[ToikY]

Change

Repairs the two already recorded intake failures of PR #6319 at b1cb8b91a7213d639da117a5ef3060afecd5058b: LF-containing Git filenames can disappear from line-framed blob requests, and inherited GIT_DIR can redirect the requested root to a clean repository.

The proposed guard is absent from current main, so this adds its original implementation and six byte-identical predecessor tests with credit retained, plus the minimal repairs:

• CR/LF paths use literal NUL-framed tree lookup followed by a checked blob-OID read; ordinary paths retain batching.
• Git reads reuse the existing shared git_source_env() policy.
• Ten independent bare-object CLI regressions cover exact path bytes, classification, root redirection and failed reads.

Pin states, frozen-prefix policy and advisory/strict exit behavior are unchanged. No new digest formats, automatic guard gate, mathematical admission or selected-frontier change.

Evidence

Python 3.12.14: all 6 original + 10 new tests pass normally and optimized. The same new suite against the authenticated original produces 29 failing subcases in each mode; these reproduce the known failure families, not 29 newly discovered bugs. A read-only source copy passes with Git explicitly admitted. Committed bytes/modes and the self-contained source export were checked.

Reproduce the four commands in the scope note. The new regression filename matches the existing CI discovery rule; no workflow changes. Hosted CI and maintainer acceptance remain separate.

Task, scope and credit

Donation card portable-replay, changed scope to the two named static source-context comparison failures. Canonical main refreshed unchanged at 7c49fe32c55de02c2c873655c804b16e4c3fef0a, priority8, selected6030 unchanged. Fresh 322-open-PR pagination, exact source head and canonical intake decision checked; bounded overlap is not novelty proof. Canonical repair claim.

Original guard/tests: Armin Pourshafeie / apoursh with substantial Claude Code / Anthropic assistance. The intake reviewer supplied both counterexamples. Credit Arham Tahir / PR1595, Douglas Colkitt, the shared Git-source environment policy's T74-2530 lineage, Sagar Thakrar and ywz65. New repairs and independent regressions: ToikY with substantial OpenAI Codex assistance and three bounded agents.

Next: independently review these exact changes and decide integration alongside PR6319. Broader guard admission and automatic gating remain maintainer decisions. No PR closure or merge; maintainer edits disabled.

[antunishdPursuit]

I found a remaining false-clean case at head 170867c0a8f92375dfc489dd090bad5daee7b090: replacing one pinning file with a directory can hide a different, unchanged stale pin.

Minimal fixture:

1. Commit research/target containing old, and two text files a-pin and z-pin, each containing SHA-256(old).
2. Change the target to new. Replace a-pin with a directory containing a regular file child. Keep z-pin unchanged, then commit.
3. Run check_pinned_edits.py --root <fixture> --base <first-commit> --json.

Expected: a-pin is removed as a pinning file, but z-pin is stale, so frozen_stale=1 and exit status 1. Actual: both are classified pinner_removed, frozen_stale=0, exit status 0. Reproduced with native CPython 3.12.15 in normal and optimized modes. A control that actually deletes a-pin instead of replacing it with a directory correctly reports the stale z-pin and exits 1 in both modes.

In the batched branch of blobs(), a non-blob response takes continue without consuming its declared payload and terminating newline. The next request consequently parses tree bytes as its response header and loses the real blob. Consume every successful object's framed payload before classifying its type, or fail closed on an unexpected type. The explicit CR/LF tree-lookup branch does not have this framing problem. I have not established whether this predates your repair.

This addresses the handoff's exact-reader/fail-closed review; it is not a scientific replay or an integration decision. Prepared with substantial OpenAI Codex assistance.