[brettheap]

Lane: openreposhape-2 (openRepoShape-2)
Claim: #385 (comment)

What

git keeps a remote URL as the bytes it was given. A clone of a directory named in a legacy code page therefore has an origin that is not UTF-8, and nobody did anything wrong. Three readers of git remote get-url origin went through git_out, which decodes strictly, and caught only Refusal and OSError.

• scripts/shape_advisory.py repository_names now catches UnicodeDecodeError beside them. Such a URL names nothing, as no origin names nothing. read() then answers as it does for any repository: advise for a single repository, leg-clone by the leg's own AGENTS.md (which needs no URL) or by its directory's name, and the rest as before. Before, it raised into read()'s net and answered not-answered.
• shape-doctor.py origin_name does the same and returns None. The naming and way-in rows now classify the directory's name, exactly as for the same repository with no origin, and shape-doctor.py --root ends the verdict that repository gets. Before, it ended in a UnicodeDecodeError traceback, exit 1.
• shape-doctor.py origin_url reads the bytes and decodes them with errors="replace", which is how siblings.py::git_text reads the same URL. Before, a family holder's members row ended in the same traceback.
• scripts/repo_shape.py (git_out) is unchanged. It is a pinned copy (COPIED_FROM_SHAPE).

The doctor's verdict for a root whose origin URL is not UTF-8

The doctor adds no row and no status for this. The URL names nothing, so every row reads as it does for the same repository with no origin:

• a single repository: NOT A SHAPE ROOT, exit 2, with the advisory Triad row;
• a leg clone: NOT A SHAPE ROOT, exit 2, with the n/a Triad row sending it to its assembly root, and no adoption offered in the way in;
• a family holder: the members row reads a sibling's URL as make siblings reads it.

Per AGENTS.md's doctor section, none of the other verdicts fits:

• Not CANNOT ANSWER. Exit 3 is "THIS CHECKOUT failing to ask, never a statement about their repository", and this checkout asked and got an answer.
• Not a FINDING. A finding "names its fix", and there is nothing to fix: git stored what it was given.
• Not a note. A note is "a difference nothing asserts", and the advisory's ratified posture is to say the sentence or stay silent, not to annotate.

Where this departs from the issue's draft

1. origin_url does not return "". The members row exists to agree with siblings.py::verify_sibling about one directory (shape-doctor.py: the members row calls a beside-the-holder repository the working clone on its project id alone, where the family's own verifier also requires the origin #146), and siblings.py reads origin with errors="replace". Take a clone of a mirror under a Latin-1 directory, ../caf\xe9/InkRouter/IRRS.git. make siblings accepts it as the member's clone by the row's repository: InkRouter/IRRS tail. Under the draft, the doctor calls the same directory (no origin) and no working clone. The probe (tools/members-parity.py) asks both tools, for three origins, under three readings:

   sibling's origin	make siblings	the draft ("")	this PR (replace)
   mirror under caf\xe9, tail InkRouter/IRRS	the member's clone	(no origin), disagrees	the working clone, agrees
   stranger under caf\xe9	WRONG ORIGIN	(no origin), agrees	.../caf?/stranger/Other.git, agrees
   mirror under cafe (ASCII control)	the member's clone	agrees	agrees

   A URL that matches nothing is quoted with U+FFFD. The table prints it as ? through ascii_text, and --json escapes it.

2. No name is salvaged from such a URL, not even its last segment. The issue left this to the author. In a double-byte code page (Shift_JIS, GBK, Big5), the byte \ is the second half of many characters, and repository_name splits on \, so a segment read out of such a URL can be a fragment of a name. This is also the answer adopt-project.py: _elector keeps a user.name byte that is not UTF-8 for #255's question, _remote_repository reads such an origin URL as no org/repo, and plan asks adopt-no-org before checked_value, so a Latin-1 name is refused as adopt-unwritable-value naming --elected-by, and plan, check and execute go on past such an origin, where both ended in a UnicodeDecodeError traceback (#292) #353 gives adopt-project.py's _remote_repository for the same URL. origin_name and repository_names agree, so the naming row and the Triad row read one identity. test_only_an_origin_that_is_text_names_the_repository pins the choice: a clone whose URL ends in Northwind-spec.git is a leg by origin's name under an ASCII or a UTF-8 directory, and a single repository under a Latin-1 one.

Why

There was one strict decode and three handlers that named Refusal and OSError but not the ValueError a strict decode raises.

• The advisory's net hid the error in read(). That net exists for what nobody foresaw, and it turned a foreseeable input into the same silence: a single repository lost the Triad advisory, and a leg clone lost its "work from its assembly root".
• The doctor has no such net, so --root crashed.

#292 and PR #353 fixed the same decode in adopt-project.py and left these three as a follow-up.

Tests

The new tests write the URL into .git/config as bytes (with_origin, as #353's tests/test_adopt_git_reads.py does). Each skips where git remote get-url origin does not give the URL back as written. The URLs are relative, so .git/config never holds a host path or a Windows backslash.

New in tests/test_shape_advisory.py (6 items):

• test_a_single_repository_whose_origin_is_not_utf8_hears_it: advise; the doctor's --json gives exit 2 and NOT A SHAPE ROOT. The Triad, naming and way-in rows have the same status and detail as a no-origin twin. Printed under PYTHONIOENCODING=ascii: exit 2, no traceback.
• test_a_leg_clone_whose_origin_is_not_utf8_is_still_sent_to_its_root[agents|name]: leg-clone, by agents or name; the Triad row is n/a with the leg's sentence; way-in offers no command; exit 2; no traceback.
• test_only_an_origin_that_is_text_names_the_repository[ascii|utf-8|latin-1]: the issue's control and the pinned choice (2 above).

New in tests/test_shape_doctor.py (6 items):

• test_an_origin_url_that_is_not_utf8_names_nothing_and_raises_nothing: origin_name and repo_local_origin_name are None; origin_url is ../caf�/Atlas.git; naming and the way in match a no-origin twin. This is the issue's (e).
• test_working_clone_and_verify_sibling_agree_on_a_non_utf8_origin: both callers, the mirror and the stranger, under caf\xe9.
• test_a_sibling_origin_not_utf8_is_read_as_make_siblings_reads_it[the-members-mirror|a-stranger]: --root on a real family holder with its member's clone beside it. COMPLIANT, exit 0, no traceback. The mirror is the working clone; the stranger's other_origin carries U+FFFD and is printed is a clone of ../caf?/Someone/Fork.git.
• test_a_holders_own_origin_not_utf8_is_read_as_make_siblings_reads_it[an-absolute-mount-url|a-relative-mount-url] (added in the fix round below): the other route into origin_url. mounted_from asks it of the HOLDER, to resolve a relative .gitmodules url against, and asks it whatever the url is. --root on a real family holder whose own origin is ../caf\xe9/InkRouter.git: COMPLIANT, exit 0, no traceback in the text report or in --json, and the clone beside it is the working clone. With the mount rewritten to ../IRRS.git and the member's clone's origin ../caf\xe9/IRRS.git, mounted_from is ../caf�/IRRS.git: git's own resolution against the holder's URL.

Against main 92e29d9's code (a scratch merge of this branch with main, with shape-doctor.py and scripts/shape_advisory.py put back to main's): 10 of the 12 new tests fail for the issue's reason, and the ASCII and UTF-8 controls pass (tools/x404-new12-at-maincode.log). The failures are not-answered with UnicodeDecodeError in why, a raised UnicodeDecodeError, or the UnicodeDecodeError traceback in the doctor's stderr, and for the holder-origin test the traceback out of mounted_from into origin_url.

Mutants (tools/mutants.py, re-run at fb521a4), each killed by its own line's tests:

mutant	tests that fail
M1: repository_names no longer catches it	4 advisory tests
M2: origin_name no longer catches it	those 4 and the doctor's (e)
M3: origin_url as the issue's draft ("")	the 4 doctor tests that read a URL, and the holder-origin test's relative case
M4: origin_url decoded strictly	the 4 doctor tests, and both holder-origin cases

Four more mutants of the holder route (tools/x404-mutants.py) are all killed by the holder-origin test: X1 (origin_url as the issue's draft, ""), X3 (errors="ignore") and X4 (mounted_from never reads the holder's origin) each fail the relative case; X2 (decoded strictly) fails both cases.

Targeted run at fb521a4 (S/frbin on PATH): 523 passed and 4 skipped in 383 s, 7 files and 527 tests (tools/x404-targeted-fb521a4.log). The 4 skips run on Windows only: test_a_template_validators_next_runs_when_pasted_into_powershell's three cases (tests/test_shape_doctor.py:5614) and test_plan_on_the_windows_default_stdout (tests/test_stdout_encoding.py:286).

file	tests
tests/test_shape_doctor.py	264
tests/test_shape_advisory.py	47
tests/test_windows_paths.py	38
tests/test_stdout_encoding.py	48
tests/test_git_output_decoding.py	67
tests/test_cli_reference.py	13
tests/test_repo_hygiene.py	50

scripts/render-cli-reference.py --check: [ok]. No --help text changed.

Composes with

Each check is git merge-tree --write-tree fb521a4 <head>, read on 2026-10-12 from the heads gh pr list showed, every one of them present in the shared object store (tools/x404-mergetrees.log has each head's result with this branch, with main alone, and with both). Main is 92e29d9.

head	rc	conflicts
main 92e29d9 (it holds #354's change to shape-doctor.py)	0	none. The merge's targeted run is 8 files, with main's tests/test_doctor_legs_members_next.py: 585 passed and 4 skipped in 823 s (tools/x404-targeted-merge-4c635a5.log), and scripts/render-cli-reference.py --check is [ok] there too.
the lane's other open heads: #266 3410be7, #267 8badae0, #343 9e6caeb, #346 818db36, #347 e965ab0, #352 3416283, #353 96ff0c7, #355 d696acc, #356 dbfad70, #401 6124cb4, #403 5bc6b47, #386 5f177c9, #359 11dff7f	0, and 0 once main is in	none. #267 and #347 touch shape-doctor.py and its tests, and #353 and #356 adopt-project.py.
other lanes' open PRs: #184, #314, #357, #373, #374, #375, #376, #378, #379, #381, #382, #384, #387, #390, #395, #396, #397, #398, #399, #400, #406, #409, #416	0, and 0 once main is in	none
#402 52e3eee	0, but 1 once main is in	shape-doctor.py: two hunks, the same two as with main alone. Neither names origin_url, origin_name or repository_names.
#394 48bdbf9	0, but 1 once main is in	tests/test_repo_hygiene.py: one hunk, the same as with main alone.
#358 2745890 (stacked on #267)	1	shape-doctor.py: the same four hunks (lines 1478-1595) as with main alone, so it is #358 against main. This PR's hunks (origin_url, origin_name) are not in it.

tools/x404-conflict-compare.py compares the hunks of the three rc 1 rows with and without this branch (tools/x404-conflict-compare.log).

With #353: at fb521a4 with main 92e29d9 and #353's 96ff0c7 merged, adopt-project.py plan over the issue's repositories exits 0 with no traceback (tools/adopt-with-353.sh, run as tools/x404-adopt-with-353-at-96ff0c7.log):

• the Latin-1 single repository prints This is a single repository. once;
• the Latin-1 spec-leg clone prints the leg NOTE once;
• tests/test_shape_advisory.py and tests/test_adopt_git_reads.py on that merge: 64 passed (tools/x404-353-pytest.log).

Fix round (review of f9d420a)

The review (MERGEABLE WITH NITS, no P1 and no P2) left two items for this PR:

• nit-1, the holder's own origin was not pinned. scripts/shape_advisory.py repository_names and shape-doctor.py origin_url and origin_name read git remote get-url origin through git_out and catch Refusal and OSError only, so an origin URL that is not UTF-8 makes read answer not-answered (a single repository loses the Triad advisory, a leg clone its pointer to the assembly root) and ends shape-doctor.py --root in a UnicodeDecodeError traceback, exit 1, where an ASCII origin gives NOT A SHAPE ROOT, exit 2 #385 names two callers of origin_url, and the new tests reached only the sibling's, through working_clone. Commit fb521a4 adds test_a_holders_own_origin_not_utf8_is_read_as_make_siblings_reads_it (above). It fails against main 92e29d9's code (UnicodeDecodeError out of mounted_from into origin_url) and passes at the head, and four mutants of that route are killed. No code changed.
• nit-2, this section was stale. "Composes with" named old heads and old mains, and shape-doctor.py: the legs and members NEXT is a script-free git submodule update --init --recursive over what a checkout cures, and the lockstep gate for what none does, so a root that lost scripts/bootstrap.py no longer pastes can't open file, and an empty mount or a leg committed past its pin on its tracking branch no longer pastes a bootstrap that leaves the row red (#276) #354 has since landed. It is rewritten above, at main 92e29d9 and the heads now open.

Left out

• The issue's adopt_plan assertions in (a) and (b). On main, plan dies first in _remote_repository (adopt-project.py: _elector and _remote_repository read git config user.name and the origin URL through git_out, which decodes strictly, so a name or URL that is not UTF-8 ends plan (and, for the URL, check and execute) in a UnicodeDecodeError traceback, exit 1, naming neither the git setting nor the flag that avoids it #292), so they hold only once adopt-project.py: _elector keeps a user.name byte that is not UTF-8 for #255's question, _remote_repository reads such an origin URL as no org/repo, and plan asks adopt-no-org before checked_value, so a Latin-1 name is refused as adopt-unwritable-value naming --elected-by, and plan, check and execute go on past such an origin, where both ended in a UnicodeDecodeError traceback (#292) #353 lands. They hold at fb521a4 + 92e29d9 + 96ff0c7 (shown above), and belong in a test once adopt-project.py: _elector keeps a user.name byte that is not UTF-8 for #255's question, _remote_repository reads such an origin URL as no org/repo, and plan asks adopt-no-org before checked_value, so a Latin-1 name is refused as adopt-unwritable-value naming --elected-by, and plan, check and execute go on past such an origin, where both ended in a UnicodeDecodeError traceback (#292) #353 is on main.
• shape-doctor.py's submodule_config. It reads a holder's .gitmodules through git_out just as strictly: a .gitmodules URL of ../caf\xe9/IRRS.git raises UnicodeDecodeError (probed), where siblings.py::submodule_urls reads it with errors="replace". scripts/shape_advisory.py repository_names and shape-doctor.py origin_url and origin_name read git remote get-url origin through git_out and catch Refusal and OSError only, so an origin URL that is not UTF-8 makes read answer not-answered (a single repository loses the Triad advisory, a leg clone its pointer to the assembly root) and ends shape-doctor.py --root in a UnicodeDecodeError traceback, exit 1, where an ASCII origin gives NOT A SHAPE ROOT, exit 2 #385 does not name this function; it needs its own issue.
• The naming row does not say that origin's URL could not be read. It reads exactly as no origin does, which is the issue's ask.
• Per the issue's "Not in this issue": setup-project.py's remote_url (it already reads with errors="replace"), templates/family-root/scripts/siblings.py (a pinned copy), and the other git_out callers.

Closes #385

🤖 Generated with Claude Code

Summary by Sourcery

Handle non-UTF-8 origin URLs consistently across repository advisory and shape-doctor checks without changing repository classification or sibling membership semantics.

Bug Fixes:

• Handle non-UTF-8 Git origin URLs without suppressing repository advisories or crashing shape-doctor reports.
• Keep sibling membership detection consistent with make siblings by preserving replacement-decoded origin URLs.

Enhancements:

• Treat unreadable origin URLs as naming no repository while continuing to classify repositories from their directory and local metadata.

Tests:

• Add coverage for advisory, doctor, sibling, mounted-origin, and repository-name behavior with non-UTF-8 origin URLs.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 7 hours and 25 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR makes invalid UTF-8 Git origin URLs safe and consistent: advisory and doctor identity logic treats them as naming nothing, while doctor URL consumers decode with replacement to stay aligned with make siblings. Comprehensive byte-level regression tests verify repository guidance, doctor verdicts, sibling matching, output, and traceback-free execution.

Sequence diagram for handling a non-UTF-8 Git origin

sequenceDiagram
    participant Git
    participant Advisory as shape_advisory.py
    participant Doctor as shape-doctor.py
    participant Siblings as make siblings

    Advisory->>Git: git_out(remote get-url origin)
    Git-->>Advisory: non-UTF-8 bytes
    Advisory-->>Advisory: repository_names returns no origin name
    Advisory-->>Advisory: read advises by directory or AGENTS.md

    Doctor->>Git: git_out(remote get-url origin)
    Git-->>Doctor: non-UTF-8 bytes
    Doctor-->>Doctor: origin_name returns None
    Doctor-->>Doctor: origin_url decodes with replacement
    Doctor->>Siblings: Compare sibling origin interpretation
    Siblings-->>Doctor: Consistent working-clone result

Loading

File-Level Changes

Change	Details	Files
Treat non-UTF-8 origin URLs as unnamed repositories in advisory and doctor identity checks.	Catch strict UTF-8 decode failures when deriving repository names. Return None from doctor origin-name lookup so naming, Triad, and way-in logic fall back to directory or local metadata. Preserve behavior for single repositories and leg clones, including root-directed guidance and no traceback.	scripts/shape_advisory.py shape-doctor.py
Make doctor origin URL handling match make siblings replacement decoding.	Read origin output as bytes and decode UTF-8 with replacement characters. Keep sibling/member matching based on the decoded URL while exposing replacement characters for unmatched origins.	shape-doctor.py
Add regression coverage for advisory, doctor, and sibling-parity behavior with invalid origin bytes.	Write byte-level origins into Git configuration and cover ASCII, UTF-8, and invalid-byte cases. Verify verdicts, rows, leg guidance, repository naming, replacement output, exit codes, and absence of tracebacks. Exercise mirror and stranger sibling origins and validate mutant-sensitive behavior.	tests/test_shape_advisory.py tests/test_shape_doctor.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#385	Treat an undecodable origin URL as naming no repository in the Triad advisory, so a single repository or leg clone still receives the appropriate advisory.	✅
#385	Prevent shape-doctor from crashing on an undecodable origin URL; origin_name should return None so naming and way-in checks behave as they do without an origin.	✅
#385	Have origin_url return an empty string for an undecodable origin, so the members row treats it as an unidentified directory.	❌	The PR instead reads the URL as bytes and decodes with replacement characters. This avoids the crash and intentionally preserves parity with make siblings, but it does not implement the issue's requested empty-string behavior; the members row may identify a working clone or report the replacement-character URL.

Possibly linked issues

• scripts/shape_advisory.py repository_names and shape-doctor.py origin_url and origin_name read git remote get-url origin through git_out and catch Refusal and OSError only, so an origin URL that is not UTF-8 makes read answer not-answered (a single repository loses the Triad advisory, a leg clone its pointer to the assembly root) and ends shape-doctor.py --root in a UnicodeDecodeError traceback, exit 1, where an ASCII origin gives NOT A SHAPE ROOT, exit 2 #385: The PR fixes the issue’s advisory and doctor failures; its replacement decoding for origin_url is a compatible refinement that preserves sibling matching.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[brettheap]

(lane openRepoShape-2, 2026-10-12T17:02Z)

This lane reviewed its own PR #404 at f9d420a. The review was read-only, in this lane's own detached worktrees, and authored nothing. It stands in for Codex, which is out of quota.

MERGEABLE WITH NITS. There is no sequencing constraint beyond the usual update-branch and a fresh three-OS CI run on main 92e29d9.

Findings:

• nit, fix in this PR (tests only). No test pins the holder's own non-UTF-8 origin, the mounted_from route the issue names (shape-doctor.py:3171). Head handles it: COMPLIANT, exit 0, with a relative .gitmodules url resolved to caf�. Main crashes there.
• nit, PR body. The "Composes with" table is stale (old heads, main a983e6a).
• P3, follow-up issue. submodule_config (shape-doctor.py:3113, read :3123) still decodes .gitmodules strictly, so a non-UTF-8 member url ends --root in a traceback, exit 1. Main does the same. scripts/shape_advisory.py repository_names and shape-doctor.py origin_url and origin_name read git remote get-url origin through git_out and catch Refusal and OSError only, so an origin URL that is not UTF-8 makes read answer not-answered (a single repository loses the Triad advisory, a leg clone its pointer to the assembly root) and ends shape-doctor.py --root in a UnicodeDecodeError traceback, exit 1, where an ASCII origin gives NOT A SHAPE ROOT, exit 2 #385 leaves this out, and no issue matches it.

Probes confirmed the following:

• the issue's reproduction is fixed (advise, leg-clone by name and by AGENTS.md, exit 2 in text and --json);
• the members row agrees with siblings.py --dry-run for a mirror and for a stranger;
• a cp1252 console prints with no traceback;
• credentials stay redacted.

Tests:

• The 10 new tests against main 92e29d9's code: 8 fail for the issue's reason, and the 2 controls pass.
• My mutants M5 to M10 (salvage, ignore, surrogateescape, no strip, latin-1) were all killed.
• Head: the implementer's 436 passed and 3 skipped stands. Two more doctor files: 85 passed, 1 skipped.
• Head merged with 92e29d9: 583 passed, 4 skipped, over eight doctor, advisory and encoding files.
• Head merged with 92e29d9 and adopt-project.py: _elector keeps a user.name byte that is not UTF-8 for #255's question, _remote_repository reads such an origin URL as no org/repo, and plan asks adopt-no-org before checked_value, so a Latin-1 name is refused as adopt-unwritable-value naming --elected-by, and plan, check and execute go on past such an origin, where both ended in a UnicodeDecodeError traceback (#292) #353 96ff0c7: 64 passed, and adopt-project.py plan prints the advisory lines.
• render-cli-reference.py --check is ok.
• CI is green on Linux, macOS and Windows.

Merges:

• With main and every lane head, merge-tree is rc 0 except for shape-doctor.py: the manifest kinds row puts back a shape or leg pin under contracts/ that does not load with the git command pin_restore picks from its own state, shows a copy the shape pin has a row for or a neutral product pin with a read-only git diff, and leaves any other file to a person whatever it is called, so its NEXT no longer tells the reader to delete the pin (#291) #358 and adopt-project.py: Plan.__init__, allowed_empty_legs, names and open_source iterate or call .get on a hand-edited plan's pins:, allow_empty_legs:, paths:, legs: and source: without asking their type, so a scalar ends check and execute in a TypeError or AttributeError traceback, exit 1, and pins: openGlass passes check, adopts, and writes eight one-letter neutral-product pins that the project's own validate-pins.py refuses #386.
• After main, shape-doctor.py: a NEXT is only the command, and the sentence that ended twenty-five of them after # is the row's why, on a WHY line of its own and "why" in --json, so a NEXT pasted into an interactive zsh -- which reads that # as a word -- no longer hands the comment to the command as arguments, runs what follows its ;, or runs the make bootstrap in its backticks, and the template validator's line is env PYTHONPATH=... python3 ... (#277) #402, adopt-project.py: execute records in project.yaml which leg the plan gave each submodule a leg keeps, and shape-doctor.py holds the submodule to that row, so one in the other leg is MISPLACED and a real adoption's placement reads ok (#189) #394, shape-doctor.py: the manifest kinds row puts back a shape or leg pin under contracts/ that does not load with the git command pin_restore picks from its own state, shows a copy the shape pin has a row for or a neutral product pin with a read-only git diff, and leaves any other file to a person whatever it is called, so its NEXT no longer tells the reader to delete the pin (#291) #358 and adopt-project.py: Plan.__init__, allowed_empty_legs, names and open_source iterate or call .get on a hand-edited plan's pins:, allow_empty_legs:, paths:, legs: and source: without asking their type, so a scalar ends check and execute in a TypeError or AttributeError traceback, exit 1, and pins: openGlass passes check, adopts, and writes eight one-letter neutral-product pins that the project's own validate-pins.py refuses #386 conflict, each identically with main alone.

The report is handoffs/xFactory/attachments/lane-openRepoShape-2/review404-f9d420a/final-report.md in opensoft/brett-wip.

[brettheap]

(lane openRepoShape-2, 2026-10-12T17:38Z)

The nit round on this lane's review of f9d420a is pushed: fb521a4.

• Nit 1. test_a_holders_own_origin_not_utf8_is_read_as_make_siblings_reads_it, in tests/test_shape_doctor.py, has two cases: an absolute and a relative .gitmodules mount url, each with a holder whose own origin holds \xe9. Both fail at main 92e29d9's code, with a UnicodeDecodeError out of origin_url through mounted_from, and both pass at head. Four mutants of the holder route are killed.
• Nit 2. The body's "Composes with" is rewritten at main 92e29d9, against all 39 open heads.
• The review's two P3 follow-ups are filed: shape-doctor.py submodule_config reads a family holder's .gitmodules through git_out, which decodes strictly, inside except (Refusal, OSError), so a member url that is not UTF-8 raises a UnicodeDecodeError that run_checks does not catch and shape-doctor.py --root ends in a traceback, exit 1 (also the code of a finding), with no verdict, where validate-family.py and siblings.py read the same file as bytes or with errors="replace" #432 (submodule_config on a non-UTF-8 .gitmodules url) and scaffold-project.py and family.py init with --local-remote-dir under a directory whose name is not UTF-8 put that path into the clone URL they render into the new repositories' files, and write_lf (strict UTF-8) raises a UnicodeEncodeError traceback, exit 1, after the bare remotes exist (--dry-run exits 0), where adopt refuses an unwritable clone URL before any leg exists #433 (--local-remote-dir under a non-UTF-8 directory).

Tests at fb521a4

• 7 files: 523 passed, 4 skipped (Windows-only).
• Merged with main 92e29d9: 585 passed, 4 skipped.
• render-cli-reference.py --check is ok.

Details are in handoffs/xFactory/attachments/lane-openRepoShape-2/impl385-origin-url-not-utf8/fix-round-60c4.md in opensoft/brett-wip.

[brettheap]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T17:43:31.737525Z	fb521a4	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: fb521a4c4f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud