[LIghtJUNction]

Scope

Refs #163 #83 #85. Base main08c58928ee3f6c6cb350d9e9fba75d072bd78f08 includes merged #165. Independent of #166/#167/#169 storage/executor and #155 recovery.

Regression-first stage

Head2dd5e9b859c3d1c4804c0240350b6e8e087fb29b, tree7e7566fa6482770c115b76e4997c6f8aec2c4243. Nine new boundary/real-Git read/reference-parser tests plus a dedicated cloud PostgreSQL/Valkey/Git/LFS workflow and notes. Production source is unchanged; expect architecture failures before implementation. Do not merge this head.

Intended changes

Separate HTTP/LFS Request/Response adaptation from NativeGitStore using explicit composition. Move the existing ReferenceGuard/guarded subprocess lifecycle from the SSH entrypoint to one neutral publication owner used by HTTP and SSH. Keep old SSH import identities compatible. Give three existing HTTP helpers/base headers one neutral owner so the extracted adapter does not create another router import cycle.

Store takes only required settings into its state, not an Application service locator. Existing physical Git operations, extension registration and bundle worker algorithms stay intact. No alternate authorization, ref commit, escrow/workflow engine or public protocol version.

Gates

Exact-source red, audited source extraction, focused real HTTP/SSH/bundle/LFS/read-only/completion regressions, full four-shard exact-node-ID, conformance/build and Recovery safety on the final combined tree. No local project execution, skipped assertions, production deployment, real credentials/funds/outbound effects or recovery promotion.

Progress: docs/GIT_BOUNDARY_PROGRESS.md. Coordination #163 comment5878830664 and #83 comment5878871933.

[LIghtJUNction]

已确认有效 red：run36486187478，head ee26deca16978ac2e8e4b42095dc17cfe10c175f / tree f25afd06bc0c64d0b7f4e4354acbb41185622463 / dirty=false，7 failed /2 passed /0 errors/skips。七项均为架构归属断言；实际 smart Git fetch、广告读取与拒绝push后的数据库/refs零变化，以及ref批次格式验证均通过。artifact10999746636已下载并读取source/JUnit，SHA256 3899f709cff08113a054da148ed374802c302555a52a139d1b7ba797c3ded8ed 与提供方一致。

说明先前2dd5e9b/run36485675845为8failed/1passed，其中1项是我新增characterization错误地期待dumb HTTP HEAD可读。原实现明确http.getanyfile=false，故修正新增测试为已有smart upload-pack路径，不放宽原访问策略、不改既有测试或生产代码。其余七项红灯仍独立存在。

已触发build/git-boundaries-170的确定性提取（input e7f4da1），只允许明确的归属/装配变化并逐方法核对算法不变。一次性helper仅取消其本次精确source-only helper SHA的重复push全套CI，最终feature/PR门槛不取消、不缩减；helper文件和权限会从最终树移除。