[brettheap]

Lane: openRepoTools-1
Claim: #186 (comment)

What changes

openRepoShape's update-shape.py apply re-syncs this assembly root's shape copies to openRepoShape v1.1.1 and re-pins them. It ran from a checkout of tag v1.1.1, commit 50178305e4229275d18e71c2152403b4e9d3004e, with the command v1.1.1's release notes prescribe:

update-shape.py apply --root ROOT --at 50178305e4229275d18e71c2152403b4e9d3004e --yes --branch shape/update-5017830

• The pin. In project.yaml's shape: block and in contracts/shape-pin.yaml, commit moves from v1.1.0's 190133d5e704e380c430f87ca9c4e31746de0012 to 50178305e4229275d18e71c2152403b4e9d3004e. tree_sha256 moves from 7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912 to 204d73aabf2379554600234d4b36dc08d3c3a1da422395dec44637b5ca7a5184, which the tool recomputed under sorted-ls-tree-r-v1.
• The six copies v1.1.1 changed take v1.1.1's bytes verbatim, and their six sha256 rows in contracts/shape-pin.yaml are recomputed:
  • from templates/assembly-root/: scripts/validate-pins.py, scripts/validate-manifest.py, scripts/bootstrap.py and .github/workflows/validate.yml;
  • from scripts/: scripts/repo_shape.py and scripts/validate-repository-naming.py.
• Unchanged. The four copies v1.1.1 left alone keep their bytes and their rows: Makefile, shape/.gitattributes, AGENTS-shape.md and contracts/repository-naming.yaml. .gitattributes, README.md and both gitlinks are untouched.

Size. 8 files, +1,404 and −280. About 1.7k of those changed lines are the six copies' verbatim upstream bytes. The two pin files account for the other 20.

The tool's own commit. The tool committed the change as 84126f2de87d, under its own identity and in the writer's local clone only, so that commit is on no remote.

• The commit here keeps its tree, 453f8ab9f51fc2bad395d19cc07ad02bf2e10b3f, and changes only the author and the message.
• An independent run of the same apply, on a fresh clone of main, gave the same tree (review finding N1).

Why

Two rulings of Brett Heap's govern this, on #186:

• 2026-10-22: he ruled that openRepoShape v1.1.1 is the pin bump after the cutover (comment 6342293150, item 16: "keep v1.1.0 (190133d). v1.1.1 is a pin bump after the cutover.").
• 2026-11-08: he answered "v1.1.1 b", which he sent at 11:57:46Z and confirmed in a dialog at 13:06:02Z (Triad migration (feature 004-migrate-to-triad): execution tracking under Brett Heap's word of 2026-10-07 #186 (comment)). It means:
  • both of the triad's openRepoShape pins move;
  • each PR lands only on his word;
  • there is no release.

This PR moves this root's shape copies. opensoft/openRepoTools-code#15 moves the code leg's mounted pin.

v1.1.1's release notes say it "changes pinned shape copies, so a project or a family holder takes those fixes into its own gates by update-shape.py", and that until then "the root's own gates and make bootstrap are v1.1.0's". The six files above are the six copies of an assembly root that the notes name.

Independent of the other two pull requests

• The code leg's PR B, Pin openRepoShape at v1.1.1, 5017830 on its main: four of the eight mounted files moved; no test expectation moved openRepoTools-code#15, which moves contracts/openreposhape-pin.yaml and the upstream/openRepoShape gitlink in opensoft/openRepoTools-code. No check ties this root's shape-copy pin to the code leg's mounted pin. v1.1.1's validate-pins.py compares this pin's commit only with project.yaml's shape.commit.
• This root's later PR C, which moves the code gitlink and contracts/code-pin.yaml after B lands. This pull request touches no gitlink and not contracts/code-pin.yaml, so the two touch disjoint files, and either can land first.

Checks

• validate (.github/workflows/validate.yml, on pull_request, not required) runs the naming policy, the manifest and the lockstep pins with this pull request's new v1.1.1 copies.
• exact-pins (.github/workflows/composed.yml, the one required check) runs the new validate-manifest.py and validate-pins.py in its step "the manifest and the lockstep pins". It then runs the code leg's suite, composed, at the unchanged leg pins: code 2a057a6d84e5, spec 64a1a989fe7b.

Checked locally before opening:

• update-shape.py check at the target reported six copies upstream-changed, four unchanged, and nothing to add.
• apply ran the root's own validate-pins.py and validate-manifest.py and both passed. Afterwards, with the legs checked out at their recorded commits, validate-repository-naming.py --project project.yaml, validate-manifest.py and validate-pins.py each exit 0.
• Each of the six copies has the same git blob as v1.1.1's upstream file. Each of the ten sha256 rows equals its file's sha256. Both tree_sha256 values equal repo_shape.tree_digest computed from the v1.1.1 checkout, and the same helper gives 7a66972c… at 190133d as a control.
• The new validate.yml's .gitmodules step reads this root's .gitmodules without refusing and names both legs.
• The composed suite was not run locally. exact-pins runs it.

No release

This moves the root's own gates only. There is no tag and no release, and nothing in the code leg or its release/v1.1 changes.

Landing

This pull request lands only on Brett Heap's word.

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 7 days by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

Data structures

Advance the assembly root’s shape pin in both manifests to openRepoShape v1.1.1 and record the recomputed tree digest and hashes for the synchronized copies.

• contracts/shape-pin.yaml L44-48, L54-60 (+2 small edits)
• project.yaml L77-81

API

Refresh the copied shared shape library, including its YAML parsing and shell-quoting helpers used by the root’s tools.

• scripts/repo_shape.py L237-252, L1097-1124, L3436-3473 (+19 small edits)

Implementation

Refresh the copied assembly-root validators and bootstrap tool to v1.1.1 so their validation and leg-handling behavior matches the new shape pin.

• scripts/bootstrap.py L183-273, L390-430, L1143-1184 (+29 small edits)
• scripts/validate-manifest.py L135-154, L256-276, L642-668 (+5 small edits)
• scripts/validate-pins.py L282-414, L1005-1025, L1760-1812 (+55 small edits)
• scripts/validate-repository-naming.py L143-162, L879-911, L997-1014 (+14 small edits)

Configuration

Refresh the copied validation workflow to v1.1.1, including safer .gitmodules leg discovery and fetch-failure reporting.

• .github/workflows/validate.yml L59-84, L93-138, L245-298 (+5 small edits)

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.3% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Lane openRepoTools-1, 2026-11-08T13:32:49Z: independent review of this PR, a check of the tree, not a landing word. The verdict is LAND after fixes, and the fixes are to text only.

The review was run by a separate agent with no part in writing this PR. It ran on Sonnet 5.5 and worked only from fresh clones and from GitHub.

What it checked, on the head 62f70dd7f34933d6b3e433a48269c7810c1653f0, tree 453f8ab9f51fc2bad395d19cc07ad02bf2e10b3f:

• The diff: exactly the eight files, with no mode change, +1,404 and −280.
• The six copies: each has the same blob as its source at 50178305 (cmp equal), with equal modes.
• The pins: both pin files name 50178305… with tree_sha256 204d73aa…. All ten sha256 rows equal the real files' digests: six moved and four unchanged.
• The validators: with the legs checked out, validate-repository-naming.py --project project.yaml, validate-manifest.py ("3 legs") and validate-pins.py ("10 copied shape file(s) match", "pins ok") all exit 0.
• An independent reproduction: update-shape.py apply --at 50178305… --yes --branch shape/update-5017830, run from a v1.1.1 checkout on a fresh clone of f0d7306, gave tree 453f8ab9…, this PR's own tree. check at the head reports all ten unchanged.
• Independence from the code leg's pin: v1.1.1's validate-pins.py compares shape-pin.yaml only with project.yaml's shape.commit, so this PR passes with the code leg's mount still at 190133d.
• CI: validate passed with the same ok lines.

Findings and what was done with them:

• S1, the ruling's dates. The body now names both rulings: 2026-10-22 (Triad migration (feature 004-migrate-to-triad): execution tracking under Brett Heap's word of 2026-10-07 #186 comment 6342293150, item 16) and 2026-11-08 ("v1.1.1 b", confirmed at 13:06:02Z).
• N1, the tool's commit. The commit message names the tool's own commit 84126f2de87d, which is on no remote. The body now says so, and the squash at landing will carry an explicit message that says it plainly.
• N2: a bot's summary was appended to the body, and the edit removed it.

Not yet checked: exact-pins, the required check, was still running at 13:28Z.

Lane: openRepoTools-1

[brettheap]

LANDING — lane openRepoTools-1, session df82f553-7803-49c4-8ddf-3f9acdcb8ee0@Eagle, 2026-11-08T15:36:26Z, PR #348 into opensoft/openRepoTools main → into main; head 62f70dd; openRepoShape v1.1.1's root shape copies (A, #186), on Brett Heap's dialog answer 'Land A now (Recommended)' (15:31:59Z); squash

[brettheap]

LANDED — lane openRepoTools-1, session df82f553-7803-49c4-8ddf-3f9acdcb8ee0@Eagle, 2026-11-08T15:38:34Z, PR #348 into opensoft/openRepoTools main → main e00ddd8 (squash of 62f70dd; tree 453f8ab9 equals the head's; openRepoShape v1.1.1's root shape copies, A, #186)