Repository navigation
🚑 fix: sdk: Isolate updater Git state - #469
Merged
Merged
Conversation
Record the first-command conditions for trash, core diagnostics and tool credit in COR-629 through COR-631 Keep the global flags contract aligned with current core and transcript output
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
pascalandy
changed the title
Keep the no-code scope while naming the existing catalog overpromise in the conditional diagnostics idea
Resolve template links with the Copier revision and bundled links with the running ncly version Replace the private modeling skill reference with public steps and reject blob/main links in pinned sources
pascalandy
force-pushed
the
epic16-session-id-1-update-environment
branch
from
November 4, 2026 02:31
7ef8e87 to
d1200c0
Compare
pascalandy
force-pushed
the
epic16-session-id-1-privacy-limits
branch
from
November 4, 2026 02:31
74f0b6c to
3efdda2
Compare
pascalandy
force-pushed
the
epic16-session-id-1-update-environment
branch
2 times, most recently
from
November 4, 2026 04:34
dfdec32 to
c580c4f
Compare
- Purpose: keep the moved overview readable as a standalone paragraph - Impact: state the template behavior with complete sentences
Read the final ERROR record before diagnostic truncation so sign-in refusals cannot inherit a temporary warning Keep network failures retryable and name the browser setting in the download failure hint
Refuse invalid outputs and missing keys before generating and opening an unnamed run Keep named-run locking and verified completion replay ahead of attempt checks without deleting lock files
Distinguish the executed preparation checks from the dry-run calls in the same Verify feature
- Purpose: Prove the existing-run answers after successful unnamed preflight - Impact: Fix only the generated ID in a test subprocess; preserve normal call ordering and saved bytes
Require an explicit accepted limit ID tied to every matrix row of its privacy case while retaining independent output and bad-variant checks Keep private text searches strict and reject missing, unrelated, duplicate or placeholder limit bindings
Move the seven acceptance rules unchanged to their own linked page before extending their privacy condition
Require the accepted Limit row and every matrix row to name the same Output case Keep the independent metadata reader and missing-acceptance controls strict The unrelated hotel-network limit now fails even when the matrix names its ID
Keep the ordinary private-text negative control and route accepted retention through the scoped limit contract
- Purpose: Reject an accepted limit whose text contains only bindings, its ID or placeholders - Impact: Name missing Limit text and share the Output grammar while keeping independent artifact checks
- Purpose: keep an unfinished limit from suppressing the private-text check - Impact: reject None or Fill: parts anywhere in the Limit cell, with public regression controls
- Purpose: make the contract describe the actual limit and private-text checks - Impact: condition generic privacy examples and define the whole-part placeholder rule
pascalandy
force-pushed
the
epic16-session-id-1-update-environment
branch
from
November 4, 2026 06:14
c580c4f to
d2f6629
Compare
pascalandy
force-pushed
the
epic16-session-id-1-privacy-limits
branch
from
November 4, 2026 06:14
42d2669 to
a172b1c
Compare
Correct the final review's remaining documentation and comment claims. Keep executable behavior unchanged.
Remove caller GIT_* state from every update program and check the owned package trees with exact reader allowances
Preserve the all-GIT-variable update contract while giving Copier a scratch HOME fallback Document that the shared helpers also serve check, contract and readiness probes
- Purpose: describe the implemented environment readers without an exclusivity claim - Impact: label current command behavior accurately and retain caller-setting rules
Correct the final review's remaining documentation and comment claims. Keep executable behavior unchanged.
pascalandy
force-pushed
the
epic16-session-id-1-update-environment
branch
from
November 4, 2026 06:45
d2f6629 to
54bb169
Compare
Name every GIT_* variable and use the existing check and readiness terms.
Owner
Author
|
Note 🤖 GPT-6.1-Sol responding on behalf of @pascalandy Final owner-gate evidence for Signoff36 passed all six remaining heads in one invocation on om1, 06:16:23–07:39:36 America/Montreal on 2026-11-04. Recipe, token reader, private supervisor, pipeline and launcher all exited 0. This head's new status ID is Tests used a private D-Bus session and recipe umask The complete layer log follows. Host-specific paths are normalized. Release output belongs to disposable test fixtures, not a Nicely release. Earlier failed invocations remain historical evidence rather than passing retries. Raw layer-log SHA-256: by GPT-6.1-Sol via Codex |
pascalandy
changed the base branch from
epic16-session-id-1-privacy-limits
to
main
November 4, 2026 13:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outside the plan: Pascal assigned this Epic 16 correction on 2026-11-03.
A caller's
GIT_*settings could redirect the updater and Copier's nested Git calls to another repository. Both updater launch paths now use one explicit environment builder that removes everyGIT_*entry and preserves other settings. The analyzer checks owned packages and descendants at a slash boundary. Its allowances apply only to the exactNewOwnedRun,updateEnviron,guard.stageandfake.runowners.The real updater regression uses two repositories it creates under TMPDIR, plus Copier/Go/check stubs. Before repair, Copier's real Git ref write changes the second fixture and sees inherited Git variable names. After repair, the target receives the copied output and pin/check results, the stubs see no
GIT_*, and the second repository's refs, HEAD, index, config and tracked contents are identical. Real-clonefor-each-refandworktree list --porcelainoutputs are identical before/after each red and green probe; no poison variable targets the clone or any run checkout.Analyzer cases cover a descendant, a similar prefix, the two exact intentional readers and forbidden sibling/descendant functions. All focused tests, lint, limits and plan checks pass. Pinned documentation rule S65 moved into its own file as a neutral prerequisite split.
Closes #444
Real-clone protection readback: each exact command below ran outside the poisoned test subprocess. Both captured stdout files in each pair compare byte-for-byte (exit 0). The full inventories are retained through validation; the two scratch checkouts have been removed without force.
git -C /home/pascal/projects/nicely for-each-refc83f2b468981e5d71084a07ffe26b3f389693e2931725890e37d72914f214d41c83f2b468981e5d71084a07ffe26b3f389693e2931725890e37d72914f214d41git -C /home/pascal/projects/nicely worktree list --porcelaind7639ebf69756ef37626a357b8c1c6a2213bef8c50319c8b9eb72ce1f6ec1339d7639ebf69756ef37626a357b8c1c6a2213bef8c50319c8b9eb72ce1f6ec1339git -C /home/pascal/projects/nicely for-each-ref42ec2bc0a72f8238fa2247fc174c7bd6a8660b24acdf83211e78ab631a77d05b42ec2bc0a72f8238fa2247fc174c7bd6a8660b24acdf83211e78ab631a77d05bgit -C /home/pascal/projects/nicely worktree list --porcelaind7639ebf69756ef37626a357b8c1c6a2213bef8c50319c8b9eb72ce1f6ec1339d7639ebf69756ef37626a357b8c1c6a2213bef8c50319c8b9eb72ce1f6ec1339Earlier-head CI: full
just checkpassed at7ef8e87b14a78edfd1c4dd8dfdb08ed6dfd96725(workflow check).Independent Verify evidence
Verify is n/a for a core ncly feature. The affected
just updateis the generated extension-repository recipe, not a recipe of this core checkout. The regression uses a Copier stub and real Git against two repositories created under TMPDIR. It checks the second repository independently, before and after, and exercises the two allowed readers plus owned-path boundaries through the analyzer tests. These run injust check. No real clone is a poison target. The core checkout's lack of an update recipe does not remove that regression requirement.First-pair fixes and new-head evidence boundary
Previously recorded layer head:
d1200c0adf9f163654a7030822bc2e4023c0d36b. Earlier CI, owner-status and Verify quotes below describe their explicitly recorded earlier heads. They do not certify this new head. New-head full checks and fresh affected Verify are pending.Keep the issue's removal of every GIT_* variable. Isolate template-test through a scratch HOME as well as its scratch config so child Git cannot regain the user's global config after GIT_CONFIG_GLOBAL is removed. Document the shared helper's existing check/contract/readiness scope. The poison test passes with both poison targets created under TMPDIR and the independent second repository unchanged.
Real-clone inventories immediately before and after the poison test were byte-identical. The captured equality record is:
{ "head": "42c743ff669529be3c16642fe9792031d37df357", "test": "go test ./sdk/extensionrepo -run ^TestUpdateDropsCallerGitEnvironment$ -count=1", "test_exit": 0, "refs": { "command": "git -C /home/pascal/projects/nicely for-each-ref", "before_bytes": 437571, "after_bytes": 437571, "before_sha256": "3c0ac621e236ec6579b382245617f811b54e0546cb8eed97c843b236e3a235da", "after_sha256": "3c0ac621e236ec6579b382245617f811b54e0546cb8eed97c843b236e3a235da", "cmp_exit": 0 }, "worktrees": { "command": "git -C /home/pascal/projects/nicely worktree list --porcelain", "before_bytes": 9845, "after_bytes": 9845, "before_sha256": "bd0e2cc96c878ef6fb50fb66772eb129c5a114db2b86baccc6da11601bc2a4f0", "after_sha256": "bd0e2cc96c878ef6fb50fb66772eb129c5a114db2b86baccc6da11601bc2a4f0", "cmp_exit": 0 } }Then-current layer head:
dfdec32b4510760de753cd4e52457e73fb7fdc15. The stack is clean and pushed. Earlier proof retains its explicitly recorded source; new-head checks, final owner statuses and the remaining review passes are still required.Then-current validation layer head:
54bb169e50836ae7dd6fc004f31968dea2d2c446. Earlier progress entries name historical heads. The extra final fix-only passes, new-head required checks and owner statuses remain pending. The stack is not Ready.The final-pair corrections are confined to their owning documentation, template text and comments. Existing proof keeps its recorded tested head; a bounded independent supplement will close Verify22's missing live restoration comparisons and README copy. The new #468 and top dependency intersections and protected-path hits are empty under Chef's receipt-retention rule.
Earlier candidate reconciliation
Candidate layer head:
314ac75d2f9a03fc6920e43228e8f9cb3a3a30e8. This update preserves historical proof at its named source. Final-head CI and recipe owner statuses remain pending; steps 5 and 8 stay unticked. The final extra reviewers found no critical or warning issue at c1ded76. Their last comment and terminology proposals were applied by the Cook afterward and have no additional barrage review.Final frozen-head validation
Ready for Chef validation at
314ac75d2f9a03fc6920e43228e8f9cb3a3a30e8. This section supersedes pending-state statements in the historical progress entries above. All nine heads are frozen, clean and pushed. Every final head has passing CI and a successful recipe-owned signoff status. CodeRabbit auto review is disabled and its check is skipped, not an approval. The recorded barrage reviews are complete.CI at this exact head: passing Check 1. Owner status:
signoff=success, ID58038458760. Complete owner-recipe evidence and layer log.The final checks cover the poisoned-Git-environment regression and exact package/function analyzer allowances. Every caller GIT_* variable is removed; other caller settings retain the stated contract.
The final-top macOS check passed all 11 checks at 531b3b4. Historical failed runs remain recorded, with Chef dispositions and follow-ups. The last comment and terminology corrections after the exhausted final barrage pair have no additional barrage review. The keyring behavior repair has old-red/new-green regression evidence and independent final-head Verify29. No further source changes followed those checks.
by GPT-6.1-Sol via Codex