[pimlock]

Summary

Validate the HTTP session API proposed in NVIDIA/OpenShell#4359 with a Git push signer. The middleware consumes the complete push, signs its commits outside the sandbox, and streams a replacement request larger than the 4 MiB BUFFERED limit.

This draft lives in the personal fork as a validation example. Its base is frozen at upstream PR head 0dc751b086dd3a2190b9b87fba956e2ea36fd6c7, so the diff contains only this use case.

Related Issue

Validation for NVIDIA/OpenShell#4359, part of NVIDIA/OpenShell#2431. This fork has issues disabled; this validation draft does not close an upstream issue.

Changes

• Port the existing Git signer to HttpSessionMiddleware.EvaluateRequest with the required HTTP session capability.
• Consume STREAM input into temporary storage, then emit output_start, bounded output chunks, and finish after signing succeeds.
• Keep the SSH signing key outside the sandbox and authenticate service calls with TLS and extension JWTs.
• Add protocol, cancellation, resource-limit, authenticated TLS, and real Git signature tests, plus local and CI check integration.

Testing

• All 13 Git-signing tests pass on this branch.
• The large-push test applies a push larger than 4 MiB with Git's real receive-pack and verifies both SSH commit signatures.
• mise run pre-commit passes.

Shared runtime validation: the Docker HTTP session content-guard E2E suite passed with both signing implementations applied. No live GitHub push was tested. The full repository suite stopped at endpoint_selector_single_star_crosses_path_separators; the same prover failure reproduces on the unchanged upstream PR head.

Checklist

• Follows Conventional Commits.
• Commits are signed off for DCO.
• Example setup, protocol behavior, and limits are documented.

Push-time signing rewrites commit IDs, so users must reconcile their local branches afterward. The prototype supports SHA-1 branch updates and a bounded GitHub repository target; it is not a transparent production signing workflow.

Companion validation: SigV4 signing, based independently on the same frozen API head.