@opengsd/gsd-path 1.3.1 → 1.5.0

package/skills/path/scripts/git_guard.py

@@ -6,6 +6,7 @@ hook wiring. Inspection failures and violations both exit 1: unreadable Git
 state cannot prove archive immutability or safe publication.
 """
 
+import json
 import re
 import subprocess
 from functools import lru_cache
@@ -19,8 +20,9 @@ sys.path.insert(0, str(_HERE / "runtime" if (_HERE / "runtime" / "isolation.py")
 sys.dont_write_bytecode = True  # a hook must not leave __pycache__ in the worktree
 try:
     from isolation import BOOKKEEPING_PREFIXES, NULL_SHA, _landing_state, task_frontmatter
-    from pipeline_git import is_ship_subject, task_commit_body
+    from pipeline_git import is_ship_subject, ship_body_matches, ship_commit_body, task_commit_body
     from pipeline_state import _completion_status
+    import members
 except ImportError as error:  # pragma: no cover - broken install
     print(
         f"gsd-path guard: pipeline runtime is missing ({error}); commit blocked; "
@@ -57,6 +59,10 @@ PRODUCT_HINT = (
     f"while this worktree carries unfinished milestone state, {LANDING_HINT}; "
     "findings during ship reopen through the patch plan"
 )
+MEMBER_PUSH_HINT = (
+    "a member publishes its coordinator's Path refs, or work from them, only with "
+    "a coordinator authorization for that exact ref and object"
+)
 PUBLICATION_HINT = (
     "unshipped milestone work reaches a remote only as its ship commit "
     "(STATE shipped/done) through archive_milestone.py integrate; findings during "
@@ -76,7 +82,7 @@ INTEGRATION_STATE_FIELDS = LEGACY_STATE_FIELDS | {
     "integration",
 }
 PROVENANCE_STATE_FIELDS = INTEGRATION_STATE_FIELDS | {"integration_source"}
-INTEGRATION_MODES = {"direct", "pull-request"}
+INTEGRATION_MODES = {"direct", "pull-request", "external-landing"}
 INTEGRATION_SOURCES = {"default", "milestone"}
 
 
@@ -84,7 +90,7 @@ def staged_entries():
     output = subprocess.run(
         ["git", "diff", "--cached", "--name-status", "-z", "--find-renames"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=True,
     ).stdout
     tokens = output.split("\0")
@@ -139,7 +145,7 @@ def committed_archive_roots():
     head = subprocess.run(
         ["git", "rev-parse", "--verify", "--quiet", "HEAD^{commit}"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     if head.returncode == 1:
@@ -148,7 +154,7 @@ def committed_archive_roots():
     output = subprocess.run(
         ["git", "ls-tree", "-r", "--name-only", "HEAD", "--", ARCHIVE_PREFIX],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=True,
     ).stdout
     return {
@@ -162,7 +168,7 @@ def staged_file(path):
     return subprocess.run(
         ["git", "show", f":{path}"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=True,
     ).stdout
 
@@ -176,7 +182,7 @@ def shown_file(revspec):
     shown = subprocess.run(
         ["git", "show", revspec],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     return shown.stdout if shown.returncode == 0 else None
@@ -187,7 +193,7 @@ def state_at(revision):
     subprocess.run(
         ["git", "cat-file", "-e", revision],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=True,
     )
     content = shown_file(f"{revision}:.project/STATE.md")
@@ -288,12 +294,25 @@ def ship_contract_violations(entries, subject, body, new_archives, state):
     reviewed_head = subprocess.run(
         ["git", "rev-parse", "--verify", "HEAD"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=True,
     ).stdout.strip()
-    expected_body = f"Archive: {archive}\nReviewed-HEAD: {reviewed_head}"
-    if body != expected_body:
-        found.append("ship commit body does not match Archive and Reviewed-HEAD")
+    lock = f"{archive}/build/members.json"
+    staged_lock = subprocess.run(
+        ["git", "ls-files", "--cached", "--", lock],
+        capture_output=True,
+        encoding="utf-8", errors="replace",
+        check=True,
+    ).stdout
+    locked = [entry["name"] for entry in json.loads(staged_file(lock))["members"]] if staged_lock else []
+    rows = members.read_member_close(
+        Path(git_output("rev-parse", "--path-format=absolute", "--git-common-dir")), Path(archive).name
+    ) if locked else []
+    if [row["name"] for row in rows] != locked or any(row["status"] != "integrated" for row in rows):
+        found.append("ship commit requires every locked member closed; run archive_milestone.py close-members")
+    expected_body = ship_commit_body(archive, reviewed_head, rows).rstrip("\n")
+    if not ship_body_matches(body, expected_body):
+        found.append("ship commit body does not match Archive, Reviewed-HEAD, and closed members")
     changed_paths = {
         new if code in "CR" else old
         for code, old, new in entries
@@ -383,11 +402,15 @@ def staged_abandon_target(new_archives, state):
 
 
 @lru_cache(maxsize=None)
+def git_output(*arguments):
+    return subprocess.run(["git", *arguments], capture_output=True, encoding="utf-8", errors="replace", check=True).stdout.strip()
+
+
 def current_branch():
     return subprocess.run(
         ["git", "branch", "--show-current"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=True,
     ).stdout.strip()
 
@@ -398,7 +421,7 @@ def closed_milestone_reason():
         return None
     commits = subprocess.run(
         ["git", "log", "--format=%H", "--grep=^ship:", "HEAD"],
-        capture_output=True, text=True, check=True,
+        capture_output=True, encoding="utf-8", errors="replace", check=True,
     ).stdout.splitlines()
     if any(ship_commit_at(sha, branch) for sha in commits):
         return (f"closed milestone {branch} accepts no new work; finish integration "
@@ -411,7 +434,7 @@ def head_descends_from(commit):
         subprocess.run(
             ["git", "merge-base", "--is-ancestor", commit, "HEAD"],
             capture_output=True,
-            text=True,
+            encoding="utf-8", errors="replace",
             check=False,
         ).returncode
         == 0
@@ -429,7 +452,7 @@ def repo_root():
         subprocess.run(
             ["git", "rev-parse", "--show-toplevel"],
             capture_output=True,
-            text=True,
+            encoding="utf-8", errors="replace",
             check=True,
         ).stdout.strip()
     )
@@ -505,7 +528,7 @@ def ship_commit_at(sha, bound):
     shown = subprocess.run(
         ["git", "show", "--no-patch", "--format=%s", sha],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=True,
     )
     archive = state.get("archive") or ""
@@ -514,13 +537,7 @@ def ship_commit_at(sha, bound):
     )
 
 
-def pre_push_violations(lines):
-    """Refuse ref updates that publish unshipped milestone work.
-
-    A bound-named ref moves only to, or away from, its strict ship commit. Any
-    other ref may not carry a commit whose STATE.md still owes a ship commit.
-    """
-    found = []
+def _push_updates(lines):
     for line in lines:
         parts = line.split()
         if len(parts) != 4:
@@ -528,6 +545,60 @@ def pre_push_violations(lines):
         local_ref, local_sha, remote_ref, remote_sha = parts
         if any(re.fullmatch(r"[0-9a-fA-F]{40}", sha) is None for sha in (local_sha, remote_sha)):
             raise ValueError(f"unexpected pre-push SHA: {line!r}")
+        yield local_ref, local_sha, remote_ref, remote_sha
+
+
+def _commits(*arguments):
+    listed = subprocess.run(
+        ["git", "rev-list", *arguments], capture_output=True, encoding="utf-8", errors="replace", check=True
+    )
+    return set(listed.stdout.split())
+
+
+def member_pre_push_violations(lines, role):
+    """Member mode: the member's own STATE is ignored; coordinator refs need authorization."""
+    checkout, project = repo_root(), role["project"]
+    reserved = members.member_ref_prefixes(project)
+    members.require_origin_main(checkout)
+    exclude = ["--not", "refs/remotes/origin/main"]
+    member_work = None
+    found = []
+    for _, local_sha, remote_ref, remote_sha in _push_updates(lines):
+        if local_sha == NULL_SHA:
+            if remote_ref.startswith(reserved) and not members.authorized(
+                checkout, project, "delete", remote_ref, remote_sha
+            ):
+                found.append(f"{remote_ref} deletion is not authorized by {project}; {MEMBER_PUSH_HINT}")
+            continue
+        if members.authorized(checkout, project, "push", remote_ref, local_sha):
+            continue
+        if remote_ref.startswith(reserved):
+            found.append(
+                f"{remote_ref} <- {local_sha[:12]} is not authorized by {project}; {MEMBER_PUSH_HINT}"
+            )
+            continue
+        if member_work is None:
+            bound = [ref for ref in subprocess.run(
+                ["git", "for-each-ref", "--format=%(refname)", "refs/heads/gsd-path/"],
+                capture_output=True, encoding="utf-8", errors="replace", check=True,
+            ).stdout.split() if ref.startswith(f"refs/heads/gsd-path/{project}-")]
+            member_work = _commits(*bound, *exclude) if bound else set()
+        if member_work & _commits(local_sha, *exclude):
+            found.append(
+                f"{remote_ref} <- {local_sha[:12]} carries unpublished {project} member work; "
+                f"{MEMBER_PUSH_HINT}"
+            )
+    return found
+
+
+def pre_push_violations(lines):
+    """Refuse ref updates that publish unshipped milestone work.
+
+    A bound-named ref moves only to, or away from, its strict ship commit. Any
+    other ref may not carry a commit whose STATE.md still owes a ship commit.
+    """
+    found = []
+    for local_ref, local_sha, remote_ref, remote_sha in _push_updates(lines):
         names = [ref.removeprefix("refs/heads/") for ref in (local_ref, remote_ref)]
         bounds = {name for name in names if BOUND_BRANCH.fullmatch(name)}
         if bounds:
@@ -574,7 +645,7 @@ def default_branch():
     origin_head = subprocess.run(
         ["git", "symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     if origin_head.returncode == 0 and origin_head.stdout.strip().startswith("origin/"):
@@ -582,7 +653,7 @@ def default_branch():
     configured = subprocess.run(
         ["git", "config", "--get", "init.defaultBranch"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     if configured.returncode == 0 and configured.stdout.strip():
@@ -604,7 +675,7 @@ def is_integration_merge(subject):
     merge_head = subprocess.run(
         ["git", "rev-parse", "--verify", "--quiet", "MERGE_HEAD^{commit}"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     bound_head = subprocess.run(
@@ -616,7 +687,7 @@ def is_integration_merge(subject):
             f"refs/heads/{match.group('branch')}^{{commit}}",
         ],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     return (
@@ -708,18 +779,34 @@ def report(found, action):
 
 
 def main(argv):
+    # Git reads hook output as UTF-8; a Windows pipe would default to cp1252.
+    # In-process callers may substitute text streams.
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="replace")
     if len(argv) > 1 and argv[1] == "closed-milestone":
         reason = closed_milestone_reason()
         return report([reason] if reason else [], "mutation")
     if len(argv) > 1 and argv[1] == "pre-push":
         try:
-            found = pre_push_violations(sys.stdin.read().splitlines())
+            stdin = getattr(sys.stdin, "buffer", None)
+            text = (stdin.read().decode("utf-8", errors="surrogateescape")
+                    if stdin is not None else sys.stdin.read())
+            lines = text.splitlines()
+            role = members.member_role(repo_root())
+            found = member_pre_push_violations(lines, role) if role else pre_push_violations(lines)
         except Exception as error:
             print(f"gsd-path guard: inspection failed; push blocked ({error})", file=sys.stderr)
             return 1
         return report(found, "push")
     try:
-        reason = closed_milestone_reason()
+        # A member follows its coordinator, so its own STATE does not gate commits.
+        role = members.member_role(repo_root())
+        member = role is not None
+        if member and current_branch().startswith(f"gsd-path/{role['project']}-"):
+            return report([f"direct commits on the member bound branch {current_branch()} are refused; "
+                           "member tasks land there through Path"], "commit")
+        reason = None if member else closed_milestone_reason()
         if reason:
             return report([reason], "commit")
         entries = staged_entries()
@@ -740,7 +827,7 @@ def main(argv):
         )
         if abandon is not None:
             current_archive = abandon[0]
-        landing = product_commit_violations(entries, subject, body)
+        landing = [] if member else product_commit_violations(entries, subject, body)
     except Exception as error:
         print(
             f"gsd-path guard: inspection failed; commit blocked ({error}); "