internalauth: take both ends of the internal protocol from ecore The guard on /internal/repos and the header cmd/dolt-git-hook minted for it were two hand-written halves of one protocol in two packages that shared no type, no constant and no test. Both are now sr-ht-ecore/internalauth: Guard on the receiving end, AuthorizationAs on the calling one, over one Auth struct. The guard also pins the caller, which the old copy did not: core-go only asks that a token name some client and node, and on an endpoint that provisions a database for an arbitrary user that means any holder of the network key will do. The pinned pair lives in core so the mint and the pin cannot drift apart. The hook test now runs internalauth.Identify — the real receiving end — over the header the hook produced, so the two ends are checked against each other rather than against a third copy of the decode.
web: mirror the git twin's description onto companion databases The internal create endpoint accepts a description, but its only caller — dolt-git-hook — never sends one: git.sr.ht's push context does not carry it. Companion databases therefore all sat descriptionless on the dashboard while their git twins had perfectly good descriptions. Resolve the description server-side instead: a GitDescriber dependency (internal GraphQL query to git.sr.ht in the owner's name, the same network-key trust the hook uses to reach us, pointed the other way) is consulted on every /internal/repos call. A fresh companion is created with the twin's description; for an existing one the push doubles as the sync point — a changed, non-empty git description overwrites the stored one. An empty git description never clobbers one set in dolt's own settings, and every failure mode (no twin, git.sr.ht down, no resolver wired) degrades to no mirroring. The lookup is capped at 3s so the hook's own 5s POST timeout is never exceeded. Adds testify as a direct dependency for the new tests.
feat: auto-provision companion Dolt DBs from git.sr.ht pushes Add a service-to-service path so pushing a git.sr.ht repo creates a matching Dolt database at ~owner/name, ready before the user's first `dolt push`. - web: POST /internal/repos, guarded by internal-IP + network-key `Internal` auth (not the browser cookie/CSRF). Resolves/mirrors the owner via auth.LookupUser, then CreateRepo + InitStore, rolling back the row if the store init fails. Idempotent: an existing companion returns 200, a fresh one 201 — safe to call on every push. - cmd/dolt-git-hook: the git.sr.ht post-update-script. Delegates every hook stage to the stock /usr/bin/git.sr.ht-update-hook unchanged (argv[0], stdin, env, exit code preserved; fail-closed if the delegate is missing), then on post-update POSTs the companion create and prints a one-time clone notice. Best-effort: never fails a push, degrades to a warning on any misconfig. Tests cover the endpoint (provision/idempotent/rollback/bad-input) and the hook (signed request round-trips through the guard's decryption, notice only on 201).