission 绑定：repository admission 现在同时冻结 helper digest 与 managedTreePolicyVersion: 1；import 必须使用同一 helper identity，policy 只能由 admission owner 提供。
5. 错误协议：Rust/TypeScript 使用同一份完整 v1 reason list，测试做 exact parity；未知内部 reason 归一为 internal_error_reason_invalid，删除了 TS 独有且不可达的 unsupported_operation。

新增回归覆盖 source==destination、foreign bare/non-bare、父路径 symlink/junction、未知 policy、helper identity 替换、operation-specific deadline 和错误协议一致性。

本地四个 workspace build、Node 定向测试、Biome、diff check 均通过。真实 Gitoxide workflow 的 macOS 与 Windows 已绿色；Ubuntu 仍在等待 runner。

[zhiiw]

Thanks for the adversarial review. I addressed the findings in 73f2f64d9, 92f7e4250, and 9d7aaa9c4 without changing the three-layer capability architecture.

1. Fresh destination is now an atomic claim. The helper validates all source/ref/policy preconditions first, then claims the leaf with create_dir. AlreadyExists deterministically becomes import_destination_not_fresh; only the winning process can initialize or write the bare repository. Initialization now uses explicit isolated init_opts, destination_must_be_empty, and SHA-1. The existing-ref/same-commit success branch was removed, so publication has one rule: MustNotExist.
2. Ref syntax is authoritative before side effects. refs/maka/* remains the namespace preflight, while gix::refs::FullName now performs complete Git ref validation before destination creation. Invalid forms such as refs/maka/a..b return invalid_baseline_ref and leave the destination absent.
3. Commit/tree allocations are bounded before decode. Source HEAD commit and every reachable tree are checked with find_header() before full decode. Policy v1 now caps commit objects at 1 MiB, a single tree at 8 MiB, and cumulative reachable tree bytes at 64 MiB. Isolated open also fixes gitoxide.objects.allocLimit=64 MiB. Oversized commit/tree fixtures prove rejection before destination creation.
4. The concurrent-owner regression is production-shaped. Two real helper processes import different sources into one destination. Exactly one succeeds, the loser returns import_destination_not_fresh, and the winning object database does not contain the losing source blob.
5. The dedicated CI contract is closed. The workflow is in the PR-trigger allowlist; checkout and setup-node are pinned to repository-standard full SHAs; checkout uses persist-credentials: false; and both repository-admission owner paths explicitly trigger the three-platform gate.
6. Timeout wiring now has a behavior test. On POSIX, the test admits a real executable hanging helper with a live descendant, advances the mock clock through the 5-second inspection deadline without settlement, then reaches the 10-minute import deadline and proves both processes are terminated with gitoxide_helper_invocation_timed_out. This adds no executable/timeout injection seam to production code.

Local CI-planner tests, Runtime Host build, protocol parity, Biome, and diff checks pass. The updated dedicated gate is green on macOS and Windows; Ubuntu is currently waiting for a runner. The general package/test/audit checks are still running or queued.

The previously documented later boundaries remain intentionally unchanged: verify-to-spawn replacement resistance needs the packaged-release trust root; destination ownership still needs a state-root lease/capability; and partial artifact receipt/quarantine belongs to the future Storage owner.

中文说明

感谢这次对抗性审查。73f2f64d9、92f7e4250 和 9d7aaa9c4 已经在不改变三层 capability 架构的前提下完成收口。

1. fresh destination 改为原子领取。 helper 先完成 source/ref/policy 的全部无副作用验证，再用 create_dir 原子领取叶子目录。路径已存在时稳定返回 import_destination_not_fresh；只有胜出的进程能初始化和写入 bare repository。初始化使用 isolated init_opts、destination_must_be_empty 和显式 SHA-1。删除了“ref 已存在且 commit 相同也算成功”的旁路，publication 只剩 MustNotExist。
2. ref 在副作用前由 Gitoxide 权威校验。 refs/maka/* 只负责 namespace preflight，完整 Git ref grammar 由 gix::refs::FullName 在 destination 创建前验证。refs/maka/a..b 等非法形式返回 invalid_baseline_ref，destination 仍不存在。
3. commit/tree 在完整 decode 前受预算约束。 HEAD commit 和每个 reachable tree 都先通过 find_header() 读取类型/大小。v1 固定 commit 1 MiB、单 tree 8 MiB、全部 reachable tree 64 MiB，并在 isolated open 中固定 gitoxide.objects.allocLimit=64 MiB。恶意 oversized commit/tree fixture 证明拒绝发生在 destination 创建前。
4. 并发 owner 使用真实双进程测试。 两个 helper 从不同 source 争抢同一 destination，恰好一个成功；失败者稳定返回 not-fresh，winner object database 中也不存在 loser 的 source blob。
5. CI 合同闭环。 workflow 已加入 PR trigger allowlist；checkout/setup-node 使用仓库标准完整 SHA；checkout 禁止 credential persistence；repository admission owner 及其测试显式进入三平台 path filter。
6. timeout 改成行为测试。 POSIX CI 会 admission 一个真实 hanging executable helper 及其 descendant：逻辑时钟经过 5 秒 inspect deadline 时 import 仍未 settle，到 10 分钟 import deadline 后整个 process tree 被终止，并稳定返回 gitoxide_helper_invocation_timed_out。生产代码没有新增任意 executable 或 timeout 注入 seam。

本地 CI planner、Runtime Host build、错误协议一致性、Biome 和 diff check 均通过。更新后的专用 gate 在 macOS、Windows 已绿色；Ubuntu 正在等待 runner，通用 package/test/audit 仍在运行或排队。

原先明确记录的后续边界保持不变：verify→spawn 的替换抵抗要依赖 packaged-release trust root；destination ownership 要等 state-root lease/capability；partial artifact 的 receipt/quarantine 由未来 Storage owner 负责。

[zhiiw]

Addressed the remaining object-identity, graph-walker, portability, protocol, CI, and documentation findings in ea3699465, b0c79b25b, and 8abe835a1.

1. Claimed object identity is now verified before use. A single load_verified_object() boundary performs header kind/size checks, loads the object under the bounded Gitoxide allocation policy, rechecks the loaded kind/size, and calls Data::verify_checksum(expected_oid). Inspection verifies the claimed HEAD commit; import verifies the expected source commit and every reachable tree/blob. Stable head_commit_identity_mismatch and source_head_commit_identity_mismatch reasons were added to the exhaustive Rust/TypeScript contract.
2. Preflight and copy now share one graph authority. The separate validate_source_tree and copy_source_tree implementations were replaced by one walk_verified_source_tree in validate-only or copy mode. Each tree is checksum-verified before parsing or descending, and both passes enforce the same depth/visit/entry/path/tree-byte/blob/file/total-byte limits. Copy cannot recurse through newly substituted unverified tree bytes.
3. managedTreePolicyVersion: 1 is explicitly portable. The owner now rejects ASCII controls, Windows reserved characters, device names (including extension forms), trailing dots/spaces, .git/.gitattributes aliases, separators, and folded NFC/case collisions on every platform. This prevents import from accepting a graph that a later Windows projection cannot safely materialize.
4. Unknown formats have a closed response vocabulary. Rust returns only sha256 or unknown for unsupported formats; the TypeScript decoder accepts exactly those values. Raw untrusted config text is no longer reflected across the protocol.
5. Regression and delivery closure. New real-helper fixtures replace the loose bytes stored under claimed commit/tree keys and prove stable rejection before destination creation. The Windows skip inventory was regenerated, the architecture docs and PR body now describe the consolidated admission/import authority, and stale test counts were removed.

Verification at head 8abe835a1:

• Gitoxide helper admission workflow: Ubuntu, macOS, and Windows all pass, including Rust 1.98 formatting, Rust helper tests, Runtime Host build, and real-helper contracts.
• Local Runtime Host build and focused protocol tests pass.
• Windows skip inventory is current at 64 declarations; CI planner is 32/32.
• Biome and git diff --check pass.
• The general test and package jobs are still running; the earlier inventory failure is closed.

The Draft boundary remains unchanged: packaged-release trust, protected installation, state-root destination capability, partial-artifact recovery ownership, and Desktop/CLI/Write/Edit consumers remain follow-up gates.

中文说明

已在 ea3699465、b0c79b25b 和 8abe835a1 中处理剩余问题：

1. claimed object identity 在使用前显式验证。 新的唯一 load_verified_object() owner 会依次执行 header 类型/大小检查、受限读取、loaded kind/size 复核和 Data::verify_checksum(expected_oid)。inspection 校验 HEAD commit；import 校验 expected commit 以及全部 reachable tree/blob。Rust/TypeScript 穷举错误合同新增稳定 identity-mismatch reason。
2. preflight 与 copy 共用同一个 graph walker。 原来的两套近似实现已合并为 walk_verified_source_tree 的 validate-only/copy 两种模式。每棵 tree 都在 parse/递归前完成 checksum，两个 pass 使用完全相同的 depth、visit、entry、path、tree-byte、blob/file/total-byte 预算。
3. managedTreePolicyVersion: 1 明确定义为 portable policy。 所有平台统一拒绝 ASCII control、Windows reserved characters/device names（含扩展名形式）、尾部点/空格、.git/.gitattributes 别名、separator 和 NFC+大小写折叠冲突，避免 import 接受但 Windows projection 无法安全物化。
4. unknown object format 使用闭合词汇。 Rust 对不支持格式只返回 sha256 或 unknown，TypeScript decoder 也只接受这两项，不再回显任意未受信配置文本。
5. 回归与交付收尾。 真实 helper fixture 会把另一对象 bytes 放进 claimed commit/tree 的 loose storage key，证明 destination 创建前稳定拒绝。Windows inventory、架构文档和 PR body 均已更新。

当前 head 8abe835a1 的验证：

• Ubuntu、macOS、Windows 专属 Gitoxide workflow 全部通过，包括 Rust 1.98 formatting、Rust helper suite、Runtime Host build 和真实 helper contract；
• 本地 Runtime Host build 与定向 protocol tests 通过；
• Windows inventory 当前为 64 条，CI planner 32/32；
• Biome 与 git diff --check 通过；
• 通用 test/package 仍在运行，旧的 inventory 红灯已经关闭。

Draft 的后续边界没有伪装完成：packaged-release trust、受保护安装目录、state-root destination capability、partial artifact recovery owner 以及 Desktop/CLI/Write/Edit consumer 仍属于后续切片。

[zhiiw]

Thanks for the detailed re-review. I addressed the remaining import-authority findings in 90b051892 and 3c6ab082b.

• Canonical Git tree identity: the verified walker now rejects every raw mode token except 40000, 100644, and 100755 before destination claim. It also enforces Git's canonical base_name_compare ordering, including the implicit / suffix for directories. The pinned gix EntryRef does not implement Ord, so the comparison is implemented explicitly and covered for file/directory prefix cases.
• Versioned portable path equivalence: the collision key is now Unicode 17.0 NFC -> Unicode 16.0 Default Full Case Folding (non-Turkic) -> Unicode 17.0 NFC, using pinned caseless = 0.2.2. Original and folded paths have independent per-path and aggregate byte budgets. Greek final sigma, Straße/STRASSE, NFC/NFD equivalence, and lowercase superscript device names are covered.
• Exact response correlation: the Runtime Host decoder now binds a successful import response to the requested source HEAD, baseline ref, and managed-tree policy version. A structurally valid response for another request is rejected as gitoxide_helper_invocation_protocol_invalid.
• Bounded observation memory: the preflight path set is dropped before the copy pass; only scalar expected counts survive, and the response is derived from the copy pass after cross-observation validation.
• Contract wording: the documents now describe this as a portable lexical policy. They explicitly defer real path-length, 8.3 alias, volume case behavior, ACL, and post-create observation to a future filesystem materialization profile.

Regression coverage now includes corrupt blob storage identity, raw noncanonical/zero-padded modes, unsorted raw trees, Unicode fold collisions, lowercase reserved-device paths, and mismatched helper responses. All current checks pass: the fresh Rust helper and real invocation contract on Ubuntu/macOS/Windows, the main CI suite, dependency audit, and the Windows release/update/rollback contract.

This PR can now be treated as merge-ready enabling infrastructure rather than product-ready functionality. The absence of a currently activated Desktop/CLI/Write/Edit consumer does not, by itself, require Draft status: the slice proves a complete repository-admission/import invariant, remains inert in production, and has concrete extracted downstream consumers for successor/projection, packaged authority, and Runtime Host composition. Those later slices must still land before managed mode is exposed to users.

GitHub currently reports the PR as mergeable, and a merge-tree check against current upstream/main is clean. This PR still does not claim to provide the packaged trust root, protected installation root, durable state-root artifact owner, projection/recovery owner, or a user-visible managed-workspace capability.

中文说明

感谢这次细致的复审。本轮剩余问题已经在 90b051892 和 3c6ab082b 中处理：

• Canonical Git tree identity： verified walker 会在领取 destination 之前，只允许 raw mode token 40000、100644、100755。同时按 Git 的 base_name_compare 规则验证 canonical ordering，目录按隐含 / 后缀参与比较。锁定版本的 gix::EntryRef 实际没有实现 Ord，因此这里显式实现并测试了文件、目录和前缀排序。
• 版本化 portable path equivalence： collision key 固定为 Unicode 17.0 NFC -> Unicode 16.0 Default Full Case Folding（non-Turkic）-> Unicode 17.0 NFC，并锁定 caseless = 0.2.2。原路径和 fold 后路径分别有单路径与累计 byte budget。已覆盖 Greek final sigma、Straße/STRASSE、NFC/NFD 和小写 superscript 设备名。
• Exact response correlation： Runtime Host decoder 现在会把成功响应精确绑定到请求的 source HEAD、baseline ref 和 policy version；另一个请求的合法 shape 响应会被拒绝为 gitoxide_helper_invocation_protocol_invalid。
• 内存边界： preflight 的 path set 会在 copy pass 前释放，只保留标量计数；最终响应来自 copy pass，并验证两次 observation 一致。
• 文档收窄： 当前能力明确命名为 portable lexical policy；真实 path-length、8.3 alias、volume case、ACL 和 post-create observation 由后续 filesystem materialization profile 证明。

新增回归覆盖 corrupt blob storage identity、非 canonical/zero-padded raw mode、未排序 raw tree、Unicode fold collision、小写 reserved-device path 和错配 helper response。当前 Gitoxide 三平台 gate、通用 CI、Dependency audit、Windows release/update/rollback contract 均已通过。

当前 PR 可以视为可合并的 enabling infrastructure，但不能视为已经产品化的功能。没有已经激活的 Desktop/CLI/Write/Edit 消费者，本身不再构成必须保持 Draft 的理由：本切片已经独立证明完整的 repository admission/import 不变量，默认不会激活生产行为，而且 successor/projection、packaged authority 和 Runtime Host composition 都已有明确的下游 extraction slice。只有这些下游能力完成后，managed mode 才能向用户开放。

GitHub 当前报告 PR 可合并，和最新 upstream/main 的 merge-tree 也无冲突。本 PR 仍不声称已经提供 packaged trust root、受保护安装目录、durable state-root artifact owner、projection/recovery owner 或用户可见的 managed-workspace 能力。

[zhiiw]

Addressed both remaining findings in 9e3163af3 and b1604d358.

1. Repository metadata is now bounded before gix::open(). The helper resolves the exact .git / commondir metadata path files with bounded readers, accounts those bytes plus the repository-local config and config.worktree, and rejects totals above 1 MiB with the allowlisted repository_metadata_limit_exceeded reason. Only after that gate does Gitoxide open the repository. lossy_config(true) also avoids retaining comments and whitespace inside the admitted budget. The real Rust helper regression exercises both inspect and import with an oversized local config and proves import rejects before destination creation.
2. The process marker handshake now uses elapsed time. The test waits against a 10-second monotonic performance.now() deadline rather than 1,000 scheduler turns. It deliberately waits for a marker published after one wall-clock second, while retaining setImmediate only as the polling yield so it remains independent of the mocked operation timeout clock. The dedicated workflow now uses the repository release contract, Node 24.18.1.

The dedicated Gitoxide admission gate is green on Ubuntu, macOS, and Windows, including Rust 1.98 formatting, the new real-helper metadata regression, Runtime Host build, and the invocation/process-tree contract. Dependency audit is also green; the broader CI and Windows package jobs are still running.

中文说明

两个剩余问题已在 9e3163af3 和 b1604d358 中处理。

1. repository metadata 在 gix::open() 前受预算约束。 helper 会先用有界 reader 解析 .git / commondir 路径文件，并累计这些文件以及 repository-local config、config.worktree 的实际字节数；总量超过 1 MiB 时稳定返回白名单内的 repository_metadata_limit_exceeded，只有通过这道门后 Gitoxide 才会打开仓库。同时启用 lossy_config(true)，避免在预算内继续保留无关注释和空白。真实 Rust helper 回归同时覆盖 inspect 与 import，并证明超大 local config 会在 destination 创建前被拒绝。
2. process marker 握手改用真实经过时间。 测试现在使用单调的 performance.now() 和 10 秒截止时间，不再把 1,000 次调度当作超时。新增回归会在真实 1 秒后发布 marker；轮询只用 setImmediate 让出调度，因此不会被 operation timeout 的 mock clock 卡住。专用 workflow 也已切到仓库 release 合同中的 Node 24.18.1。

Gitoxide 专用 gate 已在 Ubuntu、macOS、Windows 全部通过，包含 Rust 1.98 formatting、新增真实 helper metadata 回归、Runtime Host build 与 invocation/process-tree 合同。Dependency audit 也已通过；通用 CI 和 Windows package job 仍在运行。

[M4n5ter]

English

Thanks for the careful work on this boundary. The overall direction is coherent: the opaque authority chain, exact object verification, shared preflight/copy walker, and fresh-destination behavior for honest contenders all make sense.

After reviewing b1604d358, I do not think the PR is merge-ready yet. Two issues break its primary bounded-admission contract.

Blocking

1. The operation deadline does not cover the complete invocation lifecycle.

In gitoxide-helper-invocation-internal.ts, the 5-second/10-minute timer starts only inside invokeHelper(). Artifact revalidation and repository realpath() happen before that timer and cannot be interrupted while their filesystem I/O is pending. A repository on a stalled filesystem can therefore exceed the advertised deadline indefinitely.

After timeout, cancellation, or output overflow, the code records the termination reason and fires terminateChildProcessTree() without awaiting a bounded exit acknowledgement. The returned promise still waits indefinitely for close; if signaling/taskkill fails or the child is stuck in uninterruptible I/O, the operation never settles.

Please use one absolute deadline from the public operation entry through preflight, spawn, termination acknowledgement, and output drain. The existing child-process-lifecycle implementation already owns bounded forced-termination acknowledgement and should preferably be reused rather than creating a second lifecycle state machine. The resulting behavior also needs a Windows-native timeout/termination contract; the current test skips that path on Windows.

2. The repository metadata admission budget is not authoritative over what Gitoxide actually reads.

assert_repository_metadata_budget() infers .git/bare/commondir paths independently from gix::open(), and those discovery rules can disagree.

I reproduced this on the current head with a valid bare SHA-1 repository whose root config was 1,100,249 bytes and which also contained an invalid empty .git/ child directory. The preflight budget inspected the child path, while Gitoxide opened the bare root and parsed the oversized root config. The helper returned repository_inspected instead of repository_metadata_limit_exceeded.

The later head_id() path is also outside this budget: the pinned gix ref reader uses an unbounded read_to_end(Vec) for HEAD and loose refs. A malformed but reachable local repository can therefore trigger large allocations before the helper's object limits or timeout protect the caller.

The fix should establish one authoritative repository-layout resolution shared with Gitoxide and bound the actual config/HEAD/ref metadata that will be read. Merely adding more guessed paths to the current preflight would remain fragile.

Important current-scope issues

3. Protected filenames do not use the equivalence relation defined by policy v1.

The collision policy uses:

NFC → Default Full Case Folding → NFC

but .git and .gitattributes are checked only with eq_ignore_ascii_case().

I verified that a repository containing the single path .gitattributeſ—ending with U+017F LATIN SMALL LETTER LONG S—is successfully imported, although its v1 folded key is exactly .gitattributes.

Please extract one versioned fold function and use it both for collision keys and protected-name comparison. This should be covered by one raw-tree regression rather than a character-specific exception.

4. The PR's readiness contract is contradictory.

The PR is no longer a Draft and the latest update calls it “merge-ready enabling infrastructure,” but the PR body and several architecture documents still state that it “remains Draft” or “must remain Draft” until the release owner and production consumers exist.

Please choose one status and make it authoritative everywhere. I think “merge-ready enabling infrastructure, not product-ready” is a reasonable position, provided the production gates remain explicit.

Contract clarification

create_dir() atomically claims a pathname only at one instant; it does not retain the directory identity throughout a potentially ten-minute import. A concurrent actor with rename rights can move the claimed directory and replace the leaf or an ancestor with a symlink/junction. The later path-based hooks deletion, object writes, and ref publication can then affect a foreign repository and may even return success for a different artifact.

I would not require a full retained-directory-handle implementation in this inert slice if concurrent same-user filesystem mutation is explicitly outside the threat model. However, the current unconditional claim that existing destinations are never modified should then be narrowed, and production composition must remain gated on a stable destination owner. Otherwise this needs to be fixed at the storage/path-identity boundary.

Simplification opportunities

I recommend removing some complexity while addressing the findings:

• Store the exact admitted helper capability inside the repository admission record. Import should consume the repository capability and internally reuse that helper, rather than requiring callers to resubmit a helper token/capability and comparing a mirrored {sha256, bytes, protocolVersion} identity.
• Remove the fresh repository's hooks remove/recreate sequence unless an actual consumer requires an empty hooks directory. The helper never executes hooks, and this path adds a destructive operation plus import_hooks_cleanup_failed.
• Remove the unreachable import_destination_unreadable protocol reason.
• Keep temporary Draft/stacked-PR lifecycle status in one overview instead of duplicating it across five architecture contracts.

The deterministic zero-parent baseline is implemented correctly, but its test does not lock that invariant. The existing import test should import the same source into two fresh destinations, assert identical baseline OIDs, and verify zero parents plus the fixed identity/message.

Product compatibility gate

Policy v1 rejects every .gitattributes file, including the one in apache/maka itself. I do not consider that a blocker for deliberately inert enabling infrastructure, but it means v1 cannot yet be presented as suitable for ordinary managed workspaces. The eventual production consumer needs an explicit attributes/materialization decision or a policy v2.

Once the two boundedness blockers, the Unicode policy inconsistency, and the readiness contract are resolved, I would be happy to re-review.

中文

感谢作者对这条边界所做的细致工作。整体方向是成立的：opaque authority chain、精确 object 校验、preflight/copy 共用 walker，以及正常并发参与者下的 fresh destination 语义都比较合理。

审查 b1604d358 后，我认为当前版本还没有达到可合并状态。有两个问题直接破坏了本 PR 的 bounded admission 主要合同。

阻塞问题

1. operation deadline 没有覆盖完整的 invocation lifecycle。

在 gitoxide-helper-invocation-internal.ts 中，5 秒/10 分钟 timer 直到进入 invokeHelper() 才开始。此前的 artifact 重验和 repository realpath() 都不受该 deadline 约束，其文件系统 I/O pending 时也无法响应 abort。位于卡顿文件系统上的 repository 因此可以无限超过所声明的 deadline。

timeout、cancel 或 output overflow 发生后，代码只是记录 termination reason，并以 fire-and-forget 方式调用 terminateChildProcessTree()；最终 Promise 仍然无限等待 close。如果 signal/taskkill 失败，或者子进程卡在不可中断 I/O，operation 永远不会 settle。

建议从 operation public entry 开始，以一个 absolute deadline 统一拥有 preflight、spawn、termination acknowledgement 和 output drain。仓库现有的 child-process-lifecycle 已经实现了有界的强制终止确认，应优先复用，而不是再维护第二套较弱的 lifecycle state machine。修复后还需要 Windows 原生 timeout/termination contract；当前测试会在 Windows 跳过这条路径。

2. repository metadata admission budget 并不能约束 Gitoxide 实际读取的 metadata。

assert_repository_metadata_budget() 独立推断 .git、bare repository 和 commondir 路径，其 discovery 规则可能与 gix::open() 不一致。

我在当前 head 上完成了真实复现：一个合法 bare SHA-1 repository，根 config 大小为 1,100,249 bytes，同时包含一个无效的空 .git/ 子目录。preflight 统计的是该子路径，但 Gitoxide 最终打开 bare root 并解析超大的根 config。helper 返回了 repository_inspected，而不是 repository_metadata_limit_exceeded。

后续 head_id() 也不在该预算内：锁定版本的 gix ref reader 会对 HEAD 和 loose ref 使用无界的 read_to_end(Vec)。因此，一个畸形但可达的本地 repository 可以在 object limit 或 timeout 保护调用方之前制造巨大的内存分配。

修复应建立一套与 Gitoxide 共用的 authoritative repository-layout resolution，并约束实际会读取的 config、HEAD 和 ref metadata。仅继续向当前 preflight 追加猜测路径仍然很脆弱。

当前范围内的重要问题

3. protected filename 没有使用 policy v1 自己定义的等价关系。

collision policy 使用：

NFC → Default Full Case Folding → NFC

但 .git 和 .gitattributes 只通过 eq_ignore_ascii_case() 检查。

我已经验证：只包含 .gitattributeſ 的 repository 可以成功导入，其中最后一个字符是 U+017F LATIN SMALL LETTER LONG S；但它的 v1 folded key 正是 .gitattributes。

建议提取唯一、版本化的 fold 函数，同时用于 collision key 和 protected-name 判断，并通过一个 raw-tree regression 覆盖，不要添加针对单个字符的特判。

4. PR 的 readiness contract 自相矛盾。

PR 已不再是 Draft，最新更新也称其为“merge-ready enabling infrastructure”；但 PR body 和多份架构文档仍明确写着“remains Draft”或在 release owner、生产消费者落地前“must remain Draft”。

需要选择唯一状态并在所有位置保持一致。我认为“可合并的 enabling infrastructure，但尚未 product-ready”是合理定位，前提是仍明确保留所有 production gate。

合同需要澄清的边界

create_dir() 只在某个瞬间原子领取 pathname，并没有在最长十分钟的导入期间持续持有该目录的 identity。具有 rename 权限的并发参与者可以移动已领取目录，并用 symlink/junction 替换 leaf 或 ancestor。此后基于 path 执行的 hooks 删除、object 写入和 ref 发布可能作用于 foreign repository，甚至可能针对另一个 artifact 返回成功。

如果明确把同用户并发文件系统篡改排除在当前 inert slice 的 threat model 外，我不认为本 PR 必须立即实现 retained directory handle。但当前“existing destinations are never modified”的无条件描述需要收窄，生产接线也必须继续等待稳定的 destination owner。否则应在 storage/path identity 边界从根因修复。

简化机会

建议在处理上述问题时顺带收回以下复杂度：

• 将 admission 时使用的 exact helper capability 直接保存到 repository admission record。import 只消费 repository capability，并在内部复用绑定的 helper；不再要求 caller 重交 helper token/capability，再比较一份镜像的 {sha256, bytes, protocolVersion} identity。
• 除非真实消费者要求 hooks 目录必须为空，否则删除 fresh repository 的 hooks remove/recreate。helper 本身不会执行 hooks，这条路径只增加了一个破坏性操作和 import_hooks_cleanup_failed 状态。
• 删除完全不可达的 import_destination_unreadable protocol reason。
• 不要在五份架构合同中重复维护临时的 Draft/stacked-PR 状态，将当前生命周期状态集中到一份总览。

deterministic zero-parent baseline 的当前实现正确，但测试没有锁定该不变量。建议让现有 import test 把同一 source 导入两个 fresh destination，断言 baseline OID 相同，并验证零 parent、固定 identity 和 message。

产品兼容门槛

policy v1 会拒绝所有 .gitattributes，包括 apache/maka 自身的 .gitattributes。对于刻意保持 inert 的 enabling infrastructure，我不认为这本身阻塞合并；但这意味着 v1 还不能被描述为适用于普通 managed workspace。未来生产消费者必须明确决定 attributes/materialization 语义，或者引入 policy v2。

处理两个 boundedness 阻塞问题、Unicode policy 不一致和 readiness contract 后，我愿意继续复核。