# git-command

The git-over-SSH command grammar, parsed once for every door that serves it.

A git client asks for a repository by sending one line:

    git-upload-pack '/max/shop.git'

Two hosts on this platform receive that line: `mnw-cli`'s russh server, which is
what `ssh.makenot.work` runs, and `mnw-admin git-auth`, which sshd's `command=`
prefix invokes. Both parse it through this crate, so the grammar has one
implementation. A second parser anywhere is a source of divergence: the same push
accepted by one host and refused by the other.

## What it promises

**Path safety.** An accepted `Request` has an owner and a repo that are each a
single, non-empty, non-traversing path segment, so `Request::repo_dir` cannot
leave the root it is given and `Request::shell_command` cannot produce more than
one quoted argument.

It does not decide **identity policy**: whether `max` is a real user, whether a
username may contain a hyphen, whether the caller may push here. That is the
server's job, and `Username::new` runs on top of this. Path safety is a property
of the string and belongs where the string is parsed; identity is a property of
the deployment.

## Fuzzing

The contract is executable, in `oracle::check`. Both the libFuzzer target and
the committed regression replay call it, so neither can drift into checking less
than the other.

    cargo test                                    # unit tests + replay, stable
    cargo +nightly fuzz run command fuzz/corpus/command fuzz/seeds/command

It is row 4 of the wiki note `astra-soak-overview`, the highest-severity target
in that plan, and it runs on astra's soak tier as `git-command`.

## License

MIT. The threat model asks whether someone could collect rent with just this
crate and contribute nothing; a parser for a command grammar is not a service
anyone can run. Both consumers stay PolyForm Noncommercial.