@opengsd/gsd-path 1.1.0 → 1.2.0

package/skills/gsd-path-roadmap/scripts/isolation.py

@@ -18,6 +18,9 @@ import re
 import stat
 import subprocess
 import sys
+
+# Runtime helpers must not modify their immutable installation.
+sys.dont_write_bytecode = True
 import tempfile
 from pathlib import Path, PurePosixPath
 from typing import Dict, Optional, Sequence, Set
@@ -33,6 +36,7 @@ try:
         task_commit_subject,
     )
     import _common
+    import worktree_paths
 except ImportError:  # pragma: no cover - package import used by tests
     from scripts.pipeline_git import (
         attest_commit_body,
@@ -44,6 +48,7 @@ except ImportError:  # pragma: no cover - package import used by tests
         task_commit_subject,
     )
     from scripts import _common
+    from scripts import worktree_paths
 
 
 TASK_BRANCH_PREFIX = "gsd-path-task/"
@@ -57,7 +62,9 @@ VERIFY_LEDGER_PATH = _common.VERIFY_LEDGER_PATH
 LANDED_VERDICTS = frozenset({"recovered", "attested"})
 # Orchestrator bookkeeping that may stay uncommitted in the primary while a
 # parallel task lands; the next `.project` checkpoint commits it.
-BOOKKEEPING_PATHS = DISCUSSION_PATHS | {VERIFY_LEDGER_PATH}
+BOOKKEEPING_PATHS = DISCUSSION_PATHS | {
+    VERIFY_LEDGER_PATH, ".project/config.json", ".project/model-policy.json",
+}
 # Bookkeeping path prefixes: pipeline records plus the guard's own install
 # artifacts. git_guard and the post-adoption proof share this one definition.
 BOOKKEEPING_PREFIXES = (
@@ -142,8 +149,11 @@ def common_git_dir(repo: Path) -> Path:
     return (repo / raw).resolve()
 
 
-def sidecar_root(primary: Path, kind: str, name: str) -> Path:
-    return primary.parent / f"{primary.name}.gsd-path" / kind / name
+def sidecar_root(primary: Path, kind: str, name: str, *, pin: bool = False) -> Path:
+    try:
+        return worktree_paths.worktree_path(primary, kind, name, pin=pin)
+    except (ValueError, OSError) as error:
+        raise IsolationError(str(error)) from error
 
 
 def validate_task_id(task_id: str) -> str:
@@ -553,7 +563,7 @@ def isolate_task(
             "worktree": str(primary),
         }
     branch = task_branch_name(task_id)
-    destination = sidecar_root(primary, "task", task_id)
+    destination = sidecar_root(primary, "task", task_id, pin=True)
     create_named_worktree(primary, branch, destination, resolved_base)
     return {
         "base": resolved_base,
@@ -589,7 +599,7 @@ def isolate_verify(primary: Path, base: str, name: str, historical_task: Optiona
             + ", ".join(product_dirt)
         )
     branch = verify_branch_name(name)
-    destination = sidecar_root(primary, "verify", name)
+    destination = sidecar_root(primary, "verify", name, pin=True)
     create_named_worktree(primary, branch, destination, resolved_base)
     return {
         "base": resolved_base,