fix(node,git): isolate authed pushes in a dedicated write pool (#62)

git-receive-pack now draws from a separate git_write_semaphore (max_concurrent_git_pushes) instead of the shared pool, so a flood of anonymous reads can no longer shed an authenticated push at admission (jatmn P1a). The shared field is renamed git_read_semaphore and continues to gate upload-pack and both info/refs advertisements. The write permit stays above acquire_write so it precedes the Tigris fresh-acquire (INV-10).

Handler-layer tests: write-pool shed (503), and a cross-boundary proof that an exhausted read pool does NOT shed a push; both mutation-checked (routing receive-pack back to the read pool flips each RED). 497 tests pass.

Part of #174.

Author: t

crates/gitlawb-node/src/api/repos.rs

@@ -509,7 +509,7 @@ pub async fn git_info_refs(
 ) -> Result<Response> {
     // Shed with a 503 before spawning git when the concurrency cap is saturated;
     // held for the whole op (incl. the smart_http call), released on return.
-    let _permit = git_permit(&state.git_semaphore)?;
+    let _permit = git_permit(&state.git_read_semaphore)?;
     let name = smart_http_repo_name(&repo)?;
     tracing::info!(owner = %owner, repo = %name, "info/refs request");
     let record = state
@@ -637,7 +637,7 @@ pub async fn git_upload_pack(
 ) -> Result<Response> {
     // Shed with a 503 before spawning git when the concurrency cap is saturated;
     // held for the whole op (incl. the smart_http call), released on return.
-    let _permit = git_permit(&state.git_semaphore)?;
+    let _permit = git_permit(&state.git_read_semaphore)?;
     let name = smart_http_repo_name(&repo)?;
     let record = state
         .db
@@ -876,9 +876,11 @@ pub async fn git_receive_pack(
     body: Bytes,
 ) -> Result<Response> {
     // Shed with a 503 before spawning git when the concurrency cap is saturated.
-    // Acquired at the very top so it wraps the write-guard below; held for the
-    // whole op (incl. the smart_http call), released on return.
-    let _permit = git_permit(&state.git_semaphore)?;
+    // Pushes draw from the dedicated WRITE pool, separate from reads, so a flood of
+    // anonymous reads cannot shed an authenticated push (#174). Acquired at the very
+    // top so it wraps the write-guard below (and precedes the Tigris acquire_write,
+    // bounding concurrent fresh acquires — INV-10); held for the whole op.
+    let _permit = git_permit(&state.git_write_semaphore)?;
     let name = smart_http_repo_name(&repo)?;
     tracing::info!(owner = %owner, repo = %name, "receive-pack request");
     let record = state

crates/gitlawb-node/src/auth/mod.rs

@@ -520,7 +520,8 @@ mod tests {
             sync_trigger_rate_limiter: RateLimiter::new(60, Duration::from_secs(3600)),
             peer_write_rate_limiter: RateLimiter::new(600, Duration::from_secs(3600)),
             shutdown_tx: tokio::sync::watch::channel(false).0,
-            git_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
+            git_read_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
+            git_write_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
         }
     }
 

crates/gitlawb-node/src/main.rs

@@ -378,7 +378,10 @@ async fn main() -> Result<()> {
         sync_trigger_rate_limiter,
         peer_write_rate_limiter,
         shutdown_tx: shutdown_tx.clone(),
-        git_semaphore: Arc::new(tokio::sync::Semaphore::new(config.max_concurrent_git_ops)),
+        git_read_semaphore: Arc::new(tokio::sync::Semaphore::new(config.max_concurrent_git_ops)),
+        git_write_semaphore: Arc::new(tokio::sync::Semaphore::new(
+            config.max_concurrent_git_pushes,
+        )),
     };
 
     // Periodic peer-count poll for the metrics gauge. If p2p is disabled

crates/gitlawb-node/src/state.rs

@@ -88,10 +88,16 @@ pub struct AppState {
     ///   * the libp2p swarm task
     ///   * the gossip, sync, operator heartbeat, and rate-limit cleanup loops
     pub shutdown_tx: tokio::sync::watch::Sender<bool>,
-    /// Bounds concurrent served git operations. A handler acquires a permit
-    /// before spawning git and holds it for the op; when none are free the
-    /// request is shed with a 503 rather than exhausting the PID/thread table.
-    pub git_semaphore: Arc<tokio::sync::Semaphore>,
+    /// Bounds concurrent served git READ operations (upload-pack + both info/refs
+    /// advertisements). A read handler acquires a permit before spawning git and
+    /// holds it for the op; when none are free the request is shed with a 503.
+    /// Writes draw from `git_write_semaphore` so a read flood cannot shed an
+    /// authenticated push at admission (#174).
+    pub git_read_semaphore: Arc<tokio::sync::Semaphore>,
+    /// Bounds concurrent `git-receive-pack` (push) operations, a pool separate
+    /// from `git_read_semaphore` so anonymous reads can never shed an authenticated
+    /// push (#174). Sized by `max_concurrent_git_pushes`.
+    pub git_write_semaphore: Arc<tokio::sync::Semaphore>,
 }
 
 impl AppState {

crates/gitlawb-node/src/test_support.rs

@@ -83,7 +83,8 @@ fn build_state(db: Arc<crate::db::Db>, pool: PgPool) -> AppState {
         peer_write_rate_limiter: RateLimiter::new(600, Duration::from_secs(3600)),
         shutdown_tx: tokio::sync::watch::channel(false).0,
         // Generous — no test drives the handler-level shed (git_permit is unit-tested).
-        git_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
+        git_read_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
+        git_write_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
     }
 }
 
@@ -199,7 +200,7 @@ mod tests {
     #[tokio::test]
     async fn git_info_refs_sheds_with_503_when_semaphore_exhausted() {
         let mut state = test_state_lazy();
-        state.git_semaphore = Arc::new(tokio::sync::Semaphore::new(0));
+        state.git_read_semaphore = Arc::new(tokio::sync::Semaphore::new(0));
 
         let router = Router::new()
             .route(
@@ -235,7 +236,7 @@ mod tests {
     #[tokio::test]
     async fn git_upload_pack_sheds_with_503_when_semaphore_exhausted() {
         let mut state = test_state_lazy();
-        state.git_semaphore = Arc::new(tokio::sync::Semaphore::new(0));
+        state.git_read_semaphore = Arc::new(tokio::sync::Semaphore::new(0));
 
         let router = Router::new()
             .route(
@@ -273,7 +274,7 @@ mod tests {
     #[tokio::test]
     async fn git_receive_pack_sheds_with_503_when_semaphore_exhausted() {
         let mut state = test_state_lazy();
-        state.git_semaphore = Arc::new(tokio::sync::Semaphore::new(0));
+        state.git_write_semaphore = Arc::new(tokio::sync::Semaphore::new(0));
 
         let router = Router::new()
             .route(
@@ -295,7 +296,7 @@ mod tests {
         assert_eq!(
             resp.status(),
             StatusCode::SERVICE_UNAVAILABLE,
-            "an exhausted git semaphore must shed git-receive-pack with 503 before touching the DB"
+            "an exhausted write pool must shed git-receive-pack with 503 before touching the DB"
         );
         assert_eq!(
             resp.headers()
@@ -306,6 +307,42 @@ mod tests {
         );
     }
 
+    /// #174 (SC1, load-bearing): a saturated READ pool must NOT shed an
+    /// authenticated push — the write pool is a separate budget. Read pool at zero,
+    /// write pool with capacity: the push proceeds PAST admission (it then errors on
+    /// the placeholder DB, but crucially it is not a 503). Route git-receive-pack
+    /// back to the read pool and this goes red — that is the isolation proof.
+    #[tokio::test]
+    async fn git_receive_pack_not_shed_by_exhausted_read_pool() {
+        let mut state = test_state_lazy();
+        // Read pool exhausted as if a flood of anonymous clones held every slot.
+        state.git_read_semaphore = Arc::new(tokio::sync::Semaphore::new(0));
+        // Write pool keeps its default capacity from test_state_lazy.
+
+        let router = Router::new()
+            .route(
+                "/{owner}/{repo}/git-receive-pack",
+                axum::routing::post(crate::api::repos::git_receive_pack),
+            )
+            .with_state(state);
+        let owner = "did:key:zRECVCROSSBOUNDARYAAAAAAAAAAAAAAAAAAAAA";
+        let resp = router
+            .oneshot(signed_request_as(
+                owner,
+                Method::POST,
+                "/alice/repo.git/git-receive-pack",
+                Body::from(&b"0000"[..]),
+            ))
+            .await
+            .unwrap();
+
+        assert_ne!(
+            resp.status(),
+            StatusCode::SERVICE_UNAVAILABLE,
+            "an exhausted READ pool must not shed a push — the write pool is a separate budget (#174)"
+        );
+    }
+
     /// N7: merge_pr is owner-only. A non-owner is rejected by require_repo_owner
     /// before any git work (so no on-disk repo is needed for the rejection).
     #[sqlx::test]