[brettheap]

Lane: openreposhape-1 (openRepoShape-1)
Claim: #188 (comment)
Claim: #177 (comment)
Claim: #171 (comment)

Described at head 92c72c1, which contains main 92e29d9. The pull request's head is 9f19afe: gh pr update-branch merged main cb7063f into 92c72c1 (2534d85), then main dd8d0ea (9f19afe), both cleanly.

What

The change is in adopt-project.py, plus one sentence of AGENTS.md. Everything else is tests.

Every failure once a leg repository exists is reported where it happens (#171, #188). run only raises. On main, _build_the_legs returns None in silence, so a failed git filter-repo ends with exit 2 and an empty stderr, with both leg repositories made (#171). Everything after the legs falls through to a bare REFUSED <step>, or to main's generic handler, printed ahead of the bare lines in a merged log (#188). Now every step that runs once a leg repository exists reports its own failure the same way:

1. stdout is flushed first;
2. then REFUSED <step>. and what failed: for a command, the exact command, where it ran, its exit code and its output;
3. then one notice of what the run left.

The steps are:

• creating the code leg repository, once the spec leg's exists;
• extracting or seeding the <role> leg;
• pushing the <role> leg, or pushing the seeded <role> leg;
• cloning the source for the split;
• mounting the legs;
• committing the split;
• pushing the split branch;
• verifying the split.

A closed stdout cannot swallow the report: the flush ignores the BrokenPipeError.

Not only a failed command (#184 P3-1, #188 N3). Three more kinds of failure are reported the same way, and exit 2:

• a Refusal raised on the way: git_out's, the materializer's, or adopt-project.py: the leg mount passes --force to git submodule add, so a source whose .gitignore is * + !.gitignore, or names spec or code, adopts instead of dying at the mount after both leg remotes were pushed (#174) #200's mount guard's;
• an OSError: a read-only work directory, a symlink loop the materializer walks into, or git gone from PATH;
• a UnicodeError: git_out (scripts/repo_shape.py) still decodes git's stdout strictly.

On main, each of these escapes, either as a refusal with no notice or as a traceback with exit 1. A Refusal keeps its own remediation, unless that is the validators' generic remediation about pins. Anything else, a defect or Ctrl-C, gets STOPPED <step> by <Type>. and the notice, and is then re-raised with its traceback.

One notice, _nothing_rolled_back. It:

• names the leg repositories that exist, and says which legs are pushed: neither, the spec leg, or both;
• starts the way out with the cause: "Once what failed above is fixed, re-run the adoption with them deleted or with fresh ones" (adopt-project.py: a failure AFTER both legs are pushed (the split-branch push, the mount, the split commit) prints only REFUSED <step> with no notice of what already exists and no stdout flush, so the combined log shows REFUSED before the bare … lines and the re-run meets leg-remote-exists unexplained #188's review, F2). A re-run while the cause is still there fails the same way, one more pair of leg repositories behind it. Only an interrupt (Ctrl-C), which failed at nothing, is told "Re-run" alone (re-verification R2). A defect fails the same way on every re-run, so it is told to fix it first, as a refusal is;
• says why a re-run that meets the legs is refused: leg-remote-exists under --local-remote-dir, and against GitHub a gh repo create that finds the name taken;
• names the work directory when, and only when, this run built or cloned something there, read off the disk: "Use a fresh --work-dir as well, or none: <work> holds Northwind-spec, Northwind-code and Northwind from this run, and execute refuses a --work-dir that holds them." (adopt-project.py: execute prints the command and its stderr when a leg cannot be built, so a git filter-repo that fails after both leg remotes exist no longer exits 2 with an empty stderr (#171) #184 P2-1, review N2). That counts the source's own clone too, which an org/repo source makes in <work>/source-readonly/<repo> (re-verification R3). A failure before anything was built or cloned leaves the sentence out.

When the code leg's repository cannot be created after the spec leg's was, the notice names the spec repository alone, "and nothing is pushed to it". main then exits 2 without printing the failure a second time. That holds for a gh that cannot be run at all, too (#188 N4).

execute refuses, before it creates anything, what an earlier run left behind. These are new refusals, in this order:

• adopt-work-dir-occupied (review F1). A --work-dir that holds anything but an empty directory at <work>/<spec leg>, <work>/<code leg> or <work>/<assembly> is refused. On main, such a run made both legs and then died at git clone into a directory an earlier run had built in. Remediation: "no leg repository was created and nothing was pushed. Pass a --work-dir that is new or empty, or none: without one, each run makes a new one." A run without --work-dir, or with a new or empty one, is never refused, and neither is a run for its own source clone. The detail ends with the reason of what builds in each occupied directory: "git clone refuses a directory that is not empty" for an extracted leg and the split, and "a seeded leg is written and committed in its own directory, and only in one that is new or empty" for a seeded leg, which is never cloned (9be2b05 and 92c72c1, rv188f's N-1 and N-2). On main, a person's own files and history left in a seeded leg's directory went into the new leg and were pushed.
• adopt-branch-exists (adopt-project.py: a failure AFTER both legs are pushed (the split-branch push, the mount, the split commit) prints only REFUSED <step> with no notice of what already exists and no stdout flush, so the combined log shows REFUSED before the bare … lines and the re-run meets leg-remote-exists unexplained #188 N1). The split branch already on the assembly at a commit the split push cannot fast-forward is refused, with the command that deletes it, quoted for sh (adopt-project.py: a failure AFTER both legs are pushed (the split-branch push, the mount, the split commit) prints only REFUSED <step> with no notice of what already exists and no stdout flush, so the combined log shows REFUSED before the bare … lines and the re-run meets leg-remote-exists unexplained #188 N5). A branch at the source commit or behind it is pushed over as on main (review N1). The remediation also covers a plan whose adopt_branch: names a branch of the source's own. Under --local-remote-dir, a leg repository still on disk keeps leg-remote-exists first.

Every path these messages name is spelled as a finding spells it (#212). Main's 5751460 has check and execute name a path in a FINDING or a refusal with _spelled: between backticks, with a backslash escape for a backslash, a backtick and any character str.isprintable refuses. This pull request's own messages do the same (e507c42):

• the notice: the leg repositories, the work directory, and what it holds;
• the notice's split line: the assembly and the branch;
• adopt-work-dir-occupied: the work directory and what it holds;
• adopt-branch-exists: the assembly and the branch.

A leg repository under --local-remote-dir, the work directory and a local source are paths a person chose. One whose name holds a line feed, U+0085 or U+2028 split the notice's one line, and a carriage return or an ESC overwrote it. Now a path reads the same in a finding, in the notice and in the two refusals. The branch deletion is not spelled: it is a command to paste, so it stays quoted for sh (shlex.quote). Two texts that this pull request prints but does not write keep main's raw spelling, as 5751460 left them: the REFUSED block's command and its (in <dir>) line (CommandFailed.loudly, scripts/shape_materialize.py), and leg-remote-exists' <bare> already exists.

A failed verification (#188 N1) flushes stdout before its findings, so they come after every line the run printed. Its exit is still to fix the plan and re-run, unless a finding names another exit. It is followed by the notice and by the split branch this run pushed, with the command that deletes it. It still exits 1. The shape-file finding's own exit now points there: "send that path to a leg or drop it, and re-run as the end of this report says". A verification that cannot be made at all (review N3), such as a git that will not list a tree, gets REFUSED verifying the split., the notice and the branch, and exits 2.

#177 and #188 N2: a refused leg push prints the adoption's own hint. Both leg builders print ADOPT_RULESET_HINT, not the scaffold's RULESET_HINT. The scaffold's hint does not fit an adoption:

• Its second exit, git -C <work> push -u origin main:seed/scaffold, fails in a clone git filter-repo rewrote, with fatal: 'origin' does not appear to be a git repository.
• It says "re-run this scaffold".
• It says "listed above" of lines that a merged log prints after it.

The adoption's hint names ONE exit: an operator holding the bypass right re-runs the adoption, once what the notice below names is cleared. It says why the seed exit cannot finish an adoption: the leg is a repository this run created, and its first push is the one refused, so it has no main for a pull request to target. It prints no command. It ends "Under such a ruleset, that bypass is the fix the notice below asks for, never a change to the ruleset." (re-verification R4). The notice follows it. #177 asked for a test that runs the printed push. No push is printed now, so the tests assert that no command line is printed and that the refused leg remote holds no ref, as the hint says. The one command this pull request adds to the output, the branch deletion, is run by two tests exactly as pasted.

AGENTS.md step 7 (review F3) is main's exit-keyed text (#304, a983e6a), and its exit 1 way out says what the tool prints: "so fix the plan, delete the split branch, and re-run into fresh legs and a fresh --work-dir, or none." That makes AGENTS.md 482 lines, one more than main's 481, and c2f3118 raises the cap in tests/test_repo_hygiene.py to 482 with a dated reason. A test reads each half of the step.

Ordering, so the notice is exact. The substitution table is built before the leg repositories are created, so its refusals leave nothing behind (an elected_on that is not a date, for example). Each leg builder reads its commit count and tree digest before it pushes. A read that fails after the push therefore cannot make the notice call a pushed leg unpushed.

After the split is pushed, a gh that cannot be run at all is handled like one that refused, after a stdout flush. The topic then gets its by-hand commands at once. The pull request gets main's by-hand command after the verification table, and only for a split that passed; one that failed or could not be verified gets "No pull request was opened, and none should be" instead (a983e6a).

With #200 (#174), the mount guard's refusals, adopt-mount-occupied and adopt-mount-unaddable, come after both legs are pushed, so they are late failures too. The run prints REFUSED mounting the legs., #200's own remediation, and the notice. The exit is 2, as on main.

Exit codes. A refusal exits 2, a failed verification 1 and a success 0, as on main. What changes is the failures that escaped as a traceback with exit 1 once a leg repository exists, an OSError or a gh that cannot be run among them. They are now reported, and execute exits 2. As on main, a failed verification's 1 outranks a missing topic. A run whose topic will not set and whose verification then cannot be made exits 2 with the topic's IS pushed commands and, after them, the notice; its way out is the notice's re-run, though AGENTS.md step 7 sends an exit 2 that says IS pushed to the printed command (rv188f's N-3, two failures in one run).

With main's own changes since the last round (5751460, d94d155, b30595c, 6d8d88b, 71b58a1, 346079d, a1b3a4b, f795cf7, 161c6c9, 1f90a0f and 92e29d9 are merged; Why, cases 9 to 14):

• 06b5204 escapes a name stdout cannot encode. The notice and every REFUSED block are on stderr, which Python opens with backslashreplace, so they print in full, the work-directory sentence and the branch line included. What the merge adds is that a stdout line before them no longer raises. At 5a8b649, before this merge, print(f" bare {bare}") raised UnicodeEncodeError on such a name, after the spec leg's repository was made, and execute exited 1 with a traceback and no notice.
• 60d08a1 has run() decode as UTF-8. Output that is not ASCII now reaches the same handlers as CommandFailed. A refused leg push then takes its own route: REFUSED pushing the spec leg., the hint, and the notice. At 5a8b649 under LC_ALL=C PYTHONUTF8=0 it was REFUSED extracting the spec leg. UnicodeDecodeError: ..., without the hint. 60d08a1 also gave the Free-plan probe's gh api a codec. That probe was the one call after both legs exist that could still escape unreported, with a UnicodeDecodeError.
• aaa40eb refuses a .gitmodules that the history's gitlinks make unreadable, and c2ff2b0 (adopt-project.py check accepts a .gitmodules value git's submodule reader rejects (update = bogus, update =, update = !cmd, shallow = maybe, fetchRecurseSubmodules = bogus), so plan ok is followed by execute dying in git filter-repo after both leg remotes exist, whether the tip or only the history holds the gitlink #215) a .gitmodules value git's submodule reader refuses (update = bogus, shallow = maybe). Both are _entry_findings, raised by _refuse_what_check_finds before _create_leg_remotes, so nothing exists yet and no notice is due. Main's own test_execute_refuses_it_before_any_leg_exists, in tests/test_adopt_history_gitlinks.py and tests/test_adopt_gitmodules_values.py, runs this branch's cmd_execute and asserts that the remotes directory is never made. Before this branch merged them, each source made both legs and died in git filter-repo's git fast-export, and this branch's notice reported it (cases 11 and 12). A value that check reads differently from the installed git still takes that path, notice included.
• 5751460 (adopt-project.py check and execute print a source path raw in a FINDING, so a \r, \n, \x85, U+2028 or ESC in a name overwrites, splits or escapes the line on a terminal, where plan's questions spell the same path with _spelled #212) spells the paths a finding or a refusal names. This branch's notice and two refusals now spell theirs the same way (e507c42).
• 6f45bf9 (adopt-project.py check accepts plan paths execute refuses as unsafe-value (a space or a non-ASCII character), so plan ok is followed by a refusal and #166's split instructions can name entries execute will refuse #196) judges an entry's path by one test, and 71b58a1 (adopt-project.py check passes a plan that keeps the source's own shape/ in the root, and place() then writes the shape's collision copy onto it after both legs are pushed: a real shape/README.md is overwritten while execute prints "nothing was overwritten" and ends adopt-lost, and a shape/Makefile/ directory or a file named shape is a traceback #262, adopt-project.py check passes a plan that keeps a plain file at a directory the shape writes into (.github, contracts, scripts), and execute dies in a NotADirectoryError or FileExistsError traceback after both legs are pushed #263) finds a kept root path where the shape writes a directory or its shape/ copy. Their findings are _entry_findings as well, refused before any leg exists. 71b58a1 also gives the materializer a refusal of its own, materialize-copy-blocked, for a run that reaches it without check's finding. That one is raised inside _commit_the_split, after both legs are pushed, so this branch reports it like any late failure: REFUSED committing the split. materialize-copy-blocked: …, its own remediation, and the notice, with exit 2. On main it escapes cmd_execute, and main's test expected that; 9d8aadd makes the test read the report instead, as 8d4fef4 did for adopt-project.py: the leg mount passes --force to git submodule add, so a source whose .gitignore is * + !.gitignore, or names spec or code, adopts instead of dying at the mount after both leg remotes were pushed (#174) #200's mount guard. 346079d (adopt-project.py plan's cross_leg_references passes a spec directory's name to git grep -F with no -e and the code entries as glob pathspecs, so a spec directory named -notes or a code entry named :cache silently drops the follow-up, a code entry named * names files that are not in the code leg, a name outside ASCII is printed in git's quoted spelling, and a spec directory named -O<cmd> is run as git grep's pager when a tracked file holds the planned commit's hash #216) has _stage_the_split add with git --literal-pathspecs, also after both legs are pushed, where any failure is reported.
• e43fa95 (adopt-project.py execute clones the source with the operator's init.templateDir applied, so a template holding modules/spec and modules/code makes the leg mounts' --force (#200) reactivate those planted stores: both gitlinks pushed on the split branch are a stranger's commit, the VERIFICATION still says adoption verified because it checks a mount is present and not which commit, and the recursive clone of the result exits 128 #243) clones the assembly root with no git template (--template=), and adds a verification finding, adopt-mount-commit, for a mount that is not the commit pushed to its leg. The clone is inside this branch's try: in _commit_the_split; that was the merge's conflict, resolved keeping both. So a clone that fails is still reported under cloning the source for the split. The new finding is a verification finding, so the footer, the notice and the branch line follow it. A git rev-parse that fails while it reads the pushed commits is REFUSED verifying the split. with the notice. 90d6077 gives main's new _verify tests the urls and the branch, as 97abf4c did for adopt-project.py _verify skips every root gitlink and compares a kept root .gitmodules byte for byte, so any plan that keeps a source submodule or its .gitmodules in the root ends with exit 1 and adopt-lost #165's.
• f795cf7 (adopt-project.py: since #247 a byte that is not UTF-8 in --elected-by, --reference or the --source directory passes plan and check, and execute pushes both legs before it dies with UnicodeEncodeError in write_lf #255) asks in plan, check and execute whether a file can hold each value execute writes. Its refusals all come before _create_leg_remotes. The case it fixes was a late failure here, reported with the notice; merged, it is refused before any leg exists, as on main (Why, case 13).
• 161c6c9 (adopt-project.py: a relative .gitmodules url the plan keeps in a leg is resolved from the source's remote and from the leg's, and where the two differ check finds it and execute refuses before any leg exists, so a recursive clone no longer fails after adoption verified (#190) #245) resolves a relative .gitmodules url a leg keeps from the source's remote and from the leg's. Its finding is check's, refused before any leg exists. ab623dd (tests: 149 tests in four files run the operator's real gh (407 calls to gh --version and gh auth status, and gh api user besides with a login) through the doctor's machine row and the installed command's machine block, so a suite whose conftest says "NO NETWORK AND NO GITHUB" reaches the host on a logged-in machine, and the one gh stub the doctor tests have is called by that row without the test seeing it #296) fails a test whose gh calls its guard refuses; the 54-file set passes under it.
• a983e6a (AGENTS.md step 7 tells an agent that a non-zero adopt-project.py execute exit is to fix the plan and re-run into fresh legs, but in GitHub mode execute exits 2 with the split pushed when gh pr create is refused, and exits 2 after adoption verified when the topic will not set, so following step 7 abandons a pushed adoption whose own exit is a command to run by hand #304) verifies before it exits on a refused gh pr create, and prints the command to open the pull request by hand after the table, only for a split that passed; NEXT is said once, by _next_steps. The pull request step keeps this branch's reach (a gh that cannot be run is reported like one that refused) and its flush; the by-hand command is main's, printed once, after the table. A split this branch cannot verify after a refused pull request gets REFUSED verifying the split., the notice and "No pull request was opened, and none should be" (Why, case 14). Step 7 keeps main's exit-keyed text, with this branch's exit 1 way out. 92e29d9 (adopt-project.py plan writes leg: spec with no question for a source path that execute will refuse (-notes.md), so the answer check or execute then rejects is one plan chose for the person, and root or drop is offered for that entry nowhere #319) changes only plan.
• d94d155, ede15ce and 87373a6 (shape-doctor.py), c3a9645 and 7491530 (scaffold-project.py's --pin and --help, with AGENTS.md and README), b30595c and 34ecbc2 (repo_shape.py's quoted scalars, and render() in scripts/shape_materialize.py), b421e6b (the validators' PYTHONIOENCODING), be2790e, 8a14ac9 and c1b6732 (update-shape.py), 86da808 (bump-leg.py), 6d8d88b, c0ed615, c7c02fa and 6f4ce47 (family.py), 7591455 (tests/conftest.py's git() identity), a1b3a4b (a test), 8cdca5e (validate-pins.py), db19187, 0f67f7b and 3ae0109 (family.py and validate-family.py), a2cb7d3 and 1f90a0f (bump-leg.py and update-shape.py, and pin-rewrite helpers in scripts/shape_materialize.py that adopt-project.py does not call), d82a83e (scaffold-project.py), 8325d05 (shape-doctor.py) and 28bdc84 (single-repository.yaml) change nothing the late failures go through. be2790e's update-shape.py notice labels its command NEXT because it finishes the job; this notice's deletion does not, so it is not labelled.

In this round's eleven merges, the definitions the late failures go through change only by main's own hunks: main() (06b5204), run() (60d08a1), _extract_leg's path listing and _mount_the_legs' git rm (6f45bf9), the materializer (71b58a1), _stage_the_split's git add (346079d), the split clone's --template= and the verification's mount-commit finding (e43fa95), Source.open and a refusal after _repository_urls (f795cf7), and the pull request step, _verify's NEXT and the end of cmd_execute (a983e6a). e507c42 changes how four of them spell a path, and 9be2b05 the reason adopt-work-dir-occupied gives.

Unchanged. scaffold-project.py, scripts/ (so the scaffold's RULESET_HINT and its callers), the setup scripts, templates, shape-doctor.py, update-shape.py, docs and README.md. AGENTS.md changes in step 7 only. git diff 92e29d9 bbdd313 --stat lists AGENTS.md, adopt-project.py, tests/conftest.py and eight test files, and nothing else.

A successful adoption is byte-identical to main's. A branch at the source tip is pushed over and verifies on both trees (case 6).

Commits.

• 5cd06c7, 41ab8ca, f416e13: adopt-project.py execute exits 2 with nothing on stderr when git filter-repo fails, after both leg remotes exist: _build_the_legs swallows CommandFailed on the premise that run already reported it, and run only raises #171, from PR adopt-project.py: execute prints the command and its stderr when a leg cannot be built, so a git filter-repo that fails after both leg remotes exist no longer exits 2 with an empty stderr (#171) #184.
• c77cef0: adopt-project.py: a failure AFTER both legs are pushed (the split-branch push, the mount, the split commit) prints only REFUSED <step> with no notice of what already exists and no stdout flush, so the combined log shows REFUSED before the bare … lines and the re-run meets leg-remote-exists unexplained #188 and RULESET_HINT advises push -u origin ... from an extracted leg whose origin filter-repo removed, and says "listed above" of lines a combined log prints after it #177, first round.
• 68d4d63: the two copy_tree test stubs return what they wrote, as copy_tree has since scaffold-project.py (and git_init_commit in shape_materialize.py, scripts/family.py) stages the first commit with git add -A -- ., so a global core.excludesFile silently drops .gitattributes, .github/, .gitignore, contracts/* and scripts/* from a freshly scaffolded repository: the same class as #167, on the scaffold side #175.
• d07e94a: the review round, lane 2's adopt-project.py: execute prints the command and its stderr when a leg cannot be built, so a git filter-repo that fails after both leg remotes exist no longer exits 2 with an empty stderr (#171) #184 P1-1, P2-1 and P3-1, and adopt-project.py: a failure AFTER both legs are pushed (the split-branch push, the mount, the split commit) prints only REFUSED <step> with no notice of what already exists and no stdout flush, so the combined log shows REFUSED before the bare … lines and the re-run meets leg-remote-exists unexplained #188 N1-N5.
• 8d4fef4: adopt-project.py: the leg mount passes --force to git submodule add, so a source whose .gitignore is * + !.gitignore, or names spec or code, adopts instead of dying at the mount after both leg remotes were pushed (#174) #200's three mount-guard tests read the reported refusal.
• 97abf4c: main's adopt-project.py _verify skips every root gitlink and compares a kept root .gitmodules byte for byte, so any plan that keeps a source submodule or its .gitmodules in the root ends with exit 1 and adopt-lost #165 _verify tests pass the urls and the branch _verify now names.
• 5dbda31: adopt-work-dir-occupied, the fix-first notice, and the work-directory sentence read off the disk (review F1, F2, N2).
• 837ccf9: adopt-branch-exists only for a branch the push cannot fast-forward (review N1).
• 855886d: a verification that cannot be made (review N3).
• b750950: AGENTS.md step 7 (review F3).
• bbfcfd9: test literals named once (review N6).
• cdfb308: tests for three changes no test read.
• 5a30b77: test_adopt_ignored_shape_files.py reads the shape-file finding's new exit (re-verification R1).
• 48e93bb: only an interrupt is told to re-run with nothing to fix (R2).
• 0d2256e: the hint's last sentence (R4).
• 03b381a, 5a8b649: the notice counts the source's own clone, and its tests (R3).
• e507c42: the notice and the two refusals spell every path they name (adopt-project.py check and execute print a source path raw in a FINDING, so a \r, \n, \x85, U+2028 or ESC in a name overwrites, splits or escapes the line on a terminal, where plan's questions spell the same path with _spelled #212).
• 9d8aadd: main's check-skipped materializer test (71b58a1) reads the refusal execute reports.
• 90d6077: main's adopt-project.py execute clones the source with the operator's init.templateDir applied, so a template holding modules/spec and modules/code makes the leg mounts' --force (#200) reactivate those planted stores: both gitlinks pushed on the split branch are a stranger's commit, the VERIFICATION still says adoption verified because it checks a mount is present and not which commit, and the recursive clone of the result exits 128 #243 _verify tests pass the urls and the split branch.
• 9be2b05: adopt-work-dir-occupied gives each directory the reason of what builds in it (the confirmation check's N-1).
• c2f3118: the AGENTS.md cap at 482, and the gh-step test reads the by-hand command where cmd_execute now says it (both for the merge with a983e6a).
• 92c72c1: adopt-work-dir-occupied's seeded-leg reason states the rule, not what a commit would take in (rv188f's N-2).

Main was merged nineteen times, never rebased:

• bbc7e53: f25d805.
• d5f8961: 22c9fdd.
• 91a5dc9: e4decfb, adopt-project.py: a plan that sends .gitmodules to one leg and a submodule it registers to another passes check and execute, says adoption verified, and the assembly's recursive clone then fails: plan should ask, check should find, execute should refuse #166 via adopt-project.py: a plan that sends a source's .gitmodules to one leg and a submodule it registers to another, or keeps either in the root, is now a check finding and an execute refusal, and plan asks the one-leg question on .gitmodules itself (#166) #194.
• b09fcc9: 20e13f0, adopt-project.py accepts a leg mount path that collides with a directory the shape writes, such as --spec-path contracts, so the adoption fails after both legs are pushed (main: at the first bootstrap) #172 and adopt-project.py: a source entry the plan keeps at the root at a leg mount path (a submodule, directory or file named spec or code) passes check as plan ok and dies at the mount after both leg remotes are pushed, so the re-run meets leg-remote-exists #191 via adopt-project.py: a leg's mount path must not be, hold or lie inside a path the assembly root holds, so --spec-path contracts no longer checks ok and dies staging the split after both legs are pushed, and --code-path project.yaml no longer says adoption verified over an assembly with no manifest (#172) #198. One conflict, on the from shape_materialize import block; both sides kept.
• c7997fc: 8df21e6, scaffold-project.py accepts a non-canonical leg path such as --spec-path spec/, writes a stray submodule.spec/.url beside a registration that points at the work directory, and the new repository's recursive clone fails once the work directory is gone: #169's bug on the scaffold side #179 via scaffold-project.py: a leg's mount path must be canonical or it is refused before anything is created, so --spec-path spec/ no longer scaffolds a project whose recursive clone fails once the work directory is gone (#179) #201.
• 9092fda: a5b09c3, adopt-project.py _mount_the_legs runs git submodule add without --force, so a source .gitignore that hides a mount path (* + !.gitignore, or spec/code) dies at the mount AFTER both leg remotes are pushed, and nothing in check warns #174 via adopt-project.py: the leg mount passes --force to git submodule add, so a source whose .gitignore is * + !.gitignore, or names spec or code, adopts instead of dying at the mount after both leg remotes were pushed (#174) #200. A clean merge, which broke the three tests 8d4fef4 fixes.
• e52f6be: 54aa69a, adopt-project.py _verify skips every root gitlink and compares a kept root .gitmodules byte for byte, so any plan that keeps a source submodule or its .gitmodules in the root ends with exit 1 and adopt-lost #165 via adopt-project.py: verification passes over the two leg mounts and no other gitlink, so the source's own submodule kept in the root is adopt-root-submodule, any other root gitlink adopt-unexpected-gitlink, one in a leg AND the root adopt-duplicated, and a missing mount adopt-mount-missing (#165) #173. Four conflict hunks at _verify, both sides kept; 97abf4c fixes main's new tests.
• f340eab: 39ac59c, scaffold-project.py _build_assembly_root runs git submodule add without --force, so a leg path an ignore rule matches (--code-path __pycache__ or .DS_Store under the shape's own .gitignore, or the default spec under an operator's global excludes) passes --dry-run, then dies at the mount AFTER all three repositories exist and both legs are pushed #229 via scaffold-project.py: the leg mount passes --force to git submodule add, so a leg path an ignore rule matches (__pycache__, .DS_Store, or the default spec under an operator's own excludes) scaffolds instead of dying at the mount after all three repositories exist and both legs are pushed (#229) #235. Clean.
• 5677c0f: 5751460, adopt-project.py check and execute print a source path raw in a FINDING, so a \r, \n, \x85, U+2028 or ESC in a name overwrites, splits or escapes the line on a terminal, where plan's questions spell the same path with _spelled #212 via adopt-project.py: check and execute spell every path a FINDING or a refusal names as plan's questions spell it, so a source name holding a carriage return, a line feed, U+0085, U+2028 or an ESC no longer overwrites, splits or escapes the line it is printed on (#212) #223. Clean. In the three files both sides changed, the merge's diff against each parent equals the other side's own diff.
• 3196491: d94d155. Clean; main's five commits change no file of this branch's.
• fe5ecd5: b30595c, adopt-project.py check accepts a .gitmodules value git's submodule reader rejects (update = bogus, update =, update = !cmd, shallow = maybe, fetchRecurseSubmodules = bogus), so plan ok is followed by execute dying in git filter-repo after both leg remotes exist, whether the tip or only the history holds the gitlink #215 via adopt-project.py: a .gitmodules value git's submodule reader refuses (update = bogus, update =, update = !cmd, shallow = maybe, fetchRecurseSubmodules = bogus) is a check finding and an execute refusal, so execute no longer dies in git fast-export after both leg repositories exist, whether the tip or only the history holds the gitlink (#215) #240 among three. One conflict, in tests/conftest.py, where both sides append after resolve(); both kept, main's block first. In adopt-project.py and tests/conftest.py, the merge's diff against each parent equals the other side's own diff (in tests/conftest.py, but for where git places two added blank lines).
• 918e8f2: 6d8d88b, update-shape.py apply --branch --push --pr: when gh pr create fails after the commit and the push succeeded, it exits 2 with "REFUSED committing the re-synced shape" and no NEXT line, and a re-run on that branch says "nothing to do" and exits 0, so the tool never opens the pull request #204 via update-shape.py: a push or gh pr create that fails after apply --branch committed is named as that step, keeps the commit and ends on a NEXT line, and a re-run with --pr on the branch opens the missing pull request, so the tool no longer refuses "committing the re-synced shape" and then answers "nothing to do" (#204) #227 and family.py add mounts the member before it checks --at or the member's project.yaml, so a refused add (a leg, a short --at) leaves a staged gitlink, a .gitmodules registration and a cached object store, and the next add of a different member commits the refused leg's registration while validate-family.py and the doctor say ok #203 via family.py: add asks every refusal of the holder and of a throwaway clone of the member before it mounts anything, and unwinds and names whatever fails after the mount, so a refused add (a leg, a short or unknown --at, an empty member) no longer leaves a staged gitlink and .gitmodules section that the next add commits under its own title (#203) #236. Clean; neither changes a file of this branch's.
• 922f2d8: 71b58a1, five commits, adopt-project.py check accepts plan paths execute refuses as unsafe-value (a space or a non-ASCII character), so plan ok is followed by a refusal and #166's split instructions can name entries execute will refuse #196 via adopt-project.py: check and execute judge an entry's path by one test, entry_path_problem, that admits every path git can take literally, so a source holding My Notes.md no longer checks plan ok and is then refused by execute as unsafe-value, and a path git cannot take is a check finding refused before any leg exists (#196) #231 and adopt-project.py check passes a plan that keeps the source's own shape/ in the root, and place() then writes the shape's collision copy onto it after both legs are pushed: a real shape/README.md is overwritten while execute prints "nothing was overwritten" and ends adopt-lost, and a shape/Makefile/ directory or a file named shape is a traceback #262/adopt-project.py check passes a plan that keeps a plain file at a directory the shape writes into (.github, contracts, scripts), and execute dies in a NotADirectoryError or FileExistsError traceback after both legs are pushed #263 via adopt-project.py: check finds, and execute refuses before any leg exists, a kept root path where the shape writes a directory or its shape/ copy, whether the disk keeps case or not; the materializer never writes over a copy (#262, #263) #313 among them. Clean. Only adopt-project.py changed on both sides, and in it only _extract_leg was changed by both, in lines that do not touch; the merged function has both. A clean merge that broke one test of main's, which 9d8aadd fixes.
• e162551: 346079d, adopt-project.py plan's cross_leg_references passes a spec directory's name to git grep -F with no -e and the code entries as glob pathspecs, so a spec directory named -notes or a code entry named :cache silently drops the follow-up, a code entry named * names files that are not in the code leg, a name outside ASCII is printed in git's quoted spelling, and a spec directory named -O<cmd> is run as git grep's pager when a tracked file holds the planned commit's hash #216 via adopt-project.py: plan's follow-up git grep takes a spec directory as its pattern and each code entry as a literal path, so a spec directory named -notes/ or a code entry named :cache/ no longer loses its follow-up, a code entry named */ no longer names a spec-leg file, a name outside ASCII is spelled instead of C-quoted, and a spec directory named -O<cmd>/ no longer runs a command (#216) #228 and family.py: bump and remove take the git pathspec from the manifest row's path: with no check and no --literal-pathspecs, so a hand-edited path: members/* makes remove --member Atlas exit 0 with ONE commit that unmounts every member while dropping only Atlas's row, and path: . makes it git rm -r -f the holder's own files and die on a FileNotFoundError, though validate-family.py already has a rule, member-path, for what path: must equal #299 via family.py: bump and remove refuse member-path when a row's path: is not members/<project> or its project: is not a directory name, and hand git every path literally, so a hand-edited path: members/* or project: . no longer makes remove unmount every member in one commit while dropping one row (#299) #315. Clean. In adopt-project.py and tests/test_adopt_ignored_shape_files.py, the merge's diff against each parent equals the other side's own diff.
• 7186b2d: a1b3a4b, ten commits, adopt-project.py execute clones the source with the operator's init.templateDir applied, so a template holding modules/spec and modules/code makes the leg mounts' --force (#200) reactivate those planted stores: both gitlinks pushed on the split branch are a stranger's commit, the VERIFICATION still says adoption verified because it checks a mount is present and not which commit, and the recursive clone of the result exits 128 #243 via e43fa95 among them. Three conflict hunks in adopt-project.py, each resolved keeping both sides: _commit_the_split's clone (main's --template= and its comment, inside this branch's try:), _verify's docstring (main's paragraph, then this branch's), and the root findings (main's lines in this branch's _accounted_for, with its mounts parameter). AGENTS.md and tests/conftest.py merged with no conflict. 90d6077 fixes main's new tests.
• 9f1778d: f795cf7, adopt-project.py: since #247 a byte that is not UTF-8 in --elected-by, --reference or the --source directory passes plan and check, and execute pushes both legs before it dies with UnicodeEncodeError in write_lf #255 via adopt-project.py: a value execute writes into a file is asked whether a file can hold it, in plan, in check and in execute before any leg exists, so a byte that is not UTF-8 in --elected-by, --reference or a local --source directory no longer pushes both legs before write_lf raises (#255) #270, with 8cdca5e and db19187. Clean. adopt-project.py is the only file both sides changed, and in it the merge's diff against each parent equals the other side's own diff. Both sides changed Source.open and cmd_execute, in different lines; the merge has both.
• 2fc1669: 161c6c9, adopt-project.py: a relative .gitmodules url the plan keeps in a leg is resolved from the source's remote and from the leg's, and where the two differ check finds it and execute refuses before any leg exists, so a recursive clone no longer fails after adoption verified (#190) #245, with ab623dd and a2cb7d3. One conflict, in tests/conftest.py: both sides append at the end of the file; both kept, main's gh guard first.
• f4ca72a: 1f90a0f, AGENTS.md step 7 tells an agent that a non-zero adopt-project.py execute exit is to fix the plan and re-run into fresh legs, but in GitHub mode execute exits 2 with the split pushed when gh pr create is refused, and exits 2 after adoption verified when the topic will not set, so following step 7 abandons a pushed adoption whose own exit is a command to run by hand #304 via a983e6a among seven. One conflict in AGENTS.md (step 7: main's text, with this branch's exit 1 way out) and six in adopt-project.py: two are this branch's own definitions either side of _flush_stdout, which both sides added word for word; _open_the_pull_request's docstring and its failure (this branch's reach and flush, main's by-hand command after the table); cmd_execute's verification (both); and _accounted_for's end (both, then main's _next_steps). _verify loses its NEXT, as on main. c2f3118 fixes two tests.
• bbdd313: 92e29d9, adopt-project.py plan writes leg: spec with no question for a source path that execute will refuse (-notes.md), so the answer check or execute then rejects is one plan chose for the person, and root or drop is offered for that entry nowhere #319. Clean.

Why: before and after, on main 92e29d9

Each case ran on main 92e29d9 and on this branch, from the same driver.

• Every repository is local: bare remotes under --local-remote-dir, and GitHub only through a simulator (url.<dir>.insteadOf plus a stub gh).
• Every run has its own GIT_CONFIG_GLOBAL and GIT_ALLOW_PROTOCOL=file.
• The source is a three-file repository <T>/Thing, and the plan is plan --source <T>/Thing --project Northwind --org testorg --elected-by T --elected-on 2026-09-02 --out <T>/p.yaml.
• <T> is the run's own directory.

Unless a case says otherwise, the command is:

python3 adopt-project.py execute --plan <T>/p.yaml --yes --local-remote-dir <T>/remotes --work-dir <T>/work

1. git filter-repo fails after both leg repositories exist (#171). A stub git-filter-repo first on PATH prints fatal: stub git-filter-repo refuses and exits 1.

main, exit 2, stderr 0 bytes:

  topics skipped for local remotes

creating the leg repositories
  bare  <T>/remotes/Northwind-spec.git
  bare  <T>/remotes/Northwind-code.git

This branch, exit 2, the same stdout, then on stderr:

REFUSED extracting the spec leg. THE EXACT COMMAND WAS:
    git filter-repo --paths-from-file <T>/work/spec-paths.txt --force
    (in <T>/work/Northwind-spec)
    exit 1
--- output ---
fatal: stub git-filter-repo refuses
--- end output ---
NOTHING has been rolled back: `<T>/remotes/Northwind-spec.git` and `<T>/remotes/Northwind-code.git` exist, and neither leg is pushed. Once what failed above is fixed, re-run the adoption with them deleted or with fresh ones (a new --local-remote-dir, or new leg repositories): a re-run that meets them is refused, as `leg-remote-exists` under --local-remote-dir, and against GitHub by `gh repo create`, which finds the name already taken. Use a fresh --work-dir as well, or none: `<T>/work` holds `Northwind-spec` from this run, and `execute` refuses a --work-dir that holds them.

Then rm -r <T>/remotes, the real git filter-repo back on PATH, and the same command:

• main: exit 2, both bare lines again, stderr 0 bytes, and both leg repositories made again.
• This branch: exit 2, stdout 0 bytes, and the remotes directory is not created:

REFUSED adopt-work-dir-occupied: --work-dir `<T>/work` already holds `Northwind-spec`, where this run builds the spec leg, and only after it has made both leg repositories: `git clone` refuses a directory that is not empty
Remediation: no leg repository was created and nothing was pushed. Pass a --work-dir that is new or empty, or none: without one, each run makes a new one.

2. The split push is refused (#188). A pre-receive hook, installed through core.hooksPath, refuses refs/heads/adopt/* on the source. The command is run as ... > log 2>&1.

• main, exit 2: the log's lines 0-9 are REFUSED pushing the split branch. THE EXACT COMMAND WAS: … --- end output ---. Only then do the run's own lines come, with the bare lines on 13-14. There is no notice.
• This branch, exit 2: the bare lines are on 3-4 and the REFUSED block on 8-17. Line 18 is the notice, "NOTHING has been rolled back: <T>/remotes/Northwind-spec.git and <T>/remotes/Northwind-code.git exist, and both legs are pushed. Once what failed above is fixed, …".

3. A leg push is refused (#177, #188 N2). The hook refuses refs/heads/main on the leg remotes; > log 2>&1.

main, exit 2, after the REFUSED block:

If the organisation applies a ruleset requiring changes to arrive by pull
request, a direct push to the default branch is refused BY DESIGN and must not
be worked around. Two legitimate exits:

  (1) have an operator holding the bypass right seed the default branch once,
      then re-run this scaffold; or
  (2) push a seed BRANCH and open a pull request:
          git -C <T>/work/Northwind-spec push -u origin main:seed/scaffold
          gh pr create --repo testorg/Northwind-spec --base main --head seed/scaffold \
              --title 'Seed the spec leg' --body 'Scaffolded shape.'

NOTHING has been rolled back. What already exists is listed above; delete it
by hand if you want a clean re-run.

The printed push, run as printed:

$ git -C <T>/work/Northwind-spec push -u origin main:seed/scaffold
fatal: 'origin' does not appear to be a git repository

It exits 128. This branch, exit 2, after the REFUSED block. No git -C line is printed:

If the organisation applies a ruleset requiring changes to arrive by pull
request, a direct push to the default branch is refused BY DESIGN and must not
be worked around. An adoption has ONE legitimate exit: have an operator
holding the bypass right re-run it, once what the notice below names is
cleared. The scaffold's other exit, a seed branch and a pull request, cannot
finish an adoption: testorg/Northwind-spec has no main for that pull request to target,
and nothing would run the rest of this adoption after it was merged. Under
such a ruleset, that bypass is the fix the notice below asks for, never a
change to the ruleset.

NOTHING has been rolled back: `<T>/remotes/Northwind-spec.git` and `<T>/remotes/Northwind-code.git` exist, and neither leg is pushed. Once what failed above is fixed, …

4. The verification fails (#188 N1, review F1). The plan keeps the source's own contracts/shape-pin.yaml in the root; > log 2>&1.

main, exit 1. The FINDING is on line 0 and the footer on line 2, above every line the run printed (the last on 21):

1 verification finding(s). The legs and the branch exist; NOTHING was deleted from the source, so the exit is to fix the plan and re-run into a fresh --local-remote-dir or fresh leg repositories, unless a finding above names another exit.

This branch, exit 1. The run's lines are 0-18, and the FINDING is on 19, ending "… send that path to a leg or drop it, and re-run as the end of this report says. …". Then:

1 verification finding(s). NOTHING was deleted from the source, so the exit is to fix the plan and re-run, unless a finding above names another exit.
NOTHING has been rolled back: `<T>/remotes/Northwind-spec.git` and `<T>/remotes/Northwind-code.git` exist, and both legs are pushed. Once what failed above is fixed, … Use a fresh --work-dir as well, or none: `<T>/work` holds `Northwind-spec`, `Northwind-code` and `Northwind` from this run, and `execute` refuses a --work-dir that holds them.
The split is pushed to `<T>/Thing` too, as `adopt/three-repo-shape`, and a re-run is refused (`adopt-branch-exists`) until that branch is deleted:
    git -C <T>/Thing push <T>/Thing --delete adopt/three-repo-shape

Next, main's exit, followed as written: the plan fixed, then execute --plan <T>/p.yaml --yes --local-remote-dir '<T>/remotes 2' --work-dir '<T>/work 2', with the branch left in place.

• main: exit 2. It makes and pushes both legs in <T>/remotes 2, then fails with REFUSED pushing the split branch (! [rejected] HEAD -> adopt/three-repo-shape (non-fast-forward)).
• This branch: exit 2, stdout 0 bytes, and <T>/remotes 2 is not created:

REFUSED adopt-branch-exists: `<T>/Thing` already has `adopt/three-repo-shape`, the branch this adoption pushes its split commit to, at 2a94424d525f: neither the source commit 2a7e80fec913 nor a commit behind it
Remediation: no leg repository was created and nothing was pushed. … If it verified and its pull request is the adoption you want, review that instead of re-running. If the branch is not an earlier run's (the plan's `adopt_branch:` names one of the source's own), give `adopt_branch:` a name no branch has. Otherwise delete it, then run `execute` again:
    git -C <T>/Thing push <T>/Thing --delete adopt/three-repo-shape

The tests follow the rest of the way out as written: the deletion, pasted, then execute again. That ends in adoption verified.

5. A symlink loop the plan keeps in the root (#188 N3). The source holds .github -> .github, answered root, and check exits 0 with plan ok.

• main, exit 1, a traceback ending OSError: [Errno 40] Too many levels of symbolic links: '<T>/work/Northwind/.github/workflows', with both legs pushed.
• This branch, exit 2:

REFUSED committing the split. OSError: [Errno 40] Too many levels of symbolic links: '<T>/work/Northwind/.github/workflows'
NOTHING has been rolled back: `<T>/remotes/Northwind-spec.git` and `<T>/remotes/Northwind-code.git` exist, and both legs are pushed. Once what failed above is fixed, …

6. A branch named adopt/three-repo-shape at the source's own tip (review N1). git -C <T>/Thing branch adopt/three-repo-shape, then the command. Both trees exit 0 with adoption verified: every source path is in exactly one place.

7. A defect inside the verification (re-verification R2). main() is run in-process, with _shape_file_findings replaced by a function that raises TypeError.

• main: the TypeError escapes main(), and nothing is printed to stderr.
• This branch: the TypeError is re-raised, after:

STOPPED verifying the split by TypeError: stand-in for a defect: 'NoneType' object is not subscriptable.
NOTHING has been rolled back: `<T>/remotes/Northwind-spec.git` and `<T>/remotes/Northwind-code.git` exist, and both legs are pushed. Once what failed above is fixed, re-run the adoption with them deleted or with fresh ones …
The split is pushed to `<T>/Thing` too, as `adopt/three-repo-shape`, and a re-run is refused (`adopt-branch-exists`) until that branch is deleted:
    git -C <T>/Thing push <T>/Thing --delete adopt/three-repo-shape

8. An org/repo source, and the code leg's repository cannot be created (#188 N4, re-verification R3). This runs in simulated GitHub mode, as execute --plan <T>/adoption-plan.yaml --yes --source rv188org/Northwind --work-dir <T>/W, with the code leg's gh repo create refused (HTTP 502).

• main: exit 2, REFUSED a git or gh command failed. THE EXACT COMMAND WAS: gh repo create rv188org/Northwind-code …, and no notice.
• This branch: exit 2.

REFUSED creating the code leg repository. THE EXACT COMMAND WAS:
    gh repo create rv188org/Northwind-code --private --description Northwind — code leg, extracted from rv188org/Northwind with history
    exit 1
--- output ---
HTTP 502: stub refuses the code leg
--- end output ---
NOTHING has been rolled back: `https://github.com/rv188org/Northwind-spec.git` exists, and nothing is pushed to it. Once what failed above is fixed, re-run the adoption with it deleted or with a fresh one (…): … Use a fresh --work-dir as well, or none: `<T>/W` holds `source-readonly/Northwind` from this run, and `execute` refuses a --work-dir that holds them.

The same --work-dir <T>/W again gives REFUSED source-unclonable: … destination path '<T>/W/source-readonly/Northwind' already exists, on both trees. This branch's notice followed as written (the spec repository deleted, the cause gone) verifies: with a fresh --work-dir, exit 0, and with none, exit 0.

9. With main's 06b5204: a name stdout cannot encode. Every path is under <T>/日本 run. adopt-project.py's own stdout is cp1252 (strict, and Windows' default surrogateescape), and git-filter-repo keeps UTF-8.

• The case-1 stub: main exits 2 with stdout escaped (bare <T>/日本 run/remotes/Northwind-spec.git) and stderr 0 bytes. This branch exits 2 with the REFUSED block and the whole notice on stderr.
• Case 4: this branch exits 1 with the finding, the footer, the notice, "Use a fresh --work-dir as well, or none: <T>/日本 run/work holds Northwind-spec, Northwind-code and Northwind from this run …", the branch line and git -C '<T>/日本 run/Thing' push '<T>/日本 run/Thing' --delete adopt/three-repo-shape. 日本 is printable, so _spelled keeps it, and stderr's backslashreplace escapes it.
• In both cases, this branch's stderr under cp1252 is identical to its stderr under UTF-8, once 日本 is read back as 日本.
• Before this merge, at 5a8b649, both runs exited 1 with UnicodeEncodeError at print(f" bare {bare}"), with one leg repository made and no notice.

10. With main's 60d08a1: a refusal that names a non-ASCII path. The hook refuses the spec leg's main with ruleset: Übersicht.md changes must arrive by pull request, and the command runs under LC_ALL=C PYTHONUTF8=0.

• main: exit 2, REFUSED pushing the spec leg., git's output (remote: ruleset: \xdcbersicht.md …), the scaffold's two exits, and no notice.
• This branch: exit 2, the same REFUSED block, the one-exit hint and the notice.
• At 5a8b649, before this merge, it was REFUSED extracting the spec leg. UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 17: ordinal not in range(128) and the notice, with no hint.

11. With main's aaa40eb: a .gitmodules the history makes unreadable. This uses main's own fixtures. The history adds and removes vendor/b, the tip .gitmodules is [submodule "b"] with a bare path, and the plan sends .gitmodules to code.

• main and this branch alike: check exits 1 with FINDING plan-gitmodules-unreadable: ….
• execute exits 2 with REFUSED plan-gitmodules-unreadable: 1 finding(s) … and "Remediation: no leg repository was created and nothing was pushed.". Its stdout is 0 bytes and the remotes directory is never made, so there is no notice. The two logs are identical once commit names are masked.
• At 5a8b649, check printed plan ok, and execute made both legs and died in git filter-repo (error: missing value for 'submodule.b.path'). This branch reported that with the notice.

12. With main's c2ff2b0: a .gitmodules value git's submodule reader refuses. This uses main's own fixtures for #215: a gitlink at the tip and update = bogus in .gitmodules, and the plan sends .gitmodules and vendor/ to code.

• main and this branch alike: check exits 1 with FINDING plan-gitmodules-unreadable: git cannot read the source's .gitmodules for its submodules (invalid value for submodule.b.update: bogus, which is not one of checkout, rebase, merge, none), ….
• execute exits 2 with REFUSED plan-gitmodules-unreadable: 1 finding(s) … and "Remediation: no leg repository was created and nothing was pushed.". Its stdout is 0 bytes and the remotes directory is never made, so there is no notice. The two logs are identical once commit names are masked.
• At e507c42, before this branch merged c2ff2b0, check printed plan ok, and execute made both legs and died in the extraction:

REFUSED extracting the spec leg. THE EXACT COMMAND WAS:
    git filter-repo --paths-from-file <T>/work/spec-paths.txt --force
    (in <T>/work/Northwind-spec)
    exit 1
--- output ---
fatal: invalid value for 'submodule.b.update'
Error: fast-export failed; see above.
…
--- end output ---
NOTHING has been rolled back: `<T>/remotes/Northwind-spec.git` and `<T>/remotes/Northwind-code.git` exist, and neither leg is pushed. Once what failed above is fixed, … Use a fresh --work-dir as well, or none: `<T>/work` holds `Northwind-spec` from this run, and `execute` refuses a --work-dir that holds them.

13. With main's f795cf7: a local source under a directory whose name is not UTF-8. The source is <T>/caf\xe9/Thing, where 0xE9 is a byte that is not UTF-8. plan and check exit 0 on every tree.

• main (f795cf7 to 92e29d9) and this branch alike: execute exits 2, prints nothing on stdout, and makes no remotes directory:

REFUSED adopt-unwritable-value: under --local-remote-dir the assembly root's clone URL is the source's own path, '<T>/caf\udce9/Thing', which `execute` writes into its `README.md`, and it holds a byte that is not UTF-8
Remediation: nothing was created. Rename or move the source repository so that its path is one line of UTF-8 text with no control character in it, then run `plan --source <its new path>`, `check` and `execute` again; …

It is raised before any leg exists, so there is no notice. The two logs are identical once the source's commit is masked.

• At 9be2b05, before this branch merged f795cf7, execute made and pushed both legs, and write_lf raised while the split was committed. Exit 2:

REFUSED committing the split. UnicodeEncodeError: 'utf-8' codec can't encode character '\udce9' in position 665: surrogates not allowed
NOTHING has been rolled back: `<T>/remotes/Northwind-spec.git` and `<T>/remotes/Northwind-code.git` exist, and both legs are pushed. Once what failed above is fixed, … Use a fresh --work-dir as well, or none: `<T>/work` holds `Northwind-spec`, `Northwind-code` and `Northwind` from this run, and `execute` refuses a --work-dir that holds them.

• On main a1b3a4b the same run made and pushed both legs too, then exited 1 with a UnicodeEncodeError traceback from write_lf, and no notice.

14. With main's a983e6a: gh pr create refused. GitHub mode, built with main's own helpers from tests/test_adopt_github_exits.py: a stub gh that refuses pr create, https://github.com/ rewritten to bare repositories, a bogus token and an empty config directory. Stdout and stderr are merged.

• The split verifies: main and this branch alike exit 2 and end with adoption verified, then The branch IS pushed. Open the pull request by hand: and the command. Here the REFUSED block comes after the split line, because stdout is flushed first; on main it is the log's first line.
• The verification fails (the source's own pin kept in the root): both exit 1 and end with No pull request was opened, and none should be: the split above did not pass verification. This branch prints its notice and the split branch's git ... --delete before that line.
• The verification cannot be made (_tree_of raising OSError: [Errno 28] No space left on device once _verify has begun): main exits 1 with a traceback, and says nothing of the pushed legs or split. This branch exits 2 with REFUSED verifying the split. OSError: [Errno 28] No space left on device, the notice, the split branch and its deletion, and then the no-pull-request line.

Tests

New files.

• tests/test_adopt_filter_repo_failure.py, 11 tests, from adopt-project.py: execute prints the command and its stderr when a leg cannot be built, so a git filter-repo that fails after both leg remotes exist no longer exits 2 with an empty stderr (#171) #184, reworked. They cover:
  • a failed leg build, printed with its command and output, for an extracted and a seeded leg, and the notice naming both legs and the work directory;
  • leg-remote-exists and the GitHub name-taken re-run, from the code that makes them true;
  • stdout flushed first, and a refused push reported once, with its hint;
  • end to end, a stub git-filter-repo first on PATH exits 1, which check cannot foresee (adopt-project.py: execute prints the command and its stderr when a leg cannot be built, so a git filter-repo that fails after both leg remotes exist no longer exits 2 with an empty stderr (#171) #184 P1-1);
  • end to end, the notice's way out followed word for word ends in adoption verified. Both work directories have a space in their names, and the test reads the two leg repositories between the notice's backticks.
• tests/test_adopt_late_failure.py, 86 tests:
  • Each split step fails: the clone and the commit for real, the mount through a stub, the push to a missing remote.
  • The notice's states. Four failures that are not a command, on a leg. The materializer's OSError on the split.
  • Interrupted leg, split and verification (STOPPED). A defect against an interrupt, at four points (R2).
  • The source's own clone named in the work-directory sentence, at four points, after a refusal and after a defect. Also one --source testorg/Thing --work-dir W run through cmd_execute, where the code leg's repository fails (R3).
  • A leg pushed last. What main is left to report. The flushes, and a closed stdout. The gh steps' by-hand exits.
  • The one-exit hint, with its last sentence (R4).
  • adopt-work-dir-occupied for a file, a directory and the split, and never for a default, new or empty work directory.
  • adopt-work-dir-occupied's reason for each builder, through cmd_execute on a code-only source with --allow-empty-leg spec: an extracted leg, the split, the seeded leg, the seeded leg and the split, and an extracted leg and the split (one reason, given once). A seeded leg's directory holding only an ignored .DS_Store, an empty subdirectory or an empty repository is refused by the same rule (N-2).
  • adopt-branch-exists: its printed command run as pasted, from a source path with a space; its precedence below leg-remote-exists; asked of the assembly's URL; not refused for a branch at or behind the source commit.
  • Every path the notice, its split line, adopt-work-dir-occupied and adopt-branch-exists name is spelled (adopt-project.py check and execute print a source path raw in a FINDING, so a \r, \n, \x85, U+2028 or ESC in a name overwrites, splits or escapes the line on a terminal, where plan's questions spell the same path with _spelled #212): three tests, each over the five characters main's tests/test_adopt_finding_spelling.py asks of a finding (a carriage return, a line feed, U+0085, U+2028 and ESC). Each message is one printable line that holds the spelled path, and the deletion stays the command sh reads. They run in-process on POSIX paths that are never made, so every platform runs them.
  • A verification that cannot be made. The substitution table is built before the legs. AGENTS.md step 7.
  • End to end with git filter-repo, in one merged pipe as > log 2>&1: a refused split push and its way out; a refused leg push; a failed verification and its way out as review F1 followed it; and a branch at the source commit that is pushed over and verifies.

Changed.

• tests/conftest.py: run_script(..., merge_stderr=True), and spelled(), the expectation for a path these messages name.
• tests/test_adopt_leg_path_collisions.py: adopt-project.py: the leg mount passes --force to git submodule add, so a source whose .gitignore is * + !.gitignore, or names spec or code, adopts instead of dying at the mount after both leg remotes were pushed (#174) #200's refused_at_the_mount expected the guard's Refusal to escape cmd_execute. Here it is reported, and cmd_execute returns 2. So the helper records the refusal the guard raised, and asserts the return value 2 and the reported block with the notice last. The next-step test also asserts that a re-run into the same work directory is adopt-work-dir-occupied and makes no leg.
• tests/test_adopt_verify.py (main's, adopt-project.py _verify skips every root gitlink and compares a kept root .gitmodules byte for byte, so any plan that keeps a source submodule or its .gitmodules in the root ends with exit 1 and adopt-lost #165): its fixture passes the urls and branch that _verify names in its way out. One assertion reads the merged footer, "… fix the plan and re-run, unless a finding above names another exit."
• tests/test_adopt_ignored_shape_files.py: PLAN_ANSWER reads the shape-file finding's new exit. The end-to-end test also reads that the way out comes after the finding and ends with the branch's deletion.
• tests/test_adopt_root_shape_paths.py (main's, 71b58a1): test_with_check_skipped_execute_stops_at_the_copy_and_overwrites_nothing expected the materializer's materialize-copy-blocked to escape cmd_execute. Here it is reported, and cmd_execute returns 2. So refused_in_the_materializer records the refusal the materializer raised, and asserts the return value 2, the reported block, and the notice last. Main's own assertions are kept: the code, the detail, no split branch, the source's file as it was, and both legs pushed.
• tests/test_adopt_clone_template.py (main's, e43fa95): its verify helper passes the urls and branch that _verify names in its way out, so the 12 tests that call it directly run. Every assertion stands as main wrote it.
• tests/test_repo_hygiene.py (main's): the AGENTS.md cap is 482, with a dated entry: step 7's exit 1 way out is one line longer here (c2f3118).

Counts at bbdd313, both modes, /usr/bin/python3 -m pytest, run in separate clean trees.

• With git-filter-repo on PATH: 3480 passed, 5 skipped.
• With it hidden (PATH without ~/.local/bin, so command -v git-filter-repo finds nothing and git's exec-path has none): 3318 passed, 167 skipped.
• At 92c72c1, which changes one sentence and its tests: tests/test_adopt_late_failure.py, tests/test_adopt_leg_path_collisions.py, tests/test_repo_hygiene.py, tests/test_shape_doctor.py and tests/test_scaffold_leg_path_collisions.py give 590 passed, 3 skipped with git-filter-repo and 580 passed, 13 skipped hidden. Merged with main 3ef059c in a scratch tree, tests/test_agents_md_codes.py, tests/test_adopt_manifest_values.py, tests/test_adopt_late_failure.py and tests/test_repo_hygiene.py give 262 passed and 245 passed, 17 skipped.

The set is 54 files: the 40 test files that load adopt-project.py (by its name, ADOPT or the adopter fixture), and fourteen of main's test files for what else this branch touches (conftest's run_script and its gh guard, shape-doctor.py, which loads adopt-project.py, and repo_shape.py's reader, which loads every plan).

tests/test_adopt_clone_template.py
tests/test_adopt_e2e.py
tests/test_adopt_entry_paths.py
tests/test_adopt_execute_refusals.py
tests/test_adopt_filter_repo_failure.py
tests/test_adopt_finding_spelling.py
tests/test_adopt_github_exits.py
tests/test_adopt_gitmodules_values.py
tests/test_adopt_history_gitlinks.py
tests/test_adopt_ignored_shape_files.py
tests/test_adopt_late_failure.py
tests/test_adopt_leg_path_collisions.py
tests/test_adopt_leg_paths.py
tests/test_adopt_literal_names.py
tests/test_adopt_mount_ignored.py
tests/test_adopt_plan.py
tests/test_adopt_plan_escapes.py
tests/test_adopt_relative_submodule_url.py
tests/test_adopt_root_shape_paths.py
tests/test_adopt_spec_only.py
tests/test_adopt_submodules.py
tests/test_adopt_template_values.py
tests/test_adopt_verify.py
tests/test_cli_reference.py
tests/test_doctor_legs_members_next.py
tests/test_family_add_refusals.py
tests/test_free_plan_hint.py
tests/test_gh_guard.py
tests/test_git_output_decoding.py
tests/test_load_yaml_refusals.py
tests/test_naming_policy.py
tests/test_reference_default.py
tests/test_repo_hygiene.py
tests/test_scaffold_e2e.py
tests/test_scaffold_free_text_values.py
tests/test_scaffold_leg_path_collisions.py
tests/test_scaffold_leg_paths.py
tests/test_scaffold_mount_ignored.py
tests/test_scaffold_pin_and_reuse.py
tests/test_scaffold_pin_collisions.py
tests/test_shape_advisory.py
tests/test_shape_doctor.py
tests/test_stdout_encoding.py
tests/test_template_quoted_values.py
tests/test_template_values_single_pass.py
tests/test_update_shape.py
tests/test_update_shape_add_ignored.py
tests/test_update_shape_landing.py
tests/test_update_shape_pr_base.py
tests/test_windows_paths.py
tests/test_yaml_block_scalar_keys.py
tests/test_yaml_flow_mappings.py
tests/test_yaml_flow_quotes.py
tests/test_yaml_quote_boundaries.py

Revert tables. Every new or changed test fails with its change undone. Each row undoes ONE change in a clean tree, with every anchor asserted to occur exactly once.

This round, measured at 918e8f2. Merges 922f2d8 and e162551 change no line of this branch's own diff, so these rows stood at e162551. Each row runs tests/test_adopt_ignored_shape_files.py, tests/test_adopt_late_failure.py and tests/test_adopt_filter_repo_failure.py: 119 tests, which all pass unmutated. The SP rows undo e507c42 (#212), one path at a time. The others re-measure the rows of 5a30b77 (SFE, FOOT), 48e93bb (R2a, R2b), 0d2256e (R4), and 03b381a and 5a8b649 (R3a-R3j). The tests each row fails are in the lane's log; every row but BASE fails at least one.

row	change undone	result
BASE	nothing undone (baseline)	119 passed
SFE	SHAPE_FILE_EXIT back to main's "re-run into fresh legs"	8 failed, 111 passed
FOOT	the verification footer printed before the findings	1 failed, 118 passed
R2a	R2 undone: an exception outside LATE_FAILURES is told only to re-run, as before	4 failed, 115 passed
R2b	an interrupt told to fix what failed first	7 failed, 112 passed
R4	the hint's last sentence removed	1 failed, 118 passed
R3a	_cloned_here never counts the clone	9 failed, 110 passed
R3b	Source.open never records that it cloned	1 failed, 118 passed
R3c	_create_leg_remotes' notice not handed the source	3 failed, 116 passed
R3d	_build_the_legs' refusal handler not handed the source	1 failed, 118 passed
R3e	_build_the_legs' other handler not handed the source	1 failed, 118 passed
R3f	_commit_the_split's refusal handler not handed the source	1 failed, 118 passed
R3g	_commit_the_split's other handler not handed the source	1 failed, 118 passed
R3h	_left_by_the_split does not hand on the source	2 failed, 117 passed
R3i	cmd_execute does not hand _create_leg_remotes the source	1 failed, 118 passed
R3j	mutation, not a revert: the clone counted as occupying the work directory	6 failed, 113 passed
SPa	the notice's leg repositories printed raw	18 failed, 101 passed
SPb	the notice's work directory printed raw	29 failed, 90 passed
SPc	what the notice says the work directory holds, printed raw	27 failed, 92 passed
SPd	the split line's assembly printed raw	6 failed, 113 passed
SPe	the split line's branch printed raw	6 failed, 113 passed
SPf	adopt-work-dir-occupied's work directory printed raw	9 failed, 110 passed
SPg	adopt-work-dir-occupied's names printed raw	9 failed, 110 passed
SPh	adopt-branch-exists' assembly printed raw	6 failed, 113 passed
SPi	adopt-branch-exists' branch printed raw	6 failed, 113 passed

9d8aadd, measured at e162551. Each row runs test_with_check_skipped_execute_stops_at_the_copy_and_overwrites_nothing, which passes unmutated:

row	change	fails
RTa	the test as main wrote it	1: DID NOT RAISE Refusal
RTb	mutation: _report_late prints the notice before what failed	1: the notice is not the last line
RTc	mutation: _failed_loudly drops a refusal's own remediation	1: the reported block

90d6077, measured at the merge's tree 9570d24. With main's verify helper as main wrote it, the 12 tests of tests/test_adopt_clone_template.py that call _verify directly fail with TypeError: _verify() missing 2 required keyword-only arguments: 'urls' and 'branch'.

9be2b05, measured at 9be2b05. Each row runs the occupied-directory tests and the spelling tests of tests/test_adopt_late_failure.py, 17 tests, which all pass unmutated:

row	change	fails
N1a	the reason back to git clone alone	2: the seeded leg, and the seeded leg with the split
N1b	cmd_execute hands the refusal no seeded leg	2: the same two
N1c	each directory's reason repeated	1: an extracted leg and the split
N1d	the reasons sorted, not in the order the run builds	1: the seeded leg and the split

c2f3118, measured in trees at the merge f4ca72a with it applied (the cap test, the gh-step test's four cases and both step 7 tests, 7 passing): the cap back to 481 fails the cap test; the _open_it_by_hand call removed fails the two [...-pull-request] cases. The joined step 7 is held from both sides: main's text alone fails this branch's step 7 test, and this branch's old text alone fails main's.

92c72c1, measured in trees at bbdd313 with it applied (the 13 occupied-directory tests, all passing): the old sentence back fails 5, the two seeded reasons and the three new cases; _holds_something made to skip .DS_Store, .git and empty directories fails the three new cases.

The confirmation check at 918e8f2 (rv188f) added rows of its own. Fourteen targeted rows cover the 28 tests of the two new files that no row above fails: GHSTEP, SPLITOS, LIVELEG, TABLE, GHASK, HOLDS, HOLDS2, SUPPRESS, LEGREPORT, AGENTS, PUSHSEED, REMED, BUILDPRINT and GHFIRST. Every named test fails in every row.

Earlier rounds, as measured then. Counts only; each row undoes one change in a clean tree, and every test it names passes unmutated.

• fix188e at cdfb308: 27 rows over 74 tests, each failing 1 to 15; the review round at d07e94a and 8d4fef4: 34 rows over 43 tests, each failing 1 to 21; 8d4fef4's F0: 3.

Platforms. CI has not run on this branch yet; it runs on pull requests. The Windows job installs no git-filter-repo, sets PYTHONUTF8=1, and honours WINDOWS_SKIP. With git-filter-repo hidden, this branch's tests give:

• tests/test_adopt_late_failure.py: 82 of 86 run on windows-latest. All the in-process ones run. Among them are the #!/bin/sh pre-receive hook in test_a_refused_leg_push_offers_an_adoption_its_one_exit, which Git for Windows runs through its own sh, and the pasted git -C … --delete in test_a_split_branch_left_behind_is_refused_before_any_leg_exists. They also include R2's 8, R3's 9, the work-directory refusals (4 refused, 3 never refused), the 2 fast-forward cases, the 15 spelling tests, the 5 occupied-directory reasons and the 3 cases of N-2, and AGENTS.md step 7. The 4 that skip are the git-filter-repo end-to-end tests:
  • test_a_refused_split_push_is_logged_after_the_legs_and_its_way_out_runs;
  • test_a_branch_at_the_source_commit_is_pushed_over_and_verifies;
  • test_a_refused_leg_push_is_logged_after_the_legs_with_one_exit;
  • test_a_failed_verification_is_flushed_and_its_way_out_runs.
• tests/test_adopt_filter_repo_failure.py: 9 of 11 run. test_a_failed_git_filter_repo_names_itself_on_stderr puts a #!/bin/sh stub on PATH, so it carries WINDOWS_SKIP, like tests/test_free_plan_hint.py's stub gh. test_following_the_notice_after_a_failed_leg_ends_adoption_verified needs git filter-repo.
• tests/test_adopt_verify.py: the 14 direct _verify tests, whose fixture this branch changed, run. Its 2 end-to-end tests skip.
• tests/test_adopt_ignored_shape_files.py: the 6 in-process tests that read PLAN_ANSWER run. Its end-to-end test skips.
• tests/test_adopt_leg_path_collisions.py: the 3 changed mount-guard tests need git filter-repo and skip.
• tests/test_adopt_root_shape_paths.py: the one changed test needs git filter-repo and skips.
• tests/test_adopt_clone_template.py (main's): 14 of 31 run. The 12 tests that call the changed verify helper run in-process, and nothing in the file carries WINDOWS_SKIP. The 17 that skip need git filter-repo.

Paths as windows-latest spells them. _spelled escapes a backslash, which is Windows' path separator. So a test that reads a path raw (str(path) in err, or a path between backticks without the escape) passes on Linux and fails on Windows. On Linux a backslash is an ordinary file-name character, so the tests were run again with one in every temporary path (--basetemp '…/bt-bs/head\win'), with git-filter-repo hidden as on windows-latest:

• the seven changed test files, tests/test_adopt_finding_spelling.py and tests/test_adopt_execute_refusals.py, at 9f1778d and at 9be2b05 alike: 498 passed, 50 skipped and 3 failed. The 3 are main's own tests in tests/test_adopt_clone_template.py, and they fail the same way on main f795cf7 and on a1b3a4b (that file alone: 3 failed, 11 passed, 17 skipped). Its operator helper writes template.as_posix() into a git config file. On Linux as_posix() keeps the backslash, which is a file-name character there, and git reads it as an escape: fatal: bad config line 2. On Windows as_posix() turns the separator into /. All 3 stop at that git call, before the verify helper this branch changes.;
• every test file that names adopt-project.py, at 918e8f2: the same 54 failures and 4 set-up errors on this branch and on main 6d8d88b, none in a file this branch changes.

That run catches the mistake: with work_dir_named made to expect the raw path between backticks, 8 tests pass with a plain temporary path and the same 8 fail with the backslash.

No added line feeds text to git's stdin. Expected paths are built from Path objects, and the AGENTS.md test reads in text mode.

Not verified.

• Real GitHub: gh repo create, an organisation ruleset, and git ls-remote against a GitHub URL. A local path or the simulator stands in for them.
• macOS and Windows. They are covered by inspection and by the hidden-tool run above, until the pull request's CI runs.
• The full suite. The lane runs the 54-file set above.

Reviews

Lane openRepoShape-2 reviewed PR #184 at f416e13 (comment):

• P1-1, the e2e test failing once adopt-project.py: a plan that sends .gitmodules to one leg and a submodule it registers to another passes check and execute, says adoption verified, and the assembly's recursive clone then fails: plan should ask, check should find, execute should refuse #166 lands: taken in d07e94a. The test now uses the stub git-filter-repo.
• P2-1, the notice's way out looping under --work-dir: taken in d07e94a, and closed for every way out by 5dbda31's adopt-work-dir-occupied.
• P3-1, only CommandFailed reported: taken in d07e94a.
• P3-2, an unguarded flush: taken in c77cef0.
• P3-3, "one leg may already be pushed" and "the corrected plan": taken in c77cef0.
• P3-4, 41ab8ca's message says "four changes" and lists five: that commit is not rewritten; the squash message replaces it.
• P3-5 is adopt-project.py: a failure AFTER both legs are pushed (the split-branch push, the mount, the split commit) prints only REFUSED <step> with no notice of what already exists and no stdout flush, so the combined log shows REFUSED before the bare … lines and the re-run meets leg-remote-exists unexplained #188, this pull request.

Lane 2 reviewed this branch at 68d4d63 (comment):

• N1, the unflushed verification and its looping exit: taken in d07e94a, and adopt-branch-exists added.
• N2, the hint's seed exit: taken in d07e94a. Only exit (1) is offered, and a test reads the hint.
• N3, non-command failures: taken in d07e94a.
• N4, the second gh repo create: taken in d07e94a. The existing test now asserts the notice.
• N5, the unquoted push: taken in d07e94a. The hint prints no push any more. The one command this pull request adds, the branch deletion, is quoted with shlex.quote, and the tests parse printed commands with shlex.split, on paths with spaces.

The lane's adversarial review at 8d4fef4 (CHANGES NEEDED):

• F1 (BLOCKER), adopt-branch-exists's way out looping on the same --work-dir: 5dbda31 adds adopt-work-dir-occupied, ahead of every other refusal of what an earlier run left, and says "re-run as the end of this report says" in the shape-file finding. cdfb308 adds a test that reads that finding's exit.
• F2, the notice never said to fix what failed first: 5dbda31. 48e93bb narrows "Re-run" alone to an interrupt.
• F3, AGENTS.md step 7 naming an exit the tool refuses: b750950.
• N1, a false claim about a branch the push fast-forwards: 837ccf9, with its adopt_branch: sentence read by a test in cdfb308.
• N2, "already cloned into" when nothing was cloned: 5dbda31 reads the work directory off the disk. 03b381a and 5a8b649 add the source's own clone.
• N3, a _verify failure with no notice: 855886d.
• N4, a leftover code bare makes a spec repository first: left. It is main's behaviour. One repository is made, and the notice names it. Checking both bares first would change leg-remote-exists' precedence.
• N5, in GitHub mode adopt-branch-exists comes before any leg check: left. It is a true refusal that makes nothing, and its remediation now says to review a verified run's pull request instead of re-running. The re-run it leads to meets gh repo create before anything is made.
• N6, S1192 in the new tests: bbfcfd9.
• N7, the mount guard's way out given twice: left. The two agree: MOUNT_REMEDIATION is adopt-project.py: the leg mount passes --force to git submodule add, so a source whose .gitignore is * + !.gitignore, or names spec or code, adopts instead of dying at the mount after both leg remotes were pushed (#174) #200's own, and the notice is common to every late failure.
• N8, the Platforms paragraph: this body.
• N9, 41ab8ca's message: left to the squash, as P3-4.

The re-verification at cdfb308 (CHANGES NEEDED on R1):

• R1 (BLOCKER), tests/test_adopt_ignored_shape_files.py expecting the shape-file finding's old exit (7 failed): 5a30b77.
• R2, a defect told only to re-run: 48e93bb.
• R3, the source's own clone missing from the work-directory sentence: 03b381a and 5a8b649.
• R4, "Once what failed above is fixed" under a hint that says the refusal is by design: 0d2256e.
• R5, main's own gap, left to main: AGENTS.md step 7 sent every non-zero exit to "fix the plan and re-run into fresh legs", which was wrong for GitHub mode's two exit 2s after a pushed split. It was filed as AGENTS.md step 7 tells an agent that a non-zero adopt-project.py execute exit is to fix the plan and re-run into fresh legs, but in GitHub mode execute exits 2 with the split pushed when gh pr create is refused, and exits 2 after adoption verified when the topic will not set, so following step 7 abandons a pushed adoption whose own exit is a command to run by hand #304, which main fixed in a983e6a (step 7 keyed to the exit, and a refused gh pr create verified before the run exits); f4ca72a merges that, with this branch's exit 1 way out joined into step 7.

The confirmation check at 918e8f2 (rv188f: PR-READY, no BLOCKER and no SHOULD-FIX):

• Its own runs at 918e8f2 gave this branch's numbers: 2610 passed and 2 skipped on 43 files with git-filter-repo, and 372 passed and 23 skipped with a backslash in every temporary path.
• N-1 (NIT), adopt-work-dir-occupied giving git clone as the reason for a seeded leg, which is never cloned: 9be2b05.
• Observations O1 to O6 are not findings: O1 and O2 are this branch's limits, described above, and O3 to O6 are main's.

rv188f's round H review (2fc1669, then 918e8f2..bbdd313: CHANGES NEEDED in this body only; its run at bbdd313, 3480 passed and 5 skipped, matched):

• B1, B2, B3, three passages false at bbdd313 (step 7, the pull request's by-hand command, R5): replaced with its wording.
• N-2 (NIT), the seeded-leg reason false for a directory holding only what git does not commit: the sentence states the rule, and the refusal is kept (92c72c1).
• N-3 (NIT), two failures in one run: left, and stated under Exit codes.

Supersedes PR #184

This pull request supersedes PR #184. It carries #184's three commits for #171 (5cd06c7, 41ab8ca, f416e13), then the work for #188 and #177 on top of them.

Lane openRepoShape-2 found that #184 cannot land on its own:

• Merged with main, it needs this branch's test-stub fix (68d4d63).
• Since adopt-project.py: a plan that sends .gitmodules to one leg and a submodule it registers to another passes check and execute, says adoption verified, and the assembly's recursive clone then fails: plan should ask, check should find, execute should refuse #166 landed (e4decfb), its one end-to-end test fails at check (review P1-1).

Lane 2 suggested folding #184 into this pull request (comment). PR #184 can be closed in favour of this one.

Closes #171
Closes #188
Closes #177

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

(lane openRepoShape-3, 2026-10-12T19:56:17Z) A v1.0.0 scope notice. Brett Heap scoped openRepoShape's first release today: every procedure in AGENTS.md works end to end for ordinary repositories on Linux, macOS and Windows. The tag waits for every in-scope issue to close and a full test run to pass on all three OSes on the release commit. This PR closes #171 (P2, parent #457), #177 (P1, parent #457), #188 (P2, parent #457): in scope, in the v1.0.0 milestone. Nothing changes in how it lands. Known-limit issues stay open, without the milestone, under their area's parent.