veltro: migrate git service mount /n/git -> /mnt/git (INFR-401) - #520
Merged
Merged
Conversation
Placement convention (docs/NAMESPACE-LAYOUT.md): git/fs is an app-authored tree the git tool mounts during trusted init, so it belongs under /mnt. The tool's mount and all its reads move; the nsconstruct grant moves from the /n allowlist block to the /mnt fixed-function block (same gating: derived only from the git tool, never from generic path grants); fixedservicecontrolpath in both nsconstruct and tools9p carries /mnt/git with /n/git retained as a belt-and-braces legacy entry, following the /mnt/web + /n/web precedent; the namespace manifest emits git under the /mnt group. Also fixes webfs.b's stale default mountpt (/n/web -> /mnt/web), found in the placement sweep. Tests: veltro_security_test's git fixed-tree pair migrated (tool sees /mnt/git without a raw grant; generic tools do not) — full suite run in emu: 33 passed, 1 skipped, PASS. nsaudit rule fixture gains /mnt/git control paths. Docs and tool text describing the live path updated in the same change. Refs: INFR-401 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Eo29oZp7mPig1XekwRPsq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First of the four placement migrations (INFR-400–403), chosen first because the path is entirely tool-internal — no external consumers, so no compatibility bind needed.
appl/veltro/tools/git.b: git/fs now mounts at/mnt/git; all reads follow.appl/veltro/nsconstruct.b: the grant moves from the/nallowlist block to the/mntfixed-function block with identical gating (derived only from thegittool capability + stat, never from generic path grants); the manifest table emits git under the/mntgroup;fixedservicecontrolpathadds/mnt/gitand retains/n/gitas a legacy control-path entry, following the existing/mnt/web+/n/webprecedent.tools9p.b's parallel predicate updated in lockstep (the two copies remain a shared-predicate consolidation candidate).lib/veltro/nsaudit/authorities/git,lib/veltro/tools/git.txt,lib/veltro/meta.txt,appl/veltro/SECURITY.md, and the three architecture docs that describe the live path — all updated in the same change, per the corpus rule that docs follow interface changes.appl/cmd/webfs.b's stale defaultmountpt := "/n/web"→/mnt/web(the tree already treats/mnt/webas canonical everywhere else).veltro_security_test's git fixed-tree pair migrated (git tool sees/mnt/gitwithout a raw grant; generic tools cannot); nsaudit rule fixture gains/mnt/git+/mnt/git/ctl.Testing
Full
veltro_security_testsuite run in emu against this tree: 33 passed, 1 skipped, PASS — includingRestrictNsGitToolDerivedagainst the migrated path. All five touched modules recompiled via mk;verify-dis-pathsgreen.Note for merge ordering with #519 (docs sweep): no file conflicts; after both land, DESIGN-PRINCIPLES' legacy list still names
/n/gitamong tracked migrations — accurate wording either way, tiny follow-up to trim it once INFR-400/402/403 complete.Refs: INFR-401
🤖 Generated with Claude Code
https://claude.ai/code/session_017Eo29oZp7mPig1XekwRPsq