instconf: take the origin and required-key helpers from ecore Two copies of one function disagreed in this repo: hostFromOrigin returned an error for a malformed origin and web's hostOf answered "localhost", which is a guess that looks like an answer. Both are gone; the caller now names which half it means, and both wanted OriginAuthority — a port is part of a sealed-URL host, a JWT audience and the synthesized commit-author domain alike. The startup checks become one Require, so an operator filling in a fresh config.ini reads every missing key off one boot instead of one per restart. The hook's internal-origin read becomes InternalOrigin, which falls back to the external origin: an instance with only a public address is not misconfigured and used to be refused. And the git-description mirror is wired only when git.sr.ht has an API origin — web.Config already documented a nil Git as no mirroring, but nothing produced one, so an instance without git.sr.ht met config.GetAPI's panic on the first push.
internalauth: take both ends of the internal protocol from ecore The guard on /internal/repos and the header cmd/dolt-git-hook minted for it were two hand-written halves of one protocol in two packages that shared no type, no constant and no test. Both are now sr-ht-ecore/internalauth: Guard on the receiving end, AuthorizationAs on the calling one, over one Auth struct. The guard also pins the caller, which the old copy did not: core-go only asks that a token name some client and node, and on an endpoint that provisions a database for an arbitrary user that means any holder of the network key will do. The pinned pair lives in core so the mint and the pin cannot drift apart. The hook test now runs internalauth.Identify — the real receiving end — over the header the hook produced, so the two ends are checked against each other rather than against a third copy of the decode.
feat: auto-provision companion Dolt DBs from git.sr.ht pushes Add a service-to-service path so pushing a git.sr.ht repo creates a matching Dolt database at ~owner/name, ready before the user's first `dolt push`. - web: POST /internal/repos, guarded by internal-IP + network-key `Internal` auth (not the browser cookie/CSRF). Resolves/mirrors the owner via auth.LookupUser, then CreateRepo + InitStore, rolling back the row if the store init fails. Idempotent: an existing companion returns 200, a fresh one 201 — safe to call on every push. - cmd/dolt-git-hook: the git.sr.ht post-update-script. Delegates every hook stage to the stock /usr/bin/git.sr.ht-update-hook unchanged (argv[0], stdin, env, exit code preserved; fail-closed if the delegate is missing), then on post-update POSTs the companion create and prints a one-time clone notice. Best-effort: never fails a push, degrades to a warning on any misconfig. Tests cover the endpoint (provision/idempotent/rollback/bad-input) and the hook (signed request round-trips through the guard's decryption, notice only on 201).