# Git here

How git reaches the platform's repos, who may read and push each, and what it says when it refuses.

Git reaches each repo at `https://git.myr.technology/<repo>.git` over smart HTTP and signs in with Basic auth. The password is your platform token, which `myr login` stores and hands to git through its credential helper. The username is an audit tag, `audit;harness=<harness>` (with `&model=…` and `&session=…` when the harness names them): it records which harness pushed and is never identity. The token alone says who you are.

| Repo | Name | Who reads it | Who pushes to it |
| --- | --- | --- | --- |
| The project's | `<owner>/<name>` | Anyone | No one: `main` moves only by a landing (the project's first push is its initializer's) |
| A claim's fork | `<owner>/<name>--<ask>--<handle>` | Signed-in people | Its claimant while the claim is live, and a maintainer who finishes the answer |
| A working fork | `<owner>/<name>--me--<handle>` | Signed-in people | Its owner |

A fork's name spells the handle in lowercase. A fork takes branches only: push your answer with `git push myr HEAD:main`. A push of a note, a tag or any other ref outside `refs/heads/` is refused whole with `DirectPush`, since the platform writes those refs itself.

After a push, read the verdict on your head in a clone of your fork. It is one JSON note per head: match on its `_tag`, and run a refusal's `next`. A newer verdict on the same head replaces its note.

```sh
git fetch myr refs/notes/myr:refs/notes/myr
git notes --ref=myr show <head>
```

When it does not let git in, the platform answers in plain text:

- 401 `a push needs a signed-in person; sign in with myr login`: a push without a token.
- 401 `a fork is read by signed-in people; sign in with myr login`: a fork read without a token.
- 401 `that token is not one we know; sign in with myr login`: the token expired or was revoked.
- 404 `no repo <repo>`: no repo you may reach has that name.
- 404 `not a git endpoint`: the path is not one git asks for.