fix(http_endpoint): git pack modules get a fuel floor, not a fixed ceiling

[rita-aga]

Problem

git_upload_pack / git_receive_pack run as WASM integrations with a fixed MaxFuel. Pack emission and ingest are bulk byte-streaming — instruction count scales with repo size — so any fixed fuel ceiling silently truncates clones/pushes once a repo outgrows it. This is the recurring ARN-57 / ARN-278 / ARN-284 class: the budget was raised 20B → 100B, and temperpaw/paw-agent now exhausts even 100B on clone:

git-upload-pack ... fuel exhausted -- module exceeded instruction budget

(confirmed in production Genesis logs; clone dies with invalid index-pack output / early EOF). The persisted endpoint entity can't be PATCHed without admin scope, and a redeploy won't reset it — so raising it per-repo isn't a durable fix.

Fix

git pack modules are trusted internal modules bounded by timeout (300s) and memory (512MB), not instruction count. Give them GIT_PACK_FUEL_FLOOR = 10T that the stored MaxFuel can only raise, never lower. ~100x the last override — effectively unbounded for any realistic pack, still a runaway safety bound. Non-git endpoints are unaffected.

Tests

• Existing git-module fuel assertions updated to the floor.
• Added: a stored value above the floor is preserved; a non-git module's explicit fuel is untouched.
• cargo test -p temper-server --lib http_endpoint → 21 passed.

Deploy: merge → bump the genesis submodule temper pin → redeploy genesis → verify paw-agent clone succeeds.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vw8tCkfnUW8p149yUNfSEE

Greptile Summary

The PR revises the git pack fuel fix so only git_upload_pack receives a 10T minimum fuel budget, while preserving the tighter limit for client-controlled git_receive_pack.

• Applies the fuel floor only to clone/fetch pack emission.
• Preserves configured upload-pack budgets above the floor.
• Keeps receive-pack and non-git endpoint fuel behavior unchanged.
• Adds regression coverage for lower, higher, and unaffected configured budgets.

Confidence Score: 5/5

The PR appears safe to merge because the previously identified receive-pack resource-boundary issue is addressed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/temper-server/src/http_endpoint.rs	Separates upload-pack and receive-pack fuel handling, resolving the prior concern by retaining receive-pack’s bounded 20B budget while floor-raising upload-pack.

_{Reviews (2): Last reviewed commit: "review(#417): scope the fuel floor to up..." | Re-trigger Greptile}

[rita-aga]

Holding as draft. Codex's P1 (unauthenticated public upload-pack + effectively-unbounded fuel + no admission control) is valid and I'm not shipping the fuel floor without addressing it. Proper path per ARN-278/ARN-311: either gate the floor to authenticated requests, or land admission/rate-limiting (ARN-311) first. Decoupling the katagami design work from this infra track for now.