From aa20eaff895f6e5b9d7dc6cca6e69f53c4bd0747 Mon Sep 17 00:00:00 2001 From: Jeff Gonzalez Date: Mon, 7 Sep 2026 14:04:32 -0400 Subject: [PATCH] =?UTF-8?q?marmalade:=20git=20wins=20list,=20measured=20?= =?UTF-8?q?=E2=80=94=20and=20I=20overclaimed=20the=20auth=20saving?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit git archive --remote is out: gitea allows it, github 422s, gitlab 404s. Partial clone with --filter=blob:none --depth=1 --no-checkout is uniform across gitea, github and gitlab, and lists homelab-cluster's six published documents over ssh in under a second — the list I could not get this morning. REST would be three URL shapes, three JSON shapes and three auth schemes, and it 404s on the private repo, which is the case that matters. Corrects my claim that git collapses the auth section. It does not: list goes over git, but add and check still want HTTP, because a 304 is a few hundred bytes and a partial clone is 124KB, so checking eight externals over git costs a megabyte to learn nothing. Private raw HTTP needs a token. Two credentials per host, not one. The argument for git is consistency, not thrift, and that argument stands alone. Records the failure mode: --filter is a server capability and git's fallback is silent, so detect the warning rather than letting list become a full clone. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris --- .loom/cart/current/claude-marmalade.md | 86 ++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) diff --git a/.loom/cart/current/claude-marmalade.md b/.loom/cart/current/claude-marmalade.md index 6403b92..e09c3ca 100644 --- a/.loom/cart/current/claude-marmalade.md +++ b/.loom/cart/current/claude-marmalade.md @@ -154,3 +154,89 @@ would have caught this.* **Nothing was lost** — *the shelf would have caught it and it did not need to, because you simply wrote it again into the next round.* **Which is the mechanism working.** + +--- + +# Measured: git, and your instinct was right + +**Taken: `published check`.** *`reachable` is gone as a word.* + +## `git archive --remote` is out + +``` +gitea works (ssh) +github HTTP 422 +gitlab HTTP 404 +``` + +*One round trip and no clone, and only one of three hosts allows it.* + +## Partial clone is uniform across all three + +**`git clone --filter=blob:none --depth=1 --no-checkout`, then +`git ls-tree HEAD:.loom/published`:** + +``` +gitea filter ok .git=124KB +github filter ok .git=124KB +gitlab filter ok .git=144KB +``` + +**Same flags, same command, same output shape.** *And on the repository that +started all this:* + +``` +jeffry/homelab-cluster 0s 124KB + databases.md gitea.md private-access.md + public-access.md recovering-data.md storage.md +``` + +> **That is the list I could not get this morning**, *in one command, against a +> private repository, in under a second.* + +## What REST would have cost + +``` +gitea /api/v1/repos/{o}/{r}/contents/{path} +github /repos/{o}/{r}/contents/{path} (api.github.com) +gitlab /api/v4/projects/{url-encoded}/repository/tree +``` + +**Three URL shapes, three JSON shapes, three auth schemes** — *and the private +gitea repository returns `404` anonymously, so REST fails on exactly the case that +matters.* **Your sense was right and it is now measured rather than felt.** + +## But I overclaimed, and here is the correction + +**I wrote that git "collapses most of your `auth` section." It does not.** + +*`list` discovers names over git. **`add` and `check` still want HTTP***, because +freshness is a conditional request — *a `304` is a few hundred bytes and a partial +clone is 124KB, so checking eight externals over git would cost a megabyte to +learn nothing.* + +**And raw HTTP against a private repository is `404` without a token.** *So the +honest account is:* + +| | transport | credential | +|---|---|---| +| **`external list`** | git | *ssh key or https creds you already have* | +| **`external add`, `external check`** | HTTP | **a read token, for private repos** | +| **`published check`** | HTTP, anonymous | *none, deliberately* | + +**Two credentials per host, not one.** *The argument for git is **consistency**, +not thrift* — **one mechanism against three hosts instead of three adapters** — +*and that argument stands on its own.* **The auth saving was me liking my answer.** + +*Untested: whether a gitea read token actually works against raw HTTP on a private +repository.* **It is the specimen's assumption and nobody has run it.** + +## The failure mode to build for + +**`--filter` is a server capability.** *All three hosts here allow it; an older +self-hosted gitea or gitlab may not, and **git's fallback is silent** — it warns +`filtering not recognized by server` and downloads everything.* + +**`--depth=1` bounds the damage to one commit**, *which is why both flags are +there and not just the filter.* **Detect the warning and say so**, rather than +letting `list` quietly become a full clone of somebody's monorepo.