Repository navigation
adopt-project.py and family.py: a source this user cannot enter is source-unreadable, a UTF-8 plan reads its source under the C locale, and a member on a branch that is not UTF-8 is put back on it (#918) - #1072
Merged
Conversation
…user cannot enter is refused `source-unreadable`, a plan written in UTF-8 mode is read under `LC_ALL=C PYTHONUTF8=0`, and a member on a branch that is not UTF-8 is put back on it (#918) L1-105: `_top_level` and `_not_a_whole_clone` run git with `cwd=` the source; at mode 000 `subprocess` raised its `PermissionError` out of `plan`, `check` and `execute`, a traceback, and a recorded clone was "no longer whole (git finds no repository there)". That error, and only that one (`_refused_at`: `subprocess` names the directory), is now the caller's `source-unreadable`, with the cure, before anything is cloned or written. L1-86: a plan's `source.local_path` this locale's file-name encoding cannot spell is asked as the UTF-8 bytes the plan records (`_recorded_spelling`), so `check` under the C locale reads the source, `plan ok`, where it said `plan-source-gone`, "names nothing that exists". Where those bytes name nothing either, the refusal says so and names the locale's encoding. L1-70: `_member_head` reads `git symbolic-ref` as bytes, as `_holder_branch` does, decoded with `surrogateescape`: a member on `caf<0xE9>` ended `bump` and `remove` in a `UnicodeDecodeError` traceback; now a rollback puts it back on that branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reviewer's GuideThe PR hardens source handling and rollback across filesystem and encoding boundaries: inaccessible sources now produce precise refusals without cloning or writing, UTF-8 plan paths are resolved correctly under the C locale, and family operations preserve branch names containing non-UTF-8 bytes or trailing non-breaking spaces. Sequence diagram for unreadable and locale-safe plan sourcessequenceDiagram
participant User
participant Plan as adopt-project.py
participant FS as Filesystem
participant Git
participant GH as GitHub
User->>Plan: check or execute
Plan->>Plan: _recorded_spelling
Plan->>FS: _is_there(source_path)
alt Path cannot be entered
FS-->>Plan: PermissionError
Plan->>Plan: _source_unreadable
Plan-->>User: Refused source-unreadable
else UTF-8 path cannot be spelled by locale
Plan->>FS: Ask for UTF-8 byte spelling
FS-->>Plan: Source exists
Plan->>Git: git rev-parse
Git-->>Plan: Repository status
Plan-->>User: plan ok
else Source is accessible
Plan->>Git: git rev-parse
Git-->>Plan: Repository status
Plan-->>User: Continue without unnecessary clone
end
Note over Plan,GH: GitHub is not contacted for unreadable or successfully resolved sources
Sequence diagram for preserving a non-UTF-8 member branch during rollbacksequenceDiagram
participant User
participant Family as family.py
participant Git
participant Hook as pre-commit hook
User->>Family: bump or remove
Family->>Git: symbolic-ref -q HEAD
Git-->>Family: Branch bytes
Family->>Family: _member_head
Note over Family: Remove one newline and refs/heads/, decode with surrogateescape
Family->>Git: Perform operation
Git->>Hook: Run pre-commit
alt Hook refuses operation
Hook-->>Git: Refusal
Git-->>Family: Operation failed
Family->>Git: _head_back to original branch and commit
Git-->>Family: Member restored
Family-->>User: Refusal with branch preserved
else Operation succeeds
Git-->>Family: Operation completed
Family-->>User: Success
end
File-Level Changes
Assessment against linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
This was referenced Oct 20, 2026
Contributor
Author
|
(lane openRepoShape-3, 2026-10-20T21:19:45Z) RV1072 independent review of #1072 at a1b18fe (base 00f6d7f; main now 6c86163): READY. Probes (stub gh exit 97, GH_TOKEN=bogus, empty GH_CONFIG_DIR, GIT_SSH_COMMAND=false):
Tests at the head: unenterable_source_and_locale 12, family_member_branch_not_utf8 4, adopt_c_locale_bytes 17, adopt_source_clone_record 100, family_bump_remove_rollback 31, all passed; the two new files pass again on the merge with main. SHOULD:
NIT:
Left out: both fine for this PR; follow-up issues suggested:
Lane 3: a fix round (F1072) takes S1 and N1 to N3 before #1072 lands, then a delta review. Both follow-ups will be filed as issues. Lane: openreposhape-3 (openRepoShape-3) |
This was referenced Oct 20, 2026
…ranch>" words name a branch that is not UTF-8 as `_shown` does, the `--source` help says `source-unreadable` covers a directory it may not enter, and a test holds the clone at the record kept under the C locale (#918) Review round on #1072 (RV1072, READY, one SHOULD and three NITs): S1: `Plan._keep_the_clone_at_the_record` asked the plan's own `source.local_path` as written, so under `LC_ALL=C PYTHONUTF8=0` a path written in UTF-8 mode met `UnicodeEncodeError` in `os.path.realpath`, the method returned and `check --source` removed the clone at the record again (#803). The line was already fixed (`_recorded_spelling`) and nothing held it; `test_the_clone_at_the_record_is_kept_under_the_c_locale` runs the method in a child under that locale and fails when `str(record)` is put back. N1: `PinRollback._head_said` and `_work_tree_said` print the branch through `_shown`, so a branch that is not UTF-8 reaches the words as U+FFFD and not as the lone surrogate stderr writes with `backslashreplace`. N2: the `--source` help in `plan` and `docs/cli.md` say `source-unreadable` covers a directory the user may not search, or one it may not enter. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Contributor
Author
|
(lane openRepoShape-3, 2026-10-20T21:47:13Z) RV1072d, lane 3's independent delta review of fix round 1 at 2ffd823 (one commit on a1b18fe): READY. No MUST, no SHOULD, one NIT. Checked:
Tests at 2ffd823, one at a time under a stub gh (exit 97), GH_TOKEN=bogus, an empty GH_CONFIG_DIR, GIT_SSH_COMMAND=false and a set EMAIL: test_adopt_unenterable_source_and_locale.py 13 passed, test_family_member_branch_not_utf8.py 4 passed, test_cli_reference.py 23 passed. The stub gh was never called. Merges (git merge-tree --write-tree of 2ffd823), all clean: origin/main 4a6b9af, #1064 166ae7b, #1071 24273dd, and #1073 at both 3c933e0 and b58a4e2. NIT-4: the body's Merges table names #1073 at 3c933e03, but #1073 was pushed at 2026-10-20 21:44:32 +0000 and is now b58a4e2. That head merges clean too, so only the row needs updating, at the next body edit. Note, no action needed: the fix commit's trailer says Claude Sonnet 5.5, which names the model that wrote it. The squash message is written by hand at landing, so it is not worth a force-push. Lane 3: NIT-4 is fixed in the body now (the #1073 row). #1072 lands at 2ffd823 through its pilot, chained after #1064 and #1071, one HOLD at a time. Lane: openreposhape-3 (openRepoShape-3) |
brettheap
added a commit
that referenced
this pull request
Oct 20, 2026
…a signal fails the run by name wherever the update met it, read from git's trace, not only where its code is the update's last; with a token in use that stays a limit (#1056) (#1076) Where a git that git's update ran dies of a signal, `make bootstrap` in a family holder now fails naming it wherever the update met it, not only where the signal's code is the update's last. This is #1056, found by rv996, lane 5's independent review of #1045 (issuecomment-6288783192, checklist candidate 1). Git keeps only the last code that is not 0 (`update_submodules` in git 2.47.1's `builtin/submodule--helper.c`), and only 128 stops it. So a member's crash or kill before a later gitlink's 128 or 1 left no signal in the update's exit code, and #1045's `ended_on` saw none: the run said the credential advice and `family bootstrap ok`, exit 0, with IRRS's legs never updated. One commit, on main `00f6d7f7` (which holds #1045 and #1023). It changes two files: the family root's `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py`. ### The signal is read from git's own trace (no token in use) - With no token in use, git's update is already traced into a directory of the run's own (#892). `traced_in` now reads that trace once and returns a `Trace`: `fetched` (#892's work trees, as before) and `died`, read by the new `died_in`. - **`died_in`** reads the events by the code, never git's words, as #892 reads a fetch: - a git writes a `child_start` event (with the argv) and a `child_exit` event (with the code) for each child it starts; - `child_of` pairs the two by the writing git's `sid` and the `child_id`; - a `child_exit` whose code is `128 + N`, N below `signal.NSIG` (`died_of`, now shared with `ended_on`), for a child whose argv begins `git` (`git_child`), is a git dead of signal N; - a hook or another program is not counted. Its code is its own: a `post-checkout` hook that exits 137 is no signal, and `git checkout` exits 1 over it (measured, both gits). - **The first signal** is the first by the time each event gives, which is the order git met them. Where trace2 gives no time (its brief form), it is the order of the files and their lines. - File order alone would name the wrong one. The files go in the order their gits started, so a member's own update comes after git's update's file. - Measured on both gits: SIGKILL at IRRS's `code` leg, then SIGTERM at its `spec` leg. That ended IRRS's own update 143, and git's update's `child_exit` 143 for it came first in the files. - **`signal_met`** chooses what (a) tells: - where git's update exited 0, nothing; - else the trace's first signal, where there is one; - else the update's own exit code, through `ended_on` as #998 reads it (`128 + N`, or `-N` where git itself was killed). - **Nothing where the update exited 0.** It did all it set out to do then, whatever a git it ran died of on the way. Measured on both gits: a `reference-transaction` hook killed IRSS's `git fetch` after it wrote the branch, git found the commit reached, checked it out and exited 0. The run says every member and leg was fetched, as before. ### What the run says - Where the signal's code is the update's own, the line is #998's, word for word, so the controls read as before: ``` UPDATE KILLED, and not for want of a credential: git's update ended on signal 9 (SIGKILL, exit 137), which a git it ran died of. Git's own words above say which git and where. family bootstrap FAILED: git's update (ended on signal 9) ``` - Where the trace gave it and the update ended with another code: ``` UPDATE KILLED, and not for want of a credential: a git that git's update ran died of signal 9 (SIGKILL, exit 137), and git's update went on and ended with exit 128. Git's own words above say which git and where. family bootstrap FAILED: git's update (a git it ran died of signal 9) ``` - No credential advice in either case (`credential_advice`). ### A signal and B4 both told: the signal first - Before, `fetch_members` returned one failure line, the signal's or the walk's stop's. Now `told_past` says each that is there, each with its own failure line. - Where both are told, **the signal is said first**. Why: - It is git's order. A death past the holder's records (128) ends git's update, so git met the signal at an earlier gitlink and went on past it. - Git's own words, printed just above, say them in that order too. - The two cures do not depend on each other. - Measured: the killed checkout in IRRS, then B4 at IRSS, with the credential. Before, the B4 line alone was said. Now: ``` UPDATE KILLED, and not for want of a credential: a git that git's update ran died of signal 9 (SIGKILL, exit 137), and git's update went on and ended with exit 128. Git's own words above say which git and where. UPDATE STOPPED, and not for want of a credential: git stopped at members/IRSS, whose fetch reached its remote and did not bring <commit>, ... family bootstrap FAILED: git's update (a git it ran died of signal 9), members/IRSS (git stopped at it) ``` - A `NOT CHECKED OUT` row or a whole-holder stop (`unfetchable`, `updated_none`) still comes first and alone, as for #998's signal (mutant S7's order is unchanged). ### With a token in use: the limit, said and pinned The issue offered two ways. I measured both, and chose to say the limit and pin it with a row. | measured (killed checkout, then IRSS's pin moved on, the token's fake value) | git 2.43.0 | git 2.47.1 | |---|---|---| | a directory trace target with the token's `-c` in argv: events holding the token | 1 (the top git's `start` argv) | 1 (the same) | | the rewrite given in the environment instead, IRSS's origin an https url through a refused local proxy: events holding the token | 8 (the remote helper's `start` and `child_start` events give the url) | 0 | | an `af_unix:dgram:` socket target read by a thread, in memory | 189 datagrams, 1 holding the token, the `child_exit` 137 for `git checkout` there; no file | 194, 1, the same; no file | So: - **Any file target writes the token**: in argv on both gits, and, moved to the environment, in git 2.43.0's remote helper url. - **Git's one target that is no file, a Unix socket, works**, but this PR does not take it: - this process would have to read it for the whole update, and every git the update starts waits on it once Linux has queued 10 events (`net.unix.max_dgram_qlen` is 10 here), so a stalled reader hangs `make bootstrap`; - the socket's path must fit in the 107 bytes Linux takes. This harness's TMPDIR is 151 bytes, and a socket path under this session's scratchpad (114 bytes) was refused (`AF_UNIX path too long`); - git for Windows builds without it (read, not run). It would be a second trace mechanism, and is better as its own issue if wanted. - **What the docstrings now say:** - `ended_on`: with a token in use the exit code is all there is, and a signal before a later failure is not told. - `credential_advice`: the limit and the measurement. - `run_update`: points at both. - **The row:** `test_with_a_credential_in_use_a_signal_is_told_only_from_git_s_code`. - `[alone]`: the killed checkout alone is named, from git's own 137. - `[then-pin-moved-on]`: the killed checkout, then IRSS's pin moved on with the transport refused, is the credential's skip, the advice and ok. - Both: the token is in no output and no file under TMPDIR, with every caller trace on. ### Two docstrings corrected - `ended_on`: git's update ends with a signal's code only where no gitlink after it fails, since it keeps the last code that is not 0. (It said the update "ends with that code".) - `credential_advice`: a failed fetch does not always end the update with 128. A clone that fails gives 1 and the update goes on (rv996's NIT 2 on #1045), so the advice is dropped beside a signal even where a credential was also wanting. The run fails on the signal, and a run made again says the advice. (It said an update ending `128 + N` "met none".) - The module docstring's (a) and (c), `fetch_members`, `run_update`, `fetched_in`, `GIT_DIED`, `UPDATE_KILLED` and `TRACE_ENV` say the same. The probe is a pytest file kept out of the commit. It builds each state with `tests/test_family_bootstrap_stops_named.py`'s own helpers, runs the family root's `bootstrap.py --skip-members` (offline), and records the exit code, whether the credential advice is said, and whether the fake token is in any output or any file under TMPDIR. It also runs git's own update, traced, on a copy of the same state with no token. It was run at main `00f6d7f7` and at this head, on git 2.43.0 (`/usr/bin/git`) and on git 2.47.1 (a local build, first on PATH). Each cell is the verdict, the signal said, and the exit code: | state (in IRRS, then in IRSS) | main 2.43.0 | head 2.43.0 | main 2.47.1 | head 2.47.1 | |---|---|---|---|---| | killed checkout, then IRSS's pin moved on, no credential | ok + advice (0) | FAILED signal 9 (1) | ok + advice (0) | FAILED signal 9 (1) | | killed checkout, then IRSS's checkout refused, with the credential | ok + advice (0) | FAILED signal 9 (1) | ok + advice (0) | FAILED signal 9 (1) | | killed checkout, then B4 at IRSS, with the credential | FAILED + B4 stop (1) | FAILED signal 9 + B4 stop (1) | FAILED + B4 stop (1) | FAILED signal 9 + B4 stop (1) | | control: killed checkout alone, with the credential | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | | P3, then IRSS's pin moved on, no credential | ok + advice (0) | FAILED signal 11 (1) | ok + advice (0) | ok + advice (0) | | P3, then B4, with the credential | ok + advice (0) | FAILED signal 11 (1) | ok + advice (0) | ok + advice (0) | | control: P3 alone, with the credential | FAILED signal 11 (1) | FAILED signal 11 (1) | ok + advice (0) | ok + advice (0) | | a hook that exits 137 (no signal), then IRSS's pin moved on, no credential | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | | a hook that exits 137, alone, with the credential | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | | SIGKILL at IRRS, then SIGTERM at IRSS, with the credential | FAILED signal 15 (1) | FAILED signal 9 (1) | FAILED signal 15 (1) | FAILED signal 9 (1) | | SIGKILL at IRRS's `code` leg, then SIGTERM at its `spec` leg, with the credential | FAILED signal 15 (1) | FAILED signal 9 (1) | FAILED signal 15 (1) | FAILED signal 9 (1) | | the same two legs, then IRSS's pin moved on, no credential | ok + advice (0) | FAILED signal 9 (1) | ok + advice (0) | FAILED signal 9 (1) | | token in use: killed checkout, then IRSS's pin moved on | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | | token in use: killed checkout alone | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | | token in use: killed checkout, then B4 | FAILED + B4 stop (1) | FAILED + B4 stop (1) | FAILED + B4 stop (1) | FAILED + B4 stop (1) | | token in use: killed checkout, then IRSS's checkout refused | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | Read across the table: - **Every no-token row of the probe that holds a signal now fails naming it, with no advice** (the rows that said `ok` with the advice, and the one that named SIGTERM): both killed-checkout rows (pin moved on, checkout refused) on both gits, and P3 (then IRSS's pin moved on, then B4) on git 2.43.0. P3 on git 2.47.1 is not a crash there (git refuses the line and exits 128, so nothing is killed), so its rows read as before. - **Killed checkout, then B4:** the B4 line alone was said at main. Now both are said, the signal first. - **A hook's own code is no signal:** a `post-checkout` hook that exits 137 reads the same at main and at this head: `ok`, with the advice. - **The first signal is the first git met:** SIGKILL at IRRS, then SIGTERM at IRSS (and the two legs of IRRS) named SIGTERM at main, from git's update's own last code, and name SIGKILL now. - **A signal in an update that exits 0 is not said.** A `reference-transaction` hook that kills IRSS's `git fetch` once, after it wrote the ref (git then finds the commit reached, checks it out and exits 0): measured at this head on both gits (main reads no trace, so it says the same), the run says `every member and leg fetched` and `family bootstrap ok`, exit 0. The trace there holds a `git fetch` `child_exit` of 137, and the row `test_a_git_killed_in_an_update_that_exits_0_is_not_said` pins that nothing is said (mutant M7). - **With a token in use nothing changed**, on purpose (the four `token in use` rows): the signal is told only where its code is git's last. - **The fake token** was in no output and in no file under TMPDIR in any run of any row (probe lines `token in output: False`, `token in temp files: []`). All in `tests/test_family_bootstrap_stops_named.py` (#954's and #1045's file), reusing its helpers and its style, with no assert that joins conditions with `and`. The module docstring gains the new rows' list, and the P3 state moved into a `p3()` helper so two rows build it. 11 new rows (37 before, 48 after). The issue's Verify rows (fail at main): - `test_p3_before_a_later_failure_fails_naming_the_signal`: P3, then IRSS's pin moved on, no credential, git 2.43.0: exit 1, signal 11 (SIGSEGV) named, no advice, FAILED. Skipped where git does not crash, as #1045's P3 row is. - `test_a_killed_checkout_before_a_later_failure_fails_naming_it[pin-moved-on-no-credential]` and `[checkout-refused-with-the-credential]`: the killed checkout (a `post-checkout` hook sending SIGKILL to its parent, `kill -s KILL $PPID`), then IRSS's pin moved on with no credential, and then IRSS's checkout refused with the credential. Each exits 1, names signal 9 (SIGKILL), gives no advice. Every POSIX git. The choice rows (fail at main): - `test_a_signal_and_b4_after_it_are_both_named_the_signal_first`: the killed checkout, then B4 at IRSS, with the credential: both lines, the signal first, and the failure line names both. - `test_the_first_signal_is_named[two-members]` and `[two-legs]`: SIGKILL, then SIGTERM, at two members and at two legs of one member. The first by time is named (SIGKILL), where git's update's own last code, and the files' order, name SIGTERM. The controls and the limit (pass at main, as intended, so they hold the rest as it was): - `test_a_killed_checkout_alone_is_named_as_before`: #998's line, word for word. - `test_a_hook_s_own_code_is_no_signal`: a hook that exits 137 is not a signal. - `test_a_git_killed_in_an_update_that_exits_0_is_not_said`: the `reference-transaction` row above. - `test_with_a_credential_in_use_a_signal_is_told_only_from_git_s_code[alone]` and `[then-pin-moved-on]`: the token's limit, pinned. Alone, the killed checkout is named from git's own 137. Then IRSS's pin moved on, the run is the credential's skip, the advice and `ok`, as before. Both: the fake token is in no output and in no file under TMPDIR, with every caller trace variable on. The controls the issue names that already existed are untouched and pass: the signal alone (`test_an_update_ended_on_a_signal_fails_naming_it`, the P3 row), the credential's skip (`test_the_credential_s_skip_is_as_it_was`) and `test_a_code_no_signal_gives_is_read_as_before[exit-128]` and `[exit-255]`. **Failing at main:** main's `bootstrap.py` bytes (sha256 `50a16751...`) against this branch's 48-row file, git 2.43.0: **6 failed, 42 passed**. The six are exactly the rows under "fail at main" above (the P3 row, the two killed-checkout rows, the both-named row and the two first-signal rows). They pass with the change. Each mutant applied alone to the change's `bootstrap.py` (a script replaces one exact string and asserts it occurs once), the stops-named file run on git 2.43.0 (`/usr/bin/git`) through the lane's runner, the file restored from the head's bytes and its sha256 checked after each. All on the final 48-row file (M1 to M3 were run once on the first 47 rows and again on the 48, with the same rows failing). | | mutant | result | |---|---|---| | M1 | the trace read dropped (`Trace(fetched_in(events))`) | killed: 6 failed, 42 passed | | M2 | `128 + N` read as `>= 128` (`GIT_DIED <= code`) | killed: 31 failed, 17 passed | | M3 | a `child_exit` of a child that is not `git` taken (`git_child` accepts any `child_start`) | killed: 1 failed (the hook row) | | M4 | the last signal for the first | killed: 2 failed (`two-members`, `two-legs`) | | M5 | the advice still printed beside a signal | killed: 10 failed | | M6 | the sort by time dropped (file order) | killed: 1 failed (`two-legs`) | | M7 | the exit-0 gate dropped (`signal_met` tells a signal where git exited 0) | killed: 1 failed (the `reference-transaction` row) | | M8 | a child paired by `child_id` alone, without the writing git's `sid` | killed: 1 failed (the hook row) | | M9 | B4 dropped beside a signal | killed: 1 failed (the both-named row) | | M10 | B4 said before the signal | killed: 1 failed (the both-named row) | | M11 | the "went on and ended with exit R" text never said | killed: 6 failed | | M12 | that text always said | killed: 5 failed | | M13 | git's update's own exit code asked before the trace | killed: 2 failed | | M14 | the failure line always "ended on signal N" | killed: 6 failed | | M15 | the `child_exit` kind check dropped from `died_in` | **survives**: 48 passed | **M15 is equivalent, and the check stays as a reader's help.** `died_in` only takes an event whose `(sid, child_id)` is one `child_start` named for a git, and only a `child_exit` event carries a `code`. A `child_start` event has none, so `died_of(None)` is None whether or not the kind is asked. No input reaches a different answer. All through the lane's runner (the real `gh` replaced by a stub, every `LANES_*` variable cleared, `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`), at most two at once, never the full suite. Git 2.43.0 is `/usr/bin/git`; git 2.47.1 is a local build, first on PATH. `bootstrap.py`'s sha256 began `f1c156e29d07e149`, which the runs recorded and the committed file has (the test file's begins `1d558af665c3`). | run | git | result | |---|---|---| | `tests/test_family_bootstrap_stops_named.py` (48 rows) | 2.43.0 | **48 passed** | | the same | 2.47.1 | **46 passed, 2 skipped** (both P3 rows: that git exits 128 there, not 139) | | main's `bootstrap.py` bytes, this branch's 48 rows | 2.43.0 | 6 failed, 42 passed (the rows listed under Tests) | | the probe, after, 17 states | 2.43.0 and 2.47.1 | 17 passed each | | group A: the stops-named file, `test_family.py`, `test_update_shape_kept_helper.py`, `test_family_holder_remedies_compose.py`, `test_family_gitmodules_values.py`, `test_pinned_copy_text.py`, `test_repo_hygiene.py` | 2.43.0 | **707 passed** | | group B: `test_family_holder_bootstrap_texts.py`, `test_family_bootstrap_gate_order.py`, `test_bootstrap_without_git.py`, `test_family_unnamed_gitlink.py`, `test_family_config_appends.py`, `test_family_member_make_jobserver.py` (#1023's), `test_family_siblings_bootstrap_unreadable.py`, `test_family_head_lost_gitmodules.py`, `test_family_members_not_a_list.py`, `test_family_makefile_siblings.py`, `test_bootstrap_spelling.py`, `test_template_text_placeholders.py`, `test_no_auto_maintenance.py`, `test_agents_md_codes.py`, `test_cli_reference.py` | 2.43.0 | **1010 passed, 3 skipped** (GNU make's jobserver spelling here, and two rows that need a session without `GIT_CONFIG_GLOBAL`) | | the 15 mutants | 2.43.0 | see Mutants | Both groups and every file that names the family root's `bootstrap.py` (`grep -l 'family-root/scripts/bootstrap' tests/*.py` gives two files, both in the groups), `test_pinned_copy_text.py` and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) are in those two groups. No other test pins the functions or lines this changes (a grep of `tests/`, `docs/` and `scripts/` for them finds only a docstring's mention in `test_family_holder_bootstrap_texts.py`, in group B, and an unrelated workflow-validator row). The runs were made at main `00f6d7f7`'s tree plus this change, before main moved (see Merges). `git merge-tree --write-tree` of this head `73906948` (parent main `00f6d7f7`), after fetching with `gc.auto=0` and `maintenance.auto=false`: | against | result | |---|---| | `origin/main` `4a6b9afde` (3 commits past `00f6d7f7`) | clean (tree `ad8dab73`); none of the 3 touches `bootstrap.py` or the stops-named file | | #1062 `fix/1040-windows-start-errors` `957ba038` (touches the family root's `bootstrap.py`, in `git_not_started` only) | clean (tree `70c5a715`); the merged `bootstrap.py` parses, and holds `died_in` and #1062's `4551` | | #1075 `fix/1055-siblings-untraced` `c3cf5154` (lane 5's: `siblings.py`, `tests/test_family_siblings_untraced.py`, `tests/test_update_shape_kept_helper.py`) | clean (tree `6770fa61`); its `siblings.py` imports `untraced` from `bootstrap.py`, which this does not touch | The other open PRs (#1073, #1072, #1071, #1070, #1069, #1068, #1064, #1031) touch neither file. `templates/family-root/scripts/bootstrap.py` is in `FAMILY_COPIED_VERBATIM`, so each holder gets one `upstream-changed` row for it, as for #1045. The only import is unchanged (`signal` came with #998), and `siblings.py`'s import list from it is unchanged. No Windows or macOS run was made, since CI is Linux only (#597). Review: rv1076, lane 5's independent reviewer, not the writers (w1056 and f1056): READY at `73906948` (issuecomment-6302104583) with no MUST or SHOULD; of its three NITs, the body's is fixed, and the other two (a docstring clause on a member's failed clone, and a text no row reaches) go to a follow-up. CI (Brett Heap's ruling 27): H0 is the head 7390694 itself, which passed tests, tests-git-bash and SonarCloud; main has touched none of its files since its base 00f6d7f; and the local gate passed on its predicted squash tree 9dae534 over main bccae28: the family_bootstrap_stops_named, repo_hygiene, agents_md_codes, cli_reference sets, 218 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #1056 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
pushed a commit
that referenced
this pull request
Oct 20, 2026
… `\041` too, so a line for a branch that is not UTF-8 never depends on a shell's history scanner, and its test also drives zsh (#1079) Review round on #1084 (RV1084, issuecomment-6303644023). `_branch_by_hand` now escapes `!` with `'`, `\` and `%`: only a name that is not UTF-8 uses the printf word, so a UTF-8 name is `shlex.quote`d as before. `tests/test_family_head_by_hand_bytes.py`: - SHELLS gains zsh (macOS's default); `shell_or_skip` still skips a shell that is not installed, and its rows run here; - a `!` row for the shell, an exact-text row for the word and a UTF-8 name with `!`; - the test that never called the module is named for what it checks, Python's `surrogateescape` decode, and says the module's own read is #1072's `_member_head`. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
brettheap
marked this pull request as ready for review
October 20, 2026 23:51
|
Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days. You can request another review in 2 days and 21 hours by commenting |
This was referenced Oct 20, 2026
brettheap
added a commit
that referenced
this pull request
Oct 21, 2026
… fetch that carry it run in bootstrap.py's `untraced()` environment, so `make siblings` and `family.py siblings` write the token to no trace the caller asks git for (#1055) (#1075) `make siblings` and `family.py siblings` now write the token in `SHAPE_LEGS_TOKEN` or `SHAPE_LEGS_APP_TOKEN` to no trace the caller asked git for. #996 (#1045) did the same for `make bootstrap`. Lane 5 found this in its independent review of #1045 (rv996, #1045 issuecomment-6288783192) and measured it in #1055. `templates/family-root/scripts/siblings.py` gives the credential's `-c url.https://x-access-token:<token>@github.com/.insteadOf=...` rewrite, in argv, to two gits: - the clone in `place`, for a member with no clone beside the holder; - the fetch in `place`, for a member whose clone is there. Both ran in the caller's own environment. So every trace2 target the caller named wrote the token in the `start` event of each, one line per member. `scrub` kept it out of the output, and only that part held. Now: - **`rewrite_environment(token)`**, a new function in `siblings.py`: - with a token in use, it returns `untraced()` from the `bootstrap.py` beside it. That is every `GIT_TRACE*` variable taken out, and `GIT_TRACE2`, `GIT_TRACE2_EVENT` and `GIT_TRACE2_PERF` set to `0`, which also turns off a target the global or the system config names; - with no token, it returns None, so the two gits keep the caller's environment and stay traced where the caller asked, as before. - **The clone and the fetch** each run with `env=rewrite_environment(token)`. Nothing else in the file changes environment. - **The member's own `scripts/bootstrap.py`**, which `place` runs after a clone, is given no token in its argv, and no `env`, so it keeps the caller's environment and its traces. That environment holds `SHAPE_LEGS_TOKEN` and `SHAPE_LEGS_APP_TOKEN` as before; the shipped member bootstrap (`templates/assembly-root/scripts/bootstrap.py`) reads neither. A test row holds this, and so does `tests/test_validator_child_encoding.py`, which reads that call as handing no `env`. - **#1023's jobserver handling is untouched**: `dispatch` still runs each member's make with `member_make_environment(make)`, and no `MAKEFLAGS` reading changed. - **The docstrings** now say the promise in full: `git_prefix` says the token is "never written into `.git/config`, never persisted, never printed, and never traced". `place`'s ABSENT paragraph in the module docstring says the same, and `rewrite_environment` says what was measured. **One thing the issue did not ask for.** `GIT_TRACE_PERFORMANCE` writes a git's whole command line, `-c` included, on git 2.43.0 and 2.47.1 alike. So at main it held the token too, two lines per run, and the rows below set it. `untraced()` already takes it out: every `GIT_TRACE*` variable goes. This follows #1045's `untraced()` (#996): the clone and the fetch run in the very environment `make bootstrap` gives every git it hands the token. `siblings.py` imports `untraced` from the `bootstrap.py` beside it, next to `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path` and `members_of`. The issue left this to the writer, because a holder may keep a `bootstrap.py` older than its `siblings.py` (`update-shape.py apply --accept-local`), and an import of a name that copy lacks would stop `make siblings`, `park` and `resume` with an `ImportError`. The issue's text was written against main `1a47ed07`, where `siblings.py` still kept its own copy of the `MAKEFLAGS` readings. Since then #1023 (`9e154d87`, lane 4's) has decided the question for this pair of files: - it replaced that copy with an import of `member_make_environment`, because a copy in each script failed SonarCloud's duplication gate; - it named the price, in the import's comment and its commit: a holder that keeps its own `bootstrap.py` while `apply` writes `siblings.py` is refused, `update-accept-local-missing-name` (#536, #604), before a byte is written, and merges `bootstrap.py` by hand first. `untraced` takes the same road for the same reasons: - **One rule.** Which traces a command carrying the token is kept out of has one answer, for `make bootstrap` and `make siblings` alike. A copy here could drift from `bootstrap.py`'s, and the drift would be a token in a file. - **A kept old `bootstrap.py` is refused in the one-step case, and not in a two-step one.** The guard reads names. `untraced` is new with #996 (#1045), so a kept `bootstrap.py` from before it is refused by that name, where `--accept-local` names it in the same `apply`. Measured with `update-shape.py`'s own readers, in process: - `siblings.py` at this head takes `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path`, `members_of` and `untraced` from `bootstrap`; - the holder's `bootstrap.py` at main `00f6d7f7` lacks none of them; - the holder's `bootstrap.py` at `6476c170` (main just before #1045) lacks `untraced` alone, which is the line the refusal names. - **The one-step case, measured end to end (rv1075).** A holder cut at `6476c170`, and `apply --at c3cf515 --accept-local scripts/bootstrap.py`: exit 2, `scripts/bootstrap.py (kept) lacks untraced, which scripts/siblings.py imports from it`, and the holder's files, HEAD and status unchanged. - **Two applies in a row are not refused (rv1075's SHOULD 1, filed as #1082).** A holder whose earlier apply kept a `bootstrap.py` without `untraced` (rv1075 applied `--at 00f6d7f --accept-local scripts/bootstrap.py`: that target's `siblings.py` imports no `untraced`, so there was nothing to refuse), and then an apply at this head without `--accept-local`, gets `siblings.py` copied. `scripts/siblings.py` then fails with `ImportError: cannot import name 'untraced' from 'bootstrap'`, and so do `make siblings`, `park` and `resume`. The cause is the guard in `update-shape.py` (`:4288-4289`): it checks only the files `--accept-local` names in the same run. That is the gap of #536's guard, and it is on main already for #1023's `member_make_environment`; this change puts `untraced` into it and does not widen it. The text above this paragraph said no `ImportError` could reach a holder, which was too strong; #1082 is the follow-up, and it is not done here. - **No copy, so no test to hold two copies to one answer.** `tests/test_update_shape_kept_helper.py`'s `test_what_siblings_takes_from_the_holders_bootstrap_is_found_defined` already holds that every name `siblings.py` takes is defined in the holder's `bootstrap.py`. Its docstring now says six names, not five. **Setup:** - git 2.43.0 (`/usr/bin/git`) and git 2.47.1, Python 3.12.3; - the family of `tests/test_family.py` (two members, local bare remotes, the file transport allowed through `GIT_CONFIG_COUNT`), laid out as `<tmp>/InkRouter/InkRouter`; - offline: a stub `gh` first on PATH, a bogus `GH_TOKEN`, an empty `GH_CONFIG_DIR`, `GIT_SSH_COMMAND=false`; - the holder's own `scripts/siblings.py` was main's (sha256 `86bf57e0...`) or this change's; - the fake token `w1055-a-token-no-forge-takes`. **Each case was run three ways:** - `make siblings`, which clones both members; - `make siblings` again, which fetches both; - `family.py siblings --family-root <holder>` in a fresh layout, which clones both. **Traces were asked for in one of three ways:** - the seven variables `GIT_TRACE`, `GIT_TRACE2`, `GIT_TRACE2_EVENT`, `GIT_TRACE2_PERF`, `GIT_TRACE_PACKET`, `GIT_TRACE_CURL` and `GIT_TRACE_PERFORMANCE`, each set to a file under the run's TMPDIR; - `trace2.eventTarget`, `normalTarget` and `perfTarget` in a scratch `GIT_CONFIG_GLOBAL`; - the same three in a scratch `GIT_CONFIG_SYSTEM`. Each way was run with `SHAPE_LEGS_TOKEN`, with `SHAPE_LEGS_APP_TOKEN`, and with no token. That is 108 runs at main and at the change, 54 for each git. Each run's TMPDIR and the whole family folder (the clones' `.git/config` included) were searched for the token. | traces asked by | main, a token set (both variables, both gits) | this change, a token set | no token, either | |---|---|---|---| | the seven variables | `trace2-event.json`, `trace2-normal.txt`, `trace2-perf.txt`, `trace-performance.txt`: 2 lines each, in the clone, the fetch and `family.py` alike | none | no token anywhere; the same files written | | the global config | `cfg-event.json`, `cfg-normal.txt`, `cfg-perf.txt`: 2 lines each | none | the same | | the system config | `sys-event.json`, `sys-normal.txt`, `sys-perf.txt`: 2 lines each | none | the same | **What the table rests on:** - Every one of the 108 runs (and the 54 runs again on this head's final bytes, sha256 `b1e7bb21...`) exited 0 and ended `siblings ok: 2 member(s) beside the holder in ...`, with the token in neither stdout nor stderr. - The 2 lines in each file are the `start` (or `performance:`) line of the git given the `-c`, one for each member. Each carries the token twice, once for each spelling the rewrite covers. - With every member a local path, `GIT_TRACE`'s file was written and held no token, and `GIT_TRACE_CURL` wrote nothing, with no http remote. An https member is a different case, measured below. - With the change and a token set: - every trace file but `GIT_TRACE_PACKET`'s was still written, by the run's other gits and the member's own bootstrap; - the packet trace was not written, since only the clone and the fetch write one here. **An https remote, measured offline (rv1075, then the row of Round 2).** The rewrite reaches only `github.com`, and the probes above are offline, with local paths. A member whose `.gitmodules` url is `https://github.com/<org>/<repo>.git` is reached by it, and can be tried offline behind a dead proxy, `http.proxy=http://127.0.0.1:9`, so that nothing leaves the host: - rv1075 set one member's url so, with `make siblings`, a fake `SHAPE_LEGS_TOKEN`, and the seven variables set to files, on git 2.43.0 and 2.47.1. Main's `siblings.py` (`86bf57e0`) held the token in `trace.txt`, `trace2-event.json`, `trace2-normal.txt`, `trace2-perf.txt` and `trace-performance.txt`; this head held it in no file and no output. The clone failed cleanly, `git clone exited 128`, and `make siblings` exited 2. - `GIT_TRACE`'s file holds it too, in the `run_command: git remote-https origin https://x-access-token:<token>@github.com/...` lines: 3 lines on git 2.43.0, 4 on 2.47.1 (rv1075). - Round 2 below holds this in a test row. **Still not measured:** a github.com clone or fetch that succeeds, since no run here reaches the network. `tests/test_family_siblings_untraced.py` is new. It uses `tests/test_family.py`'s `family` and `estate`, `offline` from `tests/test_family_add_refusals.py`, `files_holding` and `CREDENTIALS` from `tests/test_family_bootstrap_stops_named.py`, and `NO_CREDENTIAL` and `needs_make` from `tests/test_siblings_family_name.py`. No assert joins conditions with `and`. The token is the fake `w1055-a-token-no-forge-takes`. **The rows.** Each entry point is crossed with each way traces are asked for: - entry points: `make siblings` cloning, `make siblings` again fetching (after a first run with no token and no trace), and `family.py siblings` cloning; - ways: the seven variables, the three targets in a scratch global config (a copy of the session's, which keeps git's automatic maintenance off), and the three targets in a scratch system config. **Three tests** (the third is round 2's): - **`test_with_a_token_in_use_the_token_is_in_no_trace`**: 18 rows (3 entries x 3 ways x 2 variables). Each asserts: - exit 0 and `siblings ok: 2 member(s) ...`; - the token in neither stdout nor stderr; - the token in no file under the test's directory: TMPDIR, every trace and config file, and the clones and their `.git/config`; - every trace file the way asks for written: 5 for the variables, 3 for each config; - the member's own bootstrap traced where a member was cloned: a git traced in a leg of each clone, which only that bootstrap runs. Where nothing was cloned, nothing ran there. - **`test_with_no_token_the_clone_and_the_fetch_are_traced_as_asked`**: 9 controls (3 entries x 3 ways). Each asserts exit 0, `siblings ok` and the same trace files written. It also asserts the trace2 event file holds `siblings.py`'s own git at each member, read from the events: `git clone -q --no-local ...` to each member's slot, or `git fetch --quiet origin` in each member's clone. **Fails on main.** The file was run against main's `siblings.py` (sha256 `86bf57e0...`, put in place and then restored, sha256 checked): - **18 failed, 9 passed**: every row with a token failed, and the 9 controls passed; - the variables rows found the token in `trace-performance.txt`, `trace2-event.json`, `trace2-normal.txt` and `trace2-perf.txt`; - the global-config rows found it in `cfg-event.json`, `cfg-normal.txt` and `cfg-perf.txt`; - the system-config rows found it in `sys-event.json`, `sys-normal.txt` and `sys-perf.txt`. - **`test_an_https_member_with_a_token_in_use_is_in_no_trace`**: 3 rows, one for each of `CALLERS_CONFIG` (round 2 and round 3, below). Each mutant was applied alone to the worktree's file and the new test file run (git 2.43.0). The bytes were restored and checked by sha256 after each: - `siblings.py` sha256 `b776c69b...`: this head's code; it differs from the head only in two docstring lines; - `bootstrap.py` sha256 `50a16751...`, main's, unchanged here. All are **killed**. | mutant | result | |---|---| | M1 the token condition dropped: `untraced()`'s environment always | killed, 9 failed (every control) | | M1b the condition inverted | killed, 27 failed | | M1c the clone untraced always, the fetch as it is | killed, 6 failed (the clone controls) | | M2 the clone left in the caller's environment | killed, 12 failed (every clone row with a token) | | M3 the fetch left in the caller's environment | killed, 6 failed (every fetch row with a token) | | M4a `GIT_TRACE2_EVENT` not set to `0` (`TRACE2_OFF`) | killed, 12 failed (the global- and system-config rows) | | M4b `GIT_TRACE2` not set to `0` | killed, 12 failed (the same) | | M4c `GIT_TRACE2_PERF` not set to `0` | killed, 12 failed (the same) | | M5 the `GIT_TRACE*` removal dropped (`env = dict(os.environ)`) | killed, 6 failed (the variables rows, by `GIT_TRACE_PERFORMANCE`) | | M6 the prefix narrowed to `GIT_TRACE2` | killed, 6 failed (the same) | | M7 the member's own bootstrap run untraced too | killed, 12 failed (the clone rows' bootstrap check) | M5 and M6 are killed only because the variables rows set `GIT_TRACE_PERFORMANCE`. With a local-path remote, of the issue's six variables none but trace2's writes the `-c`, and trace2's three are set to `0` whatever the prefix does. With an https remote `GIT_TRACE` writes it too, in the `run_command: git remote-https` lines; that is what the row of Round 2 holds, and the mutant R4 below, which keeps the caller's `GIT_TRACE`, passed all 27 earlier rows. **How every run was made:** - through lane 5's runner: `/usr/bin/python3 -m pytest -q -rs -p no:cacheprovider -o tmp_path_retention_policy=failed`, one basetemp per run; - `LANES_*` cleared, a stub `gh` first on PATH, `GH_TOKEN=bogus`, an empty `GH_CONFIG_DIR`; - `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null` at the start of the session. | git | files | result | |---|---|---| | 2.43.0 | `test_family_siblings_untraced.py`, on this change before the docstring fix | 27 passed | | 2.43.0 | the same file against main's `siblings.py` | 18 failed, 9 passed | | 2.43.0 | gate shard A: 19 of the 41 files below | 1623 passed, 4 skipped, in 19:51 | | 2.43.0 | gate shard B: the other 22 of the 41 files | 2415 passed, 8 skipped, in 15:03 | | 2.47.1 | `test_family_siblings_untraced.py` | 27 passed, in 1:14 | **What the 41 gate files are:** - the new file; - `test_family_member_make_jobserver.py`; - every file `grep -l siblings tests/` names; - the pinned-copy and upgrade-row files: `test_pinned_copy_text.py`, `test_update_shape.py`, `test_update_shape_add.py`, `test_update_shape_kept_helper.py`, `test_no_auto_maintenance.py`, `test_template_text_placeholders.py`, `test_bootstrap_spelling.py`; - the trio: `test_repo_hygiene.py`, `test_agents_md_codes.py` and `test_cli_reference.py`. **The gate runs** (both shards at once, then the 2.47.1 run) were made on this change as it is committed: `siblings.py` sha256 `b1e7bb21...` and the new test file sha256 `7ba7a416...`, at main `00f6d7f7` (this branch's base; no rebase was needed, see Merges). The runner's `START` line read `dirty=2`, the two tracked files this commit changes, and a sha256 check after the runs found `siblings.py` unchanged (neither it nor the test files were modified after the runs started). The first pair of shards was stopped part way and re-run whole; only the re-runs count here. **The 41 files, by shard:** - shard A (19): `test_shape_doctor.py`, `test_validator_child_encoding.py`, `test_family_py_unreadable.py`, `test_pinned_copy_text.py`, `test_siblings_inputs.py`, `test_siblings_family_name.py`, `test_family_member_make_jobserver.py`, `test_update_shape_add.py`, `test_adopt_printed_sentences.py`, `test_family_printed_quoting.py`, `test_family_makefile_siblings.py`, `test_template_text_placeholders.py`, `test_park_resume_targets.py`, `test_windows_paths.py`, `test_doctor_gitmodules_not_utf8.py`, `test_local_remote_dir_urls.py`, `test_family_siblings_untraced.py`, `test_setup_family_folder.py`, `test_bootstrap_refusal_exit.py`; - shard B (22): `test_repo_hygiene.py`, `test_doctor_legs_members_next.py`, `test_update_shape.py`, `test_family.py`, `test_update_shape_kept_helper.py`, `test_yaml_reader_spaces.py`, `test_bootstrap_spelling.py`, `test_agents_md_codes.py`, `test_family_siblings_placement.py`, `test_no_auto_maintenance.py`, `test_cli_reference.py`, `test_family_siblings_bootstrap_unreadable.py`, `test_bootstrap_branch_bytes.py`, `test_family_init_asks_every_value.py`, `test_validate_workflow_gitmodules_urls.py`, `test_adopt_contracts_dir.py`, `test_doctor_unfinished_merge.py`, `test_family_members_not_a_list.py`, `test_family_init_landing.py`, `test_family_docs_one_spelling.py`, `test_doctor_members_spelled.py`, `test_pins_child_kind_and_siblings_root_spelling.py`. **The skips are the environment's, each named by its reason:** - shard A: 3 in `test_shape_doctor.py` (the PowerShell line is printed, and `powershell.exe` exists, only on a Windows host) and 1 in `test_family_member_make_jobserver.py` (`make -j2` here writes `--jobserver-auth=3,4`, not GNU make 4.4's named pipe); - shard B: 2 in `test_doctor_legs_members_next.py` (this git crashes on `submodule init`, exit 139, as git 2.43 does on a bare `branch`), 4 in the same file (this git dies on a `shallow` of -2**31, as git 2.43 does), and 2 in `test_no_auto_maintenance.py` (the session began with `GIT_CONFIG_GLOBAL` set, and its file includes that one); - the 2.47.1 run of the new file skipped none. The full suite was not run. **Static checks:** - flake8 finds in `siblings.py` only the three lines it finds at main (two E501, one E127, each moved down by the added lines); - in the new test file it finds only the F811s every fixture-importing file has; - both files are ASCII, apart from the dashes and the CJK example already in `siblings.py`. Fetched with `-c gc.auto=0 -c maintenance.auto=false`, on 2026-10-20 at about 21:03Z. Round 1, `git merge-tree --write-tree` of the first head `c3cf5154` against (round 2's are in its own section): - **origin/main `6c861635`**: clean, exit 0, tree `225b2a99`. - Main has moved two commits past this branch's base `00f6d7f7`: `9cbba9d5` (#1063: `scripts/family.py`, `scripts/shape_materialize.py`, `docs/cli.md` and two tests) and `6c861635` (#1065: `adopt-project.py` and three tests). - Neither touches `siblings.py`, `bootstrap.py`, `tests/test_update_shape_kept_helper.py` or the new test file, so there was no rebase and the gate runs above stand. - **#1062** (`fix/1040-windows-start-errors`, head `957ba038`), the one open PR that touches a family-root script this change reads (`templates/family-root/scripts/bootstrap.py`, with the assembly root's and `validate-family.py`, `validate-pins.py` and three tests): clean, exit 0, tree `84d4b54a`. - Its diff does not touch `untraced()`. - In the merged tree `bootstrap.py` still defines `untraced` (and the five other names `siblings.py` takes from it), and `siblings.py` is byte-identical to this head's (sha256 `b1e7bb21...`). - **The other 9 open PRs** (#1073, #1072, #1071, #1070, #1069, #1068, #1067, #1064, #1031): none touches `siblings.py`, `tests/test_update_shape_kept_helper.py`, or a file the new test imports from (`conftest.py`, `test_family.py`, `test_family_add_refusals.py`, `test_family_bootstrap_stops_named.py`, `test_siblings_family_name.py`), read from `gh pr list --state open --json number,headRefName,headRefOid,files`. `templates/family-root/scripts/siblings.py` is in `FAMILY_COPIED_VERBATIM`, so each holder gets one `upstream-changed` row for it, as #1045 gave one for `bootstrap.py`: - a holder that takes it with `bootstrap.py` from #1045 or later needs nothing more; - a holder that keeps an older `bootstrap.py` with `--accept-local` in the same apply is refused, `update-accept-local-missing-name`, naming `untraced`, before anything is written; - a holder whose earlier apply kept a `bootstrap.py` without `untraced`, and that then applies this change without `--accept-local`, is not refused: `siblings.py` is copied, and `make siblings`, `park` and `resume` meet an `ImportError`. That is the gap of #536's guard, which `member_make_environment` has on main already, and it is #1082's. No Windows or macOS run was made, since CI is Linux only (#597). rv1075, lane 5's independent reviewer, found `c3cf5154` READY (#1075 issuecomment-6302090874): no MUST, two SHOULDs and a NIT. One commit on top of it, `041f7831`, with no rebase: main has touched none of this PR's files. **The three findings:** - **SHOULD 1** (the body said no `ImportError` reaches a holder, and two applies in a row make one): answered in the body above, in "Where the helper comes from" and "The pinned copy". The gap is #536's guard's, it is on main for `member_make_environment` already, and it is #1082's; this PR does not change `update-shape.py`. - **SHOULD 2** (every row used a local file remote, so a leak through `GIT_TRACE` on an https member had no test, and rv1075's mutant R4 passed all 27 rows): answered by the new row below. - **NIT** (three places said the member's own bootstrap "is given no token"): `siblings.py`'s module docstring, `rewrite_environment`'s docstring and the test file's docstring now say it is given no token in its argv. It inherits `SHAPE_LEGS_TOKEN` and `SHAPE_LEGS_APP_TOKEN` in its environment, because `run_member_bootstrap` passes no `env`, and the shipped one reads neither. `rewrite_environment`'s docstring also names the https measurement. **The code of `siblings.py` is unchanged.** Its syntax tree with the docstrings taken out is the same at `c3cf5154` and at `041f7831` (compared with `ast`); the file's sha256 moved from `b1e7bb21...` to `19107ad4...` over comments and docstrings only. So round 1's two gate shards (1623 passed, 4 skipped; 2415 passed, 8 skipped) were not re-run; the targeted runs below are. **The new row,** `test_an_https_member_with_a_token_in_use_is_in_no_trace` (the file has 28 rows now). Its setup: - the estate of `tests/test_family.py`, with `IRRS`'s url in the holder's `.gitmodules` given as `https://github.com/InkRouter/IRRS.git`, and `IRSS` still a local path; - `http.proxy=http://127.0.0.1:9`, a dead proxy, in git's command scope after the entries the session holds, and `NO_PROXY` and `no_proxy` empty, so nothing leaves the host; - a fake `SHAPE_LEGS_TOKEN` and the seven trace variables set to files; - `make siblings`, cloning. It asserts: - the proxy is set where the row sets it: `http.proxy=http://127.0.0.1:9` is in the command scope the run's git reads (`command_scope_at`, which runs `git config --show-origin --list` and writes nothing); - exit 2 and `IRRS: git clone exited 128:` on stderr, which is how the head fails (rv1075 measured the same); - `IRSS` was cloned and `IRRS` was not; - the token is in neither stdout nor stderr, and in no file under the test's directory; - the five trace files the variables ask for are written, by the run's other gits. No assert names the proxy in git's message. The git 2.47.1 this lane builds has no `git-remote-https` (`git: 'remote-https' is not a git command`, `fatal: remote helper 'https' aborted session`), so there the clone fails at once without reaching the proxy, still with 128. `GIT_TRACE` has written the `run_command: git remote-https origin https://x-access-token:<token>@github.com/...` line before that, so the row finds the leak on both gits. A first local version asserted the proxy's message and failed on 2.47.1 for that reason; the assert was dropped, and the commit amended, before anything was pushed. **It fails on main.** The file was run against main's `siblings.py` (sha256 `86bf57e0...`, put in place and then restored, sha256 checked each time): - git 2.43.0, the whole file: **19 failed, 9 passed**, the 18 rows of round 1 and the new row. The new row fails at `assert files_holding(tmp_path, TOKEN) == []`, with 5 files holding the token: `temp/trace-performance.txt`, `temp/trace.txt`, `temp/trace2-event.json`, `temp/trace2-normal.txt` and `temp/trace2-perf.txt`. The round 1 rows find 4 of those, since a local path leaves `temp/trace.txt` clean; - git 2.47.1, the row alone: **1 failed**, the same 5 files. **It kills R4.** R4 is rv1075's mutant, in `rewrite_environment`: `return {**untraced(), **{k: v for k, v in os.environ.items() if k == "GIT_TRACE"}} if token else None`, which keeps the caller's `GIT_TRACE` for the clone and the fetch. Applied alone, then restored and sha256-checked: - git 2.43.0, the whole file: **1 failed, 27 passed**: the new row alone, with `temp/trace.txt` the one file holding the token; - git 2.47.1, the row alone: **1 failed**, the same one file. **The runs on the pushed head `041f7831`** (the runner's `START` line read `dirty=0`), through the same runner as round 1: | git | files | result | |---|---|---| | 2.43.0 | the new file, `test_update_shape_kept_helper.py`, `test_family_makefile_siblings.py`, `test_family_member_make_jobserver.py`, `test_pinned_copy_text.py`, and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) | 589 passed, 1 skipped (the jobserver file's named-pipe row, as in round 1), in 5:09 | | 2.47.1 (`git version 2.47.1`, printed from the exact path first on PATH) | the new file | 28 passed, in 2:13 | | 2.43.0 | the new file against main's `siblings.py` | 19 failed, 9 passed | | 2.47.1 | the new row against main's `siblings.py` | 1 failed | | 2.43.0 | the new file with R4 | 1 failed, 27 passed | | 2.47.1 | the new row with R4 | 1 failed | | 2.43.0 | on a predicted merge with main (below): the new file, `test_update_shape_kept_helper.py`, `test_pinned_copy_text.py`, `test_family_makefile_siblings.py` | 305 passed, in 2:50 | The full suite was not run. flake8 finds in `siblings.py` the same three lines as at round 1, and in the test file only F811s, from the fixtures it imports. Both files are ASCII, apart from the dashes and the CJK example already in `siblings.py`. **The merges of round 2.** Fetched with `-c gc.auto=0 -c maintenance.auto=false` at about 23:00Z; `git merge-tree --write-tree` of `041f7831` against: - **origin/main `c13c3985`** (#1076's squash, which touches `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py`, among others): clean, exit 0, tree `8ae10d0c`. None of the three files this PR changes is among the files main changed since the base `00f6d7f7`, so there is no rebase. In that tree `siblings.py` is byte-identical to this head's, `untraced()` has the same syntax tree as at the base, and `CREDENTIALS` and `files_holding`, which the new file imports from `test_family_bootstrap_stops_named.py`, are still defined. The 305-passed run above is on that tree; - **#1062** (`fix/1040-windows-start-errors`, head `957ba038`): clean, exit 0, tree `e6ed1ba2`. Its `untraced()` has the same syntax tree as main's; - **the other open PRs** (#1031, #1069, #1070, #1072, #1073, #1081, #1084): none touches `siblings.py`, `tests/test_update_shape_kept_helper.py`, `bootstrap.py`, or a file the new test imports from, read from `gh pr list --state open --json number,headRefName,headRefOid,files` at about 23:00Z. #1076 (`fix/1056-signal-anywhere`, head `73906948`) was open when the runs were made, and merged clean with this head then (tree `6ae3e65f`); it has landed since as `c13c3985`, above. **The failure.** Lane 5's landing gate (log `c1075.log`, #1075 issuecomment-6304830183) failed the https row of round 2 at `041f7831`: 1 failed, 356 passed. The change in `siblings.py` was not at fault; the row depended on the caller's git config. - The gate ran with neither `GIT_CONFIG_GLOBAL=/dev/null` nor `GIT_SSH_COMMAND=false`, which the writers' runs and round 2's runs had. - `conftest.py`'s session global file includes the caller's global config (or `~/.gitconfig`, where `GIT_CONFIG_GLOBAL` is unset). The operator's `~/.gitconfig` has `url.git@github.com:.insteadOf=https://github.com/`. - Git keeps the first of two `insteadOf` prefixes of the same length, and the config files are read before the command line, so that rewrite beat the token's `-c` rewrite of the same prefix. Measured with scratch files and a stand-in token, on git 2.43.0: under a global file with that rewrite, `git -c url.https://x-access-token:T@github.com/.insteadOf=https://github.com/ ls-remote --get-url https://github.com/InkRouter/IRRS.git` printed `git@github.com:InkRouter/IRRS.git`. - So the row's `https://github.com/InkRouter/IRRS.git` went over ssh to `InkRouter/IRRS`, a real private repository. The dead proxy never applied, the clone succeeded, `make siblings` exited 0 and the placed members were both there, and the row failed `assert result.returncode == 2`. **The fix** is in `tests/test_family_siblings_untraced.py` only. No other file changed in this round, and `siblings.py` is byte-identical to `041f7831`'s (sha256 `19107ad4...`). - **`hermetic_config`** gives the https row's git a global file of its own, `session_global_config("")` (`conftest.py`'s own function: automatic maintenance off, and no include of the caller's file), `GIT_CONFIG_NOSYSTEM=1` and `GIT_SSH_COMMAND=false`. - It is the least invasive way: only the one row with an https url sets it, `conftest.py` and every other row stay as they were, and the other rows' remotes are local paths, which no rewrite of GitHub's url reaches. - `GIT_CONFIG_GLOBAL` set takes git's two user-level files out of the reading, and `GIT_CONFIG_NOSYSTEM` the system file whatever `GIT_CONFIG_SYSTEM` says (checked on git 2.43.0 and 2.47.1 with scratch files). - `GIT_SSH_COMMAND=false` is a second wall: a url somehow sent over ssh runs `false`. No mutant can show it needed, since the runner exports it too. - **`url_after_config`** is a new assert before the clone: `git ls-remote --get-url <url>` (it applies the config's `insteadOf` and asks nothing of the network) must give the url unrewritten under the row's environment. A config that reaches the row now fails by name, before any clone. - **The row is parametrized by `CALLERS_CONFIG`**: `none` (round 2's row), and `global` and `system`, each a stand-in for a caller's config that would send the url somewhere reachable. `as_the_callers_config` writes a scratch file of the test's own, `url.<file URI of the family's own IRRS remote>.insteadOf=https://github.com/InkRouter/IRRS.git`, into this process's `GIT_CONFIG_GLOBAL` (the session file includes it) or `GIT_CONFIG_SYSTEM`. It is built from tmp files only: no network, and never the real `~/.gitconfig`. The file now has 30 rows. - With the fix, in each of the three, the clone fails at the proxy with git's 128, `make siblings` exits 2, `IRSS` is placed and `IRRS` is not, and the token is in no output and in no file under tmp_path. **The variants fail without the fix.** Each was applied alone to the worktree's test file (or `siblings.py`) and run through the runner, with the file's sha256 checked after it was restored: - **`041f7831`'s file as pushed, under a caller's global config.** Lane 5's runner now honours `L5_GIT_CONFIG_GLOBAL=<scratch file>` as the caller's global config, with ssh impossible. The scratch file rewrote `https://github.com/InkRouter/IRRS.git` to the run's own IRRS remote (a `file://` url under the run's basetemp). The whole file, git 2.43.0: **1 failed, 27 passed**, the https row at `assert 0 == 2`, the gate's failure reproduced with no network. - **T2, `041f7831`'s row plus the variants:** the new file with `hermetic_config` and the `url_after_config` assert taken out. The https rows, git 2.43.0: **2 failed, 1 passed**, `[global]` and `[system]` at `assert 0 == 2` (the clone went to the local remote and exited 0), and `[none]` passes. On git 2.47.1 the same. - **T1,** the row's global file dropped and the assert kept: `[global]` fails at the assert, which sees `file:///...IRRS.git` for the url; the other two pass. - **T3,** `GIT_CONFIG_NOSYSTEM` dropped and the assert kept: `[system]` fails at the assert; the other two pass. **R4 stays killed.** rv1075's R4 (`rewrite_environment` keeps the caller's `GIT_TRACE`), git 2.43.0, the whole file: **3 failed, 27 passed**, the three https rows. **The runs on the pushed head `962ae43c`** (`START` read `dirty=0`), through the same runner as before: | git | files | result | |---|---|---| | 2.43.0 | the new file, `test_update_shape_kept_helper.py`, and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) | 359 passed, in 3:05 | | 2.47.1 (`git version 2.47.1`, printed from the exact path first on PATH) | the new file | 30 passed, in 1:51 | | 2.43.0 | the new file, with `L5_GIT_CONFIG_GLOBAL` naming that scratch file | 30 passed, in 2:21 | | 2.43.0 | `041f7831`'s file, with the same | 1 failed, 27 passed | | 2.43.0 / 2.47.1 | T2, the https rows | 2 failed, 1 passed / 2 failed, 1 passed | | 2.43.0 | T1, T3, the https rows | 1 failed, 2 passed each | | 2.43.0 | R4, the whole file | 3 failed, 27 passed | The full suite was not run. flake8 finds in the test file only F811s from the fixtures it imports, and nothing over 79 columns; the file is ASCII. **The merge-tree of round 3.** Fetched with `-c gc.auto=0 -c maintenance.auto=false` at about 10:53Z; `git merge-tree --write-tree` of `962ae43c` against: - **origin/main `2a119f28`** (#1092): clean, exit 0, tree `b5ea0114`. Main has landed #1076 (`c13c3985`) and #1062 (`ff0c72eb`) since the last round, and has changed `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py` among others, but none of this PR's three files. In that tree `siblings.py` is byte-identical to this head's, `untraced()` has the same syntax tree as at the base `00f6d7f7`, and `CREDENTIALS` and `files_holding` are still defined where the new file imports them from. - **#1088** (`fix/1085-nit-texts`, head `88af1b7b`), which touches the same two files of main's: clean, exit 0, tree `365df092`, with the same findings. - **The other open PRs** (#1087, #1090, #1091, #1097): none touches `siblings.py`, `bootstrap.py`, `tests/test_update_shape_kept_helper.py` or a file the new test imports from, read from `gh pr list --state open --json number,headRefName,headRefOid,files` at about 10:53Z. Lane: openreposhape-5 (openRepoShape-5) Review: rv1075, lane 5's independent reviewer, not the writers (w1055 and f1055): READY at `c3cf5154` (issuecomment-6302090874) with no MUST; its two SHOULDs and its NIT were taken in one new commit, and the re-check is READY at `041f7831` (issuecomment-6303900180), with no MUST or SHOULD; its one NIT, a merge-tree number in the body, is fixed in the body. CI (Brett Heap's ruling 27): H0 is the head 962ae43 itself, which passed tests, tests-git-bash and SonarCloud; main has touched none of its files since its base 00f6d7f; and the local gate passed on its predicted squash tree fc2afb3 over main 16f9a0e: the family_siblings_untraced, update_shape_kept_helper, repo_hygiene, agents_md_codes, cli_reference sets, 359 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #1055 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 21, 2026
… holds without its commit is one it cannot answer for, `check` says a commit it cannot ask was not asked, and a pinned product YAML 1.1 or 1.2 reads as no text is quoted (#912) (#1090) Each pin question is answered from the commit actually pinned, with words that say why, and a pinned product is written so that any YAML reader reads it back as text. This is #912, which groups three lines of #457's release-commit triage: L1-81, L1-82's second case, and L2-14. One commit, on main `5e539a87`. It changes `scripts/shape_materialize.py`, `adopt-project.py` and `scripts/bump-leg.py`, and six test files. The issue's line numbers are at `5017830`. Each claim was measured again by name, on main `6c861635` first and again on `5e539a87`: - **L1-81 held.** `commit_in_clone` (`scripts/shape_materialize.py:3650` at `6c861635`, `:3809` at `5e539a87`) asks `rev-parse -q --verify <id>^{}` of an annotated tag. In a clone that holds the tag but not its commit, git answers `error: missing object referenced by '<tag>'` (git 2.43 and 2.47.1), and the id was refused as `is an annotated tag that names no commit`. `bump-leg.py`'s `peeled_target` (`:972`, now `:977`) did the same. - **L1-82's second case held.** `_recomputed_pin_finding` (`adopt-project.py:872`, now `:871`) asks a recorded `commit:` what it names only of a recorded clone that is still at its path and is no partial clone. Where the clone is gone or partial, or `gh api` read the digest, `check` exits 0 on a tag's id with a NOTE that names only the digest. - **L2-14 held, in a new place.** `_neutral_pin_entry` is no longer `adopt-project.py`'s own. Since #924 both tools call `shape_materialize.neutral_pin_entry` (`:524`), and it still asked only the project's reader. Its docstring even said that a bare `yes`, `on`, `.5` or `.inf` stays bare, naming this issue. - **Main moved under the change** while it was being tested. The commit was rebased from `6c861635` onto `5e539a87` with no conflict, and its patch is the same (`git patch-id --stable` `427e9e35fd2464cb` both times): - #1068 (`6797ca70`) changes `bump-leg.py`'s `_leg_fetch_refspecs` and `fetch_leg`'s docstring, and moves a refspec helper into `shape_materialize.py`. It does not touch `peeled_target`, and tag following under `refs/tags/`, which the new bump row relies on, is unchanged. - #1064 (`5e539a87`) changes `shape_materialize.py`'s manifest readers and `adopt-project.py`'s `_manifest_findings` and one import. It does not touch `commit_in_clone`, `neutral_pin_entry` or `_pin_digest_findings`. - Every row and every mutant below was run again on the rebased head, and the new rows were run again on `5e539a87`'s code. ### L1-81: a tag whose commit the clone lacks is a clone that cannot answer - `commit_in_clone` returns `(oid, "")` where a tag's peel cannot be read (`names is None`), as it already does for an id the clone does not hold. `plan` and the scaffold then read the digest there. `git ls-tree` finds no tree at the id, so they refuse it `pin-source-unreadable`, whose remediation says to point `--pin-source` at a clone that HAS the pinned commit, "`git fetch --all` first". That is what main said before #651. `check` says `plan-pin-source-unreadable`. - `peeled_target` returns the id as typed there. The reachability verdict answers it, as it answers an id the leg does not hold: `bump-leg-commit-not-on-remote`, "<repository> has no branch containing <id>", from both runs. - A tag of a tree or a blob, which the clone can peel, is still `pin-not-a-commit` or `bump-leg-target-not-a-commit` by name. ### L1-82: `check` says it did not ask a recorded commit it could not ask - The forge is not asked. `check` and `execute` read no network for a pin (#273's review S3, #449), `execute --local-remote-dir` needs no `gh`, and the rows that hold that (`gh` never run) stay. In a partial clone, git would fetch an id it lacks from the promisor remote. - So the NOTE says it, in the words the issue's second option asks for. It was: `NOTE <entry>: digest NOT rechecked here: <why>. The root's own `validate-pins.py` recomputes it wherever it can read the product.` It is now: `NOTE <entry>: digest NOT rechecked here, nor its `commit:` asked whether it names a commit: <why>. The root's own `validate-pins.py` recomputes the digest wherever it can read the product; `plan` asks what the commit names where it reads the digest.` - `<why>` is unchanged for each of the four cases: gone, partial, `gh api`, and a `digest_source:` that names no clone. No refusal code changes, so `AGENTS.md`'s table is unchanged. README, `docs/` and the handbook quote neither sentence. ### L2-14: a product YAML 1.1 or 1.2 reads as no text is double-quoted - New `shape_materialize.YAML_NOT_TEXT_RE`. Of the plain scalars `PLAIN_SCALAR_RE` takes, which begin with a letter, `_` or `.`, it matches the ones YAML 1.1 or YAML 1.2's core schema resolves to a bool, a null or a float: - YAML 1.1's bools `y`, `n`, `yes`, `no`, `on` and `off`, and both versions' `true` and `false`, in their three cases; - `null` in its three cases; - `.inf` and `.nan` in their three cases; - a point before digits, as YAML 1.1's pattern is written (`\.[0-9.]*` with a signed exponent, so `.`, `..` and `.5.5` too); - and as its own example `685.230_15e+03` and its readers read it, with `_` among the digits (PyYAML takes `.5_` for 0.5, ruamel.yaml takes `._` for a float), with YAML 1.2's unsigned exponent `.5e3`. - Nothing else either version resolves to no text is a plain scalar `PLAIN_SCALAR_RE` takes: `~`, the empty null, `<<`, `=`, and ints, timestamps and floats that begin with a digit or a sign. - `neutral_pin_entry` writes a name bare only where it is a plain scalar, the new rule does not match it, and the project's reader reads it back. So both tools double-quote these names. Every other name is the line it was, `openGlass` byte for byte. - The plan's `product:`, which `y` writes and only this tool reads, is unchanged. The pin file's `product:` was always double-quoted. The probe is `probe912.py` (not committed). It runs with a stub `gh` that exits 97 first on PATH, a bogus token, an empty `GH_CONFIG_DIR`, `GIT_CONFIG_GLOBAL=/dev/null` and `GIT_SSH_COMMAND=false`. The `lacking` clone holds the tags `v1` and `v1-again` but not their commit. | Case | main `6c861635` and `5e539a87` | This head | | --- | --- | --- | | `commit_in_clone(lacking, <tag>)` | `(<tag>, 'is an annotated tag that names no commit')` | `(<tag>, '')` | | `peeled_target(lacking, <tag>)` | `REFUSED bump-leg-target-not-a-commit: --to <tag> is an annotated tag that names no commit in the leg` | returns `<tag>` | | scaffold `--dry-run` and `plan`, `--pin openGlass@<tag> --pin-source lacking` | exit 2 `REFUSED pin-not-a-commit: ... is an annotated tag that names no commit in the clone at <lacking>, not a commit` | exit 2 `REFUSED pin-source-unreadable: <lacking> could not answer for opensoft/openGlass @ <tag>: ... exited 128: fatal: not a tree object`, remediation "`git fetch --all` first" | | `check`, recorded clone `lacking` | exit 1 `FINDING plan-pin-not-a-commit: ... which is an annotated tag that names no commit` | exit 1 `FINDING plan-pin-source-unreadable: ... cannot answer for it` | | `check`, a tag's id, clone whole (control) | exit 1 `plan-pin-not-a-commit`, "an annotated tag of commit <c>" | the same | | `check`, a tag's id, clone partial / gone / `gh api` / none named | exit 0, NOTE names only the digest | exit 0, the NOTE above; `gh` never ran | | names `--pin` admits of up to three characters (278915) | 231714 written bare; PyYAML misreads 132 of them, ruamel.yaml 0.19 (YAML 1.2) 132 | 231543 bare; 0 misread by either | #457 counted 138 at `3dd806f`. On `6c861635`, PyYAML misread `yes`, `no`, `on` and `off` in three cases each, `.0` to `.99`, and `.0_` to `.9_`. ruamel.yaml misread the dot forms, `._`, `._0` to `._9` and `.__`, and its YAML 1.1 mode also reads `y` and `n` as bools. **Found while testing.** git 2.43's `fetch` follows a remote tag whose object is already in the store, and brings the tag's commit with it. Its tag-following check counts the tag object itself, not only the commit. So in `bump-leg.py` a tag that the leg holds without its commit is a tag the leg's remote does not advertise, or one met after a fetch that failed. The bump row uses a tag that was never pushed. New rows, in each file's style and with its helpers: - `tests/test_pin_annotated_tag.py`: - a `lacking` fixture (`git hash-object -t tag -w` of the tags' bytes); - `commit_in_clone` answers `(id, "")` (2 rows); - `plan` and the scaffold's `--dry-run` refuse `pin-source-unreadable` with no "annotated tag" in the output (4); - `check` finds `plan-pin-source-unreadable` and `execute` refuses before any leg (1); - the NOTE for a tag's id, clone gone, partial or `gh api`, with `gh` never run (3). - `tests/test_bump_leg_dry_run_truth.py`: a tag the leg holds without its commit is `bump-leg-commit-not-on-remote` in both runs, with nothing written, through `--local-remote-dir` and `origin` (2). - `tests/test_neutral_pin_entry_one_spelling.py`: - each of 25 YAML 1.1 and 1.2 words and 20 dot floats is double-quoted and reads back (45); - the same 45, with the project's reader stubbed to read everything back, are double-quoted by the rule alone (45); - 20 look-alikes (`openGlass`, `openYes`, `yEs`, `.e5`, `._.` ...) stay bare (20); - the whole enumeration, read by PyYAML, ruamel.yaml 1.2 and ruamel.yaml 1.1 where they are installed (1; skipped without either reader, so CI holds the rule by the rows above). - Changed rows, whose old expectation was the bug: - `SPELLED["yes"]`, and the entry-equals-adopt's-old-spelling row, which now expects exactly `.`, `..`, `.0`, `.9`, `._` and `yes` to differ; - `.5`, `.inf`, `yes` and `off` move out of the bare groups in `test_scaffold_pin_and_reuse.py` and `test_adopt_pins.py` into `STOCK_MISREAD`; - the NOT-rechecked constants in `test_adopt_pins.py`, and one line in `test_pin_source_top_level.py`. No assert joins conditions with `and` or `or`. **The rows fail on main.** The six test files were run on main's code, the scripts as on main with the new tests beside them: - on `6c861635`: 96 failed, 98 passed, and 16 failed, 232 passed; - on `5e539a87`: 112 failed, 330 passed. Every failure is a new or changed row: - spelling 85; - tag file 10; - top-level partial-clone NOTE 1; - `test_adopt_pins.py` 10; - bump 2; - scaffold entry 4. Each mutant was applied alone to a scratch clone of the head and its rows were run. The results were the same on `6c861635` and on the rebased head. | Mutant | Result | | --- | --- | | M1 `commit_in_clone` without the `names is None` return | killed, 3 failed | | M2 `peeled_target` without it | killed, 2 failed | | M3 `if not peeled` in place of `if names is None` | survives: equivalent. The two differ only where `rev-parse <id>^{}` prints an id and `cat-file -t` of that id fails, and rev-parse parsed that object to print it. | | M4 the NOTE's old words | killed, 3 failed | | M5 `neutral_pin_entry` without the rule | killed, 85 failed | | M6 rule without `y`/`n` | killed, 9 | | M7 without `yes`/`no`/`on`/`off` | killed, 28 | | M8 without `true`/`false`/`null` | killed, 9 (the reader-stubbed rows) | | M9 without `.inf`/`.nan` | killed, 12 | | M10 without YAML 1.1's pattern as written | killed, 9 | | M11 without the `_`-digits pattern | killed, 14 | | M12 that pattern's exponent signed only | killed, 4 | | M13 no end anchor | killed, 15 | All runs go through lane 5's `run9.sh`: a stub `gh` first on PATH, a bogus token, every `LANES_*` variable cleared, `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`, and one basetemp per run. - **The six test files on the head `d5389eb6a71e`:** - git 2.43: 442 passed; - git 2.47.1 (first on PATH): 442 passed. - They also passed on `6c861635` before the rebase: 442 on 2.47.1, and on 2.43 in groups of 115, 31, 24, 149 and 123. - **git 2.43, every other test file that runs a changed script.** These are the files that name `adopt-project`, `ADOPT`, `shape_materialize`, `bump-leg` or `BUMP`, plus `test_shape_doctor.py`, `test_scaffold_leg_path_collisions.py` and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`), less the six. That is 177 test files in two shards, 179 paths with `tests/conftest.py` and `tests/gh_guard.py`: - shard a, 88 files: 6371 passed, 33 skipped (`END 2026-10-20T23:52:07Z rc=0`); - shard b, 91 files: 6296 passed, 3 skipped (`END 2026-10-20T23:51:58Z rc=0`). `git merge-tree --write-tree` of the head against origin/main and against each open PR that touches a file this changes. Each merge is clean, and no PR's added lines quote the changed words or name the changed functions: | Against | Head | Result | | --- | --- | --- | | origin/main | `5e539a878fc9` | clean, tree `95f9b53262fc` (the head's own tree) | | #1073 `l3-914-adopt-record-and-doctor` | `b58a4e2ccae0` | clean, `70f85d401ede` | | #1072 `l3-918-source-and-locale` | `2ffd82356c7b` | clean, `2e341d250ea1` | | #1071 `l3-916-adopt-test-strength` | `24273dd47e42` | clean, `0d183517f958` | | #1070 `fix/979-named-link-one-finding` | `20d2d4ba67f6` | clean, `a5beb7be1408` | | #1031 `fix/910-check-throwaway-repos` | `74c17705edc2` | clean, `324855e1983d` | | #1081 `fix/1060-pin-lane-in-process` | `7d4f2d82df4b` | clean, `fc9fe407b03b` (it touches none of these files) | Main moved after the runs above, which were made on `5e539a87`: #1071 (`bccae280`), #1076 (`c13c3985`), #1081 (`06cbd478`) and #1072 (`1e7971cd`) have landed. #1071 and #1072 touch two of this change's files, `tests/test_adopt_pins.py` and `adopt-project.py`. The head merges clean with origin/main `1e7971cd` (tree `ffb8249e`, from `git merge-tree --write-tree`), and the landing gates the predicted squash tree over the main of the day. #1068 and #1064 have landed and are under this commit. `fix/904-kept-links` was not on origin when this was pushed; it is now #1091, open at `8f5fd0fd`, and merges with this head clean (tree `0153f3e7e3c9`, measured by rv1090). #1062 touches none of these files. - rv1090, lane 5's independent reviewer, who wrote none of this: READY at `d5389eb6` (issuecomment-6316009648), with no MUST. - Its SHOULD is a missing row: no row has an exponent of two or more digits, and the head quotes those names correctly. - Its two code NITs: the no-`origin` bump refusal for a tag the leg holds, and an `else` nothing reaches. With the SHOULD, they are filed as #1103, to land after the v1.2.0 tag. - Its body NITs are fixed above: 177 test files, one `Claim:` line, and #1091's state. Review: rv1090, lane 5's independent reviewer, not the writer (w912): READY at `d5389eb6` (#1090 issuecomment-6316009648) with no MUST; its SHOULD (a missing row for exponents of two or more digits, which the head quotes correctly) and its two code NITs are filed as #1103 for after the v1.2.0 tag, and its body NITs are fixed. CI (Brett Heap's ruling 27 and his fast-refresh ruling of 2026-10-15T22:48:35Z): H0 d5389eb passed tests, tests-git-bash and SonarCloud; the head 1ad7605 is a clean update-branch merge of main 7e00834, with tests-git-bash and SonarCloud green; and the local gate passed on its predicted squash tree e182fde over main 7e00834: the adopt_pins, bump_leg_dry_run_truth, neutral_pin_entry_one_spelling, pin_annotated_tag, pin_source_top_level, scaffold_pin_and_reuse, repo_hygiene, agents_md_codes, cli_reference sets, 613 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #912 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 21, 2026
…keeps refs, and asks a pin's file through the links the root keeps, so a link into `.git` or onto a pin's file is refused before any leg or adopted with the copy beside it (#904) (#1091) A symlink the plan keeps in the root, where it leads into the clone's own `.git` or through a kept link to a pin's file, is refused before any leg exists for a reason that is true, or adopted with the shape's copy beside it (#904, lines L1-J1, L1-J2, L1-K2 and L1-K9 of #457, with L1-K8 as the rider). #904's line numbers are at `5017830`. Each claim was measured again by name on main `6c861635`, and again on `5e539a87` after #1064 landed (#1071 and #1076 since then touch neither `adopt-project.py` nor `scripts/shape_materialize.py`). - **L1-J1 held.** `CLONE_GIT_TREES` still counted `.git/objects`, `.git/refs`, `.git/logs` and `.git/modules` whole. `CLAUDE.md -> .git/refs/remotes/origin/main`, `-> .git/logs/refs/heads/nope` and `-> .git/modules/nope`: `check` 0 (`plan ok`), `execute` 0, `adoption verified`, 2 leg repositories, and the work clone's `.git/<target>` holds the shape's `CLAUDE.md`. Changed: `-> .git/objects/zz/nothing` now ends `REFUSED committing the split. materialize-blocked: ... there is no directory there to write it in`, still after both legs, where `5017830` printed a bare `REFUSED committing the split.` - **L1-J2 held.** `CLAUDE.md -> .git/refs/../HEAD` and `-> .git/../AGENTS.md`: `check` 1, `plan-root-symlink` "it passes through `.git/refs` (`.git`), which is not a directory in the assembly root", 0 legs. - **L1-K2 held**, and the same is true of the shape's own pin. `contracts -> governance`, `governance/` kept, `--pin openGlass@<commit>`: a file `governance/openglass-pin.yaml` gives `check` 0, `execute` 0, `beside shape/contracts/openglass-pin.yaml`, `adoption verified`, then the first bootstrap exits 2 with `REFUSED yaml-unparsable`; a link from it to `README.md` gives `REFUSED neutral-pin-unreadable`. With no pin declared and a file `governance/shape-pin.yaml`: `check` 0, `execute` 1 with `FINDING adopt-shape-pin-unreadable` after both legs. - **L1-K9 held.** `shape/README.md -> ../README.md` kept: `check` 1 says "and `execute` would write the copy through it after both leg repositories were created and pushed" ("over it" for a file), and `execute` exits 2 before any leg. `place` asks `copy_in_the_way`, which stops at a link there, dangling or not, and writes nothing there. - **L1-K8 is real.** Measured with git 2.47.1 and `GIT_DEFAULT_REF_FORMAT=reftable`: `CLAUDE.md -> .git/reftable` and `-> .git/reftable/tables.list` are refused (`plan-root-symlink`), though the clone holds both; `-> .git/packed-refs` checks ok and `execute` writes the shape's `CLAUDE.md` into `.git/packed-refs`; `-> .git/logs/HEAD` checks ok and stops after both legs. The clone's ref format comes from `GIT_DEFAULT_REF_FORMAT` or `init.defaultRefFormat`, never from the source, and git 2.43 ignores both. What the clone's `.git` holds when the shape is written was listed from inside `execute` (the materializer wrapped), on git 2.43.0 and 2.47.1, files and reftable. Edge cases were measured too: a source whose HEAD is detached gets a guessed branch, and `core.logAllRefUpdates=false` (global or `GIT_CONFIG_*`) leaves no `.git/logs`. All in `adopt-project.py`; the tests in `tests/test_adopt_root_symlinks.py` and `tests/test_adopt_root_shape_paths.py`. - **Named, not counted whole (L1-J1).** `_CloneGit` replaces `CLONE_GIT`, `CLONE_GIT_FOLDED` and `CLONE_GIT_TREES`. It names what git makes there: `.git`, `HEAD`, `config`, `index`, `objects`, `objects/info`, `objects/pack`, `refs`, and `modules` with each leg's store at `modules/<mount path>`. On the files backend it adds `packed-refs`, `refs/heads`, `refs/tags` and the three loose refs `git clone` and `execute` write (the branch the clone checks out, `refs/remotes/origin/HEAD` and the split branch), with a log of each and `logs/HEAD` where git writes reflogs. On the reftable backend it adds `reftable`, `reftable/tables.list` and a `refs/heads` that is a file, and there is no `packed-refs` and no `logs` (L1-K8). - A name inside the object store, inside a leg's store, inside the reftable tables, or under `refs/heads` and `refs/remotes` when the source's HEAD is on no branch is neither there nor not there. `check` refuses a link to one, saying that it reads nothing there, so whether `place` writes the copy beside it or the shape's file into `.git` cannot be told before any leg exists. - Any other name in `.git` is nowhere. The finding says the shape would write its file through the link into `.git`, where no commit holds it, or would find no directory there and stop after both legs: whichever is true of its directory. - **How git keeps refs is asked of the machine (L1-K8).** `_clone_ref_store` asks a throwaway repository in the work directory whether it is on the reftable backend and whether it writes reflogs, as `_checks_out_symlinks` asks about `core.symlinks`. `_SymlinkProbe.ref_store` makes that probe the first time a walk is led into the clone's `.git`, and keeps the answer. `check` makes it once, and `execute` twice, as it asks `_checks_out_symlinks` twice: once for `check`'s findings and once for `_refuse_symlinks_checked_out_as_files`. Without a work directory, or where no repository can be made, git's defaults are taken. `_entry_findings` now makes its one probe before `_leg_findings`, so the pins' walks share it. - **`..` in `.git` (L1-J2).** For a link AT a path the shape writes, a `..` steps back out of a directory `_CloneGit` names, as the end of a target is found there. A link ABOVE one is still never followed into `.git` (D9); its finding now says so, for a `..` and for a target, where it said "not a directory in the assembly root" or "not in the source tree". - **A pin's file through the kept links (L1-K2).** `_kept_pin_findings` asks each pin's file, the declared pins' and the shape's own, where the root walk reaches it through the links the plan keeps above it (`_Walk.reached`). Where that walk is stopped, the walk's own `plan-root-symlink` still names the link (`PIN_THROUGH`), so one link is one finding. The finding names the link and its remedy: "at `contracts/openglass-pin.yaml` through the symlink `contracts` to `governance` ... send `contracts` to a leg or `drop` it, or rename `governance/openglass-pin.yaml` in the source and re-run `plan`". The code is still `plan-root-holds-pin`, and `_pin_findings` and `_leg_findings` take `source` and `probe` from `_entry_findings`. - **What the materializer does (L1-K9).** `plan-root-blocks-shape-copy` now says "the materializer writes no copy through it" (or "over it", "cannot write a file where a directory is", "cannot make a directory where a file is"), then ": it would stop there (`materialize-copy-blocked`), writing nothing there, after both leg repositories were created and pushed, so `execute` refuses this plan before either exists." The comment at "A SYMLINK OR A SUBMODULE" and the test's docstring and assertion say the same. - **Codes kept.** No refusal code changed. Only tests pin the changed words: the README, the handbook mirror, `docs/cli.md` and `AGENTS.md` name none of these sentences. The probes use #457's setup: a stub `gh` exiting 97, `GH_TOKEN=bogus`, an empty `GH_CONFIG_DIR`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`, local remotes, and every null `leg:` answered `root`. They ran on git 2.43.0 unless stated. | Case | main `5e539a87` | this branch | |---|---|---| | `CLAUDE.md -> .git/refs/remotes/origin/main` | check 0, execute 0, verified, 2 legs, the shape's file in that `.git` file | check 1 `plan-root-symlink`, execute 2, 0 legs | | `-> .git/logs/refs/heads/nope`, `-> .git/modules/nope` | the same as above | check 1, execute 2, 0 legs | | `-> .git/objects/zz/nothing` | check 0, execute 2 after 2 legs | check 1 (object store not read), execute 2, 0 legs | | `-> .git/refs/../HEAD`, `-> .git/../AGENTS.md` | check 1 "not a directory in the assembly root", 0 legs | check 0, execute 0, `beside shape/CLAUDE.md`, verified | | `scripts -> .git/refs/..` (above) | check 1, 0 legs | check 1, 0 legs, saying a link above is never followed into `.git` | | K2: `governance/openglass-pin.yaml` a file | check 0, execute 0, bootstrap `yaml-unparsable` | check 1 `plan-root-holds-pin`, execute 2, 0 legs | | K2: it links to `README.md` | check 0, execute 0, bootstrap `neutral-pin-unreadable` | check 1 `plan-root-holds-pin`, execute 2, 0 legs | | K2: it links nowhere | check 1 `plan-root-symlink`, 0 legs | unchanged | | K2: nothing kept there (control) | check 0, execute 0, bootstrap 0 | unchanged | | shape's own pin, `governance/shape-pin.yaml` | check 0, execute 1 `adopt-shape-pin-unreadable` after 2 legs | check 1 `plan-root-holds-pin`, execute 2, 0 legs | | K9: `shape/README.md -> ../README.md`, and a file there | check 1 "`execute` would write the copy through (over) it" | check 1 "the materializer writes no copy through (over) it: it would stop there ..." | | git 2.47.1 reftable: `-> .git/reftable`, `-> .git/reftable/tables.list` | check 1, 0 legs | check 0, execute 0, `beside shape/CLAUDE.md`, verified | | git 2.47.1 reftable: `-> .git/packed-refs` | check 0, execute 0, the shape's file in `.git/packed-refs` | check 1, execute 2, 0 legs | | git 2.47.1 reftable: `-> .git/logs/HEAD` | check 0, execute 2 after 2 legs | check 1, execute 2, 0 legs | These names also adopt with the copy beside them, as on main: `.git/refs/heads/main`, `.git/refs/remotes/origin/HEAD`, `.git/refs/heads/adopt/three-repo-shape`, `.git/logs/refs/heads/main`, `.git/modules/code`, `.git/objects/info` and `.git/refs/tags`. **Rows that fail on main.** The two test files of this branch were run on a clone of main `5e539a87` (whose `adopt-project.py` and `scripts/shape_materialize.py` are those of main `c13c3985f`): 42 failed, 277 passed, 3 skipped. The 42 failures are every row this branch adds or changes, except those that hold on main too: - L1-K9: the three #262 rows, the case-aside row, `test_a_symlink_at_the_copy_itself_is_in_the_way` and `test_a_link_at_the_copy_is_one_finding_by_the_rule_that_sees_it`. - L1-J1, refused: the D9 row and the `.git/description` and `.git/hooks` rows (new words), four `J1-at-a-path-to-no-*` rows, `at-a-path-to-no-directory-in-dot-git`, `J1-at-a-path-into-the-object-store` and `at-a-path-into-a-legs-store`. - L1-J2: three refused `J2-*` rows, two accepted `J2-*` rows, and the end-to-end `J2-back-out-of-refs-and-origins-head`. - L1-K2: three `HELD_THROUGH` rows and the shape's own pin. - The ref store: three no-probe rows, the probe's answer, no work directory, eight `ON_REFTABLE` rows, no reflogs, a detached source HEAD, and the probe made once. The rows that pass on main too are kept as guards: - the ten `GIT_NAMED` accepted rows and the end-to-end `the-cloned-branch-and-the-split-branchs-log`, names that were counted whole and are now named; - the no-pin-file control; - `test_the_materializer_stops_at_a_link_at_the_copy`, which is L1-K9's evidence that the materializer stops there. The three rows that need git 2.45 or later were skipped there (git 2.43). **Mutants.** Each mutant was applied alone to a copy of this head, and the rows that hold it were run on git 2.43. All 21 were killed, each by an `AssertionError`, with failed and selected counts as shown. None was equivalent. | Mutant | Failed / selected | |---|---| | M1 an unread name counts as there | 2/2 | | M2 the cloned branch is not named | 2/2 | | M3 the split branch is not named | 2/2 | | M4 reflogs always | 1/1 | | M5 reftable never | 6/8 | | M6 a `..` above is followed into `.git` | 1/1 | | M6b no `..` out of a `.git` directory | 4/6 | | M7 a link above is taken as one at | 1/2 | | M8 a pin's file is not asked through links | 4/7 | | M9 asked through a stopped walk too | 4/4 | | M10 K9's old sentence | 2/47 | | M11 the probe says reflogs always | 1/1 | | M12 "written into `.git`" and "no directory" swapped | 5/6 | | M13 the cloned branch is the branch read | 1/1 | | M14 the clone's `.git` asked eagerly | 3/3 | | M15 the ref probe's answer not kept | 1/1 | | M16 no work directory gives no defaults | 1/1 | | M17 the through-link remedy is the entry's | 4/7 | | M18 the pins are asked without the source | 4/7 | | M19 `reached` is taken from any part | 1/7 | | M20 the `.git` reasons are gone | 9/9 | **Runs** (`run9.sh`, one shared stub `gh`, `EMAIL`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`): - git 2.43.0, both own test files: 319 passed, 3 skipped (the reftable rows). - git 2.47.1 first on PATH, both own test files: 322 passed. - git 2.43.0 gate: every test file that runs `adopt-project.py` (`grep -l` in `tests/`), with `test_shape_doctor.py`, `test_scaffold_leg_path_collisions.py`, `test_repo_hygiene.py`, `test_agents_md_codes.py` and `test_cli_reference.py`. That is 122 files in two shards of 61: shard A, 4075 passed, 10 skipped (`END 2026-10-20T23:41:03Z rc=0`); shard B, 4713 passed, 9 skipped (`END 2026-10-20T23:53:03Z rc=0`). `git merge-tree --write-tree` of this head against: - origin/main `c13c3985f`: clean. Main moved after the runs above, which were made on `c13c3985`: #1081 (`06cbd478`) and #1072 (`1e7971cd`) have landed, and #1072 touches `adopt-project.py`. Against origin/main `1e7971cd` the head is clean too, tree `cf4e2e68`. - #1073 (`l3-914-adopt-record-and-doctor`, `b58a4e2cc`): clean. #1072 (`l3-918-source-and-locale`, `2ffd82356`) was clean too, and has landed since as `1e7971cd` (above). - #1031 (`fix/910-check-throwaway-repos`, `74c17705e`): conflicts in `adopt-project.py`, 3 hunks. Both moved the one `_SymlinkProbe` in `_entry_findings`, and both added attributes to `_SymlinkProbe.__init__`. To resolve, make the probe before `_leg_findings` as this branch does, keep #1031's `unasked`, `linked` and `asked` lines, and keep both sets of attributes. - #1070 (`fix/979-named-link-one-finding`, `20d2d4ba6`): conflicts in `adopt-project.py`, 7 hunks. Both added parameters to `_kept_pin_findings` and `_pin_findings` and changed their docstrings, the `_leg_findings` docstring and the "A SYMLINK OR A SUBMODULE" comment. To resolve, take both parameters (`named_links`, then `source` and `probe`) and both texts, and in that comment keep this branch's sentence on what `place` does at the copy, with #979's clause after it. - #1081 and the other open pull requests touch none of these files; lane 5's #1090 (`fix/912-pin-questions`, `d5389eb6`, for #912) also changes `adopt-project.py`, and the head merges with it clean, tree `0153f3e7`. Main moved to `2a119f28` while this was in review. Two of the pull requests that landed change `adopt-project.py`: #1031 (#910, the throwaway repositories `check` asks) and #1070 (#979, a named link at a copy or a pin is one finding). The branch was merged with main, not rebased, as `1cc9180fd` (parents `8f5fd0fd3` and `2a119f281`). Ten hunks of `adopt-project.py` conflicted, seven with #1070 and three with #1031. Each was resolved by reading both sides: - **#1070.** - `_kept_pin_findings` and `_pin_findings` take both sets of parameters: `named_links` first, as main passes it, then `source` and `probe`, which the calls pass by keyword. - #979's `named_links` check stands in this branch's body as it is. A link `named_links` holds at the pin's file is left out. A walk that meets one through a link above has stopped, so the pin's file is asked at its literal path, where nothing is found, and the walk's own finding is left out too (`walk.empty`). - Both docstrings are kept, #979's paragraph first. `_leg_findings` passes `named_links, source=source, probe=probe`. - The "A SYMLINK OR A SUBMODULE" comment keeps this branch's sentence, that `place` stops at a link AT the copy and writes nothing through it. Main's "and as a write THROUGH it" is dropped, since it is not true. #979's clause follows. - **#1031.** - In `_entry_findings`, #1031's `_paths_git_refuses` question comes first. The one `_SymlinkProbe` is then made before `_leg_findings`, because the walks of the pins' files ask it. #1031's `linked`, `asked` and `unasked_notes` lines and its `probe.notes()` are kept. - `_SymlinkProbe` keeps #1031's `unasked` beside this branch's `_refs`. `ref_store` now does what #1031 has `symlinks` do: where `git init` fails otherwise than with an `OSError`, it takes git's defaults (the files backend, with reflogs) and keeps git's words in `refs_unasked`. Before the merge, that failure raised out of `check` as "a git or gh command failed". - `notes()` gives each NOTE. The symlink NOTE keeps #1031's words, and the ref NOTE is new. Both take git's words from one `_init_refused`. - Nothing else #1031 or #1070 changed is called by this branch's code. #1070's other hunks are the docstrings of `_links_at_a_copy` and `_links_at_a_pin`. #1031 leaves `_PlannedRoot`, `_checks_out_symlinks` and `_refuse_symlinks_checked_out_as_files` as they were. New rows in `tests/test_adopt_root_symlinks.py` cover the ref probe's failed `git init`, raised as a `CommandFailed` and as a `Refusal`. Further rows check that an `OSError` gives no NOTE, and that `check` under `GIT_DEFAULT_HASH=bogus` says where git would not make the ref probe. **Runs on `1cc9180fd`** (`run9.sh`, as before): - git 2.43.0, both own test files: 323 passed, 3 skipped (the reftable rows). - git 2.47.1 first on PATH, both own test files: 326 passed. - The two test files on main `2a119f28`'s code: 46 failed, 277 passed, 3 skipped. These are the 42 of before plus the four new ref-probe rows. - Mutants, re-run where the resolution touched them, each killed: - M8, M9, M15, M16, M17, M18 and M22 by an `AssertionError`. - New: M21, the ref probe's failed `git init` raising as before. It fails two rows because the `CommandFailed` or `Refusal` it lets out escapes, and one row by an `AssertionError`. - M23 removes #979's `named_links` skip at a pin's file. Only #979's own `test_a_named_link_at_a_copy_or_a_pin_is_one_finding` holds it, and that test fails by a `ValueError`, not an `AssertionError`: it unpacks exactly one finding (`tests/test_adopt_symlink_target_bytes.py:667` and `:818`), and the mutant gives two. - Gate, git 2.43.0: the 125 test files the merged tree has for `adopt-project.py`, with `test_shape_doctor.py`, `test_scaffold_leg_path_collisions.py` and the trio, in two shards. Shard B (62 files): 4507 passed, 15 skipped, `END 2026-10-21T13:14:42Z rc=0`. Shard A (63 files) was running at the checkpoint: at 87% at 13:43Z, with no failure so far. Commit `160de1186`, on top of the merge, answers rv1091's review of `8f5fd0fd`. rv1091 re-checked it: SHOULD 1, SHOULD 2 and NITs 1-3 are fixed, and the two test files gave 326 passed, 3 skipped. - **SHOULD 1: "writing nothing" was false.** `place` writes the shape's files in order and stops only at the blocked copy, so every copy before it is written. rv1091 measured 0, 5, 9 and 12 files written before the stop, at `shape/README.md`, `shape/CLAUDE.md`, `shape/Makefile` and `shape/.github/workflows/validate.yml`. `plan-root-blocks-shape-copy` now says "it would stop there (`materialize-copy-blocked`), writing nothing there, after both leg repositories were created and pushed". That matches the materializer's own "and nothing was written there". The comment above the sentence says the same, and `STOPS` in `tests/test_adopt_root_shape_paths.py` pins the new words. - **SHOULD 2: SonarCloud's two `python:S5778`.** Both are in rows this PR adds, and each made a second call inside `pytest.raises`. `template_values()` (the materializer's link-at-the-copy row) and `loaded.open_source(None, work)` (the row that checks the ref probe is made once) are now made before the block. - **NIT 1: `python:S3776` on `_kept_pin_findings`.** Sonar's analysis of the merged function gives 30. The finding for one pin's file on one disk is now `_kept_pin_finding`, and the through-link words and their fix are `_through_the_kept_link`. The nested conditional in `_shape_pin_held`'s argument is now a statement. Sonar's analysis of the new functions (`analyze_code_snippet`, project `opensoft_openRepoShape`) finds no issue in them. - Each return value stands for what the loop did before. None asks the next disk, `[]` is #979's named link, and a list of one line is the finding. - **NIT 2: what a guessed refs directory holds.** The case is a source whose HEAD is on no branch. The text "where `git clone` writes the branch it checks out" was given for `.git/refs/remotes`, `.git/logs/refs/heads` and `.git/logs/refs/remotes` as well as `.git/refs/heads`. `_guessed_refs` now says what `git clone` writes in each one: - in `refs/heads`, the branch it checks out; - in `refs/remotes`, `origin/HEAD` for that branch; - in the two `logs/` directories, the reflog of either. This was measured on git 2.43.0 and 2.47.1, for a source detached at a branch's tip and for one detached off any tip. In the first case git checks out `main` and writes `refs/remotes/origin/HEAD` (`ref: refs/remotes/origin/main`) and the reflogs of both. In the second it writes neither, and `refs/heads` holds only the split branch. Each link is still refused, as "cannot be told". The detached-HEAD row is now four rows, one per directory. - **NIT 3: the ref probe is made "once per command".** That was false for `execute`. Counted in process with `CLAUDE.md -> .git/HEAD`, `check` makes the probe once, with or without a kept `.gitattributes`, and `execute` makes it twice. The first is for `check`'s findings, which `_refuse_what_check_finds` asks. The second is for the walks of `_refuse_symlinks_checked_out_as_files`, which make their own `_SymlinkProbe`, as they ask `_checks_out_symlinks` again on main. The code is unchanged. The sentence under "What changed" now says so. - **NIT 4: two mutants of rv1091's that survived the first round.** - R8 guesses only `refs/heads` for a detached source, not `refs/remotes`. Round 2's detached-HEAD rows for `.git/refs/remotes/origin/HEAD` and its reflog kill it (M28 below). - R6 has the fix rename the kept file rather than the path the walk reaches. It still survives here, because no row keeps a directory at the reached pin file. That is a gap in the tests, not in the code. The row is a follow-up for after the v1.2.0 tag, written and run but not in this PR: `contracts -> governance`, with `governance/openglass-pin.yaml/notes.md` kept, gives "inside `contracts/openglass-pin.yaml` through the symlink ... rename `governance/openglass-pin.yaml`", and main checks it with exit 0. **Words.** A grep of `tests/`, `README.md`, `docs/` (outside the release notes), `AGENTS.md` and `templates/` finds the changed words only in the two test files. No refusal code changed. **Rows that fail on main.** The detached-HEAD rows for `.git/refs/remotes/origin/HEAD`, `.git/logs/refs/heads/main` and `.git/logs/refs/remotes/origin/HEAD` are new. A probe on main `2a119f28` gives `check` exit 0 for all four links, so main refuses none of them, and every row expects a refusal. The pytest run of these rows on main was not made before the checkpoint. On the merge `1cc9180fd` all four are refused, but the three new ones say "the branch it checks out". **Mutants** on `160de1186` were not run before the checkpoint. Each is written, and its anchor occurs once in `160de1186`'s `adopt-project.py`: - M17 and M23, re-anchored on the new helpers: the through-link fix becomes the kept entry's, and `_kept_pin_finding`'s `return []` for #979's named link is dropped; - M24: every guessed directory says what `refs/heads` holds; - M25: no "the reflog of"; - M26: the K9 sentence's old "writing nothing,"; - M28: rv1091's R8; - M8, re-run. rv1091 ran R8 at `160de118`, and the NIT 2 rows kill it (2 of 4 failed). **Runs on `160de1186`** (`run9.sh`, as before): - git 2.43.0, both own test files: rv1091 ran them at `160de118`, 326 passed, 3 skipped (the reftable rows). - Mine ran at `3abf3b1f5`: 327 passed, 3 skipped, `END 2026-10-21T13:32:51Z rc=0`. - `3abf3b1f5` is `160de118` plus the R6 row alone, the follow-up kept off this branch. Its `adopt-project.py` and `tests/test_adopt_root_shape_paths.py` are `160de118`'s, and its `tests/test_adopt_root_symlinks.py` adds that one test function. - git 2.43.0, `test_shape_doctor.py`, `test_scaffold_leg_path_collisions.py`, `test_repo_hygiene.py`, `test_agents_md_codes.py` and `test_cli_reference.py`: running at the checkpoint, at 19% at 13:43Z, with no failure so far. - Not started before the checkpoint: - the seven other test files that pin `plan-root-holds-pin` or the K9 sentence (`test_adopt_pins.py`, `test_adopt_shape_pin_and_work_dir.py`, `test_adopt_symlink_target_bytes.py`, `test_adopt_ignored_shape_files.py`, `test_adopt_root_manifest.py`, `test_adopt_nested_attributes.py` and `test_adopt_reencoded_files.py`), though all seven are in the gate on `1cc9180fd`; - the two own files on git 2.47.1. - CI runs the full suite on the push. **Merge-trees** of `160de1186`, by `git merge-tree --write-tree`: - origin/main `7e00834cf`: clean, tree `0b8a5bc9`. #1087 (`16f9a0e81`) and `7e00834cf` landed after the merge and change none of this branch's files. #1087 changes `scripts/shape_materialize.py`, whose `place` and `copy_in_the_way` the K9 sentence describes, but only the fetch for a branch's answer. - #1090 (`1ad76055b`): clean, tree `108c3a8e`. - origin/main `6da757cbe`, re-fetched at about 13:10Z, after #1090 landed: clean, tree `283d7b52`. - #1090 changes `adopt-project.py` in the NOTE `check` prints for a pin's digest and in the docstring of `_neutral_product_pins`. - Neither is code this branch changes, and no row here pins those words. Lane: openreposhape-5 (openRepoShape-5) Review: rv1091, lane 5's independent reviewer, not the writer (w904): NOT READY at `8f5fd0fd` (#1091 issuecomment-6316443939) for two SHOULDs, with the merge `1cc9180f`'s resolution READY; the fix round took both SHOULDs and three NITs, and the re-check is READY at `160de118` (#1091 issuecomment-6317666157); its one open gap, R6's row, is filed as #1116. CI (Brett Heap's ruling 27 and his fast-refresh ruling of 2026-10-15T22:48:35Z): H0 160de11 passed tests, tests-git-bash and SonarCloud; the head 551452b is a clean update-branch merge of main 823624d, with tests-git-bash and SonarCloud green; and the local gate passed on its predicted squash tree c1dcef6 over main 823624d: the adopt_root_shape_paths, adopt_root_symlinks, repo_hygiene, agents_md_codes, cli_reference sets, 496 passed, 3 skipped. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #904 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lane 3's #918 (v1.2.0): #457's lines L1-105, L1-86 and L1-70, at
2ffd8235(the review round, one commit ona1b18fe3), cut from00f6d7f7. Each state was reproduced on00f6d7f7first, under a stubghthat exits 97,GH_TOKEN=bogus, an emptyGH_CONFIG_DIRand local remotes, with Python 3.12.3 as a non-root user.What changed, and why
L1-105: a
--source, or a recordedlocal_path, that this user cannot enter--source <dir>with<dir>itself at mode 000:plan exit 1,PermissionError: [Errno 13] Permission denied: '<run>/a/Thing'. The traceback came fromgit rev-parsein_top_level, becausesubprocessraised the error ofcwd=.local_pathis at mode 000:checkgave the same traceback. Recorded ascloned: true,checkgaveREFUSED plan-source-gone: ... is a cloneplanmade that is no longer whole (git finds no repository there). With asource.repository, it printed a NOTE and askedgh repo clone.REFUSED source-unreadable: --source '<dir>': cannot be read (Permission denied), so whether a repository is there cannot be told, or the plan'ssource.local_pathwith the existing EveryPath.is_file()/is_dir()/exists()guard in the shipped tools answers False to any OSError on Python 3.14 (3.12 and 3.13 raise PermissionError), so a directory this user cannot search reads as ABSENT: validate-pins.py skips its workflow@<sha>check, update-shape.py sayscopy-missingandupdate-pin-missing("adopt the project") for files that are there, the doctor says DRIFTED (5 copy-missing), and bump-leg.py's remaining guards, and every other tool's, skip or misreport instead of refusing by name #430 words. Exit 2, with the existingchmod u+rxcure, before anything is cloned or written, andghis never asked.adopt-project.py:1765_refused_at: theOSErrornames the directory, which is howsubprocessreports acwd=it cannot enter. A git that cannot be started is named by the program, so it is raised as before (git_outleaves that to the caller).:2075_top_leveltakesrefused, the caller'ssource-unreadable, and raises it at:2119.:2063passes the--sourceone._recorded_sourcedefines the recorded one at:6526and passes it at:6541.:2502_not_a_whole_cloneraises that error for the caller instead of calling it "git finds no repository there"._recorded_source(:6552) names it.source-unreadablealready says "a path this user cannot reach" in--source's help anddocs/cli.md. A source under a directory at mode 000 was refused by EveryPath.is_file()/is_dir()/exists()guard in the shipped tools answers False to any OSError on Python 3.14 (3.12 and 3.13 raise PermissionError), so a directory this user cannot search reads as ABSENT: validate-pins.py skips its workflow@<sha>check, update-shape.py sayscopy-missingandupdate-pin-missing("adopt the project") for files that are there, the doctor says DRIFTED (5 copy-missing), and bump-leg.py's remaining guards, and every other tool's, skip or misreport instead of refusing by name #430's slice H already. It is unchanged.L1-86: a plan written in UTF-8 mode, checked under
LC_ALL=C PYTHONUTF8=0check exit 2,REFUSED plan-source-gone: the plan'ssource.local_path,/e/Thing\xe9, names nothing that exists .... In UTF-8 mode the same plan wasplan ok.check exit 0,plan ok, andghis never asked.:1775_recorded_spelling: a recorded path that this locale's file-name encoding cannot spell is asked as the plan's UTF-8 bytes (surrogateescape), asos.fsdecodespells them here. Those bytes are whatplanread under a UTF-8 locale, under UTF-8 mode and under the C locale._recorded_source(:6522) and_keep_the_clone_at_the_record(:6443) ask that spelling. Each refusal still names the path as the plan records it.plan-source-gone(:6544) then saysnames nothing that exists as UTF-8 spells it (this locale's file names, ascii, cannot spell it), and the cloned NOTE saysno longer existsthe same way (:6557).L1-70: a member on a branch that is not UTF-8
_member_headreadgit symbolic-refstrictly, soPinRollbackraisedUnicodeDecodeError: 'utf-8' codec can't decode byte 0xe9 in position 14for a member oncaf<0xE9>.bumpandremoveended in a traceback, exit 1, before any write.scripts/family.py:7695reads the ref as bytes, as_holder_branchdoes, takes off exactly one newline andrefs/heads/, and decodes withsurrogateescape(:7700), as the Direction and adopt-project.py_default_branchreads the source's branch name throughgit_out, which decodes strictly, so a source whose HEAD (ororigin/HEAD) names a branch that is not UTF-8 endsplan,checkandexecutein a UnicodeDecodeError traceback, exit 1, fromSource.open, with no plan written and no refusal naming the branch #425 say.pre-commithook refuses, it exits 2 with its own refusal, and the rollback puts the member back oncaf<0xE9>at its commit, with the holder as it was. The name reaches git as the byte it is.strip()no longer takes a trailing U+00A0 off a branch name. It used to name another branch (feat), as update-shape.py, family.py and bump-leg.py: the branch HEAD is on is read with.strip(), so a branch ending in U+00A0, U+2028 or U+0085 is read as its neighbour, and bump-leg.py (and update-shape.py) decode it witherrors="replace", so the push line names a branch that is not there #765 found for the holder.Review round
RV1072 reviewed
a1b18fe3: READY, one SHOULD and three NITs (comment 6301724552). This round is one commit on top.adopt-project.py:6443(_keep_the_clone_at_the_record) had no test.test_the_clone_at_the_record_is_kept_under_the_c_localeruns the method in a child underLC_ALL=C PYTHONUTF8=0, with a plan recording a non-ASCII path and a real directory there. At the head the clone claim at the record is taken off (0 left); with RV1072's mutant M8 it stays (1 left). A clone made elsewhere stays either way.scripts/family.py:8135(_head_said) and:8144(_work_tree_said) print the branch through_shown(self.branch)(:4046), so a branch that is not UTF-8 reaches the words as U+FFFD and not as\udce9.test_a_member_on_a_branch_that_is_not_utf8_is_put_back_on_itholds it, and keeps its" on caf"assert.adopt-project.py:16565anddocs/cli.md:463-464saysource-unreadableis a path this user cannot reach "(under a directory it may not search, or one it may not enter)".docs/cli.mdis regenerated withpython3 scripts/render-cli-reference.py.check's throwaway repositories are made in the work directory with the source's object format and no hook of this machine's; a path git refuses isplan-path-git-refuses, a repository git cannot make thereadopt-git-unasked(#910) #1031, scripts/shape_materialize.py, family.py and adopt-project.py'scheck: a manifest the template's own reader makes no mapping of is told it is a defect in the copy of the standard, naming the template file, andmanifest_invalid's docstring is true for the holder (#1059) #1064, bump-leg.py: the leg's fetch leaves out every refspec of the leg's own that can bring a tag underorigin/, and one onto the branches' names from another namespace, by the rulefamily.py bumpasks, now one function both tools import, so a branch and a tag of one name no longer fail it and a tag no longer answers for a branch (#1037) #1068, adopt-project.py: a bad link thatplan-empty-symlinkorplan-bad-symlink-targetnames is no longer named again byplan-root-blocks-shape-copyorplan-root-holds-pin, so it gets one finding, and the #908 comments say Linux's bound (#979) #1070, tests: five adopt tests fail when the thing they guard is removed: bytes on stdin, a stub gh that keeps its #! line, a cleared GIT_ALLOW_PROTOCOL, each guard of two pairs reached alone, and three name shapes (#916) #1071, adopt-project.py and shape-doctor.py: a.gitmoduleswith no section asks nothing and says how to remove it, a submodule beside one is named, so is a file'sanswered_paths:row with a/, and an identical drop counts asdrop(#914) #1073; adopt-project.py: a--work-dirthat is, or runs through, a symlink round a loop is refused in words that name the link and the loop, not "(File exists)", and a symlink to a file is named as one (#978) #1065 has merged and is dropped), this section is added, and the follow-ups are named.Follow-ups: #1078 (a one-byte locale such as Latin-1) and #1079 (the by-hand checkout line).
Out of scope
plan-source-gone; ask its UTF-8 bytes too when the first spelling names nothing #1078.git checkoutline that_head_by_handprints when a rollback's own checkout fails. It spells a branch that is not UTF-8 with the stream's escape, which typed names no branch. It is printed only after the rollback has already failed, and quoting that keeps the exact bytes ($'caf\xe9') is more thanshell_quoteddoes. This is follow-up family.py: a rollback's by-hand checkout line spells a branch that is not UTF-8 as Python's\udce9, which typed names no branch #1079. The round's N1 changes only the "back on" words, not this line.Tests
Each file ran alone under
timeout 2400, with the stubghfirst on PATH,GH_TOKEN=bogus, an emptyGH_CONFIG_DIRandEMAIL=tests@openreposhape.invalid. The command was/usr/bin/python3 -m pytest -q -p no:cacheprovider --basetemp=<scratch>/bt-<name> -o tmp_path_retention_policy=failed tests/<file>. The first block ran at2ffd8235, the review round; the second ata1b18fe3, and the round touched nothing those files read butfamily.py's two sentences and one help string.At
2ffd8235:tests/test_adopt_unenterable_source_and_locale.py13 passed(S1's test is the new one; 12 ata1b18fe3)tests/test_family_member_branch_not_utf8.py4 passed(N1's two asserts are in the first)tests/test_adopt_source_clone_record.py100 passedtests/test_adopt_c_locale_bytes.py17 passedtests/test_family_bump_remove_rollback.py31 passedtests/test_cli_reference.py23 passed(N2's regenerateddocs/cli.md)tests/test_repo_hygiene.py100 passedtests/test_agents_md_codes.py47 passedtests/test_no_auto_maintenance.py60 passedtests/test_scaffold_leg_path_collisions.py104 passedtests/test_shape_doctor.py445 passed, 3 skipped in 733.57spyflakes on
adopt-project.py,scripts/family.pyand the two test files: no new warning (0 and 0 in the scripts; 7 and 6 in the tests, as ata1b18fe3).At
a1b18fe3, not rerun:tests/test_adopt_unsearchable_source.py27 passedtests/test_adopt_project_is_the_source.py23 passedtests/test_adopt_template_values.py78 passedtests/test_adopt_temp_work_roots.py9 passedtests/test_family_py_unreadable.py75 passedtests/test_family_tracking_branch.py28 passedtests/test_update_add_codes_documented.py6 passedMutants
Each mutant was applied to the committed file and run against the new test files. Every one was KILLED. Each file was then restored and checked with
cmpandgit diff --quiet._top_levelre-raises thecwd=error (norefused)test_a_source_this_user_cannot_enter_is_refused_by_name,test_a_source_git_cannot_enter_is_refused_on_every_platform,test_a_recorded_source_this_user_cannot_enter_is_refused_by_name[check-False]_refused_atalways Truetest_a_git_that_cannot_be_started_is_not_read_as_the_source,test_a_clone_whose_git_cannot_be_started_is_still_no_repository_not_a_whole_cloneswallows thecwd=error again...cannot_enter_is_refused_by_name[check-True],[execute-True],test_a_recorded_clone_git_cannot_enter_is_not_cloned_again_recorded_spellingalways asks as writtentest_a_plan_written_in_utf8_mode_is_read_under_the_c_locale[given],[cloned],test_a_plan_path_this_locale_cannot_spell_and_utf8_does_not_findsaidalways emptytest_a_plan_path_this_locale_cannot_spell_and_utf8_does_not_find_member_headdecodes strictly againtest_a_member_on_a_branch_that_is_not_utf8_is_put_back_on_it[bump],[remove],test_the_member_head_is_the_branch_git_wrote[not-utf8]_member_headstrips the decoded name againtest_the_member_head_is_the_branch_git_wrote[trailing-no-break-space]_keep_the_clone_at_the_recordasksstr(record)again in place of_recorded_spelling(str(record))[0]test_the_clone_at_the_record_is_kept_under_the_c_locale(the clone at the record stays: 1 left)_head_saidprintsself.branchagaintest_a_member_on_a_branch_that_is_not_utf8_is_put_back_on_it[bump]_work_tree_saidprintsself.branchagaintest_a_member_on_a_branch_that_is_not_utf8_is_put_back_on_it[remove][bump]and[remove]Merges
Each was checked with
git merge-tree --write-treeof2ffd8235against the head named. Every one is clean.origin/main6c861635corigin/mainnow,4a6b9afde(one commit past that,validate-pins.py)74c17705(adopt-project.py)166ae7bd(adopt-project.py,scripts/family.py)5312a7d3(scripts/family.py)20d2d4ba(adopt-project.py)24273dd4b58a4e2c(lane 3's W914 and F1073, #914)#1065 has merged into main and is dropped from the table.
Closes #918
Lane: openreposhape-3 (openRepoShape-3)
🤖 Generated with Claude Code