gith Source

Headless by design

The headless
Git host.

One Go binary between identity and Git. No dashboard to tend, no custom client to install, and no resident service waiting around.

Bootstrap a host Read the architecture
request 8f2a short-lived process
$git push git@host:alice/project main
principal:alice
gith allow
receive-pack
policygith-admin @ 71c2
repositoryalice/project.git
evidenceintent + outcome
SSH + HTTPSordinary transports
system Gitordinary storage
default denyexplicit authorization
$ gith setup --admin-key alice.pub

One job, done completely

You bring the connection.
Gith holds the boundary.

Every request follows the same narrow path: establish who is asking, decide whether that exact Git operation is allowed, record the intent, and hand it to system Git.

Ordinary Git push alice@laptop
SSH / HTTPS
01—04
GITH
  1. 01bind principal
  2. 02read one policy
  3. 03record intent
  4. 04execute Git
exec, no shell
Bare repository main fast-forward
immutable inputgith-admin / 71c2
append-only outputaudit.jsonl / 8f2a
There is no web control plane user database custom protocol long-running Gith daemon

The control plane is a Git repository

Policy moves
the way code does.

Keys, principals, groups, repository sets, and authorization rules live in gith-admin. Review a diff. Push a commit. Activate one complete generation.

conf/gith.conf 
01# people and automation are principals
02principal alice
03principal release-bot
04
05allow read repository-set:platform
06  principal:alice
07
08allow fast-forward repository:org/api
09  principal:release-bot reference:^refs/heads/release$
10
11deny force-update repository:org/api
12  all-principals reference:^refs/heads/main$
first matching rule decidesno match → deny
The complete vocabulary06
  1. 01readclone · fetch · archive
  2. 02create-repositoryfirst eligible push
  3. 03create-referencenew branch or tag
  4. 04fast-forwardadvance history
  5. 05force-updaterewrite history
  6. 06delete-referenceremove branch or tag
71c2
reviewed commitvalidated completely
atomic activationold generation or new
known-good policynever half applied

Fail closed

If Gith cannot prove the request is allowed and record its intent, the operation stops.

audit.jsonl writable
request8f2aprincipal:alice
09:41:08.021intentallow
09:41:08.024git.receivestarted
09:41:09.117outcomesuccess
1 request→2 correlated records✓

People, CI, or AI

An agent is just another principal. Give it a key or credential, narrow its repository and reference capabilities, and keep the same audit trail.

Same Git.
Smaller blast radius.

The whole stack

OpenSSH / Apache+Gith+system Git

One binary. Ordinary protocols. Explicit policy.

Bootstrap a host View source on GitHub