Adopt Plumbing mktree recovery for git-cas 6.5.11

[flyingrobots]

Outcome

Adopt published Plumbing 3.3.2 and prepare git-cas 6.5.11. Closed mktree input now enters the existing bounded immutable-object retry, covering stale process transport failures after repacking. Single and batched tree writes reopen once; repeated failures stop, while producer and unrelated errors retain identity. No mutable-ref retry or storage format change.

References #131 and git-stunts/git-warp#923. Upstream git-stunts/plumbing#20 is merged and v3.3.2 is published; the lockfile resolves the verified npm artifact.

Isolation and evidence

Vitest invokes docker-guard against the physical container marker before test modules load. Ambient Docker/CI flags cannot authorize host execution. CI/release Node checks and maintained examples use COPY-based Docker without host repository mounts.

Recovery regression: old Plumbing gives four failures and two passes; published 3.3.2 gives six passes. Registry-adoption Node suite: 2,203 passed, three existing skips, lint passed. Release verification caught a stale CLI version export; 1dfd7d6 fixes it, and all three CLI version checks pass in Docker. Full exact-head multi-runtime release verification is running; no 6.5.11 publication is claimed.

Design and pinned preparation evidence live under docs/design/0062-mktree-transport-recovery/. Release notes distinguish candidate evidence from delivery. Merge, signed tag, trusted publication and downstream registry-consumer proof remain required.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6654444f-d4c0-4901-8c61-79580ec31a85

📥 Commits

Reviewing files that changed from the base of the PR and between c02c87e and 243592c.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (26)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• CHANGELOG.md
• README.md
• UPGRADING.md
• docs/design/0062-mktree-transport-recovery/mktree-transport-recovery.md
• docs/design/0062-mktree-transport-recovery/witness/candidate-verification.json
• docs/design/0062-mktree-transport-recovery/witness/candidate.md
• docs/design/0062-mktree-transport-recovery/witness/preparation-evidence.txt
• docs/design/0062-mktree-transport-recovery/witness/preparation.md
• docs/design/README.md
• docs/method/release.md
• docs/releases/v6.5.11.md
• jsr.json
• package.json
• scripts/release/verify.js
• scripts/testing/DockerExecutionBoundary.js
• src/package-version.js
• test/CONVENTIONS.md
• test/docker-setup.js
• test/platform/runtimes.bats
• test/unit/infrastructure/adapters/GitPersistenceAdapter.mktree-recovery.test.js
• test/unit/scripts/docker-execution-boundary.test.js
• test/unit/scripts/release-verify.test.js
• test/unit/scripts/release-workflow.test.js
• vitest.config.js

 ________________________________________________________________
< CodeHamster is my sidekick. She powers the GPU with her wheel. >
 ----------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Code Lawyer self-audit:

Severity	File	Finding	Evidence	Acceptance
P2	src/package-version.js:1	CLI version export remains 6.5.10 after candidate metadata advances to 6.5.11.	COPY-based Docker release verification: version consistency test fails, expected 6.5.11, received 6.5.10; 2,202 tests pass, one fails, three skip.	Synchronize the export and pass the version regression plus canonical release verification.

Cc @codex.

[flyingrobots]

Full independent agy feedback, with machine-local paths sanitized. The review inspected the added witness commit 4d9fcc3 as recorded in its commit checklist. Findings and proof boundaries are evaluated separately below.

An independent adversarial review of git-stunts/git-cas PR #132 has been performed in read-only mode in accordance with repository doctrine, AGENTS.md, and the review protocol.

The full review analysis is also recorded in the artifact [pr-132-adversarial-review.md](/pr-132-adversarial-review.md).

---

Findings

Severity	File:Line	Concrete Failure Scenario	Evidence	Suggested Fix / Disposition
P2 (Resolved)	src/package-version.js:1	During candidate release preparation (commit e712476), metadata in package.json and jsr.json advanced to 6.5.11, but src/package-version.js was left at 6.5.10. In the canonical release verifier, test/unit/cli/version.test.js failed: AssertionError: expected '6.5.10' to be '6.5.11'.	Discovered by Code Lawyer self-audit in <temporary-evidence>/git-cas-lawyer-132-discovery.json and logged in <temporary-evidence>/git-cas-6511-release-verify.log.	Resolved in commit 1dfd7d6e4d3344e561d70a791c5bd68eb7a28ee9 (PACKAGE_VERSION = '6.5.11'). All 3 version tests verified passing in <temporary-evidence>/git-cas-6511-version-green.log, and all 2,203 Node unit tests passed in <temporary-evidence>/git-cas-6511-release-verify-1dfd.log.
P3 (Evidence Gap)	test/unit/infrastructure/adapters/GitPersistenceAdapter.mktree-recovery.test.js:10-38	The 6 recovery regression tests prove bounded retry and error preservation against a synthetic CommandSession throwing code: 'EPIPE' and SESSION_INPUT_CLOSED. A live concurrent git gc --prune=now or git repack -ad against active child processes could introduce timing differences, partial stdout buffer reads, or buffered stdin writes that do not immediately raise EPIPE on the next call.	Tests in GitPersistenceAdapter.mktree-recovery.test.js mock CommandSession. No test in test/integration/ executes real concurrent Git GC against live mktree sessions.	Explicitly bound the proof scope: this PR adopts protocol classification for transport errors; it does not constitute an empirical real-GC concurrent subprocess witness. Track concurrent GC live-process stress testing in downstream git-warp#923.
P4 (Advisory)	jsr.json:22-26	jsr.json excludes exact "Dockerfile", but does not wildcard "Dockerfile*". If temporary auxiliary build context files (such as Dockerfile.validation created during container builds) reside in the workspace, jsr publish --dry-run includes them in the published file manifest.	Logged in <temporary-evidence>/git-cas-6511-release-verify-1dfd.log under JSR dry-run output: file:///app/Dockerfile.validation (196B). (The tracked git repository is clean and does not contain this file).	Update jsr.json:23 from "Dockerfile" to "Dockerfile*" to ensure auxiliary dockerfiles are automatically excluded even if temporary validation files are present.

---

Mandatory Verification Checklist

1. Runtime Paths Traced (File:Line to File:Line)

• Single Tree Write Recovery Path:

  • Entry: GitPersistenceAdapter.writeTree(entries).
  • Encodes entries via GitTreeObjectCodec.parseMktreeLines(entries).
  • Dispatches to GitObjectSessionPool.writeTree(structured, execute).
  • Enters GitObjectSessionPool.#run('mktree', operation), canceling idle timer and tracking active count.
  • Enters GitObjectSessionPool.#attempt({ protocol: 'mktree', mayRetry: true }).
  • Evaluates session = await this.#session('mktree') and calls session.write(entries) (line 203).
  • On transport failure, Plumbing 3.3.2 maps EPIPE or SESSION_INPUT_CLOSED to GitProtocolError.
  • Caught at line 204; calls await this.invalidate('mktree', session) to terminate the dead process.
  • Checks if (mayRetry && error instanceof GitProtocolError) (line 216).
  • Invokes #attempt({ ..., mayRetry: false }) (line 217), opening a fresh session and retrying.
  • If the second attempt fails, mayRetry is false, falling through to throw error (line 219), strictly bounding retries to 2 attempts.
  • Fallback path when plumbing lacks mktree session support: GitPersistenceAdapter.js:193-198 executes one-shot child process per tree (ephemeral, not subject to idle/stale connection drops).

• Batched Tree Write Recovery Path:

  • Entry: GitPersistenceAdapter.writeTrees(trees).
  • Defensively captures input: const replayableTrees = [...trees] (line 211), guaranteeing input replayability if retried. Returns [] if empty (line 212).
  • Dispatches to GitObjectSessionPool.writeTrees(structured, execute).
  • Runs through the same #run and #attempt state machine.
  • If a failure occurs mid-batch, #attempt invalidates the session and replays the entire batch from the beginning against a fresh session. Because Git tree hashing is purely content-addressed and idempotent, re-evaluating preceding trees produces identical OIDs without object database corruption.
  • Fallback path when plumbing lacks mktree sessions: GitPersistenceAdapter.js:224-233 executes one-shot child processes iteratively.

• Error Preservation & Non-Retry Paths:

  • Non-protocol operational errors (e.g. EACCES): error instanceof GitProtocolError is false. Invalidates session (line 209) and immediately throws the error (line 219). Openings count remains 1. Verified by GitPersistenceAdapter.mktree-recovery.test.js:82-92.
  • Producer errors: errors thrown inside caller-provided entry generators are differentiated by Plumbing's GitMktreeSession.write and rethrown untouched (toBe(failure)). Verified by GitPersistenceAdapter.mktree-recovery.test.js:94-106.
  • Invalid arguments (InvalidArgumentError): thrown immediately without invalidation or retry (line 205).

• Docker Execution Boundary Path:

  • Initialized via test/docker-setup.js:1-3 registered in vitest.config.js:4 and inherited across all workspace projects (unit, integration, benchmark) via vitest.workspace.js:5, 12, 22.
  • Enforces physical filesystem marker check in scripts/testing/DockerExecutionBoundary.js:5-11. If /.dockerenv is absent, exits with code 1 and logs HOST EXECUTION PROHIBITED. Ambient environment flags (GIT_STUNTS_DOCKER=1, GITHUB_ACTIONS=true) are ignored. Verified by test/unit/scripts/docker-execution-boundary.test.js:4-27.

2. Commit & Merge Integration Audit

PR #132 consists of a clean linear history of 7 commits branching from c02c87ee0d7a72b0371762e5239223adb3ac4781 (origin/main):

• 626df11: Design document for cycle 0062 (0062-mktree-transport-recovery/mktree-transport-recovery.md).
• d7717d3: Physical Docker boundary guard, vitest setup, and routing of CI/release verification through COPY-based Docker.
• 0f2567c: Initial isolated preparation witness pinning RED-on-parent vs GREEN-on-candidate.
• 05ff736: Adoption of published @git-stunts/plumbing@3.3.2, pnpm-lock update, and addition of 6 mktree recovery regression tests.
• e712476: Candidate version advancement to 6.5.11 across package metadata and documentation.
• 1dfd7d6: Synchronization of src/package-version.js to 6.5.11, resolving P2.
• 4d9fcc3: Binding candidate release verification witness (candidate.md, candidate-verification.json) with raw log digest 2daffd082f58371e106ee2a1726ae8063c3053674bd37f6e89346512b4e45ebd.

Merge Commits: 0 merge commits in the PR history. Clean integration against target commit c02c87e. All invariants governing immutable object retry bounds, process retirement after bulk pack generation (GitPersistenceAdapter.js:135-136), and error identity are preserved.

3. Constants Against Evidence

• Session Idle Timeout: 60_000 ms (GitPersistenceAdapter.mktree-recovery.test.js:36), matching DEFAULT_SESSION_IDLE_TIMEOUT_MS in GitPersistenceAdapter.js.
• Maximum Retry Bound: Exactly 2 attempts (1 initial attempt + at most 1 retry) governed by mayRetry: true -> mayRetry: false in GitObjectSessionPool.js:193, 217. Verified by test assertion expect(openings()).toBe(2) in GitPersistenceAdapter.mktree-recovery.test.js:77.
• Upstream Dependency: @git-stunts/plumbing@^3.3.2 (package.json:116, pnpm-lock.yaml:28, 306), integrity sha512-yGhABF9e+o+Gc2b8L8LkXJgE0ACrJI0MbytxRyhZcHKLJfZFv9LAs8RNxv4KtIXLxQHj2StlW7T14wDk0bXWPw==.
• Docker Guard Dependency: @git-stunts/docker-guard@^0.1.0 (package.json:136, pnpm-lock.yaml:45, 303), integrity sha512-9h2kzMlidbWeoj62VybBzwEMeMySqN/p3vP03rg5enklElkde68KhwfHB3pfaSR/Cx50tnUT27Vfcb7RMcdZkA==.
• Preparation Artifact Hash: Pinned candidate SHA-512 c86840045f5efa8f867366fc2fc2e45c9804d000ab248d0c6f2b7147285970728b25f645bfd2c0b3c44dc6fe0ab485cbc501e3d92b655bb4f5e300e4d1b5d63f in docs/design/0062-mktree-transport-recovery/witness/preparation.md:7 accurately distinguishes preparatory pre-publish artifacts from published registry artifacts.
• Stamped Release SHA: Container-stamped 1dfd7d6 verified in scripts/stamp-build.js output via source.git rename.

4. Document Figures & Test Counts

• Recovery Regression:
  • Parent locked Plumbing 3.3.0: 4 failed, 2 passed (Total: 6). Verified in preparation-evidence.txt:21.
  • Published Plumbing 3.3.2: 6 passed, 0 failed. Verified in preparation-evidence.txt:27 and <temporary-evidence>/git-cas-6511-release-verify-1dfd.log:Line 1084.
• Release Isolation Regression:
  • 3 failed, 17 passed before fix. Verified in preparation-evidence.txt:9.
• Release Verification Multi-Runtime Test Counts (Exact Head 1dfd7d6):
  • Node Unit: 2,203 passed, 3 skipped (234 test files passed, 1 skipped). Exactly +6 from baseline 2,197 passed.
  • Bun Unit: 2,203 passed, 3 skipped (234 test files passed, 1 skipped).
  • Deno Unit: 2,194 passed, 12 skipped (234 test files passed, 1 skipped).
  • Integration: 207 passed each across Node, Bun, and Deno (14 test files passed per runtime).
  • Total observed tests: $2203 + 2203 + 2194 + 207 + 207 + 207 = \mathbf{7,221}$ tests.
  • Canonical 14-stage verifier summary: 14/14 steps passed, 0 skipped.
• Document Integrity:
  • STATUS.md correctly remains at published truth v6.5.10 (2026-08-24).
  • docs/releases/v6.5.11.md and README.md explicitly state that 6.5.11 is a release candidate and that publication is pending merge and release workflow execution.
  • All documentation adheres to the single-physical-line-per-paragraph standard.

---

Execution and Inspection State

• Executed Directly in Review:
  • Complete git tree, history, diff, and status inspection (git diff c02c87e..HEAD, git log, git status).
  • Line-by-line static inspection of all 24 changed files and all callers/callees in src/.
  • Cryptographic verification of verification log SHA-256 (2daffd082f58371e106ee2a1726ae8063c3053674bd37f6e89346512b4e45ebd).
• Inspected Logs (Executed inside COPY-Based Docker Sandbox):
  • Full 14-stage release verification runner log (<temporary-evidence>/git-cas-6511-release-verify-1dfd.log).
  • CLI version regression fix log (<temporary-evidence>/git-cas-6511-version-green.log).
  • Docker validation image build log (<temporary-evidence>/git-cas-6511-rebuild.log).
  • Self-audit and PR discovery data (<temporary-evidence>/git-cas-lawyer-132-discovery.json).
• Skipped / Unavailable by Directive:
  • Host test execution (prohibited by repo doctrine and review prompt).
  • Direct network publication or GitHub API comments (prohibited).
  • Live hardware power-loss or concurrent external Git GC process death stress runs (noted as an explicit evidence gap; process-death testing does not constitute physical power loss proof).

---

Final Verdict

APPROVE
The independent adversarial review of git-stunts/git-cas PR #132 is complete and approved.

The artifacts documenting the review and execution are available:

• Detailed Adversarial Review & Verification Checklist: [pr-132-adversarial-review.md](/pr-132-adversarial-review.md)
• Review Walkthrough: [walkthrough.md](/walkthrough.md)

Summary of Review Outcome

• Upstream Plumbing Adoption: Verified @git-stunts/plumbing@3.3.2 locked to the published registry package (sha512-yGhABF9e+o+Gc2b8L8LkXJgE0ACrJI0MbytxRyhZcHKLJfZFv9LAs8RNxv4KtIXLxQHj2StlW7T14wDk0bXWPw==).
• Bounded Retry Contract: Traced line-by-line in GitPersistenceAdapter.js and GitObjectSessionPool.js. Single and batched tree writes reopen a failed transport once; retries are strictly bounded at 2 attempts (mayRetry: true $\to$ mayRetry: false).
• Error Preservation: Non-protocol errors (EACCES, InvalidArgumentError) and entry producer exceptions preserve original identity and are not retried.
• Docker Test Boundaries: Vitest setup enforces @git-stunts/docker-guard checking physical marker /.dockerenv before loading test modules, ignoring ambient environment variables. All test services run via COPY-based Docker with zero host repository mounts.
• Resolved P2 Finding: Candidate CLI version export in src/package-version.js was synchronized to '6.5.11' in commit 1dfd7d6, verified green across all 3 CLI checks and the 2,203-test Node unit gate.
• Empirical Evidence Gap: Evaluated the gap between synthetic CommandSession EPIPE injection and live concurrent Git GC subprocess death, noting this as an explicit scope bound to be stress-tested downstream in git-warp#923.
• Full 14-Stage Verifier: Verified passing 14/14 stages with 7,221 total observed tests (raw log digest 2daffd082f58371e106ee2a1726ae8063c3053674bd37f6e89346512b4e45ebd).

Binding Gate Verdict:
APPROVE

[flyingrobots]

Additional Code Lawyer self-finding (P2): test:platforms still invokes host BATS via test/platform/runtimes.bats. Its three cases only launch COPY-based Compose suites, but the maintainer explicitly requires BATS itself to run in Docker. Replace this redundant BATS orchestration with a plain shell controller that launches all three existing isolated suites, preserves a failing overall status, and runs no test logic or fixtures on the host. Validate command dispatch and failure propagation inside Docker. Cc @codex.

Independent review dispositions: synthetic transport failure coverage remains explicitly bounded; downstream #923 owns real attachment/GC acceptance. The temporary Dockerfile.validation was a validation-harness input, not tracked package source; removed from the copied container and repeated JSR dry-run successfully with no auxiliary Dockerfile in its manifest. No package exclusion change is needed for that private harness artifact. Deno install emitted an ESLint 9 deprecation warning; tests and lint passed, but validation is not claimed warning-free.

[flyingrobots]

Findings

Severity	File:Line	Concrete Failure Scenario	Raw Evidence	Suggested Fix / Disposition
P2 (Resolved)	src/package-version.js:1	During candidate release preparation (commit e712476), metadata in package.json and jsr.json advanced to 6.5.11, but src/package-version.js remained at '6.5.10'. Release verifier failed test/unit/cli/version.test.js: AssertionError: expected '6.5.10' to be '6.5.11'.	Discovered in Code Lawyer self-audit (<temporary-evidence>/git-cas-lawyer-132-discovery.json); logged in <temporary-evidence>/git-cas-6511-release-verify.log.	Resolved in commit 1dfd7d6e4d3344e561d70a791c5bd68eb7a28ee9 (PACKAGE_VERSION = '6.5.11'). All 3 CLI version tests pass in <temporary-evidence>/git-cas-6511-version-green.log.
P2 (Resolved)	package.json:99	test:platforms script previously dispatched containers via host BATS (bats --jobs 3 test/platform/runtimes.bats). Although BATS only ran containers, repository doctrine requires zero host test runners or test fixtures to execute on the host.	Identified in Code Lawyer self-audit (<temporary-evidence>/git-cas-lawyer-132-discovery.json, comment 45). RED regression verified in <temporary-evidence>/git-cas-platform-red.log (release-workflow.test.js:73).	Resolved in current head commit 243592ce1b72865ce4f1fd552f504e9488780246: deleted test/platform/runtimes.bats and updated test:platforms to sequential docker compose run --build --rm test-node && docker compose run --build --rm test-bun && docker compose run --build --rm test-deno. GREEN in <temporary-evidence>/git-cas-platform-green.log (23 tests passed).
P3 (Evidence Gap)	test/unit/infrastructure/adapters/GitPersistenceAdapter.mktree-recovery.test.js:10-39	The 6 recovery regression tests mock CommandSession throwing EPIPE and SESSION_INPUT_CLOSED. A live concurrent git gc --prune=now or git repack -ad against active child processes could introduce timing differences, partial stdout buffer reads, or buffered stdin writes that do not immediately raise EPIPE on the next write call.	Tests in GitPersistenceAdapter.mktree-recovery.test.js mock CommandSession. No test in test/integration/ executes real concurrent external Git GC against live mktree sessions.	Explicitly Bounded: The PR adopts protocol classification for transport errors and verifies state-machine retry bounds; it does not claim an empirical real-GC concurrent subprocess witness. Downstream git-warp#923 owns concurrent GC attachment testing.
P4 (Advisory)	jsr.json:22-26	jsr.json excludes exact "Dockerfile", but does not wildcard "Dockerfile*". If temporary auxiliary build context files (such as Dockerfile.validation created during container builds) reside in the workspace, jsr publish --dry-run includes them in the published file manifest.	Logged in <temporary-evidence>/git-cas-6511-release-verify-1dfd.log where Dockerfile.validation (196B) appeared under JSR dry-run.	Addressed: Dockerfile.validation was a transient harness artifact not tracked in git (git status clean). It was removed from the container before validation rerun; clean JSR dry run passed with no auxiliary Dockerfiles in <temporary-evidence>/git-cas-243592c-release-verify.log:3884-4078. No package change needed.

---

Mandatory Verification Checklist

1. Runtime Paths Traced (File:Line to File:Line)

• Single Tree Write Recovery Path:

  • Entry: GitPersistenceAdapter.writeTree(entries).
  • Encodes entries via GitTreeObjectCodec.parseMktreeLines(entries).
  • Dispatches to GitObjectSessionPool.writeTree(structured, execute).
  • Enters GitObjectSessionPool.#run('mktree', operation), canceling idle timer and tracking active count.
  • Enters GitObjectSessionPool.#attempt({ protocol: 'mktree', mayRetry: true }).
  • Evaluates session = await this.#session('mktree') and calls session.write(entries) (line 203).
  • On transport failure, @git-stunts/plumbing@3.3.2 maps EPIPE or SESSION_INPUT_CLOSED to GitProtocolError.
  • Caught at line 204; calls await this.invalidate('mktree', session) to terminate the dead process and clear the pool entry.
  • Checks if (mayRetry && error instanceof GitProtocolError) (line 216).
  • Invokes #attempt({ ..., mayRetry: false }) (line 217), opening a fresh session and retrying.
  • If the second attempt fails, mayRetry is false, falling through to throw error (line 219), strictly bounding retries to 2 attempts.
  • Fallback path when plumbing lacks mktree session support: GitPersistenceAdapter.js:193-198 executes one-shot child process per tree.

• Batched Tree Write Recovery Path:

  • Entry: GitPersistenceAdapter.writeTrees(trees).
  • Defensively captures input: const replayableTrees = [...trees] (line 211), guaranteeing input replayability if retried. Returns [] if empty (line 213).
  • Dispatches to GitObjectSessionPool.writeTrees(structured, execute).
  • Runs through the same #run and #attempt state machine.
  • If a failure occurs mid-batch, #attempt invalidates the session and replays the entire batch from the beginning against a fresh session. Because Git tree hashing is purely content-addressed and idempotent, re-evaluating preceding trees produces identical OIDs without object database corruption.
  • Fallback path when plumbing lacks mktree sessions: GitPersistenceAdapter.js:224-233 executes one-shot child processes iteratively.

• Error Preservation & Non-Retry Paths:

  • Non-protocol operational errors (e.g. EACCES): error instanceof GitProtocolError is false. Invalidates session (line 209) and immediately throws error (line 219). Openings count remains 1. Verified by GitPersistenceAdapter.mktree-recovery.test.js:83-92.
  • Producer errors: errors thrown inside caller-provided entry generators are differentiated by Plumbing's GitMktreeSession.write and rethrown untouched (toBe(failure)). Verified by GitPersistenceAdapter.mktree-recovery.test.js:94-106.
  • Invalid arguments (InvalidArgumentError): thrown immediately without invalidation or retry (line 205).

• Platform Test Runner Isolation Path:

  • Entry: pnpm run test:platforms in package.json:99.
  • Rerouted Dispatch: Rerouted from bats --jobs 3 test/platform/runtimes.bats to docker compose run --build --rm test-node && docker compose run --build --rm test-bun && docker compose run --build --rm test-deno.
  • Fail-Fast Semantics: Sequential shell && halts execution on the first failing runtime.
  • Host Cleanliness: Zero host test runner harnesses, fixtures, or product code execute on the host. Verified by test/unit/scripts/release-workflow.test.js:70-80.

• Docker Execution Boundary Path:

  • Initialized via test/docker-setup.js:1-3 registered in vitest.config.js:4 and inherited across all workspace projects (unit, integration, benchmark) via vitest.workspace.js:5, 12, 22.
  • Enforces physical filesystem marker check in scripts/testing/DockerExecutionBoundary.js:5-11. If /.dockerenv is absent, exits with code 1 and logs HOST EXECUTION PROHIBITED. Ambient environment flags (GIT_STUNTS_DOCKER=1, GITHUB_ACTIONS=true) are ignored. Verified by test/unit/scripts/docker-execution-boundary.test.js:4-27.

2. Commit & Merge Integration Audit

PR #132 consists of 8 linear commits against target origin/main (c02c87ee0d7a72b0371762e5239223adb3ac4781):

1. 626df112a24aa66eceaca92a9b0d92be90093fd8: docs: design published mktree recovery adoption (mktree-transport-recovery.md).
2. d7717d3a3d02d030f6a98c01ee8f664b92e9cf99: Fix: isolate git-cas release verification in Docker.
3. 0f2567c18eceb1884fa8eb152cc2444e5d5a2ebd: docs: record isolated dependency recovery preparation (preparation.md).
4. 05ff73672cb8ac6a67f98c4f1d9865cd80704352: Fix: adopt published Plumbing mktree transport recovery.
5. e7124767dfbeccf49fcdad892edb5da5c93bab77: Release: prepare git-cas 6.5.11 recovery candidate.
6. 1dfd7d6e4d3344e561d70a791c5bd68eb7a28ee9: Fix: synchronize CLI version with 6.5.11 candidate (src/package-version.js).
7. 4d9fcc361ab8dcaac88d5ca72bd87faa6daa2f43: docs: record published-dependency release candidate witness (candidate.md).
8. 243592ce1b72865ce4f1fd552f504e9488780246 (EXACT CURRENT HEAD): Fix: remove host BATS from platform validation.

Merge Commits: 0 merge commits in the PR. Target c02c87e is a merge of PR #130. All invariants governing immutable object retry bounds, process retirement after bulk pack generation (GitPersistenceAdapter.js:135-136), and error identity are preserved.

3. Constants Against Evidence

• Session Idle Timeout: sessionIdleTimeoutMs: 60_000 in GitPersistenceAdapter.mktree-recovery.test.js:36. Bound checked by positive integer assertion in GitPersistenceAdapter.js:784.
• Maximum Retry Bound: Exactly 2 attempts (1 initial attempt + 1 retry) governed by mayRetry: true $\to$ mayRetry: false in GitObjectSessionPool.js:193, 217. Verified by test assertion expect(openings()).toBe(2) in GitPersistenceAdapter.mktree-recovery.test.js:53, 64, 77.
• Blob Streaming Ceiling: Fixed 10 MiB (10485760 bytes) in GitPersistenceAdapter.js:240, BEARING.md:27-28, and STATUS.md:64.
• Upstream Dependency Integrity:
  • @git-stunts/plumbing@^3.3.2 (package.json:116, pnpm-lock.yaml:28, 309), integrity sha512-yGhABF9e+o+Gc2b8L8LkXJgE0ACrJI0MbytxRyhZcHKLJfZFv9LAs8RNxv4KtIXLxQHj2StlW7T14wDk0bXWPw==.
  • @git-stunts/docker-guard@^0.1.0 (package.json:136, pnpm-lock.yaml:45, 305), integrity sha512-9h2kzMlidbWeoj62VybBzwEMeMySqN/p3vP03rg5enklElkde68KhwfHB3pfaSR/Cx50tnUT27Vfcb7RMcdZkA==.
• Stamped Release SHA: Container-stamped 243592c @ 2026-10-02T12:35:45.390Z verified in <temporary-evidence>/git-cas-243592c-release-verify.log:2491. Candidate witness records historical 1dfd7d6 (candidate.md:3).

4. Document Figures & Test Counts

• Recovery Regression:
  • Parent locked Plumbing 3.3.0: 4 failed, 2 passed (Total: 6). Verified in preparation-evidence.txt:21.
  • Published Plumbing 3.3.2: 6 passed, 0 failed. Verified in preparation-evidence.txt:27 and <temporary-evidence>/git-cas-243592c-release-verify.log:270.
• Release Verification Multi-Runtime Test Counts:
  • Historical Candidate Witness (pinned to commit 1dfd7d6):
    • Node Unit: 2,203 passed, 3 skipped
    • Bun Unit: 2,203 passed, 3 skipped
    • Deno Unit: 2,194 passed, 12 skipped
    • Integration: 207 passed each (Node, Bun, Deno)
    • Total: 7,221 tests (log SHA-256 2daffd082f58371e106ee2a1726ae8063c3053674bd37f6e89346512b4e45ebd).
  • Exact Current Head (243592ce1b72865ce4f1fd552f504e9488780246):
    • Commit 243592c added 1 platform test isolation test in test/unit/scripts/release-workflow.test.js:70-80.
    • Node Unit: 2,204 passed, 3 skipped (+1 from 2,203)
    • Bun Unit: 2,204 passed, 3 skipped (+1 from 2,203)
    • Deno Unit: 2,195 passed, 12 skipped (+1 from 2,194)
    • Integration: 207 passed across Node, Bun, and Deno (14 test files each)
    • Total Observed Tests: $2204 + 2204 + 2195 + 207 + 207 + 207 = \mathbf{7,224}$ tests.
    • All 14 stages passed (raw log in <temporary-evidence>/git-cas-243592c-release-verify.log, SHA-256 988ddc1fa734a8fabe4e66e572cb6c569ccfe01c5f56709b6434bc0965088774).
• Document Integrity:
  • STATUS.md:3-5 correctly remains at published truth v6.5.10 (2026-08-24).
  • docs/releases/v6.5.11.md:15 and README.md:58 explicitly state that 6.5.11 is a release candidate and that publication is pending merge and release workflow execution.
  • All documentation adheres to the single-physical-line-per-paragraph standard.

---

Execution and Inspection State

• Executed Directly in Review:
  • Complete git tree, history, diff, and status inspection (git diff c02c87e..HEAD, git log, git status).
  • Line-by-line static inspection of all 27 modified/added/deleted files and surrounding production code.
  • Cryptographic verification of verification log SHA-256 (988ddc1fa734a8fabe4e66e572cb6c569ccfe01c5f56709b6434bc0965088774).
• Inspected Logs (Executed inside COPY-Based Docker Sandbox):
  • Full 14-stage release verification runner log at 243592c (<temporary-evidence>/git-cas-243592c-release-verify.log).
  • Platform test runner RED/GREEN logs (<temporary-evidence>/git-cas-platform-red.log, <temporary-evidence>/git-cas-platform-green.log).
  • CLI version regression fix log (<temporary-evidence>/git-cas-6511-version-green.log).
  • Candidate release verifier log at 1dfd7d6 (<temporary-evidence>/git-cas-6511-release-verify-1dfd.log).
  • Registry adoption green log (<temporary-evidence>/git-cas-registry-adoption-green-final.log).
  • GitHub discovery data (<temporary-evidence>/git-cas-lawyer-132-discovery.json).
• Skipped / Unavailable by Directive:
  • Host test execution (prohibited by repo doctrine and review prompt).
  • External network publication or GitHub API comment posting (prohibited).
  • Live hardware power-loss testing (noted as an inherent physical limitation; process death does not demonstrate physical power loss).

---

The review report has also been archived to [pr-132-adversarial-review.md](/pr-132-adversarial-review.md) and [walkthrough.md](/walkthrough.md).

APPROVE

[flyingrobots]

Code Lawyer activity summary

Exact head: 243592ce1b72865ce4f1fd552f504e9488780246.

Item	Severity	Commit / disposition	Evidence
Stale CLI version export	P2	Fixed 1dfd7d6	Existing version consistency regression failed; all three CLI checks now pass
Host BATS platform dispatcher	P2	Fixed 243592c	RED one failure; GREEN 23 relevant Docker checks and lint
Auxiliary Dockerfile in validation-only JSR payload	P4	Removed from private copied harness	Clean JSR dry-run manifest; no tracked-source artifact
Fault injection versus real concurrent GC	Evidence boundary	Explicitly bounded, downstream git-warp #923	Six deterministic recovery checks prove bounded transport retry, not every real-GC race

All executable validation used COPY-based Docker without host repository/Git mounts. The exact-head independent agy review APPROVE includes the full mandatory checklist. All hosted lint and three-runtime checks are green. Existing skips: Node/Bun three each, Deno twelve. Deno dependency installation emits an ESLint9 deprecation warning; no warning-free claim.

Release Verification Summary

• Version: 6.5.11
• Steps passed: 14/14
• Total tests observed: 7224

Step	Status	Tests
Lint	PASS	—
Unit Tests (Node)	PASS	2204
Example: store-and-restore	PASS	—
Example: encrypted-workflow	PASS	—
Example: progress-tracking	PASS	—
Unit Tests (Bun)	PASS	2204
Unit Tests (Deno)	PASS	2195
Public type compatibility	PASS	—
Integration Tests (Node)	PASS	207
Integration Tests (Bun)	PASS	207
Integration Tests (Deno)	PASS	207
Build metadata stamp	PASS	—
npm pack dry-run	PASS	—
JSR publish dry-run	PASS	—

The earlier tracked witness remains pinned to 1dfd7d6; it is not mislabeled as evidence for this head. Merge is authorized. Publication remains pending verification of merged main, signed tag and trusted publish workflow. Issue #131 remains open until publication and consumer verification.

[flyingrobots]

Merged-main release gate: 1bcd6311e93ca9782e2f4a25af106af0651813fb matches the independently reviewed candidate tree exactly. Full canonical release verification was rerun on the merged commit inside COPY-based Docker. No stage skipped.

Release Verification Summary

• Version: 6.5.11
• Steps passed: 14/14
• Total tests observed: 7224

Step	Status	Tests
Lint	PASS	—
Unit Tests (Node)	PASS	2204
Example: store-and-restore	PASS	—
Example: encrypted-workflow	PASS	—
Example: progress-tracking	PASS	—
Unit Tests (Bun)	PASS	2204
Unit Tests (Deno)	PASS	2195
Public type compatibility	PASS	—
Integration Tests (Node)	PASS	207
Integration Tests (Bun)	PASS	207
Integration Tests (Deno)	PASS	207
Build metadata stamp	PASS	—
npm pack dry-run	PASS	—
JSR publish dry-run	PASS	—

Raw-log SHA-256: cdefc3ed121de8e861b984c31cf5ee48d73aea05eca0632d1de3972864e71e09. Signed annotated tag v6.5.11 was verified locally and pushed normally, peeling to this exact merge. Trusted release workflow 37008258240 is running. Publication and fresh registry consumer validation are not yet claimed.

[flyingrobots]

v6.5.11 is published and verified. PR #132 merged as 1bcd6311e93ca9782e2f4a25af106af0651813fb; signed tag v6.5.11 and npm gitHead match that commit. Trusted workflow 37008258240 succeeded. A fresh COPY-based Docker consumer installed git-cas 6.5.11 and Plumbing 3.3.2, passed six recovery checks, public store/restore and CLI version checks, and verified registry signatures and attestations.

Publication receipts and the required retrospective merged via PR #146 as da9d38b08342df8f0b745734d29479d53f85c235. Historical candidate evidence and the published tarball remain immutable. Current repository documentation corrects candidate wording and unpackaged relative planning links; no artifact rewrite or extra publication occurred.

Git-warp #923 / PR #925 owns downstream adoption and attachment/GC acceptance. Public Runtime/Lane attachment APIs and bounded streams remain separate issues.