release.yml: the install check runs the doctor on macOS and Windows only over an empty repository and asserts neither its -S preflight child's report nor any validator child, so a child that cannot start under -S there passes the check #894

Goal: a release's install check fails on macOS or Windows when a child the doctor starts with -S cannot start there: the machine row's preflight, and the validators of a real shape root.

Filed by lane openRepoShape-3, from its triage of #461 at the v1.1.1 release commit 5017830. The item is lane 4's comment on #461 of 2026-10-16T11:39:33Z (R342's review of #636): "No CI job runs the real doctor's children on macOS or Windows."

State at 5017830.

• shape-doctor.py:1963 starts every child as [sys.executable, "-S", script, ...] (shape-doctor.py: run_validator starts a root's OWN validator under the doctor's interpreter with site processing on, so a .pth in the operator's user site or in a virtualenv's site-packages that names a directory holding repo_shape.py stands in for the copy the root lost, and the manifest row says ok ... passes for a gate that fails in CI on ModuleNotFoundError: the false pass #238 removed and #306 closes for PYTHONPATH alone #342, shape-doctor.py: every validator child starts with -S, so no .pth in the user's or a virtualenv's site-packages stands in for the repo_shape.py a root lost, and the manifest row is the gate's own ModuleNotFoundError (#342) #636).
• CI runs the suite on Linux only (.github/workflows/tests.yml:7-14, ci: run the test suite on Linux only #597). tests-git-bash runs on Windows with a stub doctor (tests/test_openreposhape_command.py:2748, STUB DOCTOR AT).
• The one real doctor run on macOS and Windows is release.yml's install check (matrix :893-902, step :1074-1097). It runs openRepoShape --doctor over an empty git init and asserts two things only:
  • exit 2;
  • that the machine row's git-filter-repo path is in the pipx environment. That path comes from the doctor's own shutil.which (shape-doctor.py:10597), not from the child.
• The child's exit and its [ok]/[!!]/[??] lines are kept in detail["exit"] and detail["report"] (shape-doctor.py:10608-10612), and nothing asserts them.
• No validator runs there, because an empty repository is NOT A SHAPE ROOT. tests/test_release_workflow.py does not hold this step.

Probe. Run on Linux at 5017830, under a stub gh exiting 97, with GH_TOKEN=bogus, an empty GH_CONFIG_DIR and GIT_CONFIG_GLOBAL=/dev/null, as shape-doctor.py --root <empty git repo> --json:

• Clean standard: exit 2, NOT A SHAPE ROOT, child exit 1 ("gh is not authenticated"), 6 report lines, git-filter-repo set.
• setup-project.py given import a_module_that_is_not_there after its __future__ line: exit 2, NOT A SHAPE ROOT, child exit 1, 0 report lines, reason ModuleNotFoundError: No module named 'a_module_that_is_not_there', git-filter-repo set.
• Both pass both of the step's assertions.

What happens. R342 reasoned, but did not measure, that -S costs no child an import on macOS (python.org framework and Homebrew builds) and on Windows (python.org and setup-python builds, and venvs through pyvenv.cfg's home). If that is wrong on one of them, every doctor row that runs a child reads as a crash there, and the release still passes its install check.

Direction.

1. In the doctor step, also assert that the machine row's detail.report is not empty. That shows the preflight child started under -S and printed its own lines.
2. Optionally, add a step that makes a shape root without GitHub and runs openRepoShape --doctor over it, asserting that no validator row reads "crashed before reaching a verdict". One way to make the root is scaffold-project.py --local-remote-dir through the installed commands.
3. Hold the step's text in tests/test_release_workflow.py.

Verify. Make a rehearsal run of release.yml on a branch. The new assertion passes on all three OSes, and fails on a branch whose setup-project.py imports a module that does not exist.

Size: S for the assertion alone (release.yml and tests/test_release_workflow.py); M with the scaffolded root.

Lane: openreposhape-3 (openRepoShape-3)