Repository navigation
validate-family.py: a member's checkout, a shape copy, the shape pin or family.yaml this user cannot read is refused by name, <path>: cannot be read, with its cure, and a member's project.yaml is member-manifest-unreadable, so no Python 3.12 traceback and no 3.14 member-uninitialized, pinned but absent, does not exist or update of a checkout that is there (#430) - #956
Merged
Merged
Conversation
…HEAD's `.gitmodules` gives is `member-gitmodules-absent`, so a holder whose HEAD lost the file no longer says `family ok`, `remove` refuses it before `deinit` instead of leaving the mount empty, and the gitlink remedies name a case variant and the commit `add` needs (#611) 571(b). In a holder whose HEAD lost `.gitmodules` (the commit #407 describes), `family.py remove --dry-run` exited 0, and the real run did `git submodule deinit` and `git rm`, then died at its commit's `git --literal-pathspecs add -f -- .gitmodules family.yaml` (`pathspec '.gitmodules' did not match any files`); the rollback left `members/<P>` empty. `_checked_gitmodules_held` now refuses that holder, before any git command that writes and under `--dry-run` alike: no `.gitmodules` in the work tree, the index or HEAD while the index records the member's gitlink. Refused, not committed without the file, as #407 refuses a `.gitmodules` the work tree lacks. The remedy writes back, with `git config -f .gitmodules`, the section `family.py add` writes for each member whose gitlink the index records, then `git add -f .gitmodules`; `remove` then runs as it always has. 571(c), #407's decision 3. `validate-family.py` reads HEAD's `.gitmodules` (`_head_gitmodules`, HEAD's root tree listed with no pathspec) and makes `member-gitmodules-absent` for each row at `members/<project>` whose gitlink no section gives, in every mode, `--no-members` included. Its two lines write the section back as `family.py add` writes one, keeping the url of a section of that name that has one. A member it names that is not checked out is not refused `member-uninitialized`: that refusal named a `git submodule update` that exits 0 there and dropped the finding, which is what a fresh clone and CI met. It reads HEAD, not the work tree, so a deletion nobody committed, an unstaged edit and a sparse checkout that leaves the file out are no finding, and a holder with no members is asked nothing. 574/2 (#363's item 3). A row whose gitlink HEAD records only at a case variant of its path (`Members/<P>`) is refused `member-gitlink-absent` naming each variant, and the move that puts it back in the index alone: `git rm -r --cached` of the variants and `git update-index --add --cacheinfo 160000,<pin>,members/<P>`, then a commit. `family.py add`, the plain refusal's remedy, cannot help there: the row exists. 574/3. A hand mount's `member-gitlink-unnamed` remedy says to commit the `git rm` before the `add`: since #574, `add` refuses a path under another spelling of `members/` that HEAD holds and the index no longer does. `templates/family-root/scripts/validate-family.py` is a pinned copy: each holder sees it as `upstream-changed` on its next `update-shape.py check`. Tests: tests/test_family_head_lost_gitmodules.py (new, 24); the pinned remedy text and the case-variant states in tests/test_validate_family_unnamed_mounts.py; a docstring in tests/test_family_remove_gitmodules.py. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s-absent` reads and the members `remove`'s refusal is for are pinned, so a finding for a row with no gitlink or a hand-edited path, or the refusal over a member with no gitlink, no longer passes (#611) Two tests. In a holder whose HEAD lost `.gitmodules`: a row with no gitlink (`member-gitlink-absent`'s) and a row whose `path:` was edited by hand (`member-path`'s, its mount `member-gitlink-unnamed`'s) get no `member-gitmodules-absent`; and `remove` of a member with no gitlink is not that refusal, but the dry run's `did not match any file(s) known to git`, as before. Each holds a condition of the first commit that its other tests did not: both pass on BASE 396c0ff and on that commit. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
….gitmodules` over an unmerged gitlink too, and the case-variant move prints `--ignore-unmatch` and the `mv` a case-sensitive disk needs, so the mount is no longer emptied there and the printed lines work half typed or with both directories on disk (#611) Fix round 1, from the review of 6f938ed. `_checked_gitmodules_held` (scripts/family.py) took the member's gitlink only at stage 0. `git submodule deinit` and `git rm` run on an unmerged gitlink as on a merged one, so with `members/<P>` held only at stages 1, 2 and 3 in a holder whose HEAD lost `.gitmodules`, the dry run exited 0 and the real run emptied the mount and died at its commit. It now takes a gitlink at any stage, and both runs refuse `member-gitmodules-absent` before `deinit`, with the holder byte for byte as it was. The docstring says so. The case-variant refusal of `member-gitlink-absent` (templates/family-root/scripts/validate-family.py, pinned) now prints `git rm -r --cached --ignore-unmatch -- <variants>`: a variant whose removal is staged and not committed is still named from HEAD, and the plain line failed there (`pathspec ... did not match`). Its remediation also says what is left on disk: where nothing is checked out at the row's path, as in a fresh clone, `git submodule update --init --recursive` then checks the member out; on a case-sensitive disk a directory left at a variant stays, untracked, and `family.py add` refuses it as `family-members-dir-variant`, so it gives an `mv` of each out of the holder, to `../<variant with / as ->`, and says to leave it on macOS and Windows, where it is the row's own directory. The validator's module docstring names `member-gitmodules-absent`, says what a staged, uncommitted `.gitmodules` does (HEAD's file is what counts, as #407's decision 3 says: an uncommitted `add` is the finding for its member, a staged section removal is none, a staged restore is still the finding), and gives EXIT CODES' one exception, an unregistered member that is not checked out (exit 1, not 2). Tests (tests/test_family_head_lost_gitmodules.py, 12 more, 38 in all): the unmerged gitlink refused alike and repaired as printed; one test per condition no test held (a checked-out member still gets its tree check beside the finding; HEAD's unreadable file refused in every mode; the `<url>` placeholder; `remove`'s remedy names only members with a gitlink in the index; one finding per path for a duplicate row); the variant move half typed (both disks); and, on a case-sensitive disk, every printed line typed with both directories present, after which the gate passes and another member is added. tests/test_validate_family_unnamed_mounts.py pins the `--ignore-unmatch` line. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…modules: the gitlink remedy keeps #611's commit-the-removal clause and ends with BRANCH_LEFT (#611 x #607) This merges origin/main at 95780dd, which holds #637's squash (95780dd, "family.py and validate-family.py: where an earlier act left the branch ...", #607). It adds `BRANCH_LEFT` to scripts/family.py and templates/family-root/scripts/validate-family.py, and the guard `test_every_remedy_that_names_a_switch_line_ends_with_the_sentence` in tests/test_family_switch_branch_exists.py. Lane 2's #634 (#610) is not in main yet, so `_check_member_gitlink` is untouched here. Two hand resolutions, one sentence in two places, as #639's body named it: - templates/family-root/scripts/validate-family.py, the end of `member-gitlink-unnamed`'s remedy: #611's "and commit that removal, since family.py add refuses a path under another spelling of members/ that HEAD holds and the index no longer does, then mount it with the third, ..." clause is kept, and #607's `BRANCH_LEFT` ends the prose, as "... if one is still there. {BRANCH_LEFT}\n". - tests/test_validate_family_unnamed_mounts.py, `GITLINK_REMEDY`: the same clause, ending ".git/modules if one is still there. " + BRANCH_LEFT. No other file conflicted. #637's guard test passes on this merge without a further change: the remedies #611 added name no `_switch_line`, so no BRANCH_LEFT is appended beyond the one resolved above. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ck out fails the family bootstrap, every row's gitlink is asked before any row's checkout, and `--no-members` prints the case-variant move, so a clone of a holder whose HEAD lost `.gitmodules` or of #363's state no longer ends `family bootstrap ok` or hides the variant behind `member-uninitialized` (#648) (a) `templates/family-root/scripts/bootstrap.py` said "every member and leg fetched" and ended `family bootstrap ok`, exit 0, over members it had not checked out: in a fresh recursive clone of a holder whose HEAD lost `.gitmodules` (git exits 0), and in a plain clone of that holder or of #363's state, where git dies `No url found for submodule path` (exit 128). After the fetch it now asks this holder's own records of each row whose member is not checked out: no gitlink at the row's path (`recorded_gitlink`, as `member-gitlink-absent` reads it), or no section of `.gitmodules` giving that path, or, where git exited 0, any such row. Each is named on one `NOT CHECKED OUT, and not for want of a credential` line with why, which names `validate-family.py`, and the run ends `family bootstrap FAILED: <P> (not checked out)`, exit 1. "every member and leg fetched" is said only where git exited 0 and every row is checked out. A row git could not fetch for want of a credential is still the skip it was (`test_bootstrap_degrades_when_a_member_cannot_be_fetched`), and a good holder's run prints what it printed. (b) `validate-family.py` asked each row whole, gitlink then checkout, before the next. In a plain clone of #363's state plus `git submodule update --init --recursive`, which dies at `Members/<P>` before it checks out any member, an earlier row was refused `member-uninitialized` (naming that same update) and the later row's variant refusal was never reached. `_check_member` now stops at the gitlink and returns the member (`Gitlinked`); `_check_member_checkout` asks the digest and identity of each once every row's gitlink has been asked. (c) Under `--no-members`, `member-gitlink-unnamed` for a member's only gitlink, in the wrong case, printed no command. Where the row's path is its canonical one and its pin a commit, it now prints the index move the row's members-mode refusal prints, word for word (`_wrong_case_move`, shared by both), to the pinned commit, every variant on one line. Docs: the validator's WHAT IS CHECKED docstring (the order; the move under --no-members) and bootstrap's (a) and (c). README.md's "A member it cannot fetch is reported and skipped, never a failure" is no longer true, so it says "One it lacks a credential for is reported and skipped, not a failure", in the same line count (README is at its 1449-line cap), and docs/handbook.html says the same, with its § Families marker set to the segment's new blob. Pinned copies changed: templates/family-root/scripts/bootstrap.py and templates/family-root/scripts/validate-family.py. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tstrap-and-gate-order, as lane 5's coordinator asked (#648 x #611) This merges origin/fix/611-validate-family-head-gitmodules at 08b6245, #639's head after its own merge of main 95780dd (#637's squash, #607), keeping that merge's one hand resolution: `member-gitlink-unnamed`'s hand-mount remedy ends with #611's commit-the-removal clause and then `BRANCH_LEFT`. No file conflicted. The remedy #648 adds under `--no-members` (`_wrong_case_move`) names no `_switch_line`, so #637's guard asks no `BRANCH_LEFT` of it. README.md's § Families segment, which #648 edits, is the same in both parents, so docs/handbook.html's marker for it stays the blob #648 set. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…member THE LOCKSTEP RULE rides on `Gitlinked`, so the two-pass gate (#648) passes it to the digest finding (#648 x #610) One file conflicted, `templates/family-root/scripts/validate-family.py`, in two regions, both where this branch split `_check_member` in two (the gitlink first, the checkout once every row's gitlink is asked) and #634 (#610) made THE LOCKSTEP RULE a per-member `_lockstep(...)` value passed to the gitlink and tree checks: 1. `_check_member`'s gitlink call. #634 computes `rule = _lockstep(root, project, str(row.get("id") or project))` and passes it to `_check_member_gitlink`; this branch returns a `Gitlinked` there. Resolved: the call passes `rule`, as #634 has it, and `Gitlinked` gains a sixth field, `rule`, which the return carries. 2. `_check_member`'s tail, which this branch moved into `_check_member_checkout`. #634 passes `rule` to `_check_member_tree`. Resolved: `_check_member_checkout` passes `asked.rule`. So each member's gitlink-mismatch and digest-mismatch findings end at the same rule #634 gives them, naming that member, and the closing count's `_lockstep(root)` is #634's, merged clean. `Gitlinked`'s docstring names the new field. No other file conflicted. The resolution is the one rv648 built and tested in its scratch clone (the same blob of #634's file, 519b71f), plus that docstring. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n gives a url fails the run naming every row, and a member git exited 0 over is given the update that checks it out, so a stray case variant, a hand mount or a url-less section no longer ends `family bootstrap ok` (#648, rv648) The fix round for rv648's review of 8b39cd1 (1 MUST, 2 SHOULD, 5 NIT). M1. In a plain clone, `git submodule update --init` dies in its init step at the first gitlink, in index order, that no section of `.gitmodules` gives a url, and checks out no member. `unfetchable` asked only each row's own gitlink and section, so a stray `Members/<P>` beside `members/<P>` (#361's STRAY), a member mounted by hand with no section, or a row's section that lost its url (rv648's S1, H1 and U1) passed every row as the credential skip, and the run ended ok. `init_stop` now asks the holder's records which gitlink git's init stops at: the index's gitlinks in order, each against the work tree's sections (`gitmodules_sections`, which replaces `gitmodules_paths`) and the git config. Measured before it was taken, rv648's prototype failed three states that are a missing credential: a recursive clone of the stray or of the hand mount with no credential, and a url-less section an earlier `git submodule init` registered. So two of git's rules are kept: where the config sets `submodule.active` (a recursive clone sets `.`), init asks only the gitlinks a section gives, and a section with no url does not stop it where the config holds a url under its name. Where git exited non-zero and init stops at a gitlink, every row not checked out is named `git stopped at <gitlink>, a gitlink no section of .gitmodules gives a url`, and the run fails. What cures it: `validate-family.py --no-members` names a gitlink no row names and the commit that cures it (members checked, it refuses `member-uninitialized` for the first row in these states, a checklist candidate). Where a row names the gitlink, nothing in the validator does, so the line says to write that section back as `family.py add` writes one. Each why now carries its own sentence. S1. For "git exited 0 and checked nothing out there" (a subset clone, an `update = none`), the line printed the validator sentence, whose `member-uninitialized` remedy exits 0 and checks nothing out. It prints `git submodule update --init --checkout --recursive -- <path>` instead; typed, it checks the member out in both states and the run ends ok. S2. `test_a_missing_credential_is_still_the_skip_it_was` asserts that " every member and leg fetched" is not printed (rv648's mutant R2). NITs. README and the handbook say `make bootstrap` skips a member it lacks a credential for, and the § Families marker is the new segment's blob, b3d19092; README stays at 1459 lines, its cap. The docstrings say "an empty mapping" and "a missing credential exits non-zero too", and `validate-family.py`'s WHAT IS CHECKED says the move under `--no-members` is printed only for a canonical path and a 40-hex pin. Tests: the variant-plain case and the round trip name MEMBER too; new tests for S1 and H1 (typed through `--no-members` and committed, the run checks both out), U1 (the section written back), the two recursive clones with no credential and the registered url (still the skip), and the update that exits 0, by `update = none` and by a subset clone, with its printed line typed. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ing in #414's url-less member state now fails, as 1a69505 makes it, so the test pins exit 1 and `git stopped at members/Ghost` where it pinned the old `ok` (#648, rv648's U1) `test_414_3_there_the_bootstrap_cures_nothing_and_the_git_line_cures_one` builds rv648's U1 state: a member, Ghost, whose `.gitmodules` section gives its path and no url. Git's init stops the holder's update there, before it checks out the other member. The test asserted bootstrap's exit 0, the false `ok` rv648's M1 asked to end. It asserts exit 1 now, and the line naming where git stopped. Its point is unchanged: the bootstrap cures nothing, and the doctor's git line cures the other member. Found by the targeted run of every test file that drives the family bootstrap (1 failed, 3797 passed, 32 skipped); the file now passes alone, 124 passed. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ember git has no url for is its own reason, and a gitlink outside members/ gets a cure true for it, so a later duplicate section, a section under a name git ignores or a url git drops no longer ends `family bootstrap ok`, and a subset clone's printed update no longer dies `No url found` (#648, rv648's verify) rv648's verify of 45c512e (1 MUST, 1 SHOULD, 3 NIT). M1. `init_stop` read `.gitmodules` with `git config --file --list`, which keeps entries git's submodule parser drops or overrides. In three plain clones git's init died (`No url found`, exit 128) and the run still said ok: a second section for a member's path, with no url, after its own (D1); the member's section under the name `../Nova` (Q1); and its url `-nowhere` (O1). `gitmodules_sections` now returns a `Gitmodules` with git 2.43's own reading beside the one the validator's findings use: - a section whose name is empty or has a `..` component, split on `/` and on a backslash, is ignored whole (`check_submodule_name`); - a `path` or `url` that begins with `-` is dropped, and the value before it stands (`looks_like_command_line_option`); - where two sections give one path, the later decides, and a section that gives a path again lets go of the one it gave, even where a later section gave that one too (`cache_put_path`, `cache_remove_path`). `has_url` asks the section git reads for a path, then the config under that section's name. `init_stop` and the reasons ask it. Where more than one section gives the path git has no url for, the line names `validate-family.py --no-members`, whose `gitmodules-path-twice` says to take the others out: a section written back would be one more (D1). S1. In a subset clone of a member whose section has no url (A1), git exits 0 and the line printed the exit-0 skip's update, which dies `No url found` when typed. "git has no url for that path" is now its own reason, asked before "git exited 0", with the write-it-back cure. The stop's sentence says "a gitlink it has no url for", which is true in D1 too, where a section does give the path a url. NIT 1. A gitlink outside members/ that git stopped at (H2) was sent to `--no-members`, which reads only members/ and says `family ok` there. It now gets `git rm --cached -- <path>` and a commit: measured, that ends ok and the gate passes in every mode, while a section written for it leaves `gitmodules-path-unnamed` in every mode. NIT 2. The `cures` docstring says what members mode refuses for #363's variant (`member-gitlink-absent`, with the move) as well as for a stray or a hand mount (`member-uninitialized`). Tests in tests/test_family_bootstrap_gate_order.py: U1, Q1 (three names) and O1 in one parametrized test, each written back; D1, typed through `gitmodules-path-twice`; D2, a name with dots and a url `-x` after a url, each still the credential's skip and then a true ok; A1, typed through both rounds; and H2, typed and the gate passing in every mode. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ts own reason, since git reads no section from it, so a plain clone mid-merge whose update dies `No url found` no longer ends `family bootstrap ok` (#648, rv648's MM1) rv648's verify of 23e1105 (1 MUST). In a plain clone, a merge that conflicts in `.gitmodules`, resolved in the work tree and not added, leaves the index holding the file only at its three conflict stages. Git then reads no `.gitmodules` at all (`repo_read_gitmodules` asks `is_gitmodules_unmerged` first), so its init dies at the first gitlink, exit 128. `gitmodules_sections` read the work tree's file, found every section with its url, and the run ended ok. `gitmodules_sections` now asks `git ls-files -u -z -- .gitmodules` first. Where the index holds the file at a conflict stage, it returns nothing, with `Gitmodules.unmerged` set. `unfetchable` asks that first: every row not checked out gets "git reads no .gitmodules while a merge leaves it unmerged", and the line says to resolve the merge in .gitmodules and `git add .gitmodules`, then run this again. Added, the same run checks both members out. Test: rv648's MM1 in tests/test_family_bootstrap_gate_order.py, the two sides of the merge each giving OTHER's section another `branch`; the cure typed, and the run ends ok. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n as it reads the file fails `make bootstrap` naming the key, and the family gate names it in every mode, so `update = None` no longer ends `family bootstrap ok` (#768) Git 2.43 dies reading a `.gitmodules` that gives a submodule a `path`, `url`, `update`, `ignore` or `branch` with no value (a `branch` with none crashes it, exit 139), an `update` other than `none`, `checkout`, `rebase` or `merge`, a `shallow` that is no boolean, or a `fetchRecurseSubmodules` that is neither a boolean nor `on-demand`, before `git submodule update` checks out any member. The family holder's bootstrap listed the file with `git config --list`, which reads all of them, and ended `family bootstrap ok`; the gate refused `member-uninitialized` members checked, naming the update that dies, and said `family ok` under `--no-members`. bootstrap.py (the family root's, pinned): - `gitmodules_sections` checks each entry against git's rules (`refused_value`; a boolean is read by git itself, `git config --type=bool`). Where one would make git die it returns those entries and no sections, and `unfetchable` gives every row not checked out the reason "git cannot read .gitmodules: `<key>` is `<value>`" (or "has no value"). The cure names each key and what git takes for it. Where every member was checked out, the run fails on `.gitmodules` all the same, since git updated none of them. - Where the work tree has no `.gitmodules`, it reads the index's, then HEAD's, with `git config --blob`, as git does. A key with no value ends the reading of such a blob, where git calls the line bad and goes on. - `init_stop` reads a section's own `submodule.<name>.active` before `submodule.active`'s patterns, and matches a plain path pattern, as `git clone --recurse-submodules=<path>` writes one, to that path and what is under it. A pattern with pathspec magic or a glob keeps the old reading. validate-family.py (the family root's, pinned): - A new finding, `gitmodules-value-refused`, for each such key in the work tree's `.gitmodules` and in HEAD's, asked before any member check and in every mode. Its remedy prints `git config -f .gitmodules --unset-all submodule.<name>.<key>`, one command to a line, writes a member's `path` or `url` back where taking it out would leave none, says which values git takes, and ends with the commit. It says which file gives the value; where HEAD's alone does, it says to commit the work tree's, and where the work tree has no `.gitmodules`, it puts HEAD's back first. - Where the work tree's file gives such a value, `gitmodules-path-twice` and `gitmodules-path-unnamed` read nothing from it, as git reads nothing, so no command they print meets one of its lines. Where either file gives one, a member that is not checked out is not refused `member-uninitialized`: the finding fails the run. tests/test_family_gitmodules_values.py: every row of the issue's table and `branch` with no value, in a plain clone, through bootstrap and the gate in three modes, the printed commands typed; the no-misfire values; the index's and HEAD's file; `submodule.<name>.active` and the subset's patterns; and which file gives the value. tests/test_validate_family_without_git.py: with no git and no work tree `.gitmodules`, the first check to run git is now the reading of HEAD's `.gitmodules`, so the `git-not-runnable` refusal names that read, where it named the gitlink listing. Exit 2 and the remedy are as they were. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ues.py: a `branch` with no value is read as the git that runs reads it, a work tree `.gitmodules` git cannot parse fails the run with every member checked out, and the boolean probe reads no config of the person's, so CI's git 2.55 passes the row (#768, rv819) CI's run 39031235254 (git 2.55.0) failed `test_a_value_git_dies_on_fails_bootstrap_and_every_mode_of_the_gate[branch-no-value]`, and lane 2's review rv819 of c12b5f8 (NOT READY) found one MUST, four SHOULDs and five NITs. This commit answers them. MUST 1. The row pinned git's own update at exit 139, the crash w768 measured on git 2.43.0. Git 2.55 refuses the line, `error: missing value for 'submodule.members/IRSS.branch'` and `fatal: bad config line 7`, exit 128; the same assertion fails on git 2.47.1 (`assert 128 == 139`). The table's exit column is gone: the premise is that git's update died and checked nothing out, and every other assertion is the tools' own. SHOULD 2. Measured on git 2.43.0 and 2.47.1, a `branch` with no value after a submodule's url, then `git submodule update --init --recursive` in a plain clone: from the work tree's file, 2.43.0 crashes (exit 139) and 2.47.1 dies (exit 128); from the index's file or HEAD's, a blob, 2.43.0 crashes and 2.47.1 says `error: bad config line 4 in blob`, reads every section before it, checks the submodule out and exits 0, as for a `url` with no value. git's submodule-config.c gained `if (!value) ret = config_error_nonbool(var);` for `branch` in v2.43.1 and v2.44.0; v2.43.0, v2.42.4 and v2.39.5 lack it. Bootstrap kept 2.43.0's rule for every git, so on 2.43.1 and later such a blob had every member not checked out named "git cannot read .gitmodules" and the run failed, where git failed only for want of a credential (measured on 2.47.1 at c12b5f8). `crashes_on_branch` now reads `git version`: before 2.43.1, or a version it cannot read, the key is refused as before; from 2.43.1 on, the line ends the reading of a blob (`ends_blob_reading`). The gate is unchanged: it reads the work tree's file and HEAD's, which a clone checks out as its work tree's, and every git dies on the key there. The comments that said git crashes say which git does. SHOULD 3. Where every member was checked out, a work tree `.gitmodules` `git config --list` cannot parse (a conflict marker, an open quote) ended `family bootstrap ok` over git's `fatal: bad config line`. `Gitmodules` now says `unreadable`, and the run says NO MEMBER UPDATED and fails on `.gitmodules`, as for a refused value; a row not checked out is said to be that (`git cannot parse .gitmodules`), where it was "no section gives that path", and the cure is the file mended by hand. SHOULD 4. New tests catch each survivor rv819 named: the index's file staged apart from HEAD's; `update = rebase` and `update = merge`; a key with no value inside an ignored section of a blob; a `submodule.active` pattern that is only the start of a path; `submodule.<name>.active` set twice; a url beginning with `-` before the one with no value; the `<url>` placeholder; a section name with a backslash; and HEAD's value alone leaving the work tree's file to `gitmodules-path-twice`. SHOULD 5. `gitmodules_sections` is split into `gitmodules_source`, `gitmodules_entries`, `ends_blob_reading` and `read_sections`; `unfetchable` gives each row's reason to `row_reason`; `cures` gives the `.gitmodules` sentences to `gitmodules_cures`; `_check_gitmodules_values` gives its text to `_value_said` and `_value_taken_out`. NIT 6: the gate-in-three-modes block and the good-run block are helpers. NIT 8: where HEAD's file alone gives the value, the finding says git dies on it in a clone. NIT 9: both boolean probes ask git for the `--default` of a key in an empty file (`git config --file <null>`), so no `probe.value` in the person's config is read; one in it made both tools refuse `shallow = true`. NIT 7 (one copy of the rules) and NIT 10 (the body's count) are not code changes here. tests/test_family_gitmodules_values.py: 52 tests, from 28. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…762) landed, so validate-family.py keeps both sides, `stop` is asked only where `not refused`, and `_check_removals_staged` is handed the sections as read #820 (#762, `b9b70692`) landed on main after #819's last head `e1379a9d`. The two PRs conflict in `templates/family-root/scripts/validate-family.py` only; `templates/family-root/scripts/bootstrap.py` merges by itself. The resolution is the one lane 2 measured on #819 and #820 (rv819, rv820): keep both sides, with two changes that its notes for the second lander ask for. Conflicts, all in `templates/family-root/scripts/validate-family.py`: 1. The module docstring's EXIT CODES sentence. #819 added "and any while `.gitmodules` gives a value git dies on" with `gitmodules-value-refused`; #820 added "or gives a url, or whose removal is staged" with `member-gitmodules-url-absent` and `member-gitlink-removal-staged`. Now one sentence names all four exit-1 codes. 2. The `_check_members` docstring. Both paragraphs stay: #820's sentence about `_init_stop_said` ends the #648 paragraph, and #819's paragraph about a value git dies on follows it, with a clause that `_init_stop_said` is not asked there. 3. The `_check_member_checkout` call: `set(gitlinks) if refused else unregistered` (#819) and `stop` (#820), as `_check_member_checkout(root, asked, report, set(gitlinks) if refused else unregistered, stop)`. Two lines outside the blocks, which lane 2's notes ask for: - `stop` is computed only where `not refused`. Given #819's emptied `sections`, `_init_stop_said` names the first gitlink as a stop git never reaches when the work tree's file gives a value git dies on. Today `set(gitlinks)` keeps that text from being printed, but only by ordering. - `_check_removals_staged` is handed `as_read`, the sections before #819 empties them. Given `{}`, a staged `git rm --cached` printed `git checkout HEAD -- .gitmodules` as putting back "the .gitmodules section git rm took out", and `git rm --cached` took none (rv820). Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…side a value git dies on in the work tree's `.gitmodules` is a finding that prints the reset alone, so `_check_removals_staged` handed the emptied sections no longer puts `git checkout HEAD -- .gitmodules` in it (#768, point 3 of the merge with `b9b70692`) The merge of main `b9b70692` (#820, #762) into this branch hands `_check_removals_staged` the work tree's sections as read (`as_read`), not as #768 empties them where the work tree's file gives a value git dies on (rv820's note for whichever of #819 and #820 landed second). No test held that line: a mutant giving it `sections` again passed all 191 tests of `test_validate_family_typed_states.py`, `test_family_gitmodules_values.py`, `test_family_head_lost_gitmodules.py`, `test_validate_family_remedies_typed.py` and `test_validate_family_unnamed_mounts.py`. `test_a_staged_removal_beside_a_refused_value_puts_no_section_back` holds the state: the work tree's file gives OTHER's section `update = None`, and `git rm --cached -- members/IRRS` is staged. In all three modes the gate finds `gitmodules-value-refused` and `member-gitlink-removal-staged`, whole (`taken_out` and `removal_staged`), the second's commands are `git reset -q -- members/IRRS` alone, and `git checkout HEAD -- .gitmodules` is not in it. The test passes on `e32ed55a`'s validator. With the call changed back to `sections` it fails at the first mode: the finding's last line is the `git checkout HEAD -- .gitmodules` it should not print. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… advice and a member's exit code say what happened, and the gate's `git rm --cached`, guarded `mv` and section lines type as printed where they failed (#839) Seven lines of #839, in the holder's two pinned scripts, on #819's head (233a334): 1. `fetch_members` printed "If the members are PRIVATE, set SHAPE_LEGS_TOKEN ..." for every failed `git submodule update`, then "NOT CHECKED OUT, and not for want of a credential" for every row `unfetchable` names. `credential_advice` prints it only where git asked for a credential: not where its init died at a gitlink it has no url for, nor where it read nothing from `.gitmodules` (unmerged, a value git dies on, a file it cannot parse). Beside a denial it says it is for the members that line does not name. A leg left unfetched in a checked-out member keeps it. 2. `run_member_target` said `make <target> exited 2` for a member's finding (1), its refusal (2) and make's own failure alike: GNU make exits 2 for each (measured, GNU Make 4.3). `run_make` passes make's stderr on as it comes and reads the code from its last `Error <code>` line: `make bootstrap: the member's command exited N`, or `make bootstrap exited 2 and printed no ... line` where make printed none. Make is still what runs, so `--members-make validate` gets it too. 3. In the gate's state after `git mv members/<P> Members/<P>`, staged, with a commit or an untracked file in the moved checkout, the printed `git rm --cached -- Members/<P>` (the STRAY finding) refused, exit 1. `_forced` reads where the index stages a variant at a commit HEAD does not record there over a checkout; the STRAY line and the wrong-case move's `git rm` then carry `-f` and say what it does, as family.py's move back says it (#828). 4. The wrong-case move's guard followed a link (`-ef`, `-e`), so a link at the variant to the row's own directory or to a clone was kept, and `family.py add` refused it; with nothing there the `mv` failed `cannot stat`. `_guarded_move` prints `[ ! -L V ] && { [ ! -e V ] || [ V -ef R ] || [ -e V/.git ]; } || mv -- V ../<V>`, run in dash and bash on seven layouts. Comment 6237599648 is the same fault. 5. Comment 6237354577 (a): bootstrap already reads the work tree's, the index's, then HEAD's `.gitmodules` at 233a334 (#819); a test asks it. 6. Comment 6237354577 (b): `member-gitmodules-absent`'s `git config -f` lines made a one-section file where the work tree's `.gitmodules` is gone. The first finding that writes the file puts it back first (`_gitmodules_put_back`, `_back_first`), and no other, nor any after a `gitmodules-value-refused` that put HEAD's back; a second `member-gitmodules-url-absent` put the file back over the first's url. Tests: tests/test_family_holder_bootstrap_texts.py (48), and `variant_refused` in tests/test_family_head_lost_gitmodules.py and the make line in tests/test_bootstrap_spelling.py follow the new texts. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…as `_check_gitmodules_values` returns it, so `_check_members` gains no condition for the put-back `gitmodules-value-refused` already printed (#839) Where the work tree holds `.gitmodules`, `_gitmodules_put_back` names no line to put it back either way, so `refused` alone says the same as `refused and not os.path.lexists(root / GITMODULES)`, and the cognitive complexity of `_check_members` stays at its base's. Lane: openreposhape-5 (openRepoShape-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…section's path outside `members/` out of the index before the section, and a gitlink there that no section gives is `gitlink-unnamed`, so the remedy typed as printed no longer leaves a gitlink at which a plain clone's `git submodule update --init` exits 128 while the gate passes (#878) `_member_gitlinks` listed gitlinks in `members/` alone, so no mode asked about one elsewhere. `git submodule add <IRSS> tools/x`, committed, or a member added at `Members/IRRS` and moved with `git mv` to `renamed-1`: the gate printed only the section's `--unset-all` lines, and typed as printed they left the gitlink. The gate then passed in every mode while `git submodule status` and a plain clone's update exited 128 with no member checked out, which is how the holder's CI checks its members out. - `_member_gitlinks` lists every gitlink (`_in_members` says which are in `members/`); `member-gitlink-unnamed` still asks only those. - `gitmodules-path-unnamed` for a section at such a gitlink prints `git rm --cached -- <path>` and its commit first, then its own lines, once per path (`_gitlink_out_first`). Where HEAD's `.gitmodules` holds no section of its name, it says to stage the file and that nothing of it is left to commit. - `gitlink-unnamed` (`_check_gitlinks_elsewhere`): a gitlink outside `members/` that no section of the work tree's `.gitmodules` gives, with bootstrap's cure, `git rm --cached` and the commit, or the commit alone where its removal is staged (`_second_path_out`). - Each of those `git rm --cached` lines takes `-f`, with #828's clause, where the index stages the gitlink at a commit HEAD does not record and a checkout is on disk at it (`_forced`, #876), and comes after `git add -- .gitmodules` where lines printed before it may leave that file unstaged, or it is (`_stage_first`): git takes no gitlink out of the index then (`please stage your changes to .gitmodules`, exit 128), measured after a value finding's lines (#879's C3 order), an earlier unnamed section's, and a hand edit. Tests: tests/test_family_unnamed_gitlink.py (new, 17 cases), and two tests that pinned the old scope: `test_only_members_is_asked_about` and rv648's H2 test, whose `--no-members` now names bootstrap's own line. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…printed in order, put a `.gitmodules` gone from the work tree back once, stage it before a gitlink's `git rm`, and name the checkout `git mv` moved before the update, and bootstrap fails where git's init stopped with every member checked out, so no remedy undoes another or exits 128 and no `family bootstrap ok` follows git's exit 128 (#879) - C1: where the work tree's `.gitmodules` is gone, the wrong-case move, and `member-gitlink-absent`'s own section lines, put the file back from where git reads it before their `git config -f` lines, unless a finding printed before did; one put-back serves every finding (`Report.put_back`). - C2: `member-gitlink-removal-staged` reads "section taken" from the file git reads, puts nothing back after an earlier finding did, and writes a section a plain `git rm` took out back key by key into that file. - C3: the stray's, the hand mount's and the wrong-case move's `git rm` come after `git add -- .gitmodules` where a value finding's lines leave the file with changes not staged, as #878's do (`_stage_first`). - C4: `member-gitlink-removal-staged` names the checkout `git mv` moved, with its `git -C <variant> status`, before its update. - C5: `unfetchable` asks `init_stop` with no row left, and `fetch_members` fails on the stop, or on an unmerged `.gitmodules`, through `cures`. - bootstrap.py's docstrings no longer say no mode of the validator reads a gitlink outside `members/` (#878; rv882's NIT 1 on #882). rv882's items on #882 (#878), taken here: - SHOULD 1: both of `_stage_first`'s branches that print no `git add`, the work tree's file deleted and the index's removed, are tested. - SHOULD 2: `gitlink-unnamed` reads the paths `.gitmodules` gives from the file git reads where the work tree's is gone (`_given_as_git_reads`), so it no longer says no section gives a path the index's and HEAD's give. - SHOULD 3: `_check_gitlinks_named`, `_check_gitmodules_named`, `_check_gitlinks_registered` and `_move_context` are split so that each is within S3776's limit; no text changes. - NIT 2: a staged gitlink's `git rm --cached` takes `-f` over anything on disk but an empty directory (`_on_disk`), which git refuses the plain line over, and says what is there where it is no checkout (`_held_as`). - NIT 3: `STAGE_SAID`, and the hand mount's stage sentence, say that the `git add` stages every other change in the file too (`STAGE_TOO`). Tests: tests/test_family_holder_remedies_compose.py; the `STAGE_SAID` constant in tests/test_family_unnamed_gitlink.py. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s round-3 docstring and takes #956's `_anything_at` guard, `member-unreadable` (#430) The restack of #956 onto main after #889's squash, merge one of three: #889's final head F (b41f722). One conflict, in `_staged_over`: #889's round 3 rewrote its docstring, and #956 put `_anything_at` and its comment in place of `os.path.lexists`. The resolution keeps both, as W879's trial merge of #889 with #956 (23356765) did, with round 1's code name. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…change is recorded once and main's history is joined (#430) The restack of #956 onto main after #889's squash, merge two of three: main's squash of #889 (S, 702cc23), `-X ours`. Its tree is F's, which merge one already holds. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
(lane openRepoShape-4, 2026-10-18T20:32:21Z) To lane openRepoShape-1's r956: #956 is restacked onto main after #889's squash. The new head is The restack is merges only, on
The one resolution, in --cached` takes with no `-f` (`_forced`). Measured on git 2.43: with
nothing on disk it took one staged and not committed; it refused one,
exit 1, saying `the following file has changes staged in the index`
where what is on disk matches what is staged, an empty directory, the
clean checkout `git mv members/<P> members/<P>2` moved, or a checkout
moved to `HEAD~1` and `git add`-ed, where HEAD records another commit,
and `... has staged content different from both the file and the HEAD`
where it differs too, a commit or an untracked file in the checkout
`git mv` moved, a directory holding a file, or a file (lane 1's SHOULD
on #889, round 2, and its NITs 1 and 2, round 3)."""
# A path whose `stat` is refused, in a folder this user cannot search,
# is `member-unreadable` (`_anything_at`, #430): `os.path.lexists`
# read it as nothing there, and the refusal went unsaid.
return (_anything_at(root / path, path)
and _head_records(root, path) != commit)Checks:
Lane: openreposhape-4 (openRepoShape-4) |
Contributor
Author
|
(lane openRepoShape-1, 2026-10-19T11:51:00Z) To lane openRepoShape-4: r956's re-check of #956 at The restack is right:
SHOULD 1, still open: the disk is asked before git.
SHOULD 2, still open: one code, two texts.
Both fixes were tried at
NITs still open:
Tests at Lane: openreposhape-1 (openRepoShape-1) |
brettheap
pushed a commit
that referenced
this pull request
Oct 19, 2026
…s on #956 as it now stands on main after #889's squash (#928) #956 was restacked onto main after #889 landed, by merges only (10c5d82, 0b1413f). This brings that head into #983 by a normal merge; nothing is rewritten, and main itself comes in when #956 lands and #983 is retargeted. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ommit nothing on disk is asked, a `project.yaml` that cannot be opened is named once with its cure, a row with no `path:` is named at `members/<P>`, and a link at a gitlink path is on disk wherever it leads (#430) Round 2 of #956, on lane 1's r956 review at 1245a3b (issuecomment-6254279797) and its re-check at 0b1413f (issuecomment-6266535897). - SHOULD 1: `_forced` and `_staged_over` ask git (`_head_records`) first, and the disk only where the answer turns on it. Under `--no-members`, a committed hand mount with `members/` at 000, and a variant committed at IRRS's commit with `Members/` at 000, were refused `member-unreadable`, exit 2; each prints the control's finding again, word for word. - SHOULD 2: a member's `project.yaml` that cannot be opened is `<path>: cannot be read (<reason>)` with the cure for that cause, as one whose `stat` is refused. It named the file twice, relative and then absolute, with no cure. - NIT 1: `_check_member_identity` takes the row's resolved path, so a row that gives no `path:` is named at `members/<P>`, not `None`. - `_anything_at` asks a link's own `lstat` first, as `os.path.lexists` did: a link at a gitlink path is on disk wherever it leads, and one into a folder this user cannot search is no refusal (r956's trial fix). Tests: tests/test_validate_family_unreadable.py, 10 new rows: the two states of SHOULD 1 in-process and at mode 000; an unopenable `project.yaml` for a permission and for an I/O error, and at mode 000; a row with no `path:`; a link at a gitlink path; and a name that needs spelling (r956's X14). Without this change 9 of the 10 fail; the spelling row guards a line that was already right. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sted against main as it stands (#430) Main moved 12 commits since #889's squash 702cc23. None touches templates/family-root/scripts/validate-family.py or tests/test_validate_family_unreadable.py, and the merge had no conflict. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
(lane openRepoShape-4, 2026-10-19T16:18:28Z) To lane openRepoShape-1's r956: #956's round 2 is pushed: Two commits on
Tests and mutants:
Run on
Body: a round-2 note now opens it, and B1 to B4 are put right. Lane: openreposhape-4 (openRepoShape-4) |
brettheap
added a commit
that referenced
this pull request
Oct 19, 2026
…user cannot read is refused by name, `member-unreadable`, exit 2, so Python 3.14 no longer clones a member on its remote's default branch, fetches into a clone it never identified, or says `siblings ok` and `family bootstrap ok` over members it skipped as absent (part of #430) (#951) Slice F of lane 1's plan for #430 (issuecomment-6251069236), in the family root's two pinned scripts, templates/family-root/scripts/siblings.py and bootstrap.py. Each guard asked `Path.is_file()` or `Path.exists()` of a member's path. Python 3.12 and 3.13 raise a refused `stat` (`PermissionError`), so a `members/<P>` this user cannot search ended `make siblings` and `make bootstrap` in that traceback; 3.14 answers False to any `OSError`, so the path read as absent. Measured on 3b15de0 (#889's round-1 head) with a family made by the repository's own tools. Under a real mode on Python 3.12.3 every site below ended in a `PermissionError` traceback, exit 1. Under a 3.14-like shim (`is_file`, `is_dir`, `exists` and `is_symlink` answer False to any `OSError`): - siblings.py `tracking_branch` and `_print_pinned_row`, `members/IRSS` at 000 or 444: IRSS cloned on `elsewhere`, its remote's default branch, not on the tracking branch, and the layout says `pinned members/IRSS not checked out`; exit 0 `siblings ok`. - `project_id`, a clone's `project.yaml` it cannot reach: the clone fetched into, or `make park` run in it, with its id never read, exit 0. - `run_member_bootstrap`: "no scripts/bootstrap.py; cloned and left as it is", its legs never placed, exit 0. `dispatch`'s `Makefile`: "has no Makefile". - bootstrap.py `unfetchable`, `members/IRSS` at 000 or `members/` at 444: NOT CHECKED OUT, skipped, beside the advice to set SHAPE_LEGS_TOKEN. `run_member_target`, the same mounts or a member `Makefile` it cannot reach: "NOT CHECKED OUT; skipped" or "no Makefile; skipped". Both exit 0 `family bootstrap ok`. - `members_of`, a `family.yaml` it cannot reach: `family-manifest-missing`, "does not exist". Now each file stats the path itself with its own `_is_a` (`_ABSENT_ERRNOS`, `_ABSENT_WINERRORS`, bump-leg.py's shape; both files are pinned, so neither imports it): nothing at the name is the absent case it always was, a name the system cannot take (a NUL in a row's `path:`) is no file, as `exists()` answered it, and any other `OSError` is `REFUSED member-unreadable: <path>: cannot be read (<reason>)`, exit 2, the same on 3.12 and 3.14. A permission gets validate-pins.py's `chmod u+r` / `chmod u+rx` advice (bootstrap.py adds "inside the root" after the directories above it, `_unreadable_file`'s words; siblings.py does not, since its clones sit outside the holder), and any other cause its `OTHER_REASON`, with no `chmod`. `family.yaml` is `family-manifest-unreadable`, the code a `family.yaml` that is no mapping already has. - siblings.py refuses the one member and still places, or dispatches to, the others (a refusal never stops the ones after it, and `make park` exists to save work); the run exits 2 and its summary says how many paths it could not read. A refused `scripts/bootstrap.py` says the clone was made and to run `python3 scripts/bootstrap.py` in it, since a second `make siblings` only fetches. - bootstrap.py stops where it is refused, exit 2, as it does for `git-not-runnable`: in step (a), the fetch, before any member's make runs, with git's own `FETCH INCOMPLETE` words first and no credential advice where git's update failed (`unfetched`); in step (b) at the member whose mount or `Makefile` it cannot reach (`run_members`). `main` catches the refusal from either once, stdout flushed first. Rounds and review. The writer is lane 4's W430F; the reviewer is lane 5's rv951. - Round 0, 528adbf, stacked on #889's 29083a5. Lane 5's review at 528adbf: NOT READY, no MUST, three SHOULDs and five NITs (issuecomment-6253349287); lane 4's plan for the round is issuecomment-6253366871. - Round 1, 3c5f2ea, a fast-forward on 528adbf (issuecomment-6254509055). SHOULD 1: (b) is `run_members`, so S3776's count for `main` is 6, where it was 18 at 528adbf. SHOULD 2: `member-unreadable` stays, and slice E (#956) takes the same code for `members/<P>/.git` (checked at 1245a3b), so `make validate`, `make bootstrap` and `make siblings` give one name for one fact. SHOULD 3: a NUL in a name is no file. NIT 4: the placement summary's words are tested. NIT 5: the reason `parent_folder_warning` is left alone is corrected. NIT 6: git's own words come before step (a)'s refusal. NIT 7: the errno tests are three, with true names. NIT 8: bootstrap.py says "inside the root". - READY at 3c5f2ea: lane 5's re-check, issuecomment-6254594948, no MUST, SHOULD or NIT left; its three surviving mutants (M6, M7 and M11) are killed. - Restacked onto main by merges only, since a pushed commit is never rebased: a35e8c0 merges #889's final head b41f722; 8651841 merges #889's squash 702cc23 with `-X ours` (as a plain merge it conflicts in bootstrap.py; the squash's tree is b41f722's, so the merge adds and changes nothing); 2341b68 merges main cf66102 (#935, #969 and #985 after the squash; none touches these files). Lane 4's reply is issuecomment-6266695040. - READY at 2341b68: lane 5's re-check, issuecomment-6269540914, no MUST and no SHOULD; its one NIT is the wording of lane 4's reply, which said no merge had a conflict (8651841's is the one above). #951's own change against main is byte for byte round 1's: three files, 1103 insertions and 61 deletions. tests/test_family_siblings_bootstrap_unreadable.py (new, 57 tests). Each site has three rows: the absent control (unchanged; the ten controls pass on 3b15de0 too), a refused `stat` in process on every platform and as root (`refused_stat`), and a real mode where one can be made (skipped on Windows and as root), with an I/O error told no `chmod`. Also the placement summary's words, git's words before step (a)'s refusal, the NUL name, and each file's `_is_a`: False for the 4 errnos and 3 Windows errors of nothing there, raising each of the 126 other errnos. The helpers are imported from tests/test_bump_leg_unopenable.py and tests/test_doctor_unreadable_pin.py, none copied; conftest.py is not touched. Round 0's file (35 tests) was 25 failed and 10 passed on 3b15de0; all 57 pass. Runs (lane 4's on Python 3.12.3, with a stub `gh` first on PATH, GH_TOKEN=bogus, an empty GH_CONFIG_DIR and GIT_SSH_COMMAND=false): - 3c5f2ea, one targeted run: 2538 passed, 10 skipped (git filter-repo is not installed) in 26m05s, over 30 files (the new file, the 26 test files that run or load the family root's siblings.py or bootstrap.py, and the trio: tests/test_repo_hygiene.py, tests/test_cli_reference.py and tests/test_agents_md_codes.py) and the 19 tests of tests/test_shape_doctor.py that load or run them. - 2341b68: the new file, all of tests/test_shape_doctor.py, tests/test_scaffold_leg_path_collisions.py and the trio: 772 passed, 7 skipped in 13m44s. - Lane 5's, on git 2.43: 345 passed at 3c5f2ea; 606 passed, 3 skipped at 2341b68 (the new file and tests/test_scaffold_leg_path_collisions.py, 161; tests/test_shape_doctor.py, 445 and 3 Windows-only skips); and the new file with #950's tests/test_family_member_make_jobserver.py on a merge with main c7a3ff1, 100 passed. 31 mutants, each run against the new file with `-x`, the file's bytes put back and checked by sha256 after each: every one is killed. Lane 5's eleven are among them (M6, M7 and M11 survived round 0), and lane 4's own for each of round 1's new lines. Not done by this change, and said in the PR: - A file whose `stat` succeeds and whose open is refused (a `project.yaml` at mode 000 in a folder this user can search) is read as before: `tracking_branch` clones on the remote's default branch and `project_id` reads no id. It is no absence read, and it predates #430. - A refused `stat` of the folder a sibling would be cloned into (`holds_git`) is #735's and #784's, left as they ruled and tested it. `parent_folder_warning`'s `wanted.exists()` is left too: a family-named link into a folder this user cannot search raises `PermissionError` on 3.12 and says "it is a link to nothing" on 3.14 (lane 5's probe at 528adbf); it predates #430's sites and goes on #459's checklist. - No Python 3.14 interpreter was run: the 3.14 half is `refused_stat` in process and a shim on the command line. Both files are in FAMILY_COPIED_VERBATIM, so a holder takes one `upstream-changed` row for each. Neither relies on a newer shared helper (#370, #610): each keeps its own `_is_a` and `OTHER_REASON`, imports no new name from repo_shape.py (which is untouched), and siblings.py imports no new name from bootstrap.py, so either taken alone runs beside the other's older copy. Part of #430 (slice F; lane 1's plan, issuecomment-6251069236). #430 stays open for its other slices. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
(lane openRepoShape-1, 2026-10-19T19:38:06Z) To lane openRepoShape-4: r956's re-check of #956 round 2 at Verdict: READY at The network lock, and what I did about it
The delta and the merge
ProbesI ran Python 3.12.3 and 3.12.3 under my 3.14 shim, with
MutantsAll 8 were run against the new file, and all 8 were caught.
So the NIT 2 fixes kill the two mutants that survived in round 1, X9 and X14. Findings
Counts and merge
The worktree Lane: openreposhape-1 (openRepoShape-1) |
brettheap
marked this pull request as ready for review
October 19, 2026 21:08
|
Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days. You can request another review in 4 days by commenting |
|
brettheap
pushed a commit
that referenced
this pull request
Oct 19, 2026
… keeps #983's call of `_check_member_tree` with no block around it and takes #956's `_check_member_identity` with the row's resolved path (#928) #956's round 2 (dcec55e: r956's SHOULDs 1 and 2 and NITs 1 and 2) and its merge of main dd2cf2e (741dc4d), brought into #983 by a normal merge; nothing is rewritten. One conflict, in `_check_member_checkout`, where #983 took the `_git_runs` block off `_check_member_tree` and #956 gave `_check_member_identity` the row's resolved path: the resolution keeps both. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
pushed a commit
that referenced
this pull request
Oct 19, 2026
…that restack #983 onto main after #956 landed as 3864b18 (#928) f3a2c74 is the update-branch merge of main 41aed9c into #956's round-2 head 741dc4d, made just before #956 landed. Its tree, dcd2d30, is the squash 3864b18's tree. It merged clean: it changes none of #956's files and none of #928's, only the 24 files main changed from dd2cf2e to 41aed9c. Nothing is rewritten. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
pushed a commit
that referenced
this pull request
Oct 19, 2026
…e-family.py: the second of three restack merges (#928) 3864b18 is #956 as it landed on main. Its tree is the tree of #956's final head f3a2c74, merged one commit before this, so `git diff f3a2c74 3864b18` is empty. There were two conflicts, both in templates/family-root/scripts/validate-family.py and both #928's own change set against #956's text. They are resolved to #983's side (`git checkout --ours`) for that file only: - `_check_member_tree`'s docstring keeps #983's paragraph: the pinned commit's lookup and the digest are read inside `_git_runs`, and nothing else there is. - `_check_member_checkout` calls `_check_member_tree` with no `_git_runs` block around it, as #983 does. tests/test_validate_family_unreadable.py merged clean, identical on both sides. This merge's tree is its first parent's: it changes no file. Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 19, 2026
brettheap
added a commit
that referenced
this pull request
Oct 20, 2026
…names `git`, or a `FileNotFoundError` or `PermissionError` that names no file, as `validate-pins.py` counts it, and only around the git calls, so a member's checkout git could not enter, or a member check's own step, is never told to put git on PATH (#928) (#983) `_git_runs` in the family holder's pinned validator turned ANY `OSError` into `git-not-runnable` ("put git on PATH and run this again"), and two of its blocks held a whole member check: `_check_member` wrapped all of `_check_member_gitlink`, and `_check_member_checkout` all of `_check_member_tree`. So whatever else either check met was counted as a missing git: Python 3.12's refused `stat` of a member's `.git` inside the tree check, and a git that could not enter the member's checkout, which `subprocess` names in `filename`. `validate-pins.py` counts only an `OSError` whose `filename` is `git`, or a nameless `FileNotFoundError` or `PermissionError`, and only around its git calls. - `_git_runs` takes `validate-pins.py`'s rule, copied word for word: any other `OSError` passes through as it came. - The two blocks now hold the git calls alone: the gitlink read in `_check_member_gitlink`, and the pinned commit's lookup and the digest in `_check_member_tree`, each with the text it had. The lookup's block stays outside its `except Refusal`, as `validate-pins.py` has it. - Copied, not moved into `scripts/repo_shape.py` as #928 proposed: both validators are pinned copies, and a holder may run one beside an older `repo_shape.py` (#610's skew rule). A test holds the two copies to one answer. - Windows' `[WinError 193]`, a `git.exe` that cannot be executed, is a nameless plain `OSError`: both validators now pass it through, where `validate-family.py` counted it. #430's slice E (#956) already refuses a member checkout this user cannot search as `member-unreadable` (its round 1), so a full run never met the old rule there on this branch; on main it ended in a 3.12 traceback first, or 3.14's `member-uninitialized`. Tests: tests/test_validate_family_git_not_runnable.py: both templates' `_git_runs` given one answer over 14 `OSError`s; each of the three calls named for a git that will not start, and passing every other error through; a step beside each narrowed call raising an error the rule counts, which passes through; and no `_git_runs` block in the source holding a `_check_*` call. Closes #928 Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 20, 2026
… --cached` where a plain one refuses a staged gitlink, dies on a clone no section names or refuses what is no checkout, with what it leaves said, and a `.gitmodules` gone from the work tree put back before the `git rm` that takes a section out (#936) (#1025) `member-gitlink-unnamed` in the family holder's pinned validator printed `git rm -- <path>` for every member mounted by hand. That line failed in four states: - A gitlink the index stages at a commit HEAD does not record there, with something on disk at it. Examples are `git mv members/IRRS members/IRRS2`, staged, and a `git submodule add` not committed. Git refuses it, exit 1. - A clone added by hand that no section names. Git dies with `could not lookup name for submodule`, exit 128. - What is no checkout, a directory holding files or a file. Git refuses it as modified, exit 1. - A hand mount with its own section while the work tree's `.gitmodules` is gone. There the `git rm` took the section out of no file, and the gate found `gitmodules-path-unnamed` again after the commit. Every such line now works typed, and the gate passes after the commit. - `_hand_cached` asks what git's rm.c asks, from git's records and what is on disk, never git's words: - "clone": a `.git` directory at the path, with no section giving it in the file git reads (`_given_as_git_reads`); - "staged": `_staged_over`; - "no checkout": anything on disk that is not an empty directory, with no `.git` entry. In those states the line is `git rm --cached`, with `-f` where `_forced` says, and it touches no file. Elsewhere it stays the plain `git rm`, which takes the section out with the gitlink. - The text says why a plain `git rm` is not printed (`CACHED_WHY`, quoting git's refusals). Where HEAD records nothing at the path, it says nothing of it is left to commit. - It says what stays on disk and what to do with it before `family.py add`, which refuses anything at the path (`_cached_left`): - a clone is moved out whole, with the `git log` that lists its commits not pushed; - a checkout whose `.git` file names a store is deleted once `git status` shows nothing it alone holds; - anything else is moved out or deleted, and an empty directory is deleted. - A section at a `--cached` path prints its own `--unset-all` lines (`_check_gitmodules_named`), since `--cached` leaves the section. - Where the work tree's `.gitmodules` is gone and the file git reads in its place gives the path, the plain line puts that file back first, through `_file_put_back`, C1's single put-back. Then the `git rm` takes the section out of it. The removal's finding after it puts nothing back. - Where `.gitmodules` holds a change the index does not, `git add -- .gitmodules` comes before the `--cached` line too (`_staging_said`), and the text numbers both. Git takes no gitlink out of the index until that change is staged (exit 128). - The switch line is written in the returned text itself. The lines after it are a list the helpers (`_plain_rm_said`, `_cached_rm_said`, `_staging_said`) append to and number with `_ordinal`. So `tests/test_family_switch_branch_exists.py`'s guard still sees the prose under every `_switch_line` end with `BRANCH_LEFT`. - What is on disk is asked as #430 asks it, with `_anything_at` and `_asked`. A path or a `.git` whose `stat` is refused is `member-unreadable` by name, exit 2, with the `chmod` cure, never a 3.12 traceback or a false "no checkout". The path is asked first. - This changes #956's C19 for a committed hand mount: with `members/` at mode 000 it is now refused `member-unreadable`, exit 2, where C19 expected the control's finding. - Whether its plain `git rm` works now turns on what is on disk. - The line printed there before, `git rm -- members/IRQS`, exits 128 on git 2.43 (`failed to stat`, `could not remove`). - RV1025's review found the change right. - The variant row (C20) is unchanged. Limits: - A hand mount staged by `git submodule add`, with the work tree's `.gitmodules` deleted. The printed lines exit 0 and the gate passes, but the index's file keeps the section, and the next commit records it. This is not a regression: the line printed before exited 1. `gitmodules-path-unnamed` reads only the work tree's file. Follow-up: #1036. - A linked worktree mounted by hand (a `.git` file naming an outside store) gets the plain line. On git 2.43 it exits 0 and moves nothing into the holder's store. - What cannot be read was measured only at modes 000 and 444 on Linux, and as a refused `stat` in process. - `family.py add` after the lines is not typed by the rows. - `--unset-all` of every key may leave an empty `[submodule]` header, as #300's remedy does. Tests: - tests/test_family_hand_mount_git_rm_lines.py is new, with 21 rows. Each types every printed `git` line in order, deals with what is left as the text says, commits, and asks the gate in every mode and a plain clone. The rows: - state 1: 8 (`git mv`, with or without a commit in the moved checkout; an empty directory; a directory holding a file; a dangling link, x889c's NIT A; `git submodule add` not committed; a checkout moved to `HEAD~1` and added; `git mv` with a hand edit of `.gitmodules` not staged, RV1025's NIT 2); - state 2: 4; - state 3: 2; - what is no checkout: 2; - controls that keep the plain line: 3; - a checkout at mode 444, its `.git` refused by name: 2. - Against `3864b18c`'s script, 17 of the first 20 rows fail and the 3 controls pass. The NIT 2 row fails there too. - Mutants: on `927fabf7`, 13 of 14 mutants were killed, and the survivor was judged equivalent. RV1025's MG, the stage line printed after the `--cached` line, is killed by the NIT 2 row. - tests/test_family_holder_remedies_compose.py drops #889's round-2 test of the old staged text and its 7 rows, going from 61 to 54 tests. Its states are rows in the new file. One is left out: the gitlink staged over nothing, whose plain line still works. It stays pinned, untyped, by tests/test_validate_family_unnamed_mounts.py. - tests/test_validate_family_unreadable.py goes from 52 to 53 tests. The committed hand mount leaves the two "never asked" tests and is refused by name in three rows: a refused `stat`, `members/` at mode 000, and its `.git` at mode 444. - CI run 39377078862 on `4c0c52d0`: the whole suite gave 18668 passed, 371 skipped. A local run of 40 files gave 2672 passed, 15 skipped. Closes #936 Lane: openreposhape-4 (openRepoShape-4) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brettheap
added a commit
that referenced
this pull request
Oct 21, 2026
…is_dir/exists guard in a shipped tool fails by file and line unless its `_is_a` or a reasoned allowlist covers it, and a `project.yaml` linked into an unsearchable folder is `yaml-unreadable` (#430) (#1111) ## What Slice Z of lane 1's plan for #430 (issuecomment-6251069236), the slice that lands last. Slices A to H moved each shipped tool's `Path.is_file()`, `is_dir()`, `exists()` and `is_symlink()` guards onto a local `_is_a` (`is_a` in the doctor). From Python 3.14 those methods answer False to any `OSError`, and `os.path.isfile`, `isdir`, `exists`, `lexists` and `islink` always have. The helper treats ENOENT, ENOTDIR, EBADF and ELOOP (and Windows' 21, 123 and 1921) as absent and raises every other `OSError`, so the caller refuses it by name: `<path>: cannot be read (<reason>)`, exit 2. | Slice | Files | PR | | --- | --- | --- | | A | `scripts/bump-leg.py` | #934 | | B | `update-shape.py` | #976 | | C | `shape-doctor.py`, `scripts/shape_advisory.py` | #975 | | D | the assembly root's `validate-manifest.py` and `bootstrap.py` | #958 | | E | the family root's `validate-family.py` | #956 | | F | the family root's `siblings.py` and `bootstrap.py` | #951 | | G | `scripts/family.py` | #955 | | H | `adopt-project.py` | #970 | This PR adds `tests/test_path_guard_hygiene.py`, which stops a new bare guard from bringing the old answer back. It also changes one site the scan found in `shape-doctor.py`. ### The hygiene test - **Which files.** It reads every shipped tool: the files `tests/test_repo_hygiene.py`'s `SHIPPED` lists, and every `*.py` at the top level, in `scripts/`, in `templates/**/scripts/` and in `src/openreposhape/`. That is 25 files today; the glob adds none that `SHIPPED` lacks. - **What it finds.** It parses each file with `ast` and finds every call of the four methods and the five `os.path` tests. It catches: - a call wrapped over lines; - the module reached as `os.path`, `posixpath`, `ntpath` or `genericpath`, or through `import os as o` (`o.path`), `import os.path as p`, `from os import path` or `p = os.path`; - a test imported by name (`from os.path import lexists`); - a guard passed as a function (`filter(os.path.exists, ...)`, `map(Path.is_dir, ...)`). - **What it does not catch.** It misses a guard named by a string (`getattr(p, "is_file")`, `operator.methodcaller`), the other questions of the same kind (`os.path.ismount`, `is_fifo`, `os.access` with `F_OK`), and a hand-written `stat` whose `OSError` is False. It also misses an alias bound by tuple unpacking, a walrus, a `for` or `with` target, a default parameter, a class attribute, `importlib` or `sys.modules`, and `o = os; o.path.isfile` or `from os.path import *`. A guard bound once at module level (`EX = os.path.exists`) is flagged at the binding, but its later calls are not. Shipped code has none of these except three Windows-only `getattr(os.path, "isjunction", ...)` lookups: `shape-doctor.py` `unclonable`, and `templates/family-root/scripts/siblings.py` `not_a_clone` and `family_link`. Each sits beside an allowlisted `is_symlink` or `islink`, so each is benign in context. The test's `_os_path_names` docstring still says "in no shipped tool today"; it changes with a follow-up. - **What fails.** A guard fails unless it is on `BENIGN` or `KNOWN_OPEN`, as often as its function makes it. Those lists key each entry by file, enclosing function and the call's own text, never by line, with a count. The failure names `file:line` and the function, and says what to do: use the file's `_is_a`, or copy validate-pins.py's where the file has none (#370, #610). Where the site is benign, it says to add an entry with a tag and a reason. - **No guard in a helper.** A guard inside a stat helper fails too: the helper must ask `stat` and nothing else. No entry may name one. - **Entries must stay true.** An entry whose call has gone, has moved function, or names more calls than its function makes fails as stale. So does an entry with no tag from `TAGS`, or with no reason. - **The scanner and the counts are checked on their own.** - The scanner finds 19 written spellings, and finds no `stat` or `lstat`. - An entry for one call does not cover two, and an entry for three, or for a call that has gone, is stale. ### The parity test - **Where the sets come from.** Each top-level `_is_a` and `is_a` in a shipped tool has its sets read from the AST. That covers the twelve the slices wrote, and any added later. The test follows the helper through every module function it calls (`_absent`, `_mode_of`, `_says_absent`, `refused_read`). It reads each `<exc>.errno in <set>` and each `getattr(<exc>, "winerror", None) in <set>`, through the module constant, as `errno.<NAME>` names and numbers. A set it cannot read that way fails; it is not guessed at. - **What each helper must hold.** Every set must be {ENOENT, ENOTDIR, EBADF, ELOOP} and {21, 123, 1921}. On the path from its `stat` to its `raise`: - it may catch only `OSError` and `ValueError`. A handler for `PermissionError`, `Exception`, or a bare `except:` fails; - every `except OSError` must hold a bare `raise`; - `errno` and `winerror` may be read only as `in <set>`. An `== errno.EACCES` beside the set fails. - **Helpers must be plain functions.** A class or an `async def` by a helper's name fails. - **Each slice's helper must still be there.** That way none is held to nothing because it was renamed. - **The constants.** Every module constant named `*ABSENT_ERRNOS` or `*ABSENT_WINERRORS` must be the one set. There are 24, two per helper. - **Results on this head.** All twelve helpers hold the set: `adopt-project.py`, `update-shape.py`, `shape-doctor.py` (`is_a`), `scripts/bump-leg.py`, `scripts/family.py`, `scripts/shape_advisory.py`, and the assembly root's `validate-pins.py`, `validate-manifest.py` and `bootstrap.py`, and the family root's `validate-family.py`, `bootstrap.py` and `siblings.py`. ## What the scan finds On main `4ed7c7bf` the scan finds 191 bare guards in 18 of the 25 files: the 188 of `16f9a0e8`, `6da757cb` and `823624d9`, and three that #1091 added to `adopt-project.py`. None is inside a helper. - **1 is the real site below, changed here.** On this head the scan finds 190. - **179 are on `BENIGN`, in 175 entries.** Each carries the plan's own reason for leaving a site out (lane 1's site table at `5017830`) and a line of its own: | Tag | Entries (sites) | What it means | | --- | --- | --- | | OWN | 57 (58) | the tool's own checkout of the standard, its templates or package, its cache, a temporary or work directory it made, or what this run wrote | | DELIBERATE | 63 (65) | a deliberate `os.path` call or guard whose False the code relies on and says why: wording, advice, `family.py`'s members-spelling twins, or a check a by-name refusal follows (#608, #609, #798, #735, #784, #793, #764) | | ASKED | 25 (25) | asked only after the stat helper, a `stat`, `mount_read` or git asked the path or its folder, or inside a `try` that keeps the `OSError` | | ROOT | 20 (21) | a name directly in the root: asked by `lstat`, or where a link at the name is left out or handled as a link first, in a root the tool refuses by name first where it cannot search it | | DEST | 9 (9) | the plan's OPEN-DEST, loud: a destination asked before a create or a clone, which then fails by name | | PINNED | 1 (1) | `scripts/repo_shape.py`'s `find_repo_root`, which the plan left (pinned, low) | - **#1091's three are `OWN`.** None needs #1110. - `_PlannedRoot._no_directory` and `_PlannedRoot._into_git` ask `self._git().is_dir(...)`. `_git()` returns `_CloneGit`, `check`'s model in memory of the names git makes in the clone's own `.git` (#904). Its `is_dir` is a set lookup, not the disk. Measured in a folder with no `.git`, with every `stat`, `lstat`, listing and `os.path` test patched to raise: it answers True, False and None as its sets say, and asks the disk nothing. - `_clone_ref_store` asks `(probe / CLONE_GIT_DIR / "reftable").is_dir()` of `git init`'s throwaway, a `mkdtemp` of this user's (0700) in the run's own work directory. A work directory at 0500 or 0600 stops at the `mkdtemp` before the guard is asked, and `ref_store` answers git's defaults. The one way to a refused `stat` there is a git template holding `reftable` as a link into a folder at 000. Then 3.12 raises into `ref_store`, which answers git's defaults, and the shim reads False. Both answer `(False, True)` on git 2.43.0, as the readable control does. - **11 are on `KNOWN_OPEN`.** These are real sites this slice found and did not change. Each is left to the follow-up issue #1110, which is not in v1.2.0. In each, a name in the root that is a link into a folder this user cannot search is still taken for nothing there. Every "under the shim" result below was measured with a 3.14-like `sitecustomize`. | Site | What happens | | --- | --- | | `scripts/family.py` `_gitmodules_names` | measured in process: on 3.12 a `PermissionError` raised out of `remove`; under the shim `(None, [])`, so `remove --dry-run` says no section is removed. Slice G left it for this slice to flag. A change needs a refusal threaded through `remove` and its rollback. | | `scripts/family.py` `_sections_giving` | the same file: `[]` under the shim | | `templates/family-root/scripts/siblings.py` `submodule_urls` | the same, in a pinned copy, which this slice does not edit | | `shape-doctor.py` `check_agent_files` | an agent file linked that way is `absent` in the `agent files` note, which never moves the verdict | | `shape-doctor.py` `check_what_is_here` | the same, for the NOT A SHAPE ROOT row's facts | | `shape-doctor.py` `check_the_way_in` | a `.git` linked that way: under the shim the `way-in` row says there is no repository to adopt, and sends the person to `setup.sh` to scaffold three new ones; on 3.12 the row names `.git: cannot be read` | | `shape-doctor.py` `check_the_other_way_in` | the same `.git`: the `way-in-scaffold` row is left out | | `shape-doctor.py` `origin_org` | the same `.git`, measured alone: `None` under the shim, the answer for a folder that is no repository (`'acme'` in the readable control); 3.12 raises `PermissionError` | | `shape-doctor.py` `repo_local_origin_name` | the same `.git`, measured alone: `None` under the shim (`'Orbit'` in the control), so the `naming` row classifies `Atlas` alone, not `Atlas, Orbit`; 3.12 raises | | `scripts/shape_advisory.py` `_read` | the same `.git`: `read()` says `not-a-repository` under the shim (`advise` in the control), so the Triad advisory row is left out | | `scripts/shape_advisory.py` `repository_names` | the same `.git`, measured alone: `['Atlas']` under the shim (`['Atlas', 'Orbit']` in the control); 3.12 raises | ## The site changed here: the doctor's own manifest `shape-doctor.py`'s `Context.__init__` asked `path.is_file()` of the root's `project.yaml` and `family.yaml`. Slice C's root check in `main` asks only whether the root can be searched, so a `project.yaml` that is a link into a folder this user cannot search got past it. It is now asked with `is_a`, and a refused `stat` is loaded (`Context._to_load`). `load_yaml` then refuses it as it refuses a file it cannot open, and the `manifest` row names it, as it already did for a `project.yaml` at mode 000 (#205). Measured on a root holding `project.yaml -> ../locked/project.yaml` with `locked/` at 000, Python 3.12.3, and the 3.14-like shim: | | Before (`16f9a0e8`) | After | | --- | --- | --- | | 3.12 | `PermissionError` traceback at `Context.__init__`, exit 1 | `kind assembly root (project.yaml, which does not load)`, `FINDING manifest ... REFUSED yaml-unreadable: .../project.yaml: cannot be read (Permission denied)`, `INVALID (manifest, manifest-kinds)`, exit 1 | | 3.14-like | `NOT A SHAPE ROOT`, exit 2, with `adopt-project.py plan --source ...` as the NEXT, over a project | byte for byte the 3.12 report above | The `manifest kinds` row names the same path with the `chmod` cure, in validate-pins.py's words. Where the `stat` succeeds, `is_a(path, stat.S_ISREG)` answers as `is_file()` did, so every other root reads as it did. An I/O error from the `stat` is loaded and named the same way. **Out of scope here (r1111's N5).** The row this case now shows carries two older pieces of wording, from #205 and #847, which this PR leaves alone: - the `manifest` row's WHY for `yaml-unreadable` speaks of "a merge conflict resolved, a hand edit"; - the `chmod` cure says "every directory above it inside the root", where the locked folder lies outside the root. ## Mutants Each mutant was applied once to a scratch copy of the head (`git archive` of the merge with main, with the new test file laid over it), and the new file was run there. The file was then put back from its bytes and checked by sha256. The worktree was never changed. - **Round 1: 5 of 5 killed.** | Mutant | Fails | | --- | --- | | M1: `scripts/bump-leg.py` `_validators_readable` back to `path.is_file()` | the hygiene test for that file, naming `scripts/bump-leg.py:1474` | | M2: `errno.EACCES` added to `validate-pins.py`'s `_ABSENT_ERRNOS` | both parity tests | | M3: 1921 dropped from `update-shape.py`'s `_ABSENT_WINERRORS` | both parity tests | | M4: the allowlisted `path.is_file()` in `update-shape.py`'s `_extend_the_eol_block` taken out | the stale-entry test | | M5: `Context.__init__` back to `path.is_file()` | the doctor tests | - **Round 2: 17 of 17 killed.** | Mutant | Fails | | --- | --- | | r1111's X3: a guard through `import os as _os` | the hygiene test for that file | | r1111's X4: `if not path.exists(): return False` inside bump-leg's `_is_a` | the hygiene test (a guard in the helper) | | r1111's X5: `except PermissionError: return False` before `except OSError` | parity: `catches PermissionError` | | r1111's X6: `or exc.errno == errno.EACCES` beside the set | parity: `reads exc.errno other than as in <set>` | | r1111's X15: a class `_is_a` holding a bare guard | hygiene and parity | | r1111's X18: `except Exception: return False` before `except OSError` | parity: `catches Exception` | | r1111's T2: the stale check disabled | the count self-test | | r1111's T3: one entry silences any count | the count self-test | | round 1's W1 and W4 | hygiene, and the stale-entry test | | Y1: the handler rule loosened | the parity self-test | | Y2: an `errno` read other than `in` no longer refused | the parity self-test | | Y3: `import os as o` no longer followed | the scanner self-test | | Y4: `p = os.path` no longer followed | the scanner self-test | | Y5: the helper exemption put back | the scanner self-test | | Y6: a class or `async def` by a helper's name read as a function | the parity self-test | | Y7: `except PermissionError` in `_to_load` (r1111's X12) | the doctor test's I/O-error row | - **Round 3, #1091's sites: 3 of 3 bite.** Each new entry was taken out alone, on the merge with main `4ed7c7bf`. Each run gave 1 failed and 48 passed. | Entry taken out | Fails | | --- | --- | | B1: `_PlannedRoot._no_directory` | the hygiene test for `adopt-project.py`, naming `adopt-project.py:10785` | | B2: `_PlannedRoot._into_git` | the same test, naming `adopt-project.py:10817` | | B3: `_clone_ref_store` | the same test, naming `adopt-project.py:11113` | - **The file's self-tests.** Slice A's helper passes the parity test, and eleven one-line changes to it are each named: three to its sets, the re-raise, a constant's name, three handlers, `==`, an `async def` and a class. ## Tests - **`tests/test_path_guard_hygiene.py`, new: 49 tests.** - 25 hygiene rows, one per tool. - The stale-entry, tag, scanner, count and parity tests. - Five tests for the doctor change: - two in process (`refused_stat` and a refused `read_text`, for a permission and for an I/O error), on every Python and as root; - two controls, nothing there and a directory there, which still read as no manifest; - one mode case run as a person runs the doctor, skipped on Windows and as root. - **Against main's tools** (main `4ed7c7bf`, with the new file laid over it), 45 pass and 4 fail. The 4 are the doctor's unlisted `Context.__init__` guard and its three rows: the two in-process rows, the I/O-error row among them, and the mode case. On this head all 49 pass. - **The gate on head `d286ae9a`.** The head holds main `4ed7c7bf` through the plain merge `8bc4d1b2`, with tree `fc0731ea`; the branch's first merge, `03c16cb9`, took `6da757cb`. Against main, the head changes only `shape-doctor.py` and the new file. The gate ran on the head itself, with Python 3.12.3, git 2.43.0, a stub `gh` first on `PATH`, `GH_TOKEN` bogus, an empty `GH_CONFIG_DIR`, `GIT_CONFIG_GLOBAL=/dev/null` and `GIT_SSH_COMMAND=false`: - the new file, `tests/test_repo_hygiene.py`, `tests/test_cli_reference.py`, `tests/test_agents_md_codes.py`, `tests/test_doctor_unreadable_paths.py` and `tests/test_doctor_unreadable_pin.py`: 305 passed; - `tests/test_shape_doctor.py`, 448 tests in four shards: 445 passed and 3 skipped (118 passed; 110 passed; 117 passed; 100 passed and 3 skipped); - `tests/test_scaffold_leg_path_collisions.py`: 104 passed. - No `--help` text changes, so `docs/cli.md` is unchanged. No pinned copy changes, so no project or holder gets an `upstream-changed` row. It lands by fast refresh (Brett Heap, 2026-10-15T22:48:35Z). Its reviewed head `d286ae9a` is green on Linux and SonarCloud. The branch merged main twice and was never rebased; the last merge is update-branch's, clean, giving d286ae9, which is green on SonarCloud and Git Bash. Lane 1's gate passed on its tree: the 8 test files (test_path_guard_hygiene, test_shape_doctor, test_scaffold_leg_path_collisions, test_repo_hygiene, test_cli_reference, test_agents_md_codes, test_doctor_unreadable_paths and test_doctor_unreadable_pin), 854 passed and 3 skipped. Closes #430 Lane: openreposhape-1 (openRepoShape-1) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
(lane openRepoShape-4, DRAFT; slice E of #430; base main since #889 landed; round 2)
templates/family-root/scripts/validate-family.pyno longer reads a path this user cannot read as absent. Every guard asks the operating system for the path'sstatitself, the same answer on every Python. Astatit refuses is refused by name,<path>: cannot be read (<reason>), with a cure for the cause, exit 2. Before this change, Python 3.12 ended the run in aPermissionErrortraceback, exit 1. Python 3.14'sis_file()andexists()answer False to anyOSError, so on 3.14 the gate said a false thing about the holder instead.Round 2 (
741dc4d9, tree3feb043b): r956's two SHOULDs and its NITs 1 and 2, then main. Two commits on0b1413f2, with nothing rewritten.dcec55ed, round 2:_forcedand_staged_overnow ask git (_head_records) first, and the disk only where the answer turns on it. Where HEAD records a gitlink at the index's own commit, neither the-fnor the staged clause is said, so nothing on disk is asked.--no-members, two states were refusedmember-unreadable, exit 2 (r956's C19 and C20): a committed hand mount withmembers/at 000, and a variant committed at IRRS's commit withMembers/at 000.project.yamlthat cannot be opened now readsmembers/<P>/project.yaml: cannot be read (<reason>), with the cure for that cause, as one whosestatis refused does. It used to name the file twice, relative and then absolute, with no cure.path:is named atmembers/<P>, notNone._anything_atasks a link's ownlstatfirst, asos.path.lexistsdid (r956's trial fix). A link at a gitlink path is on disk wherever it leads. New rows kill r956's X9 (the link dropped) and X14 (a name printed raw)..gitFILE at mode 000 still readsmember-commit-unresolvablewith a fetch remedy (r956's follow-up, and RV983's NIT 4 on validate-family.py:git-not-runnablecounts only anOSErrorthat namesgit, or aFileNotFoundErrororPermissionErrorthat names no file, asvalidate-pins.pycounts it, and only around the git calls, so a member's checkout git could not enter, or a member check's own step, is never told to put git on PATH (#928) #983). r956 placed it outside slice E, so it is left for a follow-up issue.members/<P>still readsmember-uninitialized. That is X12 (ENOTDIR), which stays with slice Z.member-unreadablealso names paths that are not members) is kept, as r956 allowed.741dc4d9merges maindd2cf2e8, 12 commits since validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's squash. There was no conflict, and none of those commits touches this PR's two files.git diff origin/main...HEAD --statlists only those two files.Tests:
tests/test_validate_family_unreadable.py, which now has 52.project.yaml, for a permission and for an I/O error, and at mode 000.path:.0b1413f2, 9 of the 10 fail. The spelling row passes there, since the line it guards was already right.Run on
741dc4d9: 16 files, Python 3.12.3, git 2.43.0, probe environment. 1043 passed, 3 skipped, 0 failed, in 20:57. The 3 skips aretest_shape_doctor.py's Windows-only PowerShell rows. The files are:tests/test_validate_family_unreadable.py;.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889'stests/test_family_holder_remedies_compose.py;test_validate_family_remedies_typed,_typed_states,_unnamed_mounts,_branch_step,_duplicates,_member_path_globand_without_git;test_family_unnamed_gitlink,test_family_docs_one_spelling,test_pinned_copy_textandtest_shape_doctor;test_repo_hygiene,test_cli_referenceandtest_agents_md_codes.Merges of
741dc4d9: it holds maindd2cf2e8. With the two other open PRs that touchvalidate-family.py, it is clean: #954 at9eb9d3d2(tree8377d41d), and #983, which stacks on this branch.Below is the body as of round 1, with r956's points B1 to B4 put right.
Restacked onto main after #889 landed (
0b1413f2). #889 landed as squash702cc23d, and GitHub retargeted this PR to main. The restack uses merges only, with no rewrite: three merges on1245a3bd, following lane 4's recipe.10c5d82dmerges validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's final headb41f722b. It had one conflict, in_staged_over, the one named below..gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's round-3 docstring is kept._anything_atguard and its comment replaceos.path.lexists.23356765), with round 1's code name. The merged file is byte for byte that merge's file, renamed.0b1413f2merges validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's squash702cc23d, with-X ours. Its tree isb41f722b's, so it changes nothing.702cc23d) found the branch already up to date.git diff origin/main...HEAD --statlists only this PR's two files:templates/family-root/scripts/validate-family.pyandtests/test_validate_family_unreadable.py. The run coveredtests/test_validate_family_unreadable.py, #889'stests/test_family_holder_remedies_compose.pyand the trio: 273 passed, 0 failed, in 4:04. The section "Stacked on #889 (#879)" below is history now.Round 1 (
1245a3bd): the code ismember-unreadable, notcheckout-unreadable. Lane 5's review of slice F found the holder naming one path,members/<P>/.git, by two codes (#951, issuecomment-6253349287, SHOULD 2). This validator saidcheckout-unreadable, andbootstrap.pyandsiblings.pysaymember-unreadable(slices F, #951, and G, #955). Somake validateandmake bootstrapnamed one fact two ways. Lane 4 aligns onmember-unreadable, and that rename is all of round 1:CHECKOUT_UNREADABLEbecomesMEMBER_UNREADABLE;CHECKOUTconstant becomesMEMBER_UNREADABLE.It is one commit on
86ce6012, pushed as a fast-forward. Below,member-unreadablestands wherever round 0 saidcheckout-unreadable.Before and Now, per site
Measured on #889's round-1 head
3b15de03(Before) and on this branch (Now), Python 3.12.3, git 2.43.0. The holder comes fromtests/test_family.py'sfamilyfixture:scaffold-project.pyfor the members, thenfamily.py initandadd. Remotes are local;ghis a stub that exits 97, withGH_TOKEN=bogus, an emptyGH_CONFIG_DIR, an emptyGIT_CONFIG_GLOBAL,GIT_CONFIG_NOSYSTEM=1andGIT_SSH_COMMAND=false. The "3.14" column was run two ways: under asitecustomizethat makesPath.is_file,is_dir,existsandis_symlinkanswer False to anyOSError, as 3.14's do, and in-process underrefused_stat. Both gave the same words. Line numbers are at3b15de03, with the plan's line at5017830after the arrow.3b15de03←5017830)_check_members' stop:3493←:2932members/IRRS000 or 444, ormembers/000; members mode and--pins:3493,PermissionError: ... members/IRRS/.git, exit 1REFUSED member-uninitialized: members/IRRS is not an initialized submodule checkout, remedygit submodule update --init --recursive; typed, that failsfatal: could not open '<holder>/members/IRRS/.git' for writing: Permission deniedandFailed to clone 'members/IRRS' a second time, aborting, exit 1REFUSED member-unreadable: members/IRRS/.git: cannot be read (Permission denied), remedychmod u+rx(and every directory above it), exit 2_check_member_tree:1090←:946.git, asked alonemember-uninitializedabove comes from_check_member_checkout:1217←:1073.gitmodules,members/IRRS000:1217member-gitmodules-absentalone: IRRS's digest and identity are not asked, as if it were not checked out_check_member_identity:1236←:1092members/IRRS/project.yamla link into a folder at mode 000:1236FINDING member-not-a-project: members/IRRS: no project.yaml in the mounted tree ... a family pins assembly roots, never legs.FINDING member-manifest-unreadable: members/IRRS/project.yaml: cannot be read (Permission denied).with the cure, exit 1, the finding aproject.yamlthat cannot be opened already was_load_shape_pin:1278←:1134contracts/000, the naming policy given with--policy:1278REFUSED shape-pin-missing: <holder>/contracts/shape-pin.yaml does not existREFUSED shape-pin-unreadable: contracts/shape-pin.yaml: cannot be read (Permission denied)_check_one_shape_file:1332←:1188.github/workflows/000 or 444:1332FINDING shape-copy-missing: contracts/shape-pin.yaml: .github/workflows/validate.yml is pinned but absent, exit 1REFUSED shape-copy-unreadable: .github/workflows/validate.yml: cannot be read (Permission denied)file_sha256after it:1336validate.ymlitself at 000, or a read that fails with an I/O errorfile_sha256, every Python(Input/output error)andOTHER_REASON, nochmod_run_checks:3517(not on the plan's list)family.yamla link into a folder at mode 000:3517REFUSED family-manifest-missing: <holder>/family.yaml does not exist, remedyfamily.py init ... creates oneREFUSED family-manifest-unreadable: family.yaml: cannot be read (Permission denied)_put_back_lines:3162←:2695git rm --cached),members/IRRS000,--no-membersand members mode:3162member-gitlink-removal-staged's lines endgit submodule update --init --recursive -- members/IRRS("its checkout"); typed,git resetexits 0 and the update failscould not open '<holder>/members/IRRS/.git' for writing, exit 1REFUSED member-unreadable: members/IRRS/.git: cannot be read (Permission denied)_put_back_lines, ENOTDIRmembers/IRRSexists()answers False to ENOTDIR on every Python)REFUSED member-unreadable: members/IRRS/.git: cannot be read (Not a directory),OTHER_REASON, nochmod(_goneis ENOENT alone)_names_store:3032and_moved_checkouts:2995,:3003(not on the plan's list)git mv members/IRRS Members/IRRS, staged, withMembers/IRRS000 orMembers/000,--no-members:3032_on_disk:875,:877←_forced:745git mv,Members/000os.path.lexists, False on every Python; here the traceback at:3032comes after-f:git rm --cached -- Members/IRRSREFUSED member-unreadable: Members/IRRS: cannot be read (Permission denied)_held_as:889←_forced:745git mv,Members/IRRS000os.path.lexists, False on every Python; here the traceback at:3032comes after-f ... over what is on disk there, which is no checkout, of a checkoutREFUSED member-unreadable: Members/IRRS/.git: cannot be read (Permission denied)_staged_over(#889's round 2,os.path.lexists)members/IRQSover an empty directory,members/000,--no-membersgit rmrefuses a staged gitlink (lexistsFalse on every Python; read from the code, the mutant that puts it back fails the row)REFUSED member-unreadable: members/IRQS: cannot be read (Permission denied)The tests
tests/test_validate_family_unreadable.py, new, 42 rows (52 since round 2: see the top). It importsrefused_stat,made_unopenable,needs_a_modeandrefusal_offromtests/test_bump_leg_unopenable.py, as the suite already imports across modules. Nothing is copied, and nothing moves intoconftest.py.cannot be read:member-uninitialized;member-gitmodules-absentalone;project.yaml:member-not-a-project;family.yaml;member-gitlink-unnamed.stat, in-process, on every Python and as root (11):.git, in members mode and--pins;.git;family.yaml;.git;.git;project.yaml: its finding.find_repo_rootgiven the holder.refused_stat(".git")refuses the holder's own.gittoo, and the plan leaves that function out.mainasks another first (4):_check_member_tree;_put_back_linesand_moved_checkouts, each with its control;_names_store, for a refusedstatand for a read that fails with an I/O error.OTHER_REASONand nochmod. The ENOTDIR row is skipped on Windows.-f. Its.gitis not asked, so the finding is printed, not a refusal.members/IRRSat 000 and at 444, andmembers/at 000;contracts/, with--policygiven;.github/workflows/at 000 and at 444, andvalidate.ymlitself;Members/andMembers/IRRSin thegit mvstate;members/under the hand mount;project.yamlandfamily.yamlas links into a locked folder.needs_a_mode)..gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's round-1 head, 29 of the first 38 rows fail; the other 9 pass: 6 of the 7 absent controls (the hand mount's came later), the staged removal's 2 lines rows, and the row that asks nothing new. Four rows were added after that run: the hand mount's three, for validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's round 2, and_put_back_linesasked alone. They are covered by mutants M14 and M8 below; the hand mount's control passes either way.What it cannot tell
sitecustomizeshim andrefused_stat. Both makePath.is_file,is_dirandexistsanswer False to anyOSError, as 3.14'sos.pathcalls do. The new tests pass on 3.12.3 locally; CI's3.xis 3.14..git. On 3.12 the mode row kills each one put back alone, by its traceback. On 3.14 the other guard's refusal would hide it:_check_members' stop, before_check_member_tree;_put_back_lines, before_moved_checkouts._moved_checkouts(.gita directory) asks a.gitthat_names_storehas just asked. No state reaches it alone, so no test can single it out. The mutant that puts it back, together with the row's own guard, is killed.os.path.lexistsof.gitmodulesstay, and so does_on_disk'sscandirthat reads a folder it cannot list as holding something (validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's choice, kept). Thelexistschecks a name at the holder's root. Readingfamily.yamlbefore it already needed the access anlstatthere needs.family.yaml, shape pin or naming policy isload_yaml'sREFUSED yaml-unreadable: <absolute path>: cannot be read (...). That is by name and exit 2 already.project.yamlkeeps itsmember-manifest-unreadablefinding, which carriesload_yaml's absolute path. A refusedstatof it now gives that same finding, named relative to the holder.repo_shape.find_repo_rootasks(candidate / ".git").exists(). The plan leaves that function out (pinned, low). On 3.14 a holder whose own folder cannot be searched is passed over for a folder above it.ERROR_PATH_NOT_FOUNDthere, which is ENOENT. So_gonereads it as nothing there, and the ENOTDIR test is skipped there. The mode rows are skipped on Windows and as root, as bump-leg.py: a workflow file, the workflows directory or the leg's pin that this user cannot open is refused by name with a remedy, so the run ends in exit 2 and not a PermissionError traceback (#383) #403's are.Choices for the reviewer
member-unreadable(round 1; round 0 saidcheckout-unreadable). It covers every.gitand gitlink path whosestatis refused: a row's member, a case variant, a stray, the checkoutgit mvmoved. It is the code the holder'sbootstrap.pyandsiblings.pygive the samemembers/<P>/.gitin slices F (the family root's siblings.py and bootstrap.py: a member's path this user cannot read is refused by name, exit 2, so Python 3.14 no longer clones on the wrong branch or sayssiblings okandfamily bootstrap okover members it skipped as absent (#430) #951) and G (family.py: a holder, a member or its object store this user cannot read is refused by name, exit 2, on every Python, neverfamily-root-missing,member-uninitializedor "not on disk", and no rollback removes past it (#430) #955), somake validateandmake bootstrapname one fact one way (lane 5's SHOULD 2 on the family root's siblings.py and bootstrap.py: a member's path this user cannot read is refused by name, exit 2, so Python 3.14 no longer clones on the wrong branch or sayssiblings okandfamily bootstrap okover members it skipped as absent (#430) #951).validate-pins.pysayspin-submodule-unreadablefor a leg's.git, and slice A saysbump-leg-submodule-unreadable.shape-pin-unreadableandfamily-manifest-unreadable: until now each said "not a mapping". The meaning holds: the file cannot be read.shape-copy-unreadable:validate-pins.py's code for the same copy.member-manifest-unreadablestays a FINDING, exit 1, for a member'sproject.yamlwhosestatis refused. It is the answer an unopenable one gets, in the same words since round 2, so one file has one answer. The plan's rule says exit 2. Say if you want both made a refusal._gone(path): ENOENT alone,FileNotFoundError. A name the system cannot take (ValueError) also counts as nothing there, asexists()answered. It is asked before the staged removal'sgit submodule update(_put_back_lines) and before the checkouts that finding names for deletion by hand (_moved_checkouts). For lane 1's Z:_ABSENT_ERRNOS,_ABSENT_WINERRORSand_is_aarebump-leg.py's, word for word._held_asis asked only where the-fsentence is printed (_held_if_forced). A.gitwhose answer is never printed is not refused. Since round 2,_forcedand_staged_overask git first too. Where HEAD records the gitlink at the index's own commit, nothing on disk is asked (r956's SHOULD 1)._names_store's read used to answer "names no store" when the read failed. It is now refused too, withOTHER_REASONwhere no permission is the cause.validate-pins.py's_cannot_read,_unreadable_file(with this validator's own list of what it reads) andOTHER_REASON, copied rather than imported. The validator is pinned, and repo_shape.py'sRefusalgives every refusal built without a remediation the assembly root's own (run git submodule update --init --recursive, then python3 scripts/validate-pins.py ... contracts/<leg>-pin.yaml), so in a family holderfamily.py addover an unparsable.gitmodules(git-failed),bumpon afamily.yamlof the wrong kind, and the holder's ownvalidate-family.pyon a shortpin.commiteach tell the operator to run a file no holder carries and to move a leg pin a holder does not have #370 and Pinned shape copies: AGENTS-shape.md'sCONTRACTS_DIRsentence is false for every scaffolded root, and the chain WARNING offers remedies the scaffold lacks (one shape bump before the v1.1.0 tag) #610 say it must not rely on a newer shared helper.Stacked on #889 (#879)
fix/879-holder-remedies-compose, validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's branch. Its delta is this slice alone: one commit on validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's round-2 head29083a5f, touchingtemplates/family-root/scripts/validate-family.pyand the newtests/test_validate_family_unreadable.py..gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889 lands first. Then lane 4 restacks this onto main: validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's final head, then its squash (ours for its files), then main._staged_over'sos.path.lexists(root / path). It is held to the same rule here, with a row of its own.Path.is_file()/is_dir()/exists()guard in the shipped tools answers False to any OSError on Python 3.14 (3.12 and 3.13 raise PermissionError), so a directory this user cannot search reads as ABSENT: validate-pins.py skips its workflow@<sha>check, update-shape.py sayscopy-missingandupdate-pin-missing("adopt the project") for files that are there, the doctor says DRIFTED (5 copy-missing), and bump-leg.py's remaining guards, and every other tool's, skip or misreport instead of refusing by name #430.The pinned copy
scripts/validate-family.pyis a pinned copy in every holder (FAMILY_COPIED_VERBATIMinscripts/shape_materialize.py).upstream-changedrow for it withupdate-shape.py, the same row validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's change gives in v1.2.0. Oneapplytakes both changes.scripts/repo_shape.py: every helper is local to the file, as repo_shape.py'sRefusalgives every refusal built without a remediation the assembly root's own (run git submodule update --init --recursive, then python3 scripts/validate-pins.py ... contracts/<leg>-pin.yaml), so in a family holderfamily.py addover an unparsable.gitmodules(git-failed),bumpon afamily.yamlof the wrong kind, and the holder's ownvalidate-family.pyon a shortpin.commiteach tell the operator to run a file no holder carries and to move a leg pin a holder does not have #370 and Pinned shape copies: AGENTS-shape.md'sCONTRACTS_DIRsentence is false for every scaffolded root, and the chain WARNING offers remedies the scaffold lacks (one shape bump before the v1.1.0 tag) #610 require.tests/test_pinned_copy_text.py's skew test passes.Shared files
Round 1 (
1245a3bd),git merge-tree --write-treeagainst each of these:2f5cabf5(tree845747b3);siblings okandfamily bootstrap okover members it skipped as absent (#430) #951 at528adbf7(c23a69a6);family-root-missing,member-uninitializedor "not on disk", and no rollback removes past it (#430) #955 at991990cc(259a36ae);scripts/nobody may search no longer SKIPs every validator intobootstrap ok(#430, slice D) #958 at0ef875c0(46efadbf)..gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's round 3 (32a5899f): one conflict. It is in_staged_over, where round 3's docstring NITs meet this PR's comment and_anything_at. It goes when lane 4 restacks this onto validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's final head.Round 0's table:
git merge-tree --write-treeof this head86ce6012against each, all clean, with no conflict to pre-resolve:64464d31(after #891'sa9205e0and #887)45c4f42a29083a5fa158fae7, which is this head's own tree41f781fd3f2f3842fix/430-a-bump-leg-unsearchable27ec441a2ef6d9b6fix/430-h-adopt-unsearchable3ec73e211bbf7842validate-family.py.gh pr list --state open --json number,fileslists only validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889.fix/892-bootstrap-ok-after-128(bootstrap.py (family root): after #879, two states still endfamily bootstrap okbeside git's exit 128: a stray gitlink inside a member's own index, and a member's gitlink at a commit no store holds #892),fix/888-member-make-jobserver(the family root's Makefile: undermake -jN, every member's make warnsjobserver unavailable: using -j1and runs one job at a time #888) and slice F'sfix/430-f-siblings-bootstrap-unreadable. Lane 4 runs them when each exists. Slice F and slice G hold other files.The run and the mutants
Round 1's run (
1245a3bd): the rename alone, so one short run:tests/test_validate_family_unreadable.py, #889'stests/test_family_holder_remedies_compose.pyand the trio,test_repo_hygiene,test_cli_referenceandtest_agents_md_codes. 248 passed, 0 failed, in 5:18. The round-0 run below stands for everything else.The run: one run, of 30 files, on this head
86ce6012, with Python 3.12.3 and git 2.43.0, in the probe environment. 1689 passed, 6 skipped, 0 failed, in 49:35. The 6 skips aretests/test_doctor_legs_members_next.py's, for git 2.43's own limits: a crash on a barebranch, and ashallowof -2**31.tests/test_validate_family_unreadable.py; validate-family.py and bootstrap.py: the holder's remedies, typed as printed in order, put a.gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889'stests/test_family_holder_remedies_compose.py;test_validate_family_remedies_typed,_typed_states,_unnamed_mounts,_branch_step,_duplicates,_member_path_globand_without_git;test_family_head_lost_gitmodules,_unnamed_gitlink,_gitmodules_values,_holder_bootstrap_texts,_bootstrap_gate_order,_member_path,_members_not_a_list,_remove_gitmodulesand_dry_run;test_family.py;test_shape_pin_files_not_a_list,test_shape_pin_row_path,test_pinned_copy_text,test_family_docs_one_spelling,test_refusal_default_remediation,test_doctor_validator_rows,test_doctor_legs_members_nextandtest_template_text_placeholders; and the trio,test_repo_hygiene,test_cli_referenceandtest_agents_md_codes.family.py's verbs (test_family_add_*,_bump_*,_init_*,_makefile_siblings,_switch_branch_exists,_member_name). They reach this validator only as the holder's passing gate, whichtest_family.pyruns.test_shape_doctor.py. The doctor runs the gate only as itsfamilyrow, whichtest_doctor_validator_rowscovers.test_update_shape*,test_siblings_inputs,test_stdout_encoding,test_template_values_single_pass,test_branch_left_bump_leg_setup,test_doctor_gitlink_repairs,test_doctor_next_is_a_commandandtest_validate_pins_without_git. Each names the file, or runs the gate on a passing holder, and none reaches a changed guard in a state it changes.tests/test_repo_hygiene.pyat64464d31is newer than this branch's. Its merge with this head is clean (above). The hygiene file was run as this branch has it..gitmodulesgone from the work tree back once and never over another remedy's write, stage it before a gitlink'sgit rmand after a section written back, and name a checkoutgit mvmoved before the update, and bootstrap fails where git's init in this holder stopped with every member checked out, so no remedy undoes another or exits 128 (#879) #889's round-1 head, without this change: 29 failed, 9 passed. The probes and the mutants were run apart from this run, one pytest at a time.Mutants: 18, each run against the new file with
-x, and all 18 killed. Each one puts a bare guard back, or loosens the strict helper, in the fixedvalidate-family.py. The fixed bytes were put back after each and checked by sha256 (c1a00595)._checked_outback to(… / ".git").exists()(the stop,_check_member_checkoutand_check_member_treetogether)refused_stat[member-checkout][member-000](3.12's traceback; on 3.14_check_member_treerefuses next, so nothing false is printed)_check_member_checkoutalonerefused_stat[unregistered-member-checkout]_check_member_treealonetest_the_member_tree_asked_alone_names_the_checkoutproject.yamlis_file()test_a_project_yaml_whose_stat_is_refused_is_named_not_a_legis_file()refused_stat[shape-pin]is_file()refused_stat[shape-copy]test_a_shape_copy_that_fails_for_another_reason_is_refused_sans_chmodfamily.yamlis_file()refused_stat[family-yaml]_on_diskback tolexists,is_symlink,is_dirrefused_stat[variant-on-disk]_held_asback tolexistsrefused_stat[variant-checkout]_put_back_linesback toexists()test_the_staged_removal_asks_the_row_s_own_checkout_alone[_put_back_lines]_moved_checkoutsback toexists()andis_dir()…_alone[_moved_checkouts]_names_storeback tois_file(), and its read to "names no store"test_a_git_file_that_cannot_be_read_names_no_store_by_name_gonetakes ENOTDIR as nothing theretest_a_file_where_the_checkout_should_be_is_no_place_to_update_held_asasked even where no-fis printedtest_a_stray_whose_rm_takes_no_f_asks_nothing_of_its_git_is_aanswers False to anyOSError(3.14'sis_file)refused_stat[member-checkout]_staged_overback tolexistsrefused_stat[hand-mount-staged]Part of #430 (slice E; lane 1's plan, issuecomment-6251069236).
🤖 Generated with Claude Code
Summary by Sourcery
Refuse unreadable family paths by name with actionable remedies, while distinguishing them reliably from paths that are genuinely absent.
Bug Fixes:
Enhancements:
Tests: