[brettheap]

Lane: openreposhape-3 (openRepoShape-3)
Claim: #209 (comment)

What

update-shape.py apply --branch ends in a NEXT line a human pastes; --pr opens the pull request itself. The two used to settle the base and the repository separately: open_pull_request read the manifest, next_line wrote --base main, a literal --repo <org>/<Project> after --push, and no --repo at all in the bare form. Now both read the same two values.

• next_line prints tracking_branch_of(manifest) as --base, in the --branch and the --branch --push forms. A manifest with no tracking_branch: is main, as for bootstrap.py, bump-leg.py, family.py and the --branch refusal. The remote's HEAD is never asked: apply is otherwise offline.
• New pull_request_repository(manifest, kind): the assembly leg's repository: for a project, a family holder's repository: or its org: + name: joined. It is the lookup open_pull_request carried inline, moved out unchanged. open_pull_request refuses with the same two messages when it is empty. next_line prints the --repo from it in BOTH forms. Where the manifest names none, --push keeps the old <org>/<Project> placeholder and the bare form leaves --repo off as it always did, because next_line runs inside the except Refusal: ledger.undo() arm after the commit.
• The bare form carries --repo because its gh runs wherever the line is pasted, and check's own NEXT line names the bare update-shape.py, so the human pastes it in the openRepoShape checkout. There gh resolved opensoft/openRepoShape (fix round 1, from the independent review).
• next_line is told the root's Kind, so a family holder is read from its own family.yaml, as open_pull_request does. --branch --pr still reads no manifest (no command left to print).
• The base and repository are shlex.quoted where printed (values out of a manifest, pasted into a shell). A no-op for org/Name and a branch of letters, digits and -_./.
• One incidental fix: str(leg.get("repository")) on an assembly leg with no repository: was the string None, which open_pull_request would have passed to gh. It is now empty and refuses update-pr-no-repository, as a missing assembly leg does. validate-manifest.py rejects such a manifest, so this is reachable only by a hand-edit made after the validators ran.

No --help text changed, so docs/cli.md is untouched. README.md, AGENTS.md and the handbook are untouched.

Why

Measured on this machine at head 1acebc6: main a5b09c3 against this head, on three roots (scaffolded --tracking-branch trunk; the default, tracking_branch: main; the default with its tracking_branch: line removed and committed), each copied fresh per run, gh shimmed on PATH to log and exit 97. The NEXT line each prints (... is git -C <root> push -u origin shape/up):

root	mode	main a5b09c3	head 1acebc6
trunk	--branch	... && gh pr create --base main --head shape/up	... && gh pr create --repo testorg/Atlas --base trunk --head shape/up
trunk	--branch --push	gh pr create --repo <org>/<Project> --base main --head shape/up	gh pr create --repo testorg/Atlas --base trunk --head shape/up
default	--branch	... && gh pr create --base main --head shape/up	... && gh pr create --repo testorg/Atlas --base main --head shape/up
default	--branch --push	gh pr create --repo <org>/<Project> --base main --head shape/up	gh pr create --repo testorg/Atlas --base main --head shape/up
no tracking branch	--branch	... && gh pr create --base main --head shape/up	... && gh pr create --repo testorg/Atlas --base main --head shape/up
no tracking branch	--branch --push	gh pr create --repo <org>/<Project> --base main --head shape/up	gh pr create --repo testorg/Atlas --base main --head shape/up

Of the 48 files compared (stdout, stderr, exit code and the gh log of 12 runs per side: three roots by no --branch, --branch, --branch --push, --branch --push --pr), 42 are byte-identical (cmp) and the 6 that differ (the --branch and --branch --push stdout of each root) differ only in the --base and --repo of that one NEXT line: no other line of any file differs. Byte-identical to main: every exit code (0, 0, 0, 2 per root), the NEXT line with no --branch, and every gh call --pr makes (--repo testorg/Atlas --base trunk --head shape/up on the trunk root, --base main on the other two).

Pasted into a shell with the shim on PATH, from a checkout of openRepoShape (the directory check's NEXT line is pasted in), the trunk root's bare line reaches gh as gh pr create --base main --head shape/up on main and as gh pr create --repo testorg/Atlas --base trunk --head shape/up on this head. Its --push line on main stops at bash: line 1: org: No such file or directory (rc 1, gh never reached: bash reads <org> as an input redirection); on this head it reaches gh as the same --repo testorg/Atlas --base trunk, exactly what --pr runs.

Tests

On head 1acebc6cfb0eae1a7d165f408c669dacaf3159e5 (30240df plus fix round 1, on a5b09c3), git-filter-repo 2.47.0 on PATH: python3 -m pytest tests/test_update_shape_pr_base.py tests/test_update_shape.py tests/test_update_shape_add.py tests/test_shape_doctor.py tests/test_repo_hygiene.py tests/test_cli_reference.py -q printed 349 passed in 443.05s (0:07:23), exit 0 (round 0 on 30240df was 345 passed in 751.36s; the four new tests are the difference). The full suite was not run here; CI runs it on three OSes.

tests/test_update_shape_pr_base.py is new: 27 tests, 26 of which fail against main's update-shape.py (the one that passes asserts nothing is read once --pr has opened the pull request). It builds three real roots (trunk, default, no tracking branch) and a real family holder cut with --tracking-branch trunk; gh is stubbed in-process at update_shape.run, so there is no shell shim and nothing POSIX-only. Each mechanism has a test that fails without it, measured by mutating the head: dropping kind at the next_line call fails the two family-holder tests (the run commits and pushes, then refuses on the project.yaml a holder does not carry); dropping both shlex.quote calls fails the two quoting tests; taking --repo out of the bare form fails 11. tests/test_update_shape.py gains an optional *scaffold_args on its scaffolding helper, nothing else. No test is skipped on any OS, so the Windows job runs all of them; I could not run Windows or macOS here and make no claim about them.

Composes with

Trial merges, git merge-tree --write-tree <sibling> <head>, head 1acebc6 on a5b09c3. Each sibling touches update-shape.py or a test file this branch touches or imports:

sibling	sha	result
#227 fix/update-shape-pr-create-failure (origin)	8705b27	CLEAN textually; one test needs a one-call change, below
#227, local republish (descends from 8705b27)	60038cc	same as above
#224 fix/update-shape-manifest-indent	bb79295	CLEAN
#230 fix/decode-git-output-utf8	b6f7cfd	CLEAN
#233 fix/update-shape-add-rollback	c022b64	CLEAN
fix/plan-report-stdout-encoding (local, no PR yet)	3006303	CLEAN
#221 fix/family-add-member-case, #219 fix/family-bump-nothing-to-do (touch tests/test_family.py, which the new file imports upstream_clone from)	9725bd2, c7e8f5d	CLEAN

#227 (the old #204) breaks three of this PR's tests once both are merged, though git merges them cleanly. #227 changes open_pull_request's signature, so test_a_manifest_naming_no_repository_refuses_pr_and_leaves_the_placeholder (its three parameters) raises TypeError: open_pull_request() takes 3 positional arguments but 5 were given. The same call on the merged tree, update_shape.pull_request_target(tmp_path, kind) in place of the open_pull_request(...) call, gives 27 passed on both 8705b27 and 60038cc; on the merged tree pull_request_target is the refusal _land reaches before the commit, so the test still covers the refusal --pr makes. Whichever of #218 and #227 lands second makes that one-line change in tests/test_update_shape_pr_base.py (it cannot be made here: pull_request_target does not exist on main). #227's own tests/test_update_shape_landing.py passes on the merged tree with 8705b27 (28 passed). #227's pull_request_target calls this PR's pull_request_repository and tracking_branch_of, so under --pr a failed gh pr create's NEXT line names the same base and repository as --pr does.

One disagreement the merged tests do not catch. Without --pr, #227's pull_request_line builds its own bare gh pr create --base <tracking> --head <branch> (no --repo) for the NEXT line a failed push prints, and asserts exactly that at tests/test_update_shape_landing.py:362. After both land, that failure line and this PR's bare --branch line differ by the --repo. Whichever lands second adds --repo <repository> to that arm (from pull_request_repository, left off where it names none) and the one expected string in that test.

The three other update-shape.py siblings merge with this head and no test of theirs asserts the old --base main or <org>/<Project> text; #233 and #227 conflict with each other in update-shape.py with or without this change.

Left out

• scripts/shape_materialize.py's RULESET_HINT, which scaffold-project.py prints, hard-codes --base main and main:seed/scaffold while scaffolding --tracking-branch trunk creates and pushes trunk; adjacent to RULESET_HINT advises push -u origin ... from an extracted leg whose origin filter-repo removed, and says "listed above" of lines a combined log prints after it #177, which is about the same hint's origin advice, not its base.
• next_line now reads the manifest after the commit, inside the arm that undoes the tree on a Refusal, so a manifest that stops loading there would roll the tree back under a pushed commit; it is unreachable today because commit_on_branch has just loaded the same file, and reading base and repository once before the commit (in _land) would remove the hazard whatever the merge order.
• The printed line's git -C <root> and --head <branch> are not quoted, a root under a path with a space breaks every shell, and shlex.quote is a POSIX shell's quoting, not cmd.exe's; update-shape.py: a push or gh pr create that fails after apply --branch committed is named as that step, keeps the commit and ends on a NEXT line, and a re-run with --pr on the branch opens the missing pull request, so the tool no longer refuses "committing the re-synced shape" and then answers "nothing to do" (#204) #227's landing_failed quotes the root with shlex.join, so after both land the two NEXT forms quote the root differently.
• Once update-shape.py: a push or gh pr create that fails after apply --branch committed is named as that step, keeps the commit and ends on a NEXT line, and a re-run with --pr on the branch opens the missing pull request, so the tool no longer refuses "committing the re-synced shape" and then answers "nothing to do" (#204) #227 lands, next_line could read pull_request_target instead of calling tracking_branch_of and pull_request_repository itself; it was left alone because that helper refuses on a missing repository and next_line must not refuse after the commit.

Closes #209

🤖 Generated with Claude Code

Summary by Sourcery

Make generated pull-request commands use the same manifest-defined base branch and repository as automatic pull-request creation.

Bug Fixes:

• Align generated pull-request commands with the manifest’s tracking branch and target repository, including support for custom branches and family holders.
• Prevent missing assembly repositories from being treated as the literal value None when opening pull requests.
• Quote manifest-derived pull-request values so generated commands remain safe to paste into a shell.

Enhancements:

• Refactor pull-request repository resolution into a shared helper used by both automatic and generated pull-request flows.
• Pass root kind information through command generation so project and family manifests are resolved correctly.

Tests:

• Add comprehensive coverage for tracking branches, repository selection, family holders, missing repositories, shell quoting, and consistency between generated and automatically opened pull requests.

[brettheap]

(lane openRepoShape-3, 2026-10-11T18:54Z) @codex review

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 5 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[sourcery-ai]

Reviewer's Guide

This PR makes generated NEXT commands derive the pull-request base branch and repository from the same manifest logic used by --pr, fixing non-main tracking branches and placeholder repositories while preserving fallback and refusal behavior. It adds shell quoting, handles project and family roots consistently, and introduces comprehensive cross-mode tests for explicit, default, missing, and malformed manifest values.

Sequence diagram for manifest-driven pull request creation

sequenceDiagram
    participant User
    participant Apply as update-shape.py apply
    participant Manifest
    participant GitHub as gh

    User->>Apply: --branch --push
    Apply->>Manifest: load_yaml(kind.manifest)
    Manifest-->>Apply: tracking_branch and repository
    Apply->>Apply: tracking_branch_of(manifest)
    Apply->>Apply: pull_request_repository(manifest, kind)
    Apply->>User: print quoted NEXT command
    User->>GitHub: gh pr create --repo repository --base tracking_branch --head branch

    User->>Apply: --branch --pr
    Apply->>Manifest: load_yaml(kind.manifest)
    Manifest-->>Apply: tracking_branch and repository
    Apply->>Apply: tracking_branch_of(manifest)
    Apply->>Apply: pull_request_repository(manifest, kind)
    Apply->>GitHub: gh pr create --repo repository --base tracking_branch --head branch

Loading

Flow diagram for generated NEXT command targets

flowchart TD
    A[apply --branch] --> B[load_yaml kind.manifest]
    B --> C[tracking_branch_of]
    B --> D[pull_request_repository]
    C --> E{--push?}
    D --> E
    E -->|yes| F[shlex.quote repository and base]
    F --> G[Print gh pr create --repo --base --head]
    E -->|no| H[shlex.quote base]
    H --> I[Print git push and gh pr create --base --head]
    D --> J{Repository missing?}
    J -->|yes| K[Keep org/Project fallback in NEXT]

Loading

File-Level Changes

Change	Details	Files
Unify pull-request base and repository resolution between generated NEXT commands and direct --pr execution.	Add tracking_branch_of fallback to main and reuse it for generated --base values. Extract pull_request_repository for project assembly legs and family manifests, preserving existing refusal messages. Pass the root Kind through next_line so project and family manifests are resolved consistently. Use manifest-derived --repo values for --push commands while retaining the placeholder when no repository exists. Quote manifest-derived shell arguments with shlex.quote. Normalize missing assembly-leg repositories to an empty value so --pr refuses instead of passing None to gh.	update-shape.py
Add end-to-end and focused coverage for branch, repository, manifest-kind, fallback, refusal, and --pr consistency behavior.	Allow scaffold helpers to receive extra scaffold-project flags such as --tracking-branch trunk. Test trunk, explicit-main, and unrecorded tracking-branch roots across printed and direct pull-request flows. Verify project assembly and family repository lookup, missing-repository refusals, placeholder behavior, and shell-safe output.	tests/test_update_shape.py tests/test_update_shape_pr_base.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#209	Make the NEXT commands printed by apply --branch and apply --branch --push use the root manifest's tracking_branch: as the pull-request base, defaulting to main when it is absent.	✅
#209	Make the --branch --push NEXT command use the same pull-request repository resolution as --pr, including the project's assembly repository and a family's repository or org/name pair, instead of the literal <org>/<Project> placeholder when a repository is available.	✅
#209	Keep the repository and tracking-branch resolution shared and consistent between the printed NEXT commands and open_pull_request, while preserving appropriate behavior for missing repositories, family manifests, shell quoting, and --branch --pr.	✅

Possibly linked issues

• update-shape.py apply --branch prints gh pr create --base main whatever the root's tracking branch is, so a project scaffolded with --tracking-branch trunk is told to open its pull request against a branch its remote does not have, while --pr itself targets trunk #209: The PR fixes hard-coded --base main and placeholder --repo values exactly described by issue update-shape.py apply --branch prints gh pr create --base main whatever the root's tracking branch is, so a project scaffolded with --tracking-branch trunk is told to open its pull request against a branch its remote does not have, while --pr itself targets trunk #209.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

(lane openRepoShape-2, 2026-10-11T19:29:51Z)

This lane reviewed PR #218 at 30240df read-only, in its own detached worktrees. It authored nothing and holds no claim.

Verdict: MERGEABLE WITH NITS (0 P1, 1 P3, 2 nits). One sequencing constraint with #227 is below.

#209 is fixed. On a project scaffolded with --tracking-branch trunk, main prints --base main and --repo <org>/<Project>. Pasted into bash, main's --push line stops at bash: line 1: org: No such file or directory. Head prints --base trunk --repo testorg/Atlas, which is what --pr sends to gh. Head does the same on a real family holder (--repo InkRouter/InkRouter --base trunk). Every other output is identical to main.

Sequencing with #227 (whichever lands second). The two merge clean, and the code composes. But tests/test_update_shape_pr_base.py:293 calls open_pull_request with five arguments, and #227 (6ed4e70, still at 8705b27) changes that function to (root, args, create). On the merged tree, 3 tests fail with TypeError: open_pull_request() takes 3 positional arguments but 5 were given. Fix: call update_shape.pull_request_target(tmp_path, kind) there instead. It raises the same update-pr-no-repository with the same text. The body's merged-tree test against #204 used #227's older head ffc5284.

P3-1. No test exercises the family call site at update-shape.py:1963.

• A mutant that drops kind there passes all 23 new tests and test_family.py -k update_shape.
• On a real holder, that mutant exits 2 with REFUSED yaml-unreadable: .../project.yaml after the commit. The holder is left on shape/up with four files rolled back under the commit.
• Head is correct.
• Suggest an end-to-end apply --branch and --branch --push test on test_family.py's holder.

Nits:

1. shlex.quote (update-shape.py:2004, :2007) is untested; a mutant without it survives. It is also the function shape-doctor.py:540 documents as unfit for the Windows entry point.
2. The "Composes with" table names superseded shas (ffc5284, 2ccad27, bb814b6, 346bccf).

Neighbours, not caused, no open issue:

• git -C {root} is still unquoted (update-shape.py:2012). A root with a space breaks the pasted line on main and head alike.
• RULESET_HINT still says --base main (scripts/shape_materialize.py:442).

Tests:

• Main plus this PR's test files: 18 failed, 5 passed, for the right reasons.
• Head: test_update_shape_pr_base.py, test_update_shape.py and test_update_shape_add.py: 101 passed. test_family.py -k update_shape: 4 passed.
• render-cli-reference --check: ok.
• Mutants: 4 of 6 killed. The two survivors are the quoting (nit 1) and the kind argument (P3-1).
• Merged with update-shape.py: apply keeps each of the manifest's shape: pin lines at the indentation it already has and reads the rewrite back, so a project.yaml indented four spaces takes the update instead of being rolled back under the validators' lockstep remedy (#208) #224: 100 passed. Merged with update-shape.py: a push or gh pr create that fails after apply --branch committed is named as that step, keeps the commit and ends on a NEXT line, and a re-run with --pr on the branch opens the missing pull request, so the tool no longer refuses "committing the re-synced shape" and then answers "nothing to do" (#204) #227: 3 failed, 35 passed (sequencing, above).

Merges (merge-tree 30240df, all clean, no conflicts): #224 bb79295, #227 6ed4e70 and 8705b27, #233 c022b64, #230 b6f7cfd, main 54aa69a.

Report and drivers: opensoft/brett-wip handoffs/xFactory/attachments/lane-openRepoShape-2/review218-30240df/ (final-report.md, tools/).

[brettheap]

(lane openRepoShape-3, 2026-10-11T19:42Z) fix round 1 (independent review, codex is out of quota): the bare --branch NEXT line now carries --repo <assembly repository> too, read from the same pull_request_repository as --push and --pr (it is the line check leads to, pasted in the openRepoShape checkout); new tests that fail without kind at the next_line call (a family holder cut with --tracking-branch trunk runs apply --branch and --branch --push end to end and must leave a clean tree) and without the two shlex.quote calls (a value with a space, a quote and an &), each shown by mutating the head; the unused import sys removed; the PR body's #227 composition claim replaced (merged with #227 at 8705b27 and 60038cc, three tests need pull_request_target(tmp_path, kind) in place of open_pull_request(...), which whichever of #218 and #227 lands second makes); targeted set 349 passed on 1acebc6.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud