adopt-project.py: execute writes each neutral_product_pins: entry bare, so plan --pin 007@<commit> says adoption verified over a root whose own validate-pins.py refuses entry 7 #514

Lane: openreposhape-2 (openRepoShape-2)

(lane openRepoShape-2, 2026-10-13T12:43Z) This lane's review of #435 (at 2795063) found this, and it is filed on Brett Heap's word ("file L2-10 as a v1.0.0 issue", 2026-10-13T12:42Z). It replaces checklist item L2-10 on #457, its parent.

The state. A person adopts with plan --pin <product>@<commit> --pin-source <clone>, and YAML reads the product name as a number: 007, 2026 or 1.5.

What happens.

• plan writes the pin with the product quoted, product: "007" (adopt-project.py --pin <name> is accepted by plan, check and execute ("adoption verified"), but writes only the name into neutral_product_pins: and no contracts/<name>-pin.yaml, so the adopted root's own validate-pins.py (and its validate.yml) refuses with neutral-pin-missing from the first run #273's _pin_lines), and check says plan ok.
• execute adopts, writes contracts/007-pin.yaml, and prints adoption verified, exit 0.
• It renders the root's project.yaml with each product bare, neutral_product_pins: then - 007 (adopt-project.py:6784-6785 at main 47b1e06). The project's YAML reader reads that back as the number 7, and reads 2026 and 1.5 back as numbers too.
• In the adopted root, scripts/validate-pins.py --root . exits 1 with FINDING neutral-pin-entry-malformed: project.yaml neutral_product_pins entry 7 is not a non-empty product name. validate-manifest.py says manifest ok. The root's validate.yml runs validate-pins.py, so the adopted project's first CI run is red.

Why v1.0.0. Brett Heap's word. The run says adoption verified over a root that its own validator refuses. Only a product name that reads as a number reaches it, and no open<Product> name does. But plan accepts such a name and check passes it.

Fix direction.

• Render each neutral_product_pins: entry quoted, the way templates: project.yaml, the leg pins and family.yaml quote their text placeholders, so --id 007, --tracking-branch 2026, --spec-path true or --org null read back as typed, and family.py add quotes a member id alike (#259) #395 quotes the templates' text placeholders, so the reader gets back the text plan wrote. Use the quoting the module already has for YAML scalars.
• Leave every other line of the rendered manifest byte for byte as it is.

How to test.

• For 007, 2026, 1.5 and openGlass, run plan --pin <name>@<commit> --pin-source <a local clone>, then check and execute. In each adopted root, assert two things:

  • scripts/validate-pins.py --root . and scripts/validate-manifest.py --root . both exit 0;
  • neutral_product_pins: reads back as the text given.

  The first three cases are red on main.

• The review's probe is review435-27950638/tools/pin007.sh.

The scaffold side. scaffold-project.py:1259-1260 renders the same list the same way, "\n".join(f" - {p}" for p in pins). That is L2-11 on #459. It was read from the code and not run, so whether the scaffold's --pin accepts a product name that reads as a number has not been checked.

Evidence: handoffs/xFactory/attachments/lane-openRepoShape-2/review435-27950638/ in opensoft/brett-wip (fix-list.md O1, tools/pin007.sh, tools/o1-pin007-head-2795063.log).

Related: #273, which writes the quoted product:; #395, which quoted the text placeholders but not this list; #457, the parent.