Repository navigation
t27os: GODMODE host effects spec, append_line and worktree add/status/remove (Refs #12945) - #13246
Merged
Merged
Conversation
…/remove (Refs #12945) specs/t27os/godmode_host.t27 (module T27osGodmodeHost), spec only, not pushed: - gm_append_line: open(O_WRONLY|O_APPEND); creat(0644) only on ENOENT, then close and reopen; one write(2) per row; close. Row shape checked (2..4096 bytes, one trailing newline, no NUL). One writer at a time. - gm_wt_add / gm_wt_status / gm_wt_check / gm_wt_remove: /usr/bin/git through posix_spawn with fixed word lists, no shell, a fixed minimal env (PATH=/usr/bin:/bin, LC_ALL=C), stdin/stderr on /dev/null, CLOEXEC_DEFAULT, silence timeout with SIGKILL, SIGCHLD default for the run and restored after. - add refuses a path failing gm_path_syntax_ok (reused, no second check) or starting with "-", a branch or base starting with "-", and less than 5.4 GiB free (statfs of the working directory). - status runs status --porcelain=v1 --untracked-files=all and judges it with gm_changes_verdict; quoted paths fail closed. - remove never passes --force, then proves the worktree is gone from disk (open fails with ENOENT) and from git worktree list --porcelain. Not here: fsync, CLI glue, PTY host changes, Rust. C imports stay private because pty_sys.t27 is sealed. 28 tests (8 faked_), each with a negative control; tests resting on hand-written host output are named faked_. t27c typecheck: 0 errors. check-calls: no finding in this file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…efs #12945) Owner review rulings applied to specs/t27os/godmode_host.t27, spec only: - O_NOFOLLOW on both journal opens (GH_APPEND_FLAGS 9 -> 265); a link at the path is ELOOP, HR_OPEN, never a create. creat(2) takes no flags, so it runs only right after an O_NOFOLLOW open saw ENOENT; the window between the two calls is documented, as is last-component-only. - The remove probe opens with O_RDONLY|O_NOFOLLOW (GH_PROBE_FLAGS), so a link left at the worktree path is HR_LEFT, not "gone". - git stderr is appended to a log the runner names (O_WRONLY|O_APPEND|O_CREAT|O_NOFOLLOW, 0644), not /dev/null; the gm_wt_* fns take logp, checked with gm_path_syntax_ok. - Environment set explicitly: PATH, LC_ALL=C, HOME=/var/empty. - gh_base_ref maps the contract default `current` to HEAD. - One flag check, gh_open_flags_ok(f, creat), replaces gh_flags_append_only. - Header documents: process-wide SIGCHLD swap, cwd = repository root, the branch left behind after remove (known limitation), dirty worktree = HR_EXIT, 7 argv words without -- or -c, t27b as the build backend, the post-checkout hook checked only in a T27 OS pane, and that gm_validate E006 and gm_row are not repeated here. 32 tests (8 faked_), each with a negative control. t27c typecheck: 0 errors. check-calls: no finding in this file. dupe_scan: 690 groups, unchanged. Not proof of host behaviour: real effects only in a live pane run on the owner's word. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
#12945) t27c lowers `_ = f(x)` inside a test block to `var _ = f(x)`, which Zig rejects ("'_' used as an identifier"), so `t27c test-report` reported the spec BLOCKED and spec-guards failed. faked_statfs_bytes now asserts the offset put_u64 returns (at + 8). Found with zig ast-check on t27c gen. Refs #12945 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
PR DashboardGenerated at: 2026-11-07 10:53:48 UTC
Summary
Seal Status
|
This was referenced Nov 7, 2026
gHashTag
marked this pull request as ready for review
November 7, 2026 14:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Host effects for GODMODE v1, the second vehicle after the spec layer (#13224, merged as
8f1e1ad). One new file,
specs/t27os/godmode_host.t27(moduleT27osGodmodeHost),spec only: no Rust, no CLI glue, no PTY host change.
What it does
gm_append_line: appends one journal row. Opens withO_WRONLY|O_APPEND|O_NOFOLLOW;a link at the path is
ELOOPand givesHR_OPEN.creat(0644)runs only right afteran open that saw
ENOENT, then the file is reopened. Onewrite(2)per row. Row shapeis checked: 2..4096 bytes, one trailing newline, no NUL.
gm_wt_add/gm_wt_status/gm_wt_check/gm_wt_remove: run/usr/bin/gitthrough
posix_spawnwith fixed word lists (at most 7 words, no--, no-c), noshell. The environment is exactly
PATH=/usr/bin:/bin,LC_ALL=C,HOME=/var/empty. stdin is/dev/null, stdout a pipe, stderr appended to a log therunner names (
O_WRONLY|O_APPEND|O_CREAT|O_NOFOLLOW, 0644), outside the worktree.CLOEXEC_DEFAULT, silence timeout withSIGKILL.gm_path_syntax_ok(reused, not repeated), a path, branchor base starting with
-, and less than 5.4 GiB free. The contract default basecurrentmaps toHEAD.status --porcelain=v1 --untracked-files=alland judges it withgm_changes_verdict; quoted paths fail closed. A dirty worktree givesHR_EXIT.--force, then proves the worktree is gone from disk (anO_RDONLY|O_NOFOLLOWprobe seesENOENT) and fromgit worktree list --porcelain.gm_validateE006 andgm_rowchecks are not repeated here.Known limitations (accepted in review)
creat(2)takes no flags: a 3-argumentopenis variadic and the extern ABI passes novariadic mode. So a link planted between the
ENOENTopen andcreatis followed, andcreattruncates, so racing writers can lose a row. One writer at a time closes both.O_NOFOLLOWguards the last path component only.SIGCHLDswap is seenby every thread, so
gh_runis called from one thread at a time.Build and tests
@externto a stub, so under t27c the testsreach only the pure fns.
named
faked_. Not run yet (no test runs on the Mac).t27c typecheck(0 errors),t27c check-calls(no finding in this file, total 51 unchanged), duplicate-name checkagainst the imported specs (22 intended imports). Before the rebase:
dupe_scan(no newgroup) and lefthook pre-commit (foreign-budget, own-language, gitleaks, commit-msg).
duplicate-bodies,scanandDocumented t27c subcommands existare red on masterat 8f1e1ad; expect the same here.
Not proof of host behaviour
Real effects (git worktree, PTY, command execution, the post-checkout lefthook hook) are
checked only in a live T27 OS pane run, on the owner's word.
Not here: fsync (split off), CLI glue, PTY host changes, Rust.
Refs #12945
🤖 Generated with Claude Code