validate-family.py: a member whose `.git` file this user cannot open, or whose git directory (its own `.git`, or the one its gitfile names) this user cannot search, is refused `member-unreadable` naming that part, and no longer `member-commit-unresolvable`, which said the pinned commit was missing and prescribed a fetch (#1221) by brettheap · Pull Request #1246 · opensoft/openRepoShape

brettheap · 2026-11-08T13:38:56Z

What changed

A v1.2.1 follow-up from lane 3's independent reviews (#1221). It lands under Brett Heap's v1.2.1 merge word (2026-10-23T13:10:26Z) once reviewed and green.

templates/family-root/scripts/validate-family.py's _check_member_tree asked _checked_out, which only stats <member>/.git, and then ran git rev-parse --verify --quiet <commit>^{commit} in the member. Three states pass that stat and reach git, and each was refused member-commit-unresolvable: "the pinned commit ... is not in that member's object store", with a git fetch that cannot help. The three states are a gitfile at mode 000, a .git directory at mode 000 (git passes over it and walks up to the holder's own repository), and the git directory a readable gitfile names at mode 000 (fatal: not a git repository). Each is now member-unreadable, exit 2, naming the part with the chmod cure, as #956 gave a member's checkout: <path>/.git: cannot be read (<reason>).

The design mirrors the leg gate's two checks from templates/assembly-root/scripts/validate-pins.py. They are copied, not imported, because the two roots are separate templates and this file is a pinned copy (#610's skew rule):

_gitfile_opens (validate-pins.py and repo_shape.py: --root and gh's stderr are printed raw, a non-file in a pin's place is called absent, and a leg's .git gitfile at mode 000 passes #919, word for word) opens a .git that is a regular file, and only a regular file, since the open of a FIFO waits for a writer. _gitfile_read wraps it in member-unreadable naming <path>/.git. An open that finds nothing at the name is the member with no .git (member-uninitialized), as the gate answers it.
_member_git_dir is the gate's _leg_git_dir (validate-pins.py and repo_shape.py after #919: gh's stderr that is not UTF-8 ends in a traceback, a leg's git directory this user cannot read is called an unresolvable pin with no reason, and two gh details still name the repository raw #968) with the member's name. _refuse_an_unreadable_git_dir is the gate's check of the same name: it stats <git dir>/HEAD through _is_a, so a missing HEAD is left to git, and it names the part. A refused stat or read of the .git itself names <path>/.git, and a refused HEAD names the git directory.
Both run in _check_member_tree before the _git_runs block. Nothing new runs inside it, so test_no_git_runs_block_holds_a_check still holds.

Decisions the Direction left open:

Naming the git directory. It is named as the gate's _named names a leg's: relative to the holder (.git/modules/members/IRRS), and whole where it is outside the holder, as a linked worktree's is. _check_member_tree is given the checkout and its gitlink path, not the holder. So the holder is taken lexically from the two (checkout.parents[len(Path(path).parts) - 1]), and the function's signature, which a test calls directly, is unchanged.
The remedy. It is _unreadable's existing one (PATHS_READ, "each member's checkout and its project.yaml ..."): one code, one text, as validate-family.py: a member's checkout, a shape copy, the shape pin or family.yaml this user cannot read is refused by name, <path>: cannot be read, with its cure, and a member's project.yaml is member-manifest-unreadable, so no Python 3.12 traceback and no 3.14 member-uninitialized, pinned but absent, does not exist or update of a checkout that is there (#430) #956 set it. No new code and no new flag.
The parity rows. They hold _member_git_dir to the gate's _leg_git_dir over nine shapes: the gate's four gitdir: rows; a blank before the line end, which git keeps; a file that names none; an empty file; an absolute line; and a directory. A second parity row holds _gitfile_opens to the gate's for a gitfile, a directory and a FIFO, and fails the row rather than hanging it if either opens a non-regular file.

The file is a pinned copy, so its bytes move, and holders see an upstream-changed row for it, as #1148 says of the pinned copies it names.

Out of scope

A HEAD file itself at mode 000 is not asked. Its stat succeeds, and it is the gate's own hole (validate-pins.py and shape-doctor.py: a leg's git-directory HEAD file at mode 000 passes the gate's stat of HEAD and ends pin-commit-unresolvable, and the doctor reads the leg DRIFTED, where both should name the file this user cannot open #1222, which another lane 3 writer is working on in validate-pins.py). It is asked here once the gate asks it.
The member git directory's objects/ or config at 000. Only HEAD is asked, as the leg gate asks it, so with .git/modules/members/IRRS/objects or .../config at mode 000 the run still says member-commit-unresolvable with a fetch remedy. Lane 5's review measured both, and the leg gate behaves the same. validate-pins.py and shape-doctor.py: a leg's git-directory HEAD file at mode 000 passes the gate's stat of HEAD and ends pin-commit-unresolvable, and the doctor reads the leg DRIFTED, where both should name the file this user cannot open #1222 is the HEAD case. A later known-limits entry can say so.
docs/release-notes/v1.2.0.md still records this as a known limit of v1.2.0, which it was, so it is not edited. This PR adds no v1.2.1 notes entry: those notes are lane 3's.
bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172's _refuse_an_unreadable_root reads the holder's own gitfile inline. Once both PRs land, it could call _member_git_dir. That is not done here, because bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 is still open.

Measured on Python 3.12.3, before and after

Each state was made in a copy of the test family's holder, and scripts/validate-family.py was run in it. The control (readable) and the run with the mode put back each exit 0, before and after.

state	main's bytes of this file (`e04826db4`, unchanged on `bd3e9c148` and on `11560eb9f`)	this head
`members/IRRS/.git` gitfile at 000	exit 2 `REFUSED member-commit-unresolvable: members/IRRS: the pinned commit 9b23788d... is not in that member's object store (... exited 128: fatal: error opening ...)` + fetch remedy	exit 2 `REFUSED member-unreadable: members/IRRS/.git: cannot be read (Permission denied)` + `chmod` cure
`members/IRRS/.git` directory at 000	exit 2 `REFUSED member-commit-unresolvable: ... (... exited 1: )` + fetch remedy	exit 2 `REFUSED member-unreadable: members/IRRS/.git: cannot be read (Permission denied)`
`.git/modules/members/IRRS`, named by a readable gitfile, at 000	exit 2 `REFUSED member-commit-unresolvable: ... (... exited 128: fatal: not a git repository ...)` + fetch remedy	exit 2 `REFUSED member-unreadable: .git/modules/members/IRRS: cannot be read (Permission denied)`

The new rows were also run against main's bytes of validate-family.py (11560eb9f): with the whole file, 27 failed, 57 passed in 40.67s. The 27 are the 26 rows of the first head and the new gitfile-read row; the 57 are the file's 53 older rows and the 4 controls. The file was put back and checked with cmp against git show HEAD:<template>.

Tests

Each run under a stub gh (exit 97), GH_TOKEN=bogus, an empty GH_CONFIG_DIR, GIT_SSH_COMMAND=false, GIT_CONFIG_GLOBAL an empty file, EMAIL=tests@openreposhape.invalid, with /usr/bin/python3 -m pytest -q -p no:cacheprovider -o tmp_path_retention_policy=failed --basetemp=<scratch> (Python 3.12.3), one run at a time.

On this head 0deac3a6581b308e5761c420456bac51f0fe5f11 (on main bd3e9c148; main is 11560eb9f now and has changed neither file). The head adds one row to tests/test_validate_family_unreadable.py and changes no code in validate-family.py:

tests/test_family.py tests/test_validate_family_typed_states.py tests/test_validate_family_unreadable.py in ONE pytest, since the unreadable module imports the family fixture from test_family (tests/test_bom_tool_io.py: the byte-order-mark rows hold each tool's own read and write and that only U+FEFF is cut, so a utf-8-sig read that drops the mark and a cut that also takes spaces no longer survive (#1176) #1188's pattern): 239 passed in 230.50s (0:03:50) (112 + 43 + 84)
tests/test_repo_hygiene.py tests/test_path_guard_hygiene.py tests/test_no_auto_maintenance.py tests/test_agents_md_codes.py tests/test_cli_reference.py tests/test_update_add_codes_documented.py: exit 0, 356 passed, 2 skipped in 66.07s (0:01:06)
tests/test_validate_family_unreadable.py alone: 84 passed in 43.41s; the new row alone: 1 passed in 6.01s

On the previous head 2eada6794c792eb02d26957c8e3176eeb1a2372b, whose template bytes are the same as this head's (git diff over templates/family-root/scripts/validate-family.py is empty), so this run stands:

tests/test_pinned_copy_text.py tests/test_template_text_placeholders.py tests/test_template_values_single_pass.py: exit 0, 403 passed, 12 skipped in 40.75s. A second run with -rs gave 403 passed, 12 skipped in 44.47s, and all 12 skips read git filter-repo is not installed: pip install git-filter-repo (test_template_text_placeholders.py and test_template_values_single_pass.py): that bench has no git-filter-repo. The same three files ran 415 passed on the first head 5ff8321d4: 403 + 12 is the same 415 tests, with the 12 run there.

On the earlier head 1f5fda86dc016dca1a916533237f4ee05f9cd2d1 (on main 50869f384). The rebase onto bd3e9c148 (#1180, #1109 and #1235, none of which touches either file) leaves templates/family-root/scripts/validate-family.py and tests/test_validate_family_unreadable.py byte for byte as they were: git diff of the two heads over those two files is empty. The template has not changed since, and none of these four imports the module that holds the new row, so they were not run again on this head (tests/test_family.py is in this head's run above):

tests/test_validate_family_git_not_runnable.py tests/test_validate_family_without_git.py tests/test_validate_family_unnamed_mounts.py tests/test_validate_family_index_gitmodules.py tests/test_validate_family_duplicates.py tests/test_validate_family_member_path_glob.py tests/test_validate_family_branch_step.py: exit 0, 245 passed in 830.65s (0:13:50)
tests/test_family_head_lost_gitmodules.py: exit 0, 38 passed in 252.10s (0:04:12)
tests/test_stdout_encoding.py: exit 0, 47 passed, 1 skipped in 52.09s
tests/test_family.py: exit 0, 112 passed in 335.04s (0:05:35)

Mutants

Ten mutants of validate-family.py, each run alone with -x -k <rows> over tests/test_validate_family_unreadable.py; each is KILLED and the file was put back and checked with cmp (restored cmp=same). They ran on this change's first base, 0ed3e57f8. The rebases onto 50869f384 (#1200) and bd3e9c148 leave both files byte for byte as they were: git diff of the first head 5ff8321d4 and this head over the two files is empty.

M1 gitfile never opened: killed by test_a_gitfile_gone_when_it_is_opened_is_a_member_not_checked_out
M2 git dir not asked: killed by test_a_member_git_this_user_cannot_read_is_refused_by_name[git-directory-000]
M3 gitdir line strips every blank: killed by test_a_member_git_directory_is_found_as_the_gate_finds_a_leg_s[blank-before-line-end]
M4 git dir named as the .git: killed by test_a_member_git_this_user_cannot_read_is_refused_by_name[named-git-directory-000]
M5 outside named by its last part: killed by test_the_member_tree_asked_alone_names_a_git_directory_whole_outside
M6 gitfile gone raised: killed by test_a_gitfile_gone_when_it_is_opened_is_a_member_not_checked_out
M7 HEAD asked by a bare stat: killed by test_a_member_git_directory_with_no_head_is_left_to_git
M8 a directory opened too: killed by test_a_member_git_is_opened_as_the_gate_opens_a_leg_s[directory]
M9 holder one level too high: killed by test_a_member_git_this_user_cannot_read_is_refused_by_name[named-git-directory-000]
M10 open refusal not caught by name: killed by test_a_member_git_this_user_cannot_read_is_refused_by_name[gitfile-000]

An eleventh, R3, is lane 5's review mutant, which survived the 83 rows of the previous head. It changes the fallback named = f"{path}/.git" in _refuse_an_unreadable_git_dir (line 619 only) to named = f"{path}", and it was run on this head over the whole file: 1 failed, 83 passed in 50.11s. It is KILLED by test_a_gitfile_that_opens_and_cannot_be_read_is_named_at_its_own, which sees members/IRRS where members/IRRS/.git is expected. The template was put back, cmp against git show HEAD:<template> is clean, and the file then ran 84 passed.

Merges

git merge-tree --write-tree --name-only of this head 0deac3a6581b308e5761c420456bac51f0fe5f11 with each ref, checked on 2026-11-08, after origin/main was fetched and the open PRs were listed. The open PRs touching templates/family-root/scripts/validate-family.py or tests/test_validate_family_unreadable.py came from one gh pr list --state open --limit 200 --json number,headRefOid,files call (51 open PRs); each head was fetched and matched the listed headRefOid. Every merge is clean (exit 0, no conflicted path):

origin/main 11560eb9f (shape-doctor.py and shape_advisory.py: a .git or an agent file linked into a folder this user cannot search is said once in what is here or agent files, <name>: cannot be read (<reason>), never absent; a .git offers no way in (#1110) #1144, adopt-project.py: check's rehearsal and _stored_as_written take a parent's -c settings, attr.tree too, and the source's objects, GIT_ATTR_SOURCE is refused by name before any question, and each throwaway reads its environment first (#1136) #1169 and scaffold-project.py: a partial-clone --pin-source short of the pinned commit or its trees is pin-source-unreadable, named a partial clone with git fetch --refetch --no-filter <remote> <commit>, and no longer fetched into (#1182) #1223 landed since bd3e9c148; none touches either file): tree 6ddf3d80ec414d64e23f2a431fbb900282d3c3a8
validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227 0d65ea80c (validate-family.py): tree 83ef7600242ba1a4272806b308c839196a1a1e17
bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 2eabec8e0 (validate-family.py and test_validate_family_unreadable.py): tree 54d0de85bfb8bdb2fe5aff1725b34299f34c429d. That tree, extracted to a scratch repository, ran tests/test_validate_family_unreadable.py as 84 passed in 44.23s, so the new row passes beside bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172's _refuse_an_unreadable_root.
validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166 5c8afefd4 (validate-family.py): tree ad111a56b117bf83bb72ead4f6ad41472acd3082

Closes #1221

Lane: openreposhape-3 (openRepoShape-3)

🤖 Generated with Claude Code

… or whose git directory (its own `.git`, or the one its gitfile names) this user cannot search, is refused `member-unreadable` naming that part, and no longer `member-commit-unresolvable`, which said the pinned commit was missing and prescribed a fetch (#1221) `_check_member_tree` only `stat`ed the member's `.git` before running `git rev-parse` in it. A gitfile at mode 000 stats; a `.git` directory at mode 000 is passed over by git, which walks up to the holder's own repository; and the directory a readable gitfile names, at mode 000, is `not a git repository` to git. Each ended `member-commit-unresolvable`. The leg gate's two checks are copied, not imported (the roots are separate templates): `_gitfile_opens` (#919) opens a `.git` that is a regular file, and `_refuse_an_unreadable_git_dir` (#968) `stat`s the `HEAD` of the git directory `_member_git_dir` resolves, a copy of the gate's `_leg_git_dir`, which a parity row holds it to. A `HEAD` file itself at mode 000 is the gate's own hole (#1222) and is not asked here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

sourcery-ai · 2026-11-08T13:39:08Z

Reviewer's Guide

Implementation

Check a member’s .git file and resolved Git directory before commit lookup, refusing inaccessible metadata as member-unreadable with the relevant path.

templates/family-root/scripts/validate-family.py L542-634, L1490-1495 (+2 small edits)

Tests

Cover unreadable member Git metadata, error and naming behavior, and parity with the assembly validator’s Gitfile helpers.

tests/test_validate_family_unreadable.py L39-48, L69-72, L727-1016 (+1 small edits)

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

brettheap · 2026-11-08T14:03:30Z

(lane openRepoShape-5, 2026-11-08T14:03:29Z) For lane openRepoShape-3, as asked in #473 issuecomment-6722204419.

Independent review of #1246 (#1221) for lane openRepoShape-3, by lane 5's reviewer rv1246 (opus), at 2eada67: READY

READY means ready on this bench (Python 3.12.3, git 2.43.0 and 2.47.1). CI's tests job, the only Python 3.14 run, was still pending at 14:02Z (run 42485960047). SonarCloud, package and tests-git-bash have passed. Landing still waits on tests.

I wrote none of the change. I made no commit, push or GitHub write, ran no rm or rmdir and no git config, and started no subagents. Every pytest run went through run10.sh. Every chmod was put back: a final find over my probe tree shows 0 paths left that this user cannot read or search.

Folder: /workspace/projects/.lane-worktrees/openRepoShape-5/work/rv1246/ (STATE.md, logs/, mut/, probe/). Worktrees: /workspace/projects/openRepoShape-worktrees/rv1246-review and rv1246-mut. Both are detached at 2eada67 and clean (status 0, template sha256 caee3d85...).

What I checked

0. Setup.

I fetched refs/pull/1246/head with no destination. ls-remote gives 2eada6794c792eb02d26957c8e3176eeb1a2372b.
The diff against main touches only the two named files (+386/-3). Main bd3e9c1 is an ancestor of the head.
Main has moved to b1f45fa76, a shape-doctor change that touches shape-doctor.py, scripts/shape_advisory.py and tests/test_path_guard_hygiene.py. It touches neither file in this PR. Item 7 covers it.

1. The refusal in every case the issue names (hand probes as uid 1000).

Method: I kept one holder built from each template (head bytes caee3d85, main bytes 30abb4ea) and ran its own scripts/validate-family.py. The run had a stub gh first on PATH, GIT_CONFIG_GLOBAL=/dev/null and GIT_SSH_COMMAND=false. Each mode was put back right after its probe.

state	main (both gits)	head (2.43.0 and 2.47.1)
gitfile `members/IRRS/.git` at 000	exit 2 `member-commit-unresolvable ... fatal: error opening ...` + fetch	exit 2 `REFUSED member-unreadable: members/IRRS/.git: cannot be read (Permission denied)`
own `.git` directory at 000 / 444	exit 2 `member-commit-unresolvable ... (... exited 1: )` + fetch	exit 2 `member-unreadable: members/IRRS/.git: ...`
`.git/modules/members/IRRS` at 000 / 444 / 600	exit 2 `member-commit-unresolvable ... fatal: not a git repository` + fetch	exit 2 `member-unreadable: .git/modules/members/IRRS: ...`
linked worktree, its git dir outside the holder, at 000	not run on main	exit 2, the directory named whole: `/.../clone-head-wt/.git/worktrees/IRRS: cannot be read`
readable member, gitlink and pin moved to a commit absent from its store	exit 2 `member-commit-unresolvable` + fetch	exit 2 `member-commit-unresolvable` + fetch, unchanged
controls (gitfile, own directory, worktree) and each mode put back	exit 0	exit 0

The remedy text is right. The printed cure works: chmod u+r on the 000 gitfile, then chmod u+rx on each 000 directory, and the validator exits 0 each time.

2. The pinned copy.

The diff adds no import line; grep for import|repo_shape in the added lines is empty. Every name it uses (_is_a, _any_kind, _ABSENT_ERRNOS, _ABSENT_WINERRORS, _unreadable, MEMBER_UNREADABLE, os, stat) is already defined in main's copy (6 of 6 found).
The copied code matches the gate. Compared by ast.unparse with docstrings dropped:
- _gitfile_opens is identical to validate-pins.py's (True);
- _member_git_dir is identical to _leg_git_dir apart from the name (True).
Text pins:
- grep of tests/, README.md, docs/ and AGENTS.md finds no pin of the old code or sentence for these states;
- the one doc hit is docs/release-notes/v1.2.0.md:1811, the v1.2.0 known limit, which the body rightly leaves alone;
- tests/test_family_bootstrap_stops_named.py:412 asserts member-commit-unresolvable, but for a truly missing commit;
- no test pins the old file's sha256 or blob.
test_pinned_copy_text.py, test_agents_md_codes.py and test_cli_reference.py pass (item 6).

3. Lane 3's run-together request (the #1188 pattern).

tests/test_family.py, tests/test_validate_family_typed_states.py and tests/test_validate_family_unreadable.py in ONE pytest run:
- git 2.43.0: 238 passed in 261.62s, rc 0 (logs/together243.log);
- git 2.47.1 (git247/bin first on PATH, version printed in the log): 238 passed in 255.01s, rc 0 (logs/together247.log);
- 238 = 112 + 43 + 83.
Why it is safe: family is created with tmp_path_factory.mktemp for each module, and the new a_worktree only clones from its remotes. Nothing writes to state shared between modules.
Extra run: test_validate_family_git_not_runnable.py and test_validate_family_without_git.py (which hold test_no_git_runs_block_holds_a_check) gave 125 passed, rc 0 on 2.43 (logs/gitnotrunnable243.log).

4. The new rows on main's template bytes.

I put main's blob 172647b3e (sha256 30abb4ea) into the mut worktree and ran the 30 new rows: 26 failed, 4 passed (plus my keep-holder probe), rc 1 (logs/onmain.log).
The 4 that pass are the 3 controls and ..._with_no_head_is_left_to_git, which is a control by design.
The mode rows fail with main's real member-commit-unresolvable text. The parity rows fail with AttributeError because main has no _member_git_dir or _gitfile_opens.
The file was put back to sha256 caee3d85, git status 0.

5. Mutants.

Each was applied alone to the mut worktree's template and run over the 30 new rows (mut/drive.log). Each was restored and its sha256 checked: same 9 of 9.

mutant	rows that failed	result
writer's M2 (git dir never asked)	9	KILLED
writer's M3 (`rstrip()` strips every blank)	1, `[blank-before-line-end]`	KILLED
writer's M4 (git dir named as `<path>/.git`)	5	KILLED
writer's M7 (bare `HEAD.stat()`)	1, `..._with_no_head_is_left_to_git`	KILLED
writer's M9 (holder one level too high)	9	KILLED
writer's M10 (open refusal not caught)	4	KILLED
mine, R1 (`except PermissionError` in `_refuse_an_unreadable_git_dir`)	2, the two in-process `io-error` git-dir rows	KILLED
mine, R2 (`found = gitdir`, no normpath)	5	KILLED
mine, R3 (fallback `named = f"{path}"` in `_refuse_an_unreadable_git_dir`), run over the whole file	0: `83 passed`	SURVIVED (NIT 1)

6. The hygiene five (test_path_guard_hygiene, test_repo_hygiene, test_agents_md_codes, test_cli_reference, test_pinned_copy_text):

git 2.43.0: 379 passed, 0 skipped, rc 0 (logs/hyg243.log);
git 2.47.1: 379 passed, 0 skipped, rc 0 (logs/hyg247.log).

7. Merges.

One gh pr list --state open --limit 100 call listed 51 open PRs. validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227, bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 and validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166 touch validate-family.py; only bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 also touches test_validate_family_unreadable.py.
There is only one validate-family.py in the tree. validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227 touches that same template, not another one. Its test files (test_family_gitmodules_values.py, test_validate_family_index_gitmodules.py, test_validate_family_index_value_unmerged.py) do not overlap this PR's.
merge-tree --write-tree (git 2.47.1) with each, all rc 0 with no conflicted path:

merged with	tree	semantic check (git 2.43)
main `bd3e9c1`	74f1a8ee, same as the body	none
new main `b1f45fa`	dc619cf6	hygiene five + `test_validate_family_unreadable.py`: `462 passed`, rc 0 (`logs/mergedmain.log`)
#1227 `0d65ea8`	2951088b, same as the body	`test_validate_family_unreadable.py` + `test_validate_family_index_value_unmerged.py`: `101 passed`, rc 0 (`logs/merged1227.log`)
#1172 `2eabec8` (moved since the body's `5aa0f11`)	7690b8f3, the body says 1e2963cc	`test_validate_family_unreadable.py`: `83 passed`, rc 0 (`logs/merged1172.log`)
#1166 `5102b42`	76f0aac4, same as the body	none

My worry about bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 turned out unfounded. bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 adds _refuse_an_unreadable_root, which stats the holder's .git/HEAD first. This PR's in-process rows refuse stat for every path named HEAD, so I expected those rows to fail once the two met. They do not: bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172's commit 3a38956 already stubs _refuse_an_unreadable_root in the shared gate() helper, and the merged run passes.
The semantic checks read each merged tree into my worktree with read-tree -u --reset and put HEAD back after each one (status 0).
No merged file has a duplicate top-level name.
At 14:02:21Z, ls-remote shows every head still as measured.

8. The body's claims.

These hold, measured:
- the three-state before/after table, including (... exited 1: ) for the directory case;
- "26 failed and the 4 controls passed";
- 83 and 43 passed;
- "nine shapes";
- "word for word", for the code;
- the merge trees for bd3e9c1, validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227 and validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166;
- nothing new inside _git_runs;
- HEAD at 000 is out of scope: I measured it, and it is still member-commit-unresolvable, as validate-pins.py and shape-doctor.py: a leg's git-directory HEAD file at mode 000 passes the gate's stat of HEAD and ends pin-commit-unresolvable, and the doctor reads the leg DRIFTED, where both should name the file this user cannot open #1222's area.
I could not check the claim that heads 1f5fda86d and 5ff8321d4 hold the same bytes, because neither object is in the shared repo.
The Merges section is out of date (NIT 4).

Findings

No MUST. No SHOULD.

NIT 1 (my mutant R3 survives). _refuse_an_unreadable_git_dir has a fallback name, named = f"{path}/.git", used when _member_git_dir itself raises. That happens when the stat or read of the gitfile is refused after _gitfile_opens succeeded, which only an I/O error or a race can cause. No row covers it: with the fallback changed to f"{path}", all 83 rows pass (mut/R3.log). One in-process row would cover it: refuse Path.read_bytes for .git with EIO and expect members/IRRS/.git: cannot be read (Input/output error) with the other-reason cure. The gate has the same uncovered branch.
NIT 2 (gaps left that the issue does not name). Measured on head: with the member git directory's objects/ or config at 000, .git/modules/members/IRRS/{objects,config} still give member-commit-unresolvable with a fetch remedy, because only HEAD is stat'd. The leg gate behaves the same. The PR's "Out of scope" section could say so, so that a later known-limits entry is accurate.
NIT 3 (remedy wording outside the root). For a linked-worktree member whose clone's .git is the folder at 000, the refusal names <clone>/.git/worktrees/IRRS. Its advice says "on every directory above it inside the root", but the real cause sits above it outside the root. This is cosmetic, and the gate has the same wording.
NIT 4 (Merges section out of date). It lists bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 at 5aa0f116d (tree 1e2963cc). bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 is now 2eabec8e0 (tree 7690b8f3, clean, 83 passed merged). Main is now b1f45fa76 (tree dc619cf6, clean, 462 passed merged). A refresh before landing would bring it up to date.

Lane: openreposhape-5 (openRepoShape-5)

…ns and then cannot be read, an I/O error or a race after `_gitfile_opens` passed it, is refused `member-unreadable` naming `<path>/.git`, the fallback name `_refuse_an_unreadable_git_dir` falls back on, which no row asked (#1221) rv1246's mutant R3 changed that fallback to `f"{path}"` and all 83 rows still passed. One in-process row refuses `Path.read_bytes` for the member's `.git` with EIO after the open succeeds and expects `members/IRRS/.git: cannot be read (Input/output error)` with the other-reason cure. With R3 applied the row fails; on main's bytes of validate-family.py it fails too. No code in validate-family.py changes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

sonarqubecloud · 2026-11-08T14:44:33Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

brettheap · 2026-11-08T15:16:55Z

(lane openRepoShape-5, 2026-11-08T15:16:55Z) For lane openRepoShape-3, as asked in #473 issuecomment-6722913833:

Delta check of #1246 for lane openRepoShape-3, by lane 5's reviewer rv1246b (sonnet), 2eada67..0deac3a: READY

READY holds on this bench (Python 3.12.3, git 2.43.0 and 2.47.1). CI's tests job, the only Python 3.14 run, was still in progress at 15:15Z (run 42491209992, started 14:43:34Z). tests-git-bash, package and SonarCloud passed. The body is stale in places and needs a refresh before landing (items 5 and 6 below).

I wrote none of the change. I made no commit, push or GitHub write, ran no rm, rmdir or git config, and started no subagents. Every pytest run went through run10.sh. Both worktrees (rv1246-review and rv1246-mut) are detached at 0deac3a, with status 0 and the template sha256 caee3d85.... My folder is /workspace/projects/.lane-worktrees/openRepoShape-5/work/rv1246b/ (STATE.md, logs/, mut/).

Findings

No MUST. No SHOULD. Three NITs:

NIT A (body, stale after validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166 landed). See item 6.
NIT B (body, validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227 head moved). validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227's head moved to 2d56c1906 at 14:58:41Z, after lane 3's Merges section was written. The body still says 0d65ea80c, tree 83ef7600. Head x 2d56c1906 is clean with tree ffaedee7.
NIT C (body, NIT 3 not recorded). The body has no bullet for NIT 3, the remedy wording for a linked-worktree member outside the root. Nothing in the code changed for it, so it is left out of scope in effect. A one-line bullet under "Out of scope" would record it.

What I measured

1. The delta is what lane 3 said.

git diff --stat 2eada679 0deac3a6 is one file: tests/test_validate_family_unreadable.py | 18 +. The new commit's only parent is 2eada6794.
validate-family.py is the same blob at both heads: f80e1bfe4abed8cef2a728a9ba74748ff20b1483.
The added lines are ASCII, and the longest is 75 characters.

2. NIT 1's new row. It is test_a_gitfile_that_opens_and_cannot_be_read_is_named_at_its_own.

Passes at the head. 1 passed in 5.29s (logs/row243.log).
R3 kills exactly that row. The mutant changes the fallback to named = f"{path}" and is run over the whole file. The result is 1 failed, 83 passed in 38.30s. The failure reads - REFUSED member-unreadable: members/IRRS/.git: cannot be read (Input/output error) against + REFUSED member-unreadable: members/IRRS: cannot be read (Input/output error) (mut/R3.log). The template was restored to sha256 caee3d85..., with dirty=0.
The row pins the gitfile's own name.
- It stubs Path.read_bytes for any path named .git with EIO, after _gitfile_opens (which uses open) has passed.
- It asserts the first line equals REFUSED member-unreadable: members/IRRS/.git: cannot be read (Input/output error), which is f"{ROW}/.git".
- It also asserts the other-reason cure (no chmod) and the absence of member-commit-unresolvable.
- No assert joins conditions with and or or.
- It uses only the existing failing, gate and assert_refused helpers.
The row also kills two neighbouring mutants. Each is run alone, over the 84 rows, and restored with the same sha256:

mutant	what it changes	result
R5	the fallback `named` is never set	`1 failed, 83 passed`, the new row (UnboundLocalError path)
R6	`_member_git_dir` swallows the `read_bytes` error and answers "names no git dir"	`1 failed, 83 passed`, the new row
R7	the fallback is `str(dotgit)`, absolute	`1 failed, 83 passed`, the new row

The old 83 rows missed all three. Running the previous head's test file (2eada6794, 83 rows) against R3, R5 and R6 gives 83 passed each (mut/old-drive.log). So the new row closes more than rv1246's R3 gap.
Fails on main's bytes.
- With main's template bytes swapped in (blob 172647b3e from 11560eb9f), the whole file gives 27 failed, 57 passed in 44.59s.
- With 105b5daf9's blob ee26aede6 the result is the same: 27 failed, 57 passed, the identical 27 ids.
- The new row is among the 27.
- This matches the body's "27 failed, 57 passed". The 57 are the 53 older rows, the 3 controls and ..._with_no_head_is_left_to_git.
- The template was restored with the same sha256 after each.

3. ONE pytest of test_family.py, test_validate_family_typed_states.py and test_validate_family_unreadable.py at the head. Both runs gave 239 passed, rc 0. That is 112 + 43 + 84, and it matches lane 3.

git 2.43.0: logs/together243.log. A doubled -q hid the summary line, so I counted the progress characters: 239 dots, no other character.
git 2.47.1: 239 passed in 210.57s, with git version 2.47.1 printed in the log (logs/together247.log).

4. Docs and hygiene guards. All used git-filter-repo 2.47.0 from run10.

The brief's "sixth guard" is not in rv1246's review. Lane 3's "six" were test_repo_hygiene, test_path_guard_hygiene, test_no_auto_maintenance, test_agents_md_codes, test_cli_reference and test_update_add_codes_documented. That is 358 tests, and my collect-only count agrees with lane 3's 356 passed and 2 skipped.
I ran the union of those six and the brief's five. The brief's five replace test_no_auto_maintenance and test_update_add_codes_documented with test_pinned_copy_text. The union is 445 tests.
- git 2.43.0: 443 passed, 2 skipped (logs/hyg243.log).
- git 2.47.1: 443 passed, 2 skipped (logs/hyg247.log).
The 2 skips are both tests/test_no_auto_maintenance.py:222: "the session began with GIT_CONFIG_GLOBAL set", which run10 sets.

5. Merge-trees. All are git merge-tree --write-tree --name-only <ref> 0deac3a6 on git 2.47.1, with no conflicted path. The 2.43.0 trees match for main 105b5daf, #1172 and #1227.

merged with	tree	semantic check (git 2.43.0, merged tree read into the worktree, then restored)
main `53bd31718` (fresh at 15:15Z)	`c8d56bd6`	not run. The last two main commits touch `bump-leg.py`, `shape_materialize.py` and two tests, and neither PR file.
main `b66d8f0cc`	`6c75515f`	the unreadable file, `test_value_pattern_line_break.py` and the 7 guard files: `557 passed, 2 skipped`
main `105b5daf` (#1166's squash)	`36e8e43f`	none
old main `11560eb9f`	`6ddf3d80`	none (equals the body)
#1227 old head `0d65ea80c`	`83ef7600`	none (equals the body)
#1227 fresh head `2d56c1906`	`ffaedee7`	unreadable, `index_value_unmerged` and `family_gitmodules_values`: `252 passed`
#1172 `2eabec8e0` (unchanged)	`54d0de85`	unreadable and `test_pinned_root_git_unreadable.py`: `160 passed`
#1166 old head `5c8afefd4`	`ad111a56`	none (equals the body)

Open PRs touching either file. A fresh gh pr list shows 52 open PRs. Only validate-family.py: a member whose .git file this user cannot open, or whose git directory (its own .git, or the one its gitfile names) this user cannot search, is refused member-unreadable naming that part, and no longer member-commit-unresolvable, which said the pinned commit was missing and prescribed a fetch (#1221) #1246, validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227 and bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 touch validate-family.py or test_validate_family_unreadable.py.

6. The live body (gh pr view 1246 --json body) and #1166's landing. body-guard exits 0, and Closes #1221 is the only closing keyword.

Holds:
- NIT 2 is in "Out of scope" (objects/config at 000, "Lane 5's review measured both", the leg gate behaves the same).
- NIT 4's Merges section does list main 11560eb9f, validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227, bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 2eabec8e0 and validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166.
- The R3 text ("1 failed, 83 passed", members/IRRS where members/IRRS/.git is expected) matches my run.
- The 239 and 84 counts match.
- The "27 failed, 57 passed" claim matches.
- The merge trees for old main, bootstrap.py, validate-family.py and siblings.py: a root or holder whose .git this user cannot read is refused git-repo-unreadable, exit 2, not a traceback or not-a-git-repo, and the doctor's members row names it once, never drift (#1148) #1172 and validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166 match mine.
- The six-guard "356 passed, 2 skipped" figure matches my collect-only count.
Stale since validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166 landed as 105b5daf (14:48:27Z), so the body needs a refresh:
- "main is 11560eb9f now and has changed neither file" is false. 105b5daf9 changed templates/family-root/scripts/validate-family.py (blob 172647b3e to ee26aede6). It touched DATE_RE, QUALIFIED_RE and PROJECT_ID_RE.fullmatch.
- The merge with that main is still clean. The new rows still fail on the new main's bytes (27 failed, 57 passed).
- The Merges section's main line and its validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166 bullet need replacing. Suggested text: "origin/main 53bd31718 (validate-manifest.py, validate-family.py, family.py and update-shape.py: an id:, a date or a repository: ending in a line feed is refused by name, and a pin's source_repository: that is no path or owner/repo name is named as the pin's (#1139) #1166 landed as 105b5daf): tree c8d56bd6". Tree 6c75515f is the one with a semantic run (557 passed), against b66d8f0cc.
- The validate-family.py: the check for values git dies on reads the index's .gitmodules beside the work tree's and its stage remedies end git add -- .gitmodules, an index file git cannot parse is refused, and an unmerged one is read as none (#1150) #1227 line needs the new head 2d56c1906 and tree ffaedee7 (NIT B).
- The Tests-section guard count is for a six-file set that differs from the brief's five. The body can say so, or add test_pinned_copy_text.py. That file was run on the previous head, whose template bytes equal this head's, and it passes here in the 443.
- e04826db4, labelled "main's bytes", is a main commit sha, not a blob. Its template blob is 172647b3e, so the claim is true as written.

Logs

All are under /workspace/projects/.lane-worktrees/openRepoShape-5/work/rv1246b/:

logs/row243.log
logs/together243.log
logs/together247.log
logs/hyg243.log
logs/hyg247.log
logs/mergedmain.log
logs/merged1227new.log
logs/merged1172.log
logs/onmain-11560eb9f.log
logs/onmain-105b5daf9.log
mut/R3.log
mut/old-drive.log
mut/R567-drive.log
body-live.md
STATE.md

Lane: openreposhape-5 (openRepoShape-5)

brettheap added this to the v1.2.1 milestone Nov 8, 2026

Navigation Menu

Repository navigation

brettheap commented Nov 8, 2026 •

edited

Loading

Uh oh!

sourcery-ai Bot commented Nov 8, 2026 •

edited

Loading

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

brettheap commented Nov 8, 2026

Uh oh!

sonarqubecloud Bot commented Nov 8, 2026

Uh oh!

brettheap commented Nov 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

brettheap commented Nov 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Out of scope

Measured on Python 3.12.3, before and after

Tests

Mutants

Merges

Uh oh!

sourcery-ai Bot commented Nov 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

Implementation

Tests

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

brettheap commented Nov 8, 2026

What I checked

Findings

Uh oh!

sonarqubecloud Bot commented Nov 8, 2026

Quality Gate passed

Uh oh!

brettheap commented Nov 8, 2026

Findings

What I measured

Logs

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

brettheap commented Nov 8, 2026 •

edited

Loading

sourcery-ai Bot commented Nov 8, 2026 •

edited

Loading