Skip to content

Tiger_Git Phase 1 foundation — interfaces, env detection, credentials, data model (TIGER-334) - #356

Closed
WebTigers wants to merge 2 commits into
mainfrom
feat/tiger-334-git-module-phase1
Closed

Tiger_Git Phase 1 foundation — interfaces, env detection, credentials, data model (TIGER-334)#356
WebTigers wants to merge 2 commits into
mainfrom
feat/tiger-334-git-module-phase1

Conversation

@WebTigers

@WebTigers WebTigers commented Oct 21, 2026

Copy link
Copy Markdown
Owner

Epic TIGER-334 — Phase 1 (foundation)

The Phase-1 substrate for the Tiger_Git module: give a Tiger install first-class git/GitHub — version a custom module in a private repo, cut a release through QA, and receive approved updates — with no local machine, no terminal, and (on shared hosting with exec disabled) no git binary. No other module talks to GitHub directly.

This PR ships the foundation only; the concrete transports, the /api services, and the TigerPanel UI are Phase 2+.

What's here (Stories TIGER-363, 365, 366)

  • Tiger_Git (facade) — constants, isSemver/isAllowedHost/repoSlug/normalizeVersion, and the RESOURCE_RELEASE capability resource for the owner-only tag/submit privileges (per TIGER-335 — a privilege on a capability resource, never a role-string compare).
  • Tiger_Git_Transport_Interface — the one contract both ShellTransport and ApiTransport must satisfy with equivalent results (status/diff/commit/branch/push/pull/tag/releases/archive). Fast-forward-only, allowlisted-host-only, structured secret-free failures (Tiger_Git_Exception).
  • Tiger_Git_Environment (363) — capability detection (git binary + exec usable + outbound reachability) → recommended transport. ApiTransport needs only outbound, which is what makes shared hosting work. The network probe is behind a test seam.
  • Tiger_Git_Credential (365) — the write-only credential manager: encrypt-at-rest via Tiger_Crypto, a single resolve() read path for transports only (no controller/log path returns a secret), rotate (new verified before old revoked), revoke, and an Ed25519 deploy-key generator. A credential_ref may also be a Tiger_Secret ref (SSM, etc.).
  • Data model (366, migration 20261021000001) — git_repo_connection, git_credential, git_operation_log (append-only audit, no secrets), module_release, module_install_pin. Standard columns throughout; active-only unique indexes so disconnecting frees (org_id, module_key) and a reconnect is never blocked (the node-re-enroll bug class, TIGER-274).
  • Tiger_Git_WorkingTree + Tiger_Git_Exception value objects; module scaffold (module.json, Bootstrap, an acl.ini contract stub); CAPABILITIES.md regenerated.

Tests

  • 19 unit (facade validators, WorkingTree path-escape refusal, Environment decision logic via the probe seam, deploy-key OpenSSH framing + uniqueness).
  • 12 integration — run green against real MariaDB: the five tables build, credential write-only / round-trip / rotate / revoke under real Tiger_Crypto, the active-only unique freeing on soft-delete, and every model finder.
  • Full unit suite stays green (1150 tests); the TIGER-335 authorization guard stays green.

Not in this PR (Phase 2 — TIGER-364 next)

The concrete ShellTransport + ApiTransport (the git-over-GitHub-API commit spike is the biggest risk — I'll lead with it), then the RepoConnection/Release/Update services + TigerPanel UI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ

WebTigers and others added 2 commits October 21, 2026 13:07
@WebTigers @claude
feat(git): Tiger_Git Phase 1 foundation — interfaces, env detection, …
1ea3f95 
…credentials, data model (TIGER-334)

Epic TIGER-334's Phase-1 substrate for the Tiger_Git module: version a custom module in a
private repo, cut a release through QA, and receive approved updates — no local machine, no
terminal, and (on shared hosting with exec disabled) no git binary.

Ships the foundation only; the concrete transports + /api services + TigerPanel UI are Phase 2+.

- Tiger_Git (facade): constants, semver/host-allowlist/repo-slug validators, RESOURCE_RELEASE
  capability resource (owner-only tag/submit, per TIGER-335 — never a role-string compare).
- Tiger_Git_Transport_Interface: the one contract ShellTransport + ApiTransport implement with
  equivalent results; fast-forward-only, allowlisted-host-only, structured secret-free failures.
- Tiger_Git_Environment (TIGER-363): capability detection (git binary + exec usable + outbound)
  → recommended transport; ApiTransport needs only outbound. Network probe behind a test seam.
- Tiger_Git_Credential (TIGER-365): write-only credential manager — encrypt-at-rest via
  Tiger_Crypto, resolve-for-transport-only (no controller/log path), rotate (new before old
  revoked), revoke, and an Ed25519 deploy-key generator. Supports a Tiger_Secret ref too.
- Data model (TIGER-366, migration 20261021000001): git_repo_connection, git_credential,
  git_operation_log (append-only audit), module_release, module_install_pin — standard columns,
  ACTIVE-ONLY unique indexes so a reconnect after disconnect is never blocked.
- Tiger_Git_WorkingTree + Tiger_Git_Exception value objects; module scaffold (module.json,
  Bootstrap, acl.ini contract stub); CAPABILITIES.md regenerated.

Tests: 19 unit + 12 integration (proven against real MariaDB) — path-escape refusal, env
decision logic, keygen framing, credential write-only/round-trip/rotate/revoke, active-only
unique freeing on soft-delete, and the model finders. Full unit suite stays green (1150).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
@WebTigers @claude
chore(git): module display name "Git" -> "TigerGit" (naming consistency)
7866ee7 
Matches the TigerShop/TigerServer product-name convention. Slug (`git`), table
prefix (`git_*`), and class names (Tiger_Git_* / Git_*) are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
This was referenced Oct 21, 2026
Closed
Merged
WebTigers added a commit that referenced this pull request Oct 21, 2026
@WebTigers @claude
feat(git): TigerGit — first-class git/GitHub for a Tiger install (TIG…
563f927 
…ER-334)

The TigerGit epic, landed as one squash of the reviewed stack (#356 foundation ← #357 transports+GitHubAdapter ← #358 services+UI+MCP+reconciler).

Version a custom module in a private repo, cut a release through QA, and receive approved updates — with no local machine, no terminal, and (on shared hosting with exec disabled) no git binary. Two interchangeable transports (ShellTransport; ApiTransport with no .git), the GitHubAdapter that composes them, write-only encrypted credentials, an active-only-unique data model + audit log, the no-.git reconciler (status/diff/pull/switchBranch via a merge-base marker), the /api services (Repo/Release/Update; owner-only release capability, approved-only updates), an admin dashboard at /git/admin, and full MCP reach. Both live-GitHub gates passed (commit spike + reconciler) against real public and private repos. Ships as core 1.38.0.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
@WebTigers

WebTigers commented Oct 21, 2026

Copy link
Copy Markdown
Owner Author

Superseded by #358, which was squash-merged to main with the full stack (this PR's commits included). Closing — the changes are on main. (Kept open through review as the stacked chain #356←#357←#358.)

@WebTigers WebTigers closed this Oct 21, 2026
@WebTigers
WebTigers deleted the feat/tiger-334-git-module-phase1 branch October 21, 2026 21:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@WebTigers