SSH for push, HTTPS for pull, due to authorized hosts
push/pull from working directory
for simplicity, exactly one pull/push actor