Record the git.terst.org remotes and the two-machine workflow

Every active repo now has a bare remote there, and both tungsten and the
Fedora laptop push to them. Listen gained a commit while this session sat
idle, so 'fetch before starting' is now a real requirement rather than
hygiene.

Also corrects the SHA in the Fedora handover: it cites 7f634ca, which is not
in the repo -- the commit was amended before pushing and 84ec886 is the one
that exists. A future session would have hunted for a commit that never
landed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 45 insertions, 0 deletions

diff --git a/workspace-git-remotes.md b/workspace-git-remotes.md
new file mode 100644
index 0000000..a1125b2
--- /dev/null
+++ b/workspace-git-remotes.md
@@ -0,0 +1,45 @@
+---
+name: workspace-git-remotes
+description: "Every /workspace repo now has a `local` remote on git.terst.org, and two machines push to them — fetch before starting work"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: 08c1f89c-4d24-4fb2-9488-0fe155872388
+  modified: 2026-09-24T09:01:57.575Z
+---
+
+**As of 2026-09-24 every active repo has a bare remote at `/site/git.terst.org/repos/<name>.git`.**
+Created this session: `listen.git`, `feedreader.git`, `devtools.git`, `podkit.git`. Already
+existed: `doot.git`, `claudomator.git`, `nav.git`, `modal-shell.git`, `claude-memory.git`.
+
+**Two machines push to these — tungsten and Peter's Fedora laptop.** Listen went from 18 to 19
+commits while this session sat idle. **`git fetch` before starting work on any repo**, and
+expect to fast-forward rather than assuming your local HEAD is current. A SHA-equality check is
+not a divergence check: use `git merge-base --is-ancestor` before calling something diverged
+(I reported a clean fast-forward as a divergence by comparing SHAs alone).
+
+**Convention, copied from the pre-existing `doot.git`:**
+- bare, `--shared=group`, but **no setgid** — doot is plain `775`, and `--shared=group` leaves
+  `2775`, so clear it with `chmod -R g-s`
+- owned `www-data:www-data`, dirs `775`, files `664`
+- a one-line `description` file (some web UIs display it)
+- `HEAD` points at *that repo's own* branch — `listen`/`devtools`/`podkit` use `main`,
+  `feedreader`/`doot` use `master`. Don't normalise one to the other.
+
+**Pushing as root leaves root-owned files behind.** `chown -R www-data:www-data <repo>.git`
+after every push. `doot.git` has ~339 files with this drift already; harmless at `775` because
+everything is group-readable, but it will bite if a web UI ever runs as another user.
+
+**Git refuses these paths with a "dubious ownership" error** because the bare repos are
+www-data-owned and sessions run as root. `safe.directory` entries already exist for `doot.git`
+and `claude-memory.git`; adding one for a new repo follows that established policy rather than
+deciding anything. Still check `git config --global --get-all safe.directory` first — see
+[[feedback_verify_before_asserting_root_cause]] — because silencing the error blind is how a
+real permissions problem gets papered over.
+
+**The memory tree itself is one of these repos.** `/root/.claude/projects/-workspace/memory` is
+a git checkout with remote `terst`. It diverges in both directions routinely: commit local
+changes, `git merge terst/main`, resolve `MEMORY.md` (the conflict is always both sides
+appending index lines — keep both), verify every `](file.md)` link resolves, then push.
+
+See [[workspace-layout]] and [[fedora-android-build-setup]].