[brettheap]

Lane: openreposhape-4 (openRepoShape-4)
Claim: #361 (comment)
Claim: #367 (comment)
Claim: #368 (comment)

Three defects in the holder's own gate, templates/family-root/scripts/validate-family.py, fixed in one change because all three are in _check_members and the member checks under it. The third also reaches the shared scripts/repo_shape.py.

#361: a gitlink or a .gitmodules section that no row names

What was wrong. Every member check started from a row. _check_members asked each members: row for its gitlink, digest and identity, and nothing walked back from what the holder records to a row. These all passed the holder's own gate, and the doctor called the holder COMPLIANT:

• a member mounted by hand with git submodule add;
• a row deleted by hand;
• the section family.py remove leaves of two sections for one path (family.py remove, when .gitmodules gives the member's path to two sections, takes out only the one git finds by that path (the later in the file) and exits 0, so its commit still registers members/<P> with no gitlink and no row, validate-family.py passes the result (after #317 it reported the doubled file and stops), and the next add of that member is refused member-path-registered or silently reuses the leftover section and the .git/config registration deinit never touched #360);
• a section for Members/Atlas, which add commits beside the member's own.

What it does now. Two findings, each with its own code. Both are made before the --no-members return, as #350's member-duplicate is, because a private family's CI falls back to that mode.

code	what it reads
member-gitlink-unnamed	every gitlink in members/, the directory in any case (Members/Zed counts, tools/Zed does not). It reads the whole index at stage 0, else HEAD, the order recorded_gitlink reads one in, with no pathspec and -z.
gitmodules-path-unnamed	every .gitmodules section whose path no row names. It shares one reading of the file, as git reads it, with #300's gitmodules-path-twice.

"Unnamed" is decided exactly, against the path each row gives: its path: as written, or members/<project>. A path a row names under str.casefold() is still a finding, because macOS and Windows hold the two as one directory. Which of three things it is decides what the finding says to run (fix round 1, below). family.py add's member-path-registered is unchanged (#362).

Remedies. Each command is printed on its own indented line, with no backticks, no ; and no trailing comment.

what was found	the remedy printed
an unnamed section	taken out by key, #300's removal, one git config -f .gitmodules --unset-all per key it holds. None when its gitlink's git rm below takes it out too (fix round 1).
a gitlink or section that is a SECOND path to a member that stands: the row's path: is its canonical members/<project> and that exact path holds one too	git rm --cached -- <path>, which touches no file (a plain git rm would delete the member's own checkout on a disk that folds case), or the --unset-all lines
the member's own path, whose row was hand-edited into a case variant of it	no command: the row is the hand edit, so put members/<project> back in its path: (fix round 1)
the only record of a member, at a case variant of its row's path	no command: the member is recorded in the wrong case, and the git log -p -- family.yaml restore sentence (fix round 1)
any other unnamed gitlink	put the row back from git (git log -p -- family.yaml), or, for a hand mount: git rm -- <path>, then python3 scripts/family.py add --family-root <holder> --member <org>/<Project> from a checkout of openRepoShape, the project shell-quoted as the paths are

This departs from the ruling's git rm --cached. Probed on the issue's repro row (a): after git rm --cached members/Zed, the checkout stays at the mount path, and add refuses REFUSED member-path-taken: members/Zed already exists in the family root but no `members:` row names it. A plain git rm members/Zed works instead:

• it refuses while the checkout holds changes, and takes the .gitmodules section out with it;
• add then refuses member-git-dir-cached, naming the object store git rm leaves in .git/modules (the remedy says it will);
• with that store gone, add mounts and pins the member, and the holder says family ok.

test_a_hand_mount_is_taken_out_and_added_back_as_printed runs that chain as printed.

Smaller decisions.

• A new refusal, gitlinks-unreadable, for an index git ran and could not list. The gitlink listing is the one check of members/ that --no-members runs, so a failed listing must not pass silently. A HEAD git cannot list records nothing, as recorded_gitlink reads it (a holder before its first commit).
• The doctor is not changed (ruling 4): its family row reports what this validator finds.

#367: a hand-edited path: was read as a glob

What was wrong. _check_member found the row's path: wrong (member-path), then checked the gitlink, tree and identity at that path anyway. At members/*:

1. the gitlink listing read the path as a glob and answered with a neighbour's commit, a false member-gitlink-mismatch;
2. the tree check refused member-uninitialized, whose remedy cannot help;
3. the refusal dropped both findings unprinted.

What it does now.

• The row's checks stop once its pin is read; the pin is a fact of the row itself. member-path now names the one path the row may have.
• recorded_gitlink passes git's global --literal-pathspecs to both of its listings. It never uses :(literal) magic, which a caller's GIT_LITERAL_PATHSPECS=1 turns off.
• Beyond the ruling: git refuses --literal-pathspecs beside an exported GIT_GLOB_PATHSPECS or GIT_ICASE_PATHSPECS: "global 'literal' pathspec setting is incompatible with all other global pathspec settings", exit 128 (probed on git 2.43). recorded_gitlink reads a refused listing as "no gitlink here", so an operator exporting either variable would have seen every gate refuse a gitlink that is there. Those two variables are now kept out of those two git calls' environment; git_out gained an optional env for this.

One copy of repo_shape.py: scripts/repo_shape.py. The templates carry none. scripts/shape_materialize.py copies it into projects (COPIED_FROM_SHAPE) and holders (FAMILY_COPIED_FROM_SHAPE), run by scaffold-project.py and family.py init, so the fix reaches every caller of recorded_gitlink:

• validate-family.py;
• the assembly root's validate-pins.py (187) and bootstrap.py (114);
• bump-leg.py (740);
• shape-doctor.py, at three call sites (line numbers as on main 45e01f4, and the same at cb7063f): family_beside_project (1462), check_legs, the legs row (2167), and members_verdict, the members row (3802).

family.py (107) imports recorded_gitlink but never calls it. Every caller passes a declared path, and none relies on globbing. Existing projects and holders get the fix through update-shape.py.

Decision 3 is not taken. A refusal still prints none of the findings gathered before it.

#368: no git on PATH ended in a traceback, exit 1

What was wrong. git_out raises OSError when there is no git to start, and only #317's .gitmodules reader caught it. The default and --pins modes ended in a FileNotFoundError traceback, exit 1, which is a finding's code.

What it does now.

• Every git-reading check runs inside a new context manager, _git_runs: the .gitmodules reader, validate-family.py asks every members: row for its gitlink and never the reverse, so a gitlink under members/ that no row names (a member mounted by hand with git submodule add, or a row deleted by hand) and a .gitmodules section whose path no row names (what family.py remove leaves of two sections for one path, or a section for a case variant such as Members/Atlas, which add commits beside the member's own even after #317) all pass the holder's own gate, and the doctor calls the holder COMPLIANT #361's gitlink listing, and each member's gitlink and tree.
• Without git, the validator refuses one new code for the whole validator, git-not-runnable, exit 2, naming the check and that git could not be run.
• family.py: add refuses member-path-registered when a .gitmodules section under another name already gives the mount path, and validate-family.py finds gitmodules-path-twice, so add no longer commits two sections for one path that a recursive clone resolves to the later one, and a holder that already has such a ghost section fails its own gate (#300) #317's no-git clause moves to that code too, so gitmodules-unreadable now means only a file git ran and could not read. family.py: add refuses member-path-registered when a .gitmodules section under another name already gives the mount path, and validate-family.py finds gitmodules-path-twice, so add no longer commits two sections for one path that a recursive clone resolves to the later one, and a holder that already has such a ghost section fails its own gate (#300) #317's no-git test is updated to match.
• recorded_gitlink's except Refusal lets the OSError through, so a missing git never reads as "no gitlink".
• _git_runs wraps the git calls alone, not the identity check, which reads a file.
• --no-members now runs git (the validate-family.py asks every members: row for its gitlink and never the reverse, so a gitlink under members/ that no row names (a member mounted by hand with git submodule add, or a row deleted by hand) and a .gitmodules section whose path no row names (what family.py remove leaves of two sections for one path, or a section for a case variant such as Members/Atlas, which add commits beside the member's own even after #317) all pass the holder's own gate, and the doctor calls the holder COMPLIANT #361 gitlink listing) even with no .gitmodules. Without git it now refuses, where it used to pass.

Not fixed here: the assembly root's validate-pins.py ends in the same traceback (the issue's last line). It is #412, fixed in PR #446 with the same git-not-runnable code.

Also

_check_members's docstring said "the two checks that read a file alone" where #317 had made three. It now names the checks that need no member checked out, without a count (the nit from the review of #331, PR #350).

No --help text changed, so docs/cli.md is unchanged.

Fix round 1 (review vf-423fb25)

The review found each issue's repro fixed, the five departures right and the decisive run green (1455 passed, 4 skipped on the scratch merge). It held the head on one remedy that misdirects and left four nits. Head after this round: 369af2e, one commit on 423fb25.

finding	what was done
SHOULD-1: the case-variant remedy	done: the three cases below, with tests in default mode and --no-members
NIT-1: a hand mount's two findings print overlapping remedies	done: the section finding says the git rm above takes it out and prints no --unset-all line
NIT-2: the git-not-runnable wrapper catches more than git	not done, as ruled: Follow-ups below
NIT-3: the stage-0 filter in _member_gitlinks is unpinned	done: two tests with an unmerged gitlink
NIT-4: PR body accuracy	done: the caller list above (the doctor's members row, and the three doctor call sites with lines) and the copier (shape_materialize.py); the --member value in the add remedy is shell-quoted, with shlex.quote, the file's own helper

SHOULD-1. A path that folds to a row's path was always taken for the stray, and the finding printed git rm --cached -- <path> (or the --unset-all lines). That is right in one state. In two others it took the member's own record out of the index (or .gitmodules), after which --no-members, a private family's CI fallback, said family ok. Now _variant_case tells the three apart (_row_paths carries each row's canonical members/<project> for it):

1. A second path to a member that stands: the row's path: is its canonical path AND that exact path also holds a gitlink (a section). Today's command, unchanged.
2. The member's own path, the row hand-edited into a case variant of it (path: Members/IRSS over a mount at members/IRSS): the finding says the row is the hand edit and to put members/IRSS back in the row's path:. It prints no command. Under --no-members no member-path finding says so, which is why this one must.
3. Otherwise (a canonical row whose only gitlink or section is at a case variant): the member is recorded in the wrong case, with the git log -p -- family.yaml restore sentence the unnamed gitlink always had. No command.

Decisions the ruling left open:

• "Otherwise" also takes a row that is itself hand-edited with a gitlink at a THIRD spelling (Members/IRSS row, gitlink at MEMBERS/IRSS), and a row with no project:. Nothing says either is a second path to a member that stands, so neither is told to remove it. The third case says "could un-register it" for that reason.
• The section finding's restore sentence carries the git log -p -- family.yaml parenthesis, as the brief names it. The section's non-variant text, which has none, is unchanged.
• A row's canonical path is members/<project> for a row with a project:, and unknown for one without.

NIT-1. git rm -- <path> takes the .gitmodules section out too, so the section's --unset-all lines exit 5 after it. Where two sections give one path (gitmodules-path-twice), git rm removes only the one git reads for it, the last in the file (probed on git 2.43, and the test asserts one section is left), so each of those keeps its own lines.

NIT-3. A gitlink at stages 1-3 only (made with update-index --index-info bytes) is no gitlink the holder records, and one HEAD records and the index holds only unmerged is named at HEAD's commit, not at a stage's.

How the state tests hold on a case-insensitive disk (macOS, Windows). None puts a second directory on disk. A gitlink is only an index record (update-index --index-info bytes, git rm --cached) and a commit of the index, which reads no directory, so the checkout at members/IRSS stays the one directory it is while the index says members/irss. The .gitmodules edit is hashed into git's objects and the same bytes are written to disk. The one hand edit, family.yaml, is a single file written as bytes. Members checked, state (ii) is the refusal member-gitlink-absent on a git that matches a pathspec exactly, which prints no finding (decision 3 of #367 is not taken), so only --no-members shows its finding. A git that matched the path in any case would find the variant and print the finding, so the test accepts either, and asserts that no command is printed in both. The macOS and Windows legs were not run here: CI is the gate.

Tests

One new file per issue. Every state is built in git's index and objects, with bytes on stdin, except one test that runs the remedy chain on a real git submodule add.

• tests/test_validate_family_unnamed_mounts.py (validate-family.py asks every members: row for its gitlink and never the reverse, so a gitlink under members/ that no row names (a member mounted by hand with git submodule add, or a row deleted by hand) and a .gitmodules section whose path no row names (what family.py remove leaves of two sections for one path, or a section for a case variant such as Members/Atlas, which add commits beside the member's own even after #317) all pass the holder's own gate, and the doctor calls the holder COMPLIANT #361):
  • the issue's rows (a), (b) and (c), each a finding in the default mode, --pins and --no-members;
  • a gitlink at a case variant, and its remedy run as printed;
  • the index-first, HEAD-second order;
  • members/ alone, in any case;
  • a deleted row;
  • each section's removal run as printed;
  • an index git cannot list;
  • the hand-mount remedy chain;
  • controls: the holder init and add made, and one add grew, pass in every mode;
  • fix round 1, 24 to 39 tests: a row hand-edited to Members/IRSS (state (i)), a member recorded only at members/irss (state (ii)), and a section whose only path is a case variant, each in every mode, with the finding's code, its sentence and no git rm or --unset-all; a third spelling beside an edited row; the hand mount's section naming the git rm above it, and two sections for that path keeping their lines; an unmerged gitlink, alone and beside HEAD's; and the add remedy quoting a project with a space or a quote.
• tests/test_validate_family_member_path_glob.py (validate-family.py keeps checking a member at the row's path: after it has found that path wrong (member-path), so a hand-edited path: "members/*" reaches recorded_gitlink as a glob pathspec, which answers with a neighbour's gitlink, and the run ends in member-uninitialized, whose remedy (git submodule update --init, make bootstrap) cannot help, while the member-path finding that names the hand edit is gathered and never printed #367):
  • six hand-edited spellings (members/*, members/I*, members/[I]*, :(glob)members/IRSS, members/IRSS/.., members/IRSS/) in both member modes print member-path, never member-uninitialized or a false mismatch, exit 1;
  • the other rows are still checked;
  • recorded_gitlink(root, "members/*") and three other globs are None in a holder with members and no file named *;
  • the four pathspec variables neither widen nor break it.
• tests/test_validate_family_without_git.py (validate-family.py's default and --pins modes end in a FileNotFoundError traceback, exit 1 (a finding's code), when git is not on PATH: on main for every holder with a member (recorded_gitlink through repo_shape.git_out), and after #317 still for a holder whose .gitmodules is gone, though #317's own check answers gitmodules-unreadable, exit 2, whenever the file is there #368), in-process, with the git runner patched to raise as a missing (or non-executable) program does. In each case: exit 2, the one code, no traceback.
  • in the default mode, --pins and --no-members;
  • with and without .gitmodules;
  • with git failing only in recorded_gitlink;
  • with git failing only inside a member.
• tests/test_family_add_refusals.py:
  • family.py: add refuses member-path-registered when a .gitmodules section under another name already gives the mount path, and validate-family.py finds gitmodules-path-twice, so add no longer commits two sections for one path that a recursive clone resolves to the later one, and a holder that already has such a ghost section fails its own gate (#300) #317's no-git test expects git-not-runnable;
  • its add-past-a-section control expects the one new gitmodules-path-unnamed finding for a section at another path.

Local targeted run. Linux, git 2.43.0, /usr/bin/python3 -m pytest -q, 16 files: the three new ones, test_validate_family_duplicates.py, test_family.py, test_family_add_refusals.py, test_family_member_path.py, test_family_add_excludes.py, test_family_dry_run.py, test_shape_doctor.py (the doctor calls recorded_gitlink), test_bump_leg.py, test_bump_leg_rollback.py, test_pin_validator.py, test_scaffold_e2e.py (the assembly root's validate-pins.py and bootstrap.py), test_repo_hygiene.py and test_template_values_single_pass.py.

• At a first local commit (5eba7d5, never pushed): 924 passed, 7 failed, 4 skipped. The 7 were validate-family.py member-duplicate runs only with the members checked and compares project: exactly, so --no-members passes a family.yaml that names one row twice, and rows IRRS and irrs with distinct ids pass, though members/IRRS and members/irrs are one directory on macOS and Windows #331's tests in test_validate_family_duplicates.py that dropped a mounted member's row, now fixed with keeping_mounts.
• At the pushed head (423fb25, every other file byte-identical, checked by sha256): that file 20 of 20 passed.
• Net at the pushed bytes: 931 passed, 0 failed, 4 skipped. None of the skips is in a new file.

Fix round 1 runs (Linux, git 2.43.0, /usr/bin/python3 -m pytest -q, committed bytes, sha256 recorded first):

• the six files of the brief's command that exist on this branch, plus test_repo_hygiene.py and test_template_values_single_pass.py: 472 passed;
• the brief's seven-file command, test_agents_md_codes.py included, on a scratch merge of this head onto main cb7063f (that test landed on main after this branch's base): 305 passed.

CI's three OSes are the gate.

Mutants, each run in a scratch worktree at 5eba7d5, whose code and mutant test files are byte-identical to the pushed head's, against the files named:

mutant	tests	result
the #361 checks moved after the --no-members return	test_validate_family_unnamed_mounts.py	killed: 11 failed, 13 passed
--literal-pathspecs removed from both listings	test_validate_family_member_path_glob.py	killed: 6 failed, 15 passed
the OSError clause in _git_runs removed	test_validate_family_without_git.py + #317's no-git test	killed: 14 failed, 1 passed
the member-path skip removed (the row goes on at its path)	test_validate_family_member_path_glob.py	killed: 11 failed, 10 passed
the environment scrub removed	test_validate_family_member_path_glob.py -k pathspec_setting	killed: 2 failed, 2 passed

Fix round 1 mutants, each run against tests/test_validate_family_unnamed_mounts.py at this head:

mutant	result
SHOULD-1 reverted to the old branch (_variant_case always the stray)	killed: 8 failed, 31 passed. Both state tests among them: state (i) in all three modes, state (ii) under --no-members (members checked it is a refusal, which prints no finding), the section state and the third spelling.
the stage-0 filter dropped from _member_gitlinks	killed: 2 failed, 37 passed, both unmerged-gitlink tests
NIT-1's --unset-all lines printed again	killed: 4 failed, 35 passed (the hand mount in three modes, and the real-mount chain)
the row-edited case never detected	killed: 3 failed
NIT-1's suppression kept for two sections for one path	killed: 1 failed
the --member value unquoted	killed: 2 failed
the stray case without the exact path held	killed: 4 failed

Follow-ups, not done here

• The assembly root's validate-pins.py ends in a traceback without git (validate-family.py's default and --pins modes end in a FileNotFoundError traceback, exit 1 (a finding's code), when git is not on PATH: on main for every holder with a member (recorded_gitlink through repo_shape.git_out), and after #317 still for a holder whose .gitmodules is gone, though #317's own check answers gitmodules-unreadable, exit 2, whenever the file is there #368's last row): filed as The assembly root's scripts/validate-pins.py ends in a FileNotFoundError traceback, exit 1, a finding's code, when git is not on PATH, because recorded_gitlink reaches repo_shape.git_out and nothing catches OSError, where the file's own exit codes give 1 to drift and 2 to a question that could not be asked: the sibling of #368, whose fix is ruled into validate-family.py only #412 and fixed in PR validate-pins.py: no git to run, or a git that cannot be executed, refuses git-not-runnable, exit 2, naming the leg's gitlink, pinned commit or tree digest it could not read, instead of a traceback that exits 1 where 1 is a finding, and only a git that will not start counts, so a leg directory nobody may enter is not told to put git on PATH (#412) #446, with the same code.
• The git-not-runnable wrapper also catches an OSError that is not git's, so an unreadable members/<P> with git on PATH is told git could not be run.
• recorded_gitlink still answers with the first gitlink under a path that is a directory (members) or climbs with .. (members/Nova/..). git normalizes .. and matches a leading directory even with --literal-pathspecs (probed). The validator no longer reaches it (the member-path skip), but other callers could. The fix would be an exact-path check on the listed record, or a listing with no pathspec, as family.py's _index_entries does.

Closes #361
Closes #367
Closes #368

🤖 Generated with Claude Code

Summary by Sourcery

Strengthen family validation by auditing recorded members in reverse, treating member paths literally, and converting unavailable Git into explicit refusals.

New Features:

• Detect unregistered gitlinks under members/ and .gitmodules sections whose paths are not named by family rows, including case-variant paths, in all validation modes.

Bug Fixes:

• Prevent hand-edited member paths from being interpreted as glob patterns or triggering misleading downstream checks.
• Report missing or non-runnable Git as a structured git-not-runnable refusal instead of an uncaught traceback.
• Preserve correct index-versus-HEAD gitlink resolution and handle unmerged index entries without false findings.

Enhancements:

• Make recorded gitlink lookups literal and robust against conflicting global Git pathspec environment settings.
• Provide actionable, state-aware remediation guidance for unnamed gitlinks and submodule sections.
• Apply the shared gitlink lookup fixes to all copied shape-tool callers.

Tests:

• Add coverage for unnamed mounts and sections, case-variant paths, literal path handling, unmerged gitlinks, remediation commands, and missing Git across validation modes.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 days and 3 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR hardens family validation by finding unregistered gitlinks and .gitmodules paths in every mode, preventing malformed member paths from triggering checks through glob-like paths, and replacing missing-git tracebacks with explicit exit-2 refusals; shared literal gitlink lookup behavior is implemented in scripts/repo_shape.py and covered by targeted regression tests.

Flow diagram for family validation findings and refusals

flowchart TD
    Start["validate-family.py"] --> Checks["Run checks before --no-members return"]
    Checks --> Gitmodules["Read .gitmodules sections"]
    Checks --> Gitlinks["List index and HEAD gitlinks"]
    Checks --> Rows["Build paths named by members rows"]
    Gitmodules --> UnnamedSection{"Section path named by a row?"}
    Gitlinks --> UnnamedLink{"Gitlink path named exactly?"}
    Rows --> MemberPath{"Row path is expected?"}
    UnnamedSection -->|No| SectionFinding["gitmodules-path-unnamed"]
    UnnamedLink -->|No| LinkFinding["member-gitlink-unnamed"]
    MemberPath -->|No| PathFinding["member-path; stop row checks"]
    Checks --> GitRunnable{"Git can be started?"}
    GitRunnable -->|No| GitRefusal["git-not-runnable; exit 2"]
    GitRunnable -->|Yes| Continue["Continue validation"]

Loading

File-Level Changes

Change	Details	Files
Detect repository state that is not represented by family rows and report actionable findings.	List gitlinks under any case variant of members/ from the index or HEAD, preferring stage-0 index entries. Parse .gitmodules once and detect sections whose paths no row names, including case-variant paths. Run these checks before --no-members and provide per-finding cleanup or restoration commands. Preserve gitmodules duplicate-path validation over the shared parsed sections.	templates/family-root/scripts/validate-family.py tests/test_validate_family_unnamed_mounts.py tests/test_family_add_refusals.py tests/test_validate_family_duplicates.py
Make member path validation authoritative and make recorded gitlink lookups literal and environment-safe.	Stop member gitlink, tree, and identity checks after a noncanonical path produces member-path. Pass --literal-pathspecs to ls-files and ls-tree so edited paths cannot act as globs. Remove incompatible global pathspec environment variables from these git calls. Propagate the shared repo_shape fix to copied project and holder scripts through the canonical implementation.	scripts/repo_shape.py templates/family-root/scripts/validate-family.py tests/test_validate_family_member_path_glob.py
Convert missing-git crashes into consistent validator refusals.	Add _git_runs around every validator git-reading operation and return git-not-runnable with exit 2 when git cannot start. Keep gitmodules-unreadable for git execution failures after git has started, and preserve gitlinks-unreadable for an unreadable index. Allow OSError to propagate from recorded_gitlink so missing git is not mistaken for an absent gitlink. Exercise default, pins, and no-members modes plus failures in holder and member git operations.	scripts/repo_shape.py templates/family-root/scripts/validate-family.py tests/test_validate_family_without_git.py tests/test_family_add_refusals.py

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#361	Make the holder validator reject gitlinks under members/ that no member row names, and .gitmodules sections whose path no row names, including the issue’s hand-mounted, deleted-row, stale-section, and case-variant states.	✅
#367	Do not run a member’s gitlink, tree, or identity checks through a row path after that path has failed the member-path validation.	✅
#367	Make recorded_gitlink interpret paths literally for every caller, so glob-like row paths cannot match a neighboring gitlink.	✅
#367	Ensure findings gathered before a refusal are not silently discarded, either by printing them or by handling the member’s refusal as a finding.	❌	The PR explicitly leaves this behavior unchanged. Skipping checks for an invalid member path prevents the reported glob-path repro from ending in member-uninitialized, so its member-path finding is printed; however, findings gathered before other refusals can still be dropped.
#368	Make validate-family.py refuse with exit 2, without a traceback or exit 1, when git cannot be started in the default, --pins, and other applicable modes—including when .gitmodules is missing.	✅
#368	Ensure a missing git is not misreported as an absent gitlink or as an unreadable .gitmodules file, and use a consistent refusal code for git that cannot run.	✅
#368	Prevent the same missing-git traceback in the assembly root’s validate-pins.py, which also uses the shared recorded_gitlink helper.	❌	The PR explicitly leaves the assembly root’s validate-pins.py traceback for a follow-up. Its handling of OSError is in validate-family.py, not in the shared helper, so this caller remains affected.

Possibly linked issues

• validate-family.py asks every members: row for its gitlink and never the reverse, so a gitlink under members/ that no row names (a member mounted by hand with git submodule add, or a row deleted by hand) and a .gitmodules section whose path no row names (what family.py remove leaves of two sections for one path, or a section for a case variant such as Members/Atlas, which add commits beside the member's own even after #317) all pass the holder's own gate, and the doctor calls the holder COMPLIANT #361: The PR adds reverse checks for unnamed gitlinks and .gitmodules paths in every mode, directly fixing the issue.
• validate-family.py keeps checking a member at the row's path: after it has found that path wrong (member-path), so a hand-edited path: "members/*" reaches recorded_gitlink as a glob pathspec, which answers with a neighbour's gitlink, and the run ends in member-uninitialized, whose remedy (git submodule update --init, make bootstrap) cannot help, while the member-path finding that names the hand edit is gathered and never printed #367: The PR skips member checks after member-path and makes recorded_gitlink use literal pathspecs, directly fixing the issue’s core defects.
• validate-family.py's default and --pins modes end in a FileNotFoundError traceback, exit 1 (a finding's code), when git is not on PATH: on main for every holder with a member (recorded_gitlink through repo_shape.git_out), and after #317 still for a holder whose .gitmodules is gone, though #317's own check answers gitmodules-unreadable, exit 2, whenever the file is there #368: Link: the PR catches missing-git errors in family validation and returns git-not-runnable with exit 2 instead of a traceback.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud