Repository navigation
update-shape.py and bump-leg.py: a pin rewrite keeps each line's own indentation, spacing and trailing comment and reads its result back before writing it, so a digests: child indented four spaces takes the update instead of update-pin-unrecognised / bump-leg-pin-unrecognised, and a # comment on commit: or tree_sha256: survives every pin rewrite, rewrite_manifest included (#323) - #380
Merged
Merged
Conversation
…indentation, spacing and trailing comment and reads its result back before writing it, so a `digests:` child indented four spaces takes the update instead of `update-pin-unrecognised` / `bump-leg-pin-unrecognised`, and a `# comment` on `commit:` or `tree_sha256:` survives every pin rewrite, `rewrite_manifest` included (#323) `rewrite_shape_pin` (update-shape.py) and `rewrite_pin` (scripts/bump-leg.py) FOUND `tree_sha256:` by exactly two leading spaces and WROTE both lines back as `commit: "<sha>"` and ` tree_sha256: "<digest>"`; `rewrite_manifest` kept each line's indentation since #224 and still wrote its two lines bare. So a pin whose `digests:` child is indented four spaces, which the reader and both validators accept, was refused as hand-edited ("0 `tree` line(s)"), and a trailing comment on either line was dropped by all three rewrites. #224 measured the first for `apply` and left the pin rewrites alone; this is the same fix on the same pattern. - `shape_materialize.with_scalar(line, key, value)` replaces ONLY the value: the indentation, the key, the spacing between the colon and the value and a trailing `# comment` (found by the reader's own `_strip_comment`, so a `#` inside a quoted value is not one) are the line's own. The new value is double-quoted, as the scaffold writes it. `is_nested_key` finds `tree_sha256:` as any INDENTED line that begins with it; `commit:` is still found at column 0, and each line must still be found exactly once. - `rewrite_shape_pin`, `rewrite_pin` and `rewrite_manifest` all write their two lines through it. The `files:` block of the shape pin is still written whole, from the recomputed rows. - What each returns has been READ BACK with `parse_yaml`: `commit` and `digests.tree_sha256` must equal the target, or it is refused as `update-pin-unrecognised` / `bump-leg-pin-unrecognised`, as this tool's fault, before the pin is written. The one layout a line rewrite cannot carry, a value on the line below its key, reads and validates, and used to reach the validators and the lockstep remedy about the gitlink. Raised only when the pin read before the rewrite: a pin that did not was red before the command ran and is left to the validators, as in #208. `apply` rolls the copies it had made back and `bump-leg.py` puts the leg's detached checkout back; the tree ends exactly as it was. - The reading and the question ("is this the tool's fault?") are one implementation, `shape_materialize.pin_values_in` / `rewrite_fault`, that #208's manifest check now calls too, with its messages unchanged. They live in `shape_materialize.py` and not in `repo_shape.py`, which is a shape copy every project holds and digest-pins. - `update-shape.py` still imports `parse_yaml` and `YamlError`, which nothing in it reads any more now that #208's reading is `pin_values_in`. The `--pr` re-run branch (#333) reads HEAD's pin with them in `_committed_pin`; its merge with this one is textually clean and, without the two names, fails with a `NameError` in that function, so they stay as main has them. - A pin laid out its own way and already at the commit is now `nothing to do` under `bump-leg.py` (exit 1): its rewrite is itself. A commented pin used to differ from its own rewrite, so a bump that had landed was made again as a commit that only deleted a comment. - The digest is still RECOMPUTED from the leg's own objects, never edited to fit (AGENTS.md, "Advancing a leg", rule 2). The new refusals tell the operator to leave both values alone and re-run the command, which recomputes it. Unchanged: a scaffold-shaped pin or manifest. Measured on a real scaffold, the sha256 of what `rewrite_shape_pin` (shape-pin.yaml), `rewrite_pin` (spec-pin, code-pin) and `rewrite_manifest` (project.yaml) return is identical on main c7c02fa and on this branch, and `tests/test_pin_rewrite_layout.py` holds each of the four pin kinds to the scaffold's own rendering of the target values. The refusals for a missing or doubled `commit:` or `tree_sha256:` line and the `files:` replacement are as they were. Left out: `files:` and the manifest's `shape:` followed by a trailing comment are still refused (`update-pin-unrecognised`, `update-manifest-no-shape`) by name rather than rewritten; `bump-leg.py --dry-run` does not rewrite the pin unless nothing moves, so it exits 0 for a pin the real run refuses, as it did for the four-space pin on main. Lane: openreposhape-3 (openRepoShape-3) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days. You can request another review in 2 days and 3 hours by commenting |
Reviewer's GuideThe PR factors pin scalar replacement and read-back validation into shared helpers, then uses them across shape pins, leg pins, and manifest shape blocks so rewrites accept reader-valid indentation while preserving line layout and comments, and reject only rewrites that the tool itself cannot round-trip safely. Sequence diagram for safe pin rewrite and read-back validationsequenceDiagram
participant Caller
participant Rewriter
participant Helpers
participant Reader
Caller->>Rewriter: rewrite_shape_pin(text, commit, tree)
Rewriter->>Helpers: with_scalar(line, key, value)
Helpers-->>Rewriter: rewritten line preserving layout and comment
Rewriter->>Helpers: rewrite_fault(before, after, commit, tree)
Helpers->>Reader: parse_yaml(after)
Reader-->>Helpers: parsed pin values
alt values match targets
Helpers-->>Rewriter: None
Rewriter-->>Caller: rewritten text
else rewrite does not round-trip
Helpers-->>Rewriter: refusal reason
Rewriter-->>Caller: Refusal update-pin-unrecognised
end
Flow diagram for layout-preserving pin scalar replacementflowchart TD
Start[Pin rewrite requested] --> Find[Find commit and indented tree_sha256 lines]
Find --> Replace[Replace only scalar values]
Replace --> Preserve[Preserve indentation spacing and trailing comment]
Preserve --> ReadBack[Read rewritten text with parse_yaml]
ReadBack --> Match{Target values read back?}
Match -->|Yes| Write[Write pin]
Match -->|No| Refuse[Refuse before writing and report tool rewrite fault]
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Contributor
Author
|
(lane openRepoShape-3, 14:51Z) @codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This was referenced Oct 12, 2026
brettheap
added a commit
that referenced
this pull request
Oct 12, 2026
…_pull_request` spell the pin's path by the materializer's `SHAPE_PIN`, so `contracts/shape-pin.yaml` has no third copy in this module for Sonar's S1192 (#290) `pin_rows_remediation` spelled `"contracts/shape-pin.yaml"` a third time in update-shape.py, after `cmd_apply`'s set of paths to stage and `_awaits_its_pull_request`; Sonar called the third copy a CRITICAL S1192 and it was the one new issue on the PR. `scripts/shape_materialize.py` already names the path once, as `SHAPE_PIN`, because a second spelling is how the lists beside it would stop matching what is written, and this module already takes its other constants from there. All three now use that name. Two things left as they were, on purpose. The `root / "contracts" / "shape-pin.yaml"` joins in `read_pin` and `_repin` are two short strings, not the flagged literal, and #347 rewrites the top of `read_pin` (a merge of this branch with it conflicts there if the join changes). The name comes in by its own `from shape_materialize import SHAPE_PIN` line after the existing import block, not as one more name in it, because #380 rewraps that block and a merge conflicts there if this branch does too. Lane: openreposhape-2 (openRepoShape-2) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This was referenced Oct 12, 2026
brettheap
added a commit
that referenced
this pull request
Oct 12, 2026
…) into fix/adopt-record-submodule-placement Brings in a983e6a (#304), 8325d05 (#276) and 1f90a0f (#323) on top of 28bdc84, which 48bdbf9 had merged. Merged by sha, no rebase. All three change files this branch changes: a983e6a changes adopt-project.py, AGENTS.md and tests/test_repo_hygiene.py; 8325d05 changes shape-doctor.py and tests/test_shape_doctor.py; 1f90a0f changes scripts/shape_materialize.py. One conflict, kept on both sides: - tests/test_repo_hygiene.py, `test_agents_md_is_short_enough_to_be_read`. Each side moved the AGENTS.md cap from 477 and wrote a paragraph saying why: #304 to 481, for its four lines in step 7, and this branch to 485, for its eight. AGENTS.md merged cleanly at 489 lines. That is main's 481 plus this branch's lines exactly (`git diff -U0` of the merge against main equals this branch's own against 28bdc84). The merge keeps #304's paragraph word for word, then this branch's, renumbered "2026-10-12: 481 -> 489", and asserts `<= 489`. Both paragraphs stay true side by side: step 7 grew by #304's four lines, and this branch's four lines and a blank one follow step 7 in "Adopting an existing repository". The three lines ending "Checking"'s point 4 are as they were. `git merge-tree --write-tree` of the two parents gives the same tree in every file but that one. Checked: - adopt-project.py: #304 changes `cmd_execute`, `_verify`, `_open_the_pull_request`, and adds `_open_it_by_hand`, `_next_steps`, `_pull_request_command` and `_flush_stdout`, all after the split is pushed. `_commit_the_split`, which appends the record to the split's `project.yaml` before anything is pushed, is this branch's text and untouched, as are `submodule_record`, `_answered_legs` and `_kept_in_a_leg`. The module docstring was changed by both sides, and each side's addition is in the merge. - shape-doctor.py: #276 changes `check_legs`, `check_pins`, `check_family`, `members_verdict` and `own_bootstrap`, and adds `submodule_update_next`, `lockstep_next`, `PINS_GATE` and `FAMILY_GATE`. This branch's placement functions are its own text, and no definition was changed by both sides. - scripts/shape_materialize.py: #323 adds `with_scalar`, `is_nested_key`, `pin_values_in`, `rewrite_fault` and an import of the reader's `YamlError`, `_strip_comment` and `parse_yaml`. The merged import block has both sides' names. `_spelling_reason` and `leg_path_problem` give main's answers byte for byte over 87,482 strings. - No top-level name is bound twice in adopt-project.py, scaffold-project.py, scripts/repo_shape.py, scripts/shape_materialize.py, shape-doctor.py, validate-manifest.py, update-shape.py, scripts/family.py, scripts/bump-leg.py or validate-pins.py. Each merged module's names are the base's plus what either side added. - The branch's diff against main is #189 alone: 12 files, +1694 -157, file by file the same as 48bdbf9's against 28bdc84. Lane: openreposhape-1 (openRepoShape-1) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 12, 2026
…elative-url findings join `_entry_findings` last, after this branch's `plan-root-symlink` and #255's values, and `execute` probes `core.symlinks` after #190's remote-aware refusal origin/main moved a2cb7d3 -> 92e29d9 (ten commits). The coordinator named 1f90a0f; 92e29d9 came after it and changes adopt-project.py too, so main is merged at its tip, by sha: - ab623dd (#296 via #349), tests/conftest.py: a session `gh` guard first on PATH; - 161c6c9 (#190 via #245), adopt-project.py and scripts/repo_shape.py: a relative `.gitmodules` url kept in a leg is resolved from the source's remote and from the leg's; `_entry_findings` takes `local_remote_dir` and returns its NOTEs as a third value; `_submodule_findings` returns the submodule findings and the relative-url findings apart, so that the relative urls come last; - d82a83e (#282 via #351), scaffold-project.py; - 0f67f7b (#331 via #350), the template's scripts/validate-family.py; - 3ae0109 (#326 via #345), scripts/family.py; - 28bdc84 (#337 via #372), single-repository.yaml; - a983e6a (#304 via #371), adopt-project.py and AGENTS.md: `execute` verifies before it exits on a refused `gh pr create`, and `_verify` no longer prints NEXT: `_next_steps` does, once the split is verified and no pull request was refused; - 8325d05 (#276 via #354), shape-doctor.py; - 1f90a0f (#323 via #380), scripts/shape_materialize.py (the pin-rewrite helpers), scripts/bump-leg.py and update-shape.py; - 92e29d9 (#319 via #377), adopt-project.py: `plan` asks about every path `execute` will not extract as it is named. scripts/shape_materialize.py, scripts/repo_shape.py and every other file merge with no conflict. adopt-project.py conflicts in four hunks, each resolved by keeping both sides: 1. The module docstring's `check` paragraph. Main's clause for the submodules gains "each relative url naming the same repository from the leg as from the source"; this branch's symlink clause follows it, as it followed the submodule clause before. 2. `_entry_findings`' docstring. Main's opening (the findings, what is printed once after them, and the NOTEs) and its order, with this branch's symlinks after the source's own submodules and before #255's values, and #190's relative urls last. 3. `_entry_findings`' return. Main's three values. The findings are, in order: each entry's path, coverage and the legs (with what the root keeps where the shape writes), the source's own submodules (`split`), this branch's `_root_symlink_findings`, #255's values, and #190's relative urls (`moved`) last. The remediation and the NOTEs are main's: the symlink findings carry their own fix and add none. 4. `cmd_execute`. Main's `_refuse_what_check_finds(plan, source, args.local_remote_dir)`, then this branch's `_refuse_symlinks_checked_out_as_files`, both before any leg, as before. Checked on the merged tree: - AST (fin183g/names.py, base a2cb7d3): no top-level name is bound twice in adopt-project.py, scaffold-project.py, scripts/repo_shape.py or scripts/shape_materialize.py, and none is loaded but bound nowhere. Main changed the signatures of `_entry_findings`, `_submodule_findings` and `_refuse_what_check_finds`, each by a trailing `local_remote_dir=None`; every call in the merged file is main's or passes two arguments, and this branch's tests call `_refuse_what_check_finds(loaded, source)`. - Both sides intact (fin183g/sides_intact.py): the only lines that differ from either side's own change are those of the four hunks. - What this branch changed in the materializer (fix B among it) and 1f90a0f's pin-rewrite helpers share no function: 1f90a0f adds `is_nested_key`, `with_scalar`, `pin_values_in` and `rewrite_fault`, and imports `YamlError`, `_strip_comment` and `parse_yaml`, none of them a name this branch binds. `place`, `copy_in_the_way` and `_refuse_unwritable` are as they were. - a983e6a changes what happens after the split is pushed (the pull request, the verification, NEXT). This branch's refusals all come earlier: `plan-root-symlink` and `adopt-symlinks-off` before any leg, and the materializer's before the split is committed. Its one line in `_verify` (`follows too many symlinks`) is kept. - 92e29d9 changes what `plan` asks, not what `check` or `execute` take. Left for the two commits after this one: - tests/test_adopt_root_symlinks.py's `refused_past_check` switches `_refuse_what_check_finds` off with a two-argument lambda, and `execute` now passes three, so the two tests that use it fail here with a TypeError. A rehearsal of this merge with the docstring commit gave `2 failed, 481 passed` over this branch's file and tests/test_adopt_{relative_submodule_url,github_exits,entry_paths, submodules,template_values,execute_refusals}.py, those two the only failures. The next commit fixes the fixture. - `_entry_findings`' docstring, as merged, says the two commands differ "in the one place a remote decides it". The commit after names the second place, this branch's symlink destinations asked of each command's own disk. Lane: openreposhape-1 (openRepoShape-1) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 12, 2026
brettheap
added a commit
that referenced
this pull request
Oct 12, 2026
…r and validate-manifest.py about the manifest's values before anything exists, so `--id null`, `--tracking-branch true` and a blank `--elected-by` are refused (#258, #261) (#314) Both tools fill `templates/assembly-root/` from values a person typed or edited into a plan, and the new project then reads the result with two programs of its own: its YAML reader (`repo_shape`) and its `scripts/validate-manifest.py`. Neither tool asked either of them. Now each is asked, before a work directory or a remote exists and under `--dry-run` alike, and a value the project cannot hold is refused with the value named and the reason given. - **#258, the scaffold.** `id:` and `tracking_branch:` are written bare. `--id null` and `--id true` scaffolded three repositories whose first bootstrap failed `manifest-id`; `--tracking-branch true`, `007` or `null` pushed every repository on the branch as typed while bootstrap read the manifest back as `True`, `7` or `main` and put each leg on a local branch the remotes do not have, with no upstream, exit 0. Now `scaffold-manifest-misread` names the value and what the reader makes of it. - **#261, both tools.** A blank `--elected-by`, `--reference` or `--name`, `--elected-on 2026-W41-6` or `20261011` (read by `date.fromisoformat` from Python 3.11), `--org test+org`, and a plan edited to `visibility: secret` or `elected_by: null` were accepted, and `adoption verified` or a scaffold exit 0 followed. Now the scaffold says `scaffold-manifest-invalid`, `adopt-project.py plan` says `adopt-manifest-invalid`, `check` makes a `plan-manifest-invalid` FINDING of each, and `execute` refuses it through `check`'s own list (#168), before a leg repository exists. The sentence quotes the validator's own finding, so the words are its words. - **Names that cannot be directories.** A `--project` of 247 to 250 characters died in `Path.exists` with `OSError: File name too long` and a traceback under `--local-remote-dir` (scaffold from 247, adopt `execute`); `plan` admitted 251 to 255 that `check` refused as `unsafe-value: legs.spec`. `scaffold-name-too-long` and `adopt-name-too-long` refuse the first before anything exists, and `plan` now holds the three derived names to `checked_value` as `check` does. - **A validator that cannot be asked.** A copy of the standard whose `templates/assembly-root/scripts/validate-manifest.py` is missing, does not load, lacks what is asked of it (`DATE_RE`, `_findings`) or raises, is `manifest-validator-unusable` and not a traceback: it names the file, says the defect is the copy's and that nothing was created. A failed load is not cached. - `scripts/shape_materialize.py` (the one module both tools import, in no copy list): `manifest_misreads` renders each template line that carries a value and reads it with `parse_yaml`; `manifest_invalid` renders `project.yaml` from the whole substitution table and runs the validator the template ships, loaded from that file (no bytecode written into the template tree, `sys.path` put back); `refuse_manifest_values` and `manifest_value_problems` compose them; `misread_placeholders` names the placeholders `manifest_misreads` would refuse; `election_date` admits only what the validator's own `DATE_RE` admits, on every Python; `refuse_unstorable_names` holds a name to 255 bytes, `.git` included under `--local-remote-dir`, and shows a name too long at both ends. A placeholder is what `PLACEHOLDER_RE` finds in a line, not a second copy of its alphabet. - `scaffold-project.py`: `_refuse_unholdable_manifest` after the substitution table is built and before the plan is printed, the name rule before anything asks `gh api`; `--help` for `--id`, `--elected-by` and `--tracking-branch` says the rule. - `adopt-project.py`: `_flag_plan`, `_manifest_values` (the table `execute` renders from, asked of `_template_values` and not copied), `_manifest_findings` in `_entry_findings`, `_refuse_unholdable_values` in `cmd_plan`, the name rule in `_repository_urls`. - `docs/cli.md`: regenerated (four help paragraphs). - `tests/test_scaffold_manifest_values.py` (106 tests), `tests/test_adopt_manifest_values.py` (79). The templates write `id:`, `elected_on:`, `visibility:`, `tracking_branch:` and the leg paths bare, and the project's reader reads `null`, `true` and `007` as None, True and 7. Either the tool refuses what the project would misread, or the template quotes the placeholder (#259, which Brett has not decided). This refuses, because: 1. Every neighbouring fix refuses and none quotes: #225 (`--spec-path 2026`: "refused rather than quoted in the templates"), #181 (`adopt-manifest-misread`), #266, #251 (a chain link that is not a name). A scaffold that quoted while `adopt-project.py plan` refuses `--tracking-branch 007` would disagree with it about whether `007` is a branch. 2. Quoting changes the bytes of every new project's `project.yaml` and leg pins for every tool that renders them (the scaffold and adopt `execute`), and #259 asks for that to be decided once. (`family.py init` renders `templates/family-root/`, not these lines; it has the same defects in its own file and is #307.) 3. The question is asked of the TEMPLATE: each line is rendered and read as the project reads it, so the day a placeholder is quoted those values read back and nothing here refuses them, with no edit. `test_quoting_the_template_would_make_the_refusal_go_away` holds that. 4. A value that is a legal git branch name and that YAML reads as a boolean or null is not silently retyped: it is refused, with the reading named. **A behaviour change for input that used to work.** `--tracking-branch 2026` and `1.5` worked by accident (`str(2026)` gives `2026` back, and every reader of `tracking_branch` does `str()`: `bootstrap.py`, `update-shape.py`, `bump-leg.py`); they are refused as `adopt-project.py plan` refuses them on #181. #259's quoting would allow them again. The refusal's remediation says so in the true terms: it says only what holds of every value refused (the project's reader reads back something other than what was typed), names the failures that do hold (an id that is not text fails `validate-manifest.py`; `007` as a branch reads back as `7`), says that `2026` or `1.5` as a branch work today only because the tools that read it turn the number back into text and are still numbers to the project's reader, and gives the way forward, a value the reader takes for text (`atlas`, `release-2026`, `v2`). It no longer says the first bootstrap would fail, which is false of exactly those two values. The rule is the validator's own: `manifest_validator()` loads `templates/assembly-root/scripts/validate-manifest.py` from the template it ships, and `election_date` asks its `DATE_RE`. The alternative, moving the predicates into `scripts/repo_shape.py`, is a shape copy: every project in the estate would meet an `upstream-changed` row on its next `update-shape.py check` for a question no project asks of itself (the argument `shape_materialize` already makes for the leg-path rule and the commit trailers). Loading the file leaves the validator the one place the rule is written, and any rule it learns is asked here with no edit (`test_the_election_date_asks_the_validator_not_a_copy_of_its_rule`). Reproduction scripts: the issues' own loops (`repro258.sh`, `repro261.sh`), local remotes only. ``` base c3f4987 == --id null: scaffold exit 0 ... bootstrap exit 1 FINDING manifest-id: id is None == --tracking-branch 007: scaffold exit 0 ... bootstrap exit 0 spec leg on 7, upstream: fatal: no upstream configured for branch '7' == scaffold --elected-by ' ': exit 0, bootstrap exit 1: FINDING manifest-elected-by: elected_by is empty == adopt plan --org=test+org: check plan ok, execute exit 0, 1 x 'adoption verified'; bootstrap exit 1: manifest-leg-repository == adopt --project of 247 characters: execute exit 1 OSError: [Errno 36] File name too long this branch == --id null: scaffold exit 2, REFUSED scaffold-manifest-misread: --id is 'null', which is written into project.yaml as `id: null`, where the project's own YAML reader reads it back as no value at all and not as that text. == --tracking-branch 007: scaffold exit 2, REFUSED scaffold-manifest-misread: --tracking-branch is '007' ... reads it back as the number 7 == scaffold --elected-by ' ': exit 2 REFUSED scaffold-manifest-invalid: --elected-by is ' ', which the project's own validate-manifest.py refuses: manifest-elected-by: elected_by is empty. ... == adopt plan --org=test+org: plan exit 2 REFUSED adopt-manifest-invalid: --org is 'test+org' ... manifest-leg-repository ... == adopt --project of 247 characters: execute exit 2 REFUSED adopt-name-too-long ``` Each row is in the logs named in the report; every row of the two issues, and the extra rows lane 2 added to #258 (`--id 2026` and `007`, `--project Null` and `True`, `--tracking-branch TRUE`, `Null` and `1.50`), is a test that fails on c3f4987 (130 of the 170 new tests fail there: the rest assert what must still work, such as `release-1` and `v1.2.3`, or hold the API). Targeted runs on this head, all with the venv `git-filter-repo` 2.47.0 on PATH: | run | result | |---|---| | test_scaffold_e2e, _pin_and_reuse, test_naming_policy, test_manifest_validator, test_adopt_plan, test_adopt_execute_refusals, test_repo_hygiene, test_cli_reference, test_adopt_entry_paths, test_adopt_finding_spelling, test_adopt_gitmodules_values, test_yaml_flow_quotes, test_load_yaml_refusals, test_adopt_plan_escapes, test_pin_validator, test_neutral_pin_validator, and the two new files (170 of the tests) | 1087 passed, 1 skipped (`SHAPE_MEDXEHR_CLONE` unset) | | `tests/test_shape_doctor.py`, its own stream | 242 passed, 3 skipped (the PowerShell line, a Windows host only) | Mutation probes: each hunk reverted in a throwaway worktree, at least one new test fails for each of the eighteen of the first round and the ten of the second (the date rule, the scaffold gate, the misread scan, the validator question, the bytecode and `sys.path` guards, both name rules, adopt `plan`, the one list `check` and `execute` read, the grouping by value, the attribution, the leg-path and non-text filters, the list-`legs` guard, the no-revision guard, the unclassifiable-names guard; and the remediation wording, `misreads_elsewhere`, the placeholder pattern, `_line_shown`, the name tails and the three validator guards). Reach: every tracked YAML file (14) loaded with `repo_shape.load_yaml` on c3f4987 and on this head, parsed results identical (nothing here touches the reader; 7 are unrendered templates the reader refuses on both). Writers of the constructs: `scaffold-project.py` and `adopt-project.py execute` (assembly root); the family holder's writer is #307's. Nothing ran on Windows or macOS before this PR's CI: the new tests pass bytes and never `text=True` to git, write plans with `newline="\n"`, and the ones that copy the standard (`a_copy_of_the_standard`) copy a tree the way `tests/test_family.py` does. | against | result | the merged tree, run in a throwaway worktree and never committed | |---|---|---| | origin/main d82a83e | clean: this head contains it. Main was merged five times (49c21fa b421e6b, 567ee20 c0ed615, f45edf4 34ecbc2, 4b8da3d ab623dd, c578557 d82a83e); each conflict at the tail of `_entry_findings` was resolved by keeping every group, and on this head the tail is `findings + split + unwritable_findings + value_findings + moved`, with the remediations in the same order (see the merges below) | the runs below the merges are this tree | | origin/fix/render-single-pass 552763d (#260) | clean | 364 passed: the two new files, `test_template_values_single_pass.py`, `test_template_quoted_values.py` | | origin/fix/adopt-check-shape-paths 8a496d5 (P) | clean | 284 passed: the two new files, `test_adopt_root_shape_paths.py` | | origin/fix/leg-path-yaml-scalars b2b42f8 (#266) | clean | 722 passed: the two new files, `test_leg_path_yaml_scalars.py`, `test_adopt_leg_paths.py` | | origin/fix/adopt-plan-quote-yaml-keywords e337f44 (#181) | CONFLICT, two hunks in `adopt-project.py` `_entry_findings`: its docstring and its last statement | keep both and `misreads_elsewhere=True` (below): 1050 passed, 1 skipped: the two new files, `test_adopt_plan_yaml_quoting.py`, `test_adopt_leg_paths.py`, `test_adopt_plan.py`, `test_adopt_execute_refusals.py`, `test_cli_reference.py` | **With #181, and who does what.** Both branches add a findings group to `_entry_findings`. Keeping both, with #181's misread group just before this branch's (on this head, `findings + split + unwritable_findings + misread + value_findings + moved`), gives two findings for a plan value that is TEXT and that the template writes bare, which the reader reads back as a number or a boolean (`elected_on: "20261011"`, `visibility: "true"`, `id: "007"`): #181's `plan-manifest-misread` and this branch's `plan-manifest-invalid`, the second saying the retyped `id is 7`. `_manifest_findings(plan, misreads_elsewhere=True)` leaves such a value to the misread rule, by the placeholders `shape_materialize.manifest_misreads` refuses, so it is judged once. It is False here because with nothing else asking the misread question the validator's finding is the only one: always leaving such a value out makes this branch alone accept `id: "007"` at `check`, which it refuses, and 13 tests of this branch fail with it on. **Whoever lands second passes `misreads_elsewhere=True` at the one call in `_entry_findings`**; nothing is lost in either order, and `test_a_text_value_the_reader_misreads_is_one_finding_in_the_list_check_prints` fails for each of the three values on a merge that has not (two findings), and passes on one that has. Run on a throwaway merge with #181's e337f44: the three pairs are three single findings, and the other 16 rows of the 19-row plan and `check` driver are unchanged. Re-pointing #181's own gate at `shape_materialize.manifest_misreads` (one definition for both tools, which #258 asks) is the same person's job and is not done here: lane 1's branch is not this PR's. `#266` fires first at the scaffold (its leg-path rule, before the manifest gate), at adopt `plan` and at `check`, so the two messages about a leg path never disagree once it lands. `#260` makes a value holding a `{{KEY}}` acceptable as typed (see the first left-out item). - `adopt-project.py`'s misread side is #181's: `--tracking-branch 007` at `plan`, a plan edited to a non-text value (`id: 007` read as the number 7), and a value carrying a line break (`elected_on: "2026-09-02\nfoo: bar"`). This branch already refuses `--id true` and `--id 007` at `plan`, and `id: "007"`, `visibility: "true"` and `elected_on: "20261011"` at `check` and `execute`, through the validator's `manifest-id`, `manifest-visibility` and `manifest-elected-on`. - Leg paths (`--spec-path 2026`): #225's, now #266. `plan` refuses one through the validator's `manifest-leg-path` (it passes no `ignore`), and `check` ignores that code because it reports a leg path in the leg-path rule's own words (`ignore=LEG_PATH_CODES`), so a hand-edited `spec_path: "2026"` still checks `plan ok` on this branch as it did on main. #266 judges it first everywhere. - `scripts/family.py init`: the same defects in the holder; verified here (`--created-by ' '`, `--created-on 20261011` and `--id null` exit 0 and the holder's `validate-family.py` is red; `--tracking-branch true` is silent). **#307.** - `--pin null@<sha>` and a `--pin` product the reader misreads (the scaffold writes `neutral_product_pins` and a pin file product bare): not asked; #181 does adopt's. - `--org`: the scaffold's `gh repo create` still fails for a name longer than GitHub's 100 characters, at the first leg, before anything exists; that is GitHub's limit and not the validator's. - A refusal that depends on `--pin` without `--pin-source` is reached after `_declaration` has read the forge with `gh api` (a read); the leg-path and name rules come before it (the review's NIT-8). Remaining nits of the adversarial review that are not fixed here, one line each: - NIT-1: `plan` and `check` disagree about `--spec-path 2026` on this branch alone (see the second item above), and the scaffold's sentence names no flag for `--spec-path true`; #266's rule fires first everywhere once it lands. - NIT-2: `check` exits 2 with one REFUSED and no findings for a bad `org:` (`unsafe-value`) or an unparseable `elected_on:` in a plan with no `reference:` (`election-date-malformed`, naming `--elected-on` about a plan key); both are better verdicts than main's `plan ok`, but refusals and not FINDINGs. - NIT-6: before #260 lands, a value that holds a `{{KEY}}` is refused as `template-unsubstituted` (a defect of the tool), under `--dry-run` too; main accepted the dry run and wrote the wrong text or died after the push. With #260 both are accepted as typed. - NIT-8: with `--pin` and no `--pin-source`, a misread `--id null` is reached only after the forge read (above). - Two mutants of the review survive and are judged equivalent: `_reading_of`'s `len(parsed) == 1` and `key in values` in `_sentences_of`. An adversarial review of ca21b57 approved with nits. It had three should-fixes, none a code defect: - The misread remediation gave a false reason for `--tracking-branch 2026` and `1.5`. - A conflict with main in `_entry_findings`, and a stale body. - Double findings once lane 1's #181 lands. Fix round 1 (7defac7) handles all three and four nits. Its re-verification found no blocker or should-fix. It confirmed that taking the review's #181 suggestion unconditionally would drop this branch's only finding for `id: "007"`, `visibility: "true"` and `elected_on: "20261011"`. The `misreads_elsewhere` flag is therefore the handover: whichever of this PR and #181 lands second passes `True` at the one call in `_entry_findings`, and the guard test fails if it does not. A seeded run of 1324 edited plans on the flagged merge with #181 left no value with no finding and none with two. Two new nits are left: - A template validator whose `_findings` returns something other than a list still ends in a traceback. - The flag's call site in `_entry_findings` has no comment pointing at the handover. Tests on all three OSes passed at 7defac7, but SonarCloud's quality gate failed on its security rating for new code: `pythonsecurity:S8705` at `shape_materialize.run()`. That is the agentic argument-injection family #119 marked a false positive. The only new call into `run()` was `git rev-parse HEAD` in this tool's own checkout, with constant arguments. Fix round 2 (cf3e8d3) removes it, and a second git call with it. **SonarCloud still flags the same S8705 on cf3e8d3**, so that call was not its cause. The finding sits wholly inside `run()`, and PR #316 carries the same one with no new caller of `run()`. It needed no disposition in the end: main itself carried the identical finding until 13:01:12Z on 2026-10-12, opened by a `bump-leg.py`-only commit and closed by a `validate-pins.py`-only commit, and this PR's one analysis (11:55:50Z) was charged with it as new. SonarCloud passes from 4b8da3d on, with no change to `run()` or its callers. - `plan` and `check` ask the project's own validator about the manifest with a fixed, well-formed placeholder commit and tree digest. The question starts no process; the commands still read the source with `git`. The validator holds both to their form and compares them with nothing. - A second call went with it: `_template_values` also ran `tree_digest(SHAPE_ROOT, commit)` (`git ls-tree -r` over the whole standard) on every `plan` and `check`. The table body moved to `_template_table`, which runs nothing. `execute` still builds its table with the real commit and digest, which a new test asserts. - Both commands now refuse a blank `--elected-by` from a tree with no `.git` exactly as in a checkout, which fixes the review's NIT-9. There are 16 new tests: 14 fail on the previous `adopt-project.py`. - Main c0ed615 is merged (567ee20), with no conflict. - A fresh re-verification of the round found the code correct. `execute`'s 29-key table and its 50 pushed files are identical to 7defac7's. An audit hook saw 0 process starts in the manifest question. 14 of the 16 tests fail on 7defac7, and all nine mutants of the round are caught. Fix round 3 (ab66bc0) changes no behaviour: - It corrects a stale comment that pointed at `_template_values`. - It replaces two lane-private review ids that had been committed in a test. - It splits eight composite assertions SonarCloud flagged (`python:S9073`). - It defines the validator's path once (`MANIFEST_VALIDATOR`, `python:S1192`). Targeted runs: 289, 102 and 176 passed, and the suite collects (3499). **Four later merges of main, and the #351 compose commit.** - **4b8da3d merges main ab623dd.** It brought #270 (f795cf7), which asks whether a file can hold a value at all: `adopt-unwritable-value` at `plan`, and `plan-unwritable-value` at `check` and `execute`. - Some values are judged by both #270 and this branch. Examples: a lone surrogate, a line break or a bidi control in `visibility:` or `elected_on:`, and a control character or a line break in `elected_by` or `reference`, which the validator then reads as blank. - For such a value, #270's finding comes first, so `execute` refuses under #270's code. Both findings are listed, and both refuse before any leg exists. - #270's own hand-edited-value tests pin that order: three of them fail when it is reversed. - Why this order: #270 names the byte, the break or the control the person must retype. The validator describes the manifest that value would be written into, which is a consequence of it. - #309's `--spec-path` and `--code-path` help is kept beside this branch's `--tracking-branch` help. - **c578557 merges main d82a83e.** It brought #245 (161c6c9). #245 splits the submodule findings, puts its relative-url findings last, and returns `check`'s NOTEs as a third value. - This branch's group stays after #270's and before #245's, so the tail of `_entry_findings` is `findings + split + unwritable_findings + value_findings + moved`. - Two of this branch's tests now unpack that third value. - `_repository_urls` keeps `adopt-name-too-long` in #245's shape. - **The same merge brought #351 (#282).** Its `_identity` refuses an `--elected-by`, `--reference` or `--name` that no file can hold, as `scaffold-unwritable-value`, before this branch asks the validator. So the scaffold and adopt refuse in the same order. - a5438a5 applies the compose patch written with #351, unchanged. - Five of this branch's scaffold test cases now expect #351's refusal: `--elected-by` TAB in two tests, `\x0b`, `\x1c` and U+2028. - Without the patch, the merged tree fails exactly those five. - **ba58838 and c6f441b merge main 1f90a0f and 92e29d9** through `gh pr update-branch`, with no conflict. They bring #371 (a983e6a), #354 (8325d05), #380 (1f90a0f) and #377 (92e29d9). **A behaviour change since the head first approved (f45edf4).** `plan --reference $'\t'` and `plan --elected-by ' \n'` were refused as `adopt-manifest-invalid` and are now refused as `adopt-unwritable-value`. `plan --elected-by 'Bob\u202e'`, which f45edf4 planned, is now refused too. The same holds for `check` and `execute` on a value both rules judge: the code is now #270's. No test of this branch pins the old code, and the new order is the one #270's tests require. Targeted runs on a5438a5, with `git-filter-repo` 2.47.0 on PATH and the checkout's git identity blanked, are below. | run | files | result | |---|---|---| | this branch and #351 | `test_adopt_manifest_values.py`, `test_scaffold_manifest_values.py`, `test_scaffold_free_text_values.py` | 298 passed | | #270 | `test_adopt_template_values.py` | 77 passed, 1 skipped (`:223`: this checkout's own git config names a user, which outranks the test's `GIT_CONFIG_GLOBAL`; it passes in an export of the tree) | | #245 | `test_adopt_relative_submodule_url.py`, `test_adopt_gitmodules_values.py`, `test_adopt_submodules.py` | 352 passed | | the doctor | `test_shape_doctor.py` | 255 passed, 3 skipped (the PowerShell line, a Windows host only) | | neighbours | `test_scaffold_leg_path_collisions.py`, `test_cli_reference.py`, `test_repo_hygiene.py`, `test_scaffold_pin_collisions.py`, `test_adopt_clone_template.py`, `test_adopt_ignored_shape_files.py`, `test_adopt_literal_names.py`, `test_template_quoted_values.py`, `test_template_values_single_pass.py` | 506 passed | The same five runs were repeated on c6f441b, the landing head. #377's `test_adopt_entry_paths.py` and `test_adopt_plan_escapes.py` were added to the neighbours. Results: 298 passed; 77 passed and 1 skipped; 361 passed; 255 passed and 3 skipped; 644 passed. Reviewed adversarially (APPROVE WITH NITS, 0 blockers, 3 should-fixes); fix round 1 handles the three and four nits, and its re-verification found no blocker or should-fix. Fix round 2 validates with a placeholder commit, so the manifest question starts no process; its re-verification found the code correct. Fix round 3 is nits only. CI is green on Linux, macOS and Windows, with SonarCloud passing, at c6f441b (main 92e29d9 merged in). The combined tree with main 45e01f4 passed `test_agents_md_codes.py`, `test_shape_doctor.py` and `test_adopt_manifest_values.py` locally (391 passed, 3 skipped). A re-verification of the merge with ab623dd (4b8da3d) confirmed the merge, the refusal order and the composition. Its one nit, two stale sentences about the order, is fixed here. Closes #258 Closes #261 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
pushed a commit
that referenced
this pull request
Oct 12, 2026
…351, #350, #345, #372, #371, #354, #380, #377 and the rest since ab623dd merge with no conflict, beside the pin functions this branch moved out of `scaffold-project.py` and its `plan --pin` in `adopt-project.py` Twelve commits of main since ab623dd, the base this branch last merged, reach five files this branch changes: `adopt-project.py` (161c6c9 #245, a983e6a #371, 92e29d9 #377), `scaffold-project.py` (d82a83e #351), `scripts/shape_materialize.py` (1f90a0f #380), `scripts/repo_shape.py` (161c6c9) and `docs/cli.md` (3ae0109 #345). Git merged every one with no conflict: - `scaffold-project.py`: #351's `_identity` value checks and its `unwritable_reason` import sit beside the imports that replaced the pin functions; pyflakes finds no undefined name in either tool (only the unused imports main itself has). - `adopt-project.py`: #245's `_entry_findings` now returns its NOTEs as a third value and takes `local_remote_dir`; `_pin_findings` is still read through `_leg_findings`, inside it. - `scripts/repo_shape.py` equals the tree `git merge-tree` gives for 6494714 with cd1fc79 (blob 091966b), and `validate-pins.py` and `tests/test_pin_source_env_collisions.py` are still Q's blobs. - `render-cli-reference.py --check`: ok. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
pushed a commit
that referenced
this pull request
Oct 12, 2026
… conflict with #394 (#225) 7a8b981 (#394, issue #189) moved a leg path's segment rule into `repo_shape.path_spelling_fault` and added it, with `PATH_CLIMBS`, `PATH_ITSELF` and `PATH_NOT_CANONICAL`, to the `from repo_shape import (...)` list in scripts/shape_materialize.py, the list this branch had added `parse_yaml` to. GitHub could no longer update the branch. The one conflicting hunk is resolved as main's list. The branch's `parse_yaml` is left out because main has imported it at the top of the module since #380 (`from repo_shape import YamlError, _strip_comment, parse_yaml`), and `_read_back` uses that binding. Naming it in both imports was a redefinition that pyflakes reported. With this merge the pull request changes no import line. Everything else merged without a conflict and keeps both sides. From main: the `EXCEPT THE SEGMENTS` comment, `LEG_SEGMENT_REASONS`, and `_spelling_reason` asking `path_spelling_fault`. From this branch: the #225 paragraph, `_leg_path_lines`, `_misread_reason`, and the read-back step in `leg_path_problem` and `_canonical_spelling`. The read-back is still asked last, after the spelling, Git's and Windows' names and the alphabet. 7a8b981's `submodules:` record adds no line that holds a leg path. Each row's `path:` is a submodule's path inside its leg, and `leg:` is `spec` or `code`. `execute` appends the block in code instead of rendering it from a template, and it double-quotes every path. The rule still finds the four real template lines. An adoption at `--spec-path legs/v2 --code-path c0de` with a recorded submodule writes a leg path on those four lines only, and its bootstrap passes 7a8b981's validator. The merge also brings in ec4a7a0 (#456), 437a360 (#343) and d222a12 (#397). None of them touches a file of this pull request. Lane: openreposhape-2 (openRepoShape-2) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 13, 2026
brettheap
added a commit
that referenced
this pull request
Oct 13, 2026
… writes its pin file as the scaffold does, so an adopted root passes `validate-pins.py` (#273); a `--pin-source` that cannot answer is `pin-source-unreadable` (#339) (#508) **Brought up to date after #409 squash-landed** by merging origin/main (9736424, #409's squash) as f9ed46f. Its `scaffold-project.py` conflict was resolved to this branch's side once `git diff b70a07d 9736424 -- scaffold-project.py` (#409's final head against its squash) came out empty. So the file is the one tested on this branch plus main's own later changes to it, and holds nothing of #409's; details below. This branch carries #275's adopt half. It was built on `fix/pin-source-env-collisions`, PR #409 (#275's scaffold half and its fix round), merged at 6494714 as 583f647, over the earlier 5690235 (34dbd86). After 6494714, #409 only merged main, five times, up to its final head b70a07d, and none of those merges has a hand edit (`git show --remerge-diff` is empty for each). Adopt's refusal of two products that share a source variable goes through #409's function, so this branch lands after #409. It was never rebased. `git diff b70a07d 9736424` is empty for each file #409 touched: `scaffold-project.py`, `scripts/repo_shape.py`, `templates/assembly-root/scripts/validate-pins.py` and `tests/test_pin_source_env_collisions.py`. What f9ed46f resolves, four files with one hunk each: - **`scaffold-project.py`.** - The conflict hunk is main's block from `PIN_COLLISION_REMEDIATION` through `_pin_collision_remediation`, which #409's squash edits: it adds `PIN_VARIABLE_REMEDIATION`, `_colliding_pin_variables` and `_pin_collision_remediation` and changes `_refuse_colliding_pins`. This branch moved all of that to `scripts/shape_materialize.py`. The hunk takes this branch's side. (The merge commit's message says "re-adds"; this is the exact account.) - #409's auto-merged import of `PIN_SOURCE_ENV_PREFIX, pin_source_env_collisions` is dropped, because nothing in the file uses either name any more. - It is not `git checkout --ours` of the whole file. Main changed the file beyond #409 since this branch last merged it: #355's `--tracking-branch` check (6c2a371) and a73b4e9's `RULESET_HINT`. Those lines stay. - The result is the file `git merge-tree` gives for this branch with main before the squash (518010b). Its diff from the file tested here has the same patch-id as main's own 3ef059c..518010b change to it. - **`templates/assembly-root/scripts/validate-pins.py`.** Main's side, which is #409's final blob, with main's #359 workflow reader in it. This branch had no change of its own to the file beyond #409. - **`adopt-project.py`, `_commit_the_split`.** - Main: #445 wraps the function in its late-failure `try`, and #394 builds an `append` with the plan's submodule record. - This branch: its only edits there were a comment and `neutral_pins=_recorded_pins(plan)` on the materializer call. - Both now sit on main's call inside the `try`: `append=append, neutral_pins=_recorded_pins(plan)`. - **`docs/cli.md`.** It is regenerated with `scripts/render-cli-reference.py`, and `--check` is ok. It differs from main's only in the `--pin`, `--pin-owner` and `--pin-source` help of `adopt-project.py plan`. `scripts/repo_shape.py`, `templates/assembly-root/scripts/validate-pins.py` and `tests/test_pin_source_env_collisions.py` are main's blobs, which are #409's: this branch adds nothing to them. Nothing of #409 is lost. Its scaffold behaviour is `shape_materialize.refuse_colliding_pins` and `pin_variable_collisions`, keyed by #409's `pin_product_key`. **73d65c6, after the merge.** - **The change.** `_read_pins` reads `plan.get("pins")` where it read `plan.data.get("pins")`. - **Why.** #445's `tests/test_adopt_late_failure.py` hands `_commit_the_split` a `SplitPlan` as its plan, a `dict` that adds `entries`. On f9ed46f, three of its tests stopped at "committing the split" with `AttributeError: 'SplitPlan' object has no attribute 'data'` (3 failed, 83 passed in that file). - **Nothing else changes.** `Plan.get` with no default returns `plan.data.get(key)` exactly, so a loaded plan reads as before. `adopt-project.py plan --pin` took a NAME only (`--pin openGlass`) and refused a trailing `@<commit>`. `plan`, `check` and `execute` each exited 0, and `execute` printed `adoption verified`. The manifest then listed the name in `neutral_product_pins:` with no `contracts/<product>-pin.yaml` beside it, and on its first run the adopted root's own `validate-pins.py` refused it as `neutral-pin-missing`. #273's table, reproduced on c7c02fa with the issue's own commands (local bare remotes, and a stub `gh` that exits 97): | `--pin` | c7c02fa | this branch | |---|---|---| | `openGlass` | `execute` exit 0, `- openGlass`; clone's `validate-pins.py` exit 2 `neutral-pin-missing` | `plan` exit 2 `pin-malformed`, with the scaffold's remediation (`--pin openGlass@<40 hex>`); no plan is written | | `opensoft/openGlass` | exit 0, `- opensoft/openGlass`; exit 2 `neutral-pin-missing` for `contracts/opensoft/openglass-pin.yaml` | `plan` exit 2 `pin-malformed` | | `spec` | exit 0; `validate-pins.py` exit 0, reading the leg's `contracts/spec-pin.yaml` as the neutral pin | `spec@<sha>` is `adopt-pin-collides` at `plan` | | `shape` | exit 0; `contracts/shape-pin.yaml` read as the neutral pin | `shape@<sha>` is `adopt-pin-collides` at `plan` | | `openGlass@<sha>`, `opensoft/openGlass@<sha>` | `plan` exit 2 `adopt-pin-malformed` | `plan`, `check` and `execute` exit 0, and `gh` is called 0 times. `contracts/openglass-pin.yaml` is written and the manifest lists `- openGlass`. In the clone, `validate-manifest.py` exits 0, and `validate-pins.py` exits 0 with `openGlass: pin commit … digest recomputes` | Brett ruled for decision 1's first option ("go with your recommendation on #273"): adopt takes the scaffold's pin and writes the scaffold's pin file. That reverses the NAME-only `--pin` from #6, and the comment that described it is replaced with the new contract. - **One implementation.** The scaffold's pin code moved into `scripts/shape_materialize.py`, next to `neutral_pin_path` and the materializer that writes the file. What moved: - `PIN_ARG_RE`, `parse_pin`, `pin_digest_from_source` and `pin_digest_from_gh`; - `declared_pin_values`, `declared_pin_products` and `PIN_COLLISION_REMEDIATION` (in #309's wording); - from #275's branch, `PIN_VARIABLE_REMEDIATION` and the variable check; - `_refuse_colliding_pins`, split into the pure `pin_collisions` and `pin_variable_collisions`, and `refuse_colliding_pins(refusal=...)`, which raises one refusal for both. The code did not move verbatim. `_refuse_colliding_pins` became the three functions above; `pin_digest_from_source` was rewritten for #339 (below); and fix round 1 changed three of them (below): `pin_variable_collisions` keys each pin by #275's `pin_product_key`, `pin_digest_from_source` spells a path that is not printable, and `pin_digest_from_gh` refuses a missing `gh`. The scaffold's behaviour is otherwise unchanged. `scaffold-project.py` imports what it calls under its old names. Lane 5's review ran 34 scaffold cases (every pin refusal, the `gh` stub's four modes, dry and real successes) on 34dbd86 and on this branch at 7a94b6b. rc, stdout, stderr, the `gh` log and the files made were identical, apart from the shape's own commit and digest and #339's row. Its pin tests and #275's pass as they are. `tests/test_git_output_decoding.py`'s exemption for `pin_digest_from_gh` follows the function to its new file. - **`plan`.** `--pin`, `--pin-owner` and `--pin-source` mean what they mean for the scaffold. `plan` reads the digest from `--pin-source` or `gh api`, and records product, repository, commit, digest and `digest_source` in the plan, so `check` and `execute` read no network for a pin. `plan` refuses: - a name with no `@<commit>`, as `pin-malformed`. That includes an empty `--pin ''`, which adopt used to drop and now refuses, as the scaffold always has; - `spec`, `code` and `shape`, in any case, as `adopt-pin-collides` (#273 decision 4), in the scaffold's sentence and remediation (#241, #309); - one product given twice, the same way, whether it is a repeat or two names that share one file (decision 5); - two products that one `SHAPE_PIN_SOURCE_<PRODUCT>` names, such as `open-glass` and `open_glass`, the same way, through #275's check; - a leg path over a pin's file, as `adopt-leg-path-collides`; - a `--pin-source` path that `check` would refuse in `digest_source:` (fix round 1), as `adopt-unwritable-value`. It is asked only when a `--pin` records the path; - with no `gh` on PATH and no `--pin-source`, `gh-not-found` (fix round 1). - **`check` and `execute`.** These are new `check` findings, and `execute` refuses each one before any leg exists. They come from `_leg_findings`, the list `check` and `_refuse_what_check_finds` share: - `plan-pin-unrecorded`: a name alone (an old plan's `pins: [openGlass]`, or a hand edit), or an entry missing its commit or digest; - `plan-pin-malformed`; - `plan-pin-collides`, which covers two pins at one file, a pin at a file the shape writes, and two products that share one source variable; - `plan-root-holds-pin`: a source path kept in the root at the pin's file. The materializer would write the shape's pin beside it under `shape/`, and `validate-pins.py` would read the source's file instead. How each finding ends: - `plan-pin-unrecorded` and `plan-pin-malformed` end with the `plan --pin <product>@<40 hex commit>` that records the pin whole. - `plan-pin-collides` ends with re-running `plan` with each product once, or, for two products that share a source variable, with one product of each such group. - `plan-root-holds-pin` ends with the kept path's own remedy: send that entry to a leg, `drop` it, or rename it in the source and re-run `plan`. A leg moved over a pin's file in the plan is `plan-leg-path-collides`. - **Also part of #386: its `pins:` row.** A hand-edited `pins:` that is not a list (a name such as `pins: openGlass`, a number, a mapping, a quoted string) is now `plan-pin-malformed` in `check` (`` `pins:` is 'openGlass', not a list of pins ``), and `execute` refuses it before any leg exists. - Where: `_read_pins` in `adopt-project.py`; the test row is `plan-pin-malformed-not-a-list` in `tests/test_adopt_pins.py`. - Before: on main, `check` said `plan ok` for the name, the mapping and the string, and gave a traceback for the number (reproduced by lane 5's review on cb7063f). #386 records that `execute` then wrote the name as eight one-letter pins. - Not fixed here: #386's other keys, `allow_empty_legs:`, `paths:`, `legs:` and `source:`, so #386 stays open. Lane 2's #435 takes all of #386, `pins:` included, and its `pins:` rule keeps only text items where this branch writes mappings; whichever lands second reconciles them (#435 (comment), and "Where the meaning meets" below). - **`execute`.** It writes each pin through `materialize_assembly_root(neutral_pins=...)`. The manifest lists the product with the owner stripped (decision 3), so the entry and the file agree. - **Docs.** `--help` is updated and `docs/cli.md` regenerated (`render-cli-reference.py --check` ok). `pin_digest_from_source` caught only `Refusal`. A directory that is no clone is git's own failure, so it was always `pin-source-unreadable`, exit 2. A path `subprocess.run` cannot enter never reaches git: it is a `FileNotFoundError`, `NotADirectoryError` or `PermissionError` out of `cwd=`, and nothing caught it. `scaffold-project.py --pin ... --pin-source <that>` ended `--dry-run` and the real run alike in a traceback, exit 1. Since the move above, `adopt-project.py plan --pin` reads its digest through the same function and ended the same way. Both reach it through `declared_pin_values`, and `check` and `execute` read no source, so that call is the only reader. The issue's table, run on ab623dd for the scaffold and on d806e8f for `adopt-project.py plan` (adopt has no `--pin-source` on ab623dd), then on this head. `gh` is a stub that logs and exits 97, with `GH_TOKEN` bogus and an empty `GH_CONFIG_DIR`; it was called 0 times in every run: | `--pin-source` | before | this branch | |---|---|---| | a directory that is not a clone | `pin-source-unreadable`, exit 2 | unchanged | | a path that does not exist | `FileNotFoundError` traceback, exit 1 | `pin-source-unreadable`, exit 2: `<path> could not answer for opensoft/openGlass @ <40 hex>: no such directory` | | a file | `NotADirectoryError`, exit 1 | exit 2, `... it is a file, not a directory` | | under a parent this user cannot enter | `PermissionError`, exit 1 | exit 2, `... Permission denied` | | a symlink loop (not in the issue) | `RuntimeError` out of `Path.resolve()` on 3.12, exit 1 | exit 2, `... Too many levels of symbolic links` | The real run and `--dry-run` give the same stdout and stderr, and nothing exists afterwards (no remote directory, no work directory; for adopt, no plan file). What changed, in `scripts/shape_materialize.py` only: - `pin_digest_from_source` catches `OSError` as well as `Refusal` and raises the existing `pin-source-unreadable` with its remediation unchanged. The message names the path and the reason. - `stat()` judges the source inside the guard, as #312 does in `validate-pins.py`, and the sentences are that file's: a missing path, or one beneath a file, is "no such directory"; a file is "it is a file, not a directory"; any other `OSError`, from `stat()` or from git's `cwd=`, is the system's own reason (`strerror`). It is not `exists()`/`is_dir()`, which before 3.14 swallow only a missing path. A source `stat()` can read but `cwd=` cannot enter, a directory with no search bit, fails in `tree_digest` and the same guard answers it. - `declared_pin_values` resolves the path through a guarded `_resolved_pin_source`. `Path.resolve()` raises a `RuntimeError` on a symlink loop before 3.13 (an `OSError` since), before the digest was asked for. As typed, `stat()` meets the loop and says so. - A source that answers is read exactly as before: a relative path resolves against the working directory, a symlink to a clone is followed, `digest_source` reads `local-clone (<path as typed>)`, and the digest is `tree_digest`'s. `tests/test_pin_source_unreadable.py` (46 tests in the #339 commit; fix round 1 adds 17 for S1 and moves one, below) runs each case through `scaffold-project.py --dry-run`, its real run and `adopt-project.py plan`: missing, a file, beneath a file, relative and missing, a parent and a source with no search bit (skipped on Windows and as root, by a mark, so before any fixture builds a directory), a 300-character name, a symlink loop (skipped on Windows) and a directory that is no clone. Each asserts exit 2, the refusal naming the path and the reason, its remediation, no traceback and nothing created. It also holds `--dry-run` and the real run to the same stdout and stderr, checks the path is printed escaped under an ASCII stderr and as a surrogate when it is not UTF-8, and checks that a relative source and a symlink to a clone read as before. The session `gh` guard fails any test whose run called `gh`. origin/main ab623dd reached this branch through implQ's branch: 34dbd86 is a30091f merged with ab623dd. One file conflicted there, `templates/assembly-root/scripts/validate-pins.py`, in seven hunks, because #312 (8cdca5e) replaced `keyed_sources` and `default_source` with `PinSources` and #275 added `env_shared` and `shared`. #312's blob is the same at its PR head, at the squash and at ab623dd, so it landed the file implQ resolved against. The resolution keeps #312's side in all seven and adds #275's on top: | # | hunk | resolution | |---|---|---| | 1 | `resolve_neutral_pin_source` signature | #312's `sources: PinSources` and 3-tuple return, plus #275's `env_shared: bool = False` | | 2 | its docstring tail | #312's `Returns (path, how, typed)` text, plus #275's "Rule 2 is skipped when `env_shared`" paragraph | | 3 | `_recompute_neutral_pin_digest` signature | #312's `sources`, plus #275's `shared: frozenset[str]` after `report` | | 4 | the `resolve_neutral_pin_source(...)` call inside it | #312's 3-tuple unpack, plus `env_shared = product.casefold() in shared` and the extra argument | | 5 | `_check_one_neutral_product_pin` signature | #312's `sources`, plus #275's `shared` | | 6 | its call of `_recompute_neutral_pin_digest` | `sources, report, shared` | | 7 | `_check_neutral_product_pins` docstring and body | #312's `PinSources(...)` and `_note_unused_pin_sources`, plus #275's paragraph, `_report_pin_source_collisions(products, report)` and `shared = frozenset(pin_source_env_shared(products))` | This branch's own merge of 34dbd86 (5690235) had no conflict, and neither had its merge of #409's fix round, 6494714 (583f647). That fix round made `neutral-pin-source-collides` a note and keyed "one product" by `repo_shape.pin_product_key`. At 421e4e5, `templates/assembly-root/scripts/validate-pins.py`, `scripts/repo_shape.py` and `tests/test_pin_source_env_collisions.py` were byte-identical to the tree `git merge-tree` gives for 6494714 with origin/main 3ef059c (blobs 5604007, 091966b, 5220787), so this branch added nothing to those three files beyond #409. The 34dbd86 merge brought in #335, #312, #317, #270 (f795cf7), #344 and #349 with no conflict. Earlier merges of origin/main (87373a6, for #309's reworded constant, and e43fa95) are unchanged. Fix round 1 merged origin/main three more times: - **cd1fc79 (2bcfa69).** It brought #245, #351, #350, #345, #372, #371, #354, #380, #377 and the rest since ab623dd, with no conflict. - **45e01f4 (4098b61).** It brought #396's `tests/test_agents_md_codes.py`. That test finds `scaffold-pin-collides` as a string constant of `scripts/shape_materialize.py`, which `SHIPPED` lists. - **3ef059c (421e4e5), #314.** One conflict, one hunk in `adopt-project.py`. This branch's `_refuse_an_unrecordable_pin_source` and #314's section "The project must be able to hold what `execute` writes into it (#261)" were added at the same place; both are kept. Where the two meet, lane 5's earlier recipe applies: - `_flag_plan` builds each pin as the `PIN_FIELDS` mapping `plan` writes, not `list(pins)` of products. So the plan `plan` asks the validator about is the plan it writes. - #314's `test_plan_asks_what_check_asks_of_the_same_keys` plans `--pin openGlass@<commit> --pin-source <stand-in>` where it planned the name alone, which `plan` now refuses. Then f9ed46f, after #409 squash-landed, and 73d65c6 after it (top of this description). On the merged tree exactly one test failed: `tests/test_adopt_template_values.py::test_check_finds_and_execute_refuses_a_hand_edited_value[pins-surrogate]`. It plans, then hand-edits the plan to `pins: ["openX\ud800"]`, a name-only pin with a lone surrogate. Before this branch the refusal's headline was `REFUSED plan-unwritable-value`. A name-only pin in a plan is now `plan-pin-unrecorded` (#273), so `check` has a second, independent finding for that very plan, and the headline is the first finding's: ``` REFUSED plan-pin-unrecorded: 2 finding(s) ... FINDING plan-pin-unrecorded: `pins:` entry 1, 'openX\ud800', is a name with no commit and no digest ... FINDING plan-unwritable-value: a `pins:` item is 'openX\ud800', which `execute` writes into the assembly root's `project.yaml`, and it holds a lone surrogate ... ``` Nothing about #270's contract changed. The lone surrogate is still found as `plan-unwritable-value`, listed under the refusal, and `execute` still refuses before any leg exists. `check` builds `_leg_findings`, where `_pin_findings` sits, before it calls `_value_findings`, so the pin finding comes first. d806e8f changes one assertion for that row, `pins` only: the headline is `REFUSED plan-pin-unrecorded: ` where it was `PLAN_REFUSED`. The other 15 rows and the finding assertions, including the `plan-unwritable-value` line, are untouched. Lane 5's review of 7a94b6b found 3 should-fix and 5 nits. Each is answered here: - **#409's `pin_product_key` (review N1).** The merge of #409's fix round could not carry it, because this branch had moved the function that used it out of `scaffold-project.py`. `pin_variable_collisions` now keys each pin by that function, where it casefolded. `openß` and `openss` are two pin files and one `SHAPE_PIN_SOURCE_OPENSS`, and a casefold named each of the two pins twice. No `--pin` or recorded `pins:` entry `PIN_ARG_RE` admits can spell either, so the test asks the function directly. `refuse_colliding_pins`' docstring now says, in #409's words, that the root's `validate-pins.py` only notes such a pair. - **S1, a `--pin-source` path that is not printable.** `pin_digest_from_source` names the path as typed unless it is not printable (`str.isprintable`), and then as Python's `repr` spells it (`shown_source`). That covers the refusal's head and git's own reason, which names the directory it ran in. Printed raw, an ESC reached the terminal, and a line break or a carriage return began a line of the path's choosing, a forged `REFUSED` line among them, from the scaffold and from adopt. The traceback #339 replaced had shown a `repr`. A printable path is named byte for byte as before. - **S2, no `gh` on PATH.** `pin_digest_from_gh` refuses as `gh-not-found`, exit 2, as `repo_shape.tree_digest_from_gh` names it, and offers `--pin-source`. It was a `FileNotFoundError` traceback, exit 1, from the scaffold and, new with this branch, from `adopt-project.py plan --pin`. - **S3, a hand-edited `commit:` or `tree_sha256:`.** The lane's decision is to accept it and document it (option (c)); no behaviour changed. A pair that disagrees passes `check` and `execute` (`adoption verified`), because neither reads a network for a pin, by design. The adopted root's own `validate-pins.py` then exits 1 with `neutral-pin-digest-mismatch` wherever it can read the product. `check` now says so once, after the pins it will write: "each pin as `plan` read it, not read again here: the root's own `validate-pins.py` recomputes its digest wherever it can read the product". Options (a), `execute` recomputes before it creates the legs, and (b), `check` recomputes from a clone still on the machine, are filed as #449. - **N2, a `--pin-source` that `plan` cannot record.** `plan` asks `check`'s question (`one_printable_line`) of the path it records in each pin's `digest_source:`, before any digest is read. It refuses one that fails as `adopt-unwritable-value`, in #270's words (`unwritable_reason`), or as "an invisible formatting character" where those name nothing. Before, it was planned, exit 0, and printed raw in the report. `check` then refused it as `plan-pin-malformed` and said to re-run the same `plan`. The report's `pin` line and `check`'s `write` line now spell the digest's source with `_shown`. The scaffold half is pre-existing (a line break in the path is written into the pin file; a byte that is not UTF-8 dies after all three repositories exist) and is filed as #450. - **N3, six hunks no test guarded.** Each now has a test that fails when it alone is reverted: - the two name guards (a `pins:` name holding an ESC and a forged line); - the lower-casing of the commit and the digest (an upper-cased hand edit); - the `digest_source` printability check; - the not-text check (`commit: 1234567` unquoted); - the gitlink filter (a submodule kept where the pin is written is `plan-submodule-root` alone). - **N4.** This body. - **N5, #339's third decision.** A `--pin-source` that nothing reads is still silent, now in adopt too. This PR does not decide it. #451, filed, lays out refuse, note and leave, so closing #339 loses nothing. Lane 5's second review, of 421e4e5, found no blocking item, 2 should-fix items and 3 nits. The two should-fix items are this body: the landing after #409 (above) and #386 (above). The code needed no change for them. f63d1ed adds two tests and no code: - **n1. `plan` asks nothing of a `--pin-source` no `--pin` records.** With the `args.pin and` guard dropped, such a path holding an ESC or a zero-width joiner was refused in a sentence naming no file ("`execute` writes into , and ..."), and every test still passed. `test_a_pin_source_no_pin_records_is_not_asked_about` holds the plan to exit 0 and `pins: []`, with the path named nowhere in the plan or the report. The ESC row is POSIX-only by the file's `POSIX_NAMES` mark; the zero-width joiner row runs everywhere. It holds #451's answer today, silence, so a decision there changes this test on purpose. - **n2. A printable `--pin-source` is printed as it is.** With `_spelled` in place of `_shown` in `plan`'s `pin` line, every test still passed. `test_a_printable_pin_source_is_printed_as_it_is` holds `plan`'s `pin` line, and `check`'s `write` line for the plan `plan` wrote, to their exact text, ending `(local-clone (<path>))` with no backtick. - **n3** needs a code change and is left out (below). **Fix round 2, on f63d1ed.** Each run had a `gh` stub first on PATH (it logs and exits 97), `GH_TOKEN` bogus, an empty `GH_CONFIG_DIR`, `git-filter-repo` 2.47.0 next on PATH, and the identity blanked with `GIT_CONFIG_COUNT`; the session `gh` guard came first inside each run. - **The pin set: 812 passed, 2 skipped.** It covers adopt pins, adopt plan, #339's file, #275's tests, the pin and neutral-pin validators, git output decoding, adopt template values, CLI reference, scaffold pin and reuse, scaffold pin collisions, #314's two files and #396's file. The skips are `test_adopt_plan.py:403` (no MedxEHR clone) and `test_adopt_template_values.py:223` (this host reads `git config user.name` from the repository, not from `GIT_CONFIG_GLOBAL`). That is fix round 1's 809 passed, plus the three new rows. - **Shape doctor and scaffold leg-path collisions: 369 passed, 3 skipped** (the PowerShell line exists only on a Windows host). - **Mutation probes**, each one line changed in a throwaway worktree, over `tests/test_adopt_pins.py` and `tests/test_pin_source_unreadable.py` less the five end-to-end adoptions: - the `args.pin and` guard dropped: 2 failed, both n1 rows; - `plan`'s `pin` line `_spelled`: 1 failed, the n2 test; - `check`'s `write` line `_spelled`: 2 failed, the n2 test and `test_an_upper_cased_hand_edit_is_written_lower_cased`; - `plan`'s `pin` line raw: 1 failed, the no-break-space test that already guarded that hunk. **On the merged tree, 73d65c6** (the merge f9ed46f and the `_read_pins` commit), with the same harness: - **The pin set** above, with #445's `test_adopt_late_failure.py`, `test_adopt_git_reads.py` and `test_adopt_filter_repo_failure.py` and #387's `test_adopt_empty_symlinks.py` and `test_adopt_root_manifest.py`: **988 passed, 2 skipped**. The skips are the two above. - **Shape doctor, scaffold leg-path collisions and the adopt suites:** **967 passed, 3 skipped** (the PowerShell line). The adopt suites are e2e, execute refusals, verify, root shape paths (#387's too), leg-path collisions, clone template, ignored shape files and submodules. - **On the merge alone, f9ed46f** (the same tree as before the `_read_pins` commit): `tests/test_adopt_late_failure.py` gave 3 failed, 83 passed, the three `AttributeError` rows above. - `render-cli-reference.py --check` is ok on the merged tree. pyflakes reports the same four warnings on `adopt-project.py`, `scaffold-project.py` and `scripts/shape_materialize.py` as before the merge. **Fix round 1, on 421e4e5.** Each run had `git-filter-repo` 2.47.0 on PATH and the identity blanked with `GIT_CONFIG_COUNT`. A `gh` stub that logs and exits 97 was first on PATH, with `GH_TOKEN` bogus and an empty `GH_CONFIG_DIR`, and the session `gh` guard came first inside each run. - **The pin set:** 809 passed, 2 skipped (the same files and skips as above). - **Doctor and scaffold:** 782 passed, 3 skipped (the PowerShell line exists only on a Windows host). It covers shape doctor, scaffold leg-path collisions, scaffold e2e, referent chain links, naming policy, repo hygiene and #351's free-text values. - **The adopt suites:** 882 passed. It covers e2e, execute refusals, verify, spec-only, leg paths, root shape paths, plan escapes, leg-path collisions, clone template and submodules. - **Before the #314 merge,** on 74ce4d9's tree: the first two sets gave 577 passed, 2 skipped and 782 passed, 3 skipped. On 2bcfa69's tree (the merges alone, before the fix) they gave 542 passed, 2 skipped and 782 passed, 3 skipped. After the 45e01f4 merge, `tests/test_agents_md_codes.py`, repo hygiene and CLI reference: 110 passed. - **Lane 5's second review** also ran 421e4e5 merged with main cb7063f and with 53bee5b: the pin set, the manifest-value set, and the doctor set with #357's `tests/test_doctor_validator_rows.py`. All passed, with only the skips above. Proof that fix round 1's tests test something: - **On 2bcfa69's tree,** with this head's two test files laid over it, 31 of the new rows fail: - S1: 17; - N2 and its report spelling: 7; - S2: 3; - the `pin_product_key` port: 2; - `check`'s S3 line: 1; - the not-UTF-8 `adopt plan` row: 1. The N3 rows pass there, as they must: they guard hunks this branch already had. - **Mutation probes.** Each hunk was reverted alone, in a throwaway worktree, and both test files were run: 18 of 18 were caught. - **The port:** the casefold keying (2 fail); the casefold lookup alone (2). - **S1:** the path named raw (13); git's reason named raw (2); every path `repr`'d, printable or not (27). - **S2:** no `except` (3). - **N2:** no `plan` check (11); only #270's question asked (1); the formatting-character reason said otherwise (1); the report's `pin` line raw (1); `check`'s `write` line raw (1). - **S3:** the line dropped (1). - **N3:** the `_pin_fix` name guard (1); the `_read_pins` path guard (1); the lower-casing (1); the `digest_source` check (1); the not-text check (1); the gitlink filter (1). - **The issue rows reproduced.** S1, S2 and N2 were reproduced on 2bcfa69's tree and shown gone on the fix (a probe driving both tools; `gh` was called 0 times). **Before fix round 1.** Runs were on 7a94b6b, with `git-filter-repo` 2.47.0 first on PATH and the repository-local `user.name` blanked with `GIT_CONFIG_COUNT` (a workstation whose standard checkout sets one fails `test_the_scaffold_refuses_with_no_elector` on main itself; CI sets none). 7a94b6b differs from ffd1297 in `tests/test_pin_source_unreadable.py` only, so the three suites that do not read that file ran on ffd1297: - the new file: 46 passed; - adopt pins, adopt plan, git output decoding: 172 passed, 1 skipped (the MedxEHR clone is absent); - scaffold pin and reuse, pin collisions, e2e, referent chain links, neutral pin and pin validators, #275's tests, naming policy, repo hygiene, CLI reference, scaffold leg-path collisions: 571 passed; - shape doctor: 254 passed, 3 skipped (the PowerShell line exists only on a Windows host); - the new file with repo hygiene, git output decoding and CLI reference, once more after the last edit: 176 passed. Earlier on 5690235 and d806e8f, before the #339 commit: the adopt suites (e2e, execute refusals, verify, spec-only, leg paths, root shape paths, plan escapes, leg-path collisions, clone template) 740 passed, and `tests/test_adopt_template_values.py` with #273's other adopt tests 489 passed, 2 skipped. They were not re-run on 7a94b6b: the #339 diff touches `pin_digest_from_source` and the call in `declared_pin_values`, which those suites reach through `test_adopt_pins.py` only. Nothing was run on macOS or Windows. Proof the new tests test something: - **On d806e8f.** 38 of the 46 fail, each on the traceback and its exit 1. The 8 that pass are the unchanged behaviour: the not-a-clone refusal (4 rows) and the valid-source rows (4). - **Mutation probes.** Ten hunks reverted one at a time, each failing at least one new test: the `OSError` catch (16 fail), the catch narrowed to `OSError` only (21), the missing-path clause (9), the clause narrowed to `FileNotFoundError` (3), the `S_ISDIR` judgement (3), the loop guard (4), no resolve at all (3), the old `.resolve()` call (4), the reason as `str(exc)` (12), and the file sentence as the OS's (3). - #273's own 52 tests still fail on c7c02fa (51 fail or error; the one that passes checks the test's own table), and its 18 mutation probes were each caught. **Re-verified after the merge.** An independent re-verification of f9ed46f and 73d65c6 found the code correct: - #409 is carried whole. A 30,000-case fuzz of `--pin` lists through #409's final refusal and this branch's port differed in 0 cases. - `scaffold-project.py` equals the tested file plus main's own changes that are not #409's (same patch-id). - `_commit_the_split` keeps #445's `try` and #394's `append`. - `_read_pins` reads a loaded plan as before. Its findings were all in this description (the #506 bullet and three stale facts), now fixed. Runs on the head and on its merge with main 48585e6: 988 passed, 2 skipped; and 967 passed, 3 skipped. `git merge-tree --write-tree` was run at 01:48Z on 2026-10-13, comparing hunks per file. Each PR head, fetched from `refs/pull/<n>/head` with no `gh`, was merged with 73d65c6 and with origin/main 9736424 alone. Two sets were asked about: - every PR this description listed before that main does not now contain; - every PR numbered above #468 whose head main does not contain: #473, #474, #490, #491, #493, #494, #495, #496, #497, #503, #504 and #505. **Open state, read with `gh` by the coordinator at 02:00Z and refreshed at 02:25Z after a re-verification on main 48585e6.** Every pull request named below is open. #184, #94, #96, #98, #100 and #161 are closed, and #465 landed as 48585e6. `fix/adopt-plan-quote-yaml-keywords` has no pull request. #506 (`fix/scaffold-reuse-seeded-legs`) opened after this list was made, and the re-verification reads it. - **Landed since the last draft of this list:** #343, #346, #355, #358, #373, #378, #382, #387, #394, #397, #401, #404, #409, #419, #452, #456, #465, #466 and #484. #394's `_commit_the_split` conflict and #401's `docs/cli.md` conflict are both resolved in f9ed46f, above. - **Clean, 20:** #266, #347, #356, #374, #376, #384, #395, #453, #467, #468, #473, #474, #490, #491, #493, #494, #495, #497, #503 and #505. #453, #468 and #491 were updated onto main since the first read and now merge clean. #507 (lane 5's #486-#488) shares only the generated `docs/cli.md` with this branch and merges clean with it. - **Conflicting with main alone, and this branch adds no hunk:** - #402: `shape-doctor.py` 5; - #496: `shape-doctor.py` 10 and `tests/test_shape_doctor.py` 1. **Conflicts this branch adds:** - **#435** (3efcc7a, lane 2's `fix/adopt-plan-field-types`, for #386). - It adds 2 hunks in `adopt-project.py`: 5 here, against 3 with main alone. They are `render_plan`'s `pins:` line and `Plan.pins`. - Keep this branch's `_pin_lines` and `_pin_products`. The rest is under "Where the meaning meets". - **#504** (37ef29a, `fix/adopt-root-kept-symlinks`). - It adds 1 hunk in `adopt-project.py`: 2 here, against 1 with main alone. It is the materializer call in `_commit_the_split`. - Keep both arguments and both comments: `append=append, neutral_pins=_recorded_pins(plan), spell=_spelled`. - **#506** (119d8c4, `fix/scaffold-reuse-seeded-legs`). - It adds 1 hunk in `scaffold-project.py`. With main alone, #506 conflicts only in `docs/handbook.html`. - #506 inserts `LEG_TEMPLATES` right after `declared_pin_products`, which this branch moved out, and rewrites `_reusable_remotes` further down. Keeping both sides breaks the file with an unterminated string literal. - Keep only #506's `LEG_TEMPLATES` block. Drop #506's `declared_pin_values`/`declared_pin_products`, which moved here, and this branch's three-line `_reusable_remotes` opener, which #506 rewrites below. Resolved that way, pyflakes is clean and #506's scaffold tests pass (88). - **`fix/adopt-plan-quote-yaml-keywords`** (ed9968f; a branch with no pull request). - It adds 2 hunks in `adopt-project.py`: 3 here, against 1 with main alone. - One is `render_plan`'s `pins:` line. Keep `_pin_lines`, which already sends product, repository and `digest_source` through `y`. - The other is `_refuse_unholdable_values`' signature. Keep `pins: dict`, with that branch's `_validator_judged` and `_named_as_read` above it. - `fix/adopt-late-failure-notice` is no longer on origin. #445, the late-failure notice, is on main and merged here. **Where the meaning meets:** - **#435 and #386.** The coordinator has said this on #435: #435 (comment) - #435's `_plan_key_findings` (`plan-bad-pins`) keeps only text items in `pins:`, and its `PINS_REMEDIATION` tells a person to write `pins: [openGlass]`. - This branch writes each pin as a mapping, and it makes a name alone `plan-pin-unrecorded`. - Read from #435's code, not run: on a tree with both, the plan `plan --pin` writes is `plan-bad-pins` in `check`. - Whichever lands second reconciles them, with three changes: - `_plan_key_findings` takes this branch's mappings, or leaves `pins:` items to `_read_pins`; - a `pins:` that is not a list gives one finding, not both `plan-bad-pins` and `plan-pin-malformed`; - `PINS_REMEDIATION` says the mapping `plan` writes. - Until that is done, `tests/test_adopt_pins.py::test_a_plan_with_a_whole_pin_checks_ok` fails. - **#314.** It landed, and it is merged here (above). - **`fix/adopt-plan-quote-yaml-keywords`.** Its pin tests are written against the name-only `--pin`. They need the `name@commit` form, and their expected `pins: [...]` line becomes `_pin_lines`'s mapping. - **Two unwritable values are refused in two runs (lane 5's second review, n3).** `plan --elected-by 'A<LF>B' --pin openGlass@<sha> --pin-source <a path holding an ESC>` refuses the elector alone, exit 2. Re-run with the elector retyped, it refuses the source; #270's refusal names every unwritable value at once. Reproduced on 421e4e5, with `gh` called 0 times. One refusal would need a code change, not made here: - `_refuse_an_unrecordable_pin_source` would split into a function that returns the sentence; - `_checked_plan_inputs` would ask it before #270's `unwritable_values` raise, and raise one `adopt-unwritable-value` that names both, with both remediations; - a test would add the two-value row. N2's question is `one_printable_line`, not `unwritable_reason`, so it cannot simply join #270's list. - **Docs.** The README, AGENTS.md and `docs/handbook.html` are unchanged, because none of them calls adopt's `--pin` a name. A sentence saying adopt now takes the scaffold's `--pin` is a follow-up. It costs an AGENTS.md line-cap raise, and a README edit forces the handbook's README blob to change. - **A product spelled `null`, `true` or `false`.** The scaffold already accepts `--pin null@<sha>`: it exits 0 and builds a root whose `validate-pins.py` exits 1 `neutral-pin-entry-malformed`. Adopt's `plan` writes `product: null` through `y`, and `check` then finds `plan-pin-malformed` and refuses it before any leg exists. The one fix for both tools is in `parse_pin`, and it would change the scaffold's behaviour. - **Wording shared with the scaffold.** `digest_source` is written bare into the pin file, so a `--pin-source` path holding ` #` is cut short there. `templates/assembly-root/contracts/neutral-product-pin.yaml` and `validate-pins.py`'s `neutral-pin-missing` remediation name only the scaffold as the writer. Two comments in `scripts/repo_shape.py` still name the scaffold's `pin_digest_from_gh`, in a digest-pinned shipped copy. - **Filed as follow-ups:** - #449: S3, a hand-edited `commit:` or `tree_sha256:` that disagrees, with options (a) and (b); - #450: the scaffold half of N2, a `--pin-source` path no file can hold; - #451: #339's third decision (N5), a `--pin-source` that nothing reads. - **`validate-pins.py` prints a `--pin-source` path raw** in `neutral-pin-source-unreadable`, the twin of S1. It is a shipped template that #409 and other open PRs edit, so it is left for its own change. No issue is filed for it yet. - **Windows and macOS** were not run here; CI ran both (below). Two assertions that depend on what Windows answers for a path (a name past the filesystem's limit, a path beneath a file) check only the refusal and its remediation there. Fix round 1's rows that need a control character or a byte that is not UTF-8 in a path, or a symlink to `git`, are skipped on Windows by a mark, and so is fix round 2's ESC row. The rows for a no-break space and a zero-width joiner run everywhere, and so does the in-process `gh-not-found` test. Reviewed independently by lane 5 at 7a94b6b (3 should-fix, 5 nits: fix round 1) and at 421e4e5 (0 blockers, 2 should-fix, 3 nits: fix round 2). After #409's squash, the re-verification of f9ed46f and 73d65c6 found the code correct; its 1 should-fix and 3 nits were in this description and are fixed. GitHub's update-branch then merged main twice (33bae3f, 2170526), with no hand edit. CI's tests, tests-macos and tests-windows and SonarCloud all passed at 2170526 (main cac6bb2 merged in). On that head merged with main 57c85e9 (#490, #474 and #468, none of which touches this branch's files), the pin and adopt set with `tests/test_update_shape_landing.py` gave 1112 passed, 2 skipped, and the doctor, adopt end-to-end, unfinished-merge and bootstrap set gave 1056 passed, 3 skipped (the doctor's PowerShell line, which exists only on a Windows host). Closes #273 Closes #339 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 13, 2026
… text placeholders, so `--id 007`, `--tracking-branch 2026`, `--spec-path true` or `--org null` read back as typed, and `family.py add` quotes a member id alike (#259) (#395) Brett Heap ruled on 2026-10-12: "quote #259". The templates now write each text field a tool fills from a value it was given between double quotes: | template | fields | |---|---| | `templates/assembly-root/project.yaml` | `id`, `elected_on`, `visibility`, `tracking_branch`, the spec leg's `path`, the code leg's `path` | | `templates/assembly-root/contracts/spec-pin.yaml`, `code-pin.yaml` | `submodule_path` | | `templates/family-root/family.yaml` | `id`, `org`, `created_on`, `visibility`, `tracking_branch` | `render` already spells a value between a YAML template's double quotes with `repo_shape.double_quoted` (#284). The single-pass `render` from #316, on main as 34ecbc2, does the same through `YAML_PLACEHOLDER_RE`. So each value reads back exactly. An ordinary value renders as it did before, plus the two quote characters. `family.yaml`'s `org:` is quoted along with the four fields #259 names. It is the same defect in the same file: `family.py init --org 2026` and `--org null` pass `checked_value`, and on c7c02fa the holder then fails `family-org` (#307 lists the `--org null` row). Taking `org:` back out is not a one-line revert. It fails 14 of the new tests (the 8 `family.yaml:org` in-memory cases, and all 6 `family.py init` rows, because every row of `FAMILIES` passes a misread `--org`), and it would also take the `ORG` row out of `TEXT_FIELDS` and put plain `--org` values into `FAMILIES`. The lane keeps `org:` quoted, as the same defect in the same file, unless Brett says otherwise. `scripts/family.py`: `_member_lines` writes each member's own `project.yaml` id into the holder's `members:` block. That id now reads back exactly, so a bare `007` in the row came back as 7, and `validate-family.py` would report `member-id-mismatch` for a member it had just pinned. `_member_id` quotes an id only when the reader would not read the bare text back as the same text. No row whose id reads back as text moves: `irrs` is still `id: irrs`. Two edges: - A legacy row whose bare id the reader misreads moves once. A holder written before this change, by `family.py add` of a member scaffolded with `--id 2026`, holds `id: 2026`. The next `bump`, `add` or `remove` of that holder rewrites it as `id: "2026"`. That is harmless: `validate-family.py` compares with `str()` and passes before and after. - Mixed versions. A `family.py` from before this change, run against a holder this branch wrote, turns `id: "007"` back into `id: 007`, and `validate-family.py` then fails `member-id-mismatch` (the member declares `007`, `family.yaml` records `7`). A current `family.py` that rewrites the holder next then writes that row as `id: "7"`. Nothing in this branch can prevent it: run `family.py` from a current checkout on a holder that has such a member. Left unquoted on purpose: `topic` (`xf-project-<id>`), every `repository` (`<org>/<Name>`; the slash keeps it text), `SHAPE_REPOSITORY` and `DIGEST_DEFINITION` (constants), and the block or list placeholders (`NEUTRAL_PRODUCT_PINS`, `*_NAMING`, `SHAPE_FILES`). **Why.** Every reader of these files uses `repo_shape`'s YAML subset. It reads a bare `007` as 7, `2026` and `20261011` as numbers, `1.5` as a float, `true` as True and `null` as None. The checks on the flags (`PROJECT_ID_RE`, `checked_value`, the leg-path rule) accept every one of these. Reproduced on c7c02fa, with local bare remotes only: - `scaffold-project.py --id 2026|007|true|null|20261011` exits 0, and the project's own `validate-manifest.py` then fails `manifest-id`. - `--spec-path 2026 --code-path 007` fails `manifest-leg-path`, and `validate-pins.py` exits 2. - `--tracking-branch 007` pushes each leg on `007`, and the root's `bootstrap.py` then puts the legs on a local `7` with `fatal: no upstream configured`. `true` and `null` do the same on `True` and `main`. - `adopt-project.py execute` with `--tracking-branch 007` does the same; `--id 007|20261011` gives `manifest-id`; leg paths `2026`/`007` give `manifest-leg-path`. - `family.py init --id 2026|007|true|null|20261011` gives `family-id`; `--org 2026|null` gives `family-org`; `--tracking-branch 007|true|null` reads back as 7/True/None. On this branch every one of those rows reads back as typed, bootstraps onto the typed branch with `origin/<branch>` as upstream, and passes the root's own validators. **Every reader checked.** Every reader reads these fields through `load_yaml`/`parse_yaml` into a dict. None uses a line regex, `split(":")`, `startswith("<field>: ")` or a whole-line rewrite of them: - `templates/assembly-root/scripts/bootstrap.py`: `tracking_branch`, leg `path`. - `validate-manifest.py`: `id`, `elected_on`, `visibility`, leg `path`. - `validate-pins.py`: `submodule_path` against the manifest's `path`. The pin side is read as it stands and the manifest side goes through `str()`, so the two differ in type exactly when a bare value is misread (that is the `pin-path-mismatch` row above). With both lines quoted they are the same text. - `validate-repository-naming.py`: `str(id)` for the topic. - `templates/family-root/scripts/validate-family.py`: `id`, `org`, `created_on`, `visibility`, `str()` member-id compare. - `siblings.py`, family `bootstrap.py`. - `scripts/bump-leg.py`: `tracking`, leg `path`. Its `rewrite_pin` rewrites only `commit:` and `tree_sha256:`. - `update-shape.py`: `tracking_branch_of`. `rewrite_manifest` touches only the `shape:` block. - `scripts/family.py`: `tracking()`, the member's id, and the `members:` rewrite. The member-id writer is the one fixed here. - `shape-doctor.py`: leg `path`, member row `path`, working-clone `str(id)` compare. - `adopt-project.py`: plan reads and `_template_values`. - `setup-project.py`: `family.yaml` `name`/`kind` only. - `scripts/shape_advisory.py`: the single-repository record only. The `str()` fallbacks (`bootstrap.py`, `adopt-project.py`'s `checked_value`) stay, because projects made before this keep their bare lines. **Pins.** The four files are TEMPLATED, not COPIED, so no row of any project's `contracts/shape-pin.yaml` names them. `Atlas` was scaffolded and `family.py init Contoso` was run on c7c02fa and on this branch. Each `contracts/shape-pin.yaml` differs only in `commit:` and `digests.tree_sha256`, which identify the standard itself and change with every commit; every per-file `sha256` row is identical. `update-shape.py check` of the c7c02fa project and holder against this branch reports every copied file `unchanged` (11 and 10 rows): "no copied file differs; `apply` would move the pin alone". **Tests.** - New: `tests/test_template_text_placeholders.py`, 123 tests: - Each of the 13 fields is rendered with each of 8 values the reader misreads (`2026 007 1.5 true null 20261011 ~ False`), and must read back exactly. - 6 `scaffold-project.py` runs, then a recursive clone, `bootstrap.py`, the three validators, and `bump-leg.py`, which refuses on the tracking branch and finds the leg at its path on a branch of its own. - 6 `adopt-project.py` `plan`/`check`/`execute` runs into local bare remotes, then a clone, `bootstrap.py` and the validators. - 6 `family.py init` runs. - One `family.py add` of members whose ids are `007` and `true`. - **All 123 fail on c7c02fa.** - `true`/`null` through adopt: `plan` writes them bare into the plan, and the plan's reader then misreads them. That belongs to the plan writer, #181 (lane 1). Those two rows quote the value in the plan by hand, as #181's writer will, and test `check`/`execute`. - Mutation probes: reverting any one of the 13 quoted lines fails 8 cases of its field. Reverting `_member_id` fails the member test (the rows read 7/True). - The `try/except YamlError` in `_member_id` is guarded by the follow-up commit. The review found that calling the parse directly left the member test passing. Ids such as `[`, `{`, `&a`, `*a` and `!t` reach the `except` (they raise `YamlError` bare), and `_member_id` returns each one exactly, as it does 34 adversarial inputs in all (the review's in-process probe). `test_a_member_id_the_reader_refuses_bare_is_rewritten_between_quotes` (7 cases: `[`, `{`, `&a`, `*a`, `!t`, an unclosed `'` and an unclosed `"`) opens a hand-edited holder whose row holds the id between double quotes, rewrites the `members:` block with `Family.rewritten`, and asks that the id read back exactly and the text come out byte for byte. With the `try/except` removed all 7 fail with the reader's `YamlError`, and with the `except` returning the bare text all 7 fail too; the old member test still passes under the first of those mutants. - 14 existing tests that asserted or edited a bare rendered line now spell it quoted: `test_manifest_validator` ×5, `test_pin_validator`, `test_reference_default`, `test_scaffold_e2e` ×2, `test_setup_project_py`, `test_setup_sh`, `test_family`, `test_shape_doctor` ×2. - Targeted runs on this branch: | files | result | |---|---| | new file + `test_template_quoted_values`, `test_scaffold_e2e`, `test_scaffold_pin_and_reuse`, `test_scaffold_leg_paths`, `test_scaffold_leg_path_collisions`, `test_reuse_visibility`, `test_reference_default` | 405 passed | | the six adopt files | 491 passed, 1 skipped (the MedxEHR clone is not set) | | `test_family`, `test_family_add_refusals`, `test_family_member_path`, `test_manifest_validator`, `test_pin_validator`, `test_bump_leg`, `test_update_shape`, `test_update_shape_pr_base`, `test_setup_project_py`, `test_park_resume_targets`, `test_repo_hygiene`, `test_cli_reference`, `test_setup_sh` | 603 passed | | `test_shape_doctor` | 241 passed, 3 skipped (Windows-only), 1 failed; that one test was fixed, and with its sibling it reran at 2 passed | **The review.** An independent opus review at 233dc71 (the branch's first commit) found no code defect. Its verdict was CHANGES NEEDED (0 blockers, 2 should-fixes, 6 nits) because it asked for this description and its composition counts to be corrected, and they are. Its evidence: - **Readers and rewriters.** Every reader in the shipped tree reads the 13 lines through `load_yaml`/`parse_yaml`, and no line regex or whole-line rewrite touches them. It read `bump-leg.py` `rewrite_pin`, `update-shape.py` `rewrite_shape_pin` and `rewrite_manifest`, `family.py` `rewritten`, the three validators, `siblings.py`, both `bootstrap.py`, the doctor, `setup-project.py`, the workflows, the Makefile and `setup.sh`. No test among main's 17 commits since c7c02fa (through #245's 161c6c9) edits one of these lines bare. - **`_member_id`, the one rewriter changed.** A mutant that writes every id bare fails the member test (the rows read back as `{'IRRS': 7, 'IRSS': True}`). A mutant that quotes every id fails `b" id: irqs" in lines`. So the minimal-churn choice is tested both ways. - **Old projects and holders.** Against a control commit (c7c02fa plus an unrelated README edit), a project and a holder made on c7c02fa give identical `update-shape.py check` and `shape-doctor.py` output, up to the shas. `check --at 233dc71` reports all 11 project files and all 10 holder files `unchanged` and says `no copied file differs`. The doctor's verdict is `COMPLIANT, SHAPE BEHIND (... no copied file differs)` for the control and for 233dc71. This branch's `family.py add` and `bump` on a c7c02fa holder leave the old `atlas` row and the header byte for byte, apart from the legacy-id edge described at the top. - **Tests.** All 123 new tests fail on c7c02fa (`123 failed`) and pass on 233dc71 (`123 passed`). The 14 changed existing tests pass (49 passed). - **Not covered.** Windows and macOS were reviewed by reading and not run: the plan edit and the member-row check are in bytes, and nothing writes to git's stdin in text mode. Of `test_shape_doctor.py` and `test_family.py` the review ran only the changed tests. **Follow-up commit.** A second commit, `3894aa8`, answers two nits from the review, and changes no behaviour. The `_member_id` docstring said "no existing holder's `members:` block moves by a byte", which was false: the next `bump`, `add` or `remove` of a holder written before this change rewrites a legacy `id: 2026` row as `id: "2026"`, harmlessly, because `validate-family.py` compares with `str()`. The docstring now says exactly that, and a grep of every comment and docstring the branch added for "by a byte" and "moves" found one more copy, in the member test's docstring, corrected the same way. The `try/except YamlError` in `_member_id` is guarded by a new test (see Tests), so the new file holds 130 tests. Every count above that says 123 (123 new tests, all failing on c7c02fa and passing on 233dc71) is for the first commit; the follow-up commit adds the 7. The `except` also carries a comment saying which ids reach it. **Composition at the landing head (4984651).** `49846518` is GitHub's update-branch merge of origin/main `cc8f2da4` (#376, a `--trailer` value carried into the commit as typed) into `3220c9ee`. Git reported no conflict, and the merge has no hand edit. #376 changed `scripts/family.py` and `tests/test_family.py`, which this branch also changes. None of the lines it added under `tests/` names a key the templates now quote. The coordinator ran targeted tests on this head, Linux only, before CI: - main's changed test files (`tests/test_commit_trailers.py`, `tests/test_family.py`, `tests/test_bump_leg.py`, `tests/test_update_shape.py`) with `tests/test_family_add_member_id.py`: 421 passed, 1 skipped (a case-insensitive disk only); - this branch's template set (`tests/test_template_text_placeholders.py`, `tests/test_template_quoted_values.py`, `tests/test_scaffold_manifest_values.py`, `tests/test_bootstrap_spelling.py`, `tests/test_bootstrap_after_bump.py`) with the hygiene, CLI-reference and AGENTS.md-codes tests: 652 passed. **Composition at 3220c9e.** `3220c9ee` is GitHub's update-branch merge of origin/main `70d0d1b3` into `e5e768bc`. It brings in three commits: #491 (da19735), in which `setup-project.py` asks at the person's own terminal; #374 (7ab11cf), update-shape's NEXT quoting; and #384 (70d0d1b), adopt's `_spelled` plan values. Git reported no conflict, and the merge has no hand edit. #491 changed `tests/test_setup_project_py.py` and `tests/test_setup_sh.py`, which this branch also changes. A grep of the lines main added under `tests/` for the keys the templates now quote found two hits, and neither reads a rendered template line: `tests/test_update_shape_next_quoting.py` writes its own `project.yaml`, and `tests/test_adopt_question_and_submodule_spelling.py` edits a plan's `- path:`/`question:` entry, which `adopt-project.py` writes bare. The coordinator ran targeted tests on the same tree (`e5a74d19`), Linux only, before CI: - six of main's eight changed test files (the setup, update-shape, `openRepoShape` command and doctor-row tests): 365 passed; - main's other two (adopt's spelling and repo hygiene), `tests/test_adopt_github_exits.py` and nine more files of this branch's sixteen-file set: 943 passed. **Composition, refreshed again 2026-10-13 (head e5e768b).** `6d108d18` merges origin/main `56713e21` into `6cbbac60`. That brings in two commits: 5e02abe, the doctor's and `validate-pins.py`'s gitlink repairs, and 56713e2 (#479), in which adopt's `plan` takes the tracking branch from the source's default branch. Git reported no conflict and `docs/cli.md` auto-merged; the merge has no hand edit. Two kinds of test failed on it, and two commits fix them: - **`7968f902`** changes one expected literal, at `tests/test_adopt_github_exits.py:675`, for `test_a_source_on_another_branch_opens_its_pull_request_against_it[master]` and `[trunk]`. - The test reads the adopted root's `project.yaml`, which this branch's template renders as `tracking_branch: "master"`, so it now expects the quoted line. - The look-alike lines at `:743` and `tests/test_adopt_tracking_branch.py:73-76` read a plan, which `adopt-project.py` writes bare, and they stay as they are. - **`e5e768bc`** adds `git("branch", branch, cwd=source)` to `tests/test_template_text_placeholders.py::test_an_adoption_reads_back_every_value_it_was_given`. - All six rows had failed at `check` with `plan-tracking-branch-missing`: #479 refuses a tracking branch (`2026`, `007`, `1.5`, `20261011`, `true`, `null`) the source does not have, and the test's source had only `main`. - The source now carries each row's branch, in the flag rows and the by-hand rows alike. The test's assertions are unchanged. Targeted runs, Linux only: - On e5e768b: main's seven changed test files, 211 passed; this branch's sixteen-file set, 1223 passed, 2 skipped. - On 7968f90: the same sixteen files gave 6 failed, which are the six rows e5e768b fixes. The scaffold, setup, doctor and family set gave 1094 passed, 22 skipped, and twelve further template-grep files gave 1259 passed. - `render-cli-reference.py --check` is ok. **Composition, refreshed 2026-10-13 (head 6cbbac6).** `d651b594` merges origin/main `aa4e1f59` (#508) into `d526f768`. - **The one conflict.** Git conflicted in one file, `tests/test_adopt_manifest_values.py`, in four hunks, all against #356 (965420b, #293/#294). #356 refuses an `elected_on:` that `election_date` does not read, as `election-date-malformed`, before the validator is asked (`_manifest_values` returns None, adopt-project.py:2258). - **Resolved by what the merged tree prints**, measured with `adopt-project.py plan`/`check`/`execute` into local bare remotes: - `id: "007"` checks clean and `execute` writes it as typed, so it stays in `TEXT_THE_TEMPLATE_NOW_HOLDS`. - `visibility: "true"` gets the validator's `manifest-visibility: visibility is 'true'`. - `elected_on: "20261011"` gets #294's one finding, "the plan's `elected_on:` is the text '20261011'", and the validator is not asked. That row keeps this branch's list, `TEXT_THE_VALIDATOR_REFUSES`, with main's sentence. - Two tests git merged cleanly now ask `said_of`, as main's own rows do: `test_check_refuses_a_text_value_the_validator_refuses` and `test_where_a_misread_rule_judges_the_rest_the_validator_still_answers`. - **Two more failures that no hunk showed**, fixed in the same merge: - `[branch-tilde]` in `tests/test_scaffold_manifest_values.py` was this branch's own `xfail(strict=True)` until #355 landed as 6c2a371, so it XPASSed. The mark is off, and the row asserts `REFUSED scaffold-bad-tracking-branch:`. - #391's `tests/test_bootstrap_spelling.py` and #490's `tests/test_bootstrap_after_bump.py` matched ` path: spec` and `tracking_branch: main` in a scaffolded `project.yaml`, and nine cases failed on the merge. They now match the quoted lines. - **The #507 interplay.** `6cbbac60` switches the holder to `family/members` before the real `add`s in `test_a_member_whose_id_yaml_would_misread_is_pinned_under_that_id`, so the test holds once PR #507's `family-on-tracking-branch` refusal lands. - On the clean merge of 6cbbac6 with #507's head 708f3bb, that file, all 13 `tests/test_family*.py` and `tests/test_shape_doctor.py::test_a_sibling_at_the_right_origin_with_another_id_is_not_the_member` give 686 passed, 19 skipped. - Without the switch line, the member test fails `REFUSED family-on-tracking-branch`. - **Targeted runs on 6cbbac6, Linux only:** - the template, adopt-plan and manifest files (14): 995 passed, 2 skipped; - scaffold e2e, setup, the doctor, leg-path collisions and every family file: 1094 passed, 22 skipped; - the 15 further files a grep for template lines found: 1503 passed; - `render-cli-reference.py --check`: ok. - **Re-verified independently** at d651b59 and 6cbbac6: APPROVE WITH NITS (0/0/3), all three in this paragraph and fixed here. The re-verification also ran the three rows, five mutations, and 26 more files (834 passed; 291 passed, 1 skipped). - **Not run locally:** the full suite, macOS and Windows; CI's three jobs are the check. **Composition, as measured on 2026-10-12.** The merge trees below were computed for 233dc71; the follow-up commit 3894aa8 changes only `scripts/family.py` comments and adds tests. At 15:28Z main was 3ae0109 (#245, #351, #350 and #345 had landed since the merge trees): 3894aa8 merges clean with it, and the review's re-verify ran the family tests on that merge (61 passed). Every sha below is the one it had then; main and the other branches have moved since. `git merge-tree --write-tree --name-only`, run after a fetch with automatic maintenance off on 2026-10-12: - **origin/main 161c6c9**, 17 commits past c7c02fa (the base): clean, tree 7ba8246. #316 (34ecbc2), #317, #318, #311 and #245 were on main by then. - **The 46 other remote branch heads** (the 30 open PR heads and 16 branches with no open PR): clean for 44. Among them #314 (4b8da3d), #266 (3410be7), #355 (a03abcf), lane 1's `fix/adopt-plan-quote-yaml-keywords` (d38e143), `fix/adopt-record-submodule-placement` (70f4d29) and `fix/adopt-late-failure-notice` (9f1778d), #380 (73068a3), and `fix/family-init-values` (14e2d68, #307). The two that conflict, each in the same file as it does with c7c02fa and with origin/main on its own: lane 1's `fix/adopt-root-kept-symlinks` (6c44591, `adopt-project.py`) and #358 `fix/doctor-manifest-kinds-unreadable-pin` (ebffb08, `shape-doctor.py`). This branch touches neither file. - #314 and d38e143 each conflicted with origin/main on their own, in `adopt-project.py`. Merged with this branch, neither gained a conflict. **Composition with #314, which lands before this branch.** Its misread gate (`manifest_misreads`) reads the template, so once the template quotes a field it refuses nothing there, and some of #314's tests expected that refusal. Composing with #314 (landed as 3ef059c), whose misread gate asks the template how a value is written. With `project.yaml` quoting `id`, `elected_on`, `visibility` and `tracking_branch`, the gate refuses nothing on the shipped templates, and 45 of #314's tests flipped on the merge. Forty expected a refusal the value no longer needs. Thirty-four of them now assert that the value is accepted, and the six whose premise was a bare placeholder now assert that no shipped template placeholder is misread. For example: a scaffold of `--id null|true|false|007|2026`, or of `--tracking-branch true|True|TRUE|false|False|null|Null|NULL|007|2026|1.5|1.50|0`, exits 0, and the manifest holds the text it was given. A dry run prints the plan. An id derived from `--project True|Null` is held as typed. `--id=null` reaches `gh repo create`. Adopt's `id: "007"` checks clean and `execute` writes it as typed. The rule's own sentence, remediation and line-break wording are still asserted, on a copy of the standard whose `project.yaml` writes the four lines bare. Four stay refused by #314's validator gate, now in its words about the text: `visibility is 'true'` and `elected_on is '20261011'`. One is a real break. `--tracking-branch=~` reads back as `~`, which git refuses as a branch name, and it dies at `git init -b ~`, after `gh repo create`. That is #283, so the row is `xfail(strict=True)` with that reason, and it turns XPASS (and fails) once PR #355's `git check-ref-format --branch` refusal lands. `--help` for `--id` and `--tracking-branch` no longer says such values are refused, and `docs/cli.md` is regenerated. **Composition with the other branches.** Where another branch's rules meet this one, the tests were run on the merged tree. Quoting changes what some of their tests see, and the changes are not all one kind: some tests expected a refusal the value no longer needs, some are still refused under another rule, and some guard a case quoting does not fix. Whoever lands second must tell them apart, so each branch's flips are classified below. - **#266** (lane 2, `fix/leg-path-yaml-scalars`). 27 flips, all from one cause: its rule asks a hard-coded bare line, `LEG_PATH_LINE = "path: {}\n"`, so it refuses leg paths the quoted templates now read back. 15 are `test_the_rule_agrees_with_every_template_line_that_holds_a_leg_path` (null, Null, NULL, ~, true, True, TRUE, false, False, FALSE, 2026, 007, 0, 1.5, 1.50) and 12 are this branch's own end-to-end tests (6 scaffold rows fail with `REFUSED scaffold-bad-leg-path`, 6 adopt rows with `FINDING plan-bad-leg-path`). Counted on the merge with b2b42f8. #266's head was then 3410be7, whose rule reads each template line that holds a leg path, renders the value into it as `render` does and asks the reader, so it has no hard-coded line left. The merge with this branch was clean (tree 1e348c6); that head was read and the 27 were not re-run on it. At b2b42f8, whichever of #266 and #259 landed second had to drop or re-point the bare rule; 3410be7 re-points it already. - **Lane 1's #181** (`fix/adopt-plan-quote-yaml-keywords`, d38e143). Its gate reads the template too, so `plan --tracking-branch 2026|007|true` exits 0 on the composed tree (exit 2 `adopt-manifest-misread` on d38e143). On the merge, `tests/test_adopt_plan_yaml_quoting.py` and this branch's 6 adopt end-to-end tests give 70 failed, 371 passed: - 57 refusals that are now unnecessary: `plan_refuses` ×14, `plan_names_an_id` ×2, `check_names_an_id` ×4, `check_reports` ×14 and `execute_refuses` ×14 (every value except `elected_on` and `visibility`), `text_the_loader_reads_as_other_text` ×7, and the two tests that need a bare placeholder (`test_the_gate_follows_the_loader_when_the_loader_learns_a_keyword`, `test_the_template_line_says_whether_a_value_is_quoted`). - 11 guards #181 loses. See "Do not flip". - 2 that fail only by cascade: `execute_refuses[pins='null']` and `[pins='True']` pass alone (`2 passed`). An earlier case no longer refuses, and its `execute` pushes the split branch. - The writer half of #181 (`y` asking the reader, so `true`/`null`/`True` are quoted in the plan) is still needed and composes cleanly. With it, `plan --tracking-branch true` reaches the quoted template intact, and this branch's two hand-quoted adopt rows become flag-driven. - **Do not flip these 12 to "accepted".** Each still needs a refusal or a finding, and quoting does not supply it: - **`~` (1, #314).** `test_a_value_the_reader_misreads_is_refused_before_anything_is_made[branch-tilde]`. `--tracking-branch=~` is not a branch name git accepts, and #314 refused it only as a misread. On the merge it passes the plan and dies at `git init -q --bare -b ~ .../Atlas-spec.git` with `fatal: invalid initial branch name: '~'`, and against GitHub that is after `gh repo create` has made all three repositories. That is lane 2's #283 (PR #355). `~` must stay refused, by #283's ref-name check, which is why #314's row for it is not flipped to "accepted". - **A hand-edited plan value that is not text (7, #181).** `test_check_names_a_plan_value_that_is_not_text_by_what_was_read[tracking_branch='007']`, `[tracking_branch='TRUE']`, `[tracking_branch='1.50']`, `[tracking_branch='[a]']`, `[visibility='{a: b}']`, `[id='007']` and `[elected_on='20260902']`. The plan's reader reads each as something other than text, and on the merge `check` passes. Measured on the merge: `tracking_branch: 007` and `id: 007` are adopted silently as `"7"` with every validator passing; `visibility: {a: b}` pushes both legs and then fails `manifest-visibility`; `tracking_branch: [a]` is still refused at `execute` (`unsafe-value`) before any leg exists. On d38e143 alone, `check` exits 1 `plan-manifest-misread` for each of those four. Re-point the gate at "a plan value that is not a string" and these keep their guard. - **A quoted value the validator refuses (4, #181).** `test_check_reports_a_plan_carrying_one[elected_on='20260902']` and `[visibility='true']`, and `test_execute_refuses_a_plan_carrying_one_before_any_leg_exists[elected_on='20260902']` and `[visibility='true']`. The value stays invalid for the validator (`DATE_RE`, the visibility choices), and #181's misread gate caught it only incidentally. On the composed tree `check` passes and `execute` pushes the legs, and the gate fails afterwards. That is what main does today, and #314's validator gate (`plan-manifest-invalid`) would catch it. - **main** (merge with ab623dd, tree cdeec7f, run by the review): this branch's new file, `test_adopt_template_values.py` (#270), `test_template_values_single_pass.py` (#316) and `test_template_quoted_values.py` give 431 passed, 1 skipped. The skip is `test_adopt_template_values.py:223`, which reads `git config user.name` and skips where the shared repository's `.git/config` sets one; it is environmental. The changed tests with `test_family_add_refusals.py` (#317, #318), `test_pin_validator.py` and `test_manifest_validator.py` give 132 passed. #270's `unwritable_reason` is value-based, not template-relative, so it refuses as it did and nothing flips. Main then added #245 (`adopt-project.py` and `repo_shape.remote_key`), which adds no test that edits a bare quoted line; it was not run on that merge. - **#380** (lane 3, `fix/pin-rewrite-indentation`; it landed since as 1f90a0f). It rewrites `commit:` and `tree_sha256:` only, and its tests render the pins from the templates. On the merge at dc0fa7b, `test_pin_rewrite_layout.py` and the 6 scaffold end-to-end tests gave 121 passed. Its head was then 73068a3; that merge was clean and was not re-run. - **#397** (`fix/family-init-values`, #307; measured at 14e2d68): its tests skip themselves where the template quotes. 137 passed, 19 skipped, 0 failed. With its fix-round head abb27e6, this branch's 3894aa8, main 0f67f7b and #345 together: 442 passed, 20 skipped (the 19 rows, and one Windows-only row). - **#345** (run at 875d802; it has since landed as 3ae0109): `test_family_dry_run.py` and the member test, 22 passed. Its `" id: irrs"` assertion holds, because ordinary ids stay bare. **Left out.** - The adoption plan writer `y` still writes `true`/`null` bare into the plan. That is #181 (lane 1). - `templates/assembly-root/contracts/neutral-product-pin.yaml` still writes `product`, `source_repository` and `digest_source` bare, and `family.py` writes a member row's `project:` bare. Neither is a #259 field. - A plan value someone edits to a non-text type (`tracking_branch: 007` or `id: 007`, unquoted, in the plan) is read by the plan's reader as the number 7. `str()` makes it `"7"`, and the quoted template now writes it faithfully. For `id` this is a change: on c7c02fa a bare `id: 007` failed loudly (`validate-manifest: manifest-id`, manifest line `id: 7`), and on this branch it is adopted silently as id `"7"` and every validator passes. `tracking_branch: 007` was already adopted silently as `7`. The plan side is not this branch's: the guard against it belongs with #181 (adopt plan writes YAML keywords and non-text values unquoted), whose gate should refuse a plan value that is not a string. The case is narrow, because `plan --id 007` itself writes `id: "007"`; only a hand edit reaches it. - No docs change: README, AGENTS.md, the handbook and the template comments show none of these lines; `docs/cli.md` is unchanged because no `--help` text changed. Reviewed adversarially at 233dc71 (CHANGES NEEDED: 0 blockers, 2 should-fixes, 6 nits; the code and the tests were sound, and the should-fixes were the composition counts and the claim about a hand-edited plan `id`). Fix round 3894aa8 changes no behaviour: it corrects the description and the two false "moves by a byte" claims, and guards `_member_id`'s `except YamlError` with a test of 7 cases. Its re-verification at 3894aa8 found every finding handled: APPROVE WITH NITS (0 blockers, 0 should-fixes, 1 nit: shas that had moved since the description was written, refreshed here). What was added after that re-verification, main and the composition with #314, is described under "Composition with #314". An independent re-verification of that composition at 77cd0b2 confirmed it with nits only (0 blockers, 0 should-fixes, 5 nits): the 45 flips reproduce test for test, breaking the real rule or the real template's quoting turns the compose tests red, and the `[branch-tilde]` row XPASSes on a merge with #355. **Composition with #381.** #395's quoted `id: "{{PROJECT_ID}}"` composes with #381's `member-duplicate-id` test (`tests/test_family_add_member_id.py`), whose id rewrite now matches the id bare or quoted and keeps its quoting, so the full suite, which failed that one test on Linux at 1ef3310, no longer fails `test_a_member_whose_id_changes_between_the_probe_and_the_mount_is_unwound` on Linux. CI is green on Linux, macOS and Windows, with SonarCloud passing, at 4984651 (main cc8f2da merged in by update-branch). Main af01068 (#505), which landed after, touches none of its files, and the combined tree passed the template, hygiene, CLI-reference, AGENTS.md-codes and setup tests (807 passed). Closes #259 Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 14, 2026
brettheap
added a commit
that referenced
this pull request
Oct 15, 2026
…t is rewritten and keeps it, `--branch` is judged the same from any directory, and `apply`'s messages say what is true (#437, #431, #535) (#558) Three small fixes to update-shape.py, in disjoint functions of one file. #437: `rewrite_shape_pin` and `_shape_block_bounds` find the pin's `files:` header and the manifest's `shape:` header with the reader's own `_strip_comment` at column 0 (the reader's rule for a comment, and nothing more), and the `files:` header is written back as the line it was, so a header that carries a trailing comment is rewritten and keeps it instead of being refused as `update-pin-unrecognised` or `update-manifest-no-shape`. The missing-header refusal, #380's byte-identical rewrite and the read-back are kept. A manifest holding the `shape:` key twice is refused by name, as a key written twice. #431: `checked_branch` asks git through `shape_materialize._ask_git_branch`, with no repository in play, so a good `--branch` is no longer refused from a directory git cannot open; a git that could not answer says the name "could not be checked". #535: a branchless `apply` that left nothing to commit, by bytes and by mode, says so instead of printing a commit line; the `both` row and the `update-conflict` remedy name the upstream's file and the target commit; the commit message and `--pr`'s body, a `--pr` re-run's included, claim "not hand-edited" only of the copies re-copied from the upstream and name what `--accept-local` kept; and the `gh pr create` the `--branch` NEXT line prints carries `--title` and `--body`, naming the root's own manifest (`family.yaml` for a holder). Closes #437 Closes #431 Closes #535 Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lane: openreposhape-3 (openRepoShape-3)
Claim: #323 (comment)
What
rewrite_shape_pin(update-shape.py) andrewrite_pin(scripts/bump-leg.py) foundtree_sha256:by exactly two leading spaces and wrote both lines back ascommit: "<sha>"andtree_sha256: "<digest>";rewrite_manifestkept each line's indentation since #224 and still wrote its two lines bare. They now do what #224 did for the manifest's indentation, for all three and for the comment too.commit:andtree_sha256:is replaced (shape_materialize.with_scalar): the indentation, the key, the spacing between the colon and the value and a trailing# commentare the line's own. The comment is found by the reader's own_strip_comment, so a#inside a quoted value is not one. The new value is double-quoted, as the scaffold writes it.tree_sha256:is found as any INDENTED line that begins with it (is_nested_key),commit:at column 0, each exactly once, as before.files:is still written whole from the recomputed rows.parse_yaml:commitanddigests.tree_sha256must equal the target, or it is refused asupdate-pin-unrecognised/bump-leg-pin-unrecognised, as this tool's fault, before the pin is written. The one layout a line rewrite cannot carry (a value on the line below its key) reads and validates, and used to reach the validators with their lockstep remedy about the gitlink. Raised only when the pin read before the rewrite (a pin that did not was red already and is left to the validators), as in update-shape.pyapplyrewrites the manifest'sshape:block with fixed two- and four-space indents, so aproject.yamlindented four spaces, which the project's own reader and both validators accept, is rewritten into YAML that reader rejects, and the rolled-back refusal relays the validators' lockstep remedy #208.applyrolls its copies back,bump-leg.pyputs the leg's detached checkout back.scripts/shape_materialize.py(is_nested_key,with_scalar,pin_values_in,rewrite_fault), not inrepo_shape.py, which every project holds as a digest-pinned copy. update-shape.pyapplyrewrites the manifest'sshape:block with fixed two- and four-space indents, so aproject.yamlindented four spaces, which the project's own reader and both validators accept, is rewritten into YAML that reader rejects, and the rolled-back refusal relays the validators' lockstep remedy #208's manifest check calls it too, its messages unchanged.bump-leg.py: a pin laid out its own way and already at the commit isnothing to do(exit 1), because its rewrite is itself.update-shape.pykeeps importingparse_yamlandYamlErroralthough nothing in it reads them now. The--prre-run branch (update-shape.pyapply --branch --prre-run:_awaits_its_pull_requestreads the pin from HEAD while the "nothing to do" test reads the working tree, so a re-run over a tree that an in-placeapply --at Calready wrote pushes HEAD and titles the pull request with C #333) reads HEAD's pin with them in_committed_pin, and a merge of the two is textually clean and aNameErrorwithout them (see "Composes with"). The import block is as main has it.Why
Measured on main ab623dd and on this head. The unit rows call the three functions (
measure.pyover a scaffold's own templates); the end-to-end rows are this branch's own tests run against main's tools, with the printed lines taken from the failures. The issue's numbers were from be2790e and still hold.apply,shape-pin.yamlwithtree_sha256:at four, three or one spaceREFUSED update-pin-unrecognised: contracts/shape-pin.yaml has 0 \tree` line(s) where exactly one was expected`, rolled backfiles:differs from the original by the two values, validators greenbump-leg.py --leg spec --to <sha>,spec-pin.yamlwithtree_sha256:at four, three or one spaceREFUSED bump-leg-pin-unrecognised: the pin file has 0 \tree_sha256` line(s) where exactly one was expected`validate-pins.pygreencommit: "a" # the cut we reviewedandtree_sha256: "b" # recomputed by hand, throughrewrite_shape_pin,rewrite_pin, and (shape:block)rewrite_manifestcommit: "<sha>"andtree_sha256: "<digest>", comments gonecommit: "<sha>" # the cut we reviewedbump-leg.pyto the commit a commented pin already namesnothing to docommit: >-with the value on the next line (reads, validates)applyprintsREFUSED yaml-unparsable: …thenupdate-validators-red;bump-leg.pyprintsREFUSED bump-leg-validators-red: scripts/validate-pins.py exited 2 after the rewrite; both roll back, and the remedy blames the projectupdate-pin-unrecognised/bump-leg-pin-unrecognised, "the fault is this tool's line rewrite", before the pin is written; tree as it wasshape-pin.yaml,spec-pin.yaml,code-pin.yaml,project.yamlfrom a real scaffold2b130008…,753c98e1…,7a015bc2…,b3dcc684…tests/test_pin_rewrite_layout.py(new, 115 tests) run against main's tools: 103 fail and 12 pass (the unchanged behaviours: scaffold-shaped pins, the one-of-each-line refusals, a pin that did not read before). Of the 13 end-to-end tests selected intest_update_shape.pyandtest_bump_leg.py, the 12 new ones fail on main and the one that passes is #208's manifest check.Tests
Head 73068a3 (one commit on origin/main ab623dd), three runs, each on that sha:
tests/test_pin_rewrite_layout.py(new),test_bump_leg.py,test_bump_leg_rollback.py,test_update_shape.py,test_update_shape_add.py,test_update_shape_add_ignored.py,test_update_shape_add_symlink.py,test_update_shape_landing.py,test_update_shape_pr_base.py,test_commit_trailers.py:533 passed, 4 skipped in 746.76s. The skips: one intest_bump_leg.py(a disk that ignores case, macOS and Windows) and three intest_update_shape_add_symlink.py(NTFS junctions, Windows).test_repo_hygiene.py,test_cli_reference.py,test_git_output_decoding.py,test_stdout_encoding.py,test_validator_child_encoding.py,test_windows_paths.py,test_template_quoted_values.py,test_template_values_single_pass.py,test_adopt_template_values.py,test_family.py,test_gh_guard.py:679 passed, 2 skipped in 558.34s. The skips:test_stdout_encoding.py::test_plan_on_the_windows_default_stdout(Windows only), andtest_adopt_template_values.py::test_plan_names_the_elector_it_took_from_git_config, which probes thatGIT_CONFIG_GLOBALwins and found this workstation's shared repository config carryinguser.name, so it skipped here. The same file passed in full on the previous head 7e2230c (680 passed, 1 skipped), which differs from this one only inupdate-shape.py's import block.test_shape_doctor.py,test_scaffold_leg_path_collisions.py(the doctor drivesupdate-shape.pyandbump-leg.py):358 passed, 3 skipped in 562.99s. The skips are the doctor's PowerShell line, which prints on a Windows host only.Each new test was shown to bite: eleven one-line mutations of the fix (drop the comment tail, normalise the spacing, match two spaces only in either tool, no read-back in any of the three, blame an unreadable pin, fixed-layout manifest write, match column 0) each fail the unit file, and the two read-back and comment mutations fail the end-to-end tests.
Windows: the new tests build their input in memory or write bytes, and compare LF text. They run on all three OSes.
Composes with
git merge-tree --write-tree <branch> HEAD, and the same against origin/main alone to separate old conflicts from ones this branch adds. This branch adds no conflict to any ref. Heads as of this push.NameErrorbefore the last fix, see belowadopt-project.py,scaffold-project.py,shape-doctor.py: the same conflict with origin/main alone, none in a file this branch touches#333 composed textually and failed.
fix/update-shape-pr-rerun-pin-sourcereads HEAD's pin in_committed_pinwithparse_yamlandYamlError, and this branch's first head (7e2230c) had removed both fromupdate-shape.py's import, as nothing else in it read them. The two merge with no conflict and the merge is aNameError: I merged this head and #322, #324, #325 and #333 into one scratch tree, andtest_a_rerun_over_a_tree_head_does_not_commit_is_refused_by_namefailed in all four cases (4 failed, 518 passed, 1 skipped). The import is now as main has it, so the two land in either order. On the head that is in this PR the same five-branch tree gives522 passed, 1 skippedovertest_pin_rewrite_layout.py,test_update_shape.py,test_bump_leg.py,test_ruleset_hint_tracking_branch.py,test_update_shape_next_quoting.py,test_update_shape_landing.pyandtest_commit_trailers.py. No other branch in the list readsparse_yaml,YamlErroror the removed_shape_pin_ofinupdate-shape.py.The new helpers import from
repo_shapein a secondfromstatement and not inside the existing block, so branches that edit that block do not collide with it.Left out
files:and the manifest'sshape:followed by a trailing comment are still refused by name (update-pin-unrecognised,update-manifest-no-shape), measured; only the two value lines are rewritten.bump-leg.py --dry-runcallsrewrite_pinonly when nothing moves, so it exits 0 on a pin the real run refuses (measured on main with the four-space pin: dry run 0, real run 2). Unchanged here.apply --branch --prre-run:_awaits_its_pull_requestreads the pin from HEAD while the "nothing to do" test reads the working tree, so a re-run over a tree that an in-placeapply --at Calready wrote pushes HEAD and titles the pull request with C #333 has landed,parse_yamlandYamlErrorinupdate-shape.pyare read by it; until then they are imports with no reader.rewrite_manifest). Nothing in the issue turned out wrong.Closes #323
🤖 Generated with Claude Code
Summary by Sourcery
Preserve pin layout and validate rewritten values across shape, leg, and manifest updates.
Bug Fixes:
tree_sha256:entries regardless of their indentation depth accepted by the YAML reader.Enhancements:
Tests: