fix(bootstrap): remove hardcoded HEAD:main push refs — grep-sweep gap after #370 layered resolution #379

New issue

Closed

opened 2026-07-04 20:29:48 +02:00 by bosun · 0 comments

bosun commented

2026-07-04 20:29:48 +02:00

Member

Empirical finding (external cold-read round 4)

Round-3 landed #370 (layered default-branch resolution with config override). Round-4 external found remaining hardcoded push refs in git-push argv construction — grep-sweep for round-3 targeted the literal main string in specific files, missed sibling paths using HEAD:main / refs/heads/main / origin/main shape.

Meta-class: grep-sweep-missed-siblings — sweep-pattern targeted the literal grep-target (main), not the semantic class (default-branch reference in push construction).

Blocking rationale

Blocks the default_branch: master (or trunk, or other non-main) adopter path even after #370's config layer lands. Config surface works; underlying code paths still assume main.

Fix path

Grep for HEAD:main, refs/heads/main, origin/main across scripts/**/*.sh + .forgejo/workflows/**/*.yml
Each hit: replace with resolved-default-branch variable per #370
Regression test: adopter with default_branch: trunk cuts a release without any main branch reference

Verification AC

Fresh grep across scripts+workflows shows zero remaining hardcoded main push refs
External cold-read round 5 finds no hardcoded-main leaks

Anchor

External outside-model cold-read round 4 (fresh ChatGPT session, 2026-07-03 late). Verdict: 'promising but not yet trustworthy' — SAME TIER as round-3 despite round-3 delta cycle. Meta-pattern named this round: grep-sweep-missed-siblings — the sweep-pattern targeted the literal grep-target, not the semantic class, so class-axis closed PARTIALLY per round. Operator ratified filing round-4 trackers 2026-07-04. This tracker addresses one of the round-4 findings. Success criterion: subsequent external cold-read returns no further objections of this class.

BLOCKING v1.0.0.

## Empirical finding (external cold-read round 4) Round-3 landed #370 (layered default-branch resolution with config override). Round-4 external found remaining hardcoded push refs in git-push argv construction — grep-sweep for round-3 targeted the literal `main` string in specific files, missed sibling paths using `HEAD:main` / `refs/heads/main` / `origin/main` shape. **Meta-class**: grep-sweep-missed-siblings — sweep-pattern targeted the literal grep-target (`main`), not the semantic class (default-branch reference in push construction). ## Blocking rationale Blocks the `default_branch: master` (or `trunk`, or other non-main) adopter path even after #370's config layer lands. Config surface works; underlying code paths still assume main. ## Fix path - Grep for `HEAD:main`, `refs/heads/main`, `origin/main` across `scripts/**/*.sh` + `.forgejo/workflows/**/*.yml` - Each hit: replace with resolved-default-branch variable per #370 - Regression test: adopter with `default_branch: trunk` cuts a release without any `main` branch reference ## Verification AC - Fresh grep across scripts+workflows shows zero remaining hardcoded `main` push refs - External cold-read round 5 finds no hardcoded-main leaks ## Anchor External outside-model cold-read round 4 (fresh ChatGPT session, 2026-07-03 late). Verdict: 'promising but not yet trustworthy' — SAME TIER as round-3 despite round-3 delta cycle. Meta-pattern named this round: grep-sweep-missed-siblings — the sweep-pattern targeted the literal grep-target, not the semantic class, so class-axis closed PARTIALLY per round. Operator ratified filing round-4 trackers 2026-07-04. This tracker addresses one of the round-4 findings. Success criterion: subsequent external cold-read returns no further objections of this class. BLOCKING v1.0.0.

bosun added the

labels

2026-07-04 20:29:48 +02:00