timothy/ersatztv
1
0
Fork 0
Code Issues 54 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

Mutation harness: reset_sandbox does not restore .git control state #816

New Issue
Open
opened 2026-08-22 15:00:36 +02:00 by timothy · 0 comments
timothy commented 2026-08-22 15:00:36 +02:00
Owner
Copy Link
Copy Source

Non-blocking finding from #790's round-9 cold review, filed so it is not lost.

scripts/tests/mutation_harness_lib.py's reset_sandbox restores the tracked tree, the index and
HEAD's commit (git reset --hard <recorded baseline OID>) and removes untracked/ignored content
including nested repositories (git clean -qffdx). It does not restore every piece of .git
state: symbolic branch identity, local config and hooks, replacement refs, registered-worktree
metadata, reflogs and loose objects survive a reset.

No current manifest entry can trigger this. All 13 declared mutations' proof tests do their
git init / commit / worktree add against repositories under their own tmp_path, never against
the harness sandbox — verified in the round-9 review. This is a boundary that holds today because of
what the proofs happen to do, not because the reset enforces it.

It matters the moment a future proof drives git against the sandbox root itself: switching branches,
installing a replacement ref, or making the baseline commit unreachable and pruning it would leave
later verdicts computed against a tree nobody intended. That is the same shape as the defect round 7
found (a bare git reset --hard restoring a proof's own commit) — silent, and surfacing as an
unrelated red several mutations later.

Options

  • Rebuild the sandbox per mutation. Strongest isolation; costs ~4s x 13 instead of ~4s once.
  • Snapshot and restore the .git control state (symbolic HEAD, config, hooks, refs) alongside the
    tree.
  • Assert the invariant instead of enforcing it: after each reset, check the sandbox's .git state
    against what build_sandbox left, and fail loudly if a proof moved it.

The third is cheapest and matches this milestone's preference for making the system REPORT rather
than infer.

Done-when

  • The chosen option is implemented, or the boundary is recorded as deliberate with its reasoning
  • A regression test drives a proof that dirties the sandbox's .git state and shows the harness
    either survives it or reports it
  • Adversarial review passed

Refs #790

Non-blocking finding from #790's round-9 cold review, filed so it is not lost. `scripts/tests/mutation_harness_lib.py`'s `reset_sandbox` restores the tracked tree, the index and HEAD's commit (`git reset --hard <recorded baseline OID>`) and removes untracked/ignored content including nested repositories (`git clean -qffdx`). It does **not** restore every piece of `.git` state: symbolic branch identity, local config and hooks, replacement refs, registered-worktree metadata, reflogs and loose objects survive a reset. **No current manifest entry can trigger this.** All 13 declared mutations' proof tests do their `git init` / `commit` / `worktree add` against repositories under their own `tmp_path`, never against the harness sandbox — verified in the round-9 review. This is a boundary that holds today because of what the proofs happen to do, not because the reset enforces it. It matters the moment a future proof drives git against the sandbox root itself: switching branches, installing a replacement ref, or making the baseline commit unreachable and pruning it would leave later verdicts computed against a tree nobody intended. That is the same shape as the defect round 7 found (a bare `git reset --hard` restoring a proof's own commit) — silent, and surfacing as an unrelated red several mutations later. ## Options - Rebuild the sandbox per mutation. Strongest isolation; costs ~4s x 13 instead of ~4s once. - Snapshot and restore the `.git` control state (symbolic HEAD, config, hooks, refs) alongside the tree. - Assert the invariant instead of enforcing it: after each reset, check the sandbox's `.git` state against what `build_sandbox` left, and fail loudly if a proof moved it. The third is cheapest and matches this milestone's preference for making the system REPORT rather than infer. ## Done-when - [ ] The chosen option is implemented, or the boundary is recorded as deliberate with its reasoning - [ ] A regression test drives a proof that dirties the sandbox's `.git` state and shows the harness either survives it or reports it - [ ] Adversarial review passed Refs #790
timothy added the ci-cdpriority: low labels 2026-08-22 15:00:37 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels ci-cd priority: low
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#816