feat(node,git): cap concurrent served git ops with a 503 load-shed (#62)

.env.example

@@ -109,10 +109,32 @@ GITLAWB_MAX_PACK_BYTES=2147483648
 
 # Max seconds a served git upload-pack / receive-pack (clone / push) may run
 # before it is aborted with a 504. Bounds a hung git that would otherwise pin a
-# worker and, on push, the repo write lock. Does NOT cover the info/refs
-# advertisement or the withheld-blob path, which remain unbounded. Default 600.
+# worker and, on push, the repo write lock. Also bounds the info/refs
+# advertisement and the withheld-blob pack build (#174). Default 600.
 GITLAWB_GIT_SERVICE_TIMEOUT_SECS=600
 
+# Max concurrent git read ops (upload-pack + info/refs advertisements) served at
+# once, a global pool separate from the push pool below. Over-cap sheds a clean
+# 503 + Retry-After. Anonymous reads draw from here, so pair it with
+# GITLAWB_MAX_CONCURRENT_READS_PER_CALLER (below) so one caller cannot monopolize
+# the pool. Default 128.
+GITLAWB_MAX_CONCURRENT_GIT_OPS=128
+
+# Max concurrent git-receive-pack (push) operations, in a pool separate from the
+# read pool (GITLAWB_MAX_CONCURRENT_GIT_OPS) so anonymous reads cannot shed an
+# authenticated push at admission. Over-cap sheds a 503 + Retry-After. Default 32.
+GITLAWB_MAX_CONCURRENT_GIT_PUSHES=32
+
+# Max concurrent read ops (upload-pack + info/refs advertisements) a single caller
+# may hold, so one caller cannot monopolize the read pool. Keyed per-DID when
+# signed, else per-source-IP. The per-IP key is only as granular as
+# GITLAWB_TRUSTED_PROXY below: left unset, a node behind an edge/NAT keys all
+# anonymous callers on the edge IP and this collapses to one global anonymous cap.
+# Set GITLAWB_TRUSTED_PROXY for per-client keying; a high-fanout caller (CI behind
+# one NAT) should authenticate for a per-DID budget or the operator raises this.
+# Default 16.
+GITLAWB_MAX_CONCURRENT_READS_PER_CALLER=16
+
 # ── Push rate limiting (git-receive-pack flood brake) ─────────────────────
 # Max receive-pack requests (info/refs advertisement + push POST) per client
 # IP per hour. 0 disables. Default 600.

README.md

@@ -343,7 +343,7 @@ Important node settings:
 | `GITLAWB_REQUIRE_SIGNED_PEER_WRITES` | Require signed peer announce/sync writes. |
 | `GITLAWB_AUTO_SYNC` | Enable automatic sync from known peers. |
 | `GITLAWB_MAX_PACK_BYTES` | Max git pack body size for smart-HTTP routes. |
-| `GITLAWB_GIT_SERVICE_TIMEOUT_SECS` | Max seconds a served git upload-pack/receive-pack may run before it is aborted (504). Default 600. Does not bound `info/refs` or the withheld-blob path. |
+| `GITLAWB_GIT_SERVICE_TIMEOUT_SECS` | Max seconds a served git upload-pack, receive-pack, or `info/refs` advertisement may run before it is aborted (504). Default 600. Also bounds the withheld-blob classification walk (on both the upload-pack serve and receive-pack replication paths), which is reaped at the deadline. |
 | `GITLAWB_TIGRIS_BUCKET` | Optional S3/Tigris shared repo storage bucket. |
 | `GITLAWB_PINATA_JWT` | Optional Pinata/IPFS warm-storage pinning. |
 | `GITLAWB_IRYS_URL` | Optional Irys/Arweave permanent anchoring. |

crates/gitlawb-node/src/api/ipfs.rs

@@ -27,7 +27,7 @@ use std::str::FromStr;
 use crate::auth::AuthenticatedDid;
 use crate::error::{AppError, Result};
 use crate::git::store;
-use crate::git::visibility_pack::{allowed_blob_set_for_caller, has_path_scoped_rule};
+use crate::git::visibility_pack::{allowed_blob_set_for_caller_bounded, has_path_scoped_rule};
 use crate::state::AppState;
 use crate::visibility::{visibility_check, Decision};
 
@@ -142,10 +142,16 @@ pub async fn get_by_cid(
                 let is_public = repo.is_public;
                 let owner = repo.owner_did.clone();
                 let caller_for_walk = caller_owned.clone();
-                // Full-history walk shells out to git — keep it off the async runtime.
+                let git_bin = state.git_bin.clone();
+                let walk_timeout =
+                    std::time::Duration::from_secs(state.config.git_service_timeout_secs);
+                // Full-history walk shells out to git — keep it off the async runtime,
+                // bounded and reaped like the served-git ops (#174).
                 let walk = tokio::task::spawn_blocking(move || {
-                    allowed_blob_set_for_caller(
+                    allowed_blob_set_for_caller_bounded(
                         &rp,
+                        &git_bin,
+                        walk_timeout,
                         &r,
                         is_public,
                         &owner,