chore: commit-identity gate + two latent breaks it surfaced - #178
Open
rctruta wants to merge 3 commits into
Open
chore: commit-identity gate + two latent breaks it surfaced#178rctruta wants to merge 3 commits into
rctruta wants to merge 3 commits into
Conversation
Commits must use the masked GitHub address. Global git config already sets it; the failure mode was a tool overriding it per-command, which leaked a real address into commits on a public repo. Appended to the existing pre-commit hook so the branch-protection check is preserved. Verified: a commit with a non-masked email is refused.
Two latent breaks, both surfaced by running the suite in a clean environment. litellm is imported by agent_specialist.py and scripts/autonomous_agent.py but was declared in neither pyproject.toml nor uv.lock. It survived only as an ad-hoc install, so any 'uv sync' (which prunes to the lock) took the agent tests red. An undeclared runtime import is a break in any fresh checkout. run.sh invoked a bare 'python', which resolves only when a venv is activated in the calling shell; macOS ships python3 only. Callers that spawn the script without activation -- including test_golden_capsule.py -- got exit 127. Now resolves the repo venv, falls back to python3, and fails loudly with neither. Verified: 699 passed with no venv activated (was 698 passed, 1 failed).
test_run_sh_lock built its mock by str.replace on the literal 'python run_experiment.py "$@"'. When run.sh changed the interpreter, the replace matched nothing and returned the content unchanged -- so the lock tests spawned the REAL experiment runner instead of a sleep, and failed with an argparse usage error that points nowhere near the cause. Match by pattern and assert exactly one substitution applied. A stub that can silently no-op is the defect; a miss is now a loud error naming the fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Identity gate (the ask)
Commits must use the masked GitHub address. Global git config already set it correctly; the failure mode was a tool passing a per-command
-c user.email=override, which bypasses config silently and leaked a real address into commits on a public repo.Appended to
.githooks/pre-commit, so the existing branch-protection check is preserved — it fired and blocked the first attempt at this very commit. Verified live: a commit with a non-masked email is refused.Two latent breaks this surfaced
Running the suite in a clean environment (
uv syncprunes to the lock) turned up two things that had nothing to do with the gate:litellmwas undeclared. Imported byagent_specialist.pyandscripts/autonomous_agent.py, present in neitherpyproject.tomlnoruv.lock. It survived only as an ad-hoc install — so the agent tests were one clean checkout away from red, anduv synctook them there.run.shcalled a barepython(since 2025-12-19). That resolves only with a venv activated; macOS shipspython3only.test_golden_capsulespawns the script unactivated and got exit 127. The pre-push hook had been papering over this by prepending the venv bin to PATH. Now the script resolves its own interpreter and fails loudly if it can't.test_run_sh_lockstubbedrun.shby exact string literal. Fixing (2) made thestr.replaceno-op, so the lock tests silently ran the real experiment runner. Now pattern-matched with an assertion that exactly one substitution applied — a stub that can quietly no-op is the actual defect.Verification
699 passed, 0 failed, with no venv activated. Pushed through the pre-push gate, no
--no-verify.