Second rolling sync of the campaign tree with the live upstream branch
(40 upstream commits since the previous merge-base f3fbfdbb). Automerge
resolved 18 of the 25 files both sides touched; the seven textual conflicts
and the six semantic ones the automerge hid were resolved by class:
- generated: ouroboros/size_ratchet_manifest.py taken from upstream and
regenerated on the merged tree (the upstream test
tests/test_ui_smoke_project_continuity.py entered the 1001-1500 band; its
upstream rationale is carried verbatim); domains, inventories regenerated
(FROZEN_CONTRACTS_INVENTORY.md).
- protected prose: prompts/SAFETY.md takes upstream's compressed shape; the
retired OUROBOROS_SCOPE_REVIEW_FLOOR control (removed outright by v7next
ABI-5, owner Q10=A) is dropped from the owner-only controls sentence and
the protected-path mirror is regenerated from the merged
runtime_mode_policy (36 paths + the contracts prefix). prompts/SYSTEM.md
(rewritten upstream) gets the v7next safety-critical set (registry
split organs, tool_result). Both mirrors are pinned by
tests/test_packaging_sync.py.
- tests: upstream's Windows/CRLF/argv fixes win over the campaign's interim
shims (capability predicates argv lists, golden _posix fold, telegram
parity pytest-timeout instead of signal.alarm, chat_plain_system_rows CRLF
normaliser, quarantine test import). Upstream's new governance and
terminal-receipt tests are adapted to the v7 contracts they meet on this
tree: the module-level registry_guard_process._run_shell_safety_check and
the typed ToolResult code SKILL_STATE_WRITE_BLOCKED (D02/D04), the
shell_outputs home of _sensitive_output_component_reason, and the ABI-2
task-result stamp (unstamped fixture rows are quarantined by the reader,
owner Q8=B) in tests/test_terminal_delegation_receipt.py. The git catalog
schema pin in tests/test_git_extraction.py moves to the bytes produced by
upstream's advisory_review -> preflight_review description rename
(332a02f1); the catalog itself is unchanged.
Gates on the merged tree: ruff F, check_domains, inventories --check,
size_ratchet --check, v7next_adoption, git diff --check all rc 0; the
targeted suites for every conflicted or both-sides-touched file and
web node --test (847) pass. The full CI-shape battery follows as a
separate evidence run.
tools/git.py -> git_plumbing/git_review_cycle/git_evolution/git_repo_edit/
git_vcs_ops (41/42 ledger rows; _refuse_capped_attempt retired upstream by
386e9417). supervisor/git_ops.py (protected) -> G1 leaves remotes/updates/
reset/rescue via the D35 call-time handle (26/28 rows; prepare_managed_update
and safe_restart stay facade defs - the byte gate refuses f-string reads of
rebindable globals). Every moved span proof-checked ast=tokens=bytes against
tip bytes; leaves declare every parent-scope read so facade monkeypatch
targets stay live. update_merge_plan/update_carriers (D34) hot-deferred with
the F2 update engine (upstream redesign deleted _git_run and rewrote all
three insertion points). D13-remainder closure: RELEASE_INVARIANT_PATHS and
_RELEASE_MACHINERY_PATHS cover the four git_ops leaves (additive, D04
precedent), parity pinned. Test splits: test_git_ops_recovery -> 3 siblings
+ shared (48==48), test_git_review_pipeline -> 4 siblings + shared (89==89),
lossless, tip-priority with documented exceptions. Ratchet manifest
regenerated; transplant probe corpus re-pinned to the pre-split base bytes.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
(cherry picked from commit 25a24251df579296f461e6508d1f09320fba5ee5)
