[valentinyanakiev]

What changed

A bundle's identity stops at its own files.

• The walk skips .git and git-ignored trees, as it skips its other unpinned trees. It still searches them, so a file the compile consumes inside one is refused by name.
• One skip decision. It is made on the full relative path and shared by the walk, the consumed inputs and the pinned-script lookup.
  • .git at the top is git's metadata, decided before git is asked.
  • Git is asked check-ignore -- ./<rel>, so a path is a literal name, and a skipped tree's children inherit the answer.
  • If git cannot be asked (a failed discovery, or a check-ignore status other than 0 or 1), the bundle is refused by name with git's status and stderr. Brokkr never guesses.
  • A bundle outside any work tree skips only .git.
• The bounds: a bundle past 5,000 files or 64 MiB per pinned layer (both inclusive) is refused by name before any run starts. Both checks use one past_bound message.
  • The metadata preflight judges the walked paths' listed sizes.
  • The bound is enforced again on the bytes actually read:
    • an unconsumed entry is read through a cap at the budget left plus one byte;
    • a consumed entry is charged the length of the buffer it was pinned from, never its metadata;
    • a consumed read stops at the bound plus one byte;
    • an integrity re-read stops at the pinned length plus one byte.
• Decision 0083 gains a dated addendum (2026-10-29) and amendment (2026-10-31), both proposed.

Brokkr-Run: landing-pr-for-issue-908-bug-a-b-fdf84582

How it's held

• Story, then fix rounds: 908b, the discovery refusal and one full-path decision; 908c, ./<rel> and git's stderr; 908d, the bound on bytes read; 908e, consumed charges, capped consumed and integrity reads, the amendment, test isolation, the shrink and vanish regressions.
• 908d's own review never ran. OpenAI's cyber_policy filter refused its adversarial seat twice. The first landing, 908L, stood in for it and stopped at a security hold (C1-C5), which 908e fixed. 908e closed RESIDUAL-OK at LOW.
• This landing (908L2) closed REVIEW-RESIDUAL-OK at LOW, with no security residual and no specification defect. It ran with a Fable 5.1 chief and DeepSeek Flash as the adversarial member.
  • Its chief checked every read path for its cap, the one skip decision at all three callers, and the bounds.
  • Scope: no contracts/, fixtures/, policy/ or reference/ change; no witness pin moved; the API ratchet holds. bundle.rs shrank 4,593 → 4,533 lines and places.rs is unchanged at 800.
• Controller commits after 908e (each in its message, with removal controls):
  • 9c5a655, 908e's unsigned seat commit, signed with its tree unchanged;
  • 48ddd7f covers four lines and one branch: pinned_key's git-metadata arm, first_name and relative_text's None arms, and git's silent refusal;
  • 6ca6470 fixes a test comment (908e's INFO F2).
• Tests: runtime lib 1,478; witness and frozen 24; queued_launch 8; CLI 68; recipes/self compiles with 0 unruled valuations.
• Lints: fmt, clippy, typos, and the file, clone and API ratchets.
• Coverage: exact coverage covered every line (78,686), branch (9,760) and function (10,553), with every test passing.

Commits since the landing

The landing vouched 6ca6470. Two controller commits followed it:

• 4be15ab, test only. The landing's host coverage covered every line and branch, but only 10,552 of 10,553 functions. The miss was the walk's own refusal closure at walk.rs:84: every git-failure test was refused earlier, at the declaring document's consumed read.

  • a_check_ignore_failure_during_the_walk_refuses_by_name corrupts .git/index as the walk lists the bundle's root, so the walk's own question fails and is refused with git's words.
  • Removal control: a walk that reads a failed decision as "not skipped" lets the compile succeed and fails the test.
  • The coverage figures above are for this head.

• 8b2d529, docs only (the landing's LOW F2). 0083's addendum said the preflight runs "before any byte is hashed", and the amendment said "before any byte is read". Both were overbroad: the consumed inputs are already read, each through its own cap, before the walk's preflight. Both now say "judged from the walked paths' listed sizes alone, before any walked byte is read or hashed". No bound, refusal or ruling moves.

• a11934f, test only, after the PR's CI. The macOS leg failed two tests that pinned Linux's spawn error for a git started in a file ("Not a directory (os error 20)"); macOS reports "No such file or directory (os error 2)". The refusal is the same on both hosts. spawned_in_a_file() names each host's words, and both tests keep exact pins.

• c3cec85, production (operator, 2026-11-01). The Ubuntu leg failed writer_lease and machine_proof::release. CI's temporary bundles sit under the repository's git-ignored target/, so git called every path ignored, bundle.json included. A bundle whose own root git reports ignored is now judged as a bundle outside any work tree: git_ignored asks check-ignore -- . first. Git's ignore question moved to places/ignored.rs (places.rs 800 → 714), and 0083's addendum says it.

  • a_bundle_inside_an_ignored_tree_of_its_repository_pins_its_own_files holds it, with a removal control.
  • The fresh landing landing-pr-for-issue-908-bug-a-b-fdf84582 judged the whole branch at c3cec85 and closed REVIEW-RESIDUAL-OK at LOW. Its chief checked every read cap, the one skip decision at every caller, and c3cec85 against git 2.51 in a scratch repository. Its one finding is the carried test-isolation LOW (tests: the repository-root bundle tests hold their verdict under an inherited GIT_CONFIG_COUNT (#908 F1) #936).
  • Exact coverage on this head covered every line (78,695), branch (9,762) and function (10,554).

Rulings asked (ruled 2026-10-31, as recommended)

1. (a) The git-ignored rule's exact semantics, as above. Recommended: accept as built.
2. (b) The bounds: 5,000 files and 64 MiB, inclusive per pinned layer, enforced by the metadata preflight and on the bytes actually read, with one refusal. Recommended: accept.
3. (c) Decision 0083's 2026-10-29 addendum and its 2026-10-31 amendment, proposed, with 8b2d529's wording. Recommended: accept.
4. (d) Whether a repository-root bundle stays reachable (the story's question 3). Bundle::compile reaches a repository root and applies the skip, as the tests prove.
   • The CLI's compile checks the layout of the workspace's root, not --bundle's path. So brokkr compile --bundle ., run inside a non-library repository whose root holds bundle.json, is refused by 0083 ruling 4, as it already was before this branch.
   • The same bundle named from another workspace compiles.
   • Recommended: accept that statement as built, with no change here.
5. New: the two commits since the landing. Either the operator's by-hand label for 4be15ab (test only) and 8b2d529 (docs only), or a new landing run on this head. Recommended: the by-hand label, as ruled for protocol: an idle run driver walks its own tree to detect, and one full snapshot attributes (#918) #931's test-only coverage commit.
6. Carried LOW F1 (test isolation, decision 0071 ruling 9), as a follow-up.
   • What fails: a test process that inherits GIT_CONFIG_COUNT/GIT_CONFIG_KEY_0/GIT_CONFIG_VALUE_0 pointing core.excludesFile at a file that lists roles/ fails a_repository_root_bundle_pins_neither_git_nor_an_ignored_tree. The adversarial member saw queued_launch::a_nested_folder_made_after_queueing_refuses_the_start fail the same way.
   • Production is right and refuses by name. The fix is test-only: the hardening must cover the process that runs Bundle::compile.
   • Recommended: a follow-up issue. Filed as tests: the repository-root bundle tests hold their verdict under an inherited GIT_CONFIG_COUNT (#908 F1) #936.

Ruling: operator 2026-11-01, in chat, "go with recommended" (#908, #908 (comment)): a bundle whose own root git ignores is judged as a bundle outside any work tree; a fresh landing re-judges the branch
Ruling: operator 2026-10-31, in chat, "push it by hand" (#908, #908 (comment)): the by-hand label also covers the test-only a11934f, the macOS spawn error pin
Ruling: operator 2026-10-31, in chat, "go with recommended" (#908, #908 (comment)): (a)-(d) as built, 0083's addendum and amendment with 8b2d529's wording; the by-hand label for the test-only 4be15ab and the docs-only 8b2d529; F1 a follow-up (#936)
Ruling: operator 2026-10-31, in chat, "go with recommended everywhere" (#908, #908 (comment)): fix round 908e for C1-C5
Ruling: operator 2026-10-30, in chat, "go with recommended" (#908, #908 (comment)): fix round 908d, the bound enforced on the bytes actually read
Ruling: operator 2026-10-30, in chat, "go with recommended on all the rulings" (#908, #908 (comment)): git is asked with ./<rel>; a check-ignore failure keeps git's stderr
Ruling: operator 2026-10-29, in chat, "go with recommended on the rulings" (#908, #908 (comment)): the walk skips .git and git-ignored trees and still searches them for consumed files; a bundle past a file-count or byte bound is refused by name before any run starts

Notes for the operator

• INFO, not carried as defects:
  • git_ignored's --stdin parenthetical is half-wrong on git 2.51;
  • two git spawns per entry, with batching headroom;
  • the ignored-charter refusal's pre-existing "move it to … such as roles/" hint reads oddly when roles/ is the ignored tree.
• Commit signatures could not be verified from the review seat (no GPG helper there). The host verifies them: every commit on the branch is signed.

Fixes #908.

🤖 Generated with Claude Code