fix: preserve caller paths in the standalone operation runner

[flyingrobots]

Closes #755.

The standalone operation runner previously required a Git repository and changed into its root before parsing arguments. It now preserves the caller directory, so absolute artifacts work outside Git and relative artifact/WAL paths keep their intended meaning. Repository maintenance commands retain Git-root discovery. The README and CHANGELOG describe this boundary.

Docker RED: both new runner-directory tests failed at the expected behavior assertions on main da929ca6; the repository-command control passed. Docker GREEN: all 12 operation-runner tests passed, including the two new cases and the repository-command control. Workspace rustfmt and strict Clippy for the changed binary and integration-test targets passed.

A broader xtask --all-targets Clippy run failed on the existing, unchanged map(...).unwrap_or(0) expression in an unrelated xtask unit test. CI checks xtask binaries; the changed binary and witness targets are clean. This unrelated failure is retained as a validation limit and is not absorbed into this repair.

Canonical documentation review: README now names caller-directory behavior; operation/WAL semantics and artifact/receipt boundaries remain unchanged. No new product binary or application-specific core branch is added.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: flyingrobots/echo/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 723b53e7-0fb1-48bb-a17a-72ad74ae6b11

📥 Commits

Reviewing files that changed from the base of the PR and between da929ca and 4adb0e9.

📒 Files selected for processing (4)

• CHANGELOG.md
• README.md
• xtask/src/main.rs
• xtask/tests/run_edict_operation.rs

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T12:23:41.999188Z	4adb0e9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[flyingrobots]

Adversarial Independent Review: PR #765

• Repository: flyingrobots/echo
• Branch: fix/study-runner-cwd
• Head Commit: 4adb0e9757f125d390d8d74105e09998c41d0d1b
• Base Commit: da929ca6093977e909af20ef918e2431ad9b338c (origin/main)
• Issue Reference: Resolves Run xtask run-edict-operation without a Git checkout or directory change #755 ([FEEDBACK-echo.md] item 5)
• Review Snapshot: [retained evidence: pr765.json]
• Working Tree: the reviewed checkout (Clean checkout)

---

1. Findings and Identified Boundaries

Verified Defects (P0–P3)

None. Line-by-line inspection of the diff between da929ca6 and 4adb0e97 confirms that argument parsing now precedes Git root discovery, only Commands::RunEdictOperation bypasses directory mutation, all 15 maintenance commands retain Git root resolution, and no core authority, runtime, WAL, or artifact verification contracts are altered.

Hardening & Informational Observations (P4–P5)

• P4 — Pre-existing Lint in Unchanged Code
  • Location: xtask/src/main.rs:9163-9166
  • Scenario: Running cargo clippy -p xtask --all-targets -- -D warnings fails on SystemTime::now().duration_since(...).map(...).unwrap_or(0) with clippy::map-unwrap-or in collect_policy_matrix_rows_errors_on_malformed_policy_case.
  • Evidence: s02-green.log:38-58. The offending code predates PR fix: preserve caller paths in the standalone operation runner #765 (introduced in be1b2a69). CI enforces cargo clippy -p xtask --bins -- -D warnings -D missing_docs (.github/workflows/ci.yml:126), which excludes test binaries. Strict Clippy on changed targets (--bin xtask --test run_edict_operation) passed cleanly (s02-focused-clippy.log:1-3).
  • Resolution: Correctly retained as a non-absorbed validation boundary in the PR description without expanding scope.
• P5 — Binary vs. Cargo Invocation Semantic Distinction
  • Location: README.md:296
  • Scenario: A caller attempting to run cargo xtask run-edict-operation from outside a Cargo workspace will be rejected by Cargo itself before xtask executes.
  • Evidence: README.md:296 explicitly caveats this: "The built xtask run-edict-operation binary keeps the caller's working directory and can run outside a Git checkout... cargo xtask still requires a Cargo workspace."

Missing Evidence and Review Limitations

• Missing External Benchmark Data: The original benchmark raw traces from synapse-echo-experiments referenced in [FEEDBACK-echo.md] are external and absent from this checkout.
• Static & Docker-Evidence Review: No new host builds or Docker containers were launched during this audit per the authorization contract. Review relies on static code analysis and validation of the primary's immutable Docker receipts and manifests.

---

2. Mandatory Verification Checklist

Part A: Code Paths Traced

Path / Behavior	Base (da929ca6)	Head (4adb0e97)	Verification & Invariant Preserved
CLI Argument Parsing	xtask/src/main.rs:460 (parsed after find_repo_root)	xtask/src/main.rs:455 (parsed before root discovery)	Standard clap parser behavior: --help, --version, and invalid argument errors surface immediately without triggering git rev-parse.
Runner Git-Root Bypass	xtask/src/main.rs:454-459 (unconditional chdir)	xtask/src/main.rs:459-463 (!matches!(..., RunEdictOperation(_)))	Bypasses find_repo_root() and set_current_dir(). CWD remains the caller directory.
Artifact & WAL Path Resolution	xtask/src/run_edict_operation.rs:198-256	xtask/src/run_edict_operation.rs:198-256 (unchanged)	Paths from RunEdictOperationConfig resolve relative to caller CWD. Absolute paths function outside Git.
Maintenance Subcommands Control	xtask/src/main.rs:465-482	xtask/src/main.rs:465-482	All other 15 subcommands (Bench, Doghouse, PrStatus, LintDeadRefs, etc.) enter if block, discovering and chdiring to Git root.
Witness: Absolute Artifacts Outside Git	Unexercised in base; failed RED	xtask/tests/run_edict_operation.rs:153-180	outside_repo() creates temp dir outside Git. Probes git rev-parse failure, runs runner with absolute paths. Verified passing JSON witness.
Witness: Relative Paths in Nested Foreign Repo	Unexercised in base; failed RED	xtask/tests/run_edict_operation.rs:182-214	Initializes foreign git repo, runs from nested/, verifies nested/wal created and parent repo root has no WAL artifact.
Witness: Maintenance Command Git-Root Parity	Unexercised control	xtask/tests/run_edict_operation.rs:215-230	Executes xtask lint-dead-refs from scratch temp directory; verifies it finds Echo root and exits 0 ("all links OK").

Part B: Merges and Ancestry Audited

• Branch Head: 4adb0e9757f125d390d8d74105e09998c41d0d1b
• Target Base: da929ca6093977e909af20ef918e2431ad9b338c (origin/main)
• Merge Commits in PR History: Exactly 0. PR fix: preserve caller paths in the standalone operation runner #765 consists of 1 atomic commit (4adb0e97).
• Base Integration (PR docs: clarify reachable roots and detached-write evidence #762 at da929ca6) Invariant Check:
  • PR docs: clarify reachable roots and detached-write evidence #762 merged commit f246f071, clarifying reachable state roots and binding detached-write evidence in crates/warp-core/src/worldline_state.rs, docs/architecture/application-contract-hosting.md, and docs/topics/WAL.md.
  • All modifications from PR docs: clarify reachable roots and detached-write evidence #762, including the documentation entries in CHANGELOG.md:12, are preserved intact in 4adb0e97.
• Unmerged PR docs: record the study audit and experimental Keep roadmap #758 Check: No changes from PR docs: record the study audit and experimental Keep roadmap #758 are present or merged.

Part C: Constants and Numeric Claims Checked Against Evidence

Item / Claim	Declared / Expected Value	Raw Evidence Location	Measured Value	Status
Parent RED (Outside Git)	Fail on not inside a git repository	s02-parent-runner-red.log:2-3	Exit 1, Error: not inside a git repository	Verified
Parent RED (Nested CWD)	Fail on missing input.json	s02-parent-runner-red.log:4-8	Exit 1, os error 2 (No such file or directory)	Verified
Regression RED (2 Tests)	2 failed; 10 filtered out	s02-regression-red.log:35	0 passed; 2 failed; 10 filtered out	Verified
Regression Control Test	1 passed; 0 failed	s02-regression-red.log:45	1 passed; 0 failed; 11 filtered out	Verified
GREEN Test Suite Count	12 tests passed	s02-green.log:6-20	12 passed; 0 failed; 0 filtered out	Verified
Formatting Gate	cargo fmt --check exit 0	s02-green.launch.json:37 / s02-green.log:21	Passed	Verified
Focused Clippy Gate	Exit 0 on bin & integration test	s02-focused-clippy.result.json:9	Exit 0 (0.06s)	Verified
Build Cache Ceiling	$\le 21,474,836,480$ bytes (20 GiB)	s02-focused-clippy.result.json:3	$13,113,417,004$ bytes (~12.21 GiB)	Verified
Test Data Ceiling	$\le 4,294,967,296$ bytes (4 GiB)	s02-focused-clippy.result.json:4	$4,248,980,780$ bytes (~3.957 GiB)	Verified
Log Output Ceiling	$\le 134,217,728$ bytes (128 MiB)	s02-focused-clippy.result.json:5	$15,375,879$ bytes (~14.66 MiB)	Verified
Host Free Space Floor	$\ge 53,687,091,200$ bytes (50 GiB)	s02-focused-clippy.result.json:6	$730,078,806,016$ bytes (~679.9 GiB)	Verified
Docker VM Free Space Floor	$\ge 53,687,091,200$ bytes (50 GiB)	s02-focused-clippy.result.json:7	$693,893,111,808$ bytes (~646.2 GiB)	Verified

Part D: Documentation and Standards Compliance

• File SHA256 Integrity: Every one of the 964 files recorded in s02-green.manifest.json and s02-focused-clippy.manifest.json matches byte-for-byte with the current repository checkout at 4adb0e97 (0 discrepancies).
• Documentation Policy (docs/DOCUMENTATION_STANDARDS.md):
  • README.md:296 describes the operational boundary for xtask run-edict-operation and is formatted as one physical line per paragraph.
  • CHANGELOG.md:10 records the fix under ### Fixed as a single-line entry.
• Git Hygiene: No amended commits, no rebasing, no force pushes.

---

3. Verification Posture

• Checks Executed:
  • Full tree SHA-256 verification of 964 files against precommit manifests (s02-green.manifest.json, s02-focused-clippy.manifest.json).
  • Git commit graph, ancestry, and diff audits across da929ca6..4adb0e97.
  • Static analysis of main() control flow and run_edict_operation path consumption.
• Inspected Only (Primary Immutable Docker Receipts):
  • s02-parent-runner-red.log, .launch.json, .result.json
  • s02-regression-red.log, .launch.json, .result.json
  • s02-green.log, .launch.json, .result.json
  • s02-focused-clippy.log, .launch.json, .result.json
• Skipped / Unavailable:
  • No new Docker containers or host builds launched (read-only review constraint).
  • External benchmark traces from synapse-echo-experiments unavailable.
  • Power-loss and crash recovery beyond WAL state machine assertions not simulated.

---

4. Final Verdict

APPROVE

[flyingrobots]

Code Lawyer activity summary at 4adb0e9757f125d390d8d74105e09998c41d0d1b.

Claim	Evidence	Result
Absolute artifacts outside Git	Actual binary RED and expected new regression failure; GREEN JSON recovery/value checks	Passed
Nested caller-relative input and WAL paths	Expected RED missing-file error; GREEN creates WAL under caller and not foreign Git root	Passed
Repository command parity	lint-dead-refs control passes from a nested Echo fixture directory	Passed
Scope and compatibility	Inspected dispatch and all path consumers; no artifact, runtime, WAL or authority change	Preserved

All 12 operation-runner tests, workspace rustfmt, and strict Clippy for the changed binary/integration-test targets pass in Docker. Exact committed files match both candidate manifests. Broader all-targets Clippy fails on an unchanged unit-test expression; CI uses the binary route. That unrelated failure remains disclosed, not silently greened.

The clean-tree fetch, entire diff, caller paths, documentation, all paginated review discussions, current-head CI, and independent agy checklist were reviewed. No actionable PR finding remains. Independent agy verdict: APPROVE for this exact head. The already authorized merge still requires the final live head/CI check below.