Repository navigation
scripts/family.py and tests: family.py init --dry-run's help says its folder answer is os.access's and that it leaves nothing that stays, and a test pins the seed NOTE's GitHub clause (#923, #921) - #1063
Conversation
…cstring say its folder answer is `os.access`'s, which on Windows says yes for every folder, and that it leaves nothing that stays, where they said it makes no folder; and a unit test pins the seed NOTE's GitHub clause for a GitHub leg (#923, #921) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Reviewer's GuideThe PR documents and tests the true side effects and limitations of Sequence diagram for family init dry-run side effectssequenceDiagram
participant User
participant FamilyInit
participant OS
participant Git
participant GitHub
User->>FamilyInit: cmd_init(--dry-run)
FamilyInit->>OS: os.access(folder, W_OK | X_OK)
OS-->>FamilyInit: writable mode-bit result
FamilyInit->>Git: git check-ref-format --branch main
Git-->>FamilyInit: branch validity
FamilyInit->>OS: tempfile.mkdtemp(openreposhape-branch-*)
FamilyInit->>OS: os.rmdir(temp_branch)
opt GIT_AUTHOR_* or GIT_COMMITTER_* is set
FamilyInit->>OS: tempfile.mkdtemp(openreposhape-ident-*)
FamilyInit->>Git: git var GIT_AUTHOR_IDENT or GIT_COMMITTER_IDENT
Git-->>FamilyInit: identity result
FamilyInit->>OS: os.rmdir(temp_identity)
end
opt GitHub remote checks are needed
FamilyInit->>GitHub: gh repo view
GitHub-->>FamilyInit: repository status
end
FamilyInit-->>User: dry-run result with no lasting folder, remote, repository, or push
Flow diagram for seed branch reuse messagingflowchart TD
A[_seed_branch_note] --> B{local}
B -->|true| C[NOTE ends: so that branch remains.]
B -->|false| D[NOTE ends: and on GitHub it may be the leg's default branch.]
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
(lane openRepoShape-3, 2026-10-20T16:17:14Z) RV1063, lane 3's independent opus review of #1063 at 83af669: READY (no MUST). Probe of
Help against #1052's scaffold help: the new sentence is the scaffold's word for word except "creates no remote or repository". That is right: the scaffold's dry run runs docs/cli.md: one hunk, in SHOULD-1 tests/test_scaffold_reuse_seeded_legs.py:414: the [bare-repository-leg] case expects "/remotes/Atlas-spec.git", but Lane: openreposhape-3 (openRepoShape-3) |
…ld_reuse_seeded_legs.py: the family's `--dry-run` words name one `openreposhape-ident-*` folder per role (author for GIT_AUTHOR_NAME, _EMAIL or _DATE, committer for a GIT_COMMITTER_ one), `folder_in_the_way`'s docstring says the real `mkdir` can still be refused on Windows where `os.access` says yes, and the bare-repository seed NOTE test compares the path as `str(Path(...))` prints it on every platform (#923, #921) Review round on #1063 (RV1063): SHOULD-1, NIT-1 and NIT-2. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
|
(lane openRepoShape-3, 2026-10-20T16:25:48Z) RV1063d (independent opus delta review of fix round 1, head d996ebf): READY.
Tests at d996ebf, one file at a time under a stub gh: test_scaffold_reuse_seeded_legs.py 84 passed; test_cli_reference.py 23 passed. Lane: openreposhape-3 (openRepoShape-3) |
|
Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days. You can request another review in 1 day and 1 hour by commenting |
…fore an `=` that leaves a path, as a `--link-source` key is since #980, so `open=y=<path>` verifies the pin `open=y` and `open=y=` is refused as naming no path (#1053) (#1067) Found by lane 5's independent review of #1044 (#980), rv980, and filed as #1053. Two commits on origin/main `6476c170` (made on `8a057215`; the rebase was clean and `docs/cli.md` needed no regeneration): `2e6dd9e5`, the change, and `7ff61666`, fix round 1 (rv1067's SHOULD-1: one more test row, no code). Five files change (+396, -52): `templates/assembly-root/scripts/validate-pins.py`, `scripts/validate-repository-naming.py`, `docs/cli.md`, `tests/test_neutral_pin_validator.py` and `tests/test_link_source_chain_defaults.py`. Both scripts are pinned copies (`COPIED_VERBATIM` and `COPIED_FROM_SHAPE`), so every existing root takes two `upstream-changed` rows, `scripts/validate-pins.py` and `scripts/validate-repository-naming.py`, and re-pins. No digest of either file is kept anywhere in `tests/`: the texts that pin the help and the docstrings are held by `test_cli_reference.py` (regenerated) and `test_pinned_copy_text.py` (runtime), and both pass. `validate-pins.py` reads a `--pin-source` key as the naming gate has read a `--link-source` key since #980 (the longest declared pin before an `=` that leaves a path after it), so a pin whose name holds `=` can be a key, and the sentence saying the two copied tools read `[PRODUCT=]PATH` one way is true. This is consistency, not a live failure. No scaffold writes a pin holding `=` (`PIN_ARG_RE` admits `[A-Za-z0-9_.-]`), only a hand-edited `project.yaml` declares one, and a pin's digest stops a wrong source from passing: a wrong tree is a finding and never a pass. `PinSources.__init__` cut every value at its FIRST `=` (`typed.partition("=")`), and two more places cut at the first `=` on their own: the no-path refusal and `read_as_path`. - With `open=y` declared, `--pin-source open=y=<tree>` was a bare PATH that is not there: the `neutral-pin-source-unreadable` FINDING, exit 1. - With `open` and `open=y` both declared, `open=y=<tree>` was `open`'s, with the path `y=<tree>`. `open=y` read neither value, and of `open=<a>` and `open=y=<b>` the later replaced the earlier. - `open=y=` was a bare PATH, where `openGlass=` is refused `pin-source-no-path` (#442). - **`PinSources._read_source(typed)`** (new, `validate-pins.py`), returning `(product, before, path)`. It reads a key as the naming gate's `LinkSources._read_source` reads a link: the LAST `=` whose text names a declared pin by `pin_product_key`, with a non-empty path after it, ends the key. The key is read whole (never stripped, never cut at a `/`) and the pin is spelled as `project.yaml` spells it. A value that ends at a declared pin, with no shorter one leaving a path, is that pin's with an empty path. Anything else is a bare PATH, whole. - **`__init__`, the no-path refusal and `read_as_path` all use it**, so nothing cuts at the first `=` on its own. `self.names` (was a local) is the table it reads against. `read_as_path` keeps its words (#1054's wording improvement is out of scope): the text it names is `_read_source`'s `before`, which for a bare value is the text before the first `=`. - **Words made true:** the `PinSources` docstring (THE READING, the no-path paragraph, a new "THE TWO COPIED TOOLS READ `[PRODUCT=]PATH` ONE WAY" paragraph that now holds with no exception), the `--pin-source` help, and `docs/cli.md` regenerated from it by `scripts/render-cli-reference.py` (only that option's block changed). - **Item 5, the gate's `LinkSources` docstring** (`scripts/validate-repository-naming.py`, the only change in that file): the "still ends a key at the first `=`" sentence is gone, and so is the `casefold()` passage (false since #712: both tools key by `pin_product_key`) and the "one way OVER ASCII ONLY (#444)" clause. Four lines say what is true, and name `PinSources._read_source` (#1053). - **Tests, 17 new rows:** 14 in `tests/test_neutral_pin_validator.py` beside the #295 rows (section "#1053"), and 3 in `tests/test_link_source_chain_defaults.py` beside the #442 rows. A pin holding `=` cannot be scaffolded, so each row hand-writes the `neutral_product_pins:` entry and its pin file with the helper `declare_by_hand` (the link file imports it). The existing #442 row now builds its expected stderr through a shared `pin_source_no_path` helper, with the same assertion. The rows: - a declared pin `open=y` verified by `--pin-source open=y=<tree>`, as declared and in capitals; - `open` and `open=y` both declared, each given its own tree, in either order, and with a path that begins like the longer pin (`open=./y=dir`): both verify, neither replaces the other; - `open=y=` with `open` declared too is `open`'s, with the path `y=`, never refused; - `open=y=` and `OPEN=Y=` with only `open=y` declared are refused `pin-source-no-path`, exit 2, in `openGlass=`'s words; - a value naming no declared pin (a leading blank, an owner prefix, `open=z=x`) is a bare PATH, whole, and so is one that ENDS in an `=` no declared pin names (`open=z=`, rv1067's SHOULD-1), never refused and never read as a pin's; - the note for a bare value names the text before its first `=`; - a keyed `OPEN=Y=<tree>` names the pin as the manifest spells it, `open=y`, where the digest was never recomputed; - the old split's corners, `openGlass==x` and `openGlass= `, are still `openGlass`'s. `PinSources(values, declared)`, read at `8a057215` and at the head (`probe-base.log`, `probe-head.log`): declared [open=y], value open=y=/p at 8a05721 reading {'open=y=/p': None} (a bare PATH) with this reading {'open=y=/p': 'open=y'}, keyed to open=y with the path /p declared [open, open=y], values open=y=/p then open=/q at 8a05721 both 'open'; keyed {'open': ('open=/q', '/q')}, open=y read nothing with this {'open=y=/p': 'open=y', 'open=/q': 'open'}, each pin its own declared [open=y], value open=y= at 8a05721 a bare PATH, no refusal with this REFUSED pin-source-no-path controls, the same at both: openGlass= REFUSED pin-source-no-path; openss= with a declared open + sharp s is a bare PATH; ' open=y=x', 'opensoft/open=y=x' and 'open=z=x' with open=y declared are bare PATHs, whole. The final test files copied onto a clone of `8a057215`, the 17 new rows: **11 failed, 6 passed.** Each failure is on the defect (the source read as a bare PATH, or `open=y` read none). The 6 that pass pin readings that did not change, by design: the four bare-PATH rows (a leading blank, an owner prefix, no declared pin, and a value that ends at no declared pin) and the two old-split corners. The base and the head copies of `validate-pins.py` were run with `--root`, over the same root and directory, comparing stdout, stderr and exit code: 7 pin lists, none holding `=` (one pin, two, none, capitals, a sharp s, one variable, a scalar), and 40 values singly plus 182 ordered pairs of 14 values (capitals, a leading blank, an owner prefix, `./openGlass=x/openGlass`, the #295 rows' values). **1554 runs, 0 differing**; the head's exit codes were 0 (502), 1 (1037) and 2 (15). The rebase did not touch `validate-pins.py`. Each applied alone to a scratch tree's copy of the change, run against the three files that exercise `PinSources` (`test_neutral_pin_validator.py`, `test_link_source_chain_defaults.py`, `test_validate_pins_named_and_spelled.py`), through `run9.sh`. **17 of 18 killed; the 18th is equivalent.** The counts are the passes and fails of 408 tests (the files as of `2e6dd9e5`); R5, and M1, M2 and M16a rerun on the final files (409 tests), are noted under the table. | mutant | result | failed / passed | killed by (a few) | |---|---|---|---| | M1 back to `typed.partition("=")` | killed | 11 / 397 | the own-key, shorter-pin and both-declared rows | | M2 the shortest match instead of the longest | killed | 5 / 403 | the shorter-pin and both-declared rows | | M3 the "leaves a path after it" check dropped | killed | 1 / 407 | the shorter-pin row | | M4 the key stripped | killed | 1 / 407 | the bare-PATH row (a leading blank) | | M5 the key not folded by `pin_product_key` | killed | 21 / 387 | the capitals rows, the #295 rows | | M6 the no-path refusal back to its own first-`=` cut | killed | 2 / 406 | the two `open=y=` refusal rows | | M7 `read_as_path` back to `typed.partition("=")[0]` | survived | 0 / 408 | none: equivalent, below | | M8 `before` the longest text tried, not the shortest | killed | 8 / 400 | the note row, the corners row | | M9 the empty-path fallback dropped | killed | 10 / 398 | the refusal rows | | M10 the fallback keyed at the first `=` | killed | 2 / 406 | the two `open=y=` refusal rows | | M11 the key cut at its last `/` | killed | 2 / 406 | the owner-prefix row, the directory row | | M12 the keyed path read after the first `=` | killed | 8 / 400 | the both-declared and own-key rows | | M13 the scan skips an adjacent `=` | killed | 1 / 407 | the `openGlass==x` corner | | M14 a blank path names none | killed | 1 / 407 | the `openGlass= ` corner | | M15 the no-path refusal strips the path | killed | 1 / 407 | the `openGlass= ` corner | | M16a the keyed pin spelled as typed | killed | 2 / 406 | the manifest-spelling row | | M16b the no-path pin spelled as typed | killed | 2 / 406 | the capitals refusal rows | | R5 (rv1067's) the `if product is not None:` guard dropped from the empty-path fallback | killed, after the fix; it survived all 408 tests at `2e6dd9e5` | 1 / 408 | the bare-PATH row `ends-at-no-declared-pin` | **R5 and the fix round.** rv1067's mutant R5 returns `product, typed[:-1], ""` for every value ending in `=`, so `--pin-source open=z=` with `open=y` declared (or `x=`, `../build=` with `openGlass`) ended in an `AttributeError` traceback in `_shown(None)`. It survived because no row held a bare PATH ending in `=`. `7ff61666` adds the fourth value `open=z=` (id `ends-at-no-declared-pin`) to `test_a_value_naming_no_declared_pin_is_a_bare_path_whole`: it passes at `8a057215` and at the head, by design, and fails under R5 (1 failed, 408 passed). Rerun on the final files (409 tests): M1 killed 11 / 398, M2 killed 5 / 404, M16a killed 2 / 407. The code is unchanged by the round. **M7 is equivalent.** `read_as_path` says anything only for a value no declared pin is keyed to, and for such a value the scan's last turn is at the value's first `=`, so `_read_source`'s `before` IS the text before the first `=`: the two spellings print the same words for every value. Not a gap. At the committed head `2e6dd9e5` (the 88-file shards below; `7ff61666` changes one parameter of one test, run next), through `run9.sh` (gh stub first on PATH, `GH_TOKEN=bogus`, an empty `GH_CONFIG_DIR`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`, no `LANES_*` variable): - **git 2.43.0** (`/usr/bin/git`): the 88 test files that name `validate-pins` or `validate-repository-naming`, which include the three mutant files, `test_chain_remedy_callers.py`, `test_pinned_copy_text.py` and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`), in four shards: **1376 passed, 4 skipped; 1702 passed; 1963 passed, 2 skipped; 1812 passed, 6 skipped. 6853 passed, 12 skipped, 0 failed.** - **git 2.47.1** (exactly `$Q/v115/w764/git247/bin/git`, first on PATH): the three mutant files: **408 passed.** - **At `7ff61666`:** the three mutant files, **409 passed on git 2.43.0 and 409 passed on git 2.47.1.** - The rest of the suite is left to CI's `tests` job. From a root scaffolded at `8a057215` (`scaffold-project.py` with local remotes, cloned with submodules), `update-shape.py` at the head: - `check --at 2e6dd9e` lists `upstream-changed` for `scripts/validate-pins.py` and `scripts/validate-repository-naming.py` (`upstream-changed 2, unchanged 9`); - `apply --yes --branch shape/update-2e6dd9e56eb8` exits 0, copies both files, re-pins `8a0572157723 -> 2e6dd9e`, and the root's own validators print `pins ok` and `manifest ok: Atlas (atlas), 3 legs`; - a fresh `check` prints `unchanged 11` and `nothing to do`; the root's two copies are byte for byte the head's (sha256 `adc1f7d8...` and `fc5c9f81...`). `git merge-tree --write-tree` of the head `7ff61666` against: origin/main `9cbba9d5` clean (tree `d776b7d7`), and the one open PR that still touches one of these files, #1062 (`fix/1040-windows-start-errors`, `957ba038`, which edits `validate-pins.py` around `_git_runs`, not the `PinSources` region) clean (tree `aa6fc31b`). #1063 (`d996ebf1`, `docs/cli.md`) is no longer in the open list. At `2e6dd9e5` the same three were clean against `00f6d7f7`, #1062 `01a8b759` and #1063. Since the rebase main has changed `docs/cli.md` (8 lines added, 2 removed, outside the `--pin-source` block) and none of the other four files, and the merge-tree against it is clean, so the branch needs no rebase. Review: rv1067, lane 5's independent reviewer, not the writers (w1053 and f1053): READY at `2e6dd9e5` (issuecomment-6297358113) with no MUST; its SHOULD-1 was taken in one new commit, and the re-check is READY at `7ff61666` (issuecomment-6297678467), with no MUST or SHOULD. CI (Brett Heap's ruling 27 and his fast-refresh ruling of 2026-10-15T22:48:35Z): H0 7ff6166 passed tests, tests-git-bash and SonarCloud; the head 5bc0d30 is a clean update-branch merge of main 6c86163, with tests-git-bash and SonarCloud green; and the local gate passed on its predicted squash tree 9a936b7 over main 6c86163: the link_source_chain_defaults, neutral_pin_validator, repo_hygiene, agents_md_codes, cli_reference sets, 235 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #1053 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… fetch that carry it run in bootstrap.py's `untraced()` environment, so `make siblings` and `family.py siblings` write the token to no trace the caller asks git for (#1055) (#1075) `make siblings` and `family.py siblings` now write the token in `SHAPE_LEGS_TOKEN` or `SHAPE_LEGS_APP_TOKEN` to no trace the caller asked git for. #996 (#1045) did the same for `make bootstrap`. Lane 5 found this in its independent review of #1045 (rv996, #1045 issuecomment-6288783192) and measured it in #1055. `templates/family-root/scripts/siblings.py` gives the credential's `-c url.https://x-access-token:<token>@github.com/.insteadOf=...` rewrite, in argv, to two gits: - the clone in `place`, for a member with no clone beside the holder; - the fetch in `place`, for a member whose clone is there. Both ran in the caller's own environment. So every trace2 target the caller named wrote the token in the `start` event of each, one line per member. `scrub` kept it out of the output, and only that part held. Now: - **`rewrite_environment(token)`**, a new function in `siblings.py`: - with a token in use, it returns `untraced()` from the `bootstrap.py` beside it. That is every `GIT_TRACE*` variable taken out, and `GIT_TRACE2`, `GIT_TRACE2_EVENT` and `GIT_TRACE2_PERF` set to `0`, which also turns off a target the global or the system config names; - with no token, it returns None, so the two gits keep the caller's environment and stay traced where the caller asked, as before. - **The clone and the fetch** each run with `env=rewrite_environment(token)`. Nothing else in the file changes environment. - **The member's own `scripts/bootstrap.py`**, which `place` runs after a clone, is given no token in its argv, and no `env`, so it keeps the caller's environment and its traces. That environment holds `SHAPE_LEGS_TOKEN` and `SHAPE_LEGS_APP_TOKEN` as before; the shipped member bootstrap (`templates/assembly-root/scripts/bootstrap.py`) reads neither. A test row holds this, and so does `tests/test_validator_child_encoding.py`, which reads that call as handing no `env`. - **#1023's jobserver handling is untouched**: `dispatch` still runs each member's make with `member_make_environment(make)`, and no `MAKEFLAGS` reading changed. - **The docstrings** now say the promise in full: `git_prefix` says the token is "never written into `.git/config`, never persisted, never printed, and never traced". `place`'s ABSENT paragraph in the module docstring says the same, and `rewrite_environment` says what was measured. **One thing the issue did not ask for.** `GIT_TRACE_PERFORMANCE` writes a git's whole command line, `-c` included, on git 2.43.0 and 2.47.1 alike. So at main it held the token too, two lines per run, and the rows below set it. `untraced()` already takes it out: every `GIT_TRACE*` variable goes. This follows #1045's `untraced()` (#996): the clone and the fetch run in the very environment `make bootstrap` gives every git it hands the token. `siblings.py` imports `untraced` from the `bootstrap.py` beside it, next to `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path` and `members_of`. The issue left this to the writer, because a holder may keep a `bootstrap.py` older than its `siblings.py` (`update-shape.py apply --accept-local`), and an import of a name that copy lacks would stop `make siblings`, `park` and `resume` with an `ImportError`. The issue's text was written against main `1a47ed07`, where `siblings.py` still kept its own copy of the `MAKEFLAGS` readings. Since then #1023 (`9e154d87`, lane 4's) has decided the question for this pair of files: - it replaced that copy with an import of `member_make_environment`, because a copy in each script failed SonarCloud's duplication gate; - it named the price, in the import's comment and its commit: a holder that keeps its own `bootstrap.py` while `apply` writes `siblings.py` is refused, `update-accept-local-missing-name` (#536, #604), before a byte is written, and merges `bootstrap.py` by hand first. `untraced` takes the same road for the same reasons: - **One rule.** Which traces a command carrying the token is kept out of has one answer, for `make bootstrap` and `make siblings` alike. A copy here could drift from `bootstrap.py`'s, and the drift would be a token in a file. - **A kept old `bootstrap.py` is refused in the one-step case, and not in a two-step one.** The guard reads names. `untraced` is new with #996 (#1045), so a kept `bootstrap.py` from before it is refused by that name, where `--accept-local` names it in the same `apply`. Measured with `update-shape.py`'s own readers, in process: - `siblings.py` at this head takes `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path`, `members_of` and `untraced` from `bootstrap`; - the holder's `bootstrap.py` at main `00f6d7f7` lacks none of them; - the holder's `bootstrap.py` at `6476c170` (main just before #1045) lacks `untraced` alone, which is the line the refusal names. - **The one-step case, measured end to end (rv1075).** A holder cut at `6476c170`, and `apply --at c3cf515 --accept-local scripts/bootstrap.py`: exit 2, `scripts/bootstrap.py (kept) lacks untraced, which scripts/siblings.py imports from it`, and the holder's files, HEAD and status unchanged. - **Two applies in a row are not refused (rv1075's SHOULD 1, filed as #1082).** A holder whose earlier apply kept a `bootstrap.py` without `untraced` (rv1075 applied `--at 00f6d7f --accept-local scripts/bootstrap.py`: that target's `siblings.py` imports no `untraced`, so there was nothing to refuse), and then an apply at this head without `--accept-local`, gets `siblings.py` copied. `scripts/siblings.py` then fails with `ImportError: cannot import name 'untraced' from 'bootstrap'`, and so do `make siblings`, `park` and `resume`. The cause is the guard in `update-shape.py` (`:4288-4289`): it checks only the files `--accept-local` names in the same run. That is the gap of #536's guard, and it is on main already for #1023's `member_make_environment`; this change puts `untraced` into it and does not widen it. The text above this paragraph said no `ImportError` could reach a holder, which was too strong; #1082 is the follow-up, and it is not done here. - **No copy, so no test to hold two copies to one answer.** `tests/test_update_shape_kept_helper.py`'s `test_what_siblings_takes_from_the_holders_bootstrap_is_found_defined` already holds that every name `siblings.py` takes is defined in the holder's `bootstrap.py`. Its docstring now says six names, not five. **Setup:** - git 2.43.0 (`/usr/bin/git`) and git 2.47.1, Python 3.12.3; - the family of `tests/test_family.py` (two members, local bare remotes, the file transport allowed through `GIT_CONFIG_COUNT`), laid out as `<tmp>/InkRouter/InkRouter`; - offline: a stub `gh` first on PATH, a bogus `GH_TOKEN`, an empty `GH_CONFIG_DIR`, `GIT_SSH_COMMAND=false`; - the holder's own `scripts/siblings.py` was main's (sha256 `86bf57e0...`) or this change's; - the fake token `w1055-a-token-no-forge-takes`. **Each case was run three ways:** - `make siblings`, which clones both members; - `make siblings` again, which fetches both; - `family.py siblings --family-root <holder>` in a fresh layout, which clones both. **Traces were asked for in one of three ways:** - the seven variables `GIT_TRACE`, `GIT_TRACE2`, `GIT_TRACE2_EVENT`, `GIT_TRACE2_PERF`, `GIT_TRACE_PACKET`, `GIT_TRACE_CURL` and `GIT_TRACE_PERFORMANCE`, each set to a file under the run's TMPDIR; - `trace2.eventTarget`, `normalTarget` and `perfTarget` in a scratch `GIT_CONFIG_GLOBAL`; - the same three in a scratch `GIT_CONFIG_SYSTEM`. Each way was run with `SHAPE_LEGS_TOKEN`, with `SHAPE_LEGS_APP_TOKEN`, and with no token. That is 108 runs at main and at the change, 54 for each git. Each run's TMPDIR and the whole family folder (the clones' `.git/config` included) were searched for the token. | traces asked by | main, a token set (both variables, both gits) | this change, a token set | no token, either | |---|---|---|---| | the seven variables | `trace2-event.json`, `trace2-normal.txt`, `trace2-perf.txt`, `trace-performance.txt`: 2 lines each, in the clone, the fetch and `family.py` alike | none | no token anywhere; the same files written | | the global config | `cfg-event.json`, `cfg-normal.txt`, `cfg-perf.txt`: 2 lines each | none | the same | | the system config | `sys-event.json`, `sys-normal.txt`, `sys-perf.txt`: 2 lines each | none | the same | **What the table rests on:** - Every one of the 108 runs (and the 54 runs again on this head's final bytes, sha256 `b1e7bb21...`) exited 0 and ended `siblings ok: 2 member(s) beside the holder in ...`, with the token in neither stdout nor stderr. - The 2 lines in each file are the `start` (or `performance:`) line of the git given the `-c`, one for each member. Each carries the token twice, once for each spelling the rewrite covers. - With every member a local path, `GIT_TRACE`'s file was written and held no token, and `GIT_TRACE_CURL` wrote nothing, with no http remote. An https member is a different case, measured below. - With the change and a token set: - every trace file but `GIT_TRACE_PACKET`'s was still written, by the run's other gits and the member's own bootstrap; - the packet trace was not written, since only the clone and the fetch write one here. **An https remote, measured offline (rv1075, then the row of Round 2).** The rewrite reaches only `github.com`, and the probes above are offline, with local paths. A member whose `.gitmodules` url is `https://github.com/<org>/<repo>.git` is reached by it, and can be tried offline behind a dead proxy, `http.proxy=http://127.0.0.1:9`, so that nothing leaves the host: - rv1075 set one member's url so, with `make siblings`, a fake `SHAPE_LEGS_TOKEN`, and the seven variables set to files, on git 2.43.0 and 2.47.1. Main's `siblings.py` (`86bf57e0`) held the token in `trace.txt`, `trace2-event.json`, `trace2-normal.txt`, `trace2-perf.txt` and `trace-performance.txt`; this head held it in no file and no output. The clone failed cleanly, `git clone exited 128`, and `make siblings` exited 2. - `GIT_TRACE`'s file holds it too, in the `run_command: git remote-https origin https://x-access-token:<token>@github.com/...` lines: 3 lines on git 2.43.0, 4 on 2.47.1 (rv1075). - Round 2 below holds this in a test row. **Still not measured:** a github.com clone or fetch that succeeds, since no run here reaches the network. `tests/test_family_siblings_untraced.py` is new. It uses `tests/test_family.py`'s `family` and `estate`, `offline` from `tests/test_family_add_refusals.py`, `files_holding` and `CREDENTIALS` from `tests/test_family_bootstrap_stops_named.py`, and `NO_CREDENTIAL` and `needs_make` from `tests/test_siblings_family_name.py`. No assert joins conditions with `and`. The token is the fake `w1055-a-token-no-forge-takes`. **The rows.** Each entry point is crossed with each way traces are asked for: - entry points: `make siblings` cloning, `make siblings` again fetching (after a first run with no token and no trace), and `family.py siblings` cloning; - ways: the seven variables, the three targets in a scratch global config (a copy of the session's, which keeps git's automatic maintenance off), and the three targets in a scratch system config. **Three tests** (the third is round 2's): - **`test_with_a_token_in_use_the_token_is_in_no_trace`**: 18 rows (3 entries x 3 ways x 2 variables). Each asserts: - exit 0 and `siblings ok: 2 member(s) ...`; - the token in neither stdout nor stderr; - the token in no file under the test's directory: TMPDIR, every trace and config file, and the clones and their `.git/config`; - every trace file the way asks for written: 5 for the variables, 3 for each config; - the member's own bootstrap traced where a member was cloned: a git traced in a leg of each clone, which only that bootstrap runs. Where nothing was cloned, nothing ran there. - **`test_with_no_token_the_clone_and_the_fetch_are_traced_as_asked`**: 9 controls (3 entries x 3 ways). Each asserts exit 0, `siblings ok` and the same trace files written. It also asserts the trace2 event file holds `siblings.py`'s own git at each member, read from the events: `git clone -q --no-local ...` to each member's slot, or `git fetch --quiet origin` in each member's clone. **Fails on main.** The file was run against main's `siblings.py` (sha256 `86bf57e0...`, put in place and then restored, sha256 checked): - **18 failed, 9 passed**: every row with a token failed, and the 9 controls passed; - the variables rows found the token in `trace-performance.txt`, `trace2-event.json`, `trace2-normal.txt` and `trace2-perf.txt`; - the global-config rows found it in `cfg-event.json`, `cfg-normal.txt` and `cfg-perf.txt`; - the system-config rows found it in `sys-event.json`, `sys-normal.txt` and `sys-perf.txt`. - **`test_an_https_member_with_a_token_in_use_is_in_no_trace`**: 3 rows, one for each of `CALLERS_CONFIG` (round 2 and round 3, below). Each mutant was applied alone to the worktree's file and the new test file run (git 2.43.0). The bytes were restored and checked by sha256 after each: - `siblings.py` sha256 `b776c69b...`: this head's code; it differs from the head only in two docstring lines; - `bootstrap.py` sha256 `50a16751...`, main's, unchanged here. All are **killed**. | mutant | result | |---|---| | M1 the token condition dropped: `untraced()`'s environment always | killed, 9 failed (every control) | | M1b the condition inverted | killed, 27 failed | | M1c the clone untraced always, the fetch as it is | killed, 6 failed (the clone controls) | | M2 the clone left in the caller's environment | killed, 12 failed (every clone row with a token) | | M3 the fetch left in the caller's environment | killed, 6 failed (every fetch row with a token) | | M4a `GIT_TRACE2_EVENT` not set to `0` (`TRACE2_OFF`) | killed, 12 failed (the global- and system-config rows) | | M4b `GIT_TRACE2` not set to `0` | killed, 12 failed (the same) | | M4c `GIT_TRACE2_PERF` not set to `0` | killed, 12 failed (the same) | | M5 the `GIT_TRACE*` removal dropped (`env = dict(os.environ)`) | killed, 6 failed (the variables rows, by `GIT_TRACE_PERFORMANCE`) | | M6 the prefix narrowed to `GIT_TRACE2` | killed, 6 failed (the same) | | M7 the member's own bootstrap run untraced too | killed, 12 failed (the clone rows' bootstrap check) | M5 and M6 are killed only because the variables rows set `GIT_TRACE_PERFORMANCE`. With a local-path remote, of the issue's six variables none but trace2's writes the `-c`, and trace2's three are set to `0` whatever the prefix does. With an https remote `GIT_TRACE` writes it too, in the `run_command: git remote-https` lines; that is what the row of Round 2 holds, and the mutant R4 below, which keeps the caller's `GIT_TRACE`, passed all 27 earlier rows. **How every run was made:** - through lane 5's runner: `/usr/bin/python3 -m pytest -q -rs -p no:cacheprovider -o tmp_path_retention_policy=failed`, one basetemp per run; - `LANES_*` cleared, a stub `gh` first on PATH, `GH_TOKEN=bogus`, an empty `GH_CONFIG_DIR`; - `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null` at the start of the session. | git | files | result | |---|---|---| | 2.43.0 | `test_family_siblings_untraced.py`, on this change before the docstring fix | 27 passed | | 2.43.0 | the same file against main's `siblings.py` | 18 failed, 9 passed | | 2.43.0 | gate shard A: 19 of the 41 files below | 1623 passed, 4 skipped, in 19:51 | | 2.43.0 | gate shard B: the other 22 of the 41 files | 2415 passed, 8 skipped, in 15:03 | | 2.47.1 | `test_family_siblings_untraced.py` | 27 passed, in 1:14 | **What the 41 gate files are:** - the new file; - `test_family_member_make_jobserver.py`; - every file `grep -l siblings tests/` names; - the pinned-copy and upgrade-row files: `test_pinned_copy_text.py`, `test_update_shape.py`, `test_update_shape_add.py`, `test_update_shape_kept_helper.py`, `test_no_auto_maintenance.py`, `test_template_text_placeholders.py`, `test_bootstrap_spelling.py`; - the trio: `test_repo_hygiene.py`, `test_agents_md_codes.py` and `test_cli_reference.py`. **The gate runs** (both shards at once, then the 2.47.1 run) were made on this change as it is committed: `siblings.py` sha256 `b1e7bb21...` and the new test file sha256 `7ba7a416...`, at main `00f6d7f7` (this branch's base; no rebase was needed, see Merges). The runner's `START` line read `dirty=2`, the two tracked files this commit changes, and a sha256 check after the runs found `siblings.py` unchanged (neither it nor the test files were modified after the runs started). The first pair of shards was stopped part way and re-run whole; only the re-runs count here. **The 41 files, by shard:** - shard A (19): `test_shape_doctor.py`, `test_validator_child_encoding.py`, `test_family_py_unreadable.py`, `test_pinned_copy_text.py`, `test_siblings_inputs.py`, `test_siblings_family_name.py`, `test_family_member_make_jobserver.py`, `test_update_shape_add.py`, `test_adopt_printed_sentences.py`, `test_family_printed_quoting.py`, `test_family_makefile_siblings.py`, `test_template_text_placeholders.py`, `test_park_resume_targets.py`, `test_windows_paths.py`, `test_doctor_gitmodules_not_utf8.py`, `test_local_remote_dir_urls.py`, `test_family_siblings_untraced.py`, `test_setup_family_folder.py`, `test_bootstrap_refusal_exit.py`; - shard B (22): `test_repo_hygiene.py`, `test_doctor_legs_members_next.py`, `test_update_shape.py`, `test_family.py`, `test_update_shape_kept_helper.py`, `test_yaml_reader_spaces.py`, `test_bootstrap_spelling.py`, `test_agents_md_codes.py`, `test_family_siblings_placement.py`, `test_no_auto_maintenance.py`, `test_cli_reference.py`, `test_family_siblings_bootstrap_unreadable.py`, `test_bootstrap_branch_bytes.py`, `test_family_init_asks_every_value.py`, `test_validate_workflow_gitmodules_urls.py`, `test_adopt_contracts_dir.py`, `test_doctor_unfinished_merge.py`, `test_family_members_not_a_list.py`, `test_family_init_landing.py`, `test_family_docs_one_spelling.py`, `test_doctor_members_spelled.py`, `test_pins_child_kind_and_siblings_root_spelling.py`. **The skips are the environment's, each named by its reason:** - shard A: 3 in `test_shape_doctor.py` (the PowerShell line is printed, and `powershell.exe` exists, only on a Windows host) and 1 in `test_family_member_make_jobserver.py` (`make -j2` here writes `--jobserver-auth=3,4`, not GNU make 4.4's named pipe); - shard B: 2 in `test_doctor_legs_members_next.py` (this git crashes on `submodule init`, exit 139, as git 2.43 does on a bare `branch`), 4 in the same file (this git dies on a `shallow` of -2**31, as git 2.43 does), and 2 in `test_no_auto_maintenance.py` (the session began with `GIT_CONFIG_GLOBAL` set, and its file includes that one); - the 2.47.1 run of the new file skipped none. The full suite was not run. **Static checks:** - flake8 finds in `siblings.py` only the three lines it finds at main (two E501, one E127, each moved down by the added lines); - in the new test file it finds only the F811s every fixture-importing file has; - both files are ASCII, apart from the dashes and the CJK example already in `siblings.py`. Fetched with `-c gc.auto=0 -c maintenance.auto=false`, on 2026-10-20 at about 21:03Z. Round 1, `git merge-tree --write-tree` of the first head `c3cf5154` against (round 2's are in its own section): - **origin/main `6c861635`**: clean, exit 0, tree `225b2a99`. - Main has moved two commits past this branch's base `00f6d7f7`: `9cbba9d5` (#1063: `scripts/family.py`, `scripts/shape_materialize.py`, `docs/cli.md` and two tests) and `6c861635` (#1065: `adopt-project.py` and three tests). - Neither touches `siblings.py`, `bootstrap.py`, `tests/test_update_shape_kept_helper.py` or the new test file, so there was no rebase and the gate runs above stand. - **#1062** (`fix/1040-windows-start-errors`, head `957ba038`), the one open PR that touches a family-root script this change reads (`templates/family-root/scripts/bootstrap.py`, with the assembly root's and `validate-family.py`, `validate-pins.py` and three tests): clean, exit 0, tree `84d4b54a`. - Its diff does not touch `untraced()`. - In the merged tree `bootstrap.py` still defines `untraced` (and the five other names `siblings.py` takes from it), and `siblings.py` is byte-identical to this head's (sha256 `b1e7bb21...`). - **The other 9 open PRs** (#1073, #1072, #1071, #1070, #1069, #1068, #1067, #1064, #1031): none touches `siblings.py`, `tests/test_update_shape_kept_helper.py`, or a file the new test imports from (`conftest.py`, `test_family.py`, `test_family_add_refusals.py`, `test_family_bootstrap_stops_named.py`, `test_siblings_family_name.py`), read from `gh pr list --state open --json number,headRefName,headRefOid,files`. `templates/family-root/scripts/siblings.py` is in `FAMILY_COPIED_VERBATIM`, so each holder gets one `upstream-changed` row for it, as #1045 gave one for `bootstrap.py`: - a holder that takes it with `bootstrap.py` from #1045 or later needs nothing more; - a holder that keeps an older `bootstrap.py` with `--accept-local` in the same apply is refused, `update-accept-local-missing-name`, naming `untraced`, before anything is written; - a holder whose earlier apply kept a `bootstrap.py` without `untraced`, and that then applies this change without `--accept-local`, is not refused: `siblings.py` is copied, and `make siblings`, `park` and `resume` meet an `ImportError`. That is the gap of #536's guard, which `member_make_environment` has on main already, and it is #1082's. No Windows or macOS run was made, since CI is Linux only (#597). rv1075, lane 5's independent reviewer, found `c3cf5154` READY (#1075 issuecomment-6302090874): no MUST, two SHOULDs and a NIT. One commit on top of it, `041f7831`, with no rebase: main has touched none of this PR's files. **The three findings:** - **SHOULD 1** (the body said no `ImportError` reaches a holder, and two applies in a row make one): answered in the body above, in "Where the helper comes from" and "The pinned copy". The gap is #536's guard's, it is on main for `member_make_environment` already, and it is #1082's; this PR does not change `update-shape.py`. - **SHOULD 2** (every row used a local file remote, so a leak through `GIT_TRACE` on an https member had no test, and rv1075's mutant R4 passed all 27 rows): answered by the new row below. - **NIT** (three places said the member's own bootstrap "is given no token"): `siblings.py`'s module docstring, `rewrite_environment`'s docstring and the test file's docstring now say it is given no token in its argv. It inherits `SHAPE_LEGS_TOKEN` and `SHAPE_LEGS_APP_TOKEN` in its environment, because `run_member_bootstrap` passes no `env`, and the shipped one reads neither. `rewrite_environment`'s docstring also names the https measurement. **The code of `siblings.py` is unchanged.** Its syntax tree with the docstrings taken out is the same at `c3cf5154` and at `041f7831` (compared with `ast`); the file's sha256 moved from `b1e7bb21...` to `19107ad4...` over comments and docstrings only. So round 1's two gate shards (1623 passed, 4 skipped; 2415 passed, 8 skipped) were not re-run; the targeted runs below are. **The new row,** `test_an_https_member_with_a_token_in_use_is_in_no_trace` (the file has 28 rows now). Its setup: - the estate of `tests/test_family.py`, with `IRRS`'s url in the holder's `.gitmodules` given as `https://github.com/InkRouter/IRRS.git`, and `IRSS` still a local path; - `http.proxy=http://127.0.0.1:9`, a dead proxy, in git's command scope after the entries the session holds, and `NO_PROXY` and `no_proxy` empty, so nothing leaves the host; - a fake `SHAPE_LEGS_TOKEN` and the seven trace variables set to files; - `make siblings`, cloning. It asserts: - the proxy is set where the row sets it: `http.proxy=http://127.0.0.1:9` is in the command scope the run's git reads (`command_scope_at`, which runs `git config --show-origin --list` and writes nothing); - exit 2 and `IRRS: git clone exited 128:` on stderr, which is how the head fails (rv1075 measured the same); - `IRSS` was cloned and `IRRS` was not; - the token is in neither stdout nor stderr, and in no file under the test's directory; - the five trace files the variables ask for are written, by the run's other gits. No assert names the proxy in git's message. The git 2.47.1 this lane builds has no `git-remote-https` (`git: 'remote-https' is not a git command`, `fatal: remote helper 'https' aborted session`), so there the clone fails at once without reaching the proxy, still with 128. `GIT_TRACE` has written the `run_command: git remote-https origin https://x-access-token:<token>@github.com/...` line before that, so the row finds the leak on both gits. A first local version asserted the proxy's message and failed on 2.47.1 for that reason; the assert was dropped, and the commit amended, before anything was pushed. **It fails on main.** The file was run against main's `siblings.py` (sha256 `86bf57e0...`, put in place and then restored, sha256 checked each time): - git 2.43.0, the whole file: **19 failed, 9 passed**, the 18 rows of round 1 and the new row. The new row fails at `assert files_holding(tmp_path, TOKEN) == []`, with 5 files holding the token: `temp/trace-performance.txt`, `temp/trace.txt`, `temp/trace2-event.json`, `temp/trace2-normal.txt` and `temp/trace2-perf.txt`. The round 1 rows find 4 of those, since a local path leaves `temp/trace.txt` clean; - git 2.47.1, the row alone: **1 failed**, the same 5 files. **It kills R4.** R4 is rv1075's mutant, in `rewrite_environment`: `return {**untraced(), **{k: v for k, v in os.environ.items() if k == "GIT_TRACE"}} if token else None`, which keeps the caller's `GIT_TRACE` for the clone and the fetch. Applied alone, then restored and sha256-checked: - git 2.43.0, the whole file: **1 failed, 27 passed**: the new row alone, with `temp/trace.txt` the one file holding the token; - git 2.47.1, the row alone: **1 failed**, the same one file. **The runs on the pushed head `041f7831`** (the runner's `START` line read `dirty=0`), through the same runner as round 1: | git | files | result | |---|---|---| | 2.43.0 | the new file, `test_update_shape_kept_helper.py`, `test_family_makefile_siblings.py`, `test_family_member_make_jobserver.py`, `test_pinned_copy_text.py`, and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) | 589 passed, 1 skipped (the jobserver file's named-pipe row, as in round 1), in 5:09 | | 2.47.1 (`git version 2.47.1`, printed from the exact path first on PATH) | the new file | 28 passed, in 2:13 | | 2.43.0 | the new file against main's `siblings.py` | 19 failed, 9 passed | | 2.47.1 | the new row against main's `siblings.py` | 1 failed | | 2.43.0 | the new file with R4 | 1 failed, 27 passed | | 2.47.1 | the new row with R4 | 1 failed | | 2.43.0 | on a predicted merge with main (below): the new file, `test_update_shape_kept_helper.py`, `test_pinned_copy_text.py`, `test_family_makefile_siblings.py` | 305 passed, in 2:50 | The full suite was not run. flake8 finds in `siblings.py` the same three lines as at round 1, and in the test file only F811s, from the fixtures it imports. Both files are ASCII, apart from the dashes and the CJK example already in `siblings.py`. **The merges of round 2.** Fetched with `-c gc.auto=0 -c maintenance.auto=false` at about 23:00Z; `git merge-tree --write-tree` of `041f7831` against: - **origin/main `c13c3985`** (#1076's squash, which touches `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py`, among others): clean, exit 0, tree `8ae10d0c`. None of the three files this PR changes is among the files main changed since the base `00f6d7f7`, so there is no rebase. In that tree `siblings.py` is byte-identical to this head's, `untraced()` has the same syntax tree as at the base, and `CREDENTIALS` and `files_holding`, which the new file imports from `test_family_bootstrap_stops_named.py`, are still defined. The 305-passed run above is on that tree; - **#1062** (`fix/1040-windows-start-errors`, head `957ba038`): clean, exit 0, tree `e6ed1ba2`. Its `untraced()` has the same syntax tree as main's; - **the other open PRs** (#1031, #1069, #1070, #1072, #1073, #1081, #1084): none touches `siblings.py`, `tests/test_update_shape_kept_helper.py`, `bootstrap.py`, or a file the new test imports from, read from `gh pr list --state open --json number,headRefName,headRefOid,files` at about 23:00Z. #1076 (`fix/1056-signal-anywhere`, head `73906948`) was open when the runs were made, and merged clean with this head then (tree `6ae3e65f`); it has landed since as `c13c3985`, above. **The failure.** Lane 5's landing gate (log `c1075.log`, #1075 issuecomment-6304830183) failed the https row of round 2 at `041f7831`: 1 failed, 356 passed. The change in `siblings.py` was not at fault; the row depended on the caller's git config. - The gate ran with neither `GIT_CONFIG_GLOBAL=/dev/null` nor `GIT_SSH_COMMAND=false`, which the writers' runs and round 2's runs had. - `conftest.py`'s session global file includes the caller's global config (or `~/.gitconfig`, where `GIT_CONFIG_GLOBAL` is unset). The operator's `~/.gitconfig` has `url.git@github.com:.insteadOf=https://github.com/`. - Git keeps the first of two `insteadOf` prefixes of the same length, and the config files are read before the command line, so that rewrite beat the token's `-c` rewrite of the same prefix. Measured with scratch files and a stand-in token, on git 2.43.0: under a global file with that rewrite, `git -c url.https://x-access-token:T@github.com/.insteadOf=https://github.com/ ls-remote --get-url https://github.com/InkRouter/IRRS.git` printed `git@github.com:InkRouter/IRRS.git`. - So the row's `https://github.com/InkRouter/IRRS.git` went over ssh to `InkRouter/IRRS`, a real private repository. The dead proxy never applied, the clone succeeded, `make siblings` exited 0 and the placed members were both there, and the row failed `assert result.returncode == 2`. **The fix** is in `tests/test_family_siblings_untraced.py` only. No other file changed in this round, and `siblings.py` is byte-identical to `041f7831`'s (sha256 `19107ad4...`). - **`hermetic_config`** gives the https row's git a global file of its own, `session_global_config("")` (`conftest.py`'s own function: automatic maintenance off, and no include of the caller's file), `GIT_CONFIG_NOSYSTEM=1` and `GIT_SSH_COMMAND=false`. - It is the least invasive way: only the one row with an https url sets it, `conftest.py` and every other row stay as they were, and the other rows' remotes are local paths, which no rewrite of GitHub's url reaches. - `GIT_CONFIG_GLOBAL` set takes git's two user-level files out of the reading, and `GIT_CONFIG_NOSYSTEM` the system file whatever `GIT_CONFIG_SYSTEM` says (checked on git 2.43.0 and 2.47.1 with scratch files). - `GIT_SSH_COMMAND=false` is a second wall: a url somehow sent over ssh runs `false`. No mutant can show it needed, since the runner exports it too. - **`url_after_config`** is a new assert before the clone: `git ls-remote --get-url <url>` (it applies the config's `insteadOf` and asks nothing of the network) must give the url unrewritten under the row's environment. A config that reaches the row now fails by name, before any clone. - **The row is parametrized by `CALLERS_CONFIG`**: `none` (round 2's row), and `global` and `system`, each a stand-in for a caller's config that would send the url somewhere reachable. `as_the_callers_config` writes a scratch file of the test's own, `url.<file URI of the family's own IRRS remote>.insteadOf=https://github.com/InkRouter/IRRS.git`, into this process's `GIT_CONFIG_GLOBAL` (the session file includes it) or `GIT_CONFIG_SYSTEM`. It is built from tmp files only: no network, and never the real `~/.gitconfig`. The file now has 30 rows. - With the fix, in each of the three, the clone fails at the proxy with git's 128, `make siblings` exits 2, `IRSS` is placed and `IRRS` is not, and the token is in no output and in no file under tmp_path. **The variants fail without the fix.** Each was applied alone to the worktree's test file (or `siblings.py`) and run through the runner, with the file's sha256 checked after it was restored: - **`041f7831`'s file as pushed, under a caller's global config.** Lane 5's runner now honours `L5_GIT_CONFIG_GLOBAL=<scratch file>` as the caller's global config, with ssh impossible. The scratch file rewrote `https://github.com/InkRouter/IRRS.git` to the run's own IRRS remote (a `file://` url under the run's basetemp). The whole file, git 2.43.0: **1 failed, 27 passed**, the https row at `assert 0 == 2`, the gate's failure reproduced with no network. - **T2, `041f7831`'s row plus the variants:** the new file with `hermetic_config` and the `url_after_config` assert taken out. The https rows, git 2.43.0: **2 failed, 1 passed**, `[global]` and `[system]` at `assert 0 == 2` (the clone went to the local remote and exited 0), and `[none]` passes. On git 2.47.1 the same. - **T1,** the row's global file dropped and the assert kept: `[global]` fails at the assert, which sees `file:///...IRRS.git` for the url; the other two pass. - **T3,** `GIT_CONFIG_NOSYSTEM` dropped and the assert kept: `[system]` fails at the assert; the other two pass. **R4 stays killed.** rv1075's R4 (`rewrite_environment` keeps the caller's `GIT_TRACE`), git 2.43.0, the whole file: **3 failed, 27 passed**, the three https rows. **The runs on the pushed head `962ae43c`** (`START` read `dirty=0`), through the same runner as before: | git | files | result | |---|---|---| | 2.43.0 | the new file, `test_update_shape_kept_helper.py`, and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) | 359 passed, in 3:05 | | 2.47.1 (`git version 2.47.1`, printed from the exact path first on PATH) | the new file | 30 passed, in 1:51 | | 2.43.0 | the new file, with `L5_GIT_CONFIG_GLOBAL` naming that scratch file | 30 passed, in 2:21 | | 2.43.0 | `041f7831`'s file, with the same | 1 failed, 27 passed | | 2.43.0 / 2.47.1 | T2, the https rows | 2 failed, 1 passed / 2 failed, 1 passed | | 2.43.0 | T1, T3, the https rows | 1 failed, 2 passed each | | 2.43.0 | R4, the whole file | 3 failed, 27 passed | The full suite was not run. flake8 finds in the test file only F811s from the fixtures it imports, and nothing over 79 columns; the file is ASCII. **The merge-tree of round 3.** Fetched with `-c gc.auto=0 -c maintenance.auto=false` at about 10:53Z; `git merge-tree --write-tree` of `962ae43c` against: - **origin/main `2a119f28`** (#1092): clean, exit 0, tree `b5ea0114`. Main has landed #1076 (`c13c3985`) and #1062 (`ff0c72eb`) since the last round, and has changed `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py` among others, but none of this PR's three files. In that tree `siblings.py` is byte-identical to this head's, `untraced()` has the same syntax tree as at the base `00f6d7f7`, and `CREDENTIALS` and `files_holding` are still defined where the new file imports them from. - **#1088** (`fix/1085-nit-texts`, head `88af1b7b`), which touches the same two files of main's: clean, exit 0, tree `365df092`, with the same findings. - **The other open PRs** (#1087, #1090, #1091, #1097): none touches `siblings.py`, `bootstrap.py`, `tests/test_update_shape_kept_helper.py` or a file the new test imports from, read from `gh pr list --state open --json number,headRefName,headRefOid,files` at about 10:53Z. Lane: openreposhape-5 (openRepoShape-5) Review: rv1075, lane 5's independent reviewer, not the writers (w1055 and f1055): READY at `c3cf5154` (issuecomment-6302090874) with no MUST; its two SHOULDs and its NIT were taken in one new commit, and the re-check is READY at `041f7831` (issuecomment-6303900180), with no MUST or SHOULD; its one NIT, a merge-tree number in the body, is fixed in the body. CI (Brett Heap's ruling 27): H0 is the head 962ae43 itself, which passed tests, tests-git-bash and SonarCloud; main has touched none of its files since its base 00f6d7f; and the local gate passed on its predicted squash tree fc2afb3 over main 16f9a0e: the family_siblings_untraced, update_shape_kept_helper, repo_hygiene, agents_md_codes, cli_reference sets, 359 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #1055 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>



The family half of #923 U063 and #921 U088, and RV1052d's NIT-A. It finishes #923; #921 keeps its other sections.
What changed, and why
family.py init --dry-runsaid it "makes no folder, remote or repository". It makes and removes temporary folders, and its folder question isos.access's, which reads the mode bits and on Windows says yes for every folder. The scaffold's--dry-runhelp said so in #1052; the family's did not.I probed the family's dry run first, under an audit hook on
os.mkdir,os.rmdir,shutil.rmtree,tempfile.mkdtempandsubprocess.Popen(the realghreplaced by a stub that answersrepo viewas not found), for the GitHub path, withGIT_AUTHOR_*andGIT_COMMITTER_*set, and with--local-remote-dir:openreposhape-branch-*(git check-ref-format --branch main, asked of an empty--git-dir), and, only where aGIT_AUTHOR_*orGIT_COMMITTER_*variable is set and not empty, oneopenreposhape-ident-*each for the author and the committer (git var GIT_AUTHOR_IDENT,git var GIT_COMMITTER_IDENT). It makes noopenreposhape-seed-*, which is the scaffold's.--work-dir), the holder in it, and--local-remote-dir; each is asked ofos.access(W_OK | X_OK)on the nearest folder that exists (folder_in_the_way,target_in_the_way), and none is made, with no probe file.ghcall isgh repo view(and the commit listing when the repository exists), and with--local-remote-dirnoghcall at all. Nogit init,cloneorpushran.So:
scripts/family.py:93(the module docstring): "and makes no folder, remote or repository" is now "and creates no remote or repository". Two new paragraphs follow at:102-117. One says the dry run LEAVES NOTHING THAT STAYS, names the two temporary folders and when each is made, says a failed removal is not reported, and says its onlyghcalls read. The other says the write answer is the mode bits' and why a quota, a Windows ACL or a read-only drive on Windows can pass the dry run and be refused by the real one.scripts/family.py:10464-10480(init --dry-run's help): "make no folder, remote or repository" is now the scaffold's sentence, adapted: "Whether each folder can be written in is asked ofos.access, which reads the mode bits and on Windows says yes for every folder, so a quota, a Windows ACL or a read-only drive on Windows can pass here and be refused by the real run. It leaves nothing that stays: it makes and removes temporary folders, creates no remote or repository and pushes nothing". The one difference from the scaffold's words is "no remote or repository", which is what the family's old help claimed and is still true.docs/cli.md: regenerated withscripts/render-cli-reference.py; its family section is the only hunk (@@ -959,2 +959,8 @@), and--checksays[ok] docs/cli.md is what the generator produces.tests/test_github_limits_init_check_org.py:test_init_dry_run_help_says_the_mode_bits_and_nothing_that_stays, the family's counterpart of the scaffold's test of that name. It sits besidetest_init_help_says_each_bound_where_the_value_is_typed, the only existing test that runsfamily.py init --help; no family help test file existed for--dry-run. It pins the whole sentence in the--dry-runentry, and that "make no folder" and "its mode bits'" are absent.tests/test_scaffold_reuse_seeded_legs.py: RV1052d's NIT-A,test_the_note_a_re_run_prints_says_github_only_for_a_github_leg. It monkeypatchesremote_is_empty(returning False) and_held_seed(returning(seed, None, ("seed/scaffold",))), calls_reusable_remotes(..., local=False, reuse_flag=True, ...)and reads the NOTE fromcapsys: it must end ", and on GitHub it may be the leg's default branch." It is parametrized withlocal=Truetoo (local_remote_is_emptypatched), where the NOTE ends "so that branch remains." and says no word of GitHub.#923, item by item, on this branch
passed_values' docstring (setup-project.py:2694-2704): done in AGENTS.md, README.md, docs/handbook.html and setup-project.py: the taken-clone-path refusal names the--familyfolder, "nothing that stays" replaces "nothing is created", andpassed_valuessays what argparse takes as a value (#921, #923) #1051; it says argparse takes-,-5,-1.5and-x yas values.--dry-run's help says the folder answer is the mode bits': the scaffold in scaffold-project.py:--dry-run's help says its answer about each folder is the mode bits' and that it leaves nothing that stays, a--reuse-empty-repore-run that takes a seed found only onseed/scaffoldnames that branch as remaining, and the unusedCOMMIT_REimport is gone (#921, #923) #1052 (scaffold-project.py:368-383), the family here.--dry-run's help says its answer about each folder is the mode bits' and that it leaves nothing that stays, a--reuse-empty-repore-run that takes a seed found only onseed/scaffoldnames that branch as remaining, and the unusedCOMMIT_REimport is gone (#921, #923) #1052,shape_materialize.py's andfamily.py's in family.py and shape_materialize.py:initasks the scaffold's own manifest questions offamily.yaml, soinit, the scaffold and adopt refuse a validator that exits or answers with something that is not text, and a manifest that is not a mapping, in the same words, and pyflakes finds nothing in either file (#925, #923) #1057.pyflakes4.0.0 is silent onscaffold-project.py,scripts/shape_materialize.py,scripts/family.pyandsetup-project.pyon this branch, and no test readsCOMMIT_REorrecorded_gitlinkas an attribute of either (tests/test_validate_family_without_git.py:87andtests/test_validate_pins_without_git.py:164read the validators').Left out of scope
--familyrefusal path, "nothing is created", three ruledbumplimits and aseed/scaffoldre-run are unsaid or slightly wrong #921: U033 and U088's documentation half landed in AGENTS.md, README.md, docs/handbook.html and setup-project.py: the taken-clone-path refusal names the--familyfolder, "nothing that stays" replaces "nothing is created", andpassed_valuessays what argparse takes as a value (#921, #923) #1051, U088's scaffold half and U006's NOTE in scaffold-project.py:--dry-run's help says its answer about each folder is the mode bits' and that it leaves nothing that stays, a--reuse-empty-repore-run that takes a seed found only onseed/scaffoldnames that branch as remaining, and the unusedCOMMIT_REimport is gone (#921, #923) #1052; U066, U068 and U071 (the threebumplimits for the release notes) and U097, which needs a ruling, are not touched here.family.py's run-time line--dry-run: nothing was created.and its refusals' "nothing was created": the brief for this change was the docstring and the help only, and a refusal names a folder or remote it did not create, which is true.Tests
Each file alone, under a stub
gh(exit 97),GH_TOKEN=bogus, an emptyGH_CONFIG_DIRandEMAIL=tests@openreposhape.invalid, with/usr/bin/python3 -m pytest -q -p no:cacheprovider -o tmp_path_retention_policy=failed:tests/test_cli_reference.py: 23 passed in 27.25stests/test_github_limits_init_check_org.py: 96 passed in 25.12stests/test_scaffold_reuse_seeded_legs.py: 84 passed in 45.07stests/test_family_init_landing.py: 19 passed in 7.13stests/test_family_refuse_up_front.py: 79 passed in 70.63stests/test_agents_md_codes.py: 47 passed in 1.85stests/test_update_add_codes_documented.py: 6 passed in 0.51stests/test_repo_hygiene.py: 100 passed in 2.29stests/test_no_auto_maintenance.py: 60 passed in 10.62spython3 -m pyflakes scripts/family.py: no output, exit 0scripts/render-cli-reference.py --check: exit 0Mutants
scaffold-project.py:751print(_seed_branch_note(target, found_on, tracking, local))changed to passTrueforlocal: KILLED bytest_the_note_a_re_run_prints_says_github_only_for_a_github_leg[github-leg](1 failed, 18 passed). The mirror,Falseforlocal, is killed by[bare-repository-leg]. The file was restored andcmp-ed against its copy.--dry-runhelp put back to "make no folder, remote or repository": KILLED bytest_init_dry_run_help_says_the_mode_bits_and_nothing_that_stays(1 failed).tests/test_cli_reference.py(5 failed).scripts/family.pyrestored after each andcmp-ed.Merges
git merge-tree --write-treeof this head withorigin/main(eee089cae): clean. The four open PRs, none of which touches these four files, each also clean: #1062 (01a8b7593), #1045 (3272d5334), #1031 (b83d9c022), #1025 (4c0c52d0c).Review round
RV1063's review of
83af669dcwas READY, with one SHOULD and three NITs; this round is one commit,d996ebf1e, pushed as a fast-forward.tests/test_scaffold_reuse_seeded_legs.py:414: the[bare-repository-leg]case expects the path asstr(Path("/remotes/Atlas-spec.git")), because_reusable_remotesprintsstr(Path(url)), which is\remotes\Atlas-spec.giton Windows; the test's docstring says it runs on every platform.scripts/family.py:105-109: the module docstring says oneopenreposhape-ident-*folder for the author whenGIT_AUTHOR_NAME,_EMAILor_DATEis set and not empty, and one for the committer when aGIT_COMMITTER_one is, asCOMMIT_IDENTITYand its loop work, per role.scripts/shape_materialize.py:1621-1622:folder_in_the_way's docstring saysos.accesssays yes for root and for any folder on Windows, "where the realmkdircan still be refused: an ACL, a quota", so it agrees with the help. A docstring only; it widens the file list by this one file.gh:test_scaffold_reuse_seeded_legs.py84 passed;test_github_limits_init_check_org.py96 passed;test_cli_reference.py23 passed;test_no_auto_maintenance.py60 passed;pyflakesonscripts/family.pyandscripts/shape_materialize.py: no output.git merge-tree --write-treeofd996ebf1e: clean withorigin/main(6476c1704, one commit ahead, none of these files; update the branch before landing) and clean with scripts/shape_materialize.py, family.py and adopt-project.py'scheck: a manifest the template's own reader makes no mapping of is told it is a defect in the copy of the standard, naming the template file, andmanifest_invalid's docstring is true for the holder (#1059) #1064 (l3-1059-not-a-mapping-remedy,edc9fc719), which also editsshape_materialize.py, far from:1621.Closes #923
Part of #921
Lane: openreposhape-3 (openRepoShape-3)
🤖 Generated with Claude Code
Summary by Sourcery
Clarify family dry-run semantics and guard the platform-specific seeded re-run note behavior with tests.
Enhancements:
family.py init --dry-runchecks folder writability viaos.access, may create and remove temporary validation folders, and leaves no persistent changes while creating no remote or repository.Documentation:
Tests: