[groupsky]

The code of pullgate v0.1 (#1), as DESIGN.md describes it.

Progress

• pullgate run, pullgate listen, pullgate apply, pullgate status
• safe git as root (rule 6), tree export without filters
• spool between root and the listener, with os.Root
• tests for every rule (fake Telegram server, local git remote)
• end-to-end test in CI (test/e2e)
• example systemd units and configs, systemd-analyze security scores in the README
• README
• security review and correctness review, findings fixed

Review findings not fixed, and why

• The listener holds its lock during Telegram calls (a tap can wait behind a slow send). It fails closed and is rare; a send queue is for later.
• --trust-own-config stays in the binary for the end-to-end test. Abusing it needs root to change the unit.
• A stale .tmp-* file in the inbox (listener crash in the middle of a write) can trip the start limit of the apply unit for up to 10 seconds; root removes it after 10 seconds.

🤖 Generated with Claude Code