cac9fe1f
docs: three receive hooks, and the read plane's rev guard
The two-hook split was unimplementable. Push options reach pre-receive and post-receive only, so the skip-validation escape hatch was unreachable where the design put it; and pre-receive cannot read the pushed objects at all, because they sit in the quarantine until after it runs. update is therefore the earliest hook that can validate, which the design relied on without saying why. Work splits across three hooks correlated by repository and receive-pack pid. Records that per-ref rejection is not atomic: a push of main plus a proposal branch, with main rejected, still lands the proposal. Settles the read plane's audience, which was anonymous-capable in one section and leak-free in the verification checklist. It is fail-closed. Documents the rev guard: reads take the approved head or a full object name, never a ref, because rev=proposals/42 would otherwise serve unreviewed text as approved through the read plane itself.
bigbes <bigbes@gmail.com> — 2026-07-22 11:46:55 UTC
Commit cac9fe1fb81fc0c100dab64c30ffe5d5f31a8442 —
view raw patch
Parent(s):
eaa2b65f
| File | Status | + | − |
|---|---|---|---|
docs/DESIGN.md
|
M | +60 | -10 |