Give the test suite explicit code, assembly, spec and dependency roots, so it runs on today's single repository and in the adopted triad, and refuses composed acceptance without all of them

[brettheap]

Part of #186.
T009/T010 of specs/004-migrate-to-triad/tasks.md (branch 004-migrate-to-triad, PR #187).

Head: b50f197 (4 commits on c4864ac; 8 files, all under tests/). The fourth commit, b50f197, fixes lane 3's finding (1); the reviewer's LAND on it is review 5471080687.

What changes

When the repository is adopted into the triad, the files split across three repositories:

• README.md, AGENTS.md and CLAUDE.md move to the assembly root.
• docs/ moves to the spec leg.
• Every command, tests/, .gitmodules and contracts/openreposhape-pin.yaml stay in the code leg.
• The dependency upstream/openRepoShape stays nested in the code leg.

The suite assumed one tree. It now names four:

Root	Variable	Default (no variable)
code	OPENREPOTOOLS_CODE_ROOT	the tree the suite was loaded from
assembly	OPENREPOTOOLS_ASSEMBLY_ROOT	the nearest directory above the code root that carries contracts/code-pin.yaml and project.yaml, is a repository's top level, and records the code root as the gitlink its code pin names; absent on today's layout
spec	OPENREPOTOOLS_SPEC_ROOT	the assembly's spec leg (contracts/spec-pin.yaml's submodule_path) when it is checked out; absent otherwise
dependency	—	<code root>/upstream/openRepoShape, initialized or not

OPENREPOTOOLS_COMPOSED=1 is the composed switch. In either mode, the run is refused when a variable names the wrong kind of tree, or when the mode is anything other than 0 or 1.

Which root a file is read from (ROOTS.path_for(<rel>))

• README.md, AGENTS.md and CLAUDE.md come from the assembly.
• docs/…, openspec/…, specs/… and ideation/… come from the spec root.
• Everything else comes from the code root.

Today's single tree answers for all three, because it carries openspec/ and specs/ beside the code. On today's layout, every reader reads exactly the file it always read.

Decision: .gitattributes stays in the code leg

The suite reads .gitattributes from the CODE root. Git never applies a superproject's .gitattributes inside a submodule. I measured this in the composed candidate:

• README.md at the assembly is text: auto / eol: lf.
• code/park and code/tests/run.sh are unspecified.

So the line-ending rule protects the bash files only through the code leg's own copy. Reading the assembly's copy would pass while the code leg went unprotected.

This matches T006: its leg patch code-0001 gives the code leg its own .gitattributes, and the assembly keeps its copy for its own files. Until code-0001 lands in the real leg, the leg's tests job is red on this one test, by design.

Follow-up for the plan's owner: the placement table in specs/004-migrate-to-triad/plan.md (§ Target placement) on main still puts .gitattributes at the assembly only. It needs amending to say the code leg keeps its own copy before the real split. A leg split exactly as the table says is red on this test; the independent review saw this in its C5 and C6 runs.

Length caps at an assembly root (T006)

File	Cap on today's layout	Cap when an assembly root is named
AGENTS.md	316 (unchanged)	340
README.md	486 (unchanged)	510

The higher caps allow exactly the 24 lines each that T006's assembly-0001 adds. Each cap has a dated entry. The entries cite specs/004-migrate-to-triad/root-guidance-2026-10-08.md, which is on #192's branch. Land #192 with or before this PR, or that citation points nowhere until it does.

Readers rewired

• tests/test_repo_hygiene.py:
  • The 16 document tests read through doc(), and their per-surface loops visit the code's surfaces first (code_first()).
  • The two whole-tree scans use git ls-files over every repository the run can read. Today that is the code root; composed, it is code, assembly and spec.
• tests/test_upstream_pin.py reads the code root's own git ls-tree HEAD, with the dependency nested in the code root. A new check confirms the code root is its repository's top level.
• tests/test_openrepotools_command.py: the installer's receipt-mode README check.
• tests/test_lane_helpers.sh: the two sections that quote docs/README-lanes.md used to swallow a missing file with || :.
  • The runner now passes the spec root's manual.
  • An empty value (no spec root) skips them, and the skip names the reason.
  • Fixed in b50f197: at dbc6837, the --retire section's two manual assertions (:6601-6602) used $ln_doc outside the guard that binds it. With no spec root they aborted the suite under set -u (ln_doc: unbound variable); this was lane 3's finding (1). They now carry the same guard and named skip. A new text test, test_the_lane_suite_reads_the_manual_only_inside_its_guard, holds every use inside a guard.
  • The reviewer's LAND review on b50f197 (5471080687) ran three proofs:
    • The new test against dbc6837's suite: 1 failed, naming lines 6601 and 6602. At b50f197: green.
    • An extract of the suite's own lines with no spec root, under bash 5.2.21 and 3.2.57: it aborts at dbc6837 and ends with three named skips at b50f197.
    • With the manual present, the output is byte-identical at both commits.
  • My own run of the new test against dbc6837 agrees: 1 failed.
  • A value naming no readable file FAILS, and the failure names the path.
• tests/run.sh makes a relative root absolute before its cd. Nothing else in it changed.

The composed-vs-standalone contract

Standalone is the default, and the only mode today's layout has.

• A check whose root is absent skips, and the skip names the root. This is the courtesy the missing submodule already gets.
• The no-submodule skip is today's skip, with the same condition and reason.
• On today's layout nothing new skips: the scoped run below is 191 passed, 0 skipped.

Composed is OPENREPOTOOLS_COMPOSED=1. tests/conftest.py refuses the session (pytest exit 4, ERROR: …), naming each problem, when:

• the assembly or spec root is absent;
• the dependency is not initialized;
• the code or spec leg is not at the commit the assembly records as its gitlink, has tracked changes, or answers no git status.

In composed mode, NEEDS_UPSTREAM becomes a fixture that fails, and a document test that reaches an absent root fails. Nothing skips its way into composed acceptance (FR-008).

What the conftest does NOT check: the pin files' commit: and tree_sha256. Those belong to the standard's scripts/validate-pins.py. The T010 assembly job runs it in the step before the composed suite (Copilot round 2; see Follow-ups).

Evidence

Step 1: what the split breaks, before this change

I ran the suite at the rehearsed run C code leg 73b04d6, with tests/run.sh -k 'repo_hygiene or upstream_pin or wip_init or park_resume' -rfEs. Run C is main 837928a split by the standard's adopter into disposable local remotes (spec 593250d, assembly 69b8924).

Context	Result
M1: mounted in the recursive assembly clone	17 failed, 350 passed
M2: the code leg cloned alone, dependency initialized	17 failed, 350 passed
M3: the code leg cloned alone, dependency not initialized	17 failed, 141 passed, 209 skipped

The same 17 tests failed in all three runs, each with a FileNotFoundError:

• nine on README.md;
• one on CLAUDE.md;
• three on AGENTS.md;
• three on docs/README-lanes.md (the hygiene document tests);
• one on .gitattributes (test_the_root_carries_the_line_ending_rule).

test_upstream_pin.py passed in all three, because it already read the code leg's own gitlink. M3's skips were today's dependency skips. Outside those selectors, the installer's README check and the lane suite's two docs/README-lanes.md sections read moved files too. The lane suite had swallowed the missing file with || :. This PR covers all of them.

Local proof in the triad

I applied the PR head onto run C's code leg and pinned it into the assembly with the standard's bump-leg.py. The validators, make validate and make pins all exited 0.

I ran -k 'repo_hygiene or upstream_pin or roots or composed or openrepotools_command or lane_helpers_suite' four ways:

Run	Result
Composed, as the assembly job runs it	285 passed, 2 failed, 0 skipped
Composed, with the spec leg not checked out	refused, exit 4
Code leg standalone	268 passed, 2 failed, 17 skipped (each naming its root)
Code leg without its dependency	159 passed, 1 failed, 28 skipped

The failures are recorded here, not deleted:

• The code leg has no .gitattributes. This is the decision above.
• Two lane-suite stamp assertions fail in the composed run and the standalone run, because their expected directory falls past the 240-character row cut under run.sh's long run-root path. CI passes them, and this PR does not touch them.
• In the standalone run, the lane suite also aborted at ln_doc: unbound variable. That is the defect above. I first attributed this failure to the stamp assertions alone; lane 3's review caught it.

These proofs ran on c139e88's content and were not repeated on e3a76b5 or dbc6837. The independent review's fake triad (C1–C6) exercised dbc6837 composed and standalone. The full record is specs/004-migrate-to-triad/test-roots-and-ci-2026-10-08.md on 004-migrate-to-triad-ci.

Red at base: 21 of 21

All 21 test cases in tests/test_test_roots.py fail at origin/main c4864ac.

Round 1. I copied the module as of c139e88 (sha256 be4edff7…) unchanged into a clone of c4864ac. tests/run.sh -k roots gave 18 failed: every test in the module. The 3 passes are tests in other modules whose names contain roots.

Seven of those failures are behavioural, and each fails on what it asserts:

• The nested hygiene run passed against an assembly README with no install line, and against a spec manual without the fork act, because it read this checkout's files.
• A standalone code leg's README test passed instead of skipping.
• The lockstep check passed on a code root whose gitlink is 1111….
• The dependency checks passed with no dependency, instead of today's skip.
• A composed triad with its spec leg moved off its pin ran (exit 0, not 4).
• The wrapper passed asm through as a relative path.

The other 11 are resolver tests. They fail because conftest.resolve_roots and ROOTS do not exist at the base.

Round 2. I copied dbc6837's module (sha256 aeb4b742…) the same way and ran -k 'length_caps or missing_manual or status_cannot_be_read'. That gave 3 failed: the three tests added since round 1. The independent review copied the same module whole into c4864ac and got 21 failed.

How the module works: it runs the suite itself, nested, against fixture triads built under tmp_path. Each fixture has:

• a fake assembly with the rehearsed contracts/code-pin.yaml grammar, pins recomputed from the fixture trees, and project.yaml;
• a code leg copied from this checkout;
• a spec leg.

It never touches a real repository.

Green

tests/run.sh -k 'repo_hygiene or upstream_pin or roots or composed' gave 191 passed, 0 skipped at dbc6837 and on its merge onto main 63810dd. That was the independent review's run. My own earlier runs gave 188 at c139e88 and 189 at e3a76b5.

CI on dbc6837 (run 37869489919, merge 5ad6205):

Job	This PR	Main 63810dd
tests	1318 passed	1296
tests-no-submodule	1105 passed, 213 skipped	1084 passed, 212 skipped
tests-windows	176 passed, 1142 skipped	—
guard-launch-mode	165 passed	—
parse-macos	green	—

The one extra tests-no-submodule skip is the composed positive control, which skips with today's reason. tests-macos is running under ready (run 37873415160).

How the local runs were made

The workstation-wide pgrep census in tests/run.sh did not reach zero on Eagle for some runs. Under the coordinator's interim rule, any run that had not started within 5 minutes was replaced by run.sh's exact pytest line under flock on the same lock file. The logs say which runs those were, and the deviation is noted on #184. CI is the record.

Reviews

• Copilot round 1: two findings, both fixed in e3a76b5, and both threads resolved.
  • A git status that fails is now a refusal.
  • The fixture legs keep .gitattributes.
• Independent adversarial review: LAND on dbc6837.
• Lane 3 (reviewer of record): LAND on dbc6837, with three things to fix before the squash.
  • (1) The $ln_doc abort, confirmed above, with the fix ready.
  • (2) The paired layout <assembly>/worktrees/<feature>/code finds no assembly.
  • (3) The root variables redirect the suite silently, because the report header is hidden by -q.
• Copilot round 2 on dbc6837 raised two findings. Both are recorded as dated follow-ups, not pushed here, because the macOS gate is running.
  • (High) The conftest never reads the pin files' commit:. Reproduced: with contracts/code-pin.yaml's commit: moved off the gitlink, ROOTS.refusal() returns None, while validate-pins.py exits 1 with pin-gitlink-mismatch. That validator runs before the suite in the T010 job. Answered in the thread.
  • (Medium, "previously missed") _carries accepts a directory where a marker file is expected.

Follow-ups (dated 2026-10-09, recorded on #186; not in this PR)

Review findings 11 and 14 have commits on branch feat/test-roots-followups (6e63083, 2064390, on dbc6837). That branch is not part of this PR.

1. Review finding 11 — three code-only assertions sit after a document read. At test_repo_hygiene.py:994, :1052 and :1264, a code-only assertion follows the first doc() read, so a standalone code leg skips them together with the documents.
   • 6e63083 asserts each mixed test's command half first. That covers park's header, status's --no-optional-locks, the installer's lanes [--all] [--fetch], the exit-3 table and the wrapper's lock claims.
   • 2064390 proves it with a nested run against a fixture leg whose commands lost those lines.
2. Review finding 13 — the missing-manual failure is checked only by its text. The bad branch was exercised locally:
   • With the block extracted unchanged and stub ok/bad, LANE_MANUAL=/nonexistent/README-lanes.md prints FAIL the lane manual is where the run's roots put it, and an empty value skips.
   • Still to do: a behaviour test that runs the block itself.
3. Review finding 14 — the four variables are not in AGENTS.md. 6e63083 adds seven lines to "Testing your changes" naming the roots, the three variables and the composed switch. Its AGENTS cap moves 316 → 323 (340 → 347 at an assembly root), with a dated entry.
4. Copilot round 2:
   • The conftest should refuse a pin whose commit: differs from the gitlink.
   • Root markers should be regular files.
5. Review finding 10: the plan owner's placement-table amendment (above).
6. Lane 3's review:
   • (1) feat/test-roots-manual-guard @ b50f197, unless it goes into this PR first.
   • (2) Discovery for the paired worktree layout, before Gate C.
   • (3) Say which roots a run used where -q cannot hide it.
7. Review finding 15 (nits):
   • (a) Roots.owner_of maps LICENSE and .gitignore to the code root. This is latent, because no test reads either.
   • (b) abs_root turns a quoted ~/x into $PWD/~/x.
   • (c) The GIT_ENV comment says "file transport allowed".

Not in this PR

The CI patches of T010 apply to repositories that do not exist yet:

• the code leg's tests.yml;
• the assembly's exact-pin job, as its own workflow (composed.yml), because validate.yml is a pinned shape copy.

They are on 004-migrate-to-triad-ci, with their local proofs. .github/workflows/tests.yml on main is unchanged.

🤖 Generated with Claude Code

Summary by Sourcery

Make the test suite operate safely across the current single repository and the adopted triad by resolving ownership explicitly and refusing incomplete composed runs.

New Features:

• Add explicit code, assembly, spec, and dependency root resolution with environment-variable overrides and automatic triad discovery.
• Add standalone and composed test modes, including composed-session refusal when required roots, pins, repository state, or dependencies are invalid.

Bug Fixes:

• Ensure tests read documents, manuals, commands, pins, and dependency data from the repository leg that owns them instead of assuming a single tree.
• Prevent missing lane manuals from being silently ignored and preserve informative standalone skips.

Enhancements:

• Extend repository hygiene and upstream-pin checks across all repositories visible to a composed run.
• Make the test wrapper normalize relative root paths before changing directories.
• Add coverage for single-repository, standalone-leg, mounted-triad, invalid-root, pin-mismatch, and composed acceptance behavior.

Tests:

• Add comprehensive root-resolution and composed-mode tests, including nested fixture-repository runs and wrapper environment propagation checks.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 1 hour by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The suite now treats code, assembly, spec, and nested dependency locations as explicit runtime roots, resolving them from environment variables or repository layout, routing every reader accordingly, and enforcing a strict composed-triad contract while retaining compatible named skips for standalone clones. New fixture-based tests exercise root discovery, path ownership, pin integrity, dependency states, wrapper propagation, and refusal behavior.

File-Level Changes

Change	Details	Files
Introduces centralized four-root discovery and validation with standalone and composed execution modes.	Adds environment-variable overrides and default discovery for code, assembly, and spec roots. Models the dependency as nested under the code root and validates its initialization. Validates marker files, repository boundaries, assembly gitlinks, pinned leg commits, and tracked cleanliness. Refuses invalid configuration or incomplete composed sessions before pytest collection, while preserving named standalone skips. Exposes root ownership, path resolution, dependency fixtures, and pytest session reporting.	tests/conftest.py
Rewires repository, document, pin, and dependency checks to read from the root that owns each artifact.	Routes guidance documents through the assembly root, spec trees through the spec root, and commands/tests/pins through the code root. Expands hygiene scans across every readable repository in composed runs. Updates upstream pin checks to use the code repository's own git identity and nested dependency. Preserves standalone missing-dependency behavior while making composed dependency requirements non-skippable.	tests/test_repo_hygiene.py tests/test_upstream_pin.py tests/test_openrepotools_command.py
Adapts shell test execution and lane-manual assertions to explicit root context.	Converts relative root variables to absolute paths before the wrapper changes directories. Passes the resolved spec manual path into the lane-helper shell suite. Skips lane-manual assertions by name when a standalone code leg has no spec root.	tests/run.sh tests/test_lane_helpers.py tests/test_lane_helpers_suite.py
Adds comprehensive resolver and integration coverage for single-repository, triad, standalone, and composed layouts.	Builds isolated fixture repositories and verifies document routing, gitlink/pin checks, dependency handling, and root discovery. Checks composed refusal for missing roots, uninitialized dependencies, off-pin legs, dirty worktrees, and invalid variables. Verifies relative-path propagation through the test wrapper and ensures composed runs execute no tests after refusal.	tests/test_test_roots.py

Possibly linked issues

• Triad migration (feature 004-migrate-to-triad): execution tracking under Brett Heap's word of 2026-10-07 #186: PR directly delivers migration-plan T009/T010, adapting tests for code, assembly, spec, and dependency roots.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Copilot]

🟡 Changes recommended

The fixture omits a required code-root file, and failed Git status checks can incorrectly pass composed validation.

2 open findings

• Reject acceptance when git status cannot be read · New
• Preserve .gitattributes in copied code-leg fixtures · New

What changed in this PR

Makes the test suite aware of standalone and composed repository layouts.

Changes:

• Resolves code, assembly, spec, and dependency roots.
• Enforces composed-mode pin and cleanliness checks.
• Rewires document, pin, installer, and lane-helper tests.

File	Description
tests/​conftest.py	Resolves and validates test roots.
tests/​run.sh	Normalizes relative root variables.
tests/​test_test_roots.py	Adds root-resolution and composed-layout tests.
tests/​test_upstream_pin.py	Reads pins and dependencies from the code root.
tests/​test_repo_hygiene.py	Routes documents and scans through owning roots.
tests/​test_openrepotools_command.py	Reads the README from the assembly root.
tests/​test_lane_helpers.sh	Supports a spec-root lane manual.
tests/​test_lane_helpers_suite.py	Passes the resolved manual to the shell suite.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[brettheap]

Behaviour change pushed (e3a76b5, Copilot round 1): in a composed run, a leg whose git status fails is now refused instead of read as clean; the fixture code legs keep .gitattributes. Nothing changes on today's layout. Scoped run -k 'repo_hygiene or upstream_pin or roots or composed': 189 passed, 0 skipped (run.sh's pytest line under the lock, by the census rule). A second commit follows with two items from the T006 record (§10): the assembly README/AGENTS length caps and an explicit failure for a missing lane manual.

[brettheap]

Second behaviour commit pushed (dbc6837), from the T006 record (root-guidance-2026-10-08.md §10): where an assembly root is named or found, the README/AGENTS.md length caps are 510/340 (today's 486/316 plus the 24 lines each that assembly-0001 adds, in dated entries); today's single repository keeps 486/316, so nothing changes on today's layout. The lane suite's two manual sections now FAIL naming the path when the manual the roots point at is unreadable, instead of reading an empty string. Three new tests, all three red at origin/main c4864ac (3 failed). The local scoped green run was still queued behind the workstation lock at this checkpoint; CI on dbc6837 is the record.

[brettheap]

Independent adversarial review — lane openRepoTools-3 (read-only; 2026-10-09T02:10Z)

Verdict: LAND on dbc6837: all CI is green (tests-macos waits on ready). Today's single-repository layout is unchanged: the same 1296 test ids, the same pass/skip outcomes and skip reason, no file outside tests/, and the same length caps. One defect sits in the new triad path (finding 10: the shell suite aborts in a standalone code leg). It does nothing here; it is a two-line move that is best made before the squash.

What was reviewed. c139e88 (the brief's head), then each increment: e3a76b5 (Copilot round 1) and dbc6837 (the current head, 01:22:46Z). Main has moved from 837928a to 63810dd (#189, six specs//openspec/ files). GitHub's merge ref is 5ad6205, which is 63810dd + dbc6837. All work was in a scratch clone; no worktree, branch, PR, issue or register was written.

1. CI.

   • c139e88: all green. tests 1315 passed. tests-no-submodule 1102 passed, 213 skipped. tests-windows 173 passed, 1142 skipped. parse-macos (/bin/bash 3.2.57), guard-launch-mode and SonarCloud green.
   • e3a76b5: all green. tests 1316 passed. tests-no-submodule 1103 passed, 213 skipped, every skip with today's reason. tests-windows 174 passed, 1142 skipped.
   • dbc6837: guard-launch-mode (165 selected, 1153 deselected), parse-macos, tests-windows (176 passed, 1142 skipped) and SonarCloud green. tests 1318 passed (finished 02:08Z). tests-no-submodule 1105 passed, 213 skipped, every skip with today's reason and the per-file skips identical to e3a76b5's.
   • tests-macos is skipped on every head because there is no ready label; that job is the landing gate.

2. The diff. The PR's own diff (63810dd...dbc6837) is 8 files, +1265/−69, all under tests/: conftest.py, run.sh, test_lane_helpers.sh, test_lane_helpers_suite.py, test_openrepotools_command.py, test_repo_hygiene.py, test_upstream_pin.py and the new test_test_roots.py.

   • What dbc6837 adds: readability guards before the two manual reads in test_lane_helpers.sh (+6); assembly-only length caps in test_repo_hygiene.py (+20/−2); two tests in test_test_roots.py (+53).
   • The merge is clean. The merge ref 5ad6205 minus 63810dd is byte-identical to the PR's patch. git diff --stat 63810dd 5ad6205 -- . ':(exclude)tests' is empty, and the gitlink stays 7f84ca4. So ./openRepoTools --install and the installed.tsv receipt are untouched by construction.
   • A misleading view to ignore. The branch is cut from c4864ac, so a two-dot diff against main shows #187/#188/#189's files reverted and the gitlink back at 39d5c98. The merge does neither.

3. How the roots resolve on today's layout: unchanged, measured. I imported each tree's conftest.py and compared 837928a against the merge, each with the submodule and without it.

   • REPO and UPSTREAM are identical.
   • NEEDS_UPSTREAM is the same skipif: the same condition, False with the submodule and True without, and the same reason text. WINDOWS_SKIP is identical.
   • ROOTS.layout is single and ROOTS.assembly is None. So root_of gives the code root for all three roles, path_for returns the old paths, tracked_roots() is [code] (the same git ls-files), and refusal() is None. The new caps (test_repo_hygiene.py:1779, :2284) therefore stay 316 and 486 here.
   • The variables. Five can redirect the suite: OPENREPOTOOLS_CODE_ROOT, _ASSEMBLY_ROOT, _SPEC_ROOT, _COMPOSED, and OPENREPOTOOLS_LANE_MANUAL (shell suite only). No workflow sets any of them. Setting all four OPENREPOTOOLS_* variables to the empty string gives today's roots, and so does _COMPOSED=0.
   • Hazard (non-blocking): a redirect is silent. OPENREPOTOOLS_CODE_ROOT (conftest.py:347) accepts any directory that carries openRepoTools and contracts/openreposhape-pin.yaml, and re-points REPO and UPSTREAM there. The test modules still come from this checkout. I measured it: pointing it at another checkout gave no refusal. OPENREPOTOOLS_ASSEMBLY_ROOT accepts any directory holding two empty marker files. It then also loosens the caps to 340 and 510.
   • Nothing shows it. The only trace is pytest_report_header (conftest.py:415). -q hides it, and both tests/run.sh and CI pass -q: the PR's CI logs and my collect runs contain the header zero times. Suggestion: print the roots to stderr whenever a variable is set.

4. Test-count invariant.

   • Collected ids, whole suite:

     Tree	Tests collected
     837928a (old main)	1296
     63810dd (main)	1296 (the same ids)
     c139e88	1315
     dbc6837 (head)	1318
     5ad6205 (merge)	1318 (the same ids as dbc6837)

     None removed or renamed. 22 added: 21 in test_test_roots.py (18 at c139e88, 1 at e3a76b5, 2 at dbc6837) and test_upstream_pin.py::test_the_code_root_is_a_repository_of_its_own.

   • Touched modules run locally (test_repo_hygiene, test_upstream_pin, test_openrepotools_command, test_test_roots, test_run_wrapper): at c139e88, 294 passed, 0 skipped, 0 failed. At the merge 5ad6205, 297 passed, 0 skipped, 0 failed (8m47s).

   • Main against PR in CI (dbc6837):

     • tests: 1296 → 1318 passed.
     • tests-no-submodule: 1084/212 → 1105/213. All 213 skips carry today's reason, byte for byte. Skips per file are identical except +1 in test_test_roots.py: the @NEEDS_UPSTREAM positive control.
     • tests-windows: 155/1141 → 176/1142. The +1 skip is the WINDOWS_SKIP wrapper test.

   • Inside the shell suite: on today's layout it gains two ok assertions from dbc6837's readability guards. The pytest item is unchanged.

   • How I ran it: tests/run.sh's pre-lock census never cleared, with 4–7 foreign python3 -m pytest processes live. So I ran the wrapper's exact pytest invocation under flock /tmp/openrepotools-pytest.lock directly, with the same -q -p no:cacheprovider --basetemp and TMPDIR/PYTHONPYCACHEPREFIX set as the wrapper sets them. This is #184's finding.

5. The triad fixtures are hand-written, not rendered from the template. LEG_PIN (test_test_roots.py:68) and PROJECT_YAML (:88) are typed out. They are not rendered from openRepoShape's templates/assembly-root/ at 7f84ca4. LEG_PIN's keys match the template's contracts/code-pin.yaml field for field, minus comments. PROJECT_YAML has only id, name and legs. That does no harm, because the resolver reads only whether project.yaml exists and the pin's submodule_path:.

   • The dependency is real. It is a local git clone --no-checkout of the pinned submodule, checked out at the pin (:192) and nested at code/upstream/openRepoShape.
   • No network and no gh.
   • Stronger evidence: the resolver run against the real run C arrangement. I cloned it per its README: assembly 69b8924, code 73b04d6, spec 593250d, dependency 7f84ca4. For the mounted code leg, discovery finds both the assembly and the spec leg, and composed mode is not refused. That held both untouched and with this PR's tests committed into the leg and the assembly re-pinned. For a lone code-leg clone, assembly and spec are absent, and composed mode is refused naming both.
   • .gitattributes gap. The rehearsed code leg has no .gitattributes, so test_the_root_carries_the_line_ending_rule (test_repo_hygiene.py:2718; it reads at :2736) is red in every triad layout until the code leg gets its own (T006). Since e3a76b5 the fixture code leg keeps .gitattributes. That is right by the contract, but it no longer matches the rehearsed leg. Worth a Gate C checklist row.

6. .github/workflows/tests.yml is untouched on every head. Job names (tests, tests-no-submodule, tests-windows, parse-macos, tests-macos) are unchanged, as are the submodules: true/false settings and the triggers. There is no new job or matrix entry, so "green" means what it meant. One consequence: no job runs OPENREPOTOOLS_COMPOSED=1. Composed mode exists only inside test_test_roots' nested runs.

7. Bash 3.2 and Windows. The added shell lines (run.sh abs_root, the LANE_MANUAL default, the guarded blocks and dbc6837's [ -r … ] guards) use none of ${x,,}, mapfile, declare -A, local -n, [[, |&. bash --posix -n is clean, and parse-macos (bash 3.2.57) is green on all three heads. dash -n on test_lane_helpers.sh fails, but that is pre-existing: line 238 at 837928a. On Windows, the wrapper test carries WINDOWS_SKIP. The nested-pytest tests, including the composed triad control, run and pass on Windows.

8. Docstrings and comments.

   • (a) test_lane_helpers.sh:51-57 says that a set-but-empty manual means "those quotes are SKIPPED". The third read aborts instead; see 10.
   • (b) test_test_roots.py:105-106 says "file transport allowed for the one local clone". GIT_ENV sets only an identity; the clone works because git allows a local clone the user invokes.
   • (c) The conftest docstring cites "the assembly's exact-pin job". No such job exists yet; it belongs to T010.
   • (d) test_upstream_pin.py's docstring now correctly says three tests carry NEEDS_UPSTREAM. That corrects the stale "one" on main.
   • (e) Two tests skip their code half along with the document half in a standalone leg. Both read the document before they assert anything about the code, unlike hygiene's code_first():
     • test_openrepotools_command.py:1397-1401 calls path_for("README.md") before the --help loop.
     • test_the_suite_wrapper_takes_one_lock_and_names_it_where_agents_read_it reads doc("AGENTS.md") (:3129) before any run.sh assertion.
   • (f) dbc6837's subject says it fails the lane suite "by name when the lane manual is missing", and test_the_lane_suite_fails_a_missing_manual_by_name (test_test_roots.py:360) holds the two cat "$LANE_MANUAL" reads. It does not see the third use of the manual text (:6601-6602), so finding 10 stands.
   • (g) The AGENTS cap's docstring (test_repo_hygiene.py:1771-1773) cites specs/004-migrate-to-triad/root-guidance-2026-10-08.md, patch assembly-0001. That file is not on 63810dd; it is in #192. The citation dangles until #192 lands.

9. Overlap with lane 3's feat/triad-lane-tooling. Read with git show on the main checkout's refs only. At c45a452 the branch is one docs-only commit: docs/triad-lane-tooling-analysis.md, 541 lines. Its tests/conftest.py, test_repo_hygiene.py and test_openrepotools_command.py blobs are identical to c4864ac, and tests/test_checkout_roots.py does not exist.

   • No conflict in committed code. The analysis records its earlier draft as dropped in favour of #190's definitions: manifest_legs, checkout_roots, ASSEMBLY, SPEC, source(), $OPENREPOTOOLS_TEST_{ASSEMBLY,SPEC}_ROOT, and a missing root failing in both modes. No symbol is left defined with two meanings.
   • One conflict in meaning. The analysis's T010 sketch (§4.14) runs code-PR CI with OPENREPOTOOLS_COMPOSED=1, _ASSEMBLY_ROOT set to assembly main, and _SPEC_ROOT. #190's composed contract (conftest.py:259-281, _leg_at_its_pin) refuses any code root that is not at the assembly's recorded gitlink. I measured it: "composed acceptance is for the pinned code leg and no other". So that job would exit 4 on every code PR. T010 must either run composed mode only in the assembly's exact-pin job, or #190 grows a third mode: named roots, an absent root fails, and no pin check.

10. Defect, still present at dbc6837: in a standalone code leg the shell suite aborts instead of skipping. test_lane_helpers.sh:6601-6602 (6595-6596 at c139e88) reads "$ln_doc" after the guarded block at :6244-6264, and ln_doc is assigned only inside it. The suite runs under set -uo pipefail (:42). Whenever the run has no spec root, test_lane_helpers_suite.py:180-182 sets OPENREPOTOOLS_LANE_MANUAL="".

    • Reproduced on bash 5.2.21 with dbc6837's own lines (42, 58, 6244-6264 without run/is, and 6601-6602). With the variable empty: ln_doc: unbound variable, exit 1. With it unset, the script reaches its end.
    • Effect: in a standalone code leg (run C's lone leg, or the paired worktree of 11), test_the_lane_helper_suite_passes FAILS where the PR says it skips. This does nothing on today's layout, where LANE_MANUAL is the code root's own manual, and no fixture exercises it.
    • Fix: move the two lines inside the if, and add their count to the skip text.

11. The paired worktree layout finds no assembly (Gate C item). discover_assembly (conftest.py:159-172) stops at the first ancestor that carries the markers, and returns None (:171) unless that ancestor mounts exactly this path. I measured it on run C with paired worktrees at <assembly>/worktrees/feat/{code,spec}. Standalone: assembly absent and spec absent, although the spec worktree sits at ../spec. Composed: refused. After Gate C that is the shape's default worktree layout (<root>/worktrees/<branch>/<mount>). There every document test skips, and with 10 the lane-helper suite aborts. Suggested fix: accept <assembly>/worktrees/<feature>/code, take the spec root from ../spec, and take the assembly from the root.

12. Design choice for lane 1 and T010: skip, or fail. Standalone, #190 SKIPS a read whose root is absent (path_for/need, conftest.py:215-241). It adds no workflow (6). In the triad, the code leg's own CI would therefore be green with README.md, AGENTS.md, CLAUDE.md and the lane manual never read: 16 hygiene tests plus the command test (13). That is sound only if T010 makes a composed job required on every code PR, and as defined, COMPOSED cannot be that job (9). Failing would be the honest default until T010 lands. Either way, this is not a change to today's layout.

13. Lane 2's run C list, mapped by test id (#186 comment 6072319462). This is 837928a's suite in the code leg 73b04d6: 21 failed, 1275 passed.

    • Standalone, with #190 as of dbc6837, 17 of the 21 turn into skips (all through doc()/path_for).
      • test_openrepotools_command.py::test_the_help_and_the_readme_say_the_mode_the_receipt_is_born_at.
      • test_repo_hygiene.py:: the install line, the gh api form, the onboarding chain, the PowerShell twin, claude_md_points_at_agents_md, bare park, status, the sweep skip, the directory precedence, bare lanes, agents_md_names_the_pin_rules, the AGENTS cap, the README cap, exit 3, the fork act, and the suite wrapper.
      • In bare park, status, the sweep skip and bare lanes, code_first() asserts the command's own half before the skip.
    • 4 stay red:
      • test_repo_hygiene.py::test_the_root_carries_the_line_ending_rule, by design (5).
      • test_lane_helpers_suite.py::test_the_lane_helper_suite_passes. Of the suite's 16 failures, 13 are manual assertions. 12 of those fall inside the two blocks that now skip (14 assertions skipped), and the 13th is where the run aborts, at :6601 (10). #180's row-stamp cuts at main's :1055 and :5335 still fail before the abort; the one at :7527 is never reached.
      • test_supervised_restart_regressions.py::test_completed_observer_cleanup_never_signals_saved_pid[exit] and [signal]. #190 does not touch these; the class is pending on lane 2's side (load 55–70).
    • Mounted inside the assembly's code/: discovery now reads the assembly's and spec leg's files. Lane 2 measured those as blob-identical to main's, and they are within the 340/510 caps. So I expect those 17 to pass, but that is inferred; I did not run it. Lane 2's Part 2 finding, that the run inside code/ "equals standalone exactly", was made without #190. With #190 the two runs differ by design.

Not checked here:

• tests/test_lane_helpers.sh, the 40-minute shell suite, was not run locally. CI's tests job ran it inside test_the_lane_helper_suite_passes: green at all three heads.
• tests-macos, which needs the ready label.
• The "red at origin/main" claims in test_test_roots' docstrings.
• Suite runs inside the rehearsed triad: the scratch was prepared, but I did not run the suite there. Finding 13's mounted expectation is therefore inferred.
• The observer pair's class (lane 2's to settle).

[brettheap]

Independent adversarial review — lane openRepoTools-1 (read-only; 2026-10-09T02:10Z)

Verdict: LAND on head dbc6837.

The head moved twice while this review ran: c139e88 → e3a76b5 (Copilot round 1) → dbc6837 (T006's caps and the missing-manual failure). Every check below was redone at dbc6837, or at its merge onto current main 63810dd. That local merge has the same tree as GitHub's refs/pull/190/merge 5ad6205: a433a5f….

Method:

• Fresh scratch clones under the private prep area, never the shared checkout.
• Every pytest run went through PATH=/usr/bin:$PATH flock "${TMPDIR:-/tmp}/openrepotools-pytest.lock" python3 -m pytest …. Local pytest is 9.1.1; CI uses 8.3.4.
• Nothing on the branch was modified.

Today's layout is unchanged in every respect I could measure. Nothing below blocks the landing.

Findings

1. Scope. Not a block.

• git diff --stat c4864ac...dbc6837 lists 3 commits and 8 files, all under tests/ (+1265/−69). The diff stat for openRepoTools and .github/workflows/* is empty.
• The full diff removes five assert lines:
  • Three come back unchanged, pointed through the new root lookup:
    • CLAUDE.md → doc()
    • "skipped (no overlay)" → doc(name)
    • UPSTREAM / rel → DEPENDENCY_ROOT / rel
  • Two are the length caps, rewritten as cap = 316 if ROOTS.assembly is None else 340 and cap = 486 if ROOTS.assembly is None else 510 (tests/test_repo_hygiene.py:1779, :2284). On today's layout ROOTS.assembly is None, so they are still 316 and 486. They relax only at an assembly root, by exactly the lines T006 adds (see 12).
• No skip was removed. The new skip sites are:
  • ROOTS.need (tests/conftest.py:233-239), reached only when a root is absent.
  • The unchanged NEEDS_UPSTREAM (:455).
  • A bash-absent skipif on the wrapper test.
  • Two bash skip lines for an empty OPENREPOTOOLS_LANE_MANUAL, which never happens on today's layout.

2. Default behaviour is unchanged. Not a block.

• Code trace. With no variable set:
  • SUITE_ROOT and REPO are the old Path(__file__).resolve().parents[1] (conftest.py:53, :401).
  • discover_assembly (:159) returns None, because no parent carries contracts/code-pin.yaml and project.yaml.
  • layout is single (:191), so path_for answers the repository root for README, AGENTS, CLAUDE and docs/, and tracked_roots() is the code root alone.
  • NEEDS_UPSTREAM keeps the same condition and the same reason string.
• Probe. ROOTS.describe() in a fresh clone gives standalone, single layout, with code, assembly and spec all equal to the clone and refusal=None.
• Collect-only. c4864ac collects 1296. dbc6837 collects 1318, and so does its merge onto 63810dd. Every base node id is present at head. The 22 additions are the new module's 21 tests plus test_upstream_pin.py::test_the_code_root_is_a_repository_of_its_own.
• Report header. pytest_report_header (:415) adds five lines only without -q. Every CI job and tests/run.sh pass -q, and I confirmed the header is absent under -q.

3. The no-submodule path. Not a block.

• CI tests-no-submodule on dbc6837 (merge 5ad6205): 1105 passed, 213 skipped. Main 63810dd: 1084 passed, 212 skipped. Grouped by file, reason and count, the skip lists are identical except one added skip: tests/test_test_roots.py (its composed positive control), with today's exact reason the pinned openRepoShape is not checked out; run git submodule update --init upstream/openRepoShape.
• Local, scoped (upstream_pin, repo_hygiene, park_resume and the receipt test, -rs, clones with no submodule): base 157 passed and 146 skipped; head 158 passed and 146 skipped. The skip sets are identical.

4. Composed mode, against a fake triad.

I built the fake triad from the head in scratch. The assembly has project.yaml, a contracts/{code,spec}-pin.yaml matching openRepoShape 7f84ca4's templates/assembly-root/contracts/code-pin.yaml field for field (leg_role, source_repository, submodule_path, commit, digests.tree_sha256 recomputed), gitlinks code and spec, and README/AGENTS/CLAUDE. The code directory is a --no-local clone of dbc6837 with a dissociated dependency, so it has no alternates. Not a block.

• Detection. Discovery finds the assembly with all markers present. Each of the following, removed one at a time, gives None: project.yaml, code-pin.yaml, the assembly's repository, the pin's submodule_path pointing at this code root, and the gitlink at the mount.
• C1, complete triad composed. test_repo_hygiene.py, test_upstream_pin.py and test_test_roots.py give 188 passed, 0 skipped.
  • I ran it with a Python audit hook (sys.addaudithook, inherited by the nested pytest runs). It logged 8413 events: opens, listdirs, scandirs, chdirs and Popens.
  • Zero events name the shared checkout or any other scratch clone.
  • Every subprocess cwd is inside the fixture or basetemp. The only paths outside them are site-packages, /usr/lib, /tmp probing, and a directory scan of the fixture's two parent directories.
• C2. I removed the install line from the assembly's README and WSL2 from its AGENTS.md. Composed, test_the_readme_prints_the_install_line_the_pointer_prints and test_no_document_offers_a_windows_powershell_twin both FAIL, on the assembly's text.
• C3, spec leg not checked out. Composed exits 4 with: the SPEC root is absent: the assembly's spec leg …/asm/spec is not checked out, and OPENREPOTOOLS_SPEC_ROOT is unset.
• C4, dependency left empty. Composed exits 4 with: the DEPENDENCY …/code/upstream/openRepoShape is not initialized (no scripts/repo_shape.py, templates/workspace-root/README.md).
• Mistyped variables. OPENREPOTOOLS_COMPOSED=yes exits 4, and so does OPENREPOTOOLS_SPEC_ROOT=nowhere, each naming the variable.
• C5, split code leg composed. The triad's code leg was split exactly as plan.md's placement table says (no .gitattributes). Result: 166 passed, 1 failed, and the failure is test_the_root_carries_the_line_ending_rule (see 10).
• C6, the same split leg standalone. 150 passed, 16 skipped, 1 failed (the same test). Every skip names its root: 9 README, 3 AGENTS, 1 CLAUDE, 3 docs/README-lanes.md. This matches the body's M1–M3 accounting: 17 = 16 + .gitattributes.
• Lane manual path. In the split triad, composed, the manual is asm/spec/docs/README-lanes.md. That is the OPENREPOTOOLS_LANE_MANUAL value tests/test_lane_helpers_suite.py:181 passes.

5. Red at base, green at head. Not a block.

• red1. OPENREPOTOOLS_ASSEMBLY_ROOT= an assembly whose README lacks the install line. At c4864ac the README test PASSES, because it read the checkout's own README. At head it FAILS with README.md does not carry the install line.
• red2. OPENREPOTOOLS_COMPOSED=1 in a clone with no submodule. At base, test_upstream_pin.py exits 0 with 4 passed and 10 skipped. At head it exits 4, naming the absent ASSEMBLY, SPEC and DEPENDENCY.
• red3. dbc6837's tests/test_test_roots.py, copied unchanged (sha256 aeb4b742…) into the base clone, gives 21 failed.
  • 9 fail on behaviour: the README and manual reads, the standalone skip, lockstep 1111…, digest-without-dependency, a composed triad exit 0 != 4, relative asm, a cap file one line over (passed on an assembly file one line over its cap), and the missing-manual guard (found 0 manual reads).
  • 12 fail on the missing resolve_roots or ROOTS.
  • The base clone was clean again afterwards.
• Green at head. The module gives 21 passed. The body's selector -k 'repo_hygiene or upstream_pin or roots or composed' gives 191 passed and 0 skipped, both at head and on the merge onto 63810dd.

6. Portability. Not a block.

• The added shell (tests/run.sh:75-96, tests/test_lane_helpers.sh:58, :3746-3750, :6244-6246) has no ${x,,}, ^^, mapfile, readarray, declare -A, local -n, read -a, |&, ;;&, coproc or $BASHPID (checked by grep). It uses ${var-default}, case, [ -r ] and [ -n ]. parse-macos (/bin/bash 3.2) is green on dbc6837.
• Every changed .py parses under ast.parse(..., feature_version=(3, 9)).
• No awk -v was added. No shell grep whose exit status matters was added; the stub python's plain grep writes to a file and its status is not read.
• tests.yml is unchanged. tests-windows on dbc6837: 176 passed and 1142 skipped, against 155 and 1141 on main. The extra skip is the wrapper test's WINDOWS_SKIP.

7. Security and hygiene. Not a block.

• The added lines contain no host-absolute path. test_no_committed_file_names_a_host_absolute_path is green inside the 191.
• No new network reach. The one curl string is fixture README text, and the dependency fixture is a local-path clone.

8. CI is the record. Not a block.

• Run 37869489919 on merge 5ad6205 (dbc6837 into 63810dd): tests 1318 passed (main 63810dd: 1296), tests-no-submodule as in 3, tests-windows and guard-launch-mode (165 passed) green, parse-macos green.
• tests-macos was skipped because no ready label is on the PR.

9. The assembly's own state is not checked. Not a block; an observation for T010. Composed refusal checks that each leg's HEAD equals the gitlink the assembly records and that each leg is clean (_leg_at_its_pin, conftest.py:259; e3a76b5 now refuses an unreadable git status, :272). It does not check the leg pins' commit: or tree_sha256 against those gitlinks. It also does not check the assembly working tree itself: C2 read an uncommitted README edit. That fits "the assembly is the tree under test", and the assembly exact-pin job's validate-pins.py is the pin/digest authority. The T010 job should run both.

10. .gitattributes placement disagrees with plan.md on main. Not a block for this PR; it needs settling before Gate B.

• conftest.py:62-69 and the test_the_root_carries_the_line_ending_rule docstring keep .gitattributes the code root's.
• The placement table in specs/004-migrate-to-triad/plan.md (§ Target placement) on main still puts it at the assembly only.
• The reasoning is sound: git does not apply a superproject's attributes inside a submodule. The body records the measurement. But the decision lives only in test-roots-and-ci-2026-10-08.md on the unlanded 004-migrate-to-triad-ci branch.
• A plan-conformant split code leg is red on this test (C5, C6). The adoption mapping or plan needs the amendment (the code leg keeps its own .gitattributes) before the real split.

11. Three code-only assertions are lost to the skip in a standalone code leg. Not a block; no effect today, and composed runs assert them.

• code_first() reorders only the per-surface loops.
• In each of these tests, a code-only assertion comes after the first doc() read:
  • test_the_documents_say_what_bare_park_does_now: "PARKED EVERY ESTATE unasked" in park, test_repo_hygiene.py:994
  • test_the_documents_say_what_status_is_and_is_not: "--no-optional-locks" in status, :1052
  • test_the_documents_say_what_a_bare_lanes_lists: "lanes [--all] [--fetch]" in usage, :1264
• So the body's "the command's half is asserted first" holds for the loops but not for these three. A standalone code leg (the T010 code-leg job) never runs them. Move them above the first doc(), or into their own tests, in the T010 follow-up.

12. The assembly caps of 340 and 510 depend on #192. Not a block; a landing-order note.

• I applied T006's assembly-0001 patch (from 004-migrate-to-triad-evidence-2, PR #192) to README.md and AGENTS.md at 837928a, 63810dd and dbc6837. Each gives exactly README 510 and AGENTS 340: today's 486 and 316, plus 24 each. The numbers reproduce.
• Both files would sit at their caps with zero slack, which is this repository's convention.
• The docstrings cite specs/004-migrate-to-triad/root-guidance-2026-10-08.md, which is not on main; it is on #192's branch. Land #192 with or before this PR, or the citation dangles until it does.
• The relaxation keys on ROOTS.assembly is not None, so naming any marker-bearing directory in OPENREPOTOOLS_ASSEMBLY_ROOT also gets 340/510. That is acceptable, because it is the assembly's file being measured.

13. The missing-manual branch is checked only by its text. Not a block.

• tests/test_lane_helpers.sh:3749, :6245 add [ -r "$LANE_MANUAL" ] with ok/bad. On today's layout that is two more ok lines; the wrapper only reads the exit status.
• The bad branch is never executed by any test. test_the_lane_suite_fails_a_missing_manual_by_name checks only the file's text shape, red at base (found 0).
• That is consistent with how its neighbours treat the 40-minute shell suite, but it is a shape test, not a behaviour test.

14. Documentation. A finding, not a block.

• The four variables are documented in conftest.py's docstring and in the PR body, but not in AGENTS.md "Testing your changes to this repository".
• AGENTS.md is at its 316-line cap (test_agents_md_is_short_enough_to_be_read), so a line there needs a dated cap entry.
• That section's "Without the submodule the command tests SKIP … they never fail" is now true only for standalone runs. Composed runs fail by design.
• Worth one line in the T010 or T006 documentation pass.

15. Nits. None blocks.

• (a) Roots.owner_of maps LICENSE and .gitignore to the code root, while the placement table puts them at the assembly. No test reads either, so this is latent.
• (b) tests/run.sh:82 abs_root turns a quoted ~/x into $PWD/~/x, while conftest._absolute would expanduser it.
• (c) The GIT_ENV comment (tests/test_test_roots.py:105) says "file transport allowed", but nothing sets protocol.file.allow. A local-path clone does not need it.
• (d) tests/test_test_roots.py:212 uses PEP 604 Path | None under from __future__ import annotations. That is fine on 3.9 and already done at base in test_openrepotools_command.py:163, :204-206, but conftest.py uses Optional.
• (e) Standalone, with an assembly found but the spec leg not checked out, a code root that still carries docs/ answers for spec (C3s passed by reading the code leg's manual). Real code legs carry no docs/, so this is harmless.

16. PR body accuracy.

• Reproduced:
  • the four-root table and its defaults
  • the routing rule, the 16 doc() tests and the 2 whole-tree scans (counted with ast)
  • refusal in both modes for a variable naming the wrong tree
  • composed exit 4 for a missing assembly, spec or dependency, and for a leg off its pin
  • the no-submodule skip is today's
  • "nothing new skips on today's layout"
  • Red at base (now 21 failed, not 18)
  • the 7 behavioural reasons (plus the 2 new ones)
• Stale: the counts are c139e88's ("18 failed", "188 passed", "CI 1315"). At dbc6837 they are 21, 191 and 1318. The body also does not yet describe dbc6837's 340/510 caps or the missing-manual failure.
• Not checked: the private run-C measurements (M1–M3) and the "Local proof in the triad" 285/2 numbers. They depend on rehearsal artifacts outside the repository; my C5 and C6 are the independent analogue and agree in kind.

17. Copilot. Both round-1 threads (conftest.py status-None; the fixture .gitattributes) are fixed in e3a76b5, but GitHub still shows them unresolved. Round 2 has not run.

Conditions left to the landing owner

1. Linux CI green on the head that lands. It is green on dbc6837 (merge 5ad6205): tests 1318 passed, tests-no-submodule 1105 passed and 213 skipped. If the head moves, re-check.
2. The macOS gate: the ready label, then a green tests-macos on the landing head.
3. Copilot: resolve the two round-1 threads and take or waive round 2, per the two-round rule.
4. Refresh the PR body's counts and add dbc6837's two items (finding 16).
5. Landing order: #192 with or before this PR, so the cap docstrings' citation exists on main (finding 12).
6. Not conditions for this PR, but owed before Gate B: amend the .gitattributes placement in the plan (10), the three standalone-leg assertions (11), and the AGENTS.md variables (14).

[Copilot]

🟡 Changes recommended

Composed validation can accept mismatched leg-pin manifests, and marker directories can incorrectly pass root validation.

1 open finding

• Validate manifest commit against assembly gitlink and checkout HEAD · New

2 resolved since last review

• Preserve .gitattributes in copied code-leg fixtures
• Reject acceptance when git status cannot be read

Previously missed (1)

In code that hasn't changed since last review

Require root markers to be regular files

tests/​conftest.py:146

The root markers are required files, but exists() also accepts directories. An explicit code or assembly root containing directories named openRepoTools, project.yaml, or a pin path therefore passes the promised “wrong kind of tree” refusal and fails later in unrelated tests. Require each marker to be a regular file.

🧠 Review effort: Balanced

[brettheap]

Lane openRepoTools-1 (writer), 2026-10-09 ~02:3xZ.

Lane 3's finding (1) is confirmed. It is a defect in this PR's own code. The fix is ready on its own branch. I have not pushed it here, because the coordinator asked for no code pushes while the macOS gate runs on dbc6837.

The defect

• At dbc6837, tests/test_lane_helpers.sh:6601-6602 use $ln_doc outside the if [ -n "$LANE_MANUAL" ] guard that binds it.
• With no spec root, LANE_MANUAL is empty. The suite runs under set -u, so it aborts with ln_doc: unbound variable instead of skipping.
• The body's claim that an empty value skips those reads, by name, was therefore false for these two lines.
• My own standalone-leg proof P3 had logged the same abort (line 6595 at c139e88). I had attributed that run's lane-suite failure only to the two stamp-tail assertions. The body and the evidence branch are now corrected.

Today's layout is not affected. The spec root is always present, so the guard is always taken, and CI's 1318 stands.

The fix: feat/test-roots-manual-guard @ b50f197. It is one commit on dbc6837, so it fast-forwards onto this branch. It does two things:

• It wraps the two lines in the same guard and named skip the other two manual sections use.
• It adds test_the_lane_suite_reads_the_manual_only_inside_its_guard, a text test like its neighbour. The test requires every use of $ss_doc/$ln_doc (16) to sit inside a $LANE_MANUAL guard. Against dbc6837's file, its check names lines 6601 and 6602. The scoped red and green runs through tests/run.sh are queued for the workstation lock.

Behaviour, with the --retire section run alone under the suite's set -u, an empty manual and stub helpers (log sha256 c593520e…):

• At dbc6837: 4 ok, then ln_doc: unbound variable, exit 1.
• At b50f197: 4 passed, 0 failed, 1 skipped, exit 0.

Whether this goes into #190 before the squash (which re-runs the gate) or lands as the first follow-up is the coordinator's call.

[sonarqubecloud]

Quality Gate passed

Issues
22 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Independent adversarial review — lane openRepoTools-1 (read-only; 2026-10-09T13:59:58Z): the dbc6837..b50f197 delta

Verdict: LAND on head b50f1974f3aa4b78b1bcdc5d770e63795d42e4ac, a one-commit fast-forward of dbc6837. This covers the delta only. The LAND at dbc6837 (pullrequestreview-5464938427) stands for the rest. This commit fixes exactly lane openRepoTools-3's finding 10 (pullrequestreview-5464931249).

Everything ran from a fresh scratch clone under .openrepotools-private-prep/work-20261009/review-190-delta/, never from the author's tree. Each pytest or suite run took its own flock on ${TMPDIR:-/tmp}/openrepotools-pytest.lock and ran inside unshare -c -n (uid 1000, no network). The extract scripts of finding 2 run nothing but cat, so they ran without the lock.

Findings

1. Scope. git diff --stat dbc6837 b50f197 is tests/test_lane_helpers.sh +8 and tests/test_test_roots.py +29, and nothing else. git merge-base --is-ancestor dbc6837 b50f197 holds.

   • The shell change is a 4-line comment plus if [ -n "$LANE_MANUAL" ]; then / else / skip "…(two assertions)" "…" / fi around the two existing assertions, now at tests/test_lane_helpers.sh:6605-6610.
   • The Python change is one new text test, test_the_lane_suite_reads_the_manual_only_inside_its_guard (tests/test_test_roots.py:382-408).

2. The guard is complete (check 1). The manual's text reaches the suite through $LANE_MANUAL only (:58), read in exactly two places.

   • ss_doc is assigned at :3751 inside :3746-3761, and ln_doc at :6247 inside :6244-6264. The neighbour test pins exactly two cat "$LANE_MANUAL" reads.
   • Every non-comment use is inside a column-0 if [ -n "$LANE_MANUAL" ] guard, 16 in all: ss_doc at :3752-3758, ln_doc at :6248-6260, and the two moved lines at :6606-6607.
   • No ${ss_doc} or ${ln_doc} spelling exists anywhere.
   • No other root-owned path is read. Every $SRC_DIR/… the suite touches is code-leg payload: the executables, repos.tsv, skills/{handoff,lane-swap,restart}/SKILL.md and commands/{handoff,ctx,swap}.md. docs/README-lanes.md appears only as :58's default. Nothing reads README.md, AGENTS.md, CLAUDE.md, openspec/, specs/ or upstream/.
   • Behaviourally: I started the full shell suite at b50f197 with OPENREPOTOOLS_LANE_MANUAL set and empty, which is what tests/test_lane_helpers_suite.py:180-182 passes when a run has no spec root. It cannot finish here. The workstation's load average was 160-169, and a run started at 13:32:49Z had printed 64 lines by 13:46Z. I stopped it (rc 143; its own TERM trap cleaned its sandbox) rather than hold the shared lock for hours.
     • In its place I ran an extract of the suite itself: its set -uo pipefail (:42), its LANE_MANUAL= line (:58), ok/bad/skip/excerpt/has/hasnt copied verbatim, and every manual-reading line in file order, each guard block whole.
     • Under bash 5.2.21 and 3.2.57, with OPENREPOTOOLS_LANE_MANUAL empty:
       • dbc6837 skips the first two blocks, then aborts with ln_doc: unbound variable (rc 1). That is lane 3's finding 10 reproduced.
       • b50f197 reaches its end with 0 passed, 0 failed, 3 skipped (rc 0). The three skips name their counts: seven, seven and two, which is all 16 uses.
   • Lane 3's other three code-leg failures (the row-stamp assertions at main's :1055, :5335, :7527) read the sandbox register $LANES, not a root. They are not spec-root reads and are outside this delta. I did not re-measure them.

3. Today's single-repository layout is unchanged (check 2). On today's layout LANE_MANUAL is never empty:

   • by default it is $SRC_DIR/docs/README-lanes.md (:58);
   • under the pytest runner it is the spec root's copy, and today the spec root is the code root (test_lane_helpers_suite.py:180-182).

   So the guard's then branch always runs. The same two assertions run with the same text in the same order, and the else is unreachable. The guard adds no ok/bad/skip line on that branch, so the suite's footer count is unchanged. Measured on the same extract with OPENREPOTOOLS_LANE_MANUAL unset: 18 passed, 0 failed, 0 skipped at both dbc6837 and b50f197, and the two outputs are byte-identical (cmp). I did not run the 40-minute suite on today's layout locally; CI does, on this head.

4. bash 3.2 (check 3). The 37 added lines contain no ${x,,}/${x^^}, no mapfile/readarray, no declare -A/-n, no local -n and no read -a. They contain no awk at all, so no awk -v value can carry a newline. bash -n tests/test_lane_helpers.sh passes under bash 5.2.21 and under a locally built 3.2.57. CI's parse-macos and tests-macos (Apple's /bin/bash 3.2.57) remain the record.

5. Python 3.9, standard library only (check 4). The new test adds no import: it uses REPO and pathlib (already imported), list comprehensions and str methods. The module parses under the 3.9 grammar (ast.parse(..., feature_version=(3, 9))). Called directly under CPython 3.9.23, the new test passes at b50f197.

6. Red at dbc6837 (check 5). I ran b50f197's tests/test_test_roots.py against dbc6837's shell suite (-k 'test_the_lane_suite_reads_the_manual_only_inside_its_guard or test_the_lane_suite_fails_a_missing_manual_by_name'). Result: 1 failed, 1 passed. The failure names exactly the defect:

   • 6601: hasnt "the manual no longer promises an Amendment 6(d) record" "$ln_doc" …
   • 6602: has "…and says in terms that it writes nothing" "$ln_doc" "**It writes nothing**"

   At b50f197 the same selection gives 2 passed.

7. A residual limit, not a block. The text test recognises only the "$ln_doc"/"$ss_doc" spellings and column-0 if/else/fi lines. A ${ln_doc} use, or a guard closed by an indented fi, would escape it. A third manual-reading variable cannot appear unnoticed, because the neighbour test's exactly-two count fails first. The only stronger guard is behavioural: run the 40-minute suite with an empty manual in CI, which is T010's to decide. Holding it on the text, like its neighbour, is proportionate.

8. CI on b50f197: run 37940820017 (pull_request) started at the fast-forward. At 2026-10-09T13:59:58Z, parse-macos and guard-launch-mode had passed; tests, tests-no-submodule, tests-windows and tests-macos were pending (the PR carries ready). That run is the record for this head.

Conditions for the landing owner (lane 1)

• Linux CI green on b50f197.
• tests-macos through the ready label.
• Copilot: rounds on c139e88 and dbc6837 are taken. Under AGENTS.md's two-round cap, a later finding is filed as an issue, not a push.

Not checked here: the shell suite on today's layout (CI's), and macOS.