tests/test_adopt_plan_value_order.py: follow-up of PR #1125 (#1020) from its review: four mutants of the head ask (L1, L2, L4, L11) that none of its 85 rows kills, so a bad id: or org: beside a --work-dir that is a file or a shared one, or beside a gone source, is pinned through neither check nor execute #1179

(lane openRepoShape-4, 2026-10-22T20:31:36Z)

Found by: RV1125b, the independent review of PR #1125 (for #1020) at 9549006f (#1125 issuecomment-6347244363). It found no MUST and no SHOULD, and graded this one NIT-A. Line numbers are approximate, at 9549006f (#1125's head, adopt-project.py sha256 412edbda). Its other NIT, NIT-B, is a sentence of the PR body, which is not this issue's.

What is missing

Nothing a user can see: there is no limit here. #1125's code is right on every case below, and F4 measured each again on 9549006f. But four mutants of the head ask (L1, L2, L4 and L11) leave the PR's two order files, tests/test_adopt_plan_value_order.py and tests/test_adopt_check_plan_name.py (85 rows), green, so a later change could put the ask after one of the work directory's own refusals, or after the source is opened, and no test would fail.

Both commands ask plan.names() and _checked_org_and_id(plan) right after the plan's keys, and before _work_root: in cmd_check (about :12313 and :12314, with _work_root at :12315 and plan.open_source at :12325) and in cmd_execute (about :14973 and :14974, with _work_root at :14975, _refuse_an_unwritable_work_dir at :14977, plan.open_source at :14978 and _require_filter_repo() at :14980). The one row that pins the position against the work directory is test_the_org_or_the_id_is_named_before_an_unwritable_work_dir (about :511 of the first file), and it uses chmod 500 alone. _work_root refuses two more things before anything is made, and check and execute refuse a gone source too, and no row puts a bad id: or org: beside any of them.

The rows go onto #1125's branch, or into the file after #1125 lands (it is a draft and not on main). No change to adopt-project.py. This is about where the two asks sit among the refusals. The order among the problems of a plan with no bad id: or org: is #1113's, not this issue's: see #1113.

Rows to add

<D> is the test's tmp_path, and <realpath D> is os.path.realpath of it. Each row is test_the_org_or_the_id_is_named_before_an_unwritable_work_dir's shape (both_on(edited(answered, edit), tmp_path, work), BAD_ID or BAD_ORG, with needs_filter_repo as the file's other rows have), once for id and once for org. Expected for each of the six: exit 2 from check and from execute, the first REFUSED line of each the same, and none of adopt-work-dir-unwritable, adopt-work-dir-shared or plan-source-gone anywhere on either's stderr:

• id: REFUSED plan-bad-id: <D>/adoption-plan.yaml: `id:` is 'North Wind' and must match ^[a-z0-9][a-z0-9-]*$

• org: REFUSED unsafe-value: org is '-evil', which is not a value this tool will put on a `git` or `gh` command line

• A --work-dir that is a file. <D>/a-file, made by the test with write_text("mine\n"), passed as --work-dir to both. The control, the plan unedited beside the same file, is the refusal both commands make:
  REFUSED adopt-work-dir-unwritable: --work-dir `<realpath D>/a-file` cannot be made: making it a directory failed (File exists)
  Mutants L1, L4 and L11 make check or execute say that line in place of the id or the org.

• A shared --work-dir. <D>/shared-work, made by the test and given os.chmod(work, 0o777) (every user can write in it, no sticky bit). Mark it WINDOWS_SKIP (from conftest): the shared test is never asked on Windows. The control is:
  REFUSED adopt-work-dir-shared: --work-dir `<D>/shared-work` can be written in by every user, without the sticky bit, so another user could rename or replace what this run makes in it
  RV1125b's NIT-A names "a --work-dir that is a file or a shared one"; the request that filed this issue named the file and the gone source, and the shared row is the same kind of row, so it is here too. Drop it if the lane rules otherwise.

• A gone source. No --work-dir for check, as both_on gives none. Replace the plan's local_path: line with local_path: "<D>/Gone" (with_line and double_quoted of tests/test_adopt_template_values.py do it), a path that names nothing, so that plan did not clone it. The control, the plan unedited beside the same path, is the refusal both commands make:
  REFUSED plan-source-gone: the plan's `source.local_path`, `<D>/Gone`, names nothing that exists, and the plan does not record it as a clone `plan` made (`source.cloned` is not `true`), so nothing clones it again
  Mutant L2 makes check say that line in place of the id or the org.

Every expected line above is what 9549006f prints (F4's probes: a stub gh first on PATH, GH_TOKEN=bogus, an empty GH_CONFIG_DIR, the landing gate's git environment). On each of the six, both commands print the same first line, exit 2, and check's stdout is empty.

Mutants these rows kill

Each was applied to adopt-project.py at 9549006f in a scratch worktree, run against the two order files (85 rows) and against the six rows above, and restored with its sha256 checked (412edbda, the same after each one):

On 9549006f itself the six rows pass, and so do the 85.

Done when

Each new row passes on 9549006f and fails on its mutants (RV1125b's L1, L2, L4 and L11 are defined in its comment above), with each mutant run restored and its sha256 checked.

See #1020, #1125 and #1113.

Lane: openreposhape-4 (openRepoShape-4)