[ScriptedAlchemy]

DRAFT / HOLD MERGE

Refs #4593. Keep the issue open pending independent review and hosted Linux verification.

A project can set index.include_submodules.v1 and restart its daemon to index a checked-out direct submodule under its parent-relative paths. The default is false. Grep, structural search, the unmounted-file audit and graph indexing share the boundary. The audit reports skipped nested repositories.

Live capture binds the staged parent gitlink and exact pin, the staged and working .gitmodules registration, and the child checkout to the parent's Git administration. It tracks child commits and local additions, edits and removals. Linked worktrees, unrelated clones, nested gitlinks, symlinked source entries and uninitialized children stay outside live indexing. Historical capture uses the selected parent tree and the pinned object in the parent-owned module store. If that store is missing, the historical generation is unavailable.

Verification

At 3fdb50ddbe, five macOS Bazel suites passed 17 selected tests. They cover a call from the parent into its submodule, live grep and graph changes, disabled/restarted indexing, exact historical content after deinitialization, registry convergence, and native Git candidate-tree behavior. The retained scheduler-fixture correction is a separate commit. The workspace dependency fetch and BUILD generator completed. The repository-wide formatting check, MCP production build and hosted Linux run are being verified.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3fdb50d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Refs #4593 — validation blocker at exact head 38bc131598d5d993295f97b7001811209a1b16a5.

The repository-gates job failed before Rust execution: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42433144833/job/128586224987 . The actual failures are:

1. check-generated-rust-entrypoints: stale generated entrypoint/toolchain contract; its diagnostic names package.json packageManager/engines and the setup-pnpm node-version instruction surface.
2. check-generated-api: unexpected generated AgentPromotionStatus.swift and AgentSignalGate.swift bridge surfaces.
3. Domain ownership contract drift: docs/generated/domain-module-map.json, docs/generated/runtime-service-map.json, and crates/tracedecay-configuration/src/generated/project_settings_contract.rs.

git diff --check, CI-shape/scope/environment-policy checks and Bazel BUILD graph checks passed. This is NOT a rustfmt failure, and none of those passes establishes Rust compilation or behavioral correctness. Native tests were skipped by draft selection. I could not establish whether these gate failures also occur on current master: the master status/workflow requests were unavailable to this integration. Do not label them pre-existing without that comparison.

No source fix, Rust test execution, independent review, branch update, merge or issue closure was completed in this follow-up. This environment has no executable repository checkout or Bazel; direct repository retrieval failed, and no usable remote execution/workflow-dispatch capability was exposed. This is a validation limitation, not evidence that the implementation is correct.

#4801 remains diagnostic-only and draft. It does not yet satisfy authenticated submodule admission, pinned child-tree capture, child-aware freshness, or consistent retrieval/graph behavior. Retain Refs #4593; do not infer issue completion from a green diagnostic PR. Reuse this existing issue PR rather than opening a duplicate. The next implementation must use one authenticated submodule inventory across admission/capture/freshness/retrieval, invalidate parent reuse for child commits and edits, preserve linked-worktree/untrusted-repository exclusions, and add nonzero Bazel regressions including opt-in/off, spoof rejection, child changes, historical capture and restart behavior.

Coordination: the dedicated #4593 owner remains responsible for implementation; PR maintenance owns CI assistance without racing its branch. Do not repair unrelated decision-model generated paths by importing forbidden work. #4776 and all Kev/decision-model work remain draft and unmergeable by instruction; #4763 remains read-only. No protections or tests were weakened.

[ScriptedAlchemy]

Refs #4593 — exact-head CI repair 1f8c1997090e4631ee38f50a32af4186e8153c12 (nonforce fast-forward from 38bc131): applied the three exact Rust formatting replacements reported by hosted Bazel //crates/tracedecay-code-index:rustfmt_check_2024 in run 42433144833. Correction: my earlier comment erroneously attributed the failure to generated entrypoints/API/domain maps. The repository-gates log shows the actual failure was rustfmt_check_2024 only; 8 other Bazel test targets passed. No generated-source edits are warranted by that log. Fresh run 42437677389 was queued when last checked; no claim it passed.

The PR is still partial: it adds skipped-nested-repository diagnostics and regression source, but NOT authenticated submodule indexing, freshness, or indexed retrieval. HOLD MERGE even if its current-head diagnostics tests pass: keep this same PR open to complete #4593. Being reviewable or passing preliminary tests does not mean the issue's acceptance is met. No complete-implementation, native macOS or independent-review proof exists. Keep Refs #4593, issue open, and protected Kev/release PRs untouched.

[ScriptedAlchemy]

Refs #4593 — published source repair 8d6f07e1bb326630a313e1911d8bd271f337dd6c on this same branch with expected_sha=1f8c1997090e4631ee38f50a32af4186e8153c12, force=false; independently re-read PR head confirms the update.

Fixed unbounded skipped-repository collection, diagnostics escaping configured directory exclusions, unquoted/unbounded path labels, and swallowed filesystem-walk failures. Added six behavioral regression cases (one Unix-only filename case); existing initialized-submodule and linked/nested-repository exclusions are preserved. Only source_walk.rs, unmounted_files.rs, and the new nested-repository test module changed; no scheduler, generated contract, release, infrastructure or model changes.

Current-head CI: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42442123433 — queued when inspected. These Rust regressions have NOT executed; author diff review is NOT independent review. The prior successful draft run skipped Rust/Clippy/native jobs, so it is not acceptance evidence for these changes.

The existing merge hold remains. This repairs the current audit implementation, not the still-unimplemented optional authenticated submodule indexing feature. Keep the PR draft/open and #4593 open. Continue the integrated admission/capture/freshness/retrieval implementation here rather than opening a duplicate or treating more diagnostic fixes as feature completion.

[ScriptedAlchemy]

Refs #4593 — published nonforce, expected-head fast-forward 8d6f07e → 1b49877, fixing the precise three rustfmt_check_2024 hunks from the current-head hosted Bazel repository-gates failure in run 42442123433 (job 128613365191). The exact diff changes only formatting in source_walk/nested_repository_tests.rs; 8 other repository-gate targets passed before the format failure. Verified #4801 now points to 1b49877, and current-head run 42447730459 was queued at last read. These behavioral Rust regressions have still not run; native/Linux/Clippy remained skipped on the draft workflow, and there is no submitted independent review. HOLD MERGE. Authenticated submodule indexing in parent capture, freshness, historical Git-tree capture, policy/configuration, and indexed/live retrieval remains unimplemented; keep PR draft, issue open and existing hourly owner enabled. Do not import protected Kev/release branches or change CI protections.

[ScriptedAlchemy]

Refs #4593 — published source repair 624cc833 on the existing branch, expected-head NONFORCE fast-forward from 1b498778. Four source paths changed: shared nested-repository/symlink/escape guard in source_walk, parent Git classification tombstones + dirty/freshness invalidation for tracked paths newly hidden behind nested .git, worktree capture guard including explicit ignored-source admission, and freshness roster parity. New real Git and source-boundary regression source is committed; it has not executed via Bazel. The exact-head CI run 42449422792 was still pending; native/OS Rust jobs are skipped for draft PRs. No independent review. This is a partial fail-closed security/correctness fix, NOT the registered-submodule opt-in feature. Hold #4801 DRAFT/unmerged and #4593 OPEN; next owner work must deliver canonical config + authenticated 160000/.gitmodules/topology inventory, child-aware capture, historical pinning, freshness/retrieval parity and nonzero Bazel/native acceptance. PR maintenance: assist only with exact-head CI and do not race this source branch. Preserve #4800/#4508 scheduler work, Kev/#4776 DRAFT and release #4763 read-only.

[ScriptedAlchemy]

Refs #4593 — published exact-head CI repair 9beb7b8 to the existing DRAFT #4801, using expected head 624cc8338a1cfe8486b0638ba88fbbae0df9fa33 and force=false. Hosted run 42449422792 failed Bazel rustfmt_check_2024 for exactly four formatting hunks (two in source_walk.rs, two in classification.rs); eight unrelated repository tests passed. This patch makes exactly those four formatting replacements in those two files, with no behavior changes. PR/ref readback confirms the new head. Fresh current-head run 42455645684 was QUEUED at inspection; no pass is claimed. The draft workflow skips Linux/Windows/macOS Rust tests and Clippy; zero new behavioral Rust tests have executed, and no independent review exists. HOLD MERGE: the integrated authenticated submodule feature (canonical default-off setting, gitlink + .gitmodules + child topology, dirty/historical child capture, freshness, graph/live parity, toggles and restarts) remains unimplemented. Keep issue OPEN and owner schedule unchanged. No Kev/#4776, release/#4763, or peer PR changes.

[ScriptedAlchemy]

Refs #4593 — published narrow default-deny source fix 704a9aac135046fe1d720242a482561a61eb5274 to #4801 with an expected-head NONFORCE fast-forward from 0119cf9 (remote PR ref verified). Parent 160000 gitlinks now remain excluded by the shared live source walker even if the child .git marker is removed; the real registered-submodule regression fixture now exercises that missing-marker case and explicit glob refusal. Production uses the existing in-process gix opener (no shell Git or network); no child indexing is enabled. Source diff changes one file only: crates/tracedecay-code-index/src/source_walk.rs.

Current-head run: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42466514013 (queued at check). NO Bazel behavioral Rust pass or independent review claim. Do not merge or mark ready. Feature acceptance remains integrated authenticated opt-in, pinned historical child capture, child status/freshness and cross-boundary graph/index/live retrieval, with nonzero Bazel/native validation. Preserve #4800 and protected Kev/release lanes.

[ScriptedAlchemy]

Refs #4593 — narrow hosted Bazel formatting repair published at 1899d261 by nonforce, expected-head fast-forward from 704a9aac, independently verified against the remote Git ref and PR head.

Exact-head run 42466514013, repository-gates job 128687191524, failed only //crates/tracedecay-code-index:rustfmt_check_2024, with two exact hunks in source_walk.rs (line wrapping around the workdir and index reads). The other 8 repository-gate targets passed, most cached; these were not code-index behavioral Rust regressions. Commit 1899d261 applies only those two reported formatting replacements in one file, no behavior changes. New-head CI and nonzero Bazel Rust test evidence have not yet been established.

HOLD MERGE: this PR remains DRAFT and contains only exclusion/diagnostic/freshness hardening. The requested default-off authenticated submodule inventory, selected historical child-tree capture, dirty child freshness, and graph/indexed/live retrieval parity remain unimplemented. No independent review. #4593 stays open. Please do not merge or change the draft selection to conceal missing behavior, and preserve #4800/#4508, protected #4776 Kev and read-only #4763.

[ScriptedAlchemy]

Refs #4593 — new source-review boundary mismatch, regression needed; not a claimed exploit or passing test (reviewed at exact head 1899d261c9c6486f572a0cbdf619d07315b65378).

The default-deny live walker now checks parent stage-0 gitlink roots through source_walk.rs::parent_gitlink_paths, including when the child's .git marker is absent. But code_index_scheduler/reconcile.rs::capture_admitted_candidate (around 3977–3983) and freshness_witness.rs::source_candidates (around 135–143) still validate explicitly admitted ignored paths using only source_walk::has_nested_repository_ancestor. That helper checks nested .git markers and symlink/path ancestry, not parent-index gitlink roots. Therefore the new deny boundary is not yet shared by these capture/freshness paths.

Test the concrete scenario with a real parent 160000 gitlink under node_modules/<package>, a registered .gitmodules entry, child source still present but its .git marker missing, and an ignored-dependency admission/retained roster. The admission must fail closed or retire before child bytes enter a parent generation, even when the package path matches .gitignore. Check ignored_dependencies.rs::prove_gix_ignored (exact-path lookup plus ignore match) against gitlink ancestor semantics rather than assuming it already prevents this. Also assert live grep/AST and freshness parity across marker removal and restart. This is an actionable trust-boundary test requirement, not evidence that the runtime admission exploit has reproduced: no nonzero Bazel Rust test can be executed in this environment.

Current-head hosted workflow 42468887836 has passed repository gates, but Rust native/OS tests and Clippy were skipped for this draft; the Dashboard job remained queued when checked. Do not push a speculative fix that cancels that run. Fix via the one canonical authenticated submodule boundary, not a third independent scanner, and keep DRAFT/HOLD MERGE, Refs #4593, and issue open until full integrated acceptance.

[ScriptedAlchemy]

Refs #4593 — published 77332ede0f9b9cb557bd41185203eba9500c3f0a by expected-head, NONFORCE fast-forward from 1899d261 on this existing draft PR.

The ignored-dependency gix proof now checks every parent index ancestor for mode-160000 gitlinks, not only the exact candidate path. This closes the omitted-marker admission path discussed in comment 6720823044 for verified ignored dependencies, including the production source read and existing ignored-roster revalidation. Added a real local Git submodule regression source: verified stage-0 gitlink and .gitmodules, removed the child .git marker, asserted typed refusal by proof and read, plus a normal ignored-source control. Only ignored_dependencies.rs changed; candidate diff and live remote head were read back.

No Rust regression has executed through Bazel, and there is no independent review. Current-head hosted CI 42482445184 was queued. Previous-head run 42468887836 completed successfully after re-running a Dashboard job blocked by a transient download timeout; draft native Rust/Clippy remained skipped. I independently checked the disposable Git fixture commands locally, but that is not a repository Rust test or acceptance evidence.

HOLD MERGE / keep DRAFT / #4593 OPEN. The default-off authenticated submodule inventory, selected child-commit historical capture, child-aware freshness, and indexed/graph/live retrieval parity remain undone. Protected Kev/release PRs, #4800/#4508, and CI protections were not changed.

[ScriptedAlchemy]

Refs #4593 — guarded source repair on existing DRAFT #4801, HOLD MERGE.

Commit 2b230e8232f6ffd23675223c261fcfbd0a26e80a addresses a concrete remaining default-deny gap: a child checkout with its .git marker removed and its parent gitlink staged for removal disappears from the index but remains a mode-160000 gitlink in the parent's HEAD tree. The interactive source walker previously checked only index gitlinks and the current marker, so an explicit include/glob could admit those live child bytes. It now unions parent index gitlinks with parent HEAD-tree gitlinks, handles unborn HEAD, and fails closed on unreadable committed-tree authority. The existing real-Git submodule test now commits the parent, stages removal without deleting the child, verifies index absence plus HEAD's 160000 entry, and checks ordinary and explicitly scoped walks still exclude the child. A real Git fixture was independently probed for these Git semantics; that is not a repository Rust/Bazel test.

One file changed: crates/tracedecay-code-index/src/source_walk.rs. Published via expected-head 77332ede nonforce fast-forward, verified by direct branch and PR REST reads. Exact-head hosted CI run 42499856015 was queued on last check. No nonzero Bazel Rust regression pass, native OS test, or independent code review is claimed. Draft workflow selection skips native Rust/Clippy.

The integrated canonical default-off authenticated submodule opt-in, shared inventory across child candidate capture/freshness, pinned historical submodule trees, and parent-relative graph/retrieval are not implemented. Do not mark ready, merge, or close #4593. Protected #4776 Kev, #4763 release and #4800/#4508 peers untouched.

[ScriptedAlchemy]

Refs #4593 — source repair published on existing DRAFT PR; HOLD MERGE.

Commit f925fe65 is a guarded, nonforce fast-forward from 2b230e8232f6ffd23675223c261fcfbd0a26e80a. It corrects another default-denial discrepancy: the ignored-dependency proof used only the staged parent index. After staging removal of a registered gitlink and removing the child's .git marker, live search still denies the child through the parent HEAD but explicitly admitted ignored-source reads could treat the same child files as ordinary ignored dependencies.

Ignored-source proof now calls the same index-plus-HEAD parent gitlink boundary as the source walker. The real-Git fixture commits a parent with a 160000 submodule, stages removal with git rm --cached, verifies the index no longer has that gitlink while HEAD still does, and asserts ignored admission and source-read refusal; its ordinary ignored-source control remains. Exactly two changed files: source_walk.rs (exports the existing boundary) and ignored_dependencies.rs (uses it and adds the regression).

Verification limit: read back the exact commit and diff; no nonzero Bazel Rust test executed locally. Current-head hosted run 42503394287 was queued and chooses native=none because the PR is draft, so it cannot establish Rust behavior. No independent review. This remains a partial fail-closed repair only; canonical default-off authenticated submodule inventory, child capture/freshness, pinned historical-tree capture, graph/indexed/live parity, and acceptance tests are outstanding. Keep Refs #4593, PR DRAFT/unmerged, issue open. Preserve scheduler #4800/#4508 and protected Kev/release PRs.

[ScriptedAlchemy]

Refs #4593 — published exact formatting repair bcd2b46 and classification source repair 5edd6c6 / d31966d on existing DRAFT #4801 via guarded, nonforce expected-head fast-forwards. A disposable real-Git probe showed D app and ?? app/child.rs when a committed gitlink was staged for removal and the checkout marker deleted. Parent classification now applies the shared index+HEAD gitlink exclusion, suppressing child sources and forcing invalidation; a clean registered gitlink does not falsely force dirty state. One new real-Git Rust regression was added, but it has NOT been executed via Bazel. Exact-head CI: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42507577624 (queued when checked, draft native skipped); no independent review. HOLD MERGE; opt-in authenticated child indexing, historical capture/freshness and cross-boundary retrieval still unimplemented. Details in PR description. No other PRs touched.

[ScriptedAlchemy]

New actionable source-boundary finding — Refs #4593; DRAFT / HOLD MERGE (2026-11-08 UTC).

I checked current exact branch head 5eaa4993902f1f9dd545eb92b4aed304737f2a36, the root AGENTS.md and complete master tree (no nested AGENTS.md), parent classification, clean/dirty and exact-tree capture, live grep/AST walkers, freshness, and related tests. The current nested-repository denial does not account for a parent-tracked source-file symlink whose resolved target is inside an excluded submodule.

Reproduced independently with native Git in a disposable fixture (six nonzero assertions, not Rust/Bazel): parent records 160000 app, records 120000 src/bridge.rs, src/bridge.rs -> ../app/src/feature.rs resolves to and reads the real child bytes, the child has app/.git, and the lexical src/ ancestor has no nested marker. This is not a Git status fiction.

Source trace: classification.rs::classify calls has_nested_repository_ancestor(project_root, "src/bridge.rs"), which checks lexical parent directories but not the symlink leaf's destination; thus the parent candidate can include src/bridge.rs. reconcile.rs::capture_admitted_candidate makes the same lexical check, then absolute.metadata() and read_bounded_snapshot_source follow the symlink into app/. git_tree_capture.rs::capture_clean_head_tree_snapshot refuses source-link HEAD snapshots and falls back to this worktree capture. Conversely, the exact-tree resolver only follows links through ordinary entries in the selected parent tree, not the child gitlink; live grep and AST intentionally skip symlink leaves. That risks sealed/indexed vs exact-tree/live parity and default-deny trust across a submodule boundary.

Required repair/verification: fail closed for resolved source-link targets beneath parent index/HEAD gitlinks or nested .git markers (including a removed child marker), and outside the canonical root, while preserving ordinary in-parent links. Apply the same authority before classification reuse, worktree capture, and freshness; do not apply current worktree markers to immutable historical capture. Add a real-Git parent-submodule fixture with a symlink into the child and a normal in-parent symlink control, then run nonzero Bazel Rust tests on the exact head with independent review. This source audit and native Git fixture are not executed Rust tests or proof of a final code fix. No production source changes were made and the existing queued CI was not cancelled.

[ScriptedAlchemy]

Refs #4593 — partial fail-closed source repair bc7c1fc9edbee03318afd4d408374b0c3cb5adca published to this same PR via an expected-head nonforce fast-forward from 5eaa4993902f1f9dd545eb92b4aed304737f2a36; read-back confirms the exact PR head and unchanged DRAFT state.

The parent can track bridge.rs as a mode-120000 symlink into a registered mode-160000 app gitlink. Although the shared live walker does not follow a symlink leaf, classification previously cached only lexical ancestor boundaries and capture/freshness could follow the leaf into child bytes. This commit adds a shared is_source_symlink refusal and applies it at worktree classification, candidate capture, ignored-source freshness enrollment, and freshness byte reads. The classification tombstone prevents clean-HEAD-tree/active-generation reuse from reintroducing that source.

Regression source now includes a Unix real-Git parent+child fixture whose bridge resolves to real child Rust bytes, plus a leaf-symlink control and path-refusal assertions. An independent disposable native-Git reproduction here confirmed the fixture's 160000 and 120000 entries and readable target. This is not executed Rust/Bazel evidence. Current-head workflow: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42527599960 (queued at review); draft native Rust tests/Clippy are skipped. No independent reviewer has approved or run the feature.

HOLD MERGE / DRAFT / issue OPEN. This fixes default-exclusion parity only. The canonical persisted default-off opt-in, authenticated .gitmodules+gitlink+bounded-child inventory, historical pinned child Git trees, child-sensitive freshness, parent-relative indexed/live graph retrieval, policy toggles/restarts, and nonzero native Bazel regressions are still required. Do not treat this as Fixes #4593 or change #4800/#4508, draft Kev/#4776, or release #4763.