[brettheap]

Lane: openreposhape-5 (openRepoShape-5)
Claim: #1019 (comment)

Goal

No test held that a tag at a DESCENDANT of the refused commit counts as a tag that reaches it, so --points-at in place of --contains survived in bump-leg.py and family.py (mutant M9 of #988's review, filed as #1019). This adds the rows the issue asks for to the two reachability test files, and no production code changes. Opened as a draft with no milestone: Brett Heap's ruling of 2026-10-21T10:32:04Z ("leave the follow-ups out of v1.2.0") held it until the v1.2.0 tag, and it is now on the v1.2.1 milestone.

What still held on main

Measured on main 2a119f28 before any change, and checked again on 16f9a0e81 and 7e00834c (the tag questions did not change, only their line numbers):

• scripts/bump-leg.py _remote_tag_reaches and scripts/family.py _origin_tag_reaches list the tags with git for-each-ref --contains <commit> --format=%(objectname) refs/tags/. No other copy of either exists (the --contains in on_a_remote_branch and _on_a_remote_branch asks about branches and is not this question).
• The mutant (--contains -> --points-at on that one line in each script) SURVIVES every row on main: test_bump_leg_reachability_words.py 34 passed, test_family_bump_reachability_words.py 20 passed, 54 rows, as the issue says.
• The production code is right: the new rows pass on unmutated main. So they do not "fail on main"; they fail on the mutant, which is the issue's own acceptance ("With --points-at, that row must fail"). No defect was found.

What changed (two test files, 197 insertions, 4 deletions, after round 2)

tests/test_bump_leg_reachability_words.py:

• made_in_the_leg(project, name, on="HEAD") takes an optional on, the commit the new commit is made on top of. Every existing call is unchanged.
• test_a_tag_at_a_descendant_of_the_commit_reaches_it: a commit made and a child above on top of it, on no branch of the leg's remote. The leg and the remote each tag above (v1-w1019), made apart, in three kinds: both annotated (the reviewer's case J), leg lightweight and remote annotated, and the reverse. Both runs (dry run and real) refuse made bump-leg-commit-local-only in the TAG words, through origin and through --local-remote-dir (3 kinds x 2 routes = 6 rows), with nothing moved and the leg's own tag as it was. The premises say the tag names the child, that no tag is AT made (for-each-ref --points-at), and, through shape_materialize.py: the fetch for a branch's answer leaves out every refspec of the repository's own onto the branches' names, whatever its source, and every one that puts a branch under a name not its own, so family.py bump and bump-leg.py no longer fail where the remote has x and release/x and the repository's own git fetch origin works (#1066) #1087's only_a_tag_reaches, that a tag of the remote reaches it, no branch does and no remote-tracking ref of the leg does.
• test_a_tag_at_an_ancestor_of_the_commit_alone_keeps_the_plain_words: the control (x 2 routes). The commit named is the child, and the leg and the remote tag only its parent. The plain words stay, "a pin the rest of the world cannot fetch" included.

tests/test_family_bump_reachability_words.py:

• made_on(holder, env, parent, name): a commit never pushed, made in the mount on top of parent, through commit_in_mount (which checks parent out first), so the holder stays clean.
• test_a_tag_at_a_descendant_of_the_commit_reaches_it: the same three kinds (3 rows), both bump --dry-run and the real bump refuse member-to-local-only in the tag words, with nothing moved and the mount's own tag as it was.
• test_a_tag_at_an_ancestor_of_the_commit_alone_keeps_the_plain_words: the control (1 row).

No assert joins conditions with and or or; each premise is its own assert. No README, docs, AGENTS.md or handbook text names these tests or their row counts (grep), so none changes.

The mutants (rebased tree, 7e00834c's line numbers: bump-leg.py 1205, family.py 8869; each mutant restored, sha256 checked equal to HEAD)

Mutant	Rows before (main's)	With these rows
--points-at in bump-leg.py	survives: 34 of 34 pass	killed: 6 failed, 36 passed (all six descendant rows; the two controls pass, as they should)
--points-at in family.py	survives: 20 of 20 pass	killed: 3 failed, 21 passed (all three descendant rows)
--merged in bump-leg.py (extra: a check read the other way round)	survives: 34 of 34 pass	killed: 8 failed (6 descendant rows and both controls)
--merged in family.py (extra)	survives: 20 of 20 pass	killed: 4 failed (3 descendant rows and the control)

The failure is the one the issue names: the plain words ("is reachable from no branch of ...") where the tag words ("and a tag of ... reaches it, but no branch ... does") are expected. Logs: r-mut-points-at-bump.log, r-mut-points-at-family.log, r-mut-merged-bump.log, r-mut-merged-family.log (and mut-main-*.log for the 34 and 20 on 2a119f28).

Runs (through run9.sh, EMAIL=service@opensoft.dev, GIT_SSH_COMMAND=false, GIT_CONFIG_GLOBAL=/dev/null, gh stubbed, at most two at once, never the full suite)

On the pushed head 01fcb259:

• git 2.43.0 (/usr/bin/git): the two test files, 66 passed (42 + 24; 34 + 20 before).
• git 2.43.0: the trio tests/test_repo_hygiene.py, tests/test_agents_md_codes.py, tests/test_cli_reference.py and tests/test_update_shape_kept_helper.py, 329 passed.

On 1201680f (the same two files on top of 16f9a0e8, before 7e00834c, whose three files no row of mine touches or runs):

• git 2.43.0: the trio alone, 170 passed; the two test files that import helpers from mine (test_bump_leg_fetch_refspecs.py, test_family_bump_fetch_refspecs.py), 102 passed; the two test files, 42 and 24 passed.
• git 2.47.1 ($Q/v115/w764/git247/bin/git first on PATH, git --version printed git version 2.47.1): the two test files, 66 passed.

No script changed, so no other test runs a changed script.

Merge-trees

• git merge-tree --write-tree HEAD origin/main against a re-fetched origin/main (7e00834c, which is also the merge base): exit 0, tree 3a852e87fcfda41766ece8c1771e47689c622ad6, equal to this head's tree. Against 16f9a0e8 before the last rebase: exit 0 too.
• Open PRs read with gh pr list --repo opensoft/openRepoShape --state open --json number,headRefName,isDraft,files: 8 (templates/assembly-root/project.yaml and templates/family-root/family.yaml: the comment above visibility: says it is the visibility the run asked for, and that a repository the run reuses keeps its own, where it said "this is all three repositories' visibility" (#913) #1102, scaffold-project.py: the --reuse-empty-repo help, its docs and each remedy that sends a person into that re-run say ssh, a credential helper or askpass can still make it wait, and how to keep it from waiting (#915) #1101, family.py: a failed remove's by-hand lines spell a leg mounted at a path that is not UTF-8 as a printf word of octal escapes ending in a slash, so git -C <member>/<leg> and submodule update -- <leg> typed in any POSIX shell name that leg (#1086) #1098, tests.yml: the full suite keeps its temporary files under runner.temp, not /tmp, so it runs on Ubuntu 26.04 and the tests job goes back to ubuntu-latest (#1096) #1097, adopt-project.py: check names what the clone's .git holds as git keeps refs, and asks a pin's file through the links the root keeps, so a link into .git or onto a pin's file is refused before any leg or adopted with the copy beside it (#904) #1091, shape_materialize.py, adopt-project.py and bump-leg.py: a tag a clone holds without its commit is one it cannot answer for, check says a commit it cannot ask was not asked, and a pinned product YAML 1.1 or 1.2 reads as no text is quoted (#912) #1090, the family root's bootstrap.py: credential_advice and ended_on say a member's failed clone ends git's update with 1 before any checkout but a leg's lets it go on, and killed_said says git's update was itself killed, not that it went on (#1085) #1088, the family root's siblings.py: with a token in use, the clone and the fetch that carry it run in bootstrap.py's untraced() environment, so make siblings and family.py siblings write the token to no trace the caller asks git for (#1055) #1075). None touches tests/test_bump_leg_reachability_words.py or tests/test_family_bump_reachability_words.py, so there is no merge-tree to run against any of them.

Round 2 (rv1107, NIT 2; NIT 1, the title, was the coordinator's)

• The NIT. The docstrings of the two descendant rows said "Every row before this one tagged the commit itself, so ... survived all 54 of them". 54 counts the two files together (34 + 20), several earlier rows tag nothing (the no-origin and prune rows), and a count goes stale with the next row.
• The fix, docstrings only. Each now says only what holds: "No row before this one tags a descendant of the commit: the tags in them are at the commit itself or below it, so --points-at in place of --contains, the mutant M9 of bump-leg.py and family.py: the tag check compares the commits tags point to, so a lightweight or another annotated tag at the same commit reaches it (#982) #988's review, survived every row of this file." No row, assert or helper changed. The 54 in "What still held on main" above is the two files together, as it says.
• One commit on top of 01fcb259, a fast-forward push, no rebase: head ee48b5fe9693ebda099d1c0aadaca7bdc16b91c1, read back with git ls-remote. Its tree is 615e571bb62fd1cf481e4152278b0e3628bab059.
• Runs (git 2.43.0, through run9.sh, EMAIL=service@opensoft.dev): tests/test_bump_leg_reachability_words.py 42 passed, tests/test_family_bump_reachability_words.py 24 passed. They ran on 7186f3cf, the same tree as the pushed head; only the commit message was shortened after.
• Merge-tree against a re-fetched origin/main (6da757cb, merge base 7e00834c): exit 0, tree 453566df33c886cf7fc2b1c39af02acbbff365dc. Main moved by nine files, none of mine; its scripts/bump-leg.py change (9 lines added) leaves _remote_tag_reaches and its --contains line alone (now line 1214).

Closes #1019

🤖 Generated with Claude Code

Summary by Sourcery

Strengthen reachability tests for bump-leg and family so descendant-tag handling is validated and incorrect points-at or reverse-reachability implementations are caught.

Enhancements:

• Expand bump-leg and family reachability coverage to verify that tags on descendant commits are reported as reaching the target, while tags on ancestors do not change the plain refusal wording.

Tests:

• Add parametrized reachability tests covering annotated and lightweight tags across local and remote repositories, including controls for ancestor tags, dry-run behavior, and preservation of repository state.

[sourcery-ai]

Reviewer's Guide

This test-only PR closes the reachability coverage gap in bump-leg and family by modeling tags on descendants and ancestors of a local-only commit, validating correct refusal wording and state preservation across execution paths, and killing the surviving --points-at mutation.

File-Level Changes

Change	Details	Files
Add descendant-tag reachability coverage to ensure tags on descendants of the refused commit are reported as reaching it.	Extend commit-fixture helpers to create commits on top of arbitrary parents. Exercise annotated and lightweight tag combinations through both bump-leg execution paths. Assert tag-based refusal wording, unchanged refs, and no repository movement. Verify premises exclude exact-point tags, branches, and remote-tracking refs.	tests/test_bump_leg_reachability_words.py tests/test_family_bump_reachability_words.py
Add ancestor-tag control cases to preserve the distinction between tags above and below the target commit.	Assert a tag on the parent does not reach a child commit absent from the remote. Preserve the existing plain reachability wording for both dry-run and real bump flows. Check offline state and repository contents remain unchanged.	tests/test_bump_leg_reachability_words.py tests/test_family_bump_reachability_words.py
Strengthen mutation coverage for the production reachability query without changing production code.	Ensure replacing --contains with --points-at fails all descendant-tag cases. Cover both bump-leg and family implementations and multiple tag object types. Retain compatibility checks for existing helper-importing and hygiene test suites.	tests/test_bump_leg_reachability_words.py tests/test_family_bump_reachability_words.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#1019	Add reachability-test rows in bump-leg.py’s two routes and family.py where tags point to a descendant of the pinned commit, and verify the tag-reaches wording (so replacing --contains with --points-at fails those rows).	✅
#1019	Add a control in each test area showing that a tag only at an ancestor does not reach the pinned commit and the plain wording remains.	✅

Possibly linked issues

• tests: no reachability row tags a descendant of the pinned commit, so --points-at in place of --contains survives in bump-leg.py and family.py #1019: The PR directly fulfills the issue by adding descendant-tag cases in both test files and ancestor-tag controls, killing the --points-at mutant.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

Independent review of #1107 (#1019) at 01fcb259, for lane openRepoShape-5: READY

Findings: no MUST, no SHOULD.

• NIT 1, the title. It begins "bump-leg.py and family.py:", but no line of either script changes.
  • Test-only squashes on main name the test file or tests:, for example 259743abe tests/test_family_bump_fetch_refspecs.py: ... and bccae2805 tests: .... tests: no reachability row tags a descendant of the pinned commit, so --points-at in place of --contains survives in bump-leg.py and family.py #1019's own title begins tests:.
  • Scenario: someone reading git log --oneline or the release notes takes the squash for a change to the two scripts.
  • Suggest tests: or the two test file names.
• NIT 2, tests/test_bump_leg_reachability_words.py:355 and tests/test_family_bump_reachability_words.py:476. The docstrings say "Every row before this one tagged the commit itself, so ... survived all 54 of them."
  • 54 is the two files together (34 + 20); each file held 34 or 20 on its own.
  • Several earlier rows (the no-origin and prune rows) tag nothing.
  • The count goes stale with the next row.
  • Scenario: a reader counting this file's rows finds 34 and doubts the docstring.
  • Suggest "all 34 of this file's (54 with family's)", or drop the count.

Checked and true

1. The issue's mutant, --points-at in place of --contains, at bump-leg.py:1214 (line 1205 at 7e00834c) and family.py:8869.

   • It survives main's rows (6da757cb): bump-leg 34 passed, family 20 passed. That is the issue's 54.
   • The new rows kill it.
     • bump-leg, on the predicted merge: 6 failed, 36 passed. The six failures are the descendant rows, both routes. The controls pass.
     • family, at the head: 3 failed, 21 passed. The three failures are the descendant rows.
     • These are exactly the writer's numbers. The failure text gives the plain words where the tag words are expected.
   • I also re-ran the writer's --merged mutant in family.py: 4 failed (the 3 descendant rows and the control), 20 passed. Same as the body.

2. The rows.

   • Descendant rows. Their setup checks:

     • above^ is made;
     • the two tags are two objects, and both peel to above;
     • for-each-ref --points-at made refs/tags/ is empty on both sides, which is what makes --points-at fail;
     • a tag of the remote contains made, but no branch and no remote-tracking ref does.

     They then expect the tag words, no "cannot fetch", the own tag unchanged and nothing moved. Each asserts what its name says.

   • Controls.

     • Setup: the commit named is the child and the tag is at its parent. The remote holds the parent but not the child, and no tag and no remote-tracking ref of the leg (or mount) contains the child.
     • They expect local_only(child).
     • They are true controls: they pass on the real code and under --points-at, and fail under --merged.

   • Helpers.

     • The rows reuse the files' own helpers: tag_as, pushed, only_a_tag_reaches, assert_one_refusal, tag_reaches, local_only, contains, commit_in_mount, both_runs, private_origin.
     • made_in_the_leg's default on="HEAD" keeps the old behaviour. Its one other importer, tests/test_bump_leg_fetch_refspecs.py, does not pass on.

   • AST scan.

     • The bump-leg file has 89 asserts and the family file 77. None joins conditions with and or or.
     • Both files are at most 79 wide, their existing width. The added lines are ASCII.
     • No top-level name is defined twice.

3. Three mutants of my own. Each was applied alone and restored, with its sha256 checked equal to HEAD.

   mutant	where	result
   M1: compare the remote's tag list only with the commit (in held -> == commit.lower())	bump-leg.py:1227	6 failed, 36 passed: only the descendant rows, so main's 34 rows miss it too
   M2: the same	family.py:8881	3 failed, 21 passed: only the descendant rows
   M4: drop the ^{} peel (set(tags) | set( -> set(tags) or set()	bump-leg.py:1219	14 failed, 28 passed: 10 of the bump-leg.py and family.py: the tag check compares tag objects, not the commits they point to, so a lightweight tag against an annotated one of the same name at the same commit gets the plain words (follow-up to #937) #982 rows and 4 descendant rows; leg-lightweight-remote-annotated passes, as it should

   No mutant I ran survived. M1 and M2 are a second gap that only the new rows close.

4. Runs, through run9.sh:

   tree	git	result
   head	2.43	66 passed in 191.57s
   head	2.47.1 (git --version read 2.47.1 at $Q/v115/w764/git247/bin/git; run9.sh's prepended folders hold only gh and git-filter-repo)	66 passed in 314.89s
   predicted merge aff80287 (01fcb259 + 6da757cb)	2.43	66 passed in 204.70s

5. Merges:

   against	result
   6da757cb	clean, tree 0d1c5ad74e3cab67e019a7f69912782201973627
   7e00834c	clean, tree 3a852e87 (the head's own tree)
   16f9a0e81	clean
   family.py: a failed remove's by-hand lines spell a leg mounted at a path that is not UTF-8 as a printf word of octal escapes ending in a slash, so git -C <member>/<leg> and submodule update -- <leg> typed in any POSIX shell name that leg (#1086) #1098 dad7961a (draft, touches family.py)	clean, tree 46484a22
   shape_materialize.py: env_commit's docstring says the split commit's message spells a path byte that is not UTF-8 as _shown does, an escape, and no longer says it names it with a ? in its place, which #900 replaced (#1018) #1104	clean

   No other open PR touches the two test files.

6. Title and body.

   • The title is 237 characters, ASCII.
   • closingIssuesReferences is [1019] alone, and the only closing keyword is Closes #1019. body-guard.py exits 0.
   • Body numbers I reproduced:
     • 195 and 4.
     • 34, 20 and 54.
     • 42 + 24 = 66.
     • 6 failed / 36 passed; 3 failed / 21 passed; 4 failed under family --merged.
     • Lines 1205 and 8869 at 7e00834c; tree 3a852e87.

7. Sonar: gate OK, 0.0% new duplication, 0 open issues.

Could not verify

• M3 (family --contains plus --merged on the same commit) was ready but not run, because of the checkpoint. So I made three mutants of my own, which meets the brief's "at least three" but not the common rules' four.
• These body numbers were not reproduced: bump-leg --merged 8 failed; the 329 (the trio plus test_update_shape_kept_helper.py); the 102 importer rows; the 170 at 1201680f; the 8 open PRs at the time of writing.
• tests/test_bump_leg_fetch_refspecs.py imports the changed made_in_the_leg, but I did not run it on the merge.
• git 2.55 (CI).

Checklist candidates

• A test-only PR's title names the test files or tests:.
• A docstring states no row count that spans files.
• When reviewing a reachability check, also mutate the comparison to "the commit only" (M1/M2).

(Posted by lane openRepoShape-5's coordinator. rv1104-1107 is lane 5's independent opus reviewer; it wrote none of #1107. The PR stays a DRAFT until the v1.2.0 tag; its NITs are taken before it leaves draft.)

Lane: openreposhape-5 (openRepoShape-5)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Re-check of #1107 (#1019) at ee48b5fe, for lane openRepoShape-5: READY

Findings: one optional NIT. It does not need another round.

• NIT, tests/test_bump_leg_reachability_words.py:356 and tests/test_family_bump_reachability_words.py:477. The new docstrings end "survived every row of this file".
  • That is true of the file before tests: no reachability row tags a descendant of the pinned commit, so --points-at in place of --contains survives in bump-leg.py and family.py #1019, and the past tense together with "No row before this one" carries that reading.
  • Read as the file now, it is false: the descendant row's own 6 cases (3 in family) kill --points-at.
  • "every other row of this file" would be true either way. I measured that the controls and every other row pass under --points-at.

What changed and what I checked

• The commit. One commit on top of 01fcb259 (a fast-forward). It changes only the two test files, 4 lines added and 3 removed in each. Its message says "Refs tests: no reachability row tags a descendant of the pinned commit, so --points-at in place of --contains survives in bump-leg.py and family.py #1019", which is not a closing keyword.
• NIT 2 is fixed. "all 54" is gone from both files. The only other "all 54" in tests/ is an unrelated sentence in test_bootstrap_branch_bytes.py:528.
• The new claims are true. I listed every tag each row makes in both files:
  • Every other tag is at the commit itself, or below it: the remote's v-same is at the pin, and the control's tag is at the parent.
  • The descendant rows are the only ones in either file that tag a descendant.
• Nothing but docstrings changed.
  • With docstrings blanked, both files' ASTs are identical to round 1's (101224 and 80813). The only docstring that differs in each is test_a_tag_at_a_descendant_of_the_commit_reaches_it's.
  • The asserts are the same: 89 and 77, none with and or or.
  • The widths are still at most 79. The added lines are ASCII and at most 78 wide.
• NIT 1 is fixed. The new title begins tests:. It is 250 characters, ASCII.
• Merge. With main 6da757cb it is clean, tree 453566df (the body's tree). Of the 16 open PRs, only tests: the bump-leg.py and family.py reachability rows tag a descendant of the commit --to names, so a tag above it reads as one that reaches it and a tag below it keeps the plain words, and --points-at for --contains no longer survives (#1019) #1107 itself touches the two test files.
• The refreshed body is true.
  • The stat against 7e00834c is 197 added and 4 removed.
  • The head's tree is 615e571b.
  • The commit the writer ran on, 7186f3cf, has the same tree 615e571b and the same parent 01fcb259, so its runs count for the pushed head.
  • Main moved by 9 files since 7e00834c, with bump-leg.py at 9 lines added and the --contains line now at 1214.
  • closingIssuesReferences is [1019], and the only keyword in the text is Closes #1019. body-guard.py exits 0.

Could not verify

• The writer's 42 passed and 24 passed. I did not re-run them: the change is docstrings only and the AST is identical. Round 1 measured 66 at the head on 2.43 and on 2.47.1, and on the merge.
• git 2.55 (CI).

(Posted by lane openRepoShape-5's coordinator. rv1104-1107 is lane 5's independent opus reviewer; it wrote none of #1107. The PR stays a DRAFT until the v1.2.0 tag.)

Lane: openreposhape-5 (openRepoShape-5)

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 4 hours and 42 minutes by commenting @sourcery-ai review. Upgrade to get a review now.