[tonibergholm-codento]

#316 listed two gaps with no test behind them: whether cancelled git transfers clean up after themselves, and what happens to a transfer in flight when the server gets SIGTERM. These tests cover both against real git, and record two findings.

Tests

• a_push_cancelled_while_holding_its_ref_lock_releases_it: a test reference-transaction hook holds a real push in prepared while refs/heads/main.lock exists. The test cancels the transport the way a delete or shutdown does. The lock is removed, main doesn't move, and the client fails.
• a_push_cancelled_mid_pack_moves_no_ref_and_its_quarantine_is_reclaimed: a raw receive-pack request sends half of a real pack, then disconnects. No ref moves and no lock survives. A maintenance pass removes any quarantine left behind once it is old enough.
• deleting_a_repository_during_a_clone_fails_the_clone: a raw upload-pack request reads only the response head, then the repository is deleted. The response ends without its terminating chunk, so the client gets an error rather than a clean but truncated pack. A control read of the same request ends cleanly.
• sigterm_lets_a_clone_in_flight_finish_within_the_drain and sigterm_cancels_a_clone_still_running_at_the_drain_deadline run a real sc-forge serve process. A clone that finishes within --shutdown-timeout completes. A clone still running at the deadline is cut after the server has waited the full drain, and no git process group outlives the server.
• A response read that times out fails each test, so a hung transfer can't pass.

Findings (both recorded in docs/THREAT-MODEL.md, neither fixed here)

1. With Apple git 2.54, a push cancelled mid-pack can leave objects/tmp_objdir-incoming-* behind even though the server sends SIGTERM first. Maintenance's stale sweep removes it.
2. In about 1 run in 8 locally, the request-body read in cgi.rs Pump::run doesn't see a client's EOF mid-body. The transport then ends only at --git-idle-timeout (default 120 s). Cleanup is the same, just later. The cancelled-push test uses a 5 s idle timeout to keep its run time bounded. A fix belongs in its own transport PR.

No product code changes.

Proof: each new test passed 5 runs in a row locally (macOS), with fmt, clippy (-D warnings) and cargo test -p scl-forge green. I reproduced the missed EOF with trace lines in the body pump, then removed them.

Reviewed with sol-loop: 3 rounds with gpt-6.1-sol on high. Sol verdict: approved

Created with Claude Opus 5.5 in T3 Code (Claude Code harness), with gpt-6-luna drafting the first version of the tests.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T11:04:28.144169Z	05f58a1	New commits
🔒 Security Review	✅ Completed 2026-11-09T11:05:28.161159Z	05f58a1	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 49aeb04d-0f08-40be-b335-b480a0e8f280

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn