stack/agents/gander/work/v574/BUILD.md

Vikunja574: deterministic fixture Git before/after comparisons

Owner Gander, gate Sage. mos-1369 A4 and mos-1370; sage-3107 and sage-3110. Take574 before573, as separate candidates. Base062646487451993302c768c6812b827c834e952b (origin/refactor at start), branchgander/v574. No queue move before Sage places the row. Build/push authorized now; every test/proof run waits Sage CLEAR after270+271 run5. Row292 remains independently held for final base and C1 review.

Exact authorized delta

Only prepend -c maintenance.auto=false -c gc.auto=0 to each fixture helper's Git argv. No production change, environment change, assertion change or fingerprint/snapshot change. Full-root comparisons still include .git. Production checkout.mjs's SAFE argv already contains both flags; gitEnv() alone does not. The helper called gitEnv() but skipped SAFE.

• packages/seat/tests/checkout.test.mjs:git34-35 commits fixture roots; once():88-91 fingerprints root including.git. Whole clone comparison246-249 also covers it.
• packages/seat/tests/working.test.mjs:git27-28 commits fixture repositories; fingerprint():40 and refusal checks83-86/120-122 cover the whole root.
• packages/cli/tests/git-socket.test.mjs:gitIn32-33 commits projects; fingerprint():43 and once79-101 cover project/.git.
• packages/cli/tests/lifecycle.test.mjs:gitIn47-49, commit71; snapshot459 walks every regular file, T11 compares pb.root831/839 including project/.git. Outside original list, explicitly authorized sage-3110 / mos-1370 before editing.

Static preservation check removes only the four inserted argv elements from each candidate file and requires exact equality with its base blob. Thus every original assertion, fingerprint and snapshot byte stays intact. No new tests mirror the flags; runtime evidence is the requested trace over real fixture commits and whole files.

Named but unchanged

• bus/grant-enroll.test.mjs imports fingerprint from host-grant.mjs for SSH host keys. No fixture Git helper or Git command; unchanged.
• bus/grant-executor.test.mjs uses SSH-key fingerprints; its commit references are grant transaction steps, not Git fixture commits. No Git helper; unchanged.
• bus/host-tools.test.mjs:28 hashes decoded SSH public-key bytes. No Git helper; unchanged.
• conversation/reader.test.mjs:52/71/73 fingerprints session fixture files, but creates no Git repository and makes no Git call. Unchanged.

Other fixture audit, screened and unchanged

• cli/lifecycle.test.mjs: whole-root .git snapshot is exposed; now included by explicit scope ruling above.
• cli/launcher.test.mjs: fixture commits, but the before/after byte check961-971 names the sessions JSON file, not the repository tree or Git object directory. No maintenance-lock fingerprint exposure in that comparison.
• cli/thread-launch.test.mjs and session-launch.test.mjs: fixture repositories, but compared before/transcripts/events/session-store values are application histories or evidence directories, not a whole .git tree. Unchanged.
• cli/publish-socket.test.mjs and seat/publish.test.mjs: fixture commits, with ref values and fake-Gitea request/credential assertions. No whole-root fingerprint/snapshot; unchanged.
• seat/landing.test.mjs: fixture commits support gate/root-path checks. The tree() helper builds a fixture and comparisons concern gate steps/results and output, not a whole-root byte inventory. Unchanged.
• harness/git-tools.test.mjs: fixture commits support advertised object/ref and request assertions; no source-root byte fingerprint. Unchanged.
• project/project.test.mjs, human-file.test.mjs and read.test.mjs: before/after checks use HEAD/status, spec content, or a record path; no full .git inventory including maintenance.lock. tester-init.test.mjs checks created records and identity. Unchanged.
• bus/project-files.test.mjs via spec-fixtures.mjs: state() compares rev-parse HEAD and status --porcelain; detached maintenance changes neither asserted logical value. Unchanged.
• library/mirror.test.mjs and sync.test.mjs via helpers.mjs: before/after byte checks name the sync-state file; comparison does not inventory Git objects/maintenance.lock. Unchanged.
• cli/stack-copy.test.mjs: tree() compares published copies, which exclude source .git; source fixture already configures gc.auto0. No whole-source-repo .git fingerprint. Unchanged.
• cli/stack-release-fixture.mjs and release tests: fp() compares unit, wrapper, pointer and store bytes, and tree() comparisons cover data/copies; source fixture.git is outside those roots and already sets gc.auto0. Unchanged.
• webui/pinned-copy.test.mjs: fixture commits and gc.auto0; before/after assertion names config bytes and copied output, not source.git inventory. Unchanged.
• queue/store.test.mjs via helpers.mjs: snap337 compares queue/view/.git/mosaic-queue.head only, not object/maintenance-lock paths. review tests compare request/log records. Unchanged.
• ledger/ledger.test.mjs: Git fixture history is read as logical commits/timestamps, no whole-root .git fingerprint comparison found. Unchanged.

This is an audit of fixture before/after comparisons, not a claim every unflagged fixture Git helper is fixed. No outside named scope was changed without approval. Mos's provided probe /mnt/storage/scratch/mos-1369/maint-lock-probe.py was read only, never executed.

Trace and gate plan, no execution yet

Real Git: /usr/bin/git, git version 2.55.0 (read-only version query). gitEnv() retains PATH and scrubs outer tracing env, so an outer GIT_TRACE2 alone would be vacuous. On CLEAR create an executable git shim in own scratch, outside the candidate. It only exports GIT_TRACE2 to a per-run absolute trace path and execs /usr/bin/git with the unchanged argv. The candidate contains no shim.

Positive control first: a fresh fixture-style repo/commit WITHOUT either flag, traced through that shim, must show a maintenance child_start. Do not accept a missing/empty trace as success. Allow the detached positive-control child to finish and verify its scratch repo is idle before the flagged proof.

Flagged control and four touched files whole then use the shim. Require observed fixture commit commands in each applicable trace and zero maintenance child_start. Classify a maintenance child by the trace's child_start and maintenance run --auto command, not by a substring in this plan. Save the raw trace, tested SHA, exact command/timeouts, command/child counts, and restored-tree check. No assertion weakening or .git exclusion is allowed. Any old red, timeout, maintenance child, or missing positive control stops for Sage/Mos before a retry.

Recommended slot scope: positive/flagged fixture control plus the four touched files whole with GIT_TRACE2, and any broader seat/CLI suite Sage requests. Record per-file timeout-k10 at least3x successful historical whole-file receipt with headroom before launch; use900s where timing is unknown. TMPDIR from mktemp-d /mnt/storage/scratch/tmp/gXXXXXX, never /tmp. Pipefail/tee and busy check before each start. Trace runs are test work and are not authorized before CLEAR. No dependencies installed and no live ports/units/config accessed. Session registration remains Sage's.

Filbert static approval and proof refinements

filbert-v574-7da38224-gander statically approves source65e919e5c / packet7da382244 / manifestcdda41f5. No runtime proof yet. Their independent audit found no missed fixture within the whole-root .git race class.

P1: checkout and working tests resolve command-v-git when loading their own command wrappers. The trace shim therefore lives in a stable absolute scratch bin directory for the entire run, including fixture hooks. It chains only to /usr/bin/git2.55.0 and is not deleted until all calls and detached children finish.

P2: add GIT_TRACE2_EVENT alongside GIT_TRACE2 in the scratch shim, pointing at a per-run directory. Git writes one JSON event file per process, avoiding interleaved event lines. Count child_start argv tokens for maintenance/run/--auto exactly and report actual fixture commit start counts alongside zero maintenance. The shim only sets tracing variables and execs the real git; no Git argv/config or candidate file is changed by tracing.

P3: both positive and flagged controls call the real gitEnv() from checkout.mjs, with PATH resolving that same shim. A shell-only unflagged commit is not sufficient. Positive requires observed fixture commit and maintenance child_start; flagged requires observed fixture commit and zero such child. No missing/empty trace counts as a pass.

P4: after each traced whole file, wait for no git process whose /proc cwd is under that run TMPDIR, including deleted cwd, before counting. Detached maintenance could write events after Node exits. Save the cwd sweep and count trace only after the writer set is empty. A nonempty/unstable writer set is a stop, never silently ignored.

P5: green fingerprints alone are not the proof. The trace commit count and maintenance-child count are required for every changed suite.

Additional screened files from Filbert, unchanged: bus/publish.test.mjs lists JSON files only; discord/git.test.mjs checks .vault-locks only; stack-release-external checks named files and tree(e.state); queue/write.test.mjs lists gitDir entries filtered to .tmp. Shared helpers plugins/tests/helpers, runs/tests/helpers, conversation/tests/harness and case-sudo-fixture make no Git calls.

Follow-up note, outside574: product Git commits in queue/src/store.mjs, discord/src/git.mjs and harness/src/tools.mjs do not carry both maintenance flags. No whole-root .git fingerprint currently covers those roots. A future fingerprint test there must account for detached maintenance. This note authorizes no product change or assertion change here. working.mjs fetches at183/237/245 and harness git-tools fetch249 use --no-auto-maintenance; existing production checkout SAFE has both flags.

Row 293 execution window (sage-3130 / sage-3133)

Claim gander-293-start is rev 3400. The four manifest paths have no drift over 062646487..253346e3c; no rebase is needed. Start only when the one-minute load is below 4. Print HEAD, manifest, and the full seat/CLI test-file lists before execution. Scratch harness and stable Git shim live under /mnt/storage/scratch/tmp/g349BNE, outside the candidate. Controls import the actual gitEnv(), and both human and per-process JSON traces are injected only by the shim.

Order: unflagged positive control; flagged control; checkout, working, git-socket and lifecycle whole with traces; every seat test whole; every CLI test whole. Whole suites run as serial whole files, each using timeout -k 10 and pipefail/tee. This preserves whole-file coverage and avoids test-file concurrency adding load to the timing checks. Busy check precedes every start. The trace proof waits for no Git cwd below each run TMPDIR before counting commit starts and maintenance children.

Limits recorded before launch: controls 120 s; stack-release whole 2400 s; case1 whole 1200 s; every other whole file 900 s. The prior row 253 whole CLI stage took 1253.715 s in 3b91cfdaf's run5-gate/SUMMARY.json; this run uses individual whole-file bounds, not that aggregate bound. Case1's known 259.951 s receipt is below one third of 1200. The saved historical-cli-timings.json extracts all 55 CLI per-file receipts from that summary: stack-release was 683.647 s, so ceil(3x)+120 is 2171 s, below 2400; every other historical CLI file has ceil(3x)+120 below its chosen limit. Seat files and the newly added CLI file have no per-file receipt here and use the established unknown-file 900 s fallback. Outer controller wait is each limit +30 s. No timeout counts as a pass. Report status every 15 minutes, and stop for any unexpected red, missing positive control, maintenance child, or timeout.

Run 1 stop, 2026-10-23 02:31Z

Run 1 on 57862d614 stopped at the fourth traced file; seat/CLI whole stages never started. Controls are non-vacuous: unflagged 1 commit / 1 maintenance child; flagged 1 commit / 0. Checkout 78/0, working 27/0, git-socket 24/0, lifecycle 13/11; all 313 observed commits across the four files had zero maintenance children. No skips or timeout. Raw logs, commands, event streams, trace index, controller and final zero-cwd sweep are in run1/. These are incomplete gate results, not acceptance.

Static diagnosis in gander-0176: my harness nested TMPDIR by stage, making lifecycle's tools.sock path 120 bytes. session.mjs:278 refuses >107; launcher.mjs:472 calls it before spawning. A direct /mnt/storage/scratch/tmp/gXXXXXX TMPDIR gives 95. lifecycle.test requires a TMPDIR of about 50 bytes or less. Filbert concurred from source. No product/test/assertion change, no retry, and no harness correction pending placement/CLEAR. Slot returned at 02:31:13Z; all scratch cwd processes were gone.

Run 2 authorization and integrated candidate

sage-3138 classified run 1 as a harness fault, not a candidate/lifecycle red. Rebased under new branch gander/v574-r2 onto b23783f39, retaining the original branch. The four test files and session.mjs have zero upstream drift, and the four-commit range-diff is unchanged. Manifest cdda41f5 remains unchanged and all entries verify.

Run 2 starts over at P1 with nothing carried: controls, four traced files, all eight seat and 56 CLI files. Corrected harness allocates each stage's TMPDIR with mktemp -d /mnt/storage/scratch/tmp/gXXXXXX, directly in scratch; logs/traces remain separate. lifecycle's expected tools.sock path is 95 bytes, replacing run 1's 120, below the 107-byte product limit. This is a harness-only correction and no test or assertion changed. The previous pre-recorded limits remain. Start load under 4; any second red stops to Sage/Mos before any change. Integration and harness records are in integration-r2/.

Run 2 GREEN, 2026-10-23 03:06:43Z

Fresh on 6bfab273b / cdda41f5 under sage-3138, started at load 3.80. Controls pass; four traced files 153/0/0 in 45.855 s, seat whole 202/0/0 in 22.687 s, CLI whole 905/0/0 in 1367.764 s. Total window 1564 s. The integrated census is 10 seat and 58 CLI files: the new base added two files to each package; every printed file ran whole. No timeout, skip, cancellation or todo. Final cwd/Node/tee sweep zero. Every trace stage's Git writer set is empty before counting. Both flags occur on all 312 actual traced commits, with zero maintenance children; unflagged positive control has one commit and one maintenance child, flagged control one commit and zero children. Raw driver token-count 313 included one hash-object -t commit; cmd_name=commit reconciles it to 312 in TRACE-COUNTS.json, with no change to the zero-maintenance finding. Full logs, command/guard records, reconstructable raw traces, results and timings are committed in run2/. No prior run result carried and no product, assertion or fingerprint changed.