bump-leg.py rewrites and commits every workflow file it finds on disk, so an untracked draft workflow that names the leg is added whole to the lockstep commit, though the clean-root check skips untracked files because they "cannot reach a commit made with explicit pathspecs" #207

Lane: openreposhape-4 (openRepoShape-4)

Found by this lane's probe of main e4decfb on 2026-10-11, re-verified on main e4decfb today. Not claimed.

What is wrong. plan_workflows in scripts/bump-leg.py walks .github/workflows/ on disk (workflows.iterdir(), :248) and rewrites every .yml/.yaml file that names the leg, tracked or not, and the lockstep commit then names each rewritten file as an explicit pathspec, which stages it. _ensure_root_clean deliberately ignores untracked files on the reasoning that "an untracked scratch file cannot reach a commit made with explicit pathspecs". A file plan_workflows picked up is exactly one that does reach it: an untracked draft workflow that references the leg is added WHOLE to "Bump spec leg", as a new file, and the commit body says its reference "moved with it". The dry run does list the file, so a careful reader of the dry run would see it; nothing says it is untracked.

# Atlas scaffolded into local bare remotes, cloned --recurse-submodules to $C; the spec leg's
# remote advanced by one pushed commit $ADV; $CUR is the commit the spec gitlink records
git -C $C switch -q -c bump/spec
printf 'name: draft\non: workflow_dispatch\njobs:\n  d:\n    uses: testorg/Atlas-spec/.github/workflows/x.yml@%s\n' $CUR \
    > $C/.github/workflows/draft-not-mine-yet.yml
git -C $C status --short     # ?? .github/workflows/draft-not-mine-yet.yml
python3 scripts/bump-leg.py --root $C --leg spec --to $ADV --local-remote-dir $REMOTES --dry-run
#   exit 0   workflows  1 reference(s) in 1 file(s):  .github/workflows/draft-not-mine-yet.yml
python3 scripts/bump-leg.py --root $C --leg spec --to $ADV --local-remote-dir $REMOTES
#   exit 0   committed <sha>: spec, contracts/spec-pin.yaml, .github/workflows/draft-not-mine-yet.yml
git -C $C show --stat HEAD
#   Bump spec leg to <ADV> in Atlas ... 1 workflow `@<sha>` reference(s) in 1 file(s) moved with it.
#    .github/workflows/draft-not-mine-yet.yml | 5 +++++      (a new file)

What the docs promise. AGENTS.md, "Advancing a leg", item 1: "That line, the digest under it and the workflow files it names are the whole change." bump-leg.py's docstring, under what it refuses: "a dirty root. The commit is made with explicit pathspecs, so unrelated edits would not be swept in". _ensure_root_clean: "an untracked scratch file cannot reach a commit made with explicit pathspecs".

What would fix it. In plan_workflows, rewrite only TRACKED workflow files (git ls-files -- .github/workflows), and refuse by name an untracked workflow that references the leg, since the shipped validate-pins.py _workflow_refs also reads every file on disk and would turn the bump red over the draft's old @<sha> if it were merely skipped. Alternatively _ensure_root_clean could refuse untracked files under .github/workflows/ only. Whichever is chosen, the two readers must keep agreeing (test_the_reference_expression_is_the_validators_own in tests/test_bump_leg.py).