gitgrip 2.0.0a7__tar.gz → 2.0.0a8__tar.gz

{gitgrip-2.0.0a7 → gitgrip-2.0.0a8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgrip
-Version: 2.0.0a7
+Version: 2.0.0a8
 Summary: Workspace layer for multi-repo work: workspaces, isolated lanes, and one grouped review per slice
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -21,7 +21,7 @@ Requires-Dist: packaging>=22; extra == "dev"
 ## Install
 
 ```bash
-uv tool install --pre gitgrip    # the PyPI package is "gitgrip"; the command is "gr2"
+uv tool install --pre gitgrip    # the PyPI package is "gitgrip"; it installs `gr` and `gr2`
 gr2 --version
 ```
 
@@ -37,7 +37,9 @@ gr2 --version
 
 Already installed 1.5.0 or 1.5.1? The install commands above leave it in place, because an installed version already satisfies them. Upgrade explicitly: `uv tool upgrade --prerelease allow gitgrip`, or `pip install --pre -U gitgrip`. To run unreleased development code instead, install from a checkout: `pip install -e gr2/` from the repository root.
 
-The Rust `gr` (gr1, 1.x) installs with `brew install synapt-dev/tap/gitgrip` or `cargo install gitgrip`. The two do not collide; you can have both installed.
+The package installs two commands. `gr2` always runs gr2. `gr` picks by the nearest workspace marker: in a gr1 workspace (`.gitgrip`) it runs gr1, and anywhere else, including outside any workspace, it runs gr2.
+
+The Rust `gr` (gr1, 1.x) installs with `brew install synapt-dev/tap/gitgrip` or `cargo install gitgrip`, as `gr` and `gitgrip`. You can have both installed. Whichever `gr` comes first on `PATH` answers: gitgrip 1.5 and earlier always run gr1, so if it comes first, type `gr2` for gr2 (`gr2` says so once). In a gr1 workspace, this package's `gr` runs gr1 through `gitgrip`. With no gr1 installed, it serves a workspace already moved with `gr2 workspace migrate-gr1`, and in one not yet moved it says how to move it.
 
 ## First five minutes
 
@@ -108,13 +110,45 @@ Not there yet:
 | `sync` | status, run |
 | `pr` | create, status, checks, merge, view |
 | `check` | run, show |
-| `review` | open, close, checkout-pr, run, check, bind, publish, receive, verify, show, merge, rebind, create-project |
+| `review` | open, close, checkout-pr, run, check, pin, publish, receive, verify, show, stamp, merge, repin, create-project, bind, approve, rebind |
 | `exec` | status, run |
 | `repo` | status, projection-run |
 | `hooks` | trust, revoke, status, show, run |
 | `store` | init, commit, check, push, status, log, diff, checkout, materialize, migrate, migrate-reviews |
 | `target`, `config` | stored PR target; config overlays |
 
+`review bind`, `review approve` and `review rebind` remain as aliases of `pin`, `stamp` and `repin`.
+
+The words these commands use (lane, pin, stamp, repin, gate, review) are defined in [docs/GLOSSARY.md](docs/GLOSSARY.md).
+
+## Stamps (unsigned approvals)
+
+Inside a workspace with one pinned review matching every member's current head,
+a reviewer stamps it as the workspace's Git `user.name`:
+
+```bash
+gr2 review stamp
+gr2 review merge
+```
+
+The author recorded by the pin, and anyone who authored a commit in its range,
+cannot stamp it. A stamp records an approval; approver names are self-declared and receipts say `signed: false`.
+Repeated stamps by the same name count once. A moved head needs a new pin
+and fresh stamps. Signing is not implemented by these commands.
+
+The workspace's `grip.toml` sets the number required before merging:
+
+```toml
+[approvals]
+required = 2
+```
+
+The default is zero; `review merge --approvals N` can raise the count for that
+run, but cannot lower the workspace policy. With zero required, the merge gate
+skips approval counting. When approvals are required, broken records or different
+chain tips across member remotes refuse before this run pushes a merge. After a refused stamp, rerun
+`review stamp` to read the current chain and retry with a lease.
+
 ## Overlay substrate
 
 gr2 also carries the config-overlay substrate (capture, compose, and materialize configuration layers over a workspace): see [docs/OVERLAY-SUBSTRATE.md](docs/OVERLAY-SUBSTRATE.md).
@@ -133,17 +167,17 @@ Migration: use `gr2 review check` for compiled review requirements. `review requ
 remains a hidden alias with a warning on stderr until beta. Both report `satisfied`
 in the same JSON payload, and a missing reviewer remains a reported status with exit 0.
 
-A bare `gr2 review open <workspace>` uses the workspace's sole review bind. Its default directory is `<workspace>.review/<sha8>` in the workspace's parent directory, and the command announces that path on stderr. Give `--lane-dir` to choose another location.
+A bare `gr2 review open <workspace>` uses the workspace's sole pinned review. Its default directory is `<workspace>.review/<sha8>` in the workspace's parent directory, and the command announces that path on stderr. Give `--lane-dir` to choose another location.
 
-New review binds record the binder's Git `user.name` from the workspace root.
+New pinned reviews record the author's Git `user.name` from the workspace root.
 Set it with `git config user.name 'Your Name'` there if Git has no configured name.
-`review show --json` and `review verify --json` include this author; older binds
+`review show --json` and `review verify --json` include this author; older pinned reviews
 remain readable without an author field, and reading them does not invent one.
 
 
 ## Transfer a native review
 
-Publish an existing bound review and receive it in another native workspace:
+Publish an existing pinned review and receive it in another native workspace:
 
 ```bash
 gr2 review publish gr:<full-review-id> --remote https://example.org/workspace.git
@@ -164,7 +198,7 @@ refused without falling back to context.
 Publish transfers only that review ref and confirms its returned target. Receive
 compares both the advertised and actual fetched raw target with the expected ID,
 requires a commit and recomputable review content, then creates the canonical
-local bind ref. A valid same-ID receive is idempotent. A conflicting existing ref
+local review ref. A valid same-ID receive is idempotent. A conflicting existing ref
 is refused. Object downloads may remain after refusal. The owned temporary ref
 is removed separately, and cleanup failure is reported without replacing a
 primary failure.
@@ -183,6 +217,9 @@ or cleanup authority. Opening a reconstruction remains a separate operation.
 External packages can expose a zero-argument factory through the
 `gr2.platform_adapters` entry-point group. See [the adapter contract](docs/PR-LIFECYCLE.md#51-adapter-protocol-and-capabilities)
 for registration, optional operation capabilities and merge head-pin requirements.
+What changed in that protocol, release by release, ships in the package: read it from
+an install with `importlib.resources.files("gr2") / "PLATFORM_ADAPTER_CHANGELOG.md"`,
+or in this repository at [gr2/PLATFORM_ADAPTER_CHANGELOG.md](gr2/PLATFORM_ADAPTER_CHANGELOG.md).
 Select the installed adapter with `gr2 pr create ... --platform NAME` on a
 materialized lane. The bound-lane path currently pushes and returns its receipt.
 
@@ -225,13 +262,13 @@ failure at that commit. Concurrent writes union observations with bounded
 compare-and-swap retries. An unmeasurable push acknowledgement is reported as
 indeterminate unless a fresh remote read confirms the observation.
 
-## Merge a bound review into plain Git remotes
+## Merge a pinned review into plain Git remotes
 
 ```sh
 gr2 review merge
 ```
 
-This merges the review bound at the members' current heads, from their current branch, into the
+This merges the review pinned at the members' current heads, from their current branch, into the
 branch on each remote that still sits at the reviewed base, and prints what it resolved. If several
 branches sit there, it asks for `--into`. It merges only if every member's remote feature
 branch is still the reviewed head, the target is still the reviewed base, and the exact-head check
@@ -243,7 +280,7 @@ Exit codes:
 - 3: none merged (refused);
 - 4: partial or unknown.
 
-A review id, `--from` and `--into` override the defaults. Zero or several matching binds, or members on
+A review id, `--from` and `--into` override the defaults. Zero or several matching pinned reviews, or members on
 different branches, refuse and name the value to pass.
 
 These records are attestations by writers trusted with remote access, not signed

{gitgrip-2.0.0a7 → gitgrip-2.0.0a8}/README.md

@@ -5,7 +5,7 @@
 ## Install
 
 ```bash
-uv tool install --pre gitgrip    # the PyPI package is "gitgrip"; the command is "gr2"
+uv tool install --pre gitgrip    # the PyPI package is "gitgrip"; it installs `gr` and `gr2`
 gr2 --version
 ```
 
@@ -21,7 +21,9 @@ gr2 --version
 
 Already installed 1.5.0 or 1.5.1? The install commands above leave it in place, because an installed version already satisfies them. Upgrade explicitly: `uv tool upgrade --prerelease allow gitgrip`, or `pip install --pre -U gitgrip`. To run unreleased development code instead, install from a checkout: `pip install -e gr2/` from the repository root.
 
-The Rust `gr` (gr1, 1.x) installs with `brew install synapt-dev/tap/gitgrip` or `cargo install gitgrip`. The two do not collide; you can have both installed.
+The package installs two commands. `gr2` always runs gr2. `gr` picks by the nearest workspace marker: in a gr1 workspace (`.gitgrip`) it runs gr1, and anywhere else, including outside any workspace, it runs gr2.
+
+The Rust `gr` (gr1, 1.x) installs with `brew install synapt-dev/tap/gitgrip` or `cargo install gitgrip`, as `gr` and `gitgrip`. You can have both installed. Whichever `gr` comes first on `PATH` answers: gitgrip 1.5 and earlier always run gr1, so if it comes first, type `gr2` for gr2 (`gr2` says so once). In a gr1 workspace, this package's `gr` runs gr1 through `gitgrip`. With no gr1 installed, it serves a workspace already moved with `gr2 workspace migrate-gr1`, and in one not yet moved it says how to move it.
 
 ## First five minutes
 
@@ -92,13 +94,45 @@ Not there yet:
 | `sync` | status, run |
 | `pr` | create, status, checks, merge, view |
 | `check` | run, show |
-| `review` | open, close, checkout-pr, run, check, bind, publish, receive, verify, show, merge, rebind, create-project |
+| `review` | open, close, checkout-pr, run, check, pin, publish, receive, verify, show, stamp, merge, repin, create-project, bind, approve, rebind |
 | `exec` | status, run |
 | `repo` | status, projection-run |
 | `hooks` | trust, revoke, status, show, run |
 | `store` | init, commit, check, push, status, log, diff, checkout, materialize, migrate, migrate-reviews |
 | `target`, `config` | stored PR target; config overlays |
 
+`review bind`, `review approve` and `review rebind` remain as aliases of `pin`, `stamp` and `repin`.
+
+The words these commands use (lane, pin, stamp, repin, gate, review) are defined in [docs/GLOSSARY.md](docs/GLOSSARY.md).
+
+## Stamps (unsigned approvals)
+
+Inside a workspace with one pinned review matching every member's current head,
+a reviewer stamps it as the workspace's Git `user.name`:
+
+```bash
+gr2 review stamp
+gr2 review merge
+```
+
+The author recorded by the pin, and anyone who authored a commit in its range,
+cannot stamp it. A stamp records an approval; approver names are self-declared and receipts say `signed: false`.
+Repeated stamps by the same name count once. A moved head needs a new pin
+and fresh stamps. Signing is not implemented by these commands.
+
+The workspace's `grip.toml` sets the number required before merging:
+
+```toml
+[approvals]
+required = 2
+```
+
+The default is zero; `review merge --approvals N` can raise the count for that
+run, but cannot lower the workspace policy. With zero required, the merge gate
+skips approval counting. When approvals are required, broken records or different
+chain tips across member remotes refuse before this run pushes a merge. After a refused stamp, rerun
+`review stamp` to read the current chain and retry with a lease.
+
 ## Overlay substrate
 
 gr2 also carries the config-overlay substrate (capture, compose, and materialize configuration layers over a workspace): see [docs/OVERLAY-SUBSTRATE.md](docs/OVERLAY-SUBSTRATE.md).
@@ -117,17 +151,17 @@ Migration: use `gr2 review check` for compiled review requirements. `review requ
 remains a hidden alias with a warning on stderr until beta. Both report `satisfied`
 in the same JSON payload, and a missing reviewer remains a reported status with exit 0.
 
-A bare `gr2 review open <workspace>` uses the workspace's sole review bind. Its default directory is `<workspace>.review/<sha8>` in the workspace's parent directory, and the command announces that path on stderr. Give `--lane-dir` to choose another location.
+A bare `gr2 review open <workspace>` uses the workspace's sole pinned review. Its default directory is `<workspace>.review/<sha8>` in the workspace's parent directory, and the command announces that path on stderr. Give `--lane-dir` to choose another location.
 
-New review binds record the binder's Git `user.name` from the workspace root.
+New pinned reviews record the author's Git `user.name` from the workspace root.
 Set it with `git config user.name 'Your Name'` there if Git has no configured name.
-`review show --json` and `review verify --json` include this author; older binds
+`review show --json` and `review verify --json` include this author; older pinned reviews
 remain readable without an author field, and reading them does not invent one.
 
 
 ## Transfer a native review
 
-Publish an existing bound review and receive it in another native workspace:
+Publish an existing pinned review and receive it in another native workspace:
 
 ```bash
 gr2 review publish gr:<full-review-id> --remote https://example.org/workspace.git
@@ -148,7 +182,7 @@ refused without falling back to context.
 Publish transfers only that review ref and confirms its returned target. Receive
 compares both the advertised and actual fetched raw target with the expected ID,
 requires a commit and recomputable review content, then creates the canonical
-local bind ref. A valid same-ID receive is idempotent. A conflicting existing ref
+local review ref. A valid same-ID receive is idempotent. A conflicting existing ref
 is refused. Object downloads may remain after refusal. The owned temporary ref
 is removed separately, and cleanup failure is reported without replacing a
 primary failure.
@@ -167,6 +201,9 @@ or cleanup authority. Opening a reconstruction remains a separate operation.
 External packages can expose a zero-argument factory through the
 `gr2.platform_adapters` entry-point group. See [the adapter contract](docs/PR-LIFECYCLE.md#51-adapter-protocol-and-capabilities)
 for registration, optional operation capabilities and merge head-pin requirements.
+What changed in that protocol, release by release, ships in the package: read it from
+an install with `importlib.resources.files("gr2") / "PLATFORM_ADAPTER_CHANGELOG.md"`,
+or in this repository at [gr2/PLATFORM_ADAPTER_CHANGELOG.md](gr2/PLATFORM_ADAPTER_CHANGELOG.md).
 Select the installed adapter with `gr2 pr create ... --platform NAME` on a
 materialized lane. The bound-lane path currently pushes and returns its receipt.
 
@@ -209,13 +246,13 @@ failure at that commit. Concurrent writes union observations with bounded
 compare-and-swap retries. An unmeasurable push acknowledgement is reported as
 indeterminate unless a fresh remote read confirms the observation.
 
-## Merge a bound review into plain Git remotes
+## Merge a pinned review into plain Git remotes
 
 ```sh
 gr2 review merge
 ```
 
-This merges the review bound at the members' current heads, from their current branch, into the
+This merges the review pinned at the members' current heads, from their current branch, into the
 branch on each remote that still sits at the reviewed base, and prints what it resolved. If several
 branches sit there, it asks for `--into`. It merges only if every member's remote feature
 branch is still the reviewed head, the target is still the reviewed base, and the exact-head check
@@ -227,7 +264,7 @@ Exit codes:
 - 3: none merged (refused);
 - 4: partial or unknown.
 
-A review id, `--from` and `--into` override the defaults. Zero or several matching binds, or members on
+A review id, `--from` and `--into` override the defaults. Zero or several matching pinned reviews, or members on
 different branches, refuse and name the value to pass.
 
 These records are attestations by writers trusted with remote access, not signed

{gitgrip-2.0.0a7 → gitgrip-2.0.0a8}/gitgrip.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgrip
-Version: 2.0.0a7
+Version: 2.0.0a8
 Summary: Workspace layer for multi-repo work: workspaces, isolated lanes, and one grouped review per slice
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -21,7 +21,7 @@ Requires-Dist: packaging>=22; extra == "dev"
 ## Install
 
 ```bash
-uv tool install --pre gitgrip    # the PyPI package is "gitgrip"; the command is "gr2"
+uv tool install --pre gitgrip    # the PyPI package is "gitgrip"; it installs `gr` and `gr2`
 gr2 --version
 ```
 
@@ -37,7 +37,9 @@ gr2 --version
 
 Already installed 1.5.0 or 1.5.1? The install commands above leave it in place, because an installed version already satisfies them. Upgrade explicitly: `uv tool upgrade --prerelease allow gitgrip`, or `pip install --pre -U gitgrip`. To run unreleased development code instead, install from a checkout: `pip install -e gr2/` from the repository root.
 
-The Rust `gr` (gr1, 1.x) installs with `brew install synapt-dev/tap/gitgrip` or `cargo install gitgrip`. The two do not collide; you can have both installed.
+The package installs two commands. `gr2` always runs gr2. `gr` picks by the nearest workspace marker: in a gr1 workspace (`.gitgrip`) it runs gr1, and anywhere else, including outside any workspace, it runs gr2.
+
+The Rust `gr` (gr1, 1.x) installs with `brew install synapt-dev/tap/gitgrip` or `cargo install gitgrip`, as `gr` and `gitgrip`. You can have both installed. Whichever `gr` comes first on `PATH` answers: gitgrip 1.5 and earlier always run gr1, so if it comes first, type `gr2` for gr2 (`gr2` says so once). In a gr1 workspace, this package's `gr` runs gr1 through `gitgrip`. With no gr1 installed, it serves a workspace already moved with `gr2 workspace migrate-gr1`, and in one not yet moved it says how to move it.
 
 ## First five minutes
 
@@ -108,13 +110,45 @@ Not there yet:
 | `sync` | status, run |
 | `pr` | create, status, checks, merge, view |
 | `check` | run, show |
-| `review` | open, close, checkout-pr, run, check, bind, publish, receive, verify, show, merge, rebind, create-project |
+| `review` | open, close, checkout-pr, run, check, pin, publish, receive, verify, show, stamp, merge, repin, create-project, bind, approve, rebind |
 | `exec` | status, run |
 | `repo` | status, projection-run |
 | `hooks` | trust, revoke, status, show, run |
 | `store` | init, commit, check, push, status, log, diff, checkout, materialize, migrate, migrate-reviews |
 | `target`, `config` | stored PR target; config overlays |
 
+`review bind`, `review approve` and `review rebind` remain as aliases of `pin`, `stamp` and `repin`.
+
+The words these commands use (lane, pin, stamp, repin, gate, review) are defined in [docs/GLOSSARY.md](docs/GLOSSARY.md).
+
+## Stamps (unsigned approvals)
+
+Inside a workspace with one pinned review matching every member's current head,
+a reviewer stamps it as the workspace's Git `user.name`:
+
+```bash
+gr2 review stamp
+gr2 review merge
+```
+
+The author recorded by the pin, and anyone who authored a commit in its range,
+cannot stamp it. A stamp records an approval; approver names are self-declared and receipts say `signed: false`.
+Repeated stamps by the same name count once. A moved head needs a new pin
+and fresh stamps. Signing is not implemented by these commands.
+
+The workspace's `grip.toml` sets the number required before merging:
+
+```toml
+[approvals]
+required = 2
+```
+
+The default is zero; `review merge --approvals N` can raise the count for that
+run, but cannot lower the workspace policy. With zero required, the merge gate
+skips approval counting. When approvals are required, broken records or different
+chain tips across member remotes refuse before this run pushes a merge. After a refused stamp, rerun
+`review stamp` to read the current chain and retry with a lease.
+
 ## Overlay substrate
 
 gr2 also carries the config-overlay substrate (capture, compose, and materialize configuration layers over a workspace): see [docs/OVERLAY-SUBSTRATE.md](docs/OVERLAY-SUBSTRATE.md).
@@ -133,17 +167,17 @@ Migration: use `gr2 review check` for compiled review requirements. `review requ
 remains a hidden alias with a warning on stderr until beta. Both report `satisfied`
 in the same JSON payload, and a missing reviewer remains a reported status with exit 0.
 
-A bare `gr2 review open <workspace>` uses the workspace's sole review bind. Its default directory is `<workspace>.review/<sha8>` in the workspace's parent directory, and the command announces that path on stderr. Give `--lane-dir` to choose another location.
+A bare `gr2 review open <workspace>` uses the workspace's sole pinned review. Its default directory is `<workspace>.review/<sha8>` in the workspace's parent directory, and the command announces that path on stderr. Give `--lane-dir` to choose another location.
 
-New review binds record the binder's Git `user.name` from the workspace root.
+New pinned reviews record the author's Git `user.name` from the workspace root.
 Set it with `git config user.name 'Your Name'` there if Git has no configured name.
-`review show --json` and `review verify --json` include this author; older binds
+`review show --json` and `review verify --json` include this author; older pinned reviews
 remain readable without an author field, and reading them does not invent one.
 
 
 ## Transfer a native review
 
-Publish an existing bound review and receive it in another native workspace:
+Publish an existing pinned review and receive it in another native workspace:
 
 ```bash
 gr2 review publish gr:<full-review-id> --remote https://example.org/workspace.git
@@ -164,7 +198,7 @@ refused without falling back to context.
 Publish transfers only that review ref and confirms its returned target. Receive
 compares both the advertised and actual fetched raw target with the expected ID,
 requires a commit and recomputable review content, then creates the canonical
-local bind ref. A valid same-ID receive is idempotent. A conflicting existing ref
+local review ref. A valid same-ID receive is idempotent. A conflicting existing ref
 is refused. Object downloads may remain after refusal. The owned temporary ref
 is removed separately, and cleanup failure is reported without replacing a
 primary failure.
@@ -183,6 +217,9 @@ or cleanup authority. Opening a reconstruction remains a separate operation.
 External packages can expose a zero-argument factory through the
 `gr2.platform_adapters` entry-point group. See [the adapter contract](docs/PR-LIFECYCLE.md#51-adapter-protocol-and-capabilities)
 for registration, optional operation capabilities and merge head-pin requirements.
+What changed in that protocol, release by release, ships in the package: read it from
+an install with `importlib.resources.files("gr2") / "PLATFORM_ADAPTER_CHANGELOG.md"`,
+or in this repository at [gr2/PLATFORM_ADAPTER_CHANGELOG.md](gr2/PLATFORM_ADAPTER_CHANGELOG.md).
 Select the installed adapter with `gr2 pr create ... --platform NAME` on a
 materialized lane. The bound-lane path currently pushes and returns its receipt.
 
@@ -225,13 +262,13 @@ failure at that commit. Concurrent writes union observations with bounded
 compare-and-swap retries. An unmeasurable push acknowledgement is reported as
 indeterminate unless a fresh remote read confirms the observation.
 
-## Merge a bound review into plain Git remotes
+## Merge a pinned review into plain Git remotes
 
 ```sh
 gr2 review merge
 ```
 
-This merges the review bound at the members' current heads, from their current branch, into the
+This merges the review pinned at the members' current heads, from their current branch, into the
 branch on each remote that still sits at the reviewed base, and prints what it resolved. If several
 branches sit there, it asks for `--into`. It merges only if every member's remote feature
 branch is still the reviewed head, the target is still the reviewed base, and the exact-head check
@@ -243,7 +280,7 @@ Exit codes:
 - 3: none merged (refused);
 - 4: partial or unknown.
 
-A review id, `--from` and `--into` override the defaults. Zero or several matching binds, or members on
+A review id, `--from` and `--into` override the defaults. Zero or several matching pinned reviews, or members on
 different branches, refuse and name the value to pass.
 
 These records are attestations by writers trusted with remote access, not signed

{gitgrip-2.0.0a7 → gitgrip-2.0.0a8}/gitgrip.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ gitgrip.egg-info/dependency_links.txt
 gitgrip.egg-info/entry_points.txt
 gitgrip.egg-info/requires.txt
 gitgrip.egg-info/top_level.txt
+gr2/PLATFORM_ADAPTER_CHANGELOG.md
 gr2/__init__.py
 gr2/api_core.py
 gr2/overlay/__init__.py
@@ -50,6 +51,7 @@ gr2/python_cli/__main__.py
 gr2/python_cli/add.py
 gr2/python_cli/app.py
 gr2/python_cli/approval_schema.py
+gr2/python_cli/approvals.py
 gr2/python_cli/branch.py
 gr2/python_cli/channel_bridge.py
 gr2/python_cli/check_records.py
@@ -70,6 +72,7 @@ gr2/python_cli/git_review.py
 gr2/python_cli/gitinclude.py
 gr2/python_cli/gitops.py
 gr2/python_cli/gr_resolver.py
+gr2/python_cli/gr_shadow.py
 gr2/python_cli/grip.py
 gr2/python_cli/grip_cli.py
 gr2/python_cli/hooks.py
@@ -156,10 +159,14 @@ tests/test_first_five_minutes.py
 tests/test_foreground_launch_runtime.py
 tests/test_git_review.py
 tests/test_gitinclude_compiler.py
+tests/test_gitops_shared.py
 tests/test_gr1_first_run_guidance.py
 tests/test_gr2_packaging.py
 tests/test_gr2_review_receipt.py
+tests/test_gr_installed_wheel.py
+tests/test_gr_resolved_cleared.py
 tests/test_gr_resolver_conformance.py
+tests/test_gr_shadow.py
 tests/test_grip_cli.py
 tests/test_grip_hardening.py
 tests/test_grip_snapshot.py
@@ -183,6 +190,7 @@ tests/test_lane_lease_show_json.py
 tests/test_lane_lifecycle_safety.py
 tests/test_lane_plugins.py
 tests/test_lane_probe.py
+tests/test_lane_probe_batch.py
 tests/test_lane_repo_paths_and_all_skipped.py
 tests/test_lane_roles.py
 tests/test_lane_show_name.py
@@ -229,6 +237,7 @@ tests/test_overlay_tier_b_repo_state.py
 tests/test_overlay_tier_b_staging_discipline.py
 tests/test_overlay_trust_model.py
 tests/test_overlay_workspace_spec.py
+tests/test_platform_adapter_changelog.py
 tests/test_platform_adapter_plugins.py
 tests/test_pr_events.py
 tests/test_pr_group_legibility.py
@@ -260,6 +269,7 @@ tests/test_review_a4_v2.py
 tests/test_review_a4_v3.py
 tests/test_review_allocation_recovery.py
 tests/test_review_ansi_parse.py
+tests/test_review_approvals.py
 tests/test_review_b3_reader_alignment.py
 tests/test_review_bind_author.py
 tests/test_review_bind_fork_base.py
@@ -285,6 +295,7 @@ tests/test_review_install_hint.py
 tests/test_review_merge_gate.py
 tests/test_review_merge_gate_lost_ack.py
 tests/test_review_open_lane.py
+tests/test_review_pin_stamp_names.py
 tests/test_review_pr_marker_context.py
 tests/test_review_reader_defaults.py
 tests/test_review_rebind.py
@@ -306,6 +317,7 @@ tests/test_review_subject.py
 tests/test_review_transport.py
 tests/test_review_v1_format_guard.py
 tests/test_review_verify_inside.py
+tests/test_review_vocabulary.py
 tests/test_rmtree_or_refuse.py
 tests/test_root_option_verbs.py
 tests/test_selected_workspace_commit.py
@@ -348,6 +360,7 @@ tests/test_unit_topological_apply.py
 tests/test_validate_repo_path_conflict.py
 tests/test_version_identity.py
 tests/test_version_static.py
+tests/test_vocabulary.py
 tests/test_workspace_convert_clone.py
 tests/test_workspace_edit_lease_cap.py
 tests/test_workspace_identity_boundary.py

{gitgrip-2.0.0a7 → gitgrip-2.0.0a8}/gitgrip.egg-info/entry_points.txt

@@ -1,3 +1,4 @@
 [console_scripts]
 git-review = gr2.python_cli.git_review:main
+gr = gr2.python_cli.gr_resolver:main
 gr2 = gr2.python_cli.app:main

gitgrip-2.0.0a8/gr2/PLATFORM_ADAPTER_CHANGELOG.md

@@ -0,0 +1,67 @@
+# gr2 platform adapter protocol: changes
+
+This file ships inside the `gitgrip` wheel and sdist, so an adapter author can read it from the installed
+package:
+
+```python
+from importlib.resources import files
+print((files("gr2") / "PLATFORM_ADAPTER_CHANGELOG.md").read_text())
+```
+
+It covers what an out-of-tree adapter implements or receives: the `PlatformAdapter` protocol in
+`gr2.python_cli.platform`, the request and result types passed through it, and the registration seam.
+Each entry names the release that first carried it. The full release notes for every change are in the
+project's `CHANGELOG.md` and its GitHub releases.
+
+`PLATFORM_ADAPTER_API_VERSION` is the protocol's version number. It is `1`, and it changes only for a change
+an existing adapter cannot absorb.
+
+## 2.0.0a8
+
+- **`CreatePRRequest.remote`** is new (default `None`): the exact Git URL configured for the selected
+  member in the workspace spec or review bind. Created PR groups retain it as `prs[].remote` when it is
+  supplied. Direct Python callers may omit it and keep the previous stored-group shape. This is additive
+  to adapter API version 1; factories still take no arguments and `repo` keeps its existing value.
+  Later lifecycle calls still receive the existing repo string; this field supplies creation context only.
+  Lane URLs are stripped of surrounding whitespace; blank values are treated as absent.
+  A lane member URL carrying credentials is refused by member name before adapter calls or PR state writes.
+
+## 2.0.0a7
+
+- **Registration.** Adapters register through the `gr2.platform_adapters` entry point group
+  (`PLATFORM_ADAPTER_ENTRY_POINTS`), or in-process with `register_platform_adapter(name, factory)`, where
+  `factory` takes no arguments and returns the adapter. A factory is loaded only when its platform is
+  selected. Names are lowercase (`[a-z][a-z0-9_-]*`); `github` and `gh` are reserved, and a name registered
+  twice is refused.
+- **`PLATFORM_ADAPTER_API_VERSION = 1`.** An adapter may set `platform_adapter_api_version`; when the adapter
+  is loaded, gr2 refuses one that declares any other value.
+- **`require_adapter_capability(adapter, method)`.** A verb that needs a method the adapter does not
+  provide now fails with a named refusal before any member is changed, instead of a `TypeError` or
+  `AttributeError` mid-run. Every adapter must provide `create_pr` when it is loaded. **`merge_pr` must
+  accept the `method` and `expected_head` keywords**; an adapter whose `merge_pr` does not is refused rather
+  than called without the head pin.
+- **`CreatePRRequest.draft` defaults to `True`** (it was `False`). A pull request opens as a draft unless
+  the caller asks otherwise, so an adapter must honour `draft` rather than assume a ready PR.
+
+## 2.0.0a6
+
+- **`pr_view(repo, number) -> PRDetail`** is new: one PR's full state. `PRDetail` carries `ref`, `state`,
+  `body`, `author`, `labels`, `review_decision`, `reviews`, `head_oid`, `is_draft`, `merged`, `mergeable` and
+  `checks`.
+- **New type `PRReview`**, one review on a PR: `user` and `state`.
+- **`merge_pr(..., *, method, expected_head=None)`** gains `expected_head`. When it is given, the adapter
+  must merge only if the PR's head is still that commit, and refuse otherwise; `gr2 pr merge
+  --match-head-commit` relies on it.
+- **`PRStatus.head_oid`** is new (default `None`): the PR's current head commit, which gr2 compares against
+  the reviewed head.
+
+## 2.0.0a5
+
+- **`edit_pr_body(repo, number, body) -> None`** is new: replaces a PR's description. gr2 uses it to keep a
+  grouped PR set's cross-links current.
+
+## 2.0.0a1 to 2.0.0a4
+
+The protocol as first published: `name`, `create_pr(CreatePRRequest) -> PRRef`, `merge_pr(repo, number, *,
+method) -> MergeReceipt`, `pr_status(repo, number) -> PRStatus`, `list_prs(repo, *, head_branch=None)`, and
+`pr_checks(repo, number) -> list[PRCheck]`. No protocol change between these four releases.

{gitgrip-2.0.0a7 → gitgrip-2.0.0a8}/gr2/overlay/activate.py

@@ -15,6 +15,7 @@ from gr2.overlay.trust import (
     trust_config_path,
 )
 from gr2.overlay.types import OverlayRef
+from gr2.python_cli import gitops
 
 GRIP_DIR = ".grip"
 STACK_FILE = "overlay-stack.json"
@@ -187,10 +188,5 @@ def _load_managed_files(workspace_root: Path) -> dict[str, list[str]]:
 
 
 def _git_output(git_dir: Path, *args: str) -> str:
-    result = subprocess.run(
-        ["git", f"--git-dir={git_dir}", *args],
-        check=True,
-        capture_output=True,
-        text=True,
-    )
+    result = gitops.check(gitops.run_argv(["git", f"--git-dir={git_dir}", *args]))
     return result.stdout.strip()

{gitgrip-2.0.0a7 → gitgrip-2.0.0a8}/gr2/overlay/introspection.py

@@ -8,6 +8,7 @@ from pathlib import Path
 from typing import Any
 
 from gr2.overlay.types import OverlayRef
+from gr2.python_cli import gitops
 
 GRIP_DIR = ".grip"
 
@@ -146,10 +147,5 @@ def _read_overlay_file_list(overlay_store: Path, overlay_ref: OverlayRef) -> lis
 
 
 def _git_output(git_dir: Path, *args: str) -> str:
-    result = subprocess.run(
-        ["git", f"--git-dir={git_dir}", *args],
-        check=True,
-        capture_output=True,
-        text=True,
-    )
+    result = gitops.check(gitops.run_argv(["git", f"--git-dir={git_dir}", *args]))
     return result.stdout.strip()