adopt-project.py and scaffold-project.py: a --pin-source that is a directory inside a clone records the digest of that directory's subtree alone, or of nothing, so plan, check and the scaffold pass a pin whose tree_sha256 is not the product's tree #800

Goal: a --pin-source must be a clone's top level. plan, the scaffold and check refuse any other directory by name, so no pin records the digest of part of a tree, or of nothing.

Filed by lane openRepoShape-1 from #457's lines L1-82 (its first case, #457, comment) and L1-04 (#457, comment), on Brett Heap's word of 2026-10-17T10:21:32Z, under lane 3's v1.1.1 rule (#473, issuecomment-6216697223). Measured on main bf1f099b with a stub gh.

Milestone: v1.1.1, not a regression. Passing a subdirectory of the product's clone as --pin-source is an easy slip, and today it is accepted silently, with a wrong digest.

Lines. The product clone glass holds README.md, sub/a.txt and lib/b.py. Its true digest is c183af308089….

• L1-82, first case: a subdirectory of a clone.
  • plan --pin openGlass@<head> --pin-source glass/sub records tree a17948e338f4…, the digest of sub/ alone.
  • check then says "digest recomputes … glass/sub" and plan ok.
  • scaffold-project.py … --pin-source glass/sub --dry-run prints the same tree a17948e338f4….
  • Inside a partial clone, check calls the subdirectory "a partial clone".
• L1-04: a directory inside a partial clone that is not a clone. glass-partial/notaclone is recorded as tree e3b0c44298fc…, the sha256 of nothing, and check passes it with the partial-clone NOTE.

The cause. _digest_from_pin_source (scripts/shape_materialize.py) runs tree_digest from inside the given path. git ls-tree -r without --full-tree lists only the subtree under the current directory. PR #725 set this fix aside because it "changes what both tools accept"; what they accept today is a wrong digest.

Direction

• Ask git whether the path is a top level: git -C <path> rev-parse --show-prefix is empty, or, for a bare clone, --git-dir is the path.
• Otherwise refuse pin-source-not-a-clone, naming the top level git found: "pass --pin-source ".
• check asks a recorded path the same question first, so L1-04's case becomes a finding.
• A linked worktree's top level still passes.
• tree_digest in scripts/repo_shape.py is a pinned shape copy and is NOT changed.

Tests, for plan, the scaffold (--dry-run and the real run), and check of a recorded path:

• refused: a subdirectory of a full clone, a subdirectory of a partial clone, and an untracked directory inside a clone;
• still passing: a top level, a bare clone, and a git worktree add top level.

Overlaps: scripts/shape_materialize.py is shared with the scaffold. Check the open pull requests that edit it before landing.

Lane: openreposhape-1 (openRepoShape-1)

🤖 Generated with Claude Code