[brettheap]

Lane: openreposhape-2 (openRepoShape-2)
Claim: #292 (comment)

Merged main after #270 landed

#270 landed on main as the squash f795cf7 (its final head was 3cee853), and this PR, stacked on it, now targets main. The branch carried an older copy of #270's commits, so a plain merge of main conflicts in adopt-project.py. It took two merges: #270's final head 3cee853 (81df4e2, no conflict), then origin/main ab623dd (dcbc37b). The second conflicted in adopt-project.py only, and the whole file takes this branch's side: the squash's content of the file is 3cee853's (git diff 3cee853 f795cf7 -- adopt-project.py tests/test_adopt_template_values.py is empty), which the first merge had brought in. At dcbc37b, git diff HEAD^1 HEAD on those two files is empty, git diff --stat origin/main HEAD lists adopt-project.py and tests/test_adopt_git_reads.py only, and git merge-tree --write-tree origin/main HEAD is rc 0. This PR's own change to adopt-project.py is the same lines it was before the merges. Each count below says the head it was run at.

Fix round (review of dcbc37b)

The review of dcbc37b found no P1 or P2, and four nits for this PR. They are fixed in two commits on top of dcbc37b (main is not merged again), head 96ff0c7:

• N1, 344028e. The adopt-no-org sentence said "the source has no origin to read an organisation from" of a source that has an origin whose URL is not UTF-8, which is the case this PR newly sends there (and of one whose URL ends in no org/repo). It now reads "the source's origin names no organisation this tool can read: it has none, its URL is not UTF-8, or its URL ends in no org/repo". The refusal, exit 2 and pass --org <org> remediation are the same. test_plan_without_org_refuses_a_source_that_names_none takes the new bytes and a third source, no-pair (an origin of repo.git).
• N3, 344028e. Deleting the moved args.org = checked_value("--org", args.org) survived this file and tests/test_adopt_plan.py: plan --org=-evil exited 0 and wrote org: "-evil", check said plan ok, and only execute refused it. test_plan_refuses_an_unsafe_org_that_is_passed[leading-dash|dash-only|space] pins exit 2, REFUSED unsafe-value: --org is '-evil' and no plan file.
• N2, 96ff0c7. The four user.name tests skipped in a checkout whose own .git/config sets user.name, because that outranks the GIT_CONFIG_GLOBAL file they wrote, and the _elector fix was then untested. On POSIX the name is now also given in git's command scope (GIT_CONFIG_COUNT, GIT_CONFIG_KEY_<n>, GIT_CONFIG_VALUE_<n>), which outranks every config file, appended to any count the environment already holds: the Windows job sets GIT_CONFIG_COUNT=2, and replacing it would drop core.autocrlf and core.longpaths. The GIT_CONFIG_GLOBAL file stays where an environment variable cannot carry the byte (Windows); CI is the only Windows runner, so CI is what confirms that route is unchanged. Two tests pin the route on any machine: a checkout made in tmp_path with a local user.name still reads the name given, and a count of 2 in the environment survives.
• N4. This description: the Composes with table, the two Left out items, and the claim about which test files were run are re-measured at 96ff0c7.

What

adopt-project.py asks git two questions whose answers are bytes it did not write, and now reads both without dying on one that is not UTF-8:

• _elector reads git config user.name (asked when --elected-by is not given) with binary=True and decodes it with surrogateescape, as sys.argv keeps such a byte. The lone surrogate then meets the question adopt-project.py: a value execute writes into a file is asked whether a file can hold it, in plan, in check and in execute before any leg exists, so a byte that is not UTF-8 in --elected-by, --reference or a local --source directory no longer pushes both legs before write_lf raises (#255) #270 asks of every value execute writes, and plan refuses it as adopt-unwritable-value, exit 2, before any plan is written:

  REFUSED adopt-unwritable-value: --elected-by (not given, so `git config user.name`) is 'Jos\udce9', which `execute` writes into the assembly root's `project.yaml` and `README.md`, and it holds a byte that is not UTF-8.
  Remediation: no plan was written. Pass each value named again, retyped; when `--elected-by` is not given, `plan` reads `git config user.name`, so pass the flag or correct that. ...
  

• _remote_repository catches UnicodeDecodeError beside Refusal and returns None, as it does for a source with no origin: such a URL names no org/repo. plan takes --org and records repository: null; check and execute name the source by its path and adopt it.

• _checked_plan_inputs asks adopt-no-org before checked_value. Since v0.2 (v0.2: adopt an existing repository in place, reuse an empty root, scaffold a declared descendant #5) the or "-" stand-in for a missing org reached checked_value first, which refused --org is '-', a value nobody passed, so adopt-no-org was never reached. The issue's "What it should do" 1 assumed it was; now it is, for a source with no origin, for one whose origin is not UTF-8, and for one whose URL ends in no org/repo. The refusal says each of the three, because it is asked of a source that has an origin as often as of one that has none (the fix round's N1).

• _refuse_an_unwritable_clone_url's docstring said a UTF-8 clone of a source whose path is not UTF-8, passed with --source, raised in _remote_repository; it now says that route adopts too.

git_out in scripts/repo_shape.py is untouched: it is a pinned copy, and a change there would move every project's shape pin (the issue's point 3).

Why

git keeps a config value and a remote URL as the bytes it was given, so a repository can hold either without anyone having done anything wrong: a name saved in a legacy code page, a clone of a directory named in one. Both reads decoded strictly through git_out, and UnicodeDecodeError is a ValueError, not a Refusal, so main did not catch it: the run ended in a traceback, exit 1, naming neither the git setting nor the flag (--elected-by, --org) that gets past it. Reproduced on #270's head before it landed (edfa7c6, then 72bb869) and again on main ab623dd (local only):

input	run	main	this PR
global user.name = Jos\xe9, no --elected-by	plan	exit 1, UnicodeDecodeError ... byte 0xe9 in position 3 from _elector, no plan	exit 2, adopt-unwritable-value as above, no plan
ASCII user.name (control)	plan	exit 0, elected_by: Jose	the same
Latin-1 user.name, --elected-by 'T H' (control)	plan	exit 0	the same
origin URL holding \xe9, --org	plan	exit 1, the traceback from _remote_repository	exit 0, repository: null
the same, no --org	plan	exit 1, the traceback	exit 2, adopt-no-org, "pass --org "
no origin at all, no --org	plan	exit 2, unsafe-value: --org is '-'	exit 2, adopt-no-org
origin URL holding \xe9, a plan written earlier	check	exit 1, the traceback	exit 0, plan ok
the same	execute --yes --local-remote-dir	exit 1, the traceback, no leg	exit 0, adoption verified
a UTF-8 clone of a source under caf\xe9/, execute --source <clone>	execute	exit 1, the traceback	exit 0, adoption verified

The issue said _elector "should not decode with errors="surrogateescape" and carry on", because the surrogate would be recorded and execute would die after pushing both legs. On this branch it does not carry on: #270's unwritable_values refuses it in _checked_plan_inputs, right after _elector returns, before the plan is written, with the setting and the flag named. That is the refusal the issue asked for, and it is one sentence with every other value plan cannot write.

Tests

tests/test_adopt_git_reads.py, new, 17 tests. It reuses test_adopt_template_values.py's runners (strict stdout, bytes, every run read for a traceback). user.name comes from a GIT_CONFIG_GLOBAL file written with write_bytes and, on POSIX, from git's command scope as well (command_scope, the fix round's N2), so the four tests that use it run in a checkout whose own config sets user.name too; the origin URL is written into the source's .git/config as bytes, so it runs on every OS; each skips where git does not give the bytes back as written.

• test_plan_refuses_a_user_name_that_is_not_utf8: exit 2, the refusal naming git config user.name and --elected-by, no traceback, no plan.
• test_plan_records_a_user_name_that_is_utf8[ascii|utf8]: controls, recorded as itself.
• test_elected_by_given_adopts_under_a_user_name_that_is_not_utf8: control, plan, check and execute under the Latin-1 config with the flag, adoption verified.
• test_plan_reads_an_origin_that_is_not_utf8_as_none[not-utf8|ascii]: repository: null; the ASCII URL's control reads cafe/repo.
• test_plan_without_org_refuses_a_source_that_names_none[not-utf8|no-origin|no-pair]: adopt-no-org, with one sentence for the three, not unsafe-value.
• test_plan_refuses_an_unsafe_org_that_is_passed[leading-dash|dash-only|space]: --org=-evil, --org=- and --org='my org' exit 2 as unsafe-value, naming --org, with no plan written.
• test_plan_without_org_takes_the_org_an_ascii_origin_names: control, org: cafe.
• test_check_and_execute_adopt_a_source_whose_origin_is_not_utf8: plan ok, adoption verified.
• test_a_utf8_clone_of_a_source_whose_path_is_not_utf8_adopts: adopt-project.py: a value execute writes into a file is asked whether a file can hold it, in plan, in check and in execute before any leg exists, so a byte that is not UTF-8 in --elected-by, --reference or a local --source directory no longer pushes both legs before write_lf raises (#255) #270's clone-URL refusal, then execute --source <UTF-8 clone> adopts (POSIX; skipped where no directory holds the byte 0xE9).
• test_the_user_name_given_outranks_a_checkouts_own and test_the_user_name_given_is_appended_to_the_config_the_environment_holds (POSIX): the N2 route, on any machine.

Against main's code (this file at 96ff0c7 copied into a detached worktree of origin/main 28bdc84, and again of 92e29d9, the same 7 failing): 7 failed, 10 passed. The 7 fail for the issue's reason: 5 on the UnicodeDecodeError traceback (_elector once, _remote_repository four times), and [no-origin] and [no-pair] on REFUSED unsafe-value: --org is '-'. The 10 that pass are the controls, the three --org tests (that check exists on main) and the two user.name route tests. The 11-test file was 6 failed, 5 passed against edfa7c6, 72bb869 and ab623dd; the one more failure is no-pair.

The N2 case, emulated. This worktree's own config has no user.name, and the shared checkout's [user] section is gone, so a user.name that outranks GIT_CONFIG_GLOBAL was given from outside, in the environment (GIT_CONFIG_COUNT=1, GIT_CONFIG_KEY_0=user.name, GIT_CONFIG_VALUE_0=Outer; command scope outranks a local config, so this skips the old helper exactly as a local user.name does). dcbc37b's file under it: 7 passed, 4 skipped. This file under it: 17 passed, 0 skipped; plain: 17 passed; in a scratch clone whose own config sets no user.name: 17 passed; under the Windows job's own two entries plus the name: 17 passed.

The N2 survival proof, in a detached scratch worktree of dcbc37b whose only change is _elector decoding strictly (name.decode("utf-8")): dcbc37b's own test file under the outer user.name runs 7 passed, 4 skipped, 0 failed, so the mutant survives: the four tests that would kill it skip, which is the state N2 removes. The same file without the outer name fails 1 (test_plan_refuses_a_user_name_that_is_not_utf8), so the skip is the cause. This PR's file on the same mutated code under the outer name fails 4: that test, and the three adopt-no-org rows that fail only because dcbc37b's code still has the old sentence (N1).

Mutants, at 96ff0c7 in a scratch clone, each run with that outer user.name standing in for a local one, one per decisive line, each caught except where it says so:

mutant	change	failed
strict decode	_elector returns name.decode("utf-8")	1: test_plan_refuses_a_user_name_that_is_not_utf8 (1 without the outer name too)
replace	decode("utf-8", "replace")	1, the same test (1 plain)
ignore	decode("utf-8", "ignore")	1, the same test (1 plain)
no .strip()	_elector drops .strip()	3: that test and test_plan_records_a_user_name_that_is_utf8[ascii] and [utf8] (3 plain)
_remote_repository catches Refusal only	except Refusal:	4: test_plan_reads_an_origin_that_is_not_utf8_as_none[not-utf8], test_plan_without_org_refuses_a_source_that_names_none[not-utf8], test_check_and_execute_adopt_a_source_whose_origin_is_not_utf8, test_a_utf8_clone_of_a_source_whose_path_is_not_utf8_adopts
the or "-" stand-in back	args.org or ... .split("/")[0] or "-"	3: the three adopt-no-org rows
checked_value("--org", ...) deleted (N3)	the line removed	3: the three test_plan_refuses_an_unsafe_org_that_is_passed rows (run with tests/test_adopt_plan.py: 3 failed, 70 passed, 1 skipped)
the old adopt-no-org sentence (N1)	the old text back	3: the three adopt-no-org rows
the helper without its command-scope route (N2)	the two lines in global_user_name removed	plain: 2 failed, the two route tests; under the outer name: 1 failed (test_the_user_name_given_is_appended_to_the_config_the_environment_holds) and 5 skipped

Targeted runs, git-filter-repo 2.47.0 on PATH, each row at the head its last column names (cae1bf5 before the merges, dcbc37b after them, 96ff0c7 now; the dcbc37b rows of 14 files were run by the lane's review of dcbc37b):

file	tests	result	run at
tests/test_adopt_git_reads.py (new)	17	17 passed	96ff0c7
tests/test_adopt_template_values.py	78	78 passed	96ff0c7
tests/test_adopt_plan.py	57	56 passed, 1 skipped (:393, needs a SHAPE_MEDXEHR_CLONE checkout)	96ff0c7
tests/test_git_output_decoding.py	67	67 passed	96ff0c7
tests/test_scaffold_leg_path_collisions.py	104	104 passed	96ff0c7
tests/test_cli_reference.py	13	13 passed	96ff0c7
tests/test_repo_hygiene.py	50	50 passed	96ff0c7
tests/test_shape_doctor.py	257	254 passed, 3 skipped (the PowerShell-paste test, Windows host only)	96ff0c7
tests/test_adopt_literal_names.py	14	passed	dcbc37b
tests/test_adopt_clone_template.py	31	passed	dcbc37b
tests/test_windows_paths.py	38	passed	dcbc37b
tests/test_adopt_execute_refusals.py	37	passed	dcbc37b
tests/test_adopt_e2e.py	19	passed	dcbc37b
tests/test_adopt_verify.py	16	passed	dcbc37b
tests/test_adopt_spec_only.py	14	passed	dcbc37b
tests/test_adopt_entry_paths.py	64	passed	dcbc37b
tests/test_adopt_history_gitlinks.py	45	passed	dcbc37b
tests/test_adopt_leg_path_collisions.py	95	passed	dcbc37b
tests/test_adopt_plan_escapes.py	59	passed	dcbc37b
tests/test_adopt_submodules.py	133	passed	dcbc37b
tests/test_adopt_finding_spelling.py	128	passed	cae1bf5
tests/test_adopt_root_shape_paths.py	120	passed	cae1bf5
tests/test_adopt_leg_paths.py	349	passed	cae1bf5
tests/test_adopt_gitmodules_values.py	187	passed	cae1bf5
tests/test_adopt_ignored_shape_files.py	30	passed	cae1bf5
tests/test_adopt_mount_ignored.py	26	passed	cae1bf5

scripts/render-cli-reference.py --check passes at 96ff0c7; no --help text changed. dcbc37b holds 20 tests/test_adopt_*.py files, where cae1bf5 held 18: test_adopt_clone_template.py and test_adopt_literal_names.py arrived with the merges, and were first run against this PR's code by the review of dcbc37b. Every one of the 20 was run at cae1bf5 or dcbc37b, and the six marked cae1bf5 were not re-run since. The two commits since dcbc37b change one sentence in adopt-project.py and one test file, and no other file under tests/ names the sentence (git grep -e 'to read an organisation' -e 'names no organisation' outside those two finds only test_setup_project_py.py and test_setup_sh.py, which are about setup-project.py).

Composes with

git merge-tree --write-tree at 96ff0c7 against every open head at 15:38Z, in this repository's object store (origin/main 28bdc84, a983e6a since, and 92e29d9 at 16:41Z, not fetched by this writer):

other head	rc	conflicts	resolves
origin/main 28bdc84, a983e6a and 92e29d9 (#377, which changed adopt-project.py and four adopt test files)	0	none
the 11 open PRs on adopt-project.py: #394 48bdbf9, #387 69c54c9, #384 a96297e, #382 7e55d00, #378 2da8691, #377 c35c896, #373 5ac03de (lane 3), #371 34b9500 (lane 5), #356 5a5011d (lane-mate fix/adopt-check-hand-edited-plan), #314 a5438a5, #184 f416e13	0 each	none
the 17 other open PRs that do not touch adopt-project.py (#395, #390, #381, #380, #379, #376, #375, #374, #357, #355, #354, #352, #347, #346, #343, #267, #266)	0 each	none
#358 ebffb08 (fix/doctor-manifest-kinds-unreadable-pin, based on fix/doctor-root-shape-pin-unreadable)	1	shape-doctor.py	the same conflict against origin/main 28bdc84 alone; this branch does not touch shape-doctor.py, so it adds none.
the lane's 13 other open heads at 16:50Z, against origin/main 92e29d9 too: #267 8badae0, #266 3410be7, #356 0aff5ae (the merge of a983e6a), #343 9e6caeb, #346 818db36, #347 e965ab0, #352 797c96b, #355 a03abcf, #401 6124cb4, #403 e2c78ee, #404 f9d420a, #386 d53602b (stacked on #356), #359 6eb8e4e	0 each	none	#386 conflicts with 92e29d9 alone and merges with this branch; the rest merge with both.
#358 2745890 (the head since ebffb08)	1	shape-doctor.py	the same against origin/main 92e29d9 alone; this branch adds none.

The merge of 96ff0c7 and 92e29d9 (git merge --no-commit in a scratch tree: clean, tree b2b4b7f; its diff against 92e29d9 is adopt-project.py and tests/test_adopt_git_reads.py only) ran test_adopt_git_reads.py, test_adopt_plan.py, test_adopt_template_values.py, test_adopt_entry_paths.py, test_adopt_plan_escapes.py, test_adopt_literal_names.py, test_adopt_github_exits.py and test_scaffold_leg_path_collisions.py: 418 passed, 1 skipped (test_adopt_plan.py:393, SHAPE_MEDXEHR_CLONE unset).

#356 and #382 conflict with origin/main 28bdc84 alone (main's newer commits on adopt-project.py) and merge with this branch; that is theirs against main, not something this branch adds or lifts. At dcbc37b the review merged #356 5a5011d into this branch (ce952fb) and ran test_adopt_git_reads.py and test_adopt_execute_refusals.py on the result: 92 passed. That was not re-run at 96ff0c7. None of the 11 heads on adopt-project.py pins the old adopt-no-org sentence in a test: git grep for it finds it in adopt-project.py alone at each of them.

One meaning to keep in view when #314 (#261, a blank or malformed --elected-by) and this land together: both ask about the elector plan takes from git config user.name. They merge textually (rc 0); on this branch _checked_plan_inputs asks #270's question of the elector right after _elector returns.

Left out

• scripts/shape_advisory.py repository_names reads the same origin URL and catches (Refusal, OSError) only. Under a URL that is not UTF-8 it raises, shape_advisory.read() returns not-answered, and _print_triad_advisory has nothing to print: plan and check print no Triad advisory for that source, and nothing raises up to the caller to say so. A leg clone named Northwind-spec loses its leg-clone NOTE the same way. shape-doctor.py reads the URL at two more places (origin_url, origin_name, each catching (Refusal, OSError)), and shape-doctor.py --root ends in a UnicodeDecodeError traceback on such a source, as on main. These are other functions in other tools, not in this issue; a follow-up.
• scaffold-project.py _elector (:605, the read at :618) reads git config user.name the same strict way: with no --elected-by and no GIT_AUTHOR_NAME, a Latin-1 name ends scaffold in the same UnicodeDecodeError traceback, exit 1, nothing created. That is another tool, and the open PR scaffold-project.py: --elected-by, --reference, --name and the elector's fallback are refused before anything exists when no file can hold them, so a byte that is not UTF-8 no longer creates repositories before a traceback (#282) #351 (closes scaffold-project.py writes --elected-by, --reference and --name between literal double quotes with no escaping and asks none of them whether a file can hold it, so a line break leaves a project.yaml its own validators refuse, a backslash is recorded as another character (CORP\nick as CORP, a line feed, ick), and a byte that is not UTF-8 dies in write_lf after the legs are pushed #282) already takes it.
• scripts/family.py _creator_name (:695) reads git config user.name the same way: family.py init with a Latin-1 name and no --created-by ends in the traceback, nothing created. Another tool; a follow-up.
• _default_branch and the other git_out callers of adopt-project.py (a branch name that is not UTF-8: plan, check and execute still end in a traceback from Source.open for a source whose HEAD is on caf\xe9) are the issue's "separate question", and are not asked here. The same on main.
• An organisation taken from a UTF-8 origin that checked_value refuses (café, my repos, caf%C3%A9, -evil) is refused as --org is 'café', a flag nobody passed, and the remediation never says to pass --org. The input is UTF-8, not this issue's, and it is the same on main; a follow-up.
• git_out itself, in the pinned scripts/repo_shape.py.

Closes #292

🤖 Generated with Claude Code

Summary by Sourcery

Make project adoption robust when Git configuration or origin data contains non-UTF-8 bytes.

Bug Fixes:

• Handle non-UTF-8 Git user names and origin URLs without terminating with UnicodeDecodeError tracebacks.
• Report non-UTF-8 or malformed origins as unavailable repositories and provide appropriate organization guidance.
• Reject unsafe explicitly supplied organization values before writing a plan.

Enhancements:

• Validate unwritable Git-derived elector names with actionable refusal messages and preserve existing Git configuration precedence when testing and reading names.

Tests:

• Add coverage for non-UTF-8 Git configuration values, malformed origins, organization validation, and adoption through check and execute.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 10 hours and 18 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[brettheap]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T17:01:21.798593Z	96ff0c7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: cae1bf534c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brettheap]

(lane openRepoShape-2, 2026-10-12T14:54Z)

This lane reviewed its own PR #353 at dcbc37b, read-only, in its own detached worktrees and one scratch clone. It authored nothing.

MERGEABLE WITH NITS. There is no sequencing constraint. dcbc37b already contains main ab623dd. tests-macos and tests-windows must still pass at this head.

The issue's promise holds. On plan, check and execute, neither read ends in a traceback:

• A Latin-1 user.name is refused as adopt-unwritable-value, naming the setting and --elected-by, before any plan exists.
• An origin URL that is not UTF-8 reads as no origin.
• adopt-no-org is reached.

The two merges keep the PR's diff byte for byte.

Nits for the fix round:

• adopt-project.py:1617-1620: adopt-no-org says "the source has no origin" of a source that has one.
• tests/test_adopt_git_reads.py:78-93: in a checkout whose own config sets user.name, the four user.name tests skip, and the _elector mutants survive. On POSIX, GIT_CONFIG_COUNT outranks the local config.
• adopt-project.py:1621: deleting the moved checked_value("--org", ...) survives. plan --org=-evil then exits 0; add a test.
• PR body: the adopt-project.py: check finds, and execute refuses before any leg exists, a plan follow_ups: that is not a list of text and an elected_on: that election_date does not read, with or without a reference:, so follow_ups: 5 is no longer a traceback and elected_on: someday is no longer refused under a flag neither command takes (#293, #294) #356 row, adopt-project.py, AGENTS.md: execute verifies before it exits on a refused gh pr create, and step 7 keys its way out to the exit it prints, so an IS pushed exit 2 is finished by hand, not re-run into a second pair of legs (#304) #371 and shape_materialize.py: RULESET_HINT names the run's tracking branch where it named main, as the pull request's base and the ref the scaffold and the family holder pushed (#324) #373, and the scaffold :599 cite are stale.

Follow-ups. None is in #292's promise, and the PR makes none worse:

• adopt-project.py:855 _default_branch: a branch named caf\xe9 ends plan in a traceback.
• scripts/shape_advisory.py:440, and shape-doctor.py:3094 and :3538: an origin holding 0xE9 drops the Triad advisory, and shape-doctor.py --root crashes on it.
• scripts/family.py:705: init with a Latin-1 user.name ends in a traceback.
• adopt-project.py:1621: an organisation read from a UTF-8 origin (café, my repos) is refused as --org is 'café', a flag nobody passed.

Tests:

• Clone at dcbc37b, the new file: 11 passed.
• The same file against main's code: 6 failed, 5 passed, for the issue's reasons.
• Worktree at dcbc37b: 225 passed and 1 skipped, then 396 passed, across 13 adopt files.
• Merge with adopt-project.py: check finds, and execute refuses before any leg exists, a plan follow_ups: that is not a list of text and an elected_on: that election_date does not read, with or without a reference:, so follow_ups: 5 is no longer a traceback and elected_on: someday is no longer refused under a flag neither command takes (#293, #294) #356 5a5011d: 92 passed.
• Mutants: 6 of 7 killed.
• render-cli-reference --check is ok.

Merges with 21 open heads: 19 are rc 0. #314 and #358 conflict exactly as they conflict with main alone.

The full report is in opensoft/brett-wip at handoffs/xFactory/attachments/lane-openRepoShape-2/review353-dcbc37b/final-report.md.

[brettheap]

(lane openRepoShape-2, 2026-10-12T16:52Z)

The fix round on this lane's review of dcbc37b is complete at 96ff0c7: 344028e takes N1 and N3, and 96ff0c7 takes N2. The body is now v3.

• N1. adopt-no-org now names all three causes: no origin, an origin URL that is not UTF-8, and a URL that ends in no org/repo.
• N2. The four user.name tests also take the name from git's command scope, so they run where the checkout's own config sets user.name. Before, they skipped there, and a mutant of _elector that decodes strictly survived on dcbc37b (7 passed, 4 skipped). It is now killed.
• N3. A test now pins checked_value("--org").

Tests at 96ff0c7

• tests/test_adopt_git_reads.py: 17 passed.
• tests/test_shape_doctor.py: 254 passed, 3 skipped (Windows-only).
• Merged with main 92e29d9 (git merge-tree rc 0): 418 passed, 1 skipped, across the adopt files and test_scaffold_leg_path_collisions.py.
• Mutants: 8 of 8 killed.
• CI is green on all three OSes at 96ff0c7.

Details are in handoffs/xFactory/attachments/lane-openRepoShape-2/impl292-adopt-git-reads/fix-round-0279.md in opensoft/brett-wip.

[brettheap]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 96ff0c7a23

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud