Repository navigation
validate-family.py, validate-pins.py and both bootstrap.py copies: a git Windows cannot start for a reason other than 193 that names no file (winerror 216, 1260, 11, or 188-202) is git-not-runnable, exit 2, with the put-git-on-PATH remedy, where each ended in a traceback, exit 1 (#1040) - #1062
Merged
Merged
Conversation
…`git` Windows cannot start for a reason other than 193 that names no file (`winerror` 216, 1260, 11, or 188-202) is `git-not-runnable`, exit 2, with the put-git-on-PATH remedy, where each ended in a traceback, exit 1 (#1040) #1001 (#1028) made the four copies of the `git-not-runnable` rule count a nameless `OSError` whose `winerror` is 193, a `git.exe` Windows cannot execute. Windows has other `CreateProcess` failures that mean git itself could not be started, and each names no file and is neither `FileNotFoundError` nor `PermissionError`, so all four copies passed it through and the run ended in a traceback, exit 1, as 193 did before #1001. RV1028 raised this as its SHOULD 1. Read from CPython 3.12's `PC/errmap.h` (main's is the same for these codes), with each code's words from Microsoft's System Error Codes: - 216 (`ERROR_EXE_MACHINE_TYPE_MISMATCH`), a `git.exe` built for another architecture, and 1260 (`ERROR_ACCESS_DISABLED_BY_POLICY`), one that AppLocker or a software restriction policy blocks: no case, so `EINVAL`, a plain `OSError`. - 11 (`ERROR_BAD_FORMAT`) and 188 to 202 other than 193: the rest of the `ENOEXEC` family, a program Windows cannot load, a plain `OSError`. - 267 (`ERROR_DIRECTORY`), a `cwd` that is not a folder: `ENOTDIR`, a nameless `NotADirectoryError`. It is not git's, and still passes through. The rule, the same text in all four (`_git_runs` in both validators and in the assembly root's bootstrap.py, `git_not_started` in the holder's): nameless = (exc.filename is None and (isinstance(exc, (FileNotFoundError, PermissionError)) or getattr(exc, "winerror", None) in (11, *range(188, 203), 216, 1260))) if exc.filename != "git" and not nameless: The code list is written in the expression, not in a module constant, so `test_the_four_copies_are_one_text`, which compares the rule's AST in the four, holds the list itself to one text. Only the list changed: a named error still counts only where it names `git`, and a nameless `EIO`, `ENOMEM`, an `ENOEXEC` with no `winerror`, and a 267 pass through. Each copy's docstring says which codes count and why, and that 267 does not. Tests: - tests/test_validate_pins_without_git.py: `win_error(winerror, number, words)` builds what CPython raises on Windows; `WIN_ERROR_193` is built by it, beside `WIN_ERROR_216` and `WIN_ERROR_1260`, which the no-git run takes in every run; `NOT_GIT` gains a nameless `winerror-267`, passed through at each call. - tests/test_validate_family_git_not_runnable.py: parity rows `winerror-216` and `winerror-1260` (which the per-call rows take too), `winerror-11` and `winerror-188` to `winerror-202` (`NOT_LOADABLE`, asked of the four copies alone: each is 193 but for its `winerror` and words), all `git-not-runnable`, and `winerror-267`, passed through by all four; each copy's own script is run where every start of git raises 216 as well as 193: exit 2, the refusal, the copy's remedy, no traceback. - tests/test_bootstrap_without_git.py: the `sitecustomize` shim is built by `git_raising(error)`; `GIT_NOT_WIN32` raises 193 as before, and `GIT_FOR_ANOTHER_MACHINE` raises 216; the upstream notice's no-git row takes 216 too; each root's rule counts 216 and 1260 and passes a nameless 267 through. #1028's NIT 3: `answer`'s docstring in tests/test_validate_family_git_not_runnable.py named `fetch_members` as the call site of the holder's `git_not_started`. #954 moved that call into `started()`, with the same three lines `answer` copies, so only the name was stale; it now says `started`. All four files are pinned copies, as in #1028: an assembly root takes `upstream-changed` rows for scripts/validate-pins.py and scripts/bootstrap.py, a holder for scripts/validate-family.py and scripts/bootstrap.py. Nothing new is imported from repo_shape.py. Not run on Windows: the codes, their classes and their words are read from CPython and Microsoft's documentation, and the errors are built by hand, as #1001's 193 is. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reviewer's GuideThe PR updates all four pinned git-runnability rules so nameless Windows failures indicating that git itself could not start—including winerror 11, 188–202, 216, and 1260—produce the existing git-not-runnable refusal with exit 2 and the put-git-on-PATH remedy instead of a traceback, while retaining correct filtering for directory and unrelated errors. Cross-platform tests construct the relevant Windows errors and validate classifier parity, end-to-end refusal behavior, pinned-copy consistency, and unchanged pass-through semantics. Flow diagram for Windows git startup error classificationflowchart TD
A["git startup raises OSError"] --> B{"filename is git or absent?"}
B -- "No" --> P["Pass through unchanged"]
B -- "Yes" --> C{"Nameless Windows startup error?"}
C -- "Yes: FileNotFoundError, PermissionError, or winerror 11, 188-202, 216, 1260" --> R["Refusal: git-not-runnable"]
C -- "No" --> P
R --> E["Exit 2 with put-git-on-PATH remedy"]
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
Author
|
(lane openRepoShape-4, 2026-10-20T16:10:05Z) RV1062 review of #1062 at 01a8b75: NOT READY - two SHOULDs, both list-and-test only: add 4551 to the code list, and one negative row that holds the list exact. SHOULDS1. 4551 (ERROR_SYSTEM_INTEGRITY_POLICY_VIOLATION) is missing. The rule tuple is at templates/family-root/scripts/validate-family.py:358, templates/assembly-root/scripts/validate-pins.py:825, templates/family-root/scripts/bootstrap.py:639 and templates/assembly-root/scripts/bootstrap.py:346.
S2. Nothing holds the list exact beyond 267. The issue's Direction says "an EXACT set ... Never any nameless OSError". The only negative row with a
NITN1. Newer CPython names the file. CPython main (3.16.0a1+dev, gh-119646, commit 40edefa348 of 2026-09-23) now names the failing program on Windows CreateProcess errors:
3.13, 3.14 and 3.15 do not. The rule still holds there:
But the docstrings' "Windows' The codes (check 1)All from Microsoft's System Error Codes pages (0-499, 1000-1299) and CPython
Python's view (check 2)
Pinned copies (check 3)
Tests (check 4)
Merges (check 5)
Checks (check 6)At 16:10Z:
Scope: nothing outside the four copies' code list (with the docstring beside each) and its tests needs to change. S1 adds one code to the list, and S2 adds test rows only. Lane: openreposhape-4 (openRepoShape-4) |
Main moved past eee089c: #1045 (00f6d7f) changed the holder's bootstrap.py and #1025 (6476c17) changed validate-family.py, two of the four copies of the git-not-runnable rule. The merge is clean, and the four copies' rule is still one text. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…`git.exe` App Control for Business blocks (`[WinError 4551]`) is `git-not-runnable` too, and two rows hold the code list exact (#1040) RV1062's S1: 4551 (`ERROR_SYSTEM_INTEGRITY_POLICY_VIOLATION`) is App Control for Business (WDAC) or Smart App Control refusing to start an image, the kind of block 1260 is for AppLocker and software restriction policies. CPython 3.12.10 raised it from `_winapi.CreateProcess` as a plain `OSError` naming no file (ROCm/TheRock issue 2607: `OSError: [WinError 4551] An Application Control policy has blocked this file`), and `PC/errmap.h` has no case for it, so it is `EINVAL`, as 216 and 1260 are. Every copy passed it through, and the run ended in a traceback, exit 1. The four copies, still one text: in (11, *range(188, 203), 216, 1260, 4551) Each copy's docstring names 4551 beside 1260, and says any other `winerror` passes through. RV1062's S2: nothing held the list exact beyond 267, so a rule counting any nameless `winerror` but 267 (RV1062's mutant A, `not in (None, 267)`) passed every row. `NOT_GIT` gains two nameless `CreateProcess` failures that say nothing of git, `winerror-87` (`ERROR_INVALID_PARAMETER`, `EINVAL`, the class 216, 1260 and 4551 arrive in) and `winerror-8` (`ERROR_NOT_ENOUGH_MEMORY`, `ENOMEM`), each passed through: by the parity in all four copies, at each of validate-pins.py's and validate-family.py's three calls, and by each root's own rule. Tests: - tests/test_validate_pins_without_git.py: `WIN_ERROR_4551`, which the no-git run takes in every run; `NOT_GIT` gains `winerror-87` and `winerror-8`. - tests/test_validate_family_git_not_runnable.py: `winerror-4551` in `WILL_NOT_START`, so a parity row and the per-call rows, as 1260 has; `winerror-87` and `winerror-8` arrive through `NOT_GIT`. - tests/test_bootstrap_without_git.py: each root's rule counts 4551 and passes a nameless 87 and 8 through. Words from Microsoft's System Error Codes (87, 8) and from the CPython traceback in ROCm/TheRock issue 2607 (4551); the name 4551 from mingw-w64's winerror.h. Not run on Windows. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
(lane openRepoShape-4, 2026-10-20T17:34:58Z) W1040 round 2 at 957ba03: Main. Main moved past eee089c: #1045 (00f6d7f) changed the holder's bootstrap.py, and #1025 (6476c17) changed validate-family.py. I merged origin/main in with a merge commit (710e32b), not a rebase. The merge was clean, and the four copies are still one text. S1 (4551), commit 957ba03.
S2 (an exact set).
Counts.
Mutants. I ran 8 mutants in one background script. After each one, every copy was restored, its sha256 matched, and
Merge-trees.
N1. No code change. The PR body names it as a known follow-up. Body. I updated the counts and the mutant tables, and Lane: openreposhape-4 (openRepoShape-4) |
Contributor
Author
|
(lane openRepoShape-4, 2026-10-20T17:46:07Z) RV1062 re-check of #1062 at 957ba03: READY at 957ba03. This holds only once CI S1 and S2 are resolvedS1 (4551).
S2 (an exact set). Nameless My mutants on 957ba03. Each was applied to all four copies and run against the three rule files without the 11 child runs. After each one the tree was restored and matched the head.
The merge commit (710e32b)
Tests on 957ba03Python 3.12.3 and git 2.43.0, with:
Results:
Merge-trees of 957ba03
#1067 is the only open PR that touches the four copies or the three rule tests. In both merged trees the four rules are one text and hold 4551. Checks on 957ba03
NIT
Scope: nothing outside the four copies' code list (with the docstring beside each) and its tests changed or needs to change. Lane: openreposhape-4 (openRepoShape-4) |
This was referenced Oct 20, 2026
brettheap
added a commit
that referenced
this pull request
Oct 20, 2026
…fore an `=` that leaves a path, as a `--link-source` key is since #980, so `open=y=<path>` verifies the pin `open=y` and `open=y=` is refused as naming no path (#1053) (#1067) Found by lane 5's independent review of #1044 (#980), rv980, and filed as #1053. Two commits on origin/main `6476c170` (made on `8a057215`; the rebase was clean and `docs/cli.md` needed no regeneration): `2e6dd9e5`, the change, and `7ff61666`, fix round 1 (rv1067's SHOULD-1: one more test row, no code). Five files change (+396, -52): `templates/assembly-root/scripts/validate-pins.py`, `scripts/validate-repository-naming.py`, `docs/cli.md`, `tests/test_neutral_pin_validator.py` and `tests/test_link_source_chain_defaults.py`. Both scripts are pinned copies (`COPIED_VERBATIM` and `COPIED_FROM_SHAPE`), so every existing root takes two `upstream-changed` rows, `scripts/validate-pins.py` and `scripts/validate-repository-naming.py`, and re-pins. No digest of either file is kept anywhere in `tests/`: the texts that pin the help and the docstrings are held by `test_cli_reference.py` (regenerated) and `test_pinned_copy_text.py` (runtime), and both pass. `validate-pins.py` reads a `--pin-source` key as the naming gate has read a `--link-source` key since #980 (the longest declared pin before an `=` that leaves a path after it), so a pin whose name holds `=` can be a key, and the sentence saying the two copied tools read `[PRODUCT=]PATH` one way is true. This is consistency, not a live failure. No scaffold writes a pin holding `=` (`PIN_ARG_RE` admits `[A-Za-z0-9_.-]`), only a hand-edited `project.yaml` declares one, and a pin's digest stops a wrong source from passing: a wrong tree is a finding and never a pass. `PinSources.__init__` cut every value at its FIRST `=` (`typed.partition("=")`), and two more places cut at the first `=` on their own: the no-path refusal and `read_as_path`. - With `open=y` declared, `--pin-source open=y=<tree>` was a bare PATH that is not there: the `neutral-pin-source-unreadable` FINDING, exit 1. - With `open` and `open=y` both declared, `open=y=<tree>` was `open`'s, with the path `y=<tree>`. `open=y` read neither value, and of `open=<a>` and `open=y=<b>` the later replaced the earlier. - `open=y=` was a bare PATH, where `openGlass=` is refused `pin-source-no-path` (#442). - **`PinSources._read_source(typed)`** (new, `validate-pins.py`), returning `(product, before, path)`. It reads a key as the naming gate's `LinkSources._read_source` reads a link: the LAST `=` whose text names a declared pin by `pin_product_key`, with a non-empty path after it, ends the key. The key is read whole (never stripped, never cut at a `/`) and the pin is spelled as `project.yaml` spells it. A value that ends at a declared pin, with no shorter one leaving a path, is that pin's with an empty path. Anything else is a bare PATH, whole. - **`__init__`, the no-path refusal and `read_as_path` all use it**, so nothing cuts at the first `=` on its own. `self.names` (was a local) is the table it reads against. `read_as_path` keeps its words (#1054's wording improvement is out of scope): the text it names is `_read_source`'s `before`, which for a bare value is the text before the first `=`. - **Words made true:** the `PinSources` docstring (THE READING, the no-path paragraph, a new "THE TWO COPIED TOOLS READ `[PRODUCT=]PATH` ONE WAY" paragraph that now holds with no exception), the `--pin-source` help, and `docs/cli.md` regenerated from it by `scripts/render-cli-reference.py` (only that option's block changed). - **Item 5, the gate's `LinkSources` docstring** (`scripts/validate-repository-naming.py`, the only change in that file): the "still ends a key at the first `=`" sentence is gone, and so is the `casefold()` passage (false since #712: both tools key by `pin_product_key`) and the "one way OVER ASCII ONLY (#444)" clause. Four lines say what is true, and name `PinSources._read_source` (#1053). - **Tests, 17 new rows:** 14 in `tests/test_neutral_pin_validator.py` beside the #295 rows (section "#1053"), and 3 in `tests/test_link_source_chain_defaults.py` beside the #442 rows. A pin holding `=` cannot be scaffolded, so each row hand-writes the `neutral_product_pins:` entry and its pin file with the helper `declare_by_hand` (the link file imports it). The existing #442 row now builds its expected stderr through a shared `pin_source_no_path` helper, with the same assertion. The rows: - a declared pin `open=y` verified by `--pin-source open=y=<tree>`, as declared and in capitals; - `open` and `open=y` both declared, each given its own tree, in either order, and with a path that begins like the longer pin (`open=./y=dir`): both verify, neither replaces the other; - `open=y=` with `open` declared too is `open`'s, with the path `y=`, never refused; - `open=y=` and `OPEN=Y=` with only `open=y` declared are refused `pin-source-no-path`, exit 2, in `openGlass=`'s words; - a value naming no declared pin (a leading blank, an owner prefix, `open=z=x`) is a bare PATH, whole, and so is one that ENDS in an `=` no declared pin names (`open=z=`, rv1067's SHOULD-1), never refused and never read as a pin's; - the note for a bare value names the text before its first `=`; - a keyed `OPEN=Y=<tree>` names the pin as the manifest spells it, `open=y`, where the digest was never recomputed; - the old split's corners, `openGlass==x` and `openGlass= `, are still `openGlass`'s. `PinSources(values, declared)`, read at `8a057215` and at the head (`probe-base.log`, `probe-head.log`): declared [open=y], value open=y=/p at 8a05721 reading {'open=y=/p': None} (a bare PATH) with this reading {'open=y=/p': 'open=y'}, keyed to open=y with the path /p declared [open, open=y], values open=y=/p then open=/q at 8a05721 both 'open'; keyed {'open': ('open=/q', '/q')}, open=y read nothing with this {'open=y=/p': 'open=y', 'open=/q': 'open'}, each pin its own declared [open=y], value open=y= at 8a05721 a bare PATH, no refusal with this REFUSED pin-source-no-path controls, the same at both: openGlass= REFUSED pin-source-no-path; openss= with a declared open + sharp s is a bare PATH; ' open=y=x', 'opensoft/open=y=x' and 'open=z=x' with open=y declared are bare PATHs, whole. The final test files copied onto a clone of `8a057215`, the 17 new rows: **11 failed, 6 passed.** Each failure is on the defect (the source read as a bare PATH, or `open=y` read none). The 6 that pass pin readings that did not change, by design: the four bare-PATH rows (a leading blank, an owner prefix, no declared pin, and a value that ends at no declared pin) and the two old-split corners. The base and the head copies of `validate-pins.py` were run with `--root`, over the same root and directory, comparing stdout, stderr and exit code: 7 pin lists, none holding `=` (one pin, two, none, capitals, a sharp s, one variable, a scalar), and 40 values singly plus 182 ordered pairs of 14 values (capitals, a leading blank, an owner prefix, `./openGlass=x/openGlass`, the #295 rows' values). **1554 runs, 0 differing**; the head's exit codes were 0 (502), 1 (1037) and 2 (15). The rebase did not touch `validate-pins.py`. Each applied alone to a scratch tree's copy of the change, run against the three files that exercise `PinSources` (`test_neutral_pin_validator.py`, `test_link_source_chain_defaults.py`, `test_validate_pins_named_and_spelled.py`), through `run9.sh`. **17 of 18 killed; the 18th is equivalent.** The counts are the passes and fails of 408 tests (the files as of `2e6dd9e5`); R5, and M1, M2 and M16a rerun on the final files (409 tests), are noted under the table. | mutant | result | failed / passed | killed by (a few) | |---|---|---|---| | M1 back to `typed.partition("=")` | killed | 11 / 397 | the own-key, shorter-pin and both-declared rows | | M2 the shortest match instead of the longest | killed | 5 / 403 | the shorter-pin and both-declared rows | | M3 the "leaves a path after it" check dropped | killed | 1 / 407 | the shorter-pin row | | M4 the key stripped | killed | 1 / 407 | the bare-PATH row (a leading blank) | | M5 the key not folded by `pin_product_key` | killed | 21 / 387 | the capitals rows, the #295 rows | | M6 the no-path refusal back to its own first-`=` cut | killed | 2 / 406 | the two `open=y=` refusal rows | | M7 `read_as_path` back to `typed.partition("=")[0]` | survived | 0 / 408 | none: equivalent, below | | M8 `before` the longest text tried, not the shortest | killed | 8 / 400 | the note row, the corners row | | M9 the empty-path fallback dropped | killed | 10 / 398 | the refusal rows | | M10 the fallback keyed at the first `=` | killed | 2 / 406 | the two `open=y=` refusal rows | | M11 the key cut at its last `/` | killed | 2 / 406 | the owner-prefix row, the directory row | | M12 the keyed path read after the first `=` | killed | 8 / 400 | the both-declared and own-key rows | | M13 the scan skips an adjacent `=` | killed | 1 / 407 | the `openGlass==x` corner | | M14 a blank path names none | killed | 1 / 407 | the `openGlass= ` corner | | M15 the no-path refusal strips the path | killed | 1 / 407 | the `openGlass= ` corner | | M16a the keyed pin spelled as typed | killed | 2 / 406 | the manifest-spelling row | | M16b the no-path pin spelled as typed | killed | 2 / 406 | the capitals refusal rows | | R5 (rv1067's) the `if product is not None:` guard dropped from the empty-path fallback | killed, after the fix; it survived all 408 tests at `2e6dd9e5` | 1 / 408 | the bare-PATH row `ends-at-no-declared-pin` | **R5 and the fix round.** rv1067's mutant R5 returns `product, typed[:-1], ""` for every value ending in `=`, so `--pin-source open=z=` with `open=y` declared (or `x=`, `../build=` with `openGlass`) ended in an `AttributeError` traceback in `_shown(None)`. It survived because no row held a bare PATH ending in `=`. `7ff61666` adds the fourth value `open=z=` (id `ends-at-no-declared-pin`) to `test_a_value_naming_no_declared_pin_is_a_bare_path_whole`: it passes at `8a057215` and at the head, by design, and fails under R5 (1 failed, 408 passed). Rerun on the final files (409 tests): M1 killed 11 / 398, M2 killed 5 / 404, M16a killed 2 / 407. The code is unchanged by the round. **M7 is equivalent.** `read_as_path` says anything only for a value no declared pin is keyed to, and for such a value the scan's last turn is at the value's first `=`, so `_read_source`'s `before` IS the text before the first `=`: the two spellings print the same words for every value. Not a gap. At the committed head `2e6dd9e5` (the 88-file shards below; `7ff61666` changes one parameter of one test, run next), through `run9.sh` (gh stub first on PATH, `GH_TOKEN=bogus`, an empty `GH_CONFIG_DIR`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`, no `LANES_*` variable): - **git 2.43.0** (`/usr/bin/git`): the 88 test files that name `validate-pins` or `validate-repository-naming`, which include the three mutant files, `test_chain_remedy_callers.py`, `test_pinned_copy_text.py` and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`), in four shards: **1376 passed, 4 skipped; 1702 passed; 1963 passed, 2 skipped; 1812 passed, 6 skipped. 6853 passed, 12 skipped, 0 failed.** - **git 2.47.1** (exactly `$Q/v115/w764/git247/bin/git`, first on PATH): the three mutant files: **408 passed.** - **At `7ff61666`:** the three mutant files, **409 passed on git 2.43.0 and 409 passed on git 2.47.1.** - The rest of the suite is left to CI's `tests` job. From a root scaffolded at `8a057215` (`scaffold-project.py` with local remotes, cloned with submodules), `update-shape.py` at the head: - `check --at 2e6dd9e` lists `upstream-changed` for `scripts/validate-pins.py` and `scripts/validate-repository-naming.py` (`upstream-changed 2, unchanged 9`); - `apply --yes --branch shape/update-2e6dd9e56eb8` exits 0, copies both files, re-pins `8a0572157723 -> 2e6dd9e`, and the root's own validators print `pins ok` and `manifest ok: Atlas (atlas), 3 legs`; - a fresh `check` prints `unchanged 11` and `nothing to do`; the root's two copies are byte for byte the head's (sha256 `adc1f7d8...` and `fc5c9f81...`). `git merge-tree --write-tree` of the head `7ff61666` against: origin/main `9cbba9d5` clean (tree `d776b7d7`), and the one open PR that still touches one of these files, #1062 (`fix/1040-windows-start-errors`, `957ba038`, which edits `validate-pins.py` around `_git_runs`, not the `PinSources` region) clean (tree `aa6fc31b`). #1063 (`d996ebf1`, `docs/cli.md`) is no longer in the open list. At `2e6dd9e5` the same three were clean against `00f6d7f7`, #1062 `01a8b759` and #1063. Since the rebase main has changed `docs/cli.md` (8 lines added, 2 removed, outside the `--pin-source` block) and none of the other four files, and the merge-tree against it is clean, so the branch needs no rebase. Review: rv1067, lane 5's independent reviewer, not the writers (w1053 and f1053): READY at `2e6dd9e5` (issuecomment-6297358113) with no MUST; its SHOULD-1 was taken in one new commit, and the re-check is READY at `7ff61666` (issuecomment-6297678467), with no MUST or SHOULD. CI (Brett Heap's ruling 27 and his fast-refresh ruling of 2026-10-15T22:48:35Z): H0 7ff6166 passed tests, tests-git-bash and SonarCloud; the head 5bc0d30 is a clean update-branch merge of main 6c86163, with tests-git-bash and SonarCloud green; and the local gate passed on its predicted squash tree 9a936b7 over main 6c86163: the link_source_chain_defaults, neutral_pin_validator, repo_hygiene, agents_md_codes, cli_reference sets, 235 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #1053 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 20, 2026
brettheap
added a commit
that referenced
this pull request
Oct 20, 2026
…a signal fails the run by name wherever the update met it, read from git's trace, not only where its code is the update's last; with a token in use that stays a limit (#1056) (#1076) Where a git that git's update ran dies of a signal, `make bootstrap` in a family holder now fails naming it wherever the update met it, not only where the signal's code is the update's last. This is #1056, found by rv996, lane 5's independent review of #1045 (issuecomment-6288783192, checklist candidate 1). Git keeps only the last code that is not 0 (`update_submodules` in git 2.47.1's `builtin/submodule--helper.c`), and only 128 stops it. So a member's crash or kill before a later gitlink's 128 or 1 left no signal in the update's exit code, and #1045's `ended_on` saw none: the run said the credential advice and `family bootstrap ok`, exit 0, with IRRS's legs never updated. One commit, on main `00f6d7f7` (which holds #1045 and #1023). It changes two files: the family root's `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py`. ### The signal is read from git's own trace (no token in use) - With no token in use, git's update is already traced into a directory of the run's own (#892). `traced_in` now reads that trace once and returns a `Trace`: `fetched` (#892's work trees, as before) and `died`, read by the new `died_in`. - **`died_in`** reads the events by the code, never git's words, as #892 reads a fetch: - a git writes a `child_start` event (with the argv) and a `child_exit` event (with the code) for each child it starts; - `child_of` pairs the two by the writing git's `sid` and the `child_id`; - a `child_exit` whose code is `128 + N`, N below `signal.NSIG` (`died_of`, now shared with `ended_on`), for a child whose argv begins `git` (`git_child`), is a git dead of signal N; - a hook or another program is not counted. Its code is its own: a `post-checkout` hook that exits 137 is no signal, and `git checkout` exits 1 over it (measured, both gits). - **The first signal** is the first by the time each event gives, which is the order git met them. Where trace2 gives no time (its brief form), it is the order of the files and their lines. - File order alone would name the wrong one. The files go in the order their gits started, so a member's own update comes after git's update's file. - Measured on both gits: SIGKILL at IRRS's `code` leg, then SIGTERM at its `spec` leg. That ended IRRS's own update 143, and git's update's `child_exit` 143 for it came first in the files. - **`signal_met`** chooses what (a) tells: - where git's update exited 0, nothing; - else the trace's first signal, where there is one; - else the update's own exit code, through `ended_on` as #998 reads it (`128 + N`, or `-N` where git itself was killed). - **Nothing where the update exited 0.** It did all it set out to do then, whatever a git it ran died of on the way. Measured on both gits: a `reference-transaction` hook killed IRSS's `git fetch` after it wrote the branch, git found the commit reached, checked it out and exited 0. The run says every member and leg was fetched, as before. ### What the run says - Where the signal's code is the update's own, the line is #998's, word for word, so the controls read as before: ``` UPDATE KILLED, and not for want of a credential: git's update ended on signal 9 (SIGKILL, exit 137), which a git it ran died of. Git's own words above say which git and where. family bootstrap FAILED: git's update (ended on signal 9) ``` - Where the trace gave it and the update ended with another code: ``` UPDATE KILLED, and not for want of a credential: a git that git's update ran died of signal 9 (SIGKILL, exit 137), and git's update went on and ended with exit 128. Git's own words above say which git and where. family bootstrap FAILED: git's update (a git it ran died of signal 9) ``` - No credential advice in either case (`credential_advice`). ### A signal and B4 both told: the signal first - Before, `fetch_members` returned one failure line, the signal's or the walk's stop's. Now `told_past` says each that is there, each with its own failure line. - Where both are told, **the signal is said first**. Why: - It is git's order. A death past the holder's records (128) ends git's update, so git met the signal at an earlier gitlink and went on past it. - Git's own words, printed just above, say them in that order too. - The two cures do not depend on each other. - Measured: the killed checkout in IRRS, then B4 at IRSS, with the credential. Before, the B4 line alone was said. Now: ``` UPDATE KILLED, and not for want of a credential: a git that git's update ran died of signal 9 (SIGKILL, exit 137), and git's update went on and ended with exit 128. Git's own words above say which git and where. UPDATE STOPPED, and not for want of a credential: git stopped at members/IRSS, whose fetch reached its remote and did not bring <commit>, ... family bootstrap FAILED: git's update (a git it ran died of signal 9), members/IRSS (git stopped at it) ``` - A `NOT CHECKED OUT` row or a whole-holder stop (`unfetchable`, `updated_none`) still comes first and alone, as for #998's signal (mutant S7's order is unchanged). ### With a token in use: the limit, said and pinned The issue offered two ways. I measured both, and chose to say the limit and pin it with a row. | measured (killed checkout, then IRSS's pin moved on, the token's fake value) | git 2.43.0 | git 2.47.1 | |---|---|---| | a directory trace target with the token's `-c` in argv: events holding the token | 1 (the top git's `start` argv) | 1 (the same) | | the rewrite given in the environment instead, IRSS's origin an https url through a refused local proxy: events holding the token | 8 (the remote helper's `start` and `child_start` events give the url) | 0 | | an `af_unix:dgram:` socket target read by a thread, in memory | 189 datagrams, 1 holding the token, the `child_exit` 137 for `git checkout` there; no file | 194, 1, the same; no file | So: - **Any file target writes the token**: in argv on both gits, and, moved to the environment, in git 2.43.0's remote helper url. - **Git's one target that is no file, a Unix socket, works**, but this PR does not take it: - this process would have to read it for the whole update, and every git the update starts waits on it once Linux has queued 10 events (`net.unix.max_dgram_qlen` is 10 here), so a stalled reader hangs `make bootstrap`; - the socket's path must fit in the 107 bytes Linux takes. This harness's TMPDIR is 151 bytes, and a socket path under this session's scratchpad (114 bytes) was refused (`AF_UNIX path too long`); - git for Windows builds without it (read, not run). It would be a second trace mechanism, and is better as its own issue if wanted. - **What the docstrings now say:** - `ended_on`: with a token in use the exit code is all there is, and a signal before a later failure is not told. - `credential_advice`: the limit and the measurement. - `run_update`: points at both. - **The row:** `test_with_a_credential_in_use_a_signal_is_told_only_from_git_s_code`. - `[alone]`: the killed checkout alone is named, from git's own 137. - `[then-pin-moved-on]`: the killed checkout, then IRSS's pin moved on with the transport refused, is the credential's skip, the advice and ok. - Both: the token is in no output and no file under TMPDIR, with every caller trace on. ### Two docstrings corrected - `ended_on`: git's update ends with a signal's code only where no gitlink after it fails, since it keeps the last code that is not 0. (It said the update "ends with that code".) - `credential_advice`: a failed fetch does not always end the update with 128. A clone that fails gives 1 and the update goes on (rv996's NIT 2 on #1045), so the advice is dropped beside a signal even where a credential was also wanting. The run fails on the signal, and a run made again says the advice. (It said an update ending `128 + N` "met none".) - The module docstring's (a) and (c), `fetch_members`, `run_update`, `fetched_in`, `GIT_DIED`, `UPDATE_KILLED` and `TRACE_ENV` say the same. The probe is a pytest file kept out of the commit. It builds each state with `tests/test_family_bootstrap_stops_named.py`'s own helpers, runs the family root's `bootstrap.py --skip-members` (offline), and records the exit code, whether the credential advice is said, and whether the fake token is in any output or any file under TMPDIR. It also runs git's own update, traced, on a copy of the same state with no token. It was run at main `00f6d7f7` and at this head, on git 2.43.0 (`/usr/bin/git`) and on git 2.47.1 (a local build, first on PATH). Each cell is the verdict, the signal said, and the exit code: | state (in IRRS, then in IRSS) | main 2.43.0 | head 2.43.0 | main 2.47.1 | head 2.47.1 | |---|---|---|---|---| | killed checkout, then IRSS's pin moved on, no credential | ok + advice (0) | FAILED signal 9 (1) | ok + advice (0) | FAILED signal 9 (1) | | killed checkout, then IRSS's checkout refused, with the credential | ok + advice (0) | FAILED signal 9 (1) | ok + advice (0) | FAILED signal 9 (1) | | killed checkout, then B4 at IRSS, with the credential | FAILED + B4 stop (1) | FAILED signal 9 + B4 stop (1) | FAILED + B4 stop (1) | FAILED signal 9 + B4 stop (1) | | control: killed checkout alone, with the credential | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | | P3, then IRSS's pin moved on, no credential | ok + advice (0) | FAILED signal 11 (1) | ok + advice (0) | ok + advice (0) | | P3, then B4, with the credential | ok + advice (0) | FAILED signal 11 (1) | ok + advice (0) | ok + advice (0) | | control: P3 alone, with the credential | FAILED signal 11 (1) | FAILED signal 11 (1) | ok + advice (0) | ok + advice (0) | | a hook that exits 137 (no signal), then IRSS's pin moved on, no credential | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | | a hook that exits 137, alone, with the credential | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | | SIGKILL at IRRS, then SIGTERM at IRSS, with the credential | FAILED signal 15 (1) | FAILED signal 9 (1) | FAILED signal 15 (1) | FAILED signal 9 (1) | | SIGKILL at IRRS's `code` leg, then SIGTERM at its `spec` leg, with the credential | FAILED signal 15 (1) | FAILED signal 9 (1) | FAILED signal 15 (1) | FAILED signal 9 (1) | | the same two legs, then IRSS's pin moved on, no credential | ok + advice (0) | FAILED signal 9 (1) | ok + advice (0) | FAILED signal 9 (1) | | token in use: killed checkout, then IRSS's pin moved on | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | | token in use: killed checkout alone | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | FAILED signal 9 (1) | | token in use: killed checkout, then B4 | FAILED + B4 stop (1) | FAILED + B4 stop (1) | FAILED + B4 stop (1) | FAILED + B4 stop (1) | | token in use: killed checkout, then IRSS's checkout refused | ok + advice (0) | ok + advice (0) | ok + advice (0) | ok + advice (0) | Read across the table: - **Every no-token row of the probe that holds a signal now fails naming it, with no advice** (the rows that said `ok` with the advice, and the one that named SIGTERM): both killed-checkout rows (pin moved on, checkout refused) on both gits, and P3 (then IRSS's pin moved on, then B4) on git 2.43.0. P3 on git 2.47.1 is not a crash there (git refuses the line and exits 128, so nothing is killed), so its rows read as before. - **Killed checkout, then B4:** the B4 line alone was said at main. Now both are said, the signal first. - **A hook's own code is no signal:** a `post-checkout` hook that exits 137 reads the same at main and at this head: `ok`, with the advice. - **The first signal is the first git met:** SIGKILL at IRRS, then SIGTERM at IRSS (and the two legs of IRRS) named SIGTERM at main, from git's update's own last code, and name SIGKILL now. - **A signal in an update that exits 0 is not said.** A `reference-transaction` hook that kills IRSS's `git fetch` once, after it wrote the ref (git then finds the commit reached, checks it out and exits 0): measured at this head on both gits (main reads no trace, so it says the same), the run says `every member and leg fetched` and `family bootstrap ok`, exit 0. The trace there holds a `git fetch` `child_exit` of 137, and the row `test_a_git_killed_in_an_update_that_exits_0_is_not_said` pins that nothing is said (mutant M7). - **With a token in use nothing changed**, on purpose (the four `token in use` rows): the signal is told only where its code is git's last. - **The fake token** was in no output and in no file under TMPDIR in any run of any row (probe lines `token in output: False`, `token in temp files: []`). All in `tests/test_family_bootstrap_stops_named.py` (#954's and #1045's file), reusing its helpers and its style, with no assert that joins conditions with `and`. The module docstring gains the new rows' list, and the P3 state moved into a `p3()` helper so two rows build it. 11 new rows (37 before, 48 after). The issue's Verify rows (fail at main): - `test_p3_before_a_later_failure_fails_naming_the_signal`: P3, then IRSS's pin moved on, no credential, git 2.43.0: exit 1, signal 11 (SIGSEGV) named, no advice, FAILED. Skipped where git does not crash, as #1045's P3 row is. - `test_a_killed_checkout_before_a_later_failure_fails_naming_it[pin-moved-on-no-credential]` and `[checkout-refused-with-the-credential]`: the killed checkout (a `post-checkout` hook sending SIGKILL to its parent, `kill -s KILL $PPID`), then IRSS's pin moved on with no credential, and then IRSS's checkout refused with the credential. Each exits 1, names signal 9 (SIGKILL), gives no advice. Every POSIX git. The choice rows (fail at main): - `test_a_signal_and_b4_after_it_are_both_named_the_signal_first`: the killed checkout, then B4 at IRSS, with the credential: both lines, the signal first, and the failure line names both. - `test_the_first_signal_is_named[two-members]` and `[two-legs]`: SIGKILL, then SIGTERM, at two members and at two legs of one member. The first by time is named (SIGKILL), where git's update's own last code, and the files' order, name SIGTERM. The controls and the limit (pass at main, as intended, so they hold the rest as it was): - `test_a_killed_checkout_alone_is_named_as_before`: #998's line, word for word. - `test_a_hook_s_own_code_is_no_signal`: a hook that exits 137 is not a signal. - `test_a_git_killed_in_an_update_that_exits_0_is_not_said`: the `reference-transaction` row above. - `test_with_a_credential_in_use_a_signal_is_told_only_from_git_s_code[alone]` and `[then-pin-moved-on]`: the token's limit, pinned. Alone, the killed checkout is named from git's own 137. Then IRSS's pin moved on, the run is the credential's skip, the advice and `ok`, as before. Both: the fake token is in no output and in no file under TMPDIR, with every caller trace variable on. The controls the issue names that already existed are untouched and pass: the signal alone (`test_an_update_ended_on_a_signal_fails_naming_it`, the P3 row), the credential's skip (`test_the_credential_s_skip_is_as_it_was`) and `test_a_code_no_signal_gives_is_read_as_before[exit-128]` and `[exit-255]`. **Failing at main:** main's `bootstrap.py` bytes (sha256 `50a16751...`) against this branch's 48-row file, git 2.43.0: **6 failed, 42 passed**. The six are exactly the rows under "fail at main" above (the P3 row, the two killed-checkout rows, the both-named row and the two first-signal rows). They pass with the change. Each mutant applied alone to the change's `bootstrap.py` (a script replaces one exact string and asserts it occurs once), the stops-named file run on git 2.43.0 (`/usr/bin/git`) through the lane's runner, the file restored from the head's bytes and its sha256 checked after each. All on the final 48-row file (M1 to M3 were run once on the first 47 rows and again on the 48, with the same rows failing). | | mutant | result | |---|---|---| | M1 | the trace read dropped (`Trace(fetched_in(events))`) | killed: 6 failed, 42 passed | | M2 | `128 + N` read as `>= 128` (`GIT_DIED <= code`) | killed: 31 failed, 17 passed | | M3 | a `child_exit` of a child that is not `git` taken (`git_child` accepts any `child_start`) | killed: 1 failed (the hook row) | | M4 | the last signal for the first | killed: 2 failed (`two-members`, `two-legs`) | | M5 | the advice still printed beside a signal | killed: 10 failed | | M6 | the sort by time dropped (file order) | killed: 1 failed (`two-legs`) | | M7 | the exit-0 gate dropped (`signal_met` tells a signal where git exited 0) | killed: 1 failed (the `reference-transaction` row) | | M8 | a child paired by `child_id` alone, without the writing git's `sid` | killed: 1 failed (the hook row) | | M9 | B4 dropped beside a signal | killed: 1 failed (the both-named row) | | M10 | B4 said before the signal | killed: 1 failed (the both-named row) | | M11 | the "went on and ended with exit R" text never said | killed: 6 failed | | M12 | that text always said | killed: 5 failed | | M13 | git's update's own exit code asked before the trace | killed: 2 failed | | M14 | the failure line always "ended on signal N" | killed: 6 failed | | M15 | the `child_exit` kind check dropped from `died_in` | **survives**: 48 passed | **M15 is equivalent, and the check stays as a reader's help.** `died_in` only takes an event whose `(sid, child_id)` is one `child_start` named for a git, and only a `child_exit` event carries a `code`. A `child_start` event has none, so `died_of(None)` is None whether or not the kind is asked. No input reaches a different answer. All through the lane's runner (the real `gh` replaced by a stub, every `LANES_*` variable cleared, `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`), at most two at once, never the full suite. Git 2.43.0 is `/usr/bin/git`; git 2.47.1 is a local build, first on PATH. `bootstrap.py`'s sha256 began `f1c156e29d07e149`, which the runs recorded and the committed file has (the test file's begins `1d558af665c3`). | run | git | result | |---|---|---| | `tests/test_family_bootstrap_stops_named.py` (48 rows) | 2.43.0 | **48 passed** | | the same | 2.47.1 | **46 passed, 2 skipped** (both P3 rows: that git exits 128 there, not 139) | | main's `bootstrap.py` bytes, this branch's 48 rows | 2.43.0 | 6 failed, 42 passed (the rows listed under Tests) | | the probe, after, 17 states | 2.43.0 and 2.47.1 | 17 passed each | | group A: the stops-named file, `test_family.py`, `test_update_shape_kept_helper.py`, `test_family_holder_remedies_compose.py`, `test_family_gitmodules_values.py`, `test_pinned_copy_text.py`, `test_repo_hygiene.py` | 2.43.0 | **707 passed** | | group B: `test_family_holder_bootstrap_texts.py`, `test_family_bootstrap_gate_order.py`, `test_bootstrap_without_git.py`, `test_family_unnamed_gitlink.py`, `test_family_config_appends.py`, `test_family_member_make_jobserver.py` (#1023's), `test_family_siblings_bootstrap_unreadable.py`, `test_family_head_lost_gitmodules.py`, `test_family_members_not_a_list.py`, `test_family_makefile_siblings.py`, `test_bootstrap_spelling.py`, `test_template_text_placeholders.py`, `test_no_auto_maintenance.py`, `test_agents_md_codes.py`, `test_cli_reference.py` | 2.43.0 | **1010 passed, 3 skipped** (GNU make's jobserver spelling here, and two rows that need a session without `GIT_CONFIG_GLOBAL`) | | the 15 mutants | 2.43.0 | see Mutants | Both groups and every file that names the family root's `bootstrap.py` (`grep -l 'family-root/scripts/bootstrap' tests/*.py` gives two files, both in the groups), `test_pinned_copy_text.py` and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) are in those two groups. No other test pins the functions or lines this changes (a grep of `tests/`, `docs/` and `scripts/` for them finds only a docstring's mention in `test_family_holder_bootstrap_texts.py`, in group B, and an unrelated workflow-validator row). The runs were made at main `00f6d7f7`'s tree plus this change, before main moved (see Merges). `git merge-tree --write-tree` of this head `73906948` (parent main `00f6d7f7`), after fetching with `gc.auto=0` and `maintenance.auto=false`: | against | result | |---|---| | `origin/main` `4a6b9afde` (3 commits past `00f6d7f7`) | clean (tree `ad8dab73`); none of the 3 touches `bootstrap.py` or the stops-named file | | #1062 `fix/1040-windows-start-errors` `957ba038` (touches the family root's `bootstrap.py`, in `git_not_started` only) | clean (tree `70c5a715`); the merged `bootstrap.py` parses, and holds `died_in` and #1062's `4551` | | #1075 `fix/1055-siblings-untraced` `c3cf5154` (lane 5's: `siblings.py`, `tests/test_family_siblings_untraced.py`, `tests/test_update_shape_kept_helper.py`) | clean (tree `6770fa61`); its `siblings.py` imports `untraced` from `bootstrap.py`, which this does not touch | The other open PRs (#1073, #1072, #1071, #1070, #1069, #1068, #1064, #1031) touch neither file. `templates/family-root/scripts/bootstrap.py` is in `FAMILY_COPIED_VERBATIM`, so each holder gets one `upstream-changed` row for it, as for #1045. The only import is unchanged (`signal` came with #998), and `siblings.py`'s import list from it is unchanged. No Windows or macOS run was made, since CI is Linux only (#597). Review: rv1076, lane 5's independent reviewer, not the writers (w1056 and f1056): READY at `73906948` (issuecomment-6302104583) with no MUST or SHOULD; of its three NITs, the body's is fixed, and the other two (a docstring clause on a member's failed clone, and a text no row reaches) go to a follow-up. CI (Brett Heap's ruling 27): H0 is the head 7390694 itself, which passed tests, tests-git-bash and SonarCloud; main has touched none of its files since its base 00f6d7f; and the local gate passed on its predicted squash tree 9dae534 over main bccae28: the family_bootstrap_stops_named, repo_hygiene, agents_md_codes, cli_reference sets, 218 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #1056 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 20, 2026
brettheap
marked this pull request as ready for review
October 21, 2026 00:07
|
Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days. You can request another review in 19 hours and 12 minutes by commenting |
|
brettheap
added a commit
that referenced
this pull request
Oct 21, 2026
… fetch that carry it run in bootstrap.py's `untraced()` environment, so `make siblings` and `family.py siblings` write the token to no trace the caller asks git for (#1055) (#1075) `make siblings` and `family.py siblings` now write the token in `SHAPE_LEGS_TOKEN` or `SHAPE_LEGS_APP_TOKEN` to no trace the caller asked git for. #996 (#1045) did the same for `make bootstrap`. Lane 5 found this in its independent review of #1045 (rv996, #1045 issuecomment-6288783192) and measured it in #1055. `templates/family-root/scripts/siblings.py` gives the credential's `-c url.https://x-access-token:<token>@github.com/.insteadOf=...` rewrite, in argv, to two gits: - the clone in `place`, for a member with no clone beside the holder; - the fetch in `place`, for a member whose clone is there. Both ran in the caller's own environment. So every trace2 target the caller named wrote the token in the `start` event of each, one line per member. `scrub` kept it out of the output, and only that part held. Now: - **`rewrite_environment(token)`**, a new function in `siblings.py`: - with a token in use, it returns `untraced()` from the `bootstrap.py` beside it. That is every `GIT_TRACE*` variable taken out, and `GIT_TRACE2`, `GIT_TRACE2_EVENT` and `GIT_TRACE2_PERF` set to `0`, which also turns off a target the global or the system config names; - with no token, it returns None, so the two gits keep the caller's environment and stay traced where the caller asked, as before. - **The clone and the fetch** each run with `env=rewrite_environment(token)`. Nothing else in the file changes environment. - **The member's own `scripts/bootstrap.py`**, which `place` runs after a clone, is given no token in its argv, and no `env`, so it keeps the caller's environment and its traces. That environment holds `SHAPE_LEGS_TOKEN` and `SHAPE_LEGS_APP_TOKEN` as before; the shipped member bootstrap (`templates/assembly-root/scripts/bootstrap.py`) reads neither. A test row holds this, and so does `tests/test_validator_child_encoding.py`, which reads that call as handing no `env`. - **#1023's jobserver handling is untouched**: `dispatch` still runs each member's make with `member_make_environment(make)`, and no `MAKEFLAGS` reading changed. - **The docstrings** now say the promise in full: `git_prefix` says the token is "never written into `.git/config`, never persisted, never printed, and never traced". `place`'s ABSENT paragraph in the module docstring says the same, and `rewrite_environment` says what was measured. **One thing the issue did not ask for.** `GIT_TRACE_PERFORMANCE` writes a git's whole command line, `-c` included, on git 2.43.0 and 2.47.1 alike. So at main it held the token too, two lines per run, and the rows below set it. `untraced()` already takes it out: every `GIT_TRACE*` variable goes. This follows #1045's `untraced()` (#996): the clone and the fetch run in the very environment `make bootstrap` gives every git it hands the token. `siblings.py` imports `untraced` from the `bootstrap.py` beside it, next to `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path` and `members_of`. The issue left this to the writer, because a holder may keep a `bootstrap.py` older than its `siblings.py` (`update-shape.py apply --accept-local`), and an import of a name that copy lacks would stop `make siblings`, `park` and `resume` with an `ImportError`. The issue's text was written against main `1a47ed07`, where `siblings.py` still kept its own copy of the `MAKEFLAGS` readings. Since then #1023 (`9e154d87`, lane 4's) has decided the question for this pair of files: - it replaced that copy with an import of `member_make_environment`, because a copy in each script failed SonarCloud's duplication gate; - it named the price, in the import's comment and its commit: a holder that keeps its own `bootstrap.py` while `apply` writes `siblings.py` is refused, `update-accept-local-missing-name` (#536, #604), before a byte is written, and merges `bootstrap.py` by hand first. `untraced` takes the same road for the same reasons: - **One rule.** Which traces a command carrying the token is kept out of has one answer, for `make bootstrap` and `make siblings` alike. A copy here could drift from `bootstrap.py`'s, and the drift would be a token in a file. - **A kept old `bootstrap.py` is refused in the one-step case, and not in a two-step one.** The guard reads names. `untraced` is new with #996 (#1045), so a kept `bootstrap.py` from before it is refused by that name, where `--accept-local` names it in the same `apply`. Measured with `update-shape.py`'s own readers, in process: - `siblings.py` at this head takes `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path`, `members_of` and `untraced` from `bootstrap`; - the holder's `bootstrap.py` at main `00f6d7f7` lacks none of them; - the holder's `bootstrap.py` at `6476c170` (main just before #1045) lacks `untraced` alone, which is the line the refusal names. - **The one-step case, measured end to end (rv1075).** A holder cut at `6476c170`, and `apply --at c3cf515 --accept-local scripts/bootstrap.py`: exit 2, `scripts/bootstrap.py (kept) lacks untraced, which scripts/siblings.py imports from it`, and the holder's files, HEAD and status unchanged. - **Two applies in a row are not refused (rv1075's SHOULD 1, filed as #1082).** A holder whose earlier apply kept a `bootstrap.py` without `untraced` (rv1075 applied `--at 00f6d7f --accept-local scripts/bootstrap.py`: that target's `siblings.py` imports no `untraced`, so there was nothing to refuse), and then an apply at this head without `--accept-local`, gets `siblings.py` copied. `scripts/siblings.py` then fails with `ImportError: cannot import name 'untraced' from 'bootstrap'`, and so do `make siblings`, `park` and `resume`. The cause is the guard in `update-shape.py` (`:4288-4289`): it checks only the files `--accept-local` names in the same run. That is the gap of #536's guard, and it is on main already for #1023's `member_make_environment`; this change puts `untraced` into it and does not widen it. The text above this paragraph said no `ImportError` could reach a holder, which was too strong; #1082 is the follow-up, and it is not done here. - **No copy, so no test to hold two copies to one answer.** `tests/test_update_shape_kept_helper.py`'s `test_what_siblings_takes_from_the_holders_bootstrap_is_found_defined` already holds that every name `siblings.py` takes is defined in the holder's `bootstrap.py`. Its docstring now says six names, not five. **Setup:** - git 2.43.0 (`/usr/bin/git`) and git 2.47.1, Python 3.12.3; - the family of `tests/test_family.py` (two members, local bare remotes, the file transport allowed through `GIT_CONFIG_COUNT`), laid out as `<tmp>/InkRouter/InkRouter`; - offline: a stub `gh` first on PATH, a bogus `GH_TOKEN`, an empty `GH_CONFIG_DIR`, `GIT_SSH_COMMAND=false`; - the holder's own `scripts/siblings.py` was main's (sha256 `86bf57e0...`) or this change's; - the fake token `w1055-a-token-no-forge-takes`. **Each case was run three ways:** - `make siblings`, which clones both members; - `make siblings` again, which fetches both; - `family.py siblings --family-root <holder>` in a fresh layout, which clones both. **Traces were asked for in one of three ways:** - the seven variables `GIT_TRACE`, `GIT_TRACE2`, `GIT_TRACE2_EVENT`, `GIT_TRACE2_PERF`, `GIT_TRACE_PACKET`, `GIT_TRACE_CURL` and `GIT_TRACE_PERFORMANCE`, each set to a file under the run's TMPDIR; - `trace2.eventTarget`, `normalTarget` and `perfTarget` in a scratch `GIT_CONFIG_GLOBAL`; - the same three in a scratch `GIT_CONFIG_SYSTEM`. Each way was run with `SHAPE_LEGS_TOKEN`, with `SHAPE_LEGS_APP_TOKEN`, and with no token. That is 108 runs at main and at the change, 54 for each git. Each run's TMPDIR and the whole family folder (the clones' `.git/config` included) were searched for the token. | traces asked by | main, a token set (both variables, both gits) | this change, a token set | no token, either | |---|---|---|---| | the seven variables | `trace2-event.json`, `trace2-normal.txt`, `trace2-perf.txt`, `trace-performance.txt`: 2 lines each, in the clone, the fetch and `family.py` alike | none | no token anywhere; the same files written | | the global config | `cfg-event.json`, `cfg-normal.txt`, `cfg-perf.txt`: 2 lines each | none | the same | | the system config | `sys-event.json`, `sys-normal.txt`, `sys-perf.txt`: 2 lines each | none | the same | **What the table rests on:** - Every one of the 108 runs (and the 54 runs again on this head's final bytes, sha256 `b1e7bb21...`) exited 0 and ended `siblings ok: 2 member(s) beside the holder in ...`, with the token in neither stdout nor stderr. - The 2 lines in each file are the `start` (or `performance:`) line of the git given the `-c`, one for each member. Each carries the token twice, once for each spelling the rewrite covers. - With every member a local path, `GIT_TRACE`'s file was written and held no token, and `GIT_TRACE_CURL` wrote nothing, with no http remote. An https member is a different case, measured below. - With the change and a token set: - every trace file but `GIT_TRACE_PACKET`'s was still written, by the run's other gits and the member's own bootstrap; - the packet trace was not written, since only the clone and the fetch write one here. **An https remote, measured offline (rv1075, then the row of Round 2).** The rewrite reaches only `github.com`, and the probes above are offline, with local paths. A member whose `.gitmodules` url is `https://github.com/<org>/<repo>.git` is reached by it, and can be tried offline behind a dead proxy, `http.proxy=http://127.0.0.1:9`, so that nothing leaves the host: - rv1075 set one member's url so, with `make siblings`, a fake `SHAPE_LEGS_TOKEN`, and the seven variables set to files, on git 2.43.0 and 2.47.1. Main's `siblings.py` (`86bf57e0`) held the token in `trace.txt`, `trace2-event.json`, `trace2-normal.txt`, `trace2-perf.txt` and `trace-performance.txt`; this head held it in no file and no output. The clone failed cleanly, `git clone exited 128`, and `make siblings` exited 2. - `GIT_TRACE`'s file holds it too, in the `run_command: git remote-https origin https://x-access-token:<token>@github.com/...` lines: 3 lines on git 2.43.0, 4 on 2.47.1 (rv1075). - Round 2 below holds this in a test row. **Still not measured:** a github.com clone or fetch that succeeds, since no run here reaches the network. `tests/test_family_siblings_untraced.py` is new. It uses `tests/test_family.py`'s `family` and `estate`, `offline` from `tests/test_family_add_refusals.py`, `files_holding` and `CREDENTIALS` from `tests/test_family_bootstrap_stops_named.py`, and `NO_CREDENTIAL` and `needs_make` from `tests/test_siblings_family_name.py`. No assert joins conditions with `and`. The token is the fake `w1055-a-token-no-forge-takes`. **The rows.** Each entry point is crossed with each way traces are asked for: - entry points: `make siblings` cloning, `make siblings` again fetching (after a first run with no token and no trace), and `family.py siblings` cloning; - ways: the seven variables, the three targets in a scratch global config (a copy of the session's, which keeps git's automatic maintenance off), and the three targets in a scratch system config. **Three tests** (the third is round 2's): - **`test_with_a_token_in_use_the_token_is_in_no_trace`**: 18 rows (3 entries x 3 ways x 2 variables). Each asserts: - exit 0 and `siblings ok: 2 member(s) ...`; - the token in neither stdout nor stderr; - the token in no file under the test's directory: TMPDIR, every trace and config file, and the clones and their `.git/config`; - every trace file the way asks for written: 5 for the variables, 3 for each config; - the member's own bootstrap traced where a member was cloned: a git traced in a leg of each clone, which only that bootstrap runs. Where nothing was cloned, nothing ran there. - **`test_with_no_token_the_clone_and_the_fetch_are_traced_as_asked`**: 9 controls (3 entries x 3 ways). Each asserts exit 0, `siblings ok` and the same trace files written. It also asserts the trace2 event file holds `siblings.py`'s own git at each member, read from the events: `git clone -q --no-local ...` to each member's slot, or `git fetch --quiet origin` in each member's clone. **Fails on main.** The file was run against main's `siblings.py` (sha256 `86bf57e0...`, put in place and then restored, sha256 checked): - **18 failed, 9 passed**: every row with a token failed, and the 9 controls passed; - the variables rows found the token in `trace-performance.txt`, `trace2-event.json`, `trace2-normal.txt` and `trace2-perf.txt`; - the global-config rows found it in `cfg-event.json`, `cfg-normal.txt` and `cfg-perf.txt`; - the system-config rows found it in `sys-event.json`, `sys-normal.txt` and `sys-perf.txt`. - **`test_an_https_member_with_a_token_in_use_is_in_no_trace`**: 3 rows, one for each of `CALLERS_CONFIG` (round 2 and round 3, below). Each mutant was applied alone to the worktree's file and the new test file run (git 2.43.0). The bytes were restored and checked by sha256 after each: - `siblings.py` sha256 `b776c69b...`: this head's code; it differs from the head only in two docstring lines; - `bootstrap.py` sha256 `50a16751...`, main's, unchanged here. All are **killed**. | mutant | result | |---|---| | M1 the token condition dropped: `untraced()`'s environment always | killed, 9 failed (every control) | | M1b the condition inverted | killed, 27 failed | | M1c the clone untraced always, the fetch as it is | killed, 6 failed (the clone controls) | | M2 the clone left in the caller's environment | killed, 12 failed (every clone row with a token) | | M3 the fetch left in the caller's environment | killed, 6 failed (every fetch row with a token) | | M4a `GIT_TRACE2_EVENT` not set to `0` (`TRACE2_OFF`) | killed, 12 failed (the global- and system-config rows) | | M4b `GIT_TRACE2` not set to `0` | killed, 12 failed (the same) | | M4c `GIT_TRACE2_PERF` not set to `0` | killed, 12 failed (the same) | | M5 the `GIT_TRACE*` removal dropped (`env = dict(os.environ)`) | killed, 6 failed (the variables rows, by `GIT_TRACE_PERFORMANCE`) | | M6 the prefix narrowed to `GIT_TRACE2` | killed, 6 failed (the same) | | M7 the member's own bootstrap run untraced too | killed, 12 failed (the clone rows' bootstrap check) | M5 and M6 are killed only because the variables rows set `GIT_TRACE_PERFORMANCE`. With a local-path remote, of the issue's six variables none but trace2's writes the `-c`, and trace2's three are set to `0` whatever the prefix does. With an https remote `GIT_TRACE` writes it too, in the `run_command: git remote-https` lines; that is what the row of Round 2 holds, and the mutant R4 below, which keeps the caller's `GIT_TRACE`, passed all 27 earlier rows. **How every run was made:** - through lane 5's runner: `/usr/bin/python3 -m pytest -q -rs -p no:cacheprovider -o tmp_path_retention_policy=failed`, one basetemp per run; - `LANES_*` cleared, a stub `gh` first on PATH, `GH_TOKEN=bogus`, an empty `GH_CONFIG_DIR`; - `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null` at the start of the session. | git | files | result | |---|---|---| | 2.43.0 | `test_family_siblings_untraced.py`, on this change before the docstring fix | 27 passed | | 2.43.0 | the same file against main's `siblings.py` | 18 failed, 9 passed | | 2.43.0 | gate shard A: 19 of the 41 files below | 1623 passed, 4 skipped, in 19:51 | | 2.43.0 | gate shard B: the other 22 of the 41 files | 2415 passed, 8 skipped, in 15:03 | | 2.47.1 | `test_family_siblings_untraced.py` | 27 passed, in 1:14 | **What the 41 gate files are:** - the new file; - `test_family_member_make_jobserver.py`; - every file `grep -l siblings tests/` names; - the pinned-copy and upgrade-row files: `test_pinned_copy_text.py`, `test_update_shape.py`, `test_update_shape_add.py`, `test_update_shape_kept_helper.py`, `test_no_auto_maintenance.py`, `test_template_text_placeholders.py`, `test_bootstrap_spelling.py`; - the trio: `test_repo_hygiene.py`, `test_agents_md_codes.py` and `test_cli_reference.py`. **The gate runs** (both shards at once, then the 2.47.1 run) were made on this change as it is committed: `siblings.py` sha256 `b1e7bb21...` and the new test file sha256 `7ba7a416...`, at main `00f6d7f7` (this branch's base; no rebase was needed, see Merges). The runner's `START` line read `dirty=2`, the two tracked files this commit changes, and a sha256 check after the runs found `siblings.py` unchanged (neither it nor the test files were modified after the runs started). The first pair of shards was stopped part way and re-run whole; only the re-runs count here. **The 41 files, by shard:** - shard A (19): `test_shape_doctor.py`, `test_validator_child_encoding.py`, `test_family_py_unreadable.py`, `test_pinned_copy_text.py`, `test_siblings_inputs.py`, `test_siblings_family_name.py`, `test_family_member_make_jobserver.py`, `test_update_shape_add.py`, `test_adopt_printed_sentences.py`, `test_family_printed_quoting.py`, `test_family_makefile_siblings.py`, `test_template_text_placeholders.py`, `test_park_resume_targets.py`, `test_windows_paths.py`, `test_doctor_gitmodules_not_utf8.py`, `test_local_remote_dir_urls.py`, `test_family_siblings_untraced.py`, `test_setup_family_folder.py`, `test_bootstrap_refusal_exit.py`; - shard B (22): `test_repo_hygiene.py`, `test_doctor_legs_members_next.py`, `test_update_shape.py`, `test_family.py`, `test_update_shape_kept_helper.py`, `test_yaml_reader_spaces.py`, `test_bootstrap_spelling.py`, `test_agents_md_codes.py`, `test_family_siblings_placement.py`, `test_no_auto_maintenance.py`, `test_cli_reference.py`, `test_family_siblings_bootstrap_unreadable.py`, `test_bootstrap_branch_bytes.py`, `test_family_init_asks_every_value.py`, `test_validate_workflow_gitmodules_urls.py`, `test_adopt_contracts_dir.py`, `test_doctor_unfinished_merge.py`, `test_family_members_not_a_list.py`, `test_family_init_landing.py`, `test_family_docs_one_spelling.py`, `test_doctor_members_spelled.py`, `test_pins_child_kind_and_siblings_root_spelling.py`. **The skips are the environment's, each named by its reason:** - shard A: 3 in `test_shape_doctor.py` (the PowerShell line is printed, and `powershell.exe` exists, only on a Windows host) and 1 in `test_family_member_make_jobserver.py` (`make -j2` here writes `--jobserver-auth=3,4`, not GNU make 4.4's named pipe); - shard B: 2 in `test_doctor_legs_members_next.py` (this git crashes on `submodule init`, exit 139, as git 2.43 does on a bare `branch`), 4 in the same file (this git dies on a `shallow` of -2**31, as git 2.43 does), and 2 in `test_no_auto_maintenance.py` (the session began with `GIT_CONFIG_GLOBAL` set, and its file includes that one); - the 2.47.1 run of the new file skipped none. The full suite was not run. **Static checks:** - flake8 finds in `siblings.py` only the three lines it finds at main (two E501, one E127, each moved down by the added lines); - in the new test file it finds only the F811s every fixture-importing file has; - both files are ASCII, apart from the dashes and the CJK example already in `siblings.py`. Fetched with `-c gc.auto=0 -c maintenance.auto=false`, on 2026-10-20 at about 21:03Z. Round 1, `git merge-tree --write-tree` of the first head `c3cf5154` against (round 2's are in its own section): - **origin/main `6c861635`**: clean, exit 0, tree `225b2a99`. - Main has moved two commits past this branch's base `00f6d7f7`: `9cbba9d5` (#1063: `scripts/family.py`, `scripts/shape_materialize.py`, `docs/cli.md` and two tests) and `6c861635` (#1065: `adopt-project.py` and three tests). - Neither touches `siblings.py`, `bootstrap.py`, `tests/test_update_shape_kept_helper.py` or the new test file, so there was no rebase and the gate runs above stand. - **#1062** (`fix/1040-windows-start-errors`, head `957ba038`), the one open PR that touches a family-root script this change reads (`templates/family-root/scripts/bootstrap.py`, with the assembly root's and `validate-family.py`, `validate-pins.py` and three tests): clean, exit 0, tree `84d4b54a`. - Its diff does not touch `untraced()`. - In the merged tree `bootstrap.py` still defines `untraced` (and the five other names `siblings.py` takes from it), and `siblings.py` is byte-identical to this head's (sha256 `b1e7bb21...`). - **The other 9 open PRs** (#1073, #1072, #1071, #1070, #1069, #1068, #1067, #1064, #1031): none touches `siblings.py`, `tests/test_update_shape_kept_helper.py`, or a file the new test imports from (`conftest.py`, `test_family.py`, `test_family_add_refusals.py`, `test_family_bootstrap_stops_named.py`, `test_siblings_family_name.py`), read from `gh pr list --state open --json number,headRefName,headRefOid,files`. `templates/family-root/scripts/siblings.py` is in `FAMILY_COPIED_VERBATIM`, so each holder gets one `upstream-changed` row for it, as #1045 gave one for `bootstrap.py`: - a holder that takes it with `bootstrap.py` from #1045 or later needs nothing more; - a holder that keeps an older `bootstrap.py` with `--accept-local` in the same apply is refused, `update-accept-local-missing-name`, naming `untraced`, before anything is written; - a holder whose earlier apply kept a `bootstrap.py` without `untraced`, and that then applies this change without `--accept-local`, is not refused: `siblings.py` is copied, and `make siblings`, `park` and `resume` meet an `ImportError`. That is the gap of #536's guard, which `member_make_environment` has on main already, and it is #1082's. No Windows or macOS run was made, since CI is Linux only (#597). rv1075, lane 5's independent reviewer, found `c3cf5154` READY (#1075 issuecomment-6302090874): no MUST, two SHOULDs and a NIT. One commit on top of it, `041f7831`, with no rebase: main has touched none of this PR's files. **The three findings:** - **SHOULD 1** (the body said no `ImportError` reaches a holder, and two applies in a row make one): answered in the body above, in "Where the helper comes from" and "The pinned copy". The gap is #536's guard's, it is on main for `member_make_environment` already, and it is #1082's; this PR does not change `update-shape.py`. - **SHOULD 2** (every row used a local file remote, so a leak through `GIT_TRACE` on an https member had no test, and rv1075's mutant R4 passed all 27 rows): answered by the new row below. - **NIT** (three places said the member's own bootstrap "is given no token"): `siblings.py`'s module docstring, `rewrite_environment`'s docstring and the test file's docstring now say it is given no token in its argv. It inherits `SHAPE_LEGS_TOKEN` and `SHAPE_LEGS_APP_TOKEN` in its environment, because `run_member_bootstrap` passes no `env`, and the shipped one reads neither. `rewrite_environment`'s docstring also names the https measurement. **The code of `siblings.py` is unchanged.** Its syntax tree with the docstrings taken out is the same at `c3cf5154` and at `041f7831` (compared with `ast`); the file's sha256 moved from `b1e7bb21...` to `19107ad4...` over comments and docstrings only. So round 1's two gate shards (1623 passed, 4 skipped; 2415 passed, 8 skipped) were not re-run; the targeted runs below are. **The new row,** `test_an_https_member_with_a_token_in_use_is_in_no_trace` (the file has 28 rows now). Its setup: - the estate of `tests/test_family.py`, with `IRRS`'s url in the holder's `.gitmodules` given as `https://github.com/InkRouter/IRRS.git`, and `IRSS` still a local path; - `http.proxy=http://127.0.0.1:9`, a dead proxy, in git's command scope after the entries the session holds, and `NO_PROXY` and `no_proxy` empty, so nothing leaves the host; - a fake `SHAPE_LEGS_TOKEN` and the seven trace variables set to files; - `make siblings`, cloning. It asserts: - the proxy is set where the row sets it: `http.proxy=http://127.0.0.1:9` is in the command scope the run's git reads (`command_scope_at`, which runs `git config --show-origin --list` and writes nothing); - exit 2 and `IRRS: git clone exited 128:` on stderr, which is how the head fails (rv1075 measured the same); - `IRSS` was cloned and `IRRS` was not; - the token is in neither stdout nor stderr, and in no file under the test's directory; - the five trace files the variables ask for are written, by the run's other gits. No assert names the proxy in git's message. The git 2.47.1 this lane builds has no `git-remote-https` (`git: 'remote-https' is not a git command`, `fatal: remote helper 'https' aborted session`), so there the clone fails at once without reaching the proxy, still with 128. `GIT_TRACE` has written the `run_command: git remote-https origin https://x-access-token:<token>@github.com/...` line before that, so the row finds the leak on both gits. A first local version asserted the proxy's message and failed on 2.47.1 for that reason; the assert was dropped, and the commit amended, before anything was pushed. **It fails on main.** The file was run against main's `siblings.py` (sha256 `86bf57e0...`, put in place and then restored, sha256 checked each time): - git 2.43.0, the whole file: **19 failed, 9 passed**, the 18 rows of round 1 and the new row. The new row fails at `assert files_holding(tmp_path, TOKEN) == []`, with 5 files holding the token: `temp/trace-performance.txt`, `temp/trace.txt`, `temp/trace2-event.json`, `temp/trace2-normal.txt` and `temp/trace2-perf.txt`. The round 1 rows find 4 of those, since a local path leaves `temp/trace.txt` clean; - git 2.47.1, the row alone: **1 failed**, the same 5 files. **It kills R4.** R4 is rv1075's mutant, in `rewrite_environment`: `return {**untraced(), **{k: v for k, v in os.environ.items() if k == "GIT_TRACE"}} if token else None`, which keeps the caller's `GIT_TRACE` for the clone and the fetch. Applied alone, then restored and sha256-checked: - git 2.43.0, the whole file: **1 failed, 27 passed**: the new row alone, with `temp/trace.txt` the one file holding the token; - git 2.47.1, the row alone: **1 failed**, the same one file. **The runs on the pushed head `041f7831`** (the runner's `START` line read `dirty=0`), through the same runner as round 1: | git | files | result | |---|---|---| | 2.43.0 | the new file, `test_update_shape_kept_helper.py`, `test_family_makefile_siblings.py`, `test_family_member_make_jobserver.py`, `test_pinned_copy_text.py`, and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) | 589 passed, 1 skipped (the jobserver file's named-pipe row, as in round 1), in 5:09 | | 2.47.1 (`git version 2.47.1`, printed from the exact path first on PATH) | the new file | 28 passed, in 2:13 | | 2.43.0 | the new file against main's `siblings.py` | 19 failed, 9 passed | | 2.47.1 | the new row against main's `siblings.py` | 1 failed | | 2.43.0 | the new file with R4 | 1 failed, 27 passed | | 2.47.1 | the new row with R4 | 1 failed | | 2.43.0 | on a predicted merge with main (below): the new file, `test_update_shape_kept_helper.py`, `test_pinned_copy_text.py`, `test_family_makefile_siblings.py` | 305 passed, in 2:50 | The full suite was not run. flake8 finds in `siblings.py` the same three lines as at round 1, and in the test file only F811s, from the fixtures it imports. Both files are ASCII, apart from the dashes and the CJK example already in `siblings.py`. **The merges of round 2.** Fetched with `-c gc.auto=0 -c maintenance.auto=false` at about 23:00Z; `git merge-tree --write-tree` of `041f7831` against: - **origin/main `c13c3985`** (#1076's squash, which touches `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py`, among others): clean, exit 0, tree `8ae10d0c`. None of the three files this PR changes is among the files main changed since the base `00f6d7f7`, so there is no rebase. In that tree `siblings.py` is byte-identical to this head's, `untraced()` has the same syntax tree as at the base, and `CREDENTIALS` and `files_holding`, which the new file imports from `test_family_bootstrap_stops_named.py`, are still defined. The 305-passed run above is on that tree; - **#1062** (`fix/1040-windows-start-errors`, head `957ba038`): clean, exit 0, tree `e6ed1ba2`. Its `untraced()` has the same syntax tree as main's; - **the other open PRs** (#1031, #1069, #1070, #1072, #1073, #1081, #1084): none touches `siblings.py`, `tests/test_update_shape_kept_helper.py`, `bootstrap.py`, or a file the new test imports from, read from `gh pr list --state open --json number,headRefName,headRefOid,files` at about 23:00Z. #1076 (`fix/1056-signal-anywhere`, head `73906948`) was open when the runs were made, and merged clean with this head then (tree `6ae3e65f`); it has landed since as `c13c3985`, above. **The failure.** Lane 5's landing gate (log `c1075.log`, #1075 issuecomment-6304830183) failed the https row of round 2 at `041f7831`: 1 failed, 356 passed. The change in `siblings.py` was not at fault; the row depended on the caller's git config. - The gate ran with neither `GIT_CONFIG_GLOBAL=/dev/null` nor `GIT_SSH_COMMAND=false`, which the writers' runs and round 2's runs had. - `conftest.py`'s session global file includes the caller's global config (or `~/.gitconfig`, where `GIT_CONFIG_GLOBAL` is unset). The operator's `~/.gitconfig` has `url.git@github.com:.insteadOf=https://github.com/`. - Git keeps the first of two `insteadOf` prefixes of the same length, and the config files are read before the command line, so that rewrite beat the token's `-c` rewrite of the same prefix. Measured with scratch files and a stand-in token, on git 2.43.0: under a global file with that rewrite, `git -c url.https://x-access-token:T@github.com/.insteadOf=https://github.com/ ls-remote --get-url https://github.com/InkRouter/IRRS.git` printed `git@github.com:InkRouter/IRRS.git`. - So the row's `https://github.com/InkRouter/IRRS.git` went over ssh to `InkRouter/IRRS`, a real private repository. The dead proxy never applied, the clone succeeded, `make siblings` exited 0 and the placed members were both there, and the row failed `assert result.returncode == 2`. **The fix** is in `tests/test_family_siblings_untraced.py` only. No other file changed in this round, and `siblings.py` is byte-identical to `041f7831`'s (sha256 `19107ad4...`). - **`hermetic_config`** gives the https row's git a global file of its own, `session_global_config("")` (`conftest.py`'s own function: automatic maintenance off, and no include of the caller's file), `GIT_CONFIG_NOSYSTEM=1` and `GIT_SSH_COMMAND=false`. - It is the least invasive way: only the one row with an https url sets it, `conftest.py` and every other row stay as they were, and the other rows' remotes are local paths, which no rewrite of GitHub's url reaches. - `GIT_CONFIG_GLOBAL` set takes git's two user-level files out of the reading, and `GIT_CONFIG_NOSYSTEM` the system file whatever `GIT_CONFIG_SYSTEM` says (checked on git 2.43.0 and 2.47.1 with scratch files). - `GIT_SSH_COMMAND=false` is a second wall: a url somehow sent over ssh runs `false`. No mutant can show it needed, since the runner exports it too. - **`url_after_config`** is a new assert before the clone: `git ls-remote --get-url <url>` (it applies the config's `insteadOf` and asks nothing of the network) must give the url unrewritten under the row's environment. A config that reaches the row now fails by name, before any clone. - **The row is parametrized by `CALLERS_CONFIG`**: `none` (round 2's row), and `global` and `system`, each a stand-in for a caller's config that would send the url somewhere reachable. `as_the_callers_config` writes a scratch file of the test's own, `url.<file URI of the family's own IRRS remote>.insteadOf=https://github.com/InkRouter/IRRS.git`, into this process's `GIT_CONFIG_GLOBAL` (the session file includes it) or `GIT_CONFIG_SYSTEM`. It is built from tmp files only: no network, and never the real `~/.gitconfig`. The file now has 30 rows. - With the fix, in each of the three, the clone fails at the proxy with git's 128, `make siblings` exits 2, `IRSS` is placed and `IRRS` is not, and the token is in no output and in no file under tmp_path. **The variants fail without the fix.** Each was applied alone to the worktree's test file (or `siblings.py`) and run through the runner, with the file's sha256 checked after it was restored: - **`041f7831`'s file as pushed, under a caller's global config.** Lane 5's runner now honours `L5_GIT_CONFIG_GLOBAL=<scratch file>` as the caller's global config, with ssh impossible. The scratch file rewrote `https://github.com/InkRouter/IRRS.git` to the run's own IRRS remote (a `file://` url under the run's basetemp). The whole file, git 2.43.0: **1 failed, 27 passed**, the https row at `assert 0 == 2`, the gate's failure reproduced with no network. - **T2, `041f7831`'s row plus the variants:** the new file with `hermetic_config` and the `url_after_config` assert taken out. The https rows, git 2.43.0: **2 failed, 1 passed**, `[global]` and `[system]` at `assert 0 == 2` (the clone went to the local remote and exited 0), and `[none]` passes. On git 2.47.1 the same. - **T1,** the row's global file dropped and the assert kept: `[global]` fails at the assert, which sees `file:///...IRRS.git` for the url; the other two pass. - **T3,** `GIT_CONFIG_NOSYSTEM` dropped and the assert kept: `[system]` fails at the assert; the other two pass. **R4 stays killed.** rv1075's R4 (`rewrite_environment` keeps the caller's `GIT_TRACE`), git 2.43.0, the whole file: **3 failed, 27 passed**, the three https rows. **The runs on the pushed head `962ae43c`** (`START` read `dirty=0`), through the same runner as before: | git | files | result | |---|---|---| | 2.43.0 | the new file, `test_update_shape_kept_helper.py`, and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`) | 359 passed, in 3:05 | | 2.47.1 (`git version 2.47.1`, printed from the exact path first on PATH) | the new file | 30 passed, in 1:51 | | 2.43.0 | the new file, with `L5_GIT_CONFIG_GLOBAL` naming that scratch file | 30 passed, in 2:21 | | 2.43.0 | `041f7831`'s file, with the same | 1 failed, 27 passed | | 2.43.0 / 2.47.1 | T2, the https rows | 2 failed, 1 passed / 2 failed, 1 passed | | 2.43.0 | T1, T3, the https rows | 1 failed, 2 passed each | | 2.43.0 | R4, the whole file | 3 failed, 27 passed | The full suite was not run. flake8 finds in the test file only F811s from the fixtures it imports, and nothing over 79 columns; the file is ASCII. **The merge-tree of round 3.** Fetched with `-c gc.auto=0 -c maintenance.auto=false` at about 10:53Z; `git merge-tree --write-tree` of `962ae43c` against: - **origin/main `2a119f28`** (#1092): clean, exit 0, tree `b5ea0114`. Main has landed #1076 (`c13c3985`) and #1062 (`ff0c72eb`) since the last round, and has changed `templates/family-root/scripts/bootstrap.py` and `tests/test_family_bootstrap_stops_named.py` among others, but none of this PR's three files. In that tree `siblings.py` is byte-identical to this head's, `untraced()` has the same syntax tree as at the base `00f6d7f7`, and `CREDENTIALS` and `files_holding` are still defined where the new file imports them from. - **#1088** (`fix/1085-nit-texts`, head `88af1b7b`), which touches the same two files of main's: clean, exit 0, tree `365df092`, with the same findings. - **The other open PRs** (#1087, #1090, #1091, #1097): none touches `siblings.py`, `bootstrap.py`, `tests/test_update_shape_kept_helper.py` or a file the new test imports from, read from `gh pr list --state open --json number,headRefName,headRefOid,files` at about 10:53Z. Lane: openreposhape-5 (openRepoShape-5) Review: rv1075, lane 5's independent reviewer, not the writers (w1055 and f1055): READY at `c3cf5154` (issuecomment-6302090874) with no MUST; its two SHOULDs and its NIT were taken in one new commit, and the re-check is READY at `041f7831` (issuecomment-6303900180), with no MUST or SHOULD; its one NIT, a merge-tree number in the body, is fixed in the body. CI (Brett Heap's ruling 27): H0 is the head 962ae43 itself, which passed tests, tests-git-bash and SonarCloud; main has touched none of its files since its base 00f6d7f; and the local gate passed on its predicted squash tree fc2afb3 over main 16f9a0e: the family_siblings_untraced, update_shape_kept_helper, repo_hygiene, agents_md_codes, cli_reference sets, 359 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #1055 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 21, 2026
… holds without its commit is one it cannot answer for, `check` says a commit it cannot ask was not asked, and a pinned product YAML 1.1 or 1.2 reads as no text is quoted (#912) (#1090) Each pin question is answered from the commit actually pinned, with words that say why, and a pinned product is written so that any YAML reader reads it back as text. This is #912, which groups three lines of #457's release-commit triage: L1-81, L1-82's second case, and L2-14. One commit, on main `5e539a87`. It changes `scripts/shape_materialize.py`, `adopt-project.py` and `scripts/bump-leg.py`, and six test files. The issue's line numbers are at `5017830`. Each claim was measured again by name, on main `6c861635` first and again on `5e539a87`: - **L1-81 held.** `commit_in_clone` (`scripts/shape_materialize.py:3650` at `6c861635`, `:3809` at `5e539a87`) asks `rev-parse -q --verify <id>^{}` of an annotated tag. In a clone that holds the tag but not its commit, git answers `error: missing object referenced by '<tag>'` (git 2.43 and 2.47.1), and the id was refused as `is an annotated tag that names no commit`. `bump-leg.py`'s `peeled_target` (`:972`, now `:977`) did the same. - **L1-82's second case held.** `_recomputed_pin_finding` (`adopt-project.py:872`, now `:871`) asks a recorded `commit:` what it names only of a recorded clone that is still at its path and is no partial clone. Where the clone is gone or partial, or `gh api` read the digest, `check` exits 0 on a tag's id with a NOTE that names only the digest. - **L2-14 held, in a new place.** `_neutral_pin_entry` is no longer `adopt-project.py`'s own. Since #924 both tools call `shape_materialize.neutral_pin_entry` (`:524`), and it still asked only the project's reader. Its docstring even said that a bare `yes`, `on`, `.5` or `.inf` stays bare, naming this issue. - **Main moved under the change** while it was being tested. The commit was rebased from `6c861635` onto `5e539a87` with no conflict, and its patch is the same (`git patch-id --stable` `427e9e35fd2464cb` both times): - #1068 (`6797ca70`) changes `bump-leg.py`'s `_leg_fetch_refspecs` and `fetch_leg`'s docstring, and moves a refspec helper into `shape_materialize.py`. It does not touch `peeled_target`, and tag following under `refs/tags/`, which the new bump row relies on, is unchanged. - #1064 (`5e539a87`) changes `shape_materialize.py`'s manifest readers and `adopt-project.py`'s `_manifest_findings` and one import. It does not touch `commit_in_clone`, `neutral_pin_entry` or `_pin_digest_findings`. - Every row and every mutant below was run again on the rebased head, and the new rows were run again on `5e539a87`'s code. ### L1-81: a tag whose commit the clone lacks is a clone that cannot answer - `commit_in_clone` returns `(oid, "")` where a tag's peel cannot be read (`names is None`), as it already does for an id the clone does not hold. `plan` and the scaffold then read the digest there. `git ls-tree` finds no tree at the id, so they refuse it `pin-source-unreadable`, whose remediation says to point `--pin-source` at a clone that HAS the pinned commit, "`git fetch --all` first". That is what main said before #651. `check` says `plan-pin-source-unreadable`. - `peeled_target` returns the id as typed there. The reachability verdict answers it, as it answers an id the leg does not hold: `bump-leg-commit-not-on-remote`, "<repository> has no branch containing <id>", from both runs. - A tag of a tree or a blob, which the clone can peel, is still `pin-not-a-commit` or `bump-leg-target-not-a-commit` by name. ### L1-82: `check` says it did not ask a recorded commit it could not ask - The forge is not asked. `check` and `execute` read no network for a pin (#273's review S3, #449), `execute --local-remote-dir` needs no `gh`, and the rows that hold that (`gh` never run) stay. In a partial clone, git would fetch an id it lacks from the promisor remote. - So the NOTE says it, in the words the issue's second option asks for. It was: `NOTE <entry>: digest NOT rechecked here: <why>. The root's own `validate-pins.py` recomputes it wherever it can read the product.` It is now: `NOTE <entry>: digest NOT rechecked here, nor its `commit:` asked whether it names a commit: <why>. The root's own `validate-pins.py` recomputes the digest wherever it can read the product; `plan` asks what the commit names where it reads the digest.` - `<why>` is unchanged for each of the four cases: gone, partial, `gh api`, and a `digest_source:` that names no clone. No refusal code changes, so `AGENTS.md`'s table is unchanged. README, `docs/` and the handbook quote neither sentence. ### L2-14: a product YAML 1.1 or 1.2 reads as no text is double-quoted - New `shape_materialize.YAML_NOT_TEXT_RE`. Of the plain scalars `PLAIN_SCALAR_RE` takes, which begin with a letter, `_` or `.`, it matches the ones YAML 1.1 or YAML 1.2's core schema resolves to a bool, a null or a float: - YAML 1.1's bools `y`, `n`, `yes`, `no`, `on` and `off`, and both versions' `true` and `false`, in their three cases; - `null` in its three cases; - `.inf` and `.nan` in their three cases; - a point before digits, as YAML 1.1's pattern is written (`\.[0-9.]*` with a signed exponent, so `.`, `..` and `.5.5` too); - and as its own example `685.230_15e+03` and its readers read it, with `_` among the digits (PyYAML takes `.5_` for 0.5, ruamel.yaml takes `._` for a float), with YAML 1.2's unsigned exponent `.5e3`. - Nothing else either version resolves to no text is a plain scalar `PLAIN_SCALAR_RE` takes: `~`, the empty null, `<<`, `=`, and ints, timestamps and floats that begin with a digit or a sign. - `neutral_pin_entry` writes a name bare only where it is a plain scalar, the new rule does not match it, and the project's reader reads it back. So both tools double-quote these names. Every other name is the line it was, `openGlass` byte for byte. - The plan's `product:`, which `y` writes and only this tool reads, is unchanged. The pin file's `product:` was always double-quoted. The probe is `probe912.py` (not committed). It runs with a stub `gh` that exits 97 first on PATH, a bogus token, an empty `GH_CONFIG_DIR`, `GIT_CONFIG_GLOBAL=/dev/null` and `GIT_SSH_COMMAND=false`. The `lacking` clone holds the tags `v1` and `v1-again` but not their commit. | Case | main `6c861635` and `5e539a87` | This head | | --- | --- | --- | | `commit_in_clone(lacking, <tag>)` | `(<tag>, 'is an annotated tag that names no commit')` | `(<tag>, '')` | | `peeled_target(lacking, <tag>)` | `REFUSED bump-leg-target-not-a-commit: --to <tag> is an annotated tag that names no commit in the leg` | returns `<tag>` | | scaffold `--dry-run` and `plan`, `--pin openGlass@<tag> --pin-source lacking` | exit 2 `REFUSED pin-not-a-commit: ... is an annotated tag that names no commit in the clone at <lacking>, not a commit` | exit 2 `REFUSED pin-source-unreadable: <lacking> could not answer for opensoft/openGlass @ <tag>: ... exited 128: fatal: not a tree object`, remediation "`git fetch --all` first" | | `check`, recorded clone `lacking` | exit 1 `FINDING plan-pin-not-a-commit: ... which is an annotated tag that names no commit` | exit 1 `FINDING plan-pin-source-unreadable: ... cannot answer for it` | | `check`, a tag's id, clone whole (control) | exit 1 `plan-pin-not-a-commit`, "an annotated tag of commit <c>" | the same | | `check`, a tag's id, clone partial / gone / `gh api` / none named | exit 0, NOTE names only the digest | exit 0, the NOTE above; `gh` never ran | | names `--pin` admits of up to three characters (278915) | 231714 written bare; PyYAML misreads 132 of them, ruamel.yaml 0.19 (YAML 1.2) 132 | 231543 bare; 0 misread by either | #457 counted 138 at `3dd806f`. On `6c861635`, PyYAML misread `yes`, `no`, `on` and `off` in three cases each, `.0` to `.99`, and `.0_` to `.9_`. ruamel.yaml misread the dot forms, `._`, `._0` to `._9` and `.__`, and its YAML 1.1 mode also reads `y` and `n` as bools. **Found while testing.** git 2.43's `fetch` follows a remote tag whose object is already in the store, and brings the tag's commit with it. Its tag-following check counts the tag object itself, not only the commit. So in `bump-leg.py` a tag that the leg holds without its commit is a tag the leg's remote does not advertise, or one met after a fetch that failed. The bump row uses a tag that was never pushed. New rows, in each file's style and with its helpers: - `tests/test_pin_annotated_tag.py`: - a `lacking` fixture (`git hash-object -t tag -w` of the tags' bytes); - `commit_in_clone` answers `(id, "")` (2 rows); - `plan` and the scaffold's `--dry-run` refuse `pin-source-unreadable` with no "annotated tag" in the output (4); - `check` finds `plan-pin-source-unreadable` and `execute` refuses before any leg (1); - the NOTE for a tag's id, clone gone, partial or `gh api`, with `gh` never run (3). - `tests/test_bump_leg_dry_run_truth.py`: a tag the leg holds without its commit is `bump-leg-commit-not-on-remote` in both runs, with nothing written, through `--local-remote-dir` and `origin` (2). - `tests/test_neutral_pin_entry_one_spelling.py`: - each of 25 YAML 1.1 and 1.2 words and 20 dot floats is double-quoted and reads back (45); - the same 45, with the project's reader stubbed to read everything back, are double-quoted by the rule alone (45); - 20 look-alikes (`openGlass`, `openYes`, `yEs`, `.e5`, `._.` ...) stay bare (20); - the whole enumeration, read by PyYAML, ruamel.yaml 1.2 and ruamel.yaml 1.1 where they are installed (1; skipped without either reader, so CI holds the rule by the rows above). - Changed rows, whose old expectation was the bug: - `SPELLED["yes"]`, and the entry-equals-adopt's-old-spelling row, which now expects exactly `.`, `..`, `.0`, `.9`, `._` and `yes` to differ; - `.5`, `.inf`, `yes` and `off` move out of the bare groups in `test_scaffold_pin_and_reuse.py` and `test_adopt_pins.py` into `STOCK_MISREAD`; - the NOT-rechecked constants in `test_adopt_pins.py`, and one line in `test_pin_source_top_level.py`. No assert joins conditions with `and` or `or`. **The rows fail on main.** The six test files were run on main's code, the scripts as on main with the new tests beside them: - on `6c861635`: 96 failed, 98 passed, and 16 failed, 232 passed; - on `5e539a87`: 112 failed, 330 passed. Every failure is a new or changed row: - spelling 85; - tag file 10; - top-level partial-clone NOTE 1; - `test_adopt_pins.py` 10; - bump 2; - scaffold entry 4. Each mutant was applied alone to a scratch clone of the head and its rows were run. The results were the same on `6c861635` and on the rebased head. | Mutant | Result | | --- | --- | | M1 `commit_in_clone` without the `names is None` return | killed, 3 failed | | M2 `peeled_target` without it | killed, 2 failed | | M3 `if not peeled` in place of `if names is None` | survives: equivalent. The two differ only where `rev-parse <id>^{}` prints an id and `cat-file -t` of that id fails, and rev-parse parsed that object to print it. | | M4 the NOTE's old words | killed, 3 failed | | M5 `neutral_pin_entry` without the rule | killed, 85 failed | | M6 rule without `y`/`n` | killed, 9 | | M7 without `yes`/`no`/`on`/`off` | killed, 28 | | M8 without `true`/`false`/`null` | killed, 9 (the reader-stubbed rows) | | M9 without `.inf`/`.nan` | killed, 12 | | M10 without YAML 1.1's pattern as written | killed, 9 | | M11 without the `_`-digits pattern | killed, 14 | | M12 that pattern's exponent signed only | killed, 4 | | M13 no end anchor | killed, 15 | All runs go through lane 5's `run9.sh`: a stub `gh` first on PATH, a bogus token, every `LANES_*` variable cleared, `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`, and one basetemp per run. - **The six test files on the head `d5389eb6a71e`:** - git 2.43: 442 passed; - git 2.47.1 (first on PATH): 442 passed. - They also passed on `6c861635` before the rebase: 442 on 2.47.1, and on 2.43 in groups of 115, 31, 24, 149 and 123. - **git 2.43, every other test file that runs a changed script.** These are the files that name `adopt-project`, `ADOPT`, `shape_materialize`, `bump-leg` or `BUMP`, plus `test_shape_doctor.py`, `test_scaffold_leg_path_collisions.py` and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`), less the six. That is 177 test files in two shards, 179 paths with `tests/conftest.py` and `tests/gh_guard.py`: - shard a, 88 files: 6371 passed, 33 skipped (`END 2026-10-20T23:52:07Z rc=0`); - shard b, 91 files: 6296 passed, 3 skipped (`END 2026-10-20T23:51:58Z rc=0`). `git merge-tree --write-tree` of the head against origin/main and against each open PR that touches a file this changes. Each merge is clean, and no PR's added lines quote the changed words or name the changed functions: | Against | Head | Result | | --- | --- | --- | | origin/main | `5e539a878fc9` | clean, tree `95f9b53262fc` (the head's own tree) | | #1073 `l3-914-adopt-record-and-doctor` | `b58a4e2ccae0` | clean, `70f85d401ede` | | #1072 `l3-918-source-and-locale` | `2ffd82356c7b` | clean, `2e341d250ea1` | | #1071 `l3-916-adopt-test-strength` | `24273dd47e42` | clean, `0d183517f958` | | #1070 `fix/979-named-link-one-finding` | `20d2d4ba67f6` | clean, `a5beb7be1408` | | #1031 `fix/910-check-throwaway-repos` | `74c17705edc2` | clean, `324855e1983d` | | #1081 `fix/1060-pin-lane-in-process` | `7d4f2d82df4b` | clean, `fc9fe407b03b` (it touches none of these files) | Main moved after the runs above, which were made on `5e539a87`: #1071 (`bccae280`), #1076 (`c13c3985`), #1081 (`06cbd478`) and #1072 (`1e7971cd`) have landed. #1071 and #1072 touch two of this change's files, `tests/test_adopt_pins.py` and `adopt-project.py`. The head merges clean with origin/main `1e7971cd` (tree `ffb8249e`, from `git merge-tree --write-tree`), and the landing gates the predicted squash tree over the main of the day. #1068 and #1064 have landed and are under this commit. `fix/904-kept-links` was not on origin when this was pushed; it is now #1091, open at `8f5fd0fd`, and merges with this head clean (tree `0153f3e7e3c9`, measured by rv1090). #1062 touches none of these files. - rv1090, lane 5's independent reviewer, who wrote none of this: READY at `d5389eb6` (issuecomment-6316009648), with no MUST. - Its SHOULD is a missing row: no row has an exponent of two or more digits, and the head quotes those names correctly. - Its two code NITs: the no-`origin` bump refusal for a tag the leg holds, and an `else` nothing reaches. With the SHOULD, they are filed as #1103, to land after the v1.2.0 tag. - Its body NITs are fixed above: 177 test files, one `Claim:` line, and #1091's state. Review: rv1090, lane 5's independent reviewer, not the writer (w912): READY at `d5389eb6` (#1090 issuecomment-6316009648) with no MUST; its SHOULD (a missing row for exponents of two or more digits, which the head quotes correctly) and its two code NITs are filed as #1103 for after the v1.2.0 tag, and its body NITs are fixed. CI (Brett Heap's ruling 27 and his fast-refresh ruling of 2026-10-15T22:48:35Z): H0 d5389eb passed tests, tests-git-bash and SonarCloud; the head 1ad7605 is a clean update-branch merge of main 7e00834, with tests-git-bash and SonarCloud green; and the local gate passed on its predicted squash tree e182fde over main 7e00834: the adopt_pins, bump_leg_dry_run_truth, neutral_pin_entry_one_spelling, pin_annotated_tag, pin_source_top_level, scaffold_pin_and_reuse, repo_hygiene, agents_md_codes, cli_reference sets, 613 passed. Landed on Brett Heap's word of 2026-10-18T14:45:28Z, relayed to every lane by lane 3 (#473 issuecomment-6251255596): "merge v1.2.0 PRs once reviewed and green". Closes #912 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 23, 2026
…y a member's failed clone ends git's update with 1 before any checkout but a leg's lets it go on, and `killed_said` says git's update was itself killed, not that it went on (#1085) (#1088) The two texts #1076 (#1056) left in the family root's `bootstrap.py` say what git does. A member's clone that fails ends git's update before any checkout, where a leg's lets it go on, and a run whose git was itself killed is not said to have gone on. This is #1085, found by rv1076, lane 5's independent review of #1076 (its NITs 1 and 2). Round 1 was one commit, on main `c13c3985` (where #1076 landed); round 2 (below) adds a second. It changes two files: the family root's `templates/family-root/scripts/bootstrap.py` (docstrings, and one line of `killed_said`) and `tests/test_family_bootstrap_stops_named.py` (one row). 2 files, 55 insertions, 14 deletions. ### NIT 1: two docstrings, no behaviour - **`credential_advice`** said "a clone that fails, a member's or a leg's, gives 1, and git's update goes on". That is true of a leg's clone and not of a member's. It now says: - a member's fetch that fails ends the update with 128 (as before); - a member's clone that fails a second time, git having retried it, ends the update with 1 before any gitlink at that level is checked out (`quickstop`, git's `update_submodules`); - a leg's clone that fails gives its member's update 1, and git's update goes on (rv996's NIT 2 on #1045, kept). - **`ended_on`** said `128 + N` is the update's code "where a git it ran died of signal N ... and no gitlink after it failed". A member's `git submodule--helper clone` that dies of signal N never gives that code: git retries it, and where the retry fails too the update ends in `quickstop`'s 1, even with nothing after it. The docstring now says so, and what that reads as: - **traced (no token in use):** `died_in` names the signal, since `git submodule--helper clone` is a git the update ran, and `signal_met` asks the trace first; - **with a token in use** (the update is not traced, #996): the update's code is 1, which reads as the credential's skip, the advice and `ok`, the limit `credential_advice` already says for a signal before a later failure. ### NIT 2: `killed_said`, one line Where git's trace gave a git's signal (`Died(9, 137)`) and git's update returned `-9` (Python's code for git itself killed), the line said: ``` a git that git's update ran died of signal 9 (SIGKILL, exit 137), and git's update went on and ended with exit -9. Git's own words above say which git and where. ``` git's update did not go on and end: it was killed. It now says: ``` a git that git's update ran died of signal 9 (SIGKILL, exit 137), and git's update was itself killed (exit -9). Git's own words above say which git and where. ``` Every other line is byte for byte as before. I compared main's and this head's `killed_said` over 23,814 `(Died, returncode)` pairs (for each update code from -70 to 299: the update's own `ended_on` signal, where it gives one, and a trace's signal N = 1 to 64 with code `128 + N`), with `ended_on` itself: - `ended_on` differs for 0 codes of -70..299; - the pairs where the code is the update's own (the 134 codes that give a signal, #998's texts): 0 differ; - the pairs where a trace's signal and a positive update code differ: 0; - 4,480 pairs differ, each with a negative update code and a trace code (70 codes x 64 signals), and each now says "was itself killed (exit -N)". (A script that loads main's and the head's `bootstrap.py` from `git archive` copies; its output is in lane 5's scratch notes, `v118/w1085/runs/probe-texts.txt`.) The failure line `(a git it ran died of signal N)` is unchanged, as it is true. ### Texts that pin those words A grep of `tests/`, `README.md`, `docs/` (the handbook included), `AGENTS.md` and `contracts/` for "went on and ended", "killed_said", "went on", "member's or a leg's", "goes on (rv996", "UPDATE KILLED" and "quickstop" finds the words only in `bootstrap.py` and in `tests/test_family_bootstrap_stops_named.py`. There, `WENT_ON` pins "went on and ended with exit {ended}" with `ended` 128 and 1 (real runs, a positive code), which is unchanged and still passes. The README, the docs and the handbook say none of them. The stops-named file's module docstring gains one paragraph for the new row. I read, and did not run (no network clone, no real gh, no token): - **git 2.47.1**: the local build tree of the git the lane's runs use first on PATH (`builtin/submodule--helper.c`, `run-command.c`, `trace2/tr2_tgt_event.c`, `usage.c`, `git-submodule.sh`). - **git 2.43.0**: upstream's `v2.43.0` tag, the same five files (`builtin/submodule--helper.c` is byte for byte the copy an earlier lane 5 writer kept, w648c on #682, sha256 `9383338c...`; the other four I fetched as raw files from the tag, a read, not a clone). `/usr/bin/git` here is Ubuntu's `2.43.0-1ubuntu7.3`, which I did not read the patches of. | claim | source (2.47.1 line, 2.43.0 line) | |---|---| | a member's clone is a `git` child, `git submodule--helper clone` | `prepare_to_clone_next_submodule`: `child->git_cmd = 1`, args `submodule--helper clone` (:2141-2146, :2053-2058); trace2's `child_start` writes `git` first for a `git_cmd` child (`tr2_tgt_event.c` :358-361, :359-361) | | a child killed by signal N gives 128 + N | `wait_or_whine` `code += 128` (`run-command.c` :576, :569); `finish_command` hands it on and writes `child_exit` (:986-993, :976-983) | | that code never reaches the update's own | `pp_collect_finished` passes it to `update_clone_task_finished` (:1700-1703, :1690-1693), which answers 0 ("Retry scheduled", :2265) the first time and, the second, sets `quickstop` and answers 1 ("a second time, aborting", :2276-2280; 2.43.0 :2185-2189) | | `quickstop` ends the update with 1 before any checkout | `update_submodules`: `if (suc.quickstop) { ret = 1; goto cleanup; }` (:2737-2740, :2621-2624), before the loop that runs `update_submodule` for each gitlink | | a member's fetch that fails ends it with 128 | `run_update_procedure`: `return die_message(...)`, and `die_message` returns 128 (`usage.c` :230-238, :227-235); the loop stops at 128 only (:2772, :2647) | | a leg's clone that fails gives its member's update 1 and git's update goes on | the same `update_submodules` runs in the member's own `git submodule--helper update` (`update_submodule`: `ret = run_command(&cp)`, :2700, :2584, which discards `die_message`'s 128 and returns the member's 1); the holder's loop keeps going on any code but 128 | | `git submodule update` passes the helper's code on | `git-submodule.sh`: the helper is `cmd_update`'s last command, no `\|\| exit` (:380-403, :341-363) | Two offline probes, local paths only (no network, no gh, no token, `git config` never run, `GIT_CONFIG_GLOBAL=/dev/null`; lane 5's scratch notes, `v118/w1085/probe/quickstop.sh`, with its outputs `out243.txt` and `out247.txt`), on git 2.43.0 and 2.47.1, give the same on both: | state | git's update | what is in the work trees | |---|---|---| | holder with `members/A`, `members/B` (a url that is not there), `members/C` | exit 1, `Failed to clone 'members/B'. Retry scheduled`, then `a second time, aborting` | A and C cloned, **none checked out** (`.git` only), B empty | | holder with `members/M` (its leg `legs/L2` has a url that is not there) and `members/N` after it | exit 1, `Failed to clone 'legs/L2'. Retry scheduled` | **M and N both checked out** (git's update went on past M's 1); M's leg L1 cloned, not checked out | **Not run:** - `bootstrap.py` itself over a member's clone killed by a signal. Git's update over one was measured in round 2 below (rv1088's probe, which I ran again), and the trace's `child_start` argv for it is from `tr2_tgt_event.c`; - git 2.43.0's remote helper or any network clone; - Windows and macOS (CI is Linux only, #597). One thing I read and left alone, as the brief says every other line stays byte for byte: where the trace names a signal and the update's code is a positive 1 from `quickstop`, `killed_said` still says "git's update went on and ended with exit 1". It ended there rather than went on. It is a wording nit of the same kind, not a behaviour; I did not change it here. `test_an_update_itself_killed_after_a_signal_is_not_said_to_go_on` (new; 48 rows before, 49 after). It loads the family root's `bootstrap.py` as a module (`loaded`, from `tests/test_family_holder_bootstrap_texts.py`, which the stops-named file already imports from) and calls `killed_said(Died(9, 137), -9)`, as `signal_met` hands it its arguments. No run here reaches that line short of the OOM killer taking a checkout and later the top `git`. One assert, `said == KILLED_AFTER.format(...)`, no `and` or `or`. Main's `bootstrap.py` bytes (sha256 `f1c156e2...`) against this branch's 49-row file, git 2.43.0: **1 failed, 48 passed**. The failure, from `v118/w1085/runs/mut-mainbytes.log`: ``` E - s update was itself killed (exit -9). Git's own words above say which git and where. E + s update went on and ended with exit -9. Git's own words above say which git and where. ``` The other 48 rows pass on main's bytes (the old `WENT_ON` rows say only positive codes). At this head it passes. Each applied alone to the change's `bootstrap.py` (a script replaces one exact string and asserts it occurs once), the stops-named file run on git 2.43.0 (`/usr/bin/git`) through `run9.sh`, the file put back from the head's bytes and its sha256 checked (`a52483c8...`) after each. Lane 5's scratch notes, `v118/w1085/runs/mutants-summary.txt`. | | mutant | result | |---|---|---| | M1 | the new branch dropped (the ternary replaced by the old wording alone) | killed: 1 failed (the new row), 48 passed | | M2 | the negative test inverted (`returncode > 0`) | killed: 7 failed, 42 passed: the new row and the six that say "went on" (both killed-checkout rows, P3, the both-named row, `two-members`, `two-legs`) | | M3 | the old "went on and ended with exit N" kept for negative codes (the branch's text is the old wording, its test kept) | killed: 1 failed (the new row) | | M4 | "went on" kept beside the new words (`went on and was itself killed (exit -9)`) | killed: 1 failed (the new row) | | M5 | the test asks the trace's code, not the update's (`died.code < 0`) | killed: 1 failed (the new row) | | M6 | the code not said (`was itself killed`) | killed: 1 failed (the new row) | M1 and M3 behave the same (both give the old wording for a negative code) and differ in the text of the mutation only. All through `run9.sh` (the real `gh` replaced by a stub, `GH_TOKEN` a fake, every `LANES_*` variable cleared, `EMAIL=service@opensoft.dev`, `GIT_SSH_COMMAND=false`, `GIT_CONFIG_GLOBAL=/dev/null`), at most two at once, never the full suite. At this head, `bootstrap.py` sha256 `a52483c8...`, the test file `2fb6b4dd...`. | run | git | result | |---|---|---| | `tests/test_family_bootstrap_stops_named.py` (49 rows) | 2.43.0 (`/usr/bin/git`) | **49 passed** | | the same | 2.47.1 (`git --version` printed `git version 2.47.1`; the lane's local 2.47.1 build first on PATH) | **47 passed, 2 skipped** (the two P3 rows: that git exits 128 there, where 2.43.0's crashes with 139) | | `tests/test_family.py`, `tests/test_update_shape_kept_helper.py` (the two files `grep -l 'family-root/scripts/bootstrap' tests/*.py` gives) and `tests/test_family_holder_bootstrap_texts.py` | 2.43.0 | **328 passed** | | `tests/test_pinned_copy_text.py` and the trio (`test_repo_hygiene.py`, `test_agents_md_codes.py`, `test_cli_reference.py`), with `test_template_text_placeholders.py` | 2.43.0 | **399 passed** | | the six mutants and main's bytes | 2.43.0 | see above | flake8 on `bootstrap.py` shows the 3 findings main has (E501 at line 7 and 2327, E127 at 1168), and on the test file the same 120 F811 findings main's file has (the fixture imports). New lines are 79 characters at most, ASCII only. `git merge-tree --write-tree` of this head `88af1b7b8` against `origin/main`, fetched again with `-c gc.auto=0 -c maintenance.auto=false` just before the push (it moved once while this was open: `06cbd4789`, #1081, one test file), and against each open PR that touches `bootstrap.py`, read with `gh pr list --state open --json number,headRefName,files` (9 open; #1062 touches the family root's `bootstrap.py`; #1075's files are `siblings.py` and two test files; #1087, new since the first read, touches neither): | against | result | |---|---| | `origin/main` `06cbd4789` (one commit past this branch's base `c13c3985`; it touches only `tests/test_doctor_gitlink_repairs.py`) | clean, tree `a10ffa31c` (against `c13c3985` the merge was this head's own tree, `deeab934f`) | | #1062 `fix/1040-windows-start-errors` `957ba0386` (touches `bootstrap.py`, in `git_not_started`) | clean, tree `46f25219c`; the merged family root `bootstrap.py` parses, and holds `died_in`, `quickstop`, "was itself killed (exit" and #1062's `4551` | | #1075 `fix/1055-siblings-untraced` `041f7831b` (lane 5's: `siblings.py`) | clean, tree `02b01b276`; the merged `siblings.py` imports `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path`, `members_of` and `untraced` from `bootstrap.py`, and all six are defined at module level in the merged `bootstrap.py` | None of the other open PRs touches `bootstrap.py` or the stops-named file. This change defines and renames nothing a caller imports. `templates/family-root/scripts/bootstrap.py` is in `FAMILY_COPIED_VERBATIM`, so each holder takes one `upstream-changed` row for it, as for #1045 and #1076. Nothing else is pinned. No Windows or macOS run was made. rv1088 (#1088 issuecomment-6314332205) found the review READY with one NIT: the sentence this PR added to `ended_on` said git's update retries a killed member clone, and it does not always. This round is one commit on top of `88af1b7b8` (the branch was not rebased), docstring only, one file (`templates/family-root/scripts/bootstrap.py`, +8 -4). No behaviour changes, and `killed_said`'s "went on and ended with exit 1" line is left as it is (rv1088 found it true). **Measured, offline, on git 2.43.0 and 2.47.1** (rv1088's `killprobe.sh`: a remote helper that SIGKILLs the `git submodule--helper clone` above it; I ran both modes again on both gits and got the same): | the member's clone | git's update | work trees | |---|---|---| | killed on both attempts | exit 1: `Retry scheduled`, then `a second time, aborting` | A and C hold `.git` only, B empty: nothing checked out | | killed once, its own `git clone` child left running (it writes `members/B/.git`) | exit 0: `Retry scheduled`, then `BUG: submodule considered for cloning, doesn't need cloning any more?`, no second attempt | A, B and C all checked out | `ended_on` now says: git's update retries a killed member clone where it left no `.git` at the member's path, and where the retry fails too ends in `quickstop`'s 1 before any gitlink at that level is checked out; where its own `git clone` lived on and wrote that `.git`, git retries nothing and goes on, and exits 0 with every gitlink checked out (measured, git 2.43.0 and 2.47.1). "Read, not run" is now "measured". `signal_met` already says nothing for an exit of 0, and `credential_advice`'s "fails a second time, git having retried it" stays true, so neither changes. No other text pins those words: a grep of `tests/`, `README.md`, `docs/` (the handbook included) and `AGENTS.md` for "retries it", "doesn't need cloning", "never gives that code" and "quickstop" finds them only in `bootstrap.py`, and the round-1 words "(read in git 2.43.0's and 2.47.1's submodule--helper.c, not run)" are gone everywhere. "not run" alone appears in other files only in unrelated senses (rv1088's re-check). flake8 shows the same 3 findings as before (the lines moved by 4). **Runs** at this head, through `run9.sh` with `EMAIL=service@opensoft.dev` (`GIT_SSH_COMMAND=false` and `GIT_CONFIG_GLOBAL=/dev/null` set by the runner), the stops-named file and the trio at the same time: | run | git | result | |---|---|---| | `tests/test_family_bootstrap_stops_named.py` | 2.43.0 (`/usr/bin/git`) | **49 passed** | | `tests/test_repo_hygiene.py`, `tests/test_agents_md_codes.py`, `tests/test_cli_reference.py` | 2.43.0 | **170 passed** | | `tests/test_family_bootstrap_stops_named.py` (`git --version` printed `git version 2.47.1`, the lane's 2.47.1 build first on PATH) | 2.47.1 | **47 passed, 2 skipped** (the two P3 rows, as before) | **Merges**, `git merge-tree --write-tree` of this head against `origin/main` re-fetched with `-c gc.auto=0 -c maintenance.auto=false`: | against | result | |---|---| | `origin/main` `16f9a0e81` (#1087 and the commits since this branch's base; #1062 has landed, so main's `bootstrap.py` moved) | clean, tree `b3b454168`; the merged family root `bootstrap.py` parses and holds `died_in`, `git_not_started`, "was itself killed (exit" and the new BUG sentence | | #1075 `fix/1055-siblings-untraced` `962ae43c1` (its head moved since round 1) | clean, tree `a4c72197c`; the merged `siblings.py` imports `REWRITE_TARGETS`, `credential`, `member_make_environment`, `member_path`, `members_of` and `untraced` from `bootstrap.py`, and all six are defined in the merged `bootstrap.py` | The other open PRs touch neither `bootstrap.py` nor the stops-named file. #1088 stays a draft. Review: rv1088, lane 5's independent opus reviewer, which wrote none of #1088: READY at `26f49d85`, H0 of this landing (issuecomment-6316937429), with no MUST or SHOULD; its one body NIT is fixed in the body. CI (Brett Heap's ruling 27 and his fast-refresh ruling of 2026-10-15T22:48:35Z): H0 26f49d8 passed tests, tests-git-bash and SonarCloud; the head dedc0da is a clean update-branch merge of main 0d76e4c, with tests-git-bash and SonarCloud green; and the local gate passed on its predicted squash tree 377691f over main 0d76e4c: the family_bootstrap_stops_named, repo_hygiene, agents_md_codes, cli_reference sets, 220 passed. Landed on Brett Heap's word of 2026-10-23T13:10:26Z, relayed to every lane by lane 3 (#473 issuecomment-6365697123): "merge v1.2.1 PRs once reviewed and green". Closes #1085 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1040
What happened
#1001 (PR #1028) made the four copies of the
git-not-runnablerule count a namelessOSErrorwhosewinerroris 193, agit.exeWindows cannot execute. Windows has otherCreateProcessfailures that also mean git itself could not be started. Each names no file and is neitherFileNotFoundErrornorPermissionError, so all four copies passed it through, and the run ended in a traceback, exit 1, as 193 did before #1001. RV1028 raised this as its SHOULD 1.The four copies are
_git_runsinvalidate-family.py,validate-pins.pyand the assembly root'sbootstrap.py, andgit_not_startedin the holder'sbootstrap.py.The codes, read from CPython and Microsoft
CPython 3.12's
PC/errmap.h(main's is the same for these codes), with each code's words from Microsoft's System Error Codes pages (for 4551, from a CPython 3.12.10 traceback, see below):winerrorerrno, and so the classERROR_EXE_MACHINE_TYPE_MISMATCH)git.exebuilt for another architecture, for example ARM64 on x64EINVAL: a plainOSErrorERROR_ACCESS_DISABLED_BY_POLICY)git.exethat AppLocker or a software restriction policy blocksEINVAL: a plainOSErrorERROR_SYSTEM_INTEGRITY_POLICY_VIOLATION)git.exethat App Control for Business (WDAC) or Smart App Control blocks (round 2, RV1062's S1)EINVAL: a plainOSErrorERROR_BAD_FORMAT), and 188 to 202ENOEXECfamily 193 is in: a program Windows cannot loadENOEXEC: a plainOSErrorERROR_DIRECTORY)cwdthat is not a folderENOTDIR: aNotADirectoryError, not git'sERROR_INVALID_PARAMETER), 8 (ERROR_NOT_ENOUGH_MEMORY)CreateProcessfailures that say nothing of git; negative rows (round 2, RV1062's S2)EINVAL,ENOMEM: plainOSErrors, not git's4551 is seen raised by CPython 3.12.10's
_winapi.CreateProcessin ROCm/TheRock issue 2607 (OSError: [WinError 4551] An Application Control policy has blocked this file, fromsubprocess.pyline 1538,_execute_child), a plainOSErrornaming no file. Its name is from mingw-w64'swinerror.h.Other facts read from CPython:
_winapi.CreateProcessraisesPyErr_SetFromWindowsErr(GetLastError()), so no filename is set.Python/errors.cdrops the message's final period.Objects/exceptions.chas no subclass forENOEXECorEINVAL.The change
The same text in all four copies:
range(188, 203). Nothing outside the four copies holds the rule (git grep), so lane 3's stop condition was not met.git. A namelessEIO,ENOMEM, anENOEXECwith nowinerror, a nameless 267, and any other namelesswinerror(rows for 87 and 8) all pass through.test_the_four_copies_are_one_text(an AST comparison) holds the list itself to one text. The test did not need to change.Tests
win_error(winerror, number, words)builds what CPython raises on Windows.WIN_ERROR_193is now built by it, besideWIN_ERROR_216,WIN_ERROR_1260andWIN_ERROR_4551. The no-git run takes all three new errors in every run.NOT_GITgains a namelesswinerror-267,winerror-87andwinerror-8, each passed through at each call.git-not-runnable:winerror-216,winerror-1260andwinerror-4551, which the per-call rows take too;winerror-11andwinerror-188towinerror-202(NOT_LOADABLE), asked of the four copies alone, since each is 193 except for itswinerrorand its words.winerror-267,winerror-87andwinerror-8are passed through by all four, and at each of the holder validator's three calls.sitecustomizeshim is now built bygit_raising(error).GIT_NOT_WIN32raises 193 as before, andGIT_FOR_ANOTHER_MACHINEraises 216.#1028's NIT 3
The
answerdocstring in tests/test_validate_family_git_not_runnable.py namedfetch_membersas the call site of the holder'sgit_not_started. #954 moved that call intostarted(), which uses the same three linesanswercopies, so only the name was stale. It now saysstarted. I re-readstarted()on this branch: it is still the only caller, and the rest of the docstring is still true.Verification
The environment for every run was Python 3.12.3, git 2.43.0, a stub
ghthat exits 97,GH_TOKEN=bogus, an emptyGH_CONFIG_DIR,GIT_SSH_COMMANDand everyLANES_*unset, and one basetemp.Before this branch (main 8a05721), the three rule files: 151 passed (68, 61 and 22).
This branch's tests over main's unchanged copies: 38 failed, 160 passed. The 38 are exactly the new counted rows:
validate-pins.py;Every 267 row passed on main.
Round 1, rebased on main eee089c (01a8b75): the three rule files 198 passed (99, 70 and 29); the related files 785 passed.
Round 2 (957ba03, with main 00f6d7f merged in):
test_validate_family_without_git,test_pinned_copy_text,test_bootstrap_upstream_notice,test_repo_hygiene,test_cli_reference,test_agents_md_codes,test_bootstrap_refusal_exit, and the four files that importvalidatorfromtest_validate_pins_without_git), plus the four test files the family root's bootstrap.py: git's update ended by a signal fails the run by name, and B4 with a token in use is told from fetches redone without a trace, so the token reaches no file (#998, #996) #1045 and validate-family.py: a hand mount'sgit rmline works typed:git rm --cachedwhere a plain one refuses a staged gitlink, dies on a clone no section names or refuses what is no checkout, with what it leaves said, and a.gitmodulesgone from the work tree put back before thegit rmthat takes a section out (#936) #1025 changed (test_family_bootstrap_stops_named,test_family_hand_mount_git_rm_lines,test_family_holder_remedies_compose,test_validate_family_unreadable).LANES_REPO,LANES_DIR,LANES_FILE,LANES_LANEandLANES_SESSIONwere unset by name in every run.flake8 gives no new warning in any of the seven files.
Mutants
Each mutant edits the code list in one copy, or in all four, and runs the parity and one-text tests plus
test_bootstrap_without_git.py's two in-process rule tests. Each copy is then restored from a pristine copy, its sha256 is checked, andgit statusmust be clean.27 mutants, all caught. The copies are
vf(validate-family.py),vp(validate-pins.py),fb(the holder's bootstrap.py) andab(the assembly root's bootstrap.py).winerror-11range(188, 203)becomes193winerror-188to-202but 193winerror-216winerror-1260winerror-267winerror-11range(188, 203)becomes193winerror-188to-202but 193range(188, 202)winerror-202range(189, 203)winerror-188Every edit in one copy alone is caught by
test_the_four_copies_are_one_text. Every edit in all four is caught by the parity rows.Round 2: 8 mutants, all caught, run and restored the same way. RV1062's mutant A ran against the three rule files whole.
winerror-4551not in (None, 267)winerror-87andwinerror-8; the 87 and 8 rows at each of the three calls in validate-family.py and in validate-pins.py (12); both roots' not-git's rows for 87 and 8 (4)winerror-87, both not-git's rowswinerror-8, both not-git's rowsOn 01a8b75, mutant A survived every row (RV1062: 187 passed, with the 11 child-process runs deselected).
Merge-trees
git merge-tree --write-treeof this head with each of the following. In every merged tree, the four copies' rule is one text by the same AST reading asthe_rule, it holds the list once in each copy, andgit_not_startedstill has the single callerstarted().#1045 (00f6d7f) and #1025 (6476c17) have landed and are in main, which touched the holder's bootstrap.py and validate-family.py. The merge was clean, and the copies are still one text.
Pinned copies
All four files are pinned copies, as in #1028. An assembly root takes
upstream-changedrows for scripts/validate-pins.py and scripts/bootstrap.py, and a holder takes them for scripts/validate-family.py and scripts/bootstrap.py. Nothing new is imported from repo_shape.py.Known follow-up (RV1062's N1)
CPython main (3.16.0a1+dev, gh-119646) now names the failing program on Windows
CreateProcesserrors:args[0], sogit, or thecwdfor 267. 3.13, 3.14 and 3.15 do not. The rule still holds there, since a namedgitcounts by name and a 267 naming itscwdpasses through. But the docstrings' "Windows'CreateProcessfailures carry no filename" is true only up to 3.15. Nothing changes for v1.2.0; a follow-up can say "up to 3.15".Not run on Windows
The codes, their classes and their words are read from CPython and Microsoft's documentation, and the errors are built by hand, as #1001's 193 is.
Lane: openreposhape-4 (openRepoShape-4)
🤖 Generated with Claude Code
Summary by Sourcery
Handle the full set of supported nameless Windows failures that prevent Git from starting consistently across validators and bootstrap scripts.
Bug Fixes:
git-not-runnable, returning the existing refusal with exit code 2 instead of a traceback and exit code 1.Enhancements: