From 6a8b320dc2bfb60fc06522f88173fc7059cb8792 Mon Sep 17 00:00:00 2001 From: Brett Heap Date: Sat, 17 Oct 2026 21:57:13 +0000 Subject: [PATCH 1/2] Pin openRepoShape at 190133d, its v1.1.0 release commit on main: the gitlink and contracts/openreposhape-pin.yaml move together, the digest recomputed Brett Heap's hold of 2026-10-13 (#186, comment 6152410188) held every bump of upstream/openRepoShape until openRepoShape's v1.0.0 tag. His word of 2026-10-17T21:51Z, recorded on #186 (comment 6241785035): "Yes, wait for v1.1.0", meaning pin straight to v1.1.0, so there is one pin update and one rehearsal instead of a v1.0.0 rehearsal redone days later. v1.0.1 cannot be pinned: 8cda139 sits on release/v1.0, not on main. v1.1.0 is an annotated tag, dereferenced locally and through the API: git rev-parse v1.1.0 v1.1.0^{commit} -> b9c509997727927acc20b15d9b9e04aa08b56c01 (tag, tagger 2026-10-17T21:29:43Z) -> 190133d5e704e380c430f87ca9c4e31746de0012 gh api repos/opensoft/openRepoShape/git/tags/b9c50999... --jq .object.sha -> 190133d5e704e380c430f87ca9c4e31746de0012 On openRepoShape's main, as AGENTS.md's pinned-standard rule 2 requires: gh api repos/opensoft/openRepoShape/compare/main...190133d5e704e380c430f87ca9c4e31746de0012 -> behind (ahead_by 0, behind_by 2) Bump run as contracts/openreposhape-pin.yaml states: git -C upstream/openRepoShape fetch origin main --tags git -C upstream/openRepoShape checkout 190133d5e704e380c430f87ca9c4e31746de0012 python3 -c "...from repo_shape import tree_digest; print(tree_digest('upstream/openRepoShape', 'HEAD'))" Old commit: 7f84ca42ca86a8902928345109d2bf6bad87bd91 Old tree_sha256: 3be52767e727d924dd05f9e78b18eb70f1682fe48614fab519f85331eeff5fa8 New commit: 190133d5e704e380c430f87ca9c4e31746de0012 New tree_sha256: 7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912 The digest is recomputed, not adjusted. 190133d's helper on 7f84ca4's tree prints the old row 3be52767... again, and 7f84ca4's helper on 190133d's tree prints the new row 7a66972c..., so sorted-ls-tree-r-v1 means the same on both sides. Only `commit:` and `digests.tree_sha256` change in the pin file. Nothing under upstream/openRepoShape was edited. Part of #186. Co-Authored-By: Claude Opus 5.5 --- contracts/openreposhape-pin.yaml | 4 ++-- upstream/openRepoShape | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/contracts/openreposhape-pin.yaml b/contracts/openreposhape-pin.yaml index 46460294..eea57fb5 100644 --- a/contracts/openreposhape-pin.yaml +++ b/contracts/openreposhape-pin.yaml @@ -51,12 +51,12 @@ source_repository: opensoft/openRepoShape submodule_path: upstream/openRepoShape materialization: mounted -commit: "7f84ca42ca86a8902928345109d2bf6bad87bd91" +commit: "190133d5e704e380c430f87ca9c4e31746de0012" revision_kind: commit digest_algorithm: sha256 digest_definition: sorted-ls-tree-r-v1 digests: - tree_sha256: "3be52767e727d924dd05f9e78b18eb70f1682fe48614fab519f85331eeff5fa8" + tree_sha256: "7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912" verify_pin: tests/test_upstream_pin.py diff --git a/upstream/openRepoShape b/upstream/openRepoShape index 7f84ca42..190133d5 160000 --- a/upstream/openRepoShape +++ b/upstream/openRepoShape @@ -1 +1 @@ -Subproject commit 7f84ca42ca86a8902928345109d2bf6bad87bd91 +Subproject commit 190133d5e704e380c430f87ca9c4e31746de0012 From 0af03bc4e99f967e476a86510e10291289d33459 Mon Sep 17 00:00:00 2001 From: Brett Heap Date: Sat, 17 Oct 2026 21:57:13 +0000 Subject: [PATCH 2/2] tests: cite openRepoShape's --install pointer at the new pin, line 547 of 190133d The docstring of test_r01_composed_the_documented_one_liners_resolve_through_the_root_entry_point cited the pointer as openRepoShape:280 at 7f84ca4. At the pinned 190133d the same line is 547, and its bytes are unchanged: cmp <(git show 7f84ca4:openRepoShape | sed -n 280p) \ <(git show 190133d:openRepoShape | sed -n 547p) # equal So the test's BYTE FOR BYTE claim still holds, and only the citation moves with the pin. A docstring-only change: the test's pipeline string is untouched. Part of #186. Co-Authored-By: Claude Opus 5.5 --- tests/test_install_payload_source.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_install_payload_source.py b/tests/test_install_payload_source.py index 97bd7bb0..570bf9f0 100644 --- a/tests/test_install_payload_source.py +++ b/tests/test_install_payload_source.py @@ -919,7 +919,7 @@ def test_r01_a_single_repository_by_gh_asks_for_files_and_nothing_else(tmp_path) @pytest.mark.parametrize("line", ["openRepoShape", "gh"]) def test_r01_composed_the_documented_one_liners_resolve_through_the_root_entry_point( tmp_path, line): - """openRepoShape's own `--install` pointer (openRepoShape:280 at 7f84ca4) + """openRepoShape's own `--install` pointer (openRepoShape:547 at 190133d) and README's `gh api` line, BYTE FOR BYTE, against an assembly whose root carries the real entry point: the root resolves `main` ONCE, reads the code pin there and hands every argument to the pinned implementation, which