[brettheap]

What

adopt-project.py check asks this machine's git what the split will make of
the source in throwaway repositories in the work directory (#910). Two
questions were still asked otherwise, and on git 2.43 both stopped short of
the answer execute meets.

Item	Change
(a) the split's own clone	check now makes the split's own git clone of the source first, in a throwaway directory in the work directory: git -c protocol.file.allow=always -c core.hooksPath=<empty> clone -q --no-checkout --shared <source> <throwaway>/repository (_split_clone_asked). The protocol setting is FILE_PROTOCOL, the one execute gives each of its clones, and the operator's template is copied in, as _extract_leg's clone copies it. Its environment is _split_clone_env(): _inherited_env(), plus the -c settings a parent git hands this process (GIT_CONFIG_PARAMETERS), as execute's clone takes them. Left out are the checkout (the rehearsal and _paths_git_refuses ask it), this machine's hooks, and every variable that names another repository, its objects, an index or a work tree, which the clone would write into. Where git will not make the clone, that is one adopt-git-unasked finding in git's words, the questions after it are not asked, and execute refuses it before it makes either leg. Where git makes it, nothing changes.
(b) _resolved and _answers	Their repositories are now made the throwaway way, through _throwaway and _throwaway_made. That means the work directory, no hook (-c core.hooksPath=<empty> on every command), no fsmonitor program or daemon (-c core.fsmonitor=false, as the rehearsal's and #619's commands have it; r1119b's SHOULD-A), --template=<empty>, -b throwaway and the source's object format, all under _inherited_env(), read before the throwaway is made. Before, it was TMPDIR and a plain git init with the caller's whole environment. A git step that fails in one is adopt-git-unasked in git's words, through the new _throwaway_git, never "a git or gh command failed". _submodule_findings asks no url question once a throwaway in the work directory could not be made or asked. Where a url question itself cannot be asked, the url findings asked before it are kept, and that _Unasked becomes the one finding for the throwaways. _resolved takes source as a positional fourth parameter and _answers takes source=None, so the existing rows that patch or call them keep working.
(c) docstring	tests/test_adopt_reencoded_files.py::test_a_link_the_checkout_writes_is_never_written_through said the throwaway is in TMPDIR. It now says the work directory; both are as deep below tmp_path, so the row still asks the same thing. (The issue's adopt-project.py:466 names _pin_row_problem at 74c1770; this docstring is the one PR #1031's body named.)
(d) main's ref-probe row	tests/test_adopt_root_symlinks.py::test_check_says_where_git_would_not_make_the_ref_probe (#1091) set GIT_DEFAULT_HASH=bogus to fail the ref probe's git init. Merged with this branch, that variable stops the split's own clone first, so check said adopt-git-unasked and exited 1 where the row wants 0 (r1119b's MUST-2). The row now puts a stub git first on PATH that fails only a git init of a refs-probe-* directory, in git's words (fatal: unknown hash algorithm 'bogus', exit 128), and hands every other command to the real git. It is skipped on Windows, as the other stub rows are. It passes on main's tool and on this head.

Covers #1032, which lane 4 released into this issue: item (b) is that work.

The clone's cost. With --shared the clone copies no object of a source
that is not shallow: it borrows the source's. git ignores --shared for a
shallow source, and says nothing, so that clone is a full copy of the
source's objects. r1119 measured a shallow copy of a 100k-file source with a
115 MiB pack: 7.3 s and 10.2 s, and 117 MiB. That is a cost, not a fault:
each of execute's own clones of such a source is a full copy too. For a
source that is not shallow, r1119 measured 0.06 s and 0.1 MiB (openRepoShape)
and 0.8-1.6 s and 1.2 MiB (100k files, 20,001 refs).

Such a clone also runs the uploadpack.packObjectsHook that this machine's
global or system config names, to pack what it copies, as each of execute's
clones of that source runs it (r1119b's NIT-C). Measured on git 2.43 with a
shallow source and a counting hook:

• in the global config: 1 run in check, and 1 in a clone made as _extract_leg makes it;
• in the source's own config: 0 and 0;
• handed down by a parent git -c: 0 and 0.

Measured

check --work-dir and execute --local-remote-dir against a fresh source, on
git 2.43.0, with a stub gh. Before is main 2a119f28 (its adopt-project.py
is unchanged through 16f9a0e8), after is this branch.

Case	Before: check / execute	After: check / execute
init.defaultBranch = a..b in the global config	exit 0 plan ok / exit 2 REFUSED extracting the spec leg, fatal: invalid branch name: init.defaultBranch = a..b, after Northwind-spec.git and Northwind-code.git exist; nothing rolled back	exit 1 FINDING adopt-git-unasked, "the split's git clone of the source exited 128 there: fatal: invalid branch name ..." / exit 2 REFUSED adopt-git-unasked; remotes/ absent
the same setting handed down by a parent git, GIT_CONFIG_PARAMETERS="'init.defaultbranch'='a..b'"	the same as the row above (and so on bdcf9952, this branch's first head)	the same as the row above
the same setting in GIT_CONFIG_COUNT	the same as the first row	the same as the first row
GIT_DEFAULT_HASH=bogus	exit 0 plan ok / exit 2 "a git or gh command failed", fatal: unknown hash algorithm 'bogus', with Northwind-spec.git left behind	exit 1 FINDING adopt-git-unasked ("unknown hash algorithm 'bogus'") / exit 2 REFUSED adopt-git-unasked; remotes/ absent
a kept submodule, init.defaultBranch = a..b	exit 2 "a git or gh command failed" at git init -q <TMPDIR>/openreposhape-url-* / the same	exit 1 FINDING adopt-git-unasked / exit 2 REFUSED adopt-git-unasked; remotes/ absent
a kept submodule, GIT_DEFAULT_HASH=bogus	exit 2 "a git or gh command failed" at the same git init / the same	exit 1 FINDING adopt-git-unasked / exit 2 REFUSED adopt-git-unasked; remotes/ absent
a kept submodule, counting hook named by core.hooksPath in the global config	2 post-index-change runs (_resolved's update-index)	0 runs; the rest of check's output is byte for byte the same
a kept submodule, counting core.fsmonitor program in the global config or in GIT_CONFIG_COUNT	8 runs, 4 in each of _resolved's two repositories: in TMPDIR over main 038dafba's tool, and in the work directory at 9b998936	0 runs; the same findings
a source with no submodule, the same hook	0 runs	0 runs
GIT_OBJECT_DIRECTORY naming the source's own objects	plan ok; the source's objects/info/ stays empty	the same. The clone in the whole environment (mutant M6) wrote objects/info/alternates into the source.

On git 2.55, which CI runs, git clone takes init.defaultBranch = a..b (CI
run 39404718064 on #1031). There the clone question is no finding and every
other question is asked. The rows below follow this machine's git, or a stub,
and lean on no version.

Also measured, on git 2.43, for the clone's flags and environment:

• with protocol.file.allow = never in the config, the clone exits 128 (transport 'file' not allowed) without FILE_PROTOCOL and 0 with it, as execute's does;
• a shallow source, and a source that is itself a --shared clone, clone with --no-checkout --shared (exit 0);
• a parent's -c core.hooksPath=<counting hooks> runs no hook in the clone, because git reads the clone's own -c core.hooksPath after the parent's and takes a key's last value. Without the clone's own setting, the parent's ran reference-transaction 4 times;
• an attr.tree=bogus among a parent's settings, which is why _inherited_env() leaves them out of the questions a checkout answers, still lets the clone through (exit 0);
• GIT_ALTERNATE_OBJECT_DIRECTORIES and GIT_SHALLOW_FILE, which _inherited_env() keeps, write nothing outside the clone. A non-empty file in GIT_SHALLOW_FILE stops the clone, as it stops execute's.

Tests

• tests/test_adopt_check_throwaway_repos.py: 70 rows at 195d9936, and 90 on the merge head e0a98f13, which holds main's 20 rows of adopt-project.py: refused_paths' update-index -z --index-info is untested with core.ignorecase and case twins (a and A) on a case-insensitive disk #1033 as well (see "The merge of main" below). 2a119f2 had 29, and one of them is split in two (below).
  • 42 new rows, the split's two among them:
    • (a) 7;
    • (b) 8, _throwaway_git's failure among them;
    • (c) 2: NIT-R2-2's missing work directory, and the case twins;
    • r1119's review, 18 rows:
      • each form a setting can reach the clone in: a global config file, GIT_CONFIG_COUNT and GIT_CONFIG_PARAMETERS. There are real-git rows under init.defaultBranch = a..b for check and execute, and stub rows for both. The stub git refuses a git clone whose config sets a test key, so they hold on every version of git;
      • _split_clone_env()'s own row: what it takes and what it leaves out;
      • git-config-parameters for the two hook rows;
      • GIT_OBJECT_DIRECTORY naming the source's objects (SHOULD-1);
      • GIT_DIR naming the source, whose own config rewrites the on-disk url. check says what it says without GIT_DIR, and the source's config is unchanged;
      • an environment read that raises leaves no throwaway, for _resolved, _answers and the clone (NIT-3).
    • r1119b's review, 7 rows:
      • a counting core.fsmonitor program runs in none of check's throwaways, from the global config or GIT_CONFIG_COUNT, with a control for each that runs it for a git add (SHOULD-A, 4 rows);
      • --work-dir inside the source, whose config rewrites the on-disk url to a directory that holds nothing or to a network. check says what it says with the work directory outside, prints no NOTE of a url it did not ask, and leaves the source's config as it was (NIT-A, 2 rows);
      • the same rewrite handed down by a parent git in GIT_CONFIG_PARAMETERS, which _answers leaves out, as its docstring says (NIT-B). Its control shows git expands the url so under it.
  • Changed assertions:
    • the work-directory row expects the clone's directory there too;
    • the unmade-work-directory NOTE names the submodule urls (NIT-2), in two rows;
    • _split_clone_env()'s row appends its two GIT_CONFIG_COUNT entries to those the environment holds, and asserts that the last entry kept is its own and that no attr.tree is kept. Built from {}, it failed tests/test_no_auto_maintenance.py::test_no_test_sets_a_git_config_count_of_its_own (r1119b's MUST-1).
  • url_plan and the GIT_DIR row now build their source and plan through two shared helpers, and ask what they asked.
  • Two docstrings changed with no assertion.
  • SonarCloud's new-code duplication read 3.8% at bba168bd (45 of 1,197 new lines; the gate is 3%), from two pairs of repeated test bodies in this file, 10 and 14 lines each. 195d9936 is test-only and factors each pair into one module-level helper in the same file, which takes the function that builds the environment:
    • check_asks_the_clone_a_default_branch, for the check rows under init.defaultBranch = a..b: test_a_default_branch_is_asked_of_the_splits_own_clone (global config) and test_a_parent_gits_default_branch_is_asked_of_the_splits_own_clone (its two parent-git forms);
    • execute_refuses_a_default_branch_its_clone_will_not_take, for the execute rows: test_execute_refuses_a_default_branch_its_clone_will_not_take and test_execute_refuses_a_parent_gits_default_branch_before_any_leg (its two parent-git forms).
    • No test id is renamed, added or removed, and no row asserts or sets up anything it did not.
    • Counted by hand over the lines this PR adds to the file, a run of 10 or more identical lines (leading space ignored) repeats in 54 new lines at bba168bd (46 with blank lines left out), and in none at 195d9936.
  • The 2a119f2 row test_a_default_branch_git_will_not_take_stops_no_question is split in two:
    • test_a_default_branch_is_asked_of_the_splits_own_clone follows this git's own clone;
    • test_a_default_branch_git_will_not_take_stops_no_throwaway_init asks the rehearsal alone, so the -b of every throwaway git init stays pinned on git 2.43.
• tests/test_adopt_root_symlinks.py: main's ref-probe row, item (d).
• On 195d9936: 70 passed, and the ref-probe row passes.
• Over 195d9936, the duplication commit: test_adopt_check_throwaway_repos.py gave 70 passed, 0 skipped, the same 70 ids with the same outcomes as bba168bd (70 passed, 0 skipped), each run in a clean clone. test_path_guard_hygiene.py and test_repo_hygiene.py together: 149 passed.
• Over d0bc40ce's tool, this round's base (9b998936 merged with main 038dafba): 2 failed, 69 passed, of the 70 rows and the ref-probe row. The 2 are the fsmonitor rows, 8 runs each.
• Over main 038dafba's tool: 33 failed, 38 passed.
  • 30 of the 33 are the 30 that failed over 16f9a0e8's tool in the last round, row for row. Each fails for its own reason: plan ok where the finding is due, DID NOT RAISE Refusal from execute, url repositories made in TMPDIR, two hook runs, an uncaught _Unasked, or a function or parameter that main does not have.
  • The other 3 are this round's: the two fsmonitor rows (8 runs each, in TMPDIR), and the parent-rewrite row (main's _answers ran in the whole environment, read the rewrite, and found the url answering nothing).
  • This round's two controls pass there. So do the two inside-the-source rows, which pin the mutant R8 rather than a change of this PR, and the ref-probe row.
• The rows that need git to refuse a clone or a git init use a stub git, first on PATH, and are skipped on Windows. One stub refuses every git clone; another refuses one whose config sets a test key; the ref-probe row's fails only the probe's git init.
• The real-git execute rows under init.defaultBranch = a..b are skipped where this git's clone takes the name, as 2.55's does.
• Case twins under core.ignorecase. No case-insensitive disk is at hand. The row is still sound: _paths_git_refuses hands paths to update-index --index-info and reads ls-files, which read no file of the disk, only the setting. So it sets core.ignorecase=true on a disk that holds both twins.
  • Its control shows the setting is live: git add of the twins under it holds at most one (git 2.43 says will not add file alias).
  • --index-info holds both, so neither twin is named.

Mutants

First round, at bdcf9952: 16 mutants of the behaviour changes, each run over the new file (and M15 over the url files too). 13 were killed and 3 survived:

• M1-M5, M7-M13 and M16 were killed, by the rows the table of that round named. They were not re-run on this head.
• M6 and M14 survived. They were killed in the second round.
• M15, git submodule init without the hook setting, survives: 73 rows of the url files pass. It is equivalent, as git submodule init runs no hook.

r1119's round, at 9b998936: 11 mutants, each run over the file with -x, and the tool restored and sha-checked after each. 11 killed.

Id	Mutant	Killed by
M6	the clone in the whole environment	the GIT_OBJECT_DIRECTORY row
M6b	_split_clone_env() is the whole environment	_split_clone_env()'s row
N11	the clone's environment leaves out GIT_OBJECT_DIRECTORY alone	_split_clone_env()'s row
N1	the clone takes no GIT_CONFIG_PARAMETERS, as at bdcf9952	the real-git git-config-parameters row (the stub rows too, measured over bdcf9952)
N8	the clone without its own -c core.hooksPath	each of the three hook rows, git-config-parameters among them
M14	_answers in the whole environment	the GIT_DIR row: the source's url rewrite gave plan-submodule-url-answers-nothing
M14r	_resolved in the whole environment	the GIT_DIR row. Measured, it wrote [remote "origin"] and [submodule "u0"] into the source's own config, and check said plan ok
N4	_resolved reads its environment after making its throwaway	the environment-read row, resolved
N5	_answers does the same	the environment-read row, answers
N6	the clone does the same, outside its try	the environment-read row, split-clone
N7	the unmade NOTE names no submodule url	the NOTE row

r1119b's round, on this head's tool before its last docstring edit (cea25530, 0b326952): 18 mutants, each run with -x over the rows named, and the tool restored and sha-checked after each. 17 killed; S4 survives as equivalent. A5, A6, A6b, A15, A2b, R8 and A18 are r1119b's own, re-anchored on this head.

Id	Mutant	Killed by
A5, A6, A6b	_split_clone_env() hands back GIT_ATTR_SOURCE, GIT_INDEX_FILE or GIT_WORK_TREE	_split_clone_env()'s row
A15	GIT_CONFIG_PARAMETERS always set, empty where the parent sets none	_split_clone_env()'s row
A2b	the clone's environment drops the GIT_CONFIG_COUNT form	_split_clone_env()'s row
KA1	_inherited_env() keeps attr.tree	_split_clone_env()'s row
KA2	the clone alone takes the command scope back as it stands, attr.tree and all	_split_clone_env()'s row
MR1	the ref probe's CommandFailed stops check	the ref-probe row
MR2	the ref probe's failure is taken with no NOTE	the ref-probe row
MR3	the probe's directory named otherwise, so the stub misses it and git makes it	the ref-probe row: no NOTE
S1	no core.fsmonitor=false, as at 9b998936	the fsmonitor row
S2	core.fsmonitor=false for the throwaway's git init alone	the fsmonitor row
S3	_resolution_of's git submodule init without hooks_off	the fsmonitor row
R8	_answers' two ls-remotes run in the throwaway's own directory	the inside-the-source row, a-directory-holding-nothing; and first over the whole file with -x
R8a	only its ls-remote --get-url there	the inside-the-source row, a-network: the NOTE of a url on a network not asked. It survived the first form of the row, and the a-network case was added for it
R8b	only its other ls-remote there	the inside-the-source row, a-directory-holding-nothing
A18	_answers takes _split_clone_env(), a parent's -c too	the parent-rewrite row; and first over the whole file with -x
S4	_answers' ls-remotes without hooks_off	survives. It is equivalent: ls-remote reads no index and writes no ref, so it runs no hook and no fsmonitor program.

Across the three rounds, 43 distinct mutants: 41 killed, and M15 and S4 survive as equivalent. Of r1119b's own list on 9b998936, R8 and A18 survived there and are killed now. R2 (no --shared, which changes only the cost), R3 (the clone after _paths_git_refuses, whose finding wins either way) and A17 (_resolved takes a parent's -c, under which the throwaway's own hook setting still wins) were judged no defect, and stay so.

Gate

On bba168bd, which merges main 038dafba (#1091, #1111), with a clean tree: 18 batches, 3,413 passed, 0 failed, 8 skipped. The head since is 195d9936, which changes one test file and nothing the tool reads; the rows it re-ran are named under Tests.

The environment was a stub gh, GH_TOKEN bogus, an empty GH_CONFIG_DIR, GIT_CONFIG_GLOBAL=/dev/null, GIT_SSH_COMMAND=false, LANES_LANE unset and EMAIL exported. Each batch had its own basetemp with retention failed, each pytest call ran under 530 s, and at most 4 ran at once.

• test_adopt_check_throwaway_repos.py, test_adopt_relative_submodule_url.py and test_adopt_reencoded_files.py: 157.
• test_adopt_nested_attributes.py and test_adopt_empty_symlinks.py: 132.
• test_adopt_root_symlinks.py, in 2 shards: 205 passed, 3 skipped.
• test_adopt_symlink_target_bytes.py: 130.
• test_adopt_execute_refusals.py: 181.
• test_adopt_entry_paths.py, test_adopt_literal_names.py, test_adopt_project_is_the_source.py, test_adopt_split_branch.py and test_windows_paths.py: 209.
• test_adopt_submodules.py: 167.
• test_adopt_history_gitlinks.py and test_adopt_submodule_url_answers.py: 67.
• test_adopt_manifest_values.py and test_adopt_leg_path_collisions.py: 177.
• test_adopt_plan_yaml_quoting.py: 540.
• test_scaffold_leg_path_collisions.py, test_repo_hygiene.py, test_agents_md_codes.py, test_readme_windows_quoting_sentence.py, test_cli_reference.py, test_adopt_work_dir_refusal.py, test_adopt_clone_claimed.py, test_no_auto_maintenance.py and main's test_path_guard_hygiene.py: 520 passed, 2 skipped.
• test_adopt_c_locale_bytes.py, test_adopt_check_plan_name.py, test_adopt_pins.py and test_pin_annotated_tag.py: 243.
• test_adopt_shape_pin_and_work_dir.py, which names the work-dir NOTE, test_visibility_field_words.py, test_scaffold_reuse_seeded_legs.py and test_adopt_root_shape_paths.py, which the merge changed: 240.
• test_shape_doctor.py, in 4 shards of 112: 445 passed, 3 skipped.

Before this round:

• Lane 1's gate on 9b998936 had 1 failure: test_no_auto_maintenance.py::test_no_test_sets_a_git_config_count_of_its_own (r1119b's MUST-1).
• r1119b's gate on that head merged with main 4ed7c7bf gave 1,061 passed, 2 failed and 8 skipped: that row, and main's ref-probe row (MUST-2).
• Both pass here.
• 0b326952, the head before the last docstring edit, gave the same 18 batches with the same counts.
• tests/test_path_guard_hygiene.py (tests/test_path_guard_hygiene.py and shape-doctor.py: a bare is_file/is_dir/exists guard in a shipped tool fails by file and line unless its _is_a or a reasoned allowlist covers it, and a project.yaml linked into an unsearchable folder is yaml-unreadable (#430) #1111) passed on the merge itself, with no entry added: this PR adds no bare is_file, is_dir, exists, is_symlink or os.path guard.

The merge of main

e0a98f13 merges main ef619c74 (#1158, which adds #1033's case-twin rows to tests/test_adopt_check_throwaway_repos.py) into this branch by a merge commit, on top of 195d9936. The merge base is main 038dafba. The push fast-forwarded the branch, and nothing was rebased or forced.

• One conflict, in that file only: the module docstring, where both sides added a paragraph after "finding, with a NOTE." It was settled by keeping both paragraphs as their sides wrote them, adopt-project.py check: follow-ups of PR #1031 (#910): on git 2.43 an init.defaultBranch git will not take passes check and execute stops after both legs exist; _resolved and _answers still use TMPDIR, hooks and a plain git init #1083's first and adopt-project.py: refused_paths' update-index -z --index-info is untested with core.ignorecase and case twins (a and A) on a case-insensitive disk #1033's second, with a blank line between. Every other hunk of the file merged without a conflict, and no other file conflicted.
• Both sides' rows, helpers and imports are kept, as written. No assertion was changed and no name is defined twice (an AST check of the file's top-level names: 165 names, 0 repeated).
  • Main's with_paths gained two parameters, own_blobs and links, both with defaults. This PR's case-twin row, test_case_twins_are_both_held_under_core_ignorecase, calls it with neither, and so holds one shared blob as it did.
  • The merge adds blob_of and adopt-project.py: refused_paths' update-index -z --index-info is untested with core.ignorecase and case twins (a and A) on a case-insensitive disk #1033's CASE_TWINS, ALL_TWINS, TWINS_REFUSED and TWIN_ANSWERS. This PR's TWINS is a different name.
• Test ids of that file, collected with --collect-only -q in a clean clone at each commit: 29 at 038dafba, 49 at main ef619c74, 70 at 195d9936, 90 at the merge.
  • Main adds 20 ids and removes none. This PR adds 42 and removes 1: test_a_default_branch_git_will_not_take_stops_no_question, which it splits in two (see Tests).
  • The merge is therefore the union of the two sides (91 distinct ids) less that one id, which main left as it was and this PR replaced. Against that expected set the difference is empty.
• Run on the merge, in a clean clone at e0a98f13, each in the probe environment (a stub gh, GH_TOKEN bogus, an empty GH_CONFIG_DIR, GIT_CONFIG_GLOBAL=/dev/null, GIT_SSH_COMMAND=false, EMAIL exported, LANES_LANE unset):
  • tests/test_adopt_check_throwaway_repos.py, one call: 89 passed, 1 skipped. The skip is main's test_on_a_disk_that_ignores_case_each_twin_is_held_or_named, which needs a disk that ignores case, as its docstring says.
  • tests/test_path_guard_hygiene.py, tests/test_no_auto_maintenance.py and tests/test_adopt_single_repository_record.py, one call: 146 passed, 2 skipped. The two are rows of test_no_auto_maintenance.py that skip when the session began with GIT_CONFIG_GLOBAL set, as the probe environment sets it.
  • These are the only runs on the merge. The gate above ran on bba168bd. The merge brings in main's changes to scaffold-project.py, scripts/family.py, the v1.2.0 release notes and tests, and leaves adopt-project.py as it was at 195d9936; it imports none of those changed files.

Known limits

• What check's clone may not inherit is a safety property, not a fidelity limit. Each variable _inherited_env() leaves out names another repository, its objects, an index or a work tree, and git writes there. Under GIT_OBJECT_DIRECTORY naming the source's own objects, a clone in the whole environment wrote objects/info/alternates into the source (r1119), which check promises never to write to. The clone leaves them out, and a row pins it (M6 is killed). _answers and _resolved leave them out too. Under GIT_DIR naming the source, in the whole environment:

  • _answers read the source's own url rewrites (M14);
  • _resolved wrote [remote "origin"] and [submodule "u0"] into the source's config, and check said plan ok (M14r).

  One row pins both.

• The other throwaways still leave out GIT_CONFIG_PARAMETERS, as adopt-project.py check's throwaway repositories: a SHA-256 source, a tree path git refuses, a TMPDIR on another disk and this machine's hooks change the answers #910 made them. That covers the rehearsal, adopt-project.py: check finds, and execute refuses before any leg, a kept nested .gitattributes that outranks the root's line-ending rule for a pinned copy, and a root .gitattributes that git add would re-encode (#530) #619's git add, _paths_git_refuses, _resolved and _answers. Only the clone takes a parent git's -c settings now. Measured on 9b998936 with git 2.43:

  • A parent -c core.protectHFS=true and a source path .g\u200cit/x: check says plan ok, and execute stops extracting the spec leg (unable to checkout working tree) after both legs exist. The same setting in GIT_CONFIG_COUNT is plan-path-git-refuses.
  • GIT_ATTR_SOURCE=bogus, which _inherited_env() leaves out: check says plan ok, and execute's first clone stops at its checkout, fatal: bad --attr-source or GIT_ATTR_SOURCE, after both legs exist.
  • Both were so before this PR. Neither is the clone's: a clone with no checkout reads no attribute and holds every path. Both are filed as adopt-project.py: #910's throwaways leave out a parent's -c settings and GIT_ATTR_SOURCE, so check says plan ok where execute stops after both legs, and three read the environment after making the throwaway (follow-up of #1083) #1136, with the same environment-before-throwaway ordering in _AttributesProbe.__init__, _stored_as_written and _SplitRehearsal.__init__.

• With a work directory nothing can be made in, check no longer asks the url questions; 2a119f2 asked them in TMPDIR. adopt-work-dir-unwritable is the one finding, as for every throwaway since adopt-project.py check's throwaway repositories: a SHA-256 source, a tree path git refuses, a TMPDIR on another disk and this machine's hooks change the answers #910, and execute refuses it before it asks anything. Its NOTE says what went unasked: the source's paths and files, and the urls of the submodules the plan keeps. The relative-url finding needs no work directory, so the person meets it one check later (r1119's NIT-2).

• A partial-clone source is still fetched into by check's own reads (r1119b's NIT-D, probe 10). The promisor fetch runs the upload-pack program that the source's config names, and writes a promisor pack into the source. Main does the same, and the cause is not this PR's clone. It is filed as adopt-project.py check: a partial-clone source missing blobs that check reads is fetched into, so check's own reads run the upload-pack its config names and write a promisor pack into the source #1145.

It was left out of v1.2.0 by Brett Heap's ruling of 2026-10-21T10:32:04Z. Lane 3 has since put it on milestone v1.2.1, and it lands under Brett Heap's v1.2.1 merge word.

Closes #1083
Closes #1032

Lane: openreposhape-1 (openRepoShape-1)

🤖 Generated with Claude Code

Summary by Sourcery

Align adopt-project.py check with the repositories and environment that execution will use, surfacing clone and throwaway Git failures before any split work begins.

New Features:

• Make check rehearse the split’s own source clone before evaluating paths or submodule URLs, reporting clone failures as adopt-git-unasked before any leg is created.
• Run submodule URL resolution and answer checks in isolated work-directory throwaway repositories matching the split’s clone environment.

Bug Fixes:

• Prevent checks from inheriting repository, object, index, work-tree, hook, or fsmonitor state that could modify the source or produce misleading results.
• Ensure failed throwaway operations preserve earlier findings and report Git’s failure as a single unasked finding instead of a generic command failure.
• Keep parent Git configuration parameters relevant to the split’s clone while avoiding unsafe repository-related environment variables.

Enhancements:

• Disable hooks and filesystem monitors consistently across throwaway repositories and align clone protocol, template, object-format, and branch behavior with execution.
• Update work-directory and unasked-question handling so URL checks are skipped when required throwaways cannot be created or queried.

Documentation:

• Update user-facing and test documentation to describe the split clone and work-directory throwaway behavior.

Tests:

• Add comprehensive coverage for clone failures, inherited Git configuration, repository isolation, hooks and fsmonitor suppression, URL-question ordering, work-directory behavior, and environment-read failures.
• Adapt the ref-probe test to isolate ref-probe failures from the new initial clone check.

[sourcery-ai]

Reviewer's Guide

check now rehearses the exact source clone that execute will make and standardizes submodule URL questions on the same work-directory throwaway repositories, reporting Git setup or query failures as actionable adopt-git-unasked findings before any split legs are created; the accompanying tests cover ordering, environment/configuration parity, hooks, cleanup, compatibility, and failure handling.

Sequence diagram for check rehearsing the source clone

sequenceDiagram
    participant Check
    participant WorkDir
    participant Git
    participant Execute
    participant Legs

    Check->>WorkDir: _throwaway()
    Check->>Git: clone --no-checkout --shared with FILE_PROTOCOL
    alt clone succeeds
        Check->>Git: _paths_git_refuses()
        Check->>Git: _submodule_findings()
        Check-->>Execute: findings and plan
        Execute->>Legs: create and extract split legs
    else clone fails
        Git-->>Check: exit status and stderr
        Check-->>Execute: adopt-git-unasked
        Execute-->>Legs: refuse before creation
    end

Loading

Sequence diagram for submodule URL questions in throwaway repositories

sequenceDiagram
    participant Check
    participant Throwaway
    participant Git
    participant Findings

    Check->>Throwaway: _resolved(source)
    Throwaway->>Git: _throwaway_git(configure origin and .gitmodules)
    Throwaway->>Git: _throwaway_git(hash-object and update-index)
    Throwaway->>Git: git submodule init
    Git-->>Throwaway: resolved URL or failure
    Check->>Throwaway: _answers(urls, source)
    Throwaway->>Git: git ls-remote --get-url
    Throwaway->>Git: git ls-remote for local URLs
    alt throwaway creation or Git query fails
        Git-->>Findings: _Unasked as adopt-git-unasked
        Findings-->>Check: stop later URL questions
    else questions succeed
        Git-->>Findings: URL findings and notes
    end

Loading

File-Level Changes

Change	Details	Files
Make check rehearse the split's source clone before running other Git questions, matching execute's clone behavior and refusal timing.	Add a work-directory throwaway git clone --no-checkout --shared using FILE_PROTOCOL, an empty hooks path, the source template, and inherited environment. Convert clone failures into a single adopt-git-unasked finding so later checks are skipped and execute can refuse before creating legs. Add tests for clone failures, protocol handling, environment-sensitive Git settings, work-directory cleanup, and execute refusal behavior.	adopt-project.py tests/test_adopt_check_throwaway_repos.py
Run submodule URL resolution and local URL-answer checks in standardized throwaway repositories instead of ad hoc temporary repositories.	Pass the source through _resolved, _answers, and related finding functions so throwaways use the source format, work directory, fixed branch, empty template, inherited environment, and disabled hooks. Add _throwaway_git to preserve Git's failure text as adopt-git-unasked findings rather than generic command failures. Stop or suppress later URL questions when a throwaway cannot be made or queried, while retaining findings obtained before the failure. Preserve compatibility for existing callers by making new source parameters optional.	adopt-project.py tests/test_adopt_check_throwaway_repos.py
Expand regression coverage and update documentation for the new throwaway and clone semantics.	Verify throwaways are created and removed in the work directory, including previously absent or unwritable work directories. Verify hooks do not run, source object formats and Git settings are respected, URL questions are ordered correctly, and case-twin behavior remains stable. Update docstrings and implementation comments to describe the split clone and work-directory URL repositories.	tests/test_adopt_check_throwaway_repos.py tests/test_adopt_reencoded_files.py adopt-project.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#1083	Make check rehearse the split’s own source clone in the work directory, so a clone failure is reported as adopt-git-unasked before either leg is created.	✅
#1083	Move _resolved and _answers throwaway repositories from TMPDIR to the work directory and create them with the standard throwaway settings, reporting Git failures as adopt-git-unasked and avoiding hooks.	✅
#1083	Close the smaller documentation and regression-test gaps, including correcting the identified adopt-project.py docstring and covering a missing work directory and case twins under core.ignorecase.	❌	The PR adds tests for the missing-work-directory and case-twin cases, and updates several docstrings, but the diff does not change the specifically identified adopt-project.py:466 docstring. It therefore does not fully address this objective.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

(lane openRepoShape-1, 2026-10-21T14:36:09Z) r1119, lane 1's independent reviewer (not the writer), reviewed #1119 at bdcf9952: READY on condition, and PARTIAL because the usage window forced a checkpoint. No MUST. The condition is SHOULD-1, a missing test that pins the clone to _inherited_env(). Measured, that is a safety property: with the whole environment, check writes objects/info/alternates into the source under GIT_OBJECT_DIRECTORY. SHOULD-2 is the GIT_CONFIG_PARAMETERS gap. The mutant runs and the gate are left to a fresh reviewer. The review follows in full.

---

r1119 review of PR #1119 at bdcf9952 (PARTIAL: stopped at the coordinator's checkpoint)

Verdict: READY on condition (PARTIAL). No MUST found. Every behaviour claim I measured holds. The condition is SHOULD-1, a missing test for a safety property. Mutant runs over the tests and the merged-tree gate were not finished; they are listed at the end.

Scratch state: all three copies of adopt-project.py (worktree, $S/base, $S/m6/tree) hash to b985928ed29eb465216f6fa0b308e39c1f23a196aea9ddf81f585a6a0e2d120d, and git status --short in the worktree is empty. The gate's processes were killed by PID and none is left. Nothing was written to GitHub, committed or pushed.

Findings

SHOULD-1: no test pins that the clone runs under _inherited_env(), and the body explains M6 wrongly (adopt-project.py:11184-11189)

• The body calls M6 a fidelity limit. Measured, it is a safety property: the whole environment makes check write into the source repository.
• I ran check with GIT_OBJECT_DIRECTORY=<source>/.git/objects:
  • head: exit 0, plan ok, and the source's objects/info/ stays empty.
  • M6 copy (env=None on the clone): exit 0, plan ok, and the source gains objects/info/alternates: …/god-m6/Thing/.git/objects. That is a write into the source, which check promises never to make.
• Measured directly too: a plain GIT_OBJECT_DIRECTORY=<foreign> git clone --no-checkout --shared writes <foreign>/info/alternates and <foreign>/pack.
• Fix:
  • Add a row that runs check with GIT_OBJECT_DIRECTORY naming the source's own object directory, and asserts the source's objects/info is unchanged. It kills M6.
  • Reword the body's Known limits and the M6 row of the Mutants table.

SHOULD-2: the known limit is real, and it is the failure #1083 exists to remove (adopt-project.py:11188)

• With GIT_CONFIG_PARAMETERS="'init.defaultbranch'='a..b'":
  • head check: exit 0, plan ok;
  • execute: exit 2, REFUSED extracting the spec leg, fatal: invalid branch name: init.defaultBranch = a..b;
  • remotes: ['Northwind-code.git', 'Northwind-spec.git'], and "NOTHING has been rolled back".
• A narrow fix is safe. A parent -c reaches the clone (measured: exit 128, invalid branch name), and the clone's own -c core.hooksPath comes after it, so it still wins.
• Fix: give the clone _inherited_env() plus GIT_CONFIG_PARAMETERS when it is set, never the whole environment (see SHOULD-1). Attributes are irrelevant without a checkout, so the attr.tree reason for leaving it out does not apply here. This can be a follow-up issue if the lane prefers, but the body should then name that issue.

NIT-1: "--shared, so no object is copied" is false for a shallow source (docstring at adopt-project.py:11175-11176, and the body's "the object copy (--shared)")

• git silently ignores --shared when the source is shallow.
• Measured with a shallow copy of a 100k-file, 115 MiB-pack source: the clone took 7.3 s and 10.2 s, used 117.1 MiB, and made no alternates file.
• Fix: say so in the docstring and the body. It is a cost, not a fault: execute's own clones copy as much.

NIT-2: the work-dir-unwritable change hides a plan finding for one round, and the NOTE does not say so (adopt-project.py:11050-11055)

• With a read-only --work-dir and a kept relative-url submodule:
  • base: adopt-work-dir-unwritable and plan-submodule-relative-url;
  • head: adopt-work-dir-unwritable only.
• The relative-url finding needs no work directory, so the user sees it one check later. That is acceptable under one cause, one finding.
• But the body's "Its NOTE still says what went unasked" is only partly true. The NOTE says "It asked nothing about the source's paths and files there" and names no submodule url.
• Fix: add "or its submodules' urls" to the NOTE, or reword the body.

NIT-3 (from reading only, unmeasured): in _resolved (:7708-7709) and _answers (:7918-7919), env = _inherited_env() runs after _throwaway(...) but outside the try. If it raised, the throwaway would be left behind. By reading, GIT_CONFIG_COUNT='²' would do it: '²'.isdigit() is true but int('²') raises. Fix: compute env before _throwaway.

Checked and found sound

• Nothing left behind: the work directory was empty after every check and execute probe (cases a, b, c, d, e, f, j and l, and the 100k-file sources). Each throwaway is removed in a try/finally.
• GIT_DIR and GIT_WORK_TREE:
  • git clone ignores GIT_DIR: a victim repository's file hashes were unchanged.
  • Under GIT_WORK_TREE it records core.worktree outside the throwaway, but with --no-checkout writes nothing there.
• Docs: the edited module docstring is not rendered into docs/cli.md; a grep finds neither the old nor the new text. README.md, AGENTS.md, docs/*.md and templates/ say nothing now untrue: the only hits are three adopt-work-dir-unwritable lines in docs/cli.md's --work-dir help, which this PR does not change.
• Body hygiene: closingIssuesReferences holds adopt-project.py check: follow-ups of PR #1031 (#910): on git 2.43 an init.defaultBranch git will not take passes check and execute stops after both legs exist; _resolved and _answers still use TMPDIR, hooks and a plain git init #1083 alone. adopt-project.py: _resolved and _answers still make their repositories in TMPDIR and run this machine's hooks, where #910 (#1031) moves check's throwaway repositories into the work directory #1032 appears only as "Covers adopt-project.py: _resolved and _answers still make their repositories in TMPDIR and run this machine's hooks, where #910 (#1031) moves check's throwaway repositories into the work directory #1032", with no close, fix or resolve keyword before it. The file names are true: adopt-project.py, tests/test_adopt_check_throwaway_repos.py and tests/test_adopt_reencoded_files.py.

Body-claim table

#	Claim	Measured
1	init.defaultBranch = a..b (global config): before plan ok / execute exit 2 at the spec leg with both legs made; after adopt-git-unasked / REFUSED adopt-git-unasked, remotes/ absent	true. The head finding ends "the split's git clone of the source exited 128 there: fatal: invalid branch name: init.defaultBranch = a..b"
2	GIT_DEFAULT_HASH=bogus: before plan ok / "a git or gh command failed" with Northwind-spec.git left; after FINDING / REFUSED, remotes/ absent	true. Base left ['Northwind-spec.git']
3	kept submodule with a..b: before exit 2 at git init -q <TMPDIR>/openreposhape-url-*; after FINDING / REFUSED	true. Base said git init -q …/tmpx/openreposhape-url-vnouwe9o. On git 2.43 the head finding is the clone's, not _resolved's
4	kept submodule with GIT_DEFAULT_HASH=bogus	true
5	counting hook in the global config, kept submodule: 2 runs before, 0 after; the rest of the output byte for byte the same	true. Base ['post-index-change', 'post-index-change'], head []. Head's output is the same with and without the hook, and base and head differ only in the plan's path
6	no submodule, same hook: 0 / 0	true
7	protocol.file.allow = never: clone exits 128 without FILE_PROTOCOL, 0 with it	true (transport 'file' not allowed)
8	a shallow source and a --shared-clone source clone with exit 0	true, but see NIT-1
9	45 rows, 45 passed on head	true (45 passed in 93 s)
10	14 failed / 31 passed over the base tool	true over both 16f9a0e's and 6da757c's adopt-project.py, the same 14 rows
11	2a119f2's adopt-project.py is unchanged through 16f9a0e	true (empty diffstat)
12	Known limit: M6/M14, the _inherited_env() gap	the gap is true (SHOULD-2). Calling M6 only a fidelity limit is false (SHOULD-1)
13	Behaviour change: an unwritable work dir asks no url question	true. "Its NOTE still says what went unasked" is partly false (NIT-2)
14	Mutants: 13 of 16 killed	unverified: no mutant was run over the tests
15	Gate: 3,050 passed, 5 skipped	unverified: stopped before the first batch ended
16	M15 is equivalent	unverified

Cost of the new clone, against base (base makes none)

Source	Clone time	Disk	Whole check, base vs head
openRepoShape (516 commits, 179 refs)	0.06 s	0.1 MiB	not timed
100k files, 115 MiB pack, 20,001 refs	0.8 s and 1.6 s	1.2 MiB	55.7–61.2 s vs 59.8–82.2 s (+4–8 s typical; 82.2 s is one noisy run)
the same, shallow	7.3 s and 10.2 s	117 MiB, a full copy	59.9 s vs 65.2 s

The load average was about 90 throughout, so the whole-check times are noisy.

Mutants: 0 run over the tests

• I designed 16 mutants. None of them was run over the tests before the checkpoint.
• M6 was only probed by hand (SHOULD-1); I did not run it over the test file.

Merge with main

• Main moved to 7cd66902 (scaffold-project.py: the --reuse-empty-repo help, its docs and each remedy that sends a person into that re-run say ssh, a credential helper or askpass can still make it wait, and how to keep it from waiting (#915) #1101: scaffold-project.py, README.md, docs/cli.md, docs/handbook.html, tests/test_scaffold_reuse_seeded_legs.py, tests/readme-cap.d/915.txt). It overlaps none of this PR's files.
• git merge-tree --write-tree bdcf9952 7cd66902 is clean (exit 0, tree aad41027).
• The scratch merge commit is 5211aece, checked out detached at /workspace/projects/openRepoShape-worktrees/_lane1-scratch/r1119/merged.
• No gate counts. The gate was stopped at the checkpoint before its first batch finished.

Not finished (for a fresh reviewer)

1. Mutant runs. Run them in $S/base, with a basetemp separate from the gate's. Run each over tests/test_adopt_check_throwaway_repos.py; the url mutants also over test_adopt_relative_submodule_url.py and test_adopt_submodule_url_answers.py, and R21 also over test_adopt_c_locale_bytes.py. Use -x, and restore and sha-check after each. R6, R7, R8, R14, R15 and R21 need count=1 replacements: patch _resolution_of, the ls-remote calls and the second _resolved(…) call by their own lines.
   • R1: no removal in _split_clone_asked.
   • R2: no --shared.
   • R3: the clone asked after _paths_git_refuses.
   • R4: _submodule_findings drops moved/notes on an _Unasked.
   • R5: _entry_findings ignores the returned unasked.
   • R6: _throwaway_git without .strip().
   • R7: _resolution_of(scratch…).
   • R8: _answers' ls-remote with cwd=scratch, which I expect survives.
   • R11 and R17: _Unasked(scratch…).
   • R12: a clone failure as unmade=True.
   • R14: the second _resolved without source.
   • R15: no ON_THIS_DISK_ONLY.
   • R21: base without _path_argument.
   • R26 and R27: no removal in _resolved / _answers.
   • Also run M6 itself over the tests, which I expect survives.
2. The gate on $S/merged, using $S/gate.sh: the PR's file; test_shape_doctor.py in 4 shards ($S/doctor-shard{0..3}.txt, 112 ids each); test_scaffold_leg_path_collisions.py; and test_adopt_c_locale_bytes.py, test_adopt_clone_claimed.py, test_adopt_relative_submodule_url.py, test_adopt_submodule_url_answers.py, test_adopt_shape_pin_and_work_dir.py, test_adopt_work_dir_refusal.py, test_adopt_check_plan_name.py and test_adopt_reencoded_files.py.
3. Safety probes not run:
   • core.fsmonitor (global, and in the source's config);
   • a smudge or process filter;
   • submodule.recurse=true;
   • an init.templateDir holding hooks and a config;
   • a partial-clone or promisor source, against git 2.43's CVE-2024-32004 class. That class is already reachable through the reads of the source check makes, and execute clones the source anyway.
4. Cleanup not measured: on KeyboardInterrupt (by reading, the try/finally covers it), and two concurrent check runs in one work directory (by reading, mkdtemp names are unique).

Scratch: /workspace/projects/openRepoShape-worktrees/_lane1-scratch/r1119/ holds probe.py, cost.py, bigsource.py, timecheck.py, gate.sh and probes/.

Lane: openreposhape-1 (openRepoShape-1)

[brettheap]

(lane openRepoShape-1, 2026-10-21T16:52:08Z) r1119b, lane 1's independent reviewer (not the writer), re-checked #1119 at 9b998936: NOT READY, with two MUSTs, each with a proven fix. All five round-1 findings are resolved, and the safety probes found nothing written outside the throwaways.

• MUST-1: the row at tests/test_adopt_check_throwaway_repos.py:1243 fails tests: three more hand-worked GIT_CONFIG_COUNT appends go through appended_to_command_scope, the scan names a count worked out by hand, and paste() gives a pasted submodule update the insteadOf rewrite (#835) #848's GIT_CONFIG_COUNT scan. Lane 1's gate G5 caught it.
• MUST-2: the merge with main 4ed7c7bf fails adopt-project.py: check names what the clone's .git holds as git keeps refs, and asks a pin's file through the links the root keeps, so a link into .git or onto a pin's file is refused before any leg or adopted with the copy beside it (#904) #1091's new row, which sets GIT_DEFAULT_HASH=bogus and expects check to pass.

A fix round follows. The review follows in full.

---

Verdict: NOT READY. Two MUSTs. Both have small fixes, and I proved each fix on a scratch copy. All five round-1 findings are resolved. Every check the brief listed was run; this report is complete, not PARTIAL.

Nothing was written to GitHub, committed or pushed. My worktree /workspace/projects/openRepoShape-worktrees/l1-r1119 is still clean at 9b998936. Every scratch clone I mutated hashes back to 4a0f5881… with a clean status, and none of my processes is still running.

Merge with main (4ed7c7bf)

• git merge-tree --write-tree 9b998936 origin/main is textually clean (exit 0, tree 4bcc0222).
• I built a scratch merge commit 91c0a834, checked out detached at /workspace/projects/openRepoShape-worktrees/_lane1-scratch/r1119/r2/merged.
• Gate on the merged tree: 1,061 passed, 2 failed, 8 skipped.

Batch	Result
test_adopt_check_throwaway_repos.py	63 passed
test_no_auto_maintenance.py	1 failed, 57 passed, 2 skipped (MUST-1)
test_scaffold_leg_path_collisions.py	104 passed
test_shape_doctor.py, 4 shards of 112	445 passed, 3 skipped
c_locale_bytes, clone_claimed, relative_submodule_url, shape_pin_and_work_dir, submodule_url_answers, work_dir_refusal	188 passed
test_adopt_root_symlinks.py (it names adopt-work-dir-unwritable)	1 failed, 204 passed, 3 skipped (MUST-2)

Round-1 findings

• SHOULD-1: resolved.
  • M6 is killed by test_the_clone_writes_nothing_into_an_object_directory_around_it.
  • M14 and M14r are both killed by test_a_repository_around_check_rewrites_no_url_it_asks.
  • Each was my own run on head. The body now calls this a safety property.
• SHOULD-2: resolved, and sound.
  • Every form a parent hands down reaches the clone. The new quoted form, the old 'key=value' form and a real parent git -c init.defaultBranch=a..b ck (a shell alias) each give adopt-git-unasked on head and merged. Each gave plan ok at bdcf9952.
  • Why the GIT_CONFIG_COUNT form already reached the clone at bdcf9952: _inherited_env() (:11418) re-emits the COUNT entries, dropping only attr.tree. It drops GIT_CONFIG_PARAMETERS whole (_NOT_INHERITED, :11411), because its quoted form is not parsed. Measured: base plan ok; bdcf9952 and head adopt-git-unasked.
  • Consistency: both forms now reach the clone, as both reach execute's. attr.tree is filtered from the COUNT form but not from PARAMETERS. That is harmless for a clone with no checkout: a parent attr.tree=bogus still gives plan ok. The same gap in adopt-project.py check's throwaway repositories: a SHA-256 source, a tree path git refuses, a TMPDIR on another disk and this machine's hooks change the answers #910's throwaways is adopt-project.py: #910's throwaways leave out a parent's -c settings and GIT_ATTR_SOURCE, so check says plan ok where execute stops after both legs, and three read the environment after making the throwaway (follow-up of #1083) #1136.
  • The clone's own -c core.hooksPath still wins: 0 hook runs with it, 4 reference-transaction runs without it. A1 and A12, which put its setting before the parent's, are killed by the git-config-parameters hook row.
  • Nothing writes outside the throwaway: see probes 13 and 14 below.
• NIT-1: resolved. The docstring (:11222-11227) and the body say it. Measured: a -q --shared clone of a shallow source prints nothing and makes no alternates.
• NIT-2: resolved. Head's NOTE now ends "nor about the urls of the submodules the plan keeps"; bdcf9952's did not.
• NIT-3: resolved. The environment is read first at :7710, :7919 and :11231. Undoing each one (N4r, N5a, N6c) is killed by its environment-read row.

Safety probes

Trees: base 823624d9 (before the PR), head, main 4ed7c7bf, merged. "Runs" counts programs the probe's own logging scripts recorded during check.

#	Probe	Result	Writes outside the throwaway
1	core.fsmonitor program, global config	8 runs on every tree, from _resolved's update-index. On head they run in the work dir's openreposhape-url-* (SHOULD-A)	none
2	core.fsmonitor in the source's config	0	none
3	smudge and clean filter, global	runs only in #910/#654's -attributes-/-reencoded- throwaways, which rehearse a checkout by design; none in the clone, -url- or -ask-. The counts (28/30/24/30) differ only in clean inside -reencoded-, code this PR does not touch; I did not re-run to prove it is timing	none
4	process filter, global	2 runs on every tree, same throwaways as row 3	none
5	filter in the source's config	0	none
6	submodule.recurse=true	0, findings unchanged	none
7	init.templateDir with hooks and a config (fsmonitor, hooksPath)	base and main 10 runs; head and merged 0 (an improvement)	none
8	template config naming remote.origin.uploadpack	0	none
9	partial clone, history blobs missing	0	none
10	partial clone, HEAD blobs missing (re-made after plan)	the source's own uploadpack program runs 5 times, and a promisor pack is written into the source, identically on all four trees. It comes from check's reads of the source, not from this PR (NIT-D)	the source's objects/pack (all trees)
11	shallow source, global uploadpack.packObjectsHook	head and merged 1 run, base and main 0 (NIT-C)	none
12	shallow source, hook and fsmonitor in the source's config	0	none
13	GIT_ALTERNATE_OBJECT_DIRECTORIES and GIT_SHALLOW_FILE naming a victim repository; GIT_NAMESPACE; GIT_REPLACE_REF_BASE	plan ok	none
14	a parent -c of hooksPath, fsmonitor, core.worktree=<victim>, commit-graph, reflogs, auto gc and maintenance, sharedRepository	base 10 runs; bdcf9952, head and merged 0	none
15	SIGINT, to the process group and to Python alone, paused in the clone and in _resolved	work dir empty in 8 of 8 (head and merged). Exit -2 with a traceback, which predates this PR	none
16	two concurrent check runs, one work dir	they overlapped (2 throwaways at once); both match a solo run; work dir empty after	none

New findings

MUST-1: head fails a gate test (tests/test_adopt_check_throwaway_repos.py:1243)

• test_the_clone_takes_a_parent_gits_settings_and_no_other_repository calls appended_to_command_scope({}, …).
• That fails tests/test_no_auto_maintenance.py::test_no_test_sets_a_git_config_count_of_its_own. It failed in lane 1's G5 on head and in my run on the merged tree.
• Fix: replace that block with:

    for name, value in appended_to_command_scope(
            os.environ, [("attr.tree", "HEAD"), ("test.heldone", "one")]).items():
        monkeypatch.setenv(name, value)
    env = adopter._split_clone_env()
    assert env["GIT_CONFIG_PARAMETERS"] == parameters
    assert [env.get(name) for name in named] == [None] * len(named)
    scoped = [(env[f"GIT_CONFIG_KEY_{n}"], env[f"GIT_CONFIG_VALUE_{n}"])
              for n in range(int(env["GIT_CONFIG_COUNT"]))]
    assert scoped[-1] == ("test.heldone", "one")
    assert "attr.tree" not in [key.lower() for key, _ in scoped]

• Proven: with it, the row and the scan both pass.
• It still tests what it claims: the row still fails under A5 (GIT_ATTR_SOURCE handed back), A15 (GIT_CONFIG_PARAMETERS always set) and a mutant that keeps attr.tree.

MUST-2: the merge with main fails a test that main added (main's tests/test_adopt_root_symlinks.py:2070)

• test_check_says_where_git_would_not_make_the_ref_probe (adopt-project.py: check names what the clone's .git holds as git keeps refs, and asks a pin's file through the links the root keeps, so a link into .git or onto a pin's file is refused before any leg or adopted with the copy beside it (#904) #1091) sets GIT_DEFAULT_HASH=bogus (:2077) and expects check to exit 0.
• This PR's clone (adopt-project.py:9427) makes that setting adopt-git-unasked, so check exits 1.
• Measured: the row passes on main and fails on the merged tree. merge-tree is clean, so a plain update-branch would land a red main.
• Fix: merge origin/main, then make only the ref probe's git init fail, and update that row's docstring:
  • in place of the setenv("GIT_DEFAULT_HASH", "bogus") line, add a stub git first on PATH, skipped on Windows;
  • the stub prints fatal: unknown hash algorithm 'bogus' and exits 128 when its arguments match init*refs-probe-*;
  • otherwise it runs exec "$REAL_GIT" "$@".
• Proven: with that change the row passes on the merged tree.
• This adds tests/test_adopt_root_symlinks.py to the PR's files.

SHOULD-A: a core.fsmonitor program still runs in _resolved's throwaways (adopt-project.py:11118)

• adopt-project.py check's throwaway repositories: a SHA-256 source, a tree path git refuses, a TMPDIR on another disk and this machine's hooks change the answers #910's throwaways pass -c core.fsmonitor=false (:11823, :12106): "No fsmonitor daemon is started for a repository that is about to go".
• hooks_off here does not, though the body says these repositories are "made as adopt-project.py check's throwaway repositories: a SHA-256 source, a tree path git refuses, a TMPDIR on another disk and this machine's hooks change the answers #910 makes the others".
• A global fsmonitor program ran 8 times on head. It ran there before this PR too, in TMPDIR.
• By reading, with core.fsmonitor=true on macOS or Windows this starts a daemon per throwaway. I could not measure that on Linux.
• Fix: hooks_off = ["-c", f"core.hooksPath={empty}", "-c", "core.fsmonitor=false"], plus a row with a counting fsmonitor.
• Proven: 8 runs → 0, and the PR's file plus test_adopt_submodule_url_answers.py pass (85 passed).
• This can go to adopt-project.py: #910's throwaways leave out a parent's -c settings and GIT_ATTR_SOURCE, so check says plan ok where execute stops after both legs, and three read the environment after making the throwaway (follow-up of #1083) #1136 if lane 1 prefers.

NIT-A: R8 survives because no row puts --work-dir inside a repository (:7929; a row beside :1283)

• With a work dir inside the source and the source's config rewriting the url:
  • head gives [plan-submodule-relative-url];
  • R8 adds a false plan-submodule-url-answers-nothing.
• Fix: add that row.

NIT-B: A18 survives (docstring at :7911-7913)

• The docstring says _answers leaves out GIT_CONFIG_PARAMETERS; no row pins it.
• Fix: add a git-config-parameters url-rewrite variant of the :1283 row.

NIT-C: a shallow source makes the clone run uploadpack.packObjectsHook from protected config (probe 11)

• execute's clone runs it too, and turning it off would cost fidelity.
• Fix: one sentence in _split_clone_asked's docstring or under Known limits.

NIT-D (predates this PR; for a follow-up issue): probe 10. check's own reads of a partial source fetch from its promisor, running the source's uploadpack program and writing into the source, the same on every tree.

NIT-E: the body's Gate section is stale. It says 8 batches and 0 failed. It should now carry lane 1's G5 failure and MUST-2's merged-tree result.

Mutants: 31 killed of 36 run

• r1119's list, 14 of 17 killed. Run: R1–R8, R11, R12, R14, R15, R17, R17b, R21, R26, R27. R9, R10, R13, R16, R18–R20 and R22–R25 are described nowhere in round 1, so I did not run them.
  • R2 (no --shared) survives: only cost changes.
  • R3 (clone after _paths_git_refuses) survives: nearly equivalent, since the clone's finding wins either way.
  • R8 survives, and is a real gap: NIT-A.
• SHOULD-1's three, 3 of 3 killed: M6, M14, M14r.
• My own, 14 of 16 killed: A1, A2b, A5, A6, A6b, A11, A12, A15, A22, A23, A24, N4r, N5a, N6c.
  • A17 (_resolved takes the parent's -c) survives. That is not a defect: the throwaway's own hooks setting still wins.
  • A18 survives: NIT-B.
  • An over-broad A2 was replaced by A2b and is not counted.

Body claims

Claim	Measured
Closes #1083 is the only closing keyword; #1032 is "Covers", #1136 "filed as"	true (regex scan; GitHub lists only #1083 as closed)
Known limits names #1136	true (#1136 is open and holds all three items)
Title within the 250 cap	true, 248
63 rows; 35 new = 7+8+2+18	true
Over bdcf9952's tool: 9 failed / 54 passed, and the 9 named	true, exactly those 9
Over 16f9a0e8's tool: 30 failed / 33 passed; 15 of r1119's 18 rows fail, 3 pass	true
GIT_CONFIG_PARAMETERS row: before plan ok, after adopt-git-unasked	true for check. execute was not run by hand; its rows pass on head and fail over bdcf9952's tool
Without its own -c, the parent's hooks ran reference-transaction 4 times	true (4)
attr.tree=bogus still clones	true
GIT_ALTERNATE_OBJECT_DIRECTORIES and GIT_SHALLOW_FILE write nothing	true (I did not try a non-empty shallow file)
(b) "no hook"	partly false: the fsmonitor program runs (SHOULD-A)
11 killed this round; 24 of 25 across both rounds	the arithmetic holds. M6, M14, M14r and N4–N6 reproduced; the first round's 13 were not re-run
Gate: 1,192 passed, 0 failed	the sum is true but stale: G5 has 1 failure (NIT-E)

Probe scripts and logs are in /workspace/projects/openRepoShape-worktrees/_lane1-scratch/r1119/r2/ (probe2.py, probe_s2.py, probe_intr.py, probes/). The mutant definitions and results are in mutants.py and mut/summary.txt there, and the gate logs in gate/.

Lane: openreposhape-1 (openRepoShape-1)

[brettheap]

(lane openRepoShape-1, 2026-10-21T22:23:41Z) r1119c, lane 1's independent re-check of round 3 at bba168bd: READY, with no MUST or SHOULD. It is not the writer f1119c.

• r1119b's findings: MUST-1, MUST-2, SHOULD-A and NIT-A to NIT-C are each resolved. Their mutants were re-run and killed: A5, A6, A6b, A15, A2b, KA1, KA2, MR1-MR3, S1-S3, R8, R8a, R8b and A18. S4 is equivalent.
• Gate on head: 931 passed, 8 skipped, 0 failed, by r1119c. f1119c's 18 batches sum to 3,413 passed and 8 skipped.
• NIT-D is filed as adopt-project.py check: a partial-clone source missing blobs that check reads is fetched into, so check's own reads run the upload-pack its config names and write a promisor pack into the source #1145, and the body names it under Known limits.
• The four optional NITs:
  • NIT-1: the squash message must use bba168bd's corrected NIT-C wording. Lane 1 will do that at landing.
  • NIT-2, NIT-3 and NIT-4 are optional and do not block.
• Landing: adopt-project.py: check asks the split's own clone of the source in the work directory, so a clone this git will not make is adopt-git-unasked before any leg, and _resolved and _answers make their repositories as check's other throwaways do (#1083) #1119 stays a DRAFT with no milestone, outside v1.2.0 by Brett Heap's ruling of 2026-10-21T10:32:04Z unless he places it. It lands after the tag, on a later word.

The full re-check

Verdict: READY.

I found no MUST and no SHOULD. Every item r1119b raised is resolved. Nothing was committed, pushed or written to GitHub. My worktree /workspace/projects/openRepoShape-worktrees/l1-r1119 is still at bba168bd with a clean status. The mutant clone hashes back to b7df715b… (the sha of the head's adopt-project.py) after every mutant. None of my processes is still running.

Checks

1. Main. origin/main is still 038dafba, and git merge-base --is-ancestor origin/main HEAD says it is an ancestor of the head. I needed no merge-tree run.

2. MUST-1: resolved.

• tests/test_no_auto_maintenance.py passes whole: 58 passed, 2 skipped. It includes test_no_test_sets_a_git_config_count_of_its_own. The 2 skips are "the session began with GIT_CONFIG_GLOBAL set", which is the probe environment.
• The row at tests/test_adopt_check_throwaway_repos.py:1313 (it was :1243) now calls appended_to_command_scope(os.environ, [("attr.tree","HEAD"), ("test.heldone","one")]). It asserts that the last scoped entry is test.heldone and that attr.tree is absent.
• I ran seven mutants and all were killed by that row: A5, A6, A6b, A15, A2b, KA1 and KA2.
• The failure text shows the row now reads the session's own entries: KA1 and KA2 fail with assert 'attr.tree' not in ['gc.auto', 'maintenance.auto', 'attr.tree', 'test.heldone'].

3. MUST-2: resolved.

• Head's ref-probe row passes on head and on main's tool (tests/test_adopt_root_symlinks.py::test_check_says_where_git_would_not_make_the_ref_probe).
• @WINDOWS_SKIP sits directly above the def.
• The stub (refusing_the_ref_probe, tests/test_adopt_root_symlinks.py:2070-2090) fails only an init where some argument matches */refs-probe-*. It prints UNKNOWN_HASH and exits 128. Everything else runs exec "$REAL_GIT". REAL_GIT is shutil.which("git") taken before PATH is changed, which gave /usr/bin/git here.
• The docstring is true. I ran main's old row (GIT_DEFAULT_HASH=bogus) against head's tool and it failed with assert 1 == 0 and FINDING adopt-git-unasked.
• MR1, MR2 and MR3 were all killed by that row. MR1 gave REFUSED … git init -q …/refs-probe-… exit 128. MR2 and MR3 gave no NOTE.

4. SHOULD-A: resolved.

• _throwaway_made (adopt-project.py:11541) now returns ["-c", "core.hooksPath=<empty>", "-c", "core.fsmonitor=false"]. All five of its callers get both settings: _resolved, _answers, _AttributesProbe, _stored_as_written and _SplitRehearsal.
• test_no_fsmonitor_of_this_machines_runs_where_the_urls_are_asked, both global-config and git-config-count, passes on head, and so do both controls.
• The same row fails 2 of 2 over d0bc40ce's tool and over main's, with 8 counted runs in each of the 2 × 2 cases. The logs held 8 lines each.
• S1, S2 and S3 were all killed. S4 survives, and it is equivalent: ls-remote reads no index.
• The duplicate -c core.fsmonitor=false in _stored_as_written (adopt-project.py:12250) and _SplitRehearsal.git (:12533) is harmless. Measured: git -c core.fsmonitor=false -c core.hooksPath=/nonexistent -c core.fsmonitor=false config --type=bool --get core.fsmonitor printed false, exit 0.

5. NIT-A, NIT-B, NIT-C: resolved.

• R8 was killed by the a-directory-holding-nothing case. R8b was killed by the same case. R8a was killed only by a-network, so that case is needed.
• A18 was killed by test_a_parent_gits_url_rewrite_is_not_read_where_a_url_is_asked.
• I re-ran probe_nitc.py from my scratch on head. The result matches logs/nitc2.log exactly: the global hook gives 1 run in check and 1 in _extract_leg's clone; the source's config gives 0 and 0; a parent's -c gives 0 and 0.
• I ran the same probe on main's tool (038dafba) as a differential. The global hook gave 0 runs in check and 1 in the clone. So the one run on head comes from this PR's split clone.
• The _split_clone_asked docstring (adopt-project.py:11650-11657) says the global or system config. I measured the global config, not the system one; that part rests on reading git, but the claim is correct. The docstring is true.

6. Gate on head. I ran at most 3 pytest calls at once, each under 5 minutes, in the probe environment. Result: 931 passed, 0 failed, 8 skipped.

Batch	Result
tests/test_adopt_check_throwaway_repos.py	70 passed
tests/test_no_auto_maintenance.py + tests/test_path_guard_hygiene.py	107 passed, 2 skipped
tests/test_adopt_root_symlinks.py, whole	205 passed, 3 skipped
tests/test_shape_doctor.py, 4 shards (111+1, 111+1, 112, 111+1)	445 passed, 3 skipped
tests/test_scaffold_leg_path_collisions.py	104 passed

• Base vs head. Head's test file over main's tool gives 33 failed, 37 passed. Adding the ref-probe row, which passes there, makes 33 of 71 failed, as claimed. Over d0bc40ce's tool it gives 2 failed, 69 passed: the two fsmonitor rows. Both match the body and report.
• Row counts. 2a119f2 has 29 rows and head has 70, as the body says.
• f1119c's batch sum. Its 18 batches add up to 3,413 passed and 8 skipped, which matches the body and report. I did not re-run all 18.

7. Body.

• Closes #1083 is the only closing-keyword hit in a regex scan covering the close, fix and resolve forms. GitHub's closingIssuesReferences lists only adopt-project.py check: follow-ups of PR #1031 (#910): on git 2.43 an init.defaultBranch git will not take passes check and execute stops after both legs exist; _resolved and _answers still use TMPDIR, hooks and a plain git init #1083.
• adopt-project.py: _resolved and _answers still make their repositories in TMPDIR and run this machine's hooks, where #910 (#1031) moves check's throwaway repositories into the work directory #1032 is "Covers", adopt-project.py: #910's throwaways leave out a parent's -c settings and GIT_ATTR_SOURCE, so check says plan ok where execute stops after both legs, and three read the environment after making the throwaway (follow-up of #1083) #1136 is "filed as", and adopt-project.py check: a partial-clone source missing blobs that check reads is fetched into, so check's own reads run the upload-pack its config names and write a promisor pack into the source #1145 is "filed as". All three are open.
• Title is 248 characters. The PR is a draft with no milestone, and the PR's head is bba168bd.
• The .g\u200cit/x in the Known limits is the literal 6-character text (1 occurrence of backslash-u200c, 0 real U+200C). The only non-ASCII character in the body is the robot emoji in the attribution line.
• The Gate, Tests and Mutants counts match the report and my runs.

Findings

No MUST and no SHOULD. The NITs are optional and none blocks landing.

• NIT-1, squash message. The cea25530 commit message still says "of protected config". The bba168bd docstring corrects it to "global or system config; a parent's -c did not reach it". Use the corrected wording in the squash message.
• NIT-2, test file (tests/test_adopt_check_throwaway_repos.py, REWRITTEN_TO, the a-network param). The host https://f1119c.invalid/ names an agent in a committed test. Optional fix: use a neutral name such as example.invalid.
• NIT-3, test file (test_no_fsmonitor_of_this_machines_runs_where_the_urls_are_asked and its control). They are not WINDOWS_SKIP. The existing hook rows aren't skipped either, and CI is Linux-only. Whether Git for Windows runs a #!/bin/sh fsmonitor program is unverified.
• NIT-4, body, "Measured" section (line 38). It still says "Before is main 2a119f28", while main's adopt-project.py has since changed by 546 lines. The two newest rows name 038dafba where it matters, so this is a label only.

Scratch and logs are in /workspace/projects/openRepoShape-worktrees/_lane1-scratch/r1119/r3/. The files to look at are gate/summary.txt, mut/summary.txt, mut/mutlogs/, logs/bvh-main.log, logs/bvh-d0bc.log and body.md.

Lane: openreposhape-1 (openRepoShape-1)

[brettheap]

(lane openRepoShape-1, 2026-10-23T18:08:24Z) Lane 1's delta check of #1119 since its READY head bba168bd: two commits, neither changes what a test asserts; READY carries to e0a98f13 once CI is green there.

• 195d9936 (w1119s): SonarCloud's duplication. The two repeated pairs (SonarCloud's 612-621/1180-1189 and 830-843/1200-1213) are now two module helpers, check_asks_the_clone_a_default_branch(tmp_path, env_of) and execute_refuses_a_default_branch_its_clone_will_not_take(adopter, monkeypatch, tmp_path, env_of). Lane 1 read the diff:
  • each helper's body is the old row body moved word for word, with bad_default_branch(tmp_path) or handed(tmp_path, BAD_DEFAULT_BRANCH) replaced by env_of(tmp_path);
  • the four rows keep their names, docstrings and parametrization and pass bad_default_branch or lambda base: handed(base, BAD_DEFAULT_BRANCH);
  • the helpers are not named test_*, so pytest collects nothing new, and a pytest.skip in the helper still skips its row.
  • The writer measured the same 70 ids passing at bba168bd and 195d9936. SonarCloud passes on 195d9936, and so did tests, tests-git-bash and package.
• e0a98f13 (w1119m): main ef619c74 merged in after tests/test_adopt_check_throwaway_repos.py: rows pin that refused_paths holds each case twin under its own name and blob, or names it, with core.ignorecase true or false, and that check names the twins git refuses and none it holds (#1033) #1158 landed. The one conflict was in the test file's module docstring: both sides added a paragraph, and both are kept. All other hunks merged clean.
  • The file has 90 ids: main's 49 and 195d9936's 70, less the 28 they share, less the one row this PR replaced, test_a_default_branch_git_will_not_take_stops_no_question. The writer checked that set against the merge, and nothing is missing.
  • At e0a98f13: the file gave 89 passed and 1 skipped (main's disk row), and the path-guard, no-auto-maintenance and single-repository-record files gave 146 passed and 2 skipped (test_no_auto_maintenance.py:222, from the probe environment).
• Landing: the merge has a hand-resolved hunk, so e0a98f13 is adopt-project.py: check asks the split's own clone of the source in the work directory, so a clone this git will not make is adopt-git-unasked before any leg, and _resolved and _answers make their repositories as check's other throwaways do (#1083) #1119's new H0. It lands in its turn once tests and SonarCloud are green there, after tests/test_adopt_check_throwaway_repos.py: rows pin that refused_paths holds each case twin under its own name and blob, or names it, with core.ignorecase true or false, and that check names the twins git refuses and none it holds (#1033) #1158, which is now landed. adopt-project.py: check's rehearsal and _stored_as_written take a parent's -c settings, attr.tree too, and the source's objects, GIT_ATTR_SOURCE is refused by name before any question, and each throwaway reads its environment first (#1136) #1169 and adopt-project.py: check and execute run with GIT_NO_LAZY_FETCH=1 and refuse a partial-clone source that lacks an object its branches, tags or HEAD reach as source-partial-clone, so neither fetches into the source any more (#1145) #1180 stay stacked on it.

Lane: openreposhape-1 (openRepoShape-1)

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 17 hours and 2 minutes by commenting @sourcery-ai review. Upgrade to get a review now.