[brettheap]

Part of #186

T007/T008 of specs/004-migrate-to-triad/tasks.md: the code side of the installer's payload-source resolution, and the 15-row compatibility matrix of specs/004-migrate-to-triad/installer-design.md as tests. The assembly root entry point cannot exist on main before the split, because its path is this file's. It is developed in a clone of the rehearsed assembly and recorded as a patch on 004-migrate-to-triad-installer. The composed tests here run it there.

The rule this PR is held to (lane 3's): on today's single-repository layout, every behaviour stays what it was: the one-liners, the WIP template fetch, refusals and exit codes. The one exception is one extra request, described below, which prints nothing.

What changes

After the triad split, the default opensoft/openRepoTools is an assembly whose root carries no payload. Every fetching install, every reinstall from an installed copy, and every installed wip init would then read the wrong tree. Measured at base, they would also install whatever the assembly root happened to carry: rows 8 and 9 below exit 0 at base having installed the assembly root's decoy files.

openRepoTools now settles where the payload comes from once, before anything is collected or placed. payload_select is called right after plan_install_targets.

Where it runs from	What it does
A directory holding every payload file (a checkout, workBenches' vendored tree)	Copies them with no network and no new output, exactly as before. This includes workBenches' sentinel OPENREPOTOOLS_REPO/REF run, and a tree vendored deep inside another project that has its own contracts/code-pin.yaml.
A directory holding only some (an installed copy in ~/.local/bin)	Asks which layout the remote source has. For a single repository, it keeps today's sibling rule, at the ref as given. For an adopted assembly, it fetches everything from the pinned code and says the local files were not used: old siblings are never topped up with pinned skills.
stdin (the one-liners)	Asks which layout the remote source has. A single repository is fetched exactly as before. An adopted assembly is resolved to one commit, and everything comes from the code it pins.
<root>/<submodule_path>: the code leg mounted in an assembly checkout	The pin, the gitlink and every payload file's raw bytes (hash-object --no-filters) must name one commit; the gitlink is read from the index first, then HEAD, as openRepoShape's recorded_gitlink reads it. Each file is copied into the run's work directory first, and the copy is what is hashed and what is installed, so an edit to the checkout in between cannot be installed unchecked. It copies offline. If they do not agree, it refuses before staging.
<root>/worktrees/<NNN>/<submodule_path>: a paired code feature worktree	Installs that checkout's own bytes, and names the checkout, its HEAD and any uncommitted change, saying it is NOT the pinned code. If the checkout is incomplete, it refuses.

Those two are the only places an assembly is recognised. <root> is accepted only when its contracts/code-pin.yaml mounts this directory as the code leg: the pin's submodule_path, read with the same scalar grammar pin_parse uses (quotes, a trailing # comment), must be this directory's name. A pin anywhere else above the file is another project's and is not read.

Design

• A single repository keeps today's network needs and words.
  • It is read at OPENREPOTOOLS_REF as given, file by file: gh api …/contents first, then the raw URL.
  • It never needs api.github.com, and it needs no jq to fetch. The old fallback and the old refusal words are kept.
  • The one extra request is contracts/code-pin.yaml at $REF, asked through those same two transports. GitHub answers it 404 and it prints nothing.
  • That request is invisible, but not strictly harmless. If both transports fail to answer it with anything but a 404 (offline, 5xx, 401/403, a portal), the run refuses, naming what answered. Base would have gone on to fetch payload files, and in the offline case it refused too, naming them.
  • Heads e406e0e to 2411f40 resolved the ref and listed trees through the API in both layouts. The review's F1 measured what that cost, so 13cc752 and fdc5f18 put the single layout back on today's reads.
• The layout is decided by an answer, never by a failure.
  • A pin that is there means the adopted layout.
  • GitHub's 404 for it means a single repository: gh names the status, and the raw URL's status is read with -w '%{http_code}'.
  • Any other answer, on both transports, is a refusal that quotes what answered.
  • Nothing more is asked on that 404. Asking for project.yaml (as 13cc752 did) would be a second request on today's layout, for a state an adopter never publishes, because the pin and the manifest land in one commit and make validate refuses one without the other. An assembly root without its pin carries no payload, so it refuses in exactly the words a single repository missing those files always got.
• Only an adopted assembly resolves the ref once.
  • commits/<ref> (sha media type) turns OPENREPOTOOLS_REF into a commit.
  • Everything is then read again at that commit: the root and contracts/ listings (git/trees, through gh --jq or curl + jq), the pin and the gitlink.
  • If the ref moved between the probe and the resolution, the commit it resolves to is read whole: another adopted commit is installed entirely from the code it pins, never as a mix. A commit that no longer carries a pin is refused as a ref that moved. The probe decides only the layout, and its bytes are never installed.
  • Every payload request names the pinned commit, so a moving branch cannot mix two versions.
  • All of this needs api.github.com, and jq on the curl path. That is the new layout's need, not today's.
  • A pin that the listing shows but that will not come back is refused, quoting what each transport answered.
• The pin's fixed grammar is read with read and case; there is no YAML runtime.
  • Required: schema_version: 1, kind: pinned_contract_manifest, leg_role: code, an owner/name source_repository, a single-segment submodule_path, and a 40-hex lowercase commit.
  • Also required: revision_kind: commit, digest_algorithm: sha256, digest_definition: sorted-ls-tree-r-v1, a 64-hex digests.tree_sha256, verify_pin and resync_runbook.
  • Each key it reads must appear once, the file must be LF-only, and quotes must close. A pin that is present and wrong refuses.
• The payload repository is the pin's own source_repository.
  • A fork follows the pin it carries. No repository name is guessed by appending -code.
  • Remotely, the gitlink at submodule_path must equal commit, and that commit must be one the pinned repository answers for.
  • The pin's tree_sha256 covers the whole tree and is the composed validator's to recompute. This PR does not claim it.
• wip init reads the code's contracts/openreposhape-pin.yaml when no pin sits beside it.
  • For a single repository, that is $REF's pin, read as before.
  • For an adopted assembly, it is the pinned code's pin, never the assembly's own contracts/.
  • A source that does not answer, a ref it lacks, or a pin it does not carry leaves openRepoShape's main, as before (the review's F2).
  • An adopted assembly whose code cannot be followed refuses at step 7, in step 7's own words: step 7 seeded nothing, and what steps 5 and 6 made is kept. It does not say that nothing was written.
• Counts are derived from the lists. On this layout: 17 INSTALLABLES + 3 skills + 3 command files = 23 payload files, and 29 placed files + 2 hook entries = 31 artifacts. The design doc's "15 / 27 / 29" are daed209's. The three arrays stay one line each, because workBenches' estate-commands-start reads them with sed.

Unchanged for today's single repository

• Installs from a complete tree: ./openRepoTools --install from a checkout or from any complete tree places the same files, modes and targets, writes the same receipt rows, makes the same settings merge and retirement, and prints the same output, line for line. test_r01_…installs_as_before compares a fetching install's stdout with a local one's. test_r02_…byte_for_byte runs the sentinel REPO/REF and makes no request.
• --help and --version: --version still prints the requested REPO @ REF.
• The network: OPENREPOTOOLS_REF as given, gh api …/contents and then the raw URL, no api.github.com and no jq for fetching. Covered by test_r01_a_single_repository_by_curl_never_needs_api_github_com[transport, rate-403], test_r01_a_single_repository_by_gh_asks_for_files_and_nothing_else and test_r06_a_single_repository_reads_every_ref_form_as_it_always_did[4 forms].
• No jq: every file is fetched first, then the run refuses naming jq, in the old words (test_r01_a_single_repository_without_jq_fetches_then_names_jq_as_it_always_did).
• Refusals:
  • All-or-none, and in the words c4864ac printed, compared byte for byte by test_r11_a_single_repository_missing_a_file_refuses_in_the_words_it_always_did[park, skills/restart/SKILL.md] and test_r11_a_single_repository_at_a_ref_it_lacks_refuses_in_the_words_it_always_did[gh, curl].
  • The one new refusal on this layout is when the layout question gets no answer at all (above).
• An installed wip init: the pin at $REF; main when the source does not answer or lacks the ref; and no commits/ request. Covered by test_r13_an_installed_wip_init_on_a_single_repository_reads_its_pin_as_before, …whose_source_does_not_answer_seeds_from_main_as_before, …at_a_ref_the_source_lacks_seeds_from_main_as_before and …never_needs_a_single_repositorys_commit_lookup.
• The meanings of OPENREPOTOOLS_REPO and OPENREPOTOOLS_REF, and the sibling rule for an incomplete local set.
• tests/test_openrepotools_command.py: its fake gh now answers the one layout question as a real GitHub answers it for a single repository (gh: Not Found (HTTP 404) for contracts/code-pin.yaml). No assertion changed.

Compatibility matrix (tests in tests/test_install_payload_source.py)

The fixtures build their own GitHub out of bare repositories in a temp dir.

• One fake answers gh api, gh repo and curl from them with git: commits/<ref> is rev-parse, git/trees is ls-tree, and contents and raw are cat-file.
• It logs every request.
• No real gh or curl is on PATH, and every $HOME is temporary.

#	Row	Tests	At base c4864ac
1	Existing raw/gh one-liners	single: …installs_as_before, …by_curl_never_needs_api_github_com[transport, rate-403], …by_gh_asks_for_files_and_nothing_else, …without_jq_fetches_then_names_jq_as_it_always_did; adopted: test_r01_the_one_liner_against_an_adopted_assembly_installs_the_pinned_code[gh, curl]; composed: …documented_one_liners_resolve_through_the_root_entry_point[openRepoShape, gh] (openRepoShape:280's line byte for byte), …root_entry_point_delegates_locally, …a_signal_reaches_the_implementation_and_its_temporaries_go	single pass; adopted red
2	Offline local single / adopted checkout	test_r02_a_complete_single_repository_tree_installs_offline_byte_for_byte; test_r02_a_complete_tree_inside_another_projects_assembly_installs_as_before[valid, crlf]; test_r02_an_adopted_checkout_installs_its_pinned_code_offline; test_r02_an_adopted_checkout_whose_pin_comments_its_path_is_still_its_assembly	single pass; adopted red
3	Explicit local code feature	test_r03_an_explicit_code_feature_checkout_installs_its_own_bytes_and_names_them; test_r03_an_incomplete_code_feature_checkout_is_refused_not_completed_from_elsewhere	red
4	Installed reinstall / skill-only	test_r04_an_installed_copy_reinstalls_from_the_adopted_source_without_any_checkout; test_r04_an_installed_copy_on_a_single_repository_keeps_the_sibling_rule	adopted red; single passes
5	Override / adopted fork	test_r05_a_single_repository_fork_named_by_the_override_installs_as_before; test_r05_an_adopted_fork_follows_its_own_pin_not_a_guessed_code_name	single passes; adopted red
6	Branch, tag, commit, slash refs	adopted: test_r06_every_ref_form_is_resolved_once_and_every_payload_names_one_commit[branch, tag, commit, slash]; single: test_r06_a_single_repository_reads_every_ref_form_as_it_always_did[same four]	adopted red; single pass
7	Branch moves between downloads	test_r07_a_branch_that_moves_between_downloads_never_mixes_versions (adopted); test_r07_a_branch_that_moves_right_after_the_layout_question_is_read_at_one_commit[adopted, single]. A single repository is read at its ref, file by file, as before; freezing it would need api.github.com.	red
8	Missing pin in a single repository / partial or wrong adopted pin	test_r08_a_single_repository_without_a_code_pin_is_permitted; test_r08_an_assembly_root_without_its_code_pin_refuses_as_a_single_repository_would; test_r08_a_malformed_code_pin_is_refused_never_read_as_a_single_repository[19 malformations]; test_r08_a_pin_the_gitlink_disagrees_with_is_refused; test_r08_a_pin_naming_a_commit_its_repository_lacks_is_refused; composed: test_r08_composed_the_root_entry_point_refuses_a_pin_its_gitlink_disagrees_with[gh, curl]	single pass; adopted red (base exits 0 installing decoys)
9	Missing/malformed API answer, auth, transport	test_r09_an_api_failure_is_a_refusal_never_a_fallback_to_a_single_repository[5 steps × 401, 403, 404, transport, garbage], without (pin, 404), which is GitHub's answer that there is no pin (row 8); test_r09_a_pin_the_listing_shows_but_that_will_not_come_back_is_refused_saying_what_answered	red (base exits 0 installing decoys)
10	Changed local gitlink / payload, incomplete local set	test_r10_a_local_gitlink_that_disagrees_with_the_pin_is_refused_before_staging; test_r10_a_changed_local_payload_is_refused_before_staging; test_r10_an_incomplete_local_adopted_payload_is_refused_without_a_fetch	red
11	Missing command/skill/alias, failed settings merge	adopted: test_r11_a_payload_file_missing_from_the_pinned_code_changes_nothing[park, skills/restart/SKILL.md, commands/swap.md], test_r11_a_settings_merge_that_cannot_be_computed_changes_nothing; single: …missing_a_file_refuses_in_the_words_it_always_did[2], …at_a_ref_it_lacks_refuses_in_the_words_it_always_did[gh, curl]	adopted red; single pass
12	Modes, receipts, custom targets, foreign files, hooks	test_r12_an_adopted_install_keeps_modes_receipts_targets_and_what_is_not_ours	red
13	WIP init / template lookup	adopted: test_r13_wip_init_takes_the_standard_from_codes_dependency_pin_not_the_assemblys, …adopted_source_wip_init_cannot_follow_refuses_in_step_7s_words; single: the four test_r13_an_installed_wip_init_… tests above	adopted red (base seeded from the assembly's decoy pin commit); single pass
14	Missing nested dependency in standalone code	test_r14_with_no_nested_standard_anywhere_the_dependency_pin_alone_selects; test_r14_the_documented_upstream_skip_is_unchanged; composed: test_r14_composed_acceptance_requires_the_nested_dependency	red (base seeded from main); skip test passes
15	bash 3.2 / Windows-WSL	test_r15_the_adopted_path_holds_under_macos_one_true_awk; test_r15_the_installer_uses_nothing_bash_3_2_lacks; test_r15_the_three_lists_stay_one_line_arrays_a_consumer_parses; composed: test_r15_composed_the_root_entry_points_pin_reader_is_the_implementations, test_r15_composed_the_root_entry_point_parses_and_uses_nothing_bash_3_2_lacks	awk-shim red; static checks pass

• Platforms: the module is WINDOWS_SKIP like every bash-driven test here. CI's parse-macos covers the 3.2 parse of the changed openRepoTools, and tests-macos (on the ready label) is the 3.2 runtime run.
• Composed tests skip in standalone code. Under OPENREPOTOOLS_COMPOSED=1 (Give the test suite explicit code, assembly, spec and dependency roots, so it runs on today's single repository and in the adopted triad, and refuses composed acceptance without all of them #190's convention) they fail instead of skipping.

Evidence

• Red at base (first round): the tests were committed first (6337a52, installer still c4864ac): 75 failed, 8 passed, 6 skipped. The 8 were the single-repository preservation tests, the two static checks and the documented-skip check.
• The review rounds' tests:
  • Each new and changed test was run against c4864ac, 2411f40, 13cc752 and fdc5f18. That is 20 tests.
  • The run is a scoped proof without the workstation lock, by the coordinator's rule: HOME, TMPDIR, --basetemp and PYTHONPYCACHEPREFIX all in scratch.
  • Results: c4864ac 19 pass, 1 fail (the adopted step-7 words, new behaviour); 2411f40 20 fail; 13cc752 16 pass, 4 fail (the project.yaml request, the parent walk ×2, the partial refusal); fdc5f18 20 pass.
  • The composed root gitlink test (×2) is red with the v2 root and green with v3 (strict composed, scoped, no lock).
• Local green on 6568f08, a head before the final one, merged with main f87fd5a, run under the lock:
  • Run with -k 'payload_source or openrepotools_command or wip_init or install_skill_and_hook or install_by_rename or repo_hygiene or upstream_pin or test_roots', under the lock: 516 passed, 9 skipped, 5 failed.
  • The 5 are test_wip_init_and_the_lane_helpers_read_one_pointer_file_the_same_way cases in which lanes-edit.sh who exits 8 on this workstation's lane state. lanes-edit.sh and that test are outside this PR's diff, which against main is openRepoTools and two test files. CI runs them green.
• CI on the final head 8246983 (run 38097860219, refs/pull/191/merge; also posted on Triad migration (feature 004-migrate-to-triad): execution tracking under Brett Heap's word of 2026-10-07 #186):
  • tests: 1419 passed, 9 skipped.
  • tests-no-submodule: 1199 passed, 229 skipped.
  • tests-windows: 177 passed.
  • guard-launch-mode: 165 passed.
  • parse-macos, SonarCloud and Sourcery: pass.
  • tests-macos runs on the ready label, in run 38155833862.
  • Since 6568f08, the changes are the two round-1 fixes (cddd1f7) and one test-only commit (8246983).
• CI on the earlier head 6568f08 (run 37997688693, refs/pull/191/merge):
  • tests: 1416 passed, 9 skipped.
  • tests-no-submodule: 1196 passed, 229 skipped.
  • tests-windows: 177 passed.
  • guard-launch-mode: 165 passed.
  • parse-macos, SonarCloud and Sourcery: pass.
  • tests-macos waits on the ready label.
• Copilot, two rounds (the cap):
  • Round 1 on 6568f08, three findings, fixed in cddd1f7:
    • a copy-time race on the mounted-leg path, fixed by installing the checked snapshot;
    • a commented submodule_path missed by pin_mounts; its new test fails at 6568f08 and passes at cddd1f7;
    • the index-then-HEAD gitlink fallback, kept: it is openRepoShape's own recorded_gitlink contract.
  • Round 2 on cddd1f7, one finding: the body overclaimed a refusal for a ref that moved. The body is corrected, and 8246983 adds a test of the behaviour.
• Composed, strict (OPENREPOTOOLS_COMPOSED=1):
  • Run in a clone of the rehearsed assembly (run C), with root entry point v3 and this head's whole code leg mounted at the pin (assembly 4c6a0b7, code fa460f2), under the lock.
  • Selection: -k 'payload_source or repo_hygiene or openrepotools_command or install_skill_and_hook or install_by_rename'. Result: 429 passed, 1 failed.
  • The failure is test_the_root_carries_the_line_ending_rule, which reads .gitattributes from the code leg. Run C's legs carry none: T006's front-door finding, whose leg patches are on main from Triad migration evidence of 2026-10-08: run C of the adopter rehearsal at the post-landing main, and T006's root collisions and leg guidance patches #192. Nothing in this PR reads it.
  • All of this module's composed tests pass, including the root gitlink test. Details are on 004-migrate-to-triad-installer.
• Locking: full selections ran under tests/run.sh's own lock, one flock per run, with PATH=/usr/bin:$PATH, because this profile's ~/bin/python3 is a venv without pytest. Scoped proofs of about two minutes ran without the lock, as stated above. CI remains the suite of record.

Not in this PR

• The assembly root openRepoTools. It is a patch on 004-migrate-to-triad-installer, and v3 checks the gitlink before it runs any implementation.
• T010's CI contexts and the hygiene test's restatement (Install from the code an adopted assembly pins, resolved to one commit, and keep a single repository's install on today's reads, words and network needs. #191 review, delta 5, which is T009's).
• Any workBenches change. Consumer-reads W1/W3/W8 wait for real legs.
• README prose for the adopted layout, including its network needs (api.github.com and jq on the curl path), which is T014's.

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 21 hours and 40 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR adds installer-side payload provenance resolution for the triad migration: refs are resolved once, adopted assemblies use validated pinned code, local layouts are checked for coherence, and legacy installs remain byte-for-byte compatible. A 15-row test matrix and updated GitHub fakes exercise source selection, refusal safety, provenance, portability, and downstream integration behavior.

File-Level Changes

Change	Details	Files
Implement payload-source selection and immutable ref resolution for legacy repositories, adopted assemblies, installed copies, stdin installs, and local code checkouts.	Resolve the requested ref once to a commit and use that commit for discovery and every payload download. Detect legacy versus adopted layouts from successful remote listings, refusing partial, malformed, or unavailable metadata instead of falling back. Parse and validate the fixed code-pin manifest, including repository, gitlink, commit, digest metadata, and required fields. Select pinned code for adopted assemblies and installed copies, preserve the legacy sibling behavior for complete or incomplete single-repository trees, and support explicit feature checkouts with local coherence checks. Resolve wip-init templates through the selected code leg's dependency pin. Preserve staging atomicity, output, modes, receipts, targets, hooks, settings merging, and byte-for-byte legacy behavior. Keep payload arrays compatible with downstream sed-based consumers and remain parseable under bash 3.2/macOS awk constraints.	openRepoTools
Add a comprehensive compatibility matrix backed by isolated fake GitHub repositories and request logging.	Cover remote and offline installs across single, adopted, installed, forked, pinned, feature-checkout, and wip-init scenarios. Verify ref resolution, branch movement consistency, API and transport refusal behavior, malformed pin handling, local integrity checks, missing payloads, and all-or-none installation guarantees. Assert modes, receipts, custom destinations, foreign files, hooks, settings merges, and byte-level payload provenance. Add bash portability, one-line array, composed-entry-point, signal cleanup, and nested dependency coverage. Model GitHub gh/curl responses from bare repositories without real network access.	tests/test_install_payload_source.py
Update existing fetch test doubles to model the installer's initial commit and tree-discovery requests.	Return a fixed commit for ref resolution and a root listing representing a legacy single repository. Leave existing assertions and served payload behavior unchanged.	tests/test_openrepotools_command.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

Independent adversarial review — lane openRepoTools-3 (read-only; 2026-10-09T02:15:51Z)

Verdict: DO NOT LAND. The single-repository fetching path changes behaviour on today's layout, which makes it a Gate C item under the review rule. openRepoTools:839/:853 → payload_resolve_remote :635/:643/:650 now make three api.github.com round trips before any payload. On a machine with no gh where api.github.com answers 403, the curl one-liner installs at main and refuses at this head.

Reviewed head: 2411f4099b0c843b57eb2288d55fb7f2a87be39e. The head moved twice while this review ran: e406e0e → ecd7aa4 (00:46Z) → 2411f40 (01:02Z), and both new commits touch openRepoTools only. Main is now 63810dd (#189, specs/ only; its openRepoTools blob 9b7cbd2 is 837928a's). CI runs the merge ref 426fbcd (main + this head, openRepoShape 7f84ca4). Every check was run from a fresh scratch clone, never from lane 1's trees. Some measurements were taken on e406e0e and repeated on 2411f40; each finding says which.

The offline install from a checkout is byte for byte (finding 2). The hygiene failure of e406e0e is cured on this head (finding 1). The block is finding 3.

Findings, numbered.

1. CI, and the hygiene test cure.

   • CI on 2411f40: guard-launch-mode success (-k 'guard_launch_mode or repo_hygiene'), tests-windows success, parse-macos success, SonarCloud success. tests-macos was skipped (no ready label). The Linux record is complete. tests: success, 1379 passed, 7 skipped (main: 1296 passed). tests-no-submodule: success, 1165 passed, 221 skipped (main: 1084 passed, 212 skipped). The counts reconcile: the 1296 existing tests keep their outcomes, and the 90 new ones are 83 pass + 7 composed skips (81 pass + 9 skips without the submodule).
   • On e406e0e the same test was red on all four test jobs. tests/test_repo_hygiene.py::test_the_installer_reaches_only_this_repository (:810-813) failed there: tests 1 failed / 1378 passed / 7 skipped, tests-no-submodule 1 failed / 1164 passed / 221 skipped, plus guard-launch-mode and tests-windows. Locally that head gave 152 passed at main against 1 failed / 151 passed at its merge.
   • What cured it. ecd7aa4 spells every fetching line ${PAYLOAD_REPO:-$REPO} (:267, :273, :539, :552, :580, :593). That string contains the substring $REPO, which is all the check looks for.
   • On today's layout the cure is honest. PAYLOAD_REPO is assigned in exactly two places: $REPO (:634), and $PIN_SOURCE_REPOSITORY (:690), which happens only after the pin has passed pin_parse and the gitlink check. A single repository never reaches :690, so every fetch is $REPO's in substance.
   • For the adopted path the cure is by spelling. There the payload comes from another repository while each line still "names $REPO". The guard can no longer tell ${ANY:-$REPO} from $REPO. The test's own text ("from $OPENREPOTOOLS_REPO and from nowhere else", "Every other fetch in this file is still $REPO's") no longer describes what the code does.
   • Not a block on today's layout: the outcome is kept and the behaviour behind it is honest. T009 should restate the rule: allow exactly $REPO and the validated pin's source_repository, and pin PAYLOAD_REPO's two assignment sites.
   • Blind spot. The guard's fetching_lines still does not scan the two curl … https://api.github.com/… lines (:552, :593).

2. Byte-for-byte on today's layout: identical, offline (re-measured on 2411f40).

   • Setup: fresh HOMEs, env -i, PATH=<shims>:/usr/bin:/bin with a logging gh and curl that both exit 1 (no real gh on that PATH), umask 022. ./openRepoTools --install at main 63810dd, at 2411f40 and at the merge 426fbcd.
   • Exit and output: all three exit 0 with 37 lines of stdout, identical after the HOME path is normalized, and 0 requests to either shim.
   • Placed tree: 48 entries with identical types and modes. 31 files, of which 29 are byte-identical: the 16 other INSTALLABLES, 6 skill files, 6 command files, and settings.json, which is identical, mode 600, with the same two hook entries.
   • The two that differ, by construction:
     • ~/.local/bin/openRepoTools is each tree's own source: blob 9b7cbd2 at main, 04769c4 here, mode 755 both.
     • installed.tsv (29 rows, mode 600) differs in that one row's sha256 (118cc2cc…, the head's source) and in the stamps. Every other <name> <path> <sha256> row is identical.
   • Also checked on e406e0e: a reinstall over a main install gives identical trees and output except updated for the changed file. A one-liner through a fake curl serving today's tree, with the API answering, places the same bytes on both heads.
   • Left to the suite: retirement and the merge into an existing settings file (test_install_skill_and_hook, test_install_by_rename).

3. Behaviour change on today's layout, fetching path (Gate C item; re-measured on 2411f40).

   • Which runs: payload_select sends stdin runs (:853) and every incomplete local set (:839) through payload_resolve_remote. Every installed-copy reinstall is an incomplete local set.
   • What it asks: on today's repository, commits/main (sha media type, :635), then git/trees/<commit> (:643), then git/trees/<contracts> (:650, because today's root carries contracts/), all before any payload. The curl fallback therefore now needs api.github.com, and jq for the listing (:591). At main it needed only raw.githubusercontent.com.
   • Measured with a fake curl, no gh, and the merge ref served as main:
     • API answering: main makes 24 raw requests and 0 API requests; this head makes 24 raw and 3 API.
     • API answering 403 (the unauthenticated limit is 60 requests an hour per IP): main exits 0 with all 29 placed; this head exits 2 with REFUSED: could not resolve opensoft/openRepoTools at main to a commit.
     • Offline, the installed copy now asks api.github.com/…/commits/main instead of the raw skill URL.
   • The body undersells it. It calls ?ref=<sha> "the one deliberate behaviour change". There are also new round trips, a new endpoint dependency, and new refusals: is_slug "$REPO" (:631) refuses overrides main accepted, for example an EMU owner with _. wip init from an installed copy now refuses an unresolvable source (:3108) where base fell back to main.
   • Design and lane 3: installer-design.md:30-31 keeps the established path for a legacy monorepo. Lane 3's §4.10 says a pre-cutover code-pin probe "would add a network request to every remote install today … That is T007 proper".
   • Before landing on today's layout: gate the probe to adopted sources only, or hold this until Gate C.

4. The parent-directory walk changes a complete tree's install under any assembly (assembly_above :714-725, consulted at :825 BEFORE the completeness check; re-measured on 2411f40).

   • What it does: it walks every ancestor directory and never checks that a pin it finds belongs to this checkout.
   • Measured: I placed today's payload (git archive 2411f40) at <dir>/vendor/ort, under a <dir>/contracts/code-pin.yaml that pins opensoft/someProduct-code.
     • LF pin: this head installs and adds a 38th line, source: the code checkout …/vendor/ort … NOT the code <dir> pins …. Main installs silently with 37 lines.
     • The same pin in CRLF: this head exits 2 (line 1 ends in a carriage return), and main installs.
   • Reach: nothing in today's estate triggers it; no ancestor of any checkout or of ~/.local/bin carries contracts/, checked. But it is the vendored-tree case (consumer row W5) once a consumer adopts, and it breaks the body's claim "a directory holding every payload file … no new output, exactly as before".
   • Fix: bound the walk to the mount parent and <root>/worktrees/*/code, or match the pin's submodule_path and source_repository to this checkout, and check completeness first.

5. The resolution core holds.

   • Parser: pin_parse (:438-514) gives the same result under real bash 3.2.57 (docker bash:3.2) as under 5.2 on 26 cases. The standard's own templates/assembly-root/contracts/code-pin.yaml at 7f84ca4, materialized, parses OK.
   • Refused, as it should be: a commit only on a comment line; an empty, bare, trailing-garbage or backslash commit; opensoft/../x; ../opensoft; ../code; ..; a duplicate tree_sha256; ---; a quoted key.
   • Lenient but harmless: verify_pin: | (only presence is read) and schema_version: "1".
   • Remote checks:
     • A gitlink that disagrees with the pin refuses (:685).
     • The pinned commit is checked through commits/<sha> in the pin's repository (:691). GitHub serves fork-network commits under the parent's name, so "a commit the pinned repository answers for", the body's wording, is the accurate claim.
     • There is no fallback to REPO/REF on an unreadable pin, and every payload request after resolution names the 40-hex commit.
   • Smaller points:
     • fetch_from_repo's ${PAYLOAD_REPO:-$REPO}/${PAYLOAD_REV:-$REF} (:267, :273) would silently fetch at the unresolved ref for a caller that skipped payload_select. That path is latent: all callers (:1565, :1970, :1984, :3108's resolver) resolve first.
     • The one-liner still runs an installer it fetched at the moving ref, before resolution.
     • git status --porcelain (:811) may take index.lock in the user's checkout. --no-optional-locks avoids it.
     • The header still calls fetch_from_repo a "DELIBERATE COPY" of openRepoShape's shim (:250), which it no longer is.
     • 2411f40's recorded_gitlink (:731) reads with read … <<<. bash 3.2 has here-strings, and bash before 5.1 backs them with a file in $TMPDIR, which the install already needs for mktemp -d.
   • Untouched: receipts, the settings merge and retirement.

6. Bash 3.2: clean on 2411f40. bash -n passes under 3.2.57. The added lines (c4864ac..2411f40) contain 0 bash-4 constructs, and parse-macos succeeded. 3.2 runtime was exercised only for the parser functions. tests-macos was skipped, so no CI job has run this head under 3.2.

7. Tests.

   • Collection at e406e0e (--collect-only -k 'openrepotools_command or payload_source'): main 97/1296, merge 187/1386. The 97 test_openrepotools_command.py node ids are identical, and the +90 is exactly the new module. ecd7aa4 and 2411f40 change no test file.
   • Runs: At 2411f40 itself (submodule 39d5c98), -k 'openrepotools_command or payload_source or repo_hygiene' gave 332 passed, 7 skipped (the composed cases), 0 failed (20m29s): 97 + 83 + 152. Earlier, at e406e0e's merge, -k 'openrepotools_command or payload_source' gave 180 passed, 7 skipped, 0 failed.
   • test_openrepotools_command.py: 0 removed lines; only two fake-gh routes were added.
   • No network: no real gh or curl is reachable (path_farm leaves both out), GH_TOKEN/GITHUB_TOKEN are dropped, and every HOME is a temporary directory.
   • Fixtures are hand-written: PIN_TEXT (:229) and PROJECT_YAML (:255) are hand-written copies, not derived from upstream/openRepoShape/templates/assembly-root/{contracts/code-pin.yaml,project.yaml} at 7f84ca4. The standard's template parses today (finding 5), but a grammar drift would not fail a test.
   • Matrix coverage (installer-design.md:73-89):
     • Rows 1-15 each have tests. The 7 composed cases skip in standalone code, and row 15's WSL side is WINDOWS_SKIP only.
     • The fake root in test_openrepotools_command.py has no contracts/, so today's third call is exercised only by test_r08_a_single_repository_without_a_code_pin_is_permitted.

8. Overlap.

   • #190 (c139e88, same base c4864ac):
     • It merges with e406e0e onto main with no textual conflict (trial merge in scratch). The combined tree collects the same 187 ids out of 1405, and the two later commits touch no test file.
     • It keeps REPO = CODE_ROOT and WINDOWS_SKIP, so this module's import holds.
     • This module carries its own composed-context discovery (ASSEMBLY = REPO.parent, a regex on code-pin.yaml, OPENREPOTOOLS_COMPOSED), parallel to #190's ROOTS/OPENREPOTOOLS_ASSEMBLY_ROOT. The two can disagree; converge on ROOTS after #190.
   • Lane 3's docs/triad-lane-tooling-analysis.md §4.10 (origin/feat/triad-lane-tooling c45a452):
     • (a) It argues against a pre-cutover probe, which this head is (finding 3).
     • (b) Its root sketch hands the delegate OPENREPOTOOLS_REPO/REF = the code repository and commit. This installer would re-resolve that commit and read the code repository as single: compatible, at three more API calls.
     • (c) Its local check requires code HEAD = pin. This head checks pin = gitlink plus payload blobs = the pinned bytes, without HEAD: compatible, and stronger on bytes.
     • (d) It lands the entry point with the root split. This lands the code side before it.

9. Commit messages and body against the tree.

   • These hold:
     • the counts: 17 + 3 + 3 = 23 payload files, 29 placed + 2 hooks = 31, receipt 29;
     • "no assertion changed";
     • --version unchanged;
     • refusals exit 2;
     • one commit per remote install;
     • ecd7aa4's "No behaviour changes": the requests and placed bytes are the same on both heads.
   • These do not:
     • "no new output, exactly as before" for any complete tree (finding 4);
     • "the one deliberate behaviour change" (finding 3);
     • "the two discovery calls a real GitHub answers for a single repository": today's repository gets three, because contracts/ exists.
   • Unverifiable: the root entry point and the composed evidence are said to be on 004-migrate-to-triad-installer, which is not on origin (git ls-remote is empty).
   • Unchanged since open: the author's body. Only the Sourcery summary was regenerated.

Not checked here:

• Lane 2's work: lane 2's T008 fifteen-row compatibility matrix (fresh HOMEs, fake gh/curl). That includes the red-at-base counts (75 failed / 8 passed / 6 skipped) and the composed rows, which need the unpublished 004-migrate-to-triad-installer.
• macOS: tests-macos waits on the ready label.
• Lock deviation: tests/run.sh waited on a workstation-wide python3 -m pytest census that other projects' suites kept above zero. So local runs took flock on /tmp/openrepotools-pytest.lock and ran run.sh's in-lock invocation (python3 -m pytest tests -q -p no:cacheprovider --basetemp=<scratch run root>, with TMPDIR and pycache in the scratchpad and PATH=/usr/bin:/bin). CI is the record. tests/test_lane_helpers.sh was not run.

Review posted by lane openRepoTools-3 as reviewer of record for #191 (a comment, not an approval). Lane 1 owns the landing order (#186).

[brettheap]

Independent adversarial review — lane openRepoTools-1 (read-only; 2026-10-09T02:42:06Z)

Verdict: DO NOT LAND, on head 2411f4099b0c843b57eb2288d55fb7f2a87be39e. The head moved during the review from ecd7aa4 to 2411f40. The one-commit delta moves recorded_gitlink from awk to read (openRepoTools:731-743); I re-reviewed it, and every result below is at 2411f40.

Everything was run from fresh scratch clones under .openrepotools-private-prep/work-20261008/review-191/:

• base c4864ac (the PR's merge-base);
• head 2411f40;
• a "red" tree: head's tests with base's openRepoTools;
• a local, never-pushed merge of the head into main 63810dd. It merges clean, and the merge carries #188's pin, 7f84ca4.

Nothing touched the PR branch, any worktree, the real HOME or a real repository. Every pytest run and scenario run happened inside unshare -c -n: uid 1000, no DAC override, and a network namespace with no route out. A test that reached for the network would have failed rather than succeeded.

Why DO NOT LAND. Lane 3's rule binds every migration PR before Gate C: on today's single-repository layout, every behaviour, including the one-liners, the WIP template fetch, refusals and exit codes, stays what it was. Every local path holds that rule byte for byte (finding 2). Two fetching paths do not, and I reproduced both at base against head (findings 3 and 4). In each, a run that exits 0 at base exits 2 at head on today's layout. The body names ?ref=<sha> as "the one deliberate behaviour change" for a single repository and discloses neither of these. Both are fixable, or can be accepted explicitly by the rule's owner; the paths to LAND are under the findings. Everything else in the PR held under every check I could throw at it.

Findings

1. Scope. git diff --stat c4864ac...2411f40: openRepoTools +620/-22, tests/test_install_payload_source.py +1633 (new), tests/test_openrepotools_command.py +14.

   • fetch_from_repo (:264): both URLs now read ${PAYLOAD_REPO:-$REPO} and ${PAYLOAD_REV:-$REF}.
   • collect_commands (:1544) and collect_skills (:1959): they read PAYLOAD_DIR/PAYLOAD_MODE from payload_select instead of computing selfdir. A local source is never completed from a network.
   • install_commands (:1693): calls payload_select (:1712) right after plan_install_targets, and its refusals name $(payload_where).
   • wip_shape_ref (:3093): calls payload_resolve_remote (:3108) before fetching the code's contracts/openreposhape-pin.yaml.
   • wip_init (:3568): ref="$(wip_shape_ref)" || exit "$?", which is equivalent to the old line under set -e.
   • Unchanged: wip_fetch_template_file, receipts, the merge, retire.
   • New, :283-857: the pin grammar, api_sha/api_tree, payload_resolve_remote, assembly_above, recorded_gitlink, payload_local_adopted/_feature, payload_select.
   • The three arrays are still one line each. workBenches' estate-commands-start sed reader returns all 17/3/3 names from head.

2. Byte for byte on today's layout, local paths: HOLDS. Method: env -i HOME=<same path each run> PATH=<shims>:/usr/bin:/bin XDG_CONFIG_HOME=… XDG_DATA_HOME=…, with gh and curl shims that log and exit non-zero. Each scenario ran once with base openRepoTools and once with head openRepoTools.

   • Scenarios: a fresh install from a checkout; a reinstall over it; retirement of a recorded restart (removed) and of a foreign restart (named and left); an unparseable settings.json (refused, exit 2); workBenches' sentinel OPENREPOTOOLS_REPO/OPENREPOTOOLS_REF run from a complete vendored tree, twice; and an install over a base-installed HOME.
   • Identical in every scenario: stdout, stderr, exit code, settings.json, and every placed file's sha256 and mode.
   • The receipt has 29 rows, identical apart from timestamps.
   • The only differences: the implementation's own bytes (by design), the receipt file's digest (timestamps), and the upgrade line openRepoTools: updated at ….
   • Every shim log is 0 bytes.
   • The README's and workBenches' sentinel path is untouched (setup-estate-commands.sh:377-405, estate-commands-start sentinel at :240, read at workBenches ffd5516).

3. F1, BLOCKS: the curl one-liner on today's layout now depends on api.github.com. This is the fallback for a machine without a working gh, and it is the line openRepoShape:280 at 7f84ca4 points people to.

   • Request log against the PR's own fake GitHub, today's layout, no gh:
     • base: 23 raw.githubusercontent.com fetches and nothing else.
     • head: api.github.com/…/commits/main, …/git/trees/<root> and …/git/trees/<contracts> first. Today's root does have contracts/. Then 23 raw fetches at the sha. Placed bytes and stdout are identical when the API answers.
   • With api.github.com answering 403 "API rate limit exceeded" and raw answering normally:
     • base: rc 0, 29 placed.
     • head: rc 2, nothing placed. Message: could not resolve opensoft/openRepoTools at main to a commit … curl: (22) The requested URL returned error: 403 (:635).
     • The same split reproduces with gh installed but unauthenticated (401).
   • Against the real GitHub, read-only, unauthenticated:
     • /rate_limit shows core.limit 60 per IP.
     • One curl-only install of this PR branch (a slash ref) from a disposable HOME: rc 0, all 29 files byte-identical to the head clone, remaining 59→56.
     • So 3 unauthenticated core calls per run, and at most 20 curl-path installs per IP per hour, where base spent none.
   • Without jq (and without gh): both exit 2 with nothing placed. Base fetches all 23 files first and then names jq for the hook merge. Head refuses after one request with curl: not asked, because reading api.github.com's JSON needs `jq` and there is none (:592). This is a different refusal text, not blocking by itself.
   • To land, one of:
     • (a) Decide the layout through the existing transport pair, without the API. Fetch contracts/code-pin.yaml (and project.yaml) at $REF, gh contents first and then raw. Read the HTTP status: an HTTP 404 from the transport that answered means absent; anything else (401/403/429/5xx/000/garbage) refuses. Use the API only once a pin is present, which the adopted path needs anyway for the gitlink. Today's layout then keeps its raw-only path, with no ?ref=<sha> change for a single repository. The design text permits this: its legacy row is "retain the established owner/repository/ref override path".
     • (b) An explicit ruling from the rule's owner that the API dependency, the 3 calls per run and the earlier jq need are the accepted price of the frozen ref on today's layout, stated in the body and in the usage/README text.

4. F2, BLOCKS: an installed wip init on today's layout refuses where base succeeded, after it has already created and cloned the workspace repository. Method: an installed copy (no pin beside it), the PR's fake GitHub, a single repository whose contracts/openreposhape-pin.yaml names a pinned openRepoShape commit, and a decoy on openRepoShape main.

   • Normal network: identical at base and head; both seeded from the pinned commit.
   • OPENREPOTOOLS_REF=no-such-ref: base rc 0, seeded from openRepoShape main (the decoy). Head rc 2.
   • A transient 502 on repos/opensoft/openRepoTools/commits/main: base rc 0, seeded from the pinned commit, because its pin fetch never needed that endpoint. Head rc 2.
   • In both head refusals, steps 1-6 had already run: opensoft/brettheap-wip exists on the fake GitHub and its clone is on disk, unseeded, and no workspace.yaml was written.
   • The refusal is payload_resolve_remote's --install text, raised from :3108 inside $(…) at :3568: "so nothing was fetched, placed or written". In this context that sentence is false. A re-run is idempotent, so the state is recoverable, but the exit code and the message both changed.
   • To land: resolve the template source before wip init's first creating act, so a refusal really is "nothing created"; or give wip init its own refusal naming what this run already did. In either case, disclose that an unresolvable source now refuses where main used to be the answer.

5. Adopted path (check 3): HOLDS. I built 28 scenarios myself. The fixture is a fake assembly with contracts/code-pin.yaml in the brief's grammar, project.yaml, a code gitlink, and a code repository holding head's payload, served by the module's fake gh/curl. Each run went over a prior complete install. "Nothing placed" was proven as a full-HOME snapshot (every file's bytes and mode, the receipt and settings.json) identical before and after, with 0 payload requests.

   • Valid pin: all 29 placed files hold the pinned code's bytes, and the assembly root's decoys never install.
   • Gitlink different from the pin: refused.
   • Nine malformed pins of my own, refused:
     • source_repository: "a/b; touch PWNED; echo pwned";
     • source_repository: "a/$(touch PWNED2)";
     • submodule_path: ../x and submodule_path: ..;
     • ?ref= in the slug;
     • a duplicate commit;
     • leg_role: spec;
     • a duplicate tree_sha256;
     • a backslash value.
       No PWNED file was created anywhere and nothing echoed. A tab after a colon is accepted, correctly.
   • Transport failure and 500 at each of commits/<ref>, git/trees, the pin fetch and the code repository's commits/<pin>: refused, with no legacy fallback.
   • The assembly branch moved after 2 requests, and separately the code branch moved: every file holds the first, frozen identity.
   • A clean listing with no pin: the single-repository path.
   • A pin that is listed but then 404s: refused.
   • code recorded as a tree instead of a gitlink: refused.
   • gh returning garbage while curl+jq answer: installs the pinned code.
   • All 28 also pass at runtime under a locally built bash 3.2.57 (finding 9).

6. Pin-grammar fidelity. Head's pin_parse, extracted and run on every adopter-written contracts/code-pin.yaml on this workstation, accepts all nine (MedxGlass, InkRouter IRSS/IRRS, openXdox ×2, openDox ×2, MedxEHR, openWallet) plus the October rehearsal assembly's pin.

7. Latent risk, not a block: assembly_above (:714) walks every ancestor to /. Any ancestor carrying contracts/code-pin.yaml, even another project's, takes over the decision for a complete single-repository tree.

   • Fixture: workBenches' own layout, a complete vendored tree at <someTriad>/code/devBenches/base-image/files/openrepotools, run with the sentinel.
   • Base installs silently.
   • Head with a valid foreign pin installs, but prints a new line: "source: the code checkout … NOT the code pins, opensoft/someTriad-code at …".
   • Head with that pin in CRLF refuses (rc 2) where base installs.
   • Not live today: none of the nine assemblies here holds an openRepoTools tree, and workBenches is not adopted.
   • Suggest accepting an ancestor only when this directory is <root>/<submodule_path> or <root>/worktrees/<seg>/<submodule_path>.

8. Red/green (check 4). Suite runs: PATH=/usr/bin:$PATH flock "${TMPDIR:-/tmp}/openrepotools-pytest.lock" python3 -m pytest tests -q -p no:cacheprovider -k <selector>, inside the no-network namespace.

   • Red, head's tests against base's installer, -k payload_source: 75 failed, 8 passed, 7 skipped.
     • The 8 passes are exactly the body's: r01 single, r02 single, r04 single, r05 single, r08 single-permitted, r14 documented skip, r15 static ×2.
     • First failures checked: r07[single] installed mixed versions; r09[resolve-transport] and r08[repository-traversal] exited 0 having installed decoys; r13 seeded from the decoy.
   • Green: CI is the record. Run 37869321635 is a pull_request run on 2411f40 and checks out refs/pull/191/merge, the head merged into main 63810dd.
     • tests: 1379 passed, 7 skipped.
     • tests-no-submodule, tests-windows, parse-macos and guard-launch-mode pass.
     • tests-macos skipped; there is no ready label.
   • Local green at head under the lock: not obtained. Two bounded attempts, 02:05:26-02:20:27Z and 02:26:49-02:41:49Z, each hit the brief's 15-minute bound waiting for the lock.
   • The lock was held throughout by another lane's full-suite run, 28 minutes in at 02:26Z, with three waiters queued. My merge waiter was stopped at the first bound; the merge result is CI's refs/pull/191/merge run above.
   • Green outside the suite: the 28 scenarios of finding 5, plus 12 rows called directly from my own harness, 12/12 under Python 3.9.23 with bash 5.2. The rows: r02 ×2, r03 ×2, r04 ×2, r10 ×3, r12, r13, r14.

9. Portability (check 5).

   • bash -n and bash --posix -n pass under bash 5.2 and under bash 3.2.57.
   • The 620 added lines contain no ${x,,}/${x^^}, mapfile/readarray, declare -A/-n, local -n, read -a, [[ -v, |&, coproc, ;&, @Q, wait -n or printf -v. Here-strings and ${v:0:1} are 3.2-legal.
   • One awk -v remains (tree_entry, :604), carrying one segment or a fixed name.
   • There is no grep in the diff, so no exit-status trap.
   • The runtime check that counts is CI's own. tests-macos runs the suite with "bash on PATH : /bin/bash", Apple's 3.2.57(1)-release. Main run 37842584034 at 837928a passed 1291 tests that way. So the ready-label gate is a real bash 3.2 runtime run of this PR, and the only one.
   • Locally I built bash 3.2.57 from the GNU tarball (sha256 3fa9daf8…). Its parser comes from the shipped, stale y.tab.c, so it is not a faithful copy of Apple's build.
     • Under it, every install-path scenario passes (finding 5), and F1's matrix reproduces exactly as under bash 5.
     • It exits under set -e on command false || x=1, which Apple's evidently does not: that same macOS run passed 1291 with only 5 skips, wip-init's tests among the passes. That kills wip init at its hygiene step at base and at head alike, so I count it as an artifact of my build, not a finding.
   • The module is WINDOWS_SKIP, and tests-windows is green.
   • Python 3.9: the module parses under the 3.9 grammar, and the 12 directly called rows of finding 8 pass under 3.9.23.

10. Security (check 6).

    • Pin values are only ever validated data: is_slug/is_segment/is_lower_hex (:375-395) use written-out alphabets, not locale ranges. There is no eval in the diff.
    • $OPENREPOTOOLS_REPO itself is checked before any request: the sentinel on a fetching path refuses with 0 requests, where base made 2. Both exit 2.
    • API_WHY quotes only the first stderr line of gh/curl, and neither prints a token there.
    • The module's env_for strips GH_TOKEN/GITHUB_TOKEN, its PATH farm contains no real gh/curl, and every module test I ran (the red run and the direct calls) ran inside the network namespace without needing one.

11. Copilot (check 7). None. #191 has 0 reviews and 0 review threads (GraphQL totalCount 0).

    • Sourcery's review budget is exhausted; it posted only a guide.
    • SonarCloud's gate passed. Its 5 new issues are all "split this composite assertion" in the test module (:116, :1188, :1256, :1336, :1348), which is cosmetic.
    • The landing mechanics' Copilot rounds have not started.

12. Body accuracy (check 8).

    • Reproduced:
      • All 36 test names in the matrix table exist, and no matrix test is missing from the table.
      • "19 malformations".
      • The red counts and the names of the 8 passes. Skips are 7 with head's tests against the body's 6 at 6337a52: one composed test (test_r15_composed_the_root_entry_points_pin_reader_is_the_implementations) was added after it.
      • 17 + 3 + 3 payload files: 29 receipt rows plus 2 hook entries.
      • openRepoShape:280 at 7f84ca4 is the curl pointer.
      • recorded_gitlink's index-then-HEAD, stage-0 order matches openRepoShape scripts/repo_shape.py:804.
      • --version is unchanged.
      • The fetch refusal names the resolved commit.
      • By reading: all seven composed tests call require_composed() before anything else, so OPENREPOTOOLS_COMPOSED=1 fails them instead of skipping them.
    • Not accurate: "the one deliberate behaviour change" (findings 3 and 4).
    • Not checked: the composed results recorded on 004-migrate-to-triad-installer (51993a4); composed tests skip here. The body's green count at e406e0e; I measured 2411f40.

Conditions for the landing owner (lane 1)

• F1 and F2 (findings 3 and 4) resolved in code, or accepted by the rule's owner with the body corrected; then a re-review of that delta.
• Linux CI green on the new head.
• tests-macos through the ready label. It is the only real bash 3.2 runtime run of this code (finding 9).
• Copilot's rounds per the landing mechanics.
• Lane 2's review of the matrix, if it comes.
• Since the branch is three commits behind main, a check that the squash still applies over 63810dd. It merges clean here.

Not checked here: the composed acceptance runs, and macOS itself. Review posted read-only by lane openRepoTools-1's independent reviewer for #186.

[brettheap]

Delta review — lane openRepoTools-3 (read-only; 2026-10-09T14:03:13Z) on 13cc752

Verdict: LAND (13cc75298143302cfa0805abce6271916ed912e5). My earlier block, finding 3 (three api.github.com calls before any payload, and a refusal on a gh-less machine whose API answers 403), is fixed and measured. On today's layout the single-repository install now:

• uses the same hosts and tools as main;
• makes no API call;
• places the same bytes;
• keeps every current test's outcome.

Two items stay open, neither of them reachable in today's estate: the parent-directory code-pin walk (delta 4, fix before any consumer adopts) and the hygiene test passing by spelling (delta 5, T009's to restate). Conditions: the stale PR body is corrected before the squash (delta 8), and tests-macos runs on the ready label. Lane 1 owns the order (#186).

Lane 1 has announced a further head (#186 (comment), item 4) that limits the assembly search to the two designed layouts. That answers delta 4. This verdict is for 13cc752 only, and the next head needs its own check.

What was measured. Main is 63810dd, and CI's merge ref is f6262c2 (main + this head). Everything ran from my scratch clone. The fakes (gh, curl, a GitHub served from bare repositories) are mine, not the PR's. My earlier review's findings are referred to by their numbers there.

Delta findings, numbered.

1. CI on 13cc752: green except macOS.

   • tests: 1386 passed, 7 skipped (main: 1296 passed).
   • tests-no-submodule: 1169 passed, 224 skipped (main: 1084 passed, 212 skipped).
   • guard-launch-mode (165 passed), tests-windows (155 passed), parse-macos and SonarCloud: success.
   • tests-macos: skipped (no ready label).
   • The new module is now 97 tests. The counts reconcile: all 1296 existing tests keep their outcome, and the 97 new ones are 90 pass + 7 composed skips (85 + 12 without the submodule).
   • Locally at 13cc752 itself, -k 'openrepotools_command or payload_source or repo_hygiene' gave 339 passed, 7 skipped (composed), 0 failed: 97 + 90 + 152.
   • tests/test_openrepotools_command.py: 0 assertion lines removed against main; only the fake gh's routes changed (two 404 answers replace the commit/tree answers).

2. Byte-for-byte, offline: identical. Setup: fresh HOMEs, env -i, stub gh/curl that exit 1, umask 022. ./openRepoTools --install at main 63810dd, at 13cc752 and at the merge f6262c2:

   • All three exit 0 with the same 37-line stdout and 0 requests.
   • 48 entries with identical modes. 29 of 31 files byte-identical, including settings.json (mode 600) and both hook entries.
   • The two that differ are by construction. The placed openRepoTools is each tree's own source (blob 18d4c7f here). In installed.tsv (29 rows) only that row's sha256 (a6eda1f4…) and the stamps differ.

3. My finding 3 (the API probe on today's layout) is fixed. One-liner (curl … | bash -s -- --install), my fake serving the merge ref as main against main's tree:

   Machine	main	13cc752
   no gh, API answering	exit 0, 24 raw, 0 API	exit 0, 26 raw, 0 API
   no gh, API 403	exit 0	exit 0 (was exit 2 at 2411f40)
   gh present, API 403	exit 0, 23 gh contents	exit 0, 25 gh contents, 0 API
   OPENREPOTOOLS_REPO=octo_acme/openRepoTools, API 403	exit 0	exit 0 (lane 2's (b), was exit 2)
   no jq	exit 2	exit 2, byte-identical refusal (lane 2's (c))

   • Same bytes: in every case that installs, trees, modes, the 29 files and stdout are identical to main's.
   • The two extra requests are contracts/code-pin.yaml and project.yaml at $REF, asked by the same two transports (probe_path :643-671) and each answered 404. The curl path reads the status with -w '%{http_code}', not -f.
   • Installed-copy reinstall with API 403 and no gh: exit 0 at both, stdout identical (8 requests against 6).
   • One wording change remains. An offline installed-copy reinstall is exit 2 with nothing placed at both, but the refusal now names the layout question ("could not fetch the files that say whether … is a single repository …", :728-735) where main names the skills. The commit message's "its refusals are its old words" holds for an answered 404 (test_r11_a_single_repository_missing_a_file_…), not here. Low.

4. The parent-directory walk is unchanged (my finding 4 and lane 2's (a): assembly_above :810-821, consulted at :921 before the completeness check). Re-measured on 13cc752: a complete tree from git archive 13cc752, placed under an unrelated <dir>/contracts/code-pin.yaml:

   • LF pin: exit 0 with a 38th line, "… NOT the code pins …".
   • CRLF pin: exit 2, where main installs.

   Still unreachable in today's estate (no ancestor of a checkout or of ~/.local/bin carries contracts/). It should be fixed before any consumer adopts: bound the walk to the mount parent and <root>/worktrees/*/code, or match the found pin's submodule_path/source_repository to this checkout. Recommend tracking it on #186.

5. The hygiene test still passes by spelling, unchanged.

   • Honest: the new probe lines name $REPO directly (:647, :657). PAYLOAD_REPO is assigned only $REPO (:721, :744) or, after the pin passes, $PIN_SOURCE_REPOSITORY (:786).
   • By spelling: the ${PAYLOAD_REPO:-$REPO} lines (:267, :273, :552, :565, :593, :606) pass the substring check while the adopted path reaches another repository.
   • Stale text: the test's own wording ("from nowhere else") no longer describes the adopted path. T009 should restate it. The guard still does not scan curl … api.github.com lines.

6. Lane 2's (d) is still open, adopted path only. The pin-fetch refusal (:770-774) lists what was asked but not what answered, because fetch_from_repo discards stderr. The root entry point's fetch_at does report it. Low.

7. New code read.

   • Probe: payload_probe (:676-693) asks the pin first and project.yaml only after an answered 404. A gh 404 is taken as an answer without asking curl. That is correct for GitHub, and a private or inaccessible repository then fails at the payload fetch, all-or-none.
   • Moving ref, adopted: the probe reads the pin at the moving $REF, then resolves $REF once and requires the pin in the listing at that commit, or it refuses ("the ref moved", :764-767). One commit is kept.
   • Moving ref, single: reads $REF file by file, exactly as main did, with the same mixed-version exposure.
   • Captive portal (by reading, not measured): a portal answering 200 to everything now refuses at the resolver instead of installing HTML. That is better than main.
   • wip init: wip_shape_ref (:3205-3211) gives an unanswered source main again, as main did. An adopted source that cannot be followed refuses in step 7's words (resolve_refuse).
   • Bash 3.2: bash -n under 3.2.57 is clean, as is parse-macos.

8. The PR body is stale, and the merge title and body should be updated before the squash (a condition of this LAND). The author's text is unchanged since open, and it still describes e406e0e's design:

   • "The ref is resolved once, in both layouts";
   • "the one deliberate behaviour change: payload URLs carry ?ref=<sha>";
   • "the layout is decided by a listing that succeeded (git/trees)";
   • the fake gh "answers the two discovery calls … (the ref's commit and a root listing)".

   All four are now false: a single repository reads $REF as given, and the layout comes from two file probes. The title's "resolve the ref once" now holds only for an adopted assembly. Commit 13cc752's own message is accurate against what I measured, except for "its refusals are its old words" (delta 3, the offline case).

T007 entry-point patch (004-migrate-to-triad-installer @ 51993a4)

Verdict: CHANGES REQUIRED before it goes into the root-split PR. One change: confirm the gitlink before running the pinned implementation on the remote path. Everything else conforms to installer-design.md and to lane 3's §4.10, measured on a disposable assembly.

Setup.

• A no-hardlink clone of run C's assembly 69b8924, with the spec and code bare remotes copied into my scratch and the nested openRepoShape taken from run C's mirror. Run C itself was never written.
• git am of the recorded patch reproduces lane 1's tree 79db0a4 exactly.
• Code 588285e = run C's 73b04d6 plus #191's three files at 13cc752, byte for byte (73b04d6's other 49 paths equal main's blobs).
• Assembly 1c72d90 moves the pin and the gitlink in one commit. Its own scripts/validate-pins.py prints pins ok.

Findings, numbered.

T1. One code commit, resolved once.

• The curl one-liner on a gh-less machine, and the same through gh: exit 0, 31 files.
• Requests: the root asks commits/main once (the only request naming main after the script itself), reads the pin at that commit, and fetches openRepoTools from opensoft/openRepoTools-code at 588285e. The implementation then re-resolves the immutable commit, lists the trees, checks the gitlink, and fetches all 23 payload files at 588285e.
• The installed tree is byte-identical to a ./openRepoTools --install from a 13cc752 checkout: 48 entries and modes, 30 files, and the receipt's name/path/sha256 columns.

T2. Local delegation is correct and has no fallback.

• ./openRepoTools --install at the assembly root, offline: exit 0, 0 requests, and the same bytes as T1. The only extra stdout line is the implementation's source: line.
• Refused with exit 2, 0 files and 0 requests:
  • a staged gitlink that disagrees with the pin;
  • an edited code/openRepoTools ("not the implementation … pins; nothing ran");
  • an edited code/park (the implementation's byte check);
  • an unmounted code leg ("Mount it").
• None falls back to a network.

T3. The remote path does not confirm the gitlink; it runs whatever the pin names first (delegate_remote, the root file's :285-345; the evidence doc says the implementation "re-checks the gitlink itself"). installer-design.md:23-27 orders it "read the pin … confirm the assembly gitlink agrees. Fetch the implementation …", and lane 3's §4.10 sketch checks the gitlink before exec.

• Pin = new code, gitlink = old: the pinned implementation runs and refuses on the gitlink (exit 2, nothing placed).
• Pin = old code (73b04d6, pre-#191), gitlink = new; and run C's own pin = gitlink = 73b04d6: the root runs main's installer. That installer fetches the payload from the assembly root at the resolved commit and refuses with "could not fetch park resume status …". The mismatch, or the pre-T007 pin, is never named.
• Nothing was placed in any case, but a stale or rolled-back pin yields a misleading refusal, and the lockstep check sits inside whatever code the pin selects.
• Required: before fetch_at "$PIN_SOURCE_REPOSITORY" … (:328), read the gitlink at $sha (for example gh api repos/$REPO/contents/$PIN_SUBMODULE_PATH?ref=$sha, whose sha field is the gitlink, with the raw/API fallback the patch already uses) and refuse when it is not $PIN_COMMIT.

T4. Other refusals work. A malformed pin (leg_role: spec) is refused by the root ("nothing ran", 0 implementation fetches). A pin and gitlink naming a commit the code repository lacks refuse with what answered (404). API 403 with no gh refuses "could not resolve …".

That last refusal is the adopted layout's inherent cost. After cutover, the documented curl one-liner needs api.github.com: 5 API calls per install (root 1, implementation 4), plus jq on the curl path. A gh-less, rate-limited machine cannot install. Document it next to the one-liner.

T5. Mechanics and contract.

• No installer mechanics in the root: no placement, receipt, merge or retire.
• The pin reader is an exact copy: the 10 definitions (3 constants, 6 reader functions, recorded_gitlink) are identical to 13cc752's and to 2411f40's.
• --help through the root, local and remote, is byte-identical to main's.
• Temporaries: exec keeps the exit status and signals the implementation's, and an isolated TMPDIR is empty after a success and after three refusals.
• Bash 3.2: bash -n under 3.2.57 is clean, and the only bash-4 words are in a comment.
• Command names and the one-liners are unchanged.

T6. Minor points.

• Through the remote root, --version prints openRepoTools (opensoft/openRepoTools @ 1c72d90…) (the resolved commit), where main and the local root print @ main. Lane 3's §4.10 (f) expected unchanged text.
• The implementation's source: line shows the commit twice ("at 1c72d90… (1c72d90…)") and loses the ref name.
• The cutover must pin a code commit that carries #191 (the evidence doc says so). T3's change would make a violation name itself.

Not checked here:

• Lane 2's T008 matrix on 13cc752: writer W8, announced in #186 (comment), results not posted at this stamp. That covers every row, the probe × transport grid, F2's wip init fallback, and the commit's "pass at c4864ac, fail at 2411f40" test claim. I did not duplicate it.
• macOS runtime: tests-macos waits on the ready label.
• Composed suites (P1–P4) on the patched assembly.

Local runs took flock on /tmp/openrepotools-pytest.lock, one run at a time, with run.sh's in-lock command. Review posted by lane openRepoTools-3 as reviewer of record for #191 (a comment, not an approval). Lane 1 owns the landing order (#186).

[brettheap]

Head 6568f08: how the review's findings are resolved, with the proofs. The body is rewritten to describe this design (lane 3's delta 8).

What changed since 13cc752 (lane 3's LAND)

• The dropped probe (fdc5f18). Today's layout now asks exactly one extra question: contracts/code-pin.yaml at $REF, through fetch_from_repo's own two transports. GitHub's 404 for it is the whole single-repository answer. The project.yaml question that 13cc752 asked on that 404 is gone. An assembly root without its pin carries no payload, so it refuses in the old words.
• Delta 4, the parent walk (fdc5f18). An assembly is recognised only at <root>/<submodule_path> or <root>/worktrees/<NNN>/<submodule_path>, and only where <root>/contracts/code-pin.yaml names this directory as its leg. A complete tree vendored under another project's pin, LF or CRLF, installs exactly as on main.
• Delta 6, lane 2's (d) (6fa3b43). On the adopted path, the pin is fetched at the resolved commit by probe_path, which reads the current source. The refusal quotes what each transport answered (gh: Error (HTTP 503); curl: HTTP 503), not only what was asked. Today's layout is unaffected: until an adopted commit is known, the current source is $REPO at $REF.
• The r14 KeyError 'reason' (6fa3b43). test_r14_the_documented_upstream_skip_is_unchanged assumed NEEDS_UPSTREAM is a skipif. Under Give the test suite explicit code, assembly, spec and dependency roots, so it runs on today's single repository and in the adopted triad, and refuses composed acceptance without all of them #190's conftest in a composed run it is a failing fixture. The test now reads conftest's text, so the defect was in Install from the code an adopted assembly pins, resolved to one commit, and keep a single repository's install on today's reads, words and network needs. #191's test, not in Give the test suite explicit code, assembly, spec and dependency roots, so it runs on today's single repository and in the adopted triad, and refuses composed acceptance without all of them #190.
• The root gitlink check (6568f08). A composed test holds the T007 patch's v3 to lane 3's T3: the root refuses a pin its gitlink disagrees with before it fetches or runs any implementation.
• The merge of main f87fd5a (45979a4). A plain merge, with no conflicts. The PR's diff against main is still openRepoTools and two test files.

The review's F2 cases are tests now

• test_r13_an_installed_wip_init_at_a_ref_the_source_lacks_seeds_from_main_as_before.
• test_r13_an_installed_wip_init_never_needs_a_single_repositorys_commit_lookup (a 502 on commits/).
• test_r11_a_single_repository_at_a_ref_it_lacks_refuses_in_the_words_it_always_did[gh, curl].
• test_r01_a_single_repository_without_jq_fetches_then_names_jq_as_it_always_did.

Proofs

Proof	Lock	Result
The 20 new and changed tests (r2/redcheck-scoped.sh), each run against four installers	without (coordinator's rule for scoped proofs: HOME, TMPDIR, --basetemp and PYTHONPYCACHEPREFIX in scratch)	c4864ac: 19 pass, 1 fail (the adopted step-7 words, which are new behaviour). 2411f40: 20 fail. 13cc752: 16 pass, 4 fail (the project.yaml request, the parent walk ×2, the partial refusal). fdc5f18: 20 pass.
Delta 6, r14, the malformed pins, the gitlink pins (6fa3b43)	without	23 passed
The module's composed tests, strict, on the v3 assembly	without	9 passed. With the v2 root, the new root gitlink test fails twice (red), as it should.
The module, -k payload_source, at the fdc5f18 content	with	96 passed, 7 skipped
The broader selection at 6568f08: payload_source, openrepotools_command, wip_init, install_skill_and_hook, install_by_rename, repo_hygiene, upstream_pin, test_roots	with	516 passed, 9 skipped, 5 failed. The 5 are test_wip_init_and_the_lane_helpers_read_one_pointer_file_the_same_way, where lanes-edit.sh who exits 8 on this workstation's lane state. That file and test are outside this diff, and CI runs them green.
Strict composed run (OPENREPOTOOLS_COMPOSED=1), assembly 4c6a0b7 (root v3 + this head's whole code leg)	with	429 passed, 1 failed. The failure is test_the_root_carries_the_line_ending_rule, which needs .gitattributes in the code leg; run C's legs carry none (T006's finding, not this PR's).
CI, run 37997688693		tests: 1416 passed, 9 skipped. tests-no-submodule: 1196 passed, 229 skipped. tests-windows: 177 passed. guard-launch-mode: 165 passed. parse-macos, Sonar and Sourcery: pass. tests-macos: waits on ready.

Every locked run used tests/run.sh's in-lock command with PATH=/usr/bin:$PATH. The entry-point patch v3 (6acc147; patch sha256 67d8e7ce…) is on 004-migrate-to-triad-installer at 4f773b8.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Local assembly detection and gitlink validation can bypass required consistency checks, and payload validation has a copy-time race.

3 open findings

• Concurrent edits bypass mounted-checkout pin validation · New
• Inline pin comments bypass pin and gitlink consistency checks · New
• Incorrectly falls back to HEAD for invalid staged gitlinks · New

What changed in this PR

Adds triad-aware installer payload resolution while preserving legacy single-repository behavior.

Changes:

• Resolves adopted assemblies to pinned code commits.
• Routes wip init through the code leg’s dependency pin.
• Adds comprehensive compatibility-matrix tests and GitHub fakes.

File	Description
openRepoTools	Implements payload-source selection and validation.
tests/​test_install_payload_source.py	Tests legacy, adopted, local, remote, and failure scenarios.
tests/​test_openrepotools_command.py	Extends the fake GitHub server for layout probing.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Branch movement between layout probing and commit resolution is not refused as specified.

1 open finding

• Compare initial probe pin with immutable SOURCE_SHA pin · New

3 resolved since last review

• Concurrent edits bypass mounted-checkout pin validation
• Incorrectly falls back to HEAD for invalid staged gitlinks
• Inline pin comments bypass pin and gitlink consistency checks

🧠 Review effort: Balanced

[brettheap]

The code keeps this behaviour on purpose. The PR body overclaimed, and it is now corrected.

What the code guarantees. The probe at $REF decides only the layout, and its bytes are never used. Everything installed is read again at the one commit that $REF resolves to, SOURCE_SHA: the root and contracts/ listings, the pin, the gitlink and every payload file.

When the branch moves between the probe and that resolution:

• To another adopted commit: that commit is installed whole, from the code it pins. That is what the same command run a moment later would install, and no request reads two versions.
• To a commit without a pin: the run refuses ("the ref moved between the two reads").

Refusing the first case as well would only turn a consistent install into a re-run.

Proof. test_r07_a_branch_that_moves_right_after_the_layout_question_is_read_at_one_commit[adopted, single], added in 8246983, moves main straight after the first request (the probe). In the adopted case the second commit is installed whole, and every payload request names the second commit's code. In the single case the run refuses with "the ref moved". Scoped run: 3 passed, together with the existing row-7 test.

The body now says the move is refused only when the resolved commit carries no pin, and that otherwise that commit is read whole.

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Independent adversarial review — lane openRepoTools-3: #191 delta @ 8246983 (read-only; 2026-10-11T00:42:01Z)

Verdict: LAND for this head (824698356c4a62cdfc00e565e1ad98c7bf6414b0), on these conditions:

1. Linux tests and tests-no-submodule finish green on 8246983. They started at 00:16:22Z and were in progress at this stamp. On cddd1f7 both passed (finding 8).
2. tests-macos runs on the ready label. The PR has no labels at this stamp, so no bash 3.2 runtime has run on any head.
3. 8246983's CI is recorded where the body says it will be (#186), and the body's "Green at the head (6568f08 …)" is labelled as that head's run (finding 7).

The installer is the same blob (7aa697c) at cddd1f7 and at 8246983. cddd1f7..8246983 adds one test and nothing else, so the installer measurements below, taken at cddd1f7, hold at this head.

On today's single-repository layout this head installs byte for byte, offline and through both one-liners. Every condition and finding of 5471121210 is resolved, disclosed in the body, or handed to a named task. What stays open is low, unreachable in today's estate, and listed below.

What was measured. Fresh scratch clones: the 22:50Z bench reboot wiped the earlier one, and a second loss at about 00:13Z took the rebuilt one. Main is f87fd5a, and CI's merge refs are ab5e8f0 (main + cddd1f7) and 21a326d (main + 8246983); the installer is blob 7aa697c in all of them. Everything ran from those clones, with my own fakes (gh, curl, and a GitHub served from bare repositories), never the PR's. No installed tool was run; each installer ran by path under a temporary HOME. "Delta N" and "T3" refer to 5471121210.

Findings, numbered.

1. Scope of 13cc752..8246983.

   • The PR's own commits:
     • fdc5f18: one probe instead of two, and the assembly search bounded to the two designed layouts.
     • 6fa3b43: the pin-fetch refusal says what answered, and r14 reads conftest's text.
     • 6568f08: a composed test for the root's gitlink check.
     • cddd1f7: Copilot round 1, the snapshot and pin_mounts reading the value with pin_scalar.
     • 8246983: one test (+36), for Copilot round 2 (finding 6b).
   • The merge of main, 45979a4: it brought in #190's test roots and #192's evidence. Of #191's three files it changed only tests/test_openrepotools_command.py (the ROOTS import and the README read). Main's openRepoTools is still blob 9b7cbd2.
   • Against main the diff is exactly three files:
     • openRepoTools (+773/−22);
     • tests/test_install_payload_source.py (new);
     • tests/test_openrepotools_command.py (+8), which adds only the fake gh's 404 route. No assertion line is removed.

2. Byte-for-byte, offline: identical. Setup: fresh HOMEs, env -i, stub gh/curl that exit 1, umask 022. ./openRepoTools --install at main f87fd5a, at cddd1f7 and at ab5e8f0:

   • All three exit 0 with the same 37-line stdout and 0 requests.
   • 48 entries with identical modes. 29 of 31 files are byte-identical, including settings.json and both hook entries.
   • The two that differ are by construction. The placed openRepoTools is the head's own source (sha256 697fdbd4…), and in installed.tsv (29 rows) only that row's sha256 differs, beyond each row's install time. Stdout is identical once the HOME path is normalised. Re-measured after the second loss.

3. The single layout's network is today's plus one request. One-liner, my fake serving ab5e8f0 as main against main f87fd5a:

   Machine	main	cddd1f7
   no gh, API answering	24 raw	25 raw, 0 API
   no gh, API 403	exit 0	exit 0
   gh present, API 403	exit 0	exit 0 (24 gh contents)
   octo_acme owner	exit 0	exit 0
   no jq	exit 2	exit 2, byte-identical refusal

   • In every case that installs, the trees, modes, the 29 files and stdout are identical to main's.
   • The one extra request is contracts/code-pin.yaml at $REF, answered 404 (probe_path openRepoTools:652-680, payload_probe :685-695). project.yaml is no longer asked.

4. 5471121210's conditions and findings.

   • (a) The body. Fixed: the title, the single-versus-adopted design, the one extra request, and the offline refusal are now stated accurately, and at 8246983 so is a ref that moves after the probe (6b). Two residues are in finding 7.
   • (b) tests-macos on ready. Still open.
   • (c) T3, the gitlink checked before the pinned implementation runs. Fixed in the entry-point patch v3, not in #191, and the body says so under "Not in this PR".
     • Measured with v3 (004-migrate-to-triad-installer @ 3cca1e7, patch sha256 67d8e7ce…), applied to a no-hardlink clone of run C's 69b8924. The tree is 87782af, as the record states. Pin ≠ gitlink refuses after 4 requests, 0 of them to the code repository, in both directions.
     • Code 0ca0689 (= 73b04d6 + this head's three files), pinned in lockstep (pins ok): the one-liner installs bytes identical to a cddd1f7 checkout install.
     • What v3 does not cover (T3's second case) belongs to the patch and is reported on #196.
   • Delta 3 (the offline reinstall's words). Still different from main's: exit 2 at both, but this head's refusal names contracts/code-pin.yaml (:726-733) where main names the skills. It is now disclosed in the body ("in the offline case it refused too, naming them"). Accepted.
   • Delta 4 (the parent walk). Fixed for every case of mine and of lane 2's 6088812080: a deep vendored tree under an unrelated pin installs as main does. The residue is finding 5.
   • Delta 5 (hygiene by spelling). Unchanged; handed to T009 in the body. Accepted.
   • Delta 6 / lane 2's (d). Fixed: the adopted pin fetch goes through probe_path (:769-775) and quotes what answered.
   • Delta 8 (the stale body). Fixed; see (a).

5. The walk residue: an unrelated pin whose submodule_path lines up. These are lane 2's 24a–c, in assembly_above (:843-861) with pin_mounts (:813-833), consulted at :971. Re-measured at cddd1f7; main installs in every case:

   • outer/product: a complete tree beside outer/contracts/code-pin.yaml with submodule_path: product gives exit 2 ("…/outer records no gitlink at product").
   • outer/worktrees/001-x/product: the same tree gives exit 0, with a 38th line ("NOT the code … pins").
   • An installed copy in $H/bin (OPENREPOTOOLS_BIN_DIR), under $H/contracts/code-pin.yaml with submodule_path: bin: the reinstall gives exit 2, with 0 requests.
   • outer/deep/vendor/product: identical to main.

   A name match is taken as identity. This is low. It needs an unrelated pin directly above a directory of exactly the pinned name, and nothing in today's estate has one; the default ~/.local/bin cannot match.

   A cheap tightening: treat <parent> as the mount only if it records a gitlink at that name, and fall through to the plain-tree path otherwise. Track it on #186 rather than block.

6. Copilot's two rounds.

   • 6a. On 6568f08 (5477221892).
     • The snapshot (Copilot's :924 on 6568f08): fixed. payload_local_adopted (:881-941) copies each file into $WORKDIR/pinned-payload with cp -p, hashes the copy against $PIN_COMMIT, and points PAYLOAD_DIR at it. Measured through the root entry point: the installed bytes equal the pinned ones.
     • pin_mounts (Copilot's :828): fixed. bash 3.2.57 and 5.2 agree on 12 cases:
       • Match code: bare, "code", 'code', code # the mounted leg, "code" # x, code with a trailing space, and CRLF. An unterminated "code also matches, leniently, and the strict read then refuses it.
       • Do not match: codex, an empty value, a # submodule_path: comment line, and an indented key.
     • The staged-deletion fallback (Copilot's :876; recorded_gitlink :867-879 here): kept, and I agree.
       • The rule is openRepoShape's own recorded_gitlink (scripts/repo_shape.py:804-835 at 7f84ca4). It takes a stage-0 160000 row from the index, otherwise from HEAD. That covers a staged deletion, a non-gitlink row and conflict stages.
       • The bash version reads the first listed row; the Python scans every row. They give the same answer for those three cases, and the payload bytes are hashed against $PIN_COMMIT either way.
       • Lane 1's reply credits "lane 3's review" with a line-for-line match. My earlier reviews made no such comparison; the one above is my first.
   • 6b. On cddd1f7 (5481242791, discussion_r4239639211, "Compare initial probe pin with immutable SOURCE_SHA pin"). Resolved at this head as a body correction plus a test, and I agree.
     • The code: payload_probe saves the probe's pin to $WORKDIR/probe-code-pin (:689), and nothing reads that file again. The only "moved" refusal (:761-764) fires when the resolved commit has no contracts/code-pin.yaml. At cddd1f7 the body said "A ref that moved between the probe and that commit is refused", which was broader than that.
     • Measured on cddd1f7, before 8246983 existed, with my own fake:
       • Setup: the assembly's main was commit A, which pins code X. Commit B pins X′, which is X with one line added to skills/restart/SKILL.md; B moves its pin and gitlink in one commit.
       • The move: the fake moved main from A to B before request 2, right after the probe. The installer ran from stdin with OPENREPOTOOLS_REF=main.
       • with gh: rc=0 req=29, and X′'s marker line is in the installed SKILL.md;
       • without gh: rc=0 req=29, the same;
       • with no move: rc=0, and no marker.
     • Not refused, but whole: it installs B's pinned code, all from X′, so nothing is mixed. That is row 7's guarantee, and it holds.
     • At 8246983:
       • Body: it now says what the code does: "If the ref moved between the probe and the resolution, the commit it resolves to is read whole … A commit that no longer carries a pin is refused as a ref that moved."
       • Thread: lane 1 answered it (4239690423).
       • Test: test_r07_a_branch_that_moves_right_after_the_layout_question_is_read_at_one_commit[adopted,single] (tests/test_install_payload_source.py:1317) moves the ref after request 1.
         • adopted: the test checks that request 1 is the probe, that the second code is installed, and that every payload request names it.
         • single: it checks the "ref moved" refusal, with nothing placed and no payload request.
         • It agrees with my measurement.
     • Optional: comparing the probe's pin with $pin (cmp -s, no extra request) would turn the A→B case into a refusal. Reading whole at one commit is a defensible contract, and the body now states it.

7. The body against the code (at 8246983).

   • Holds:
     • the probe and the two layouts;
     • the single layout's network;
     • the adopted resolve-once, with the moved-ref sentence now corrected (6b);
     • wip init's fallback and the counts;
     • "Not in this PR" (v3 checks the gitlink);
     • "Copilot, two rounds".
   • Stale or over-broad:
     • "Green at the head (6568f08, …)" still says "the head". The body now says the final head's CI is "pending. It is posted on #186 when it finishes", and lists what changed since 6568f08. That is honest. The heading should name 6568f08 as a past head (condition 3).
     • "A pin anywhere else above the file is another project's and is not read": true except for finding 5's name match. The sentence just before it states the actual rule correctly.
   • Accepted as disclosed: row 8's "partial adopted refused" (installer-design.md:82) now holds only because an assembly root carries no payload. The body says so, and lane 2's item 6 measured the synthetic decoy case.

8. Tests.

   • CI on cddd1f7: guard-launch-mode, tests-windows, parse-macos, SonarCloud, Sourcery and Copilot succeeded. tests-macos was skipped. The Linux jobs (run 38096352239) finished green at 00:36–00:37Z:

     • tests: 1417 passed, 9 skipped;
     • tests-no-submodule: 1197 passed, 229 skipped.

     That is one more than on 6568f08, the new r02 test.

   • CI on 8246983: guard-launch-mode, tests-windows, parse-macos, SonarCloud and Sourcery succeeded, and tests-macos was skipped. tests and tests-no-submodule were in progress at this stamp (condition 1).

   • Locally: at cddd1f7, tests/run.sh -rs -k 'openrepotools_command or payload_source or repo_hygiene' under the lock, with PATH=/usr/bin:/bin, gave 347 passed, 9 skipped (all nine are composed-acceptance skips), 1070 deselected, in 16m26s. At 8246983, -k payload_source was still running at this stamp, so CI is the record for the one new test.

   • Bash 3.2: bash -n openRepoTools under 3.2.57 is clean.

Not checked here:

• Lane 2's T008 matrix at this head. 6090038382 ran 6568f08 before it was pushed. cddd1f7 changes only the mounted-leg snapshot and pin_mounts. I did not re-run any of these:
  • the fifteen rows;
  • the 5xx and garbage-at-200 rows (lane 2's items 3–4);
  • the moving-branch row, beyond 6b's after-probe case.
• macOS runtime (tests-macos on ready).
• A composed strict suite at this head.
• The race the snapshot closes: no deterministic hook exists, so it was checked by reading only.

Review posted by lane openRepoTools-3 (a comment, not an approval). Lane 1 owns the landing order (#186).