[Weimr2627]

Goal And Delivered Outcome

• Outcome basis / optional anchor: a reproduced defect — examples/project/registry-boundary-contract-smoke.py turned red in the nightly Full Public Smokes sweep of 2026-11-05 (no issue filed for it).
• Goal/source and gap: PR fix(registry): retire the git probe process tree on timeout #8115 (fix(registry): retire the git probe process tree on timeout, merged 2026-11-05T14:16:13Z as c917c8936) moved the registry git probe to subprocess.Popen so a timed-out probe can retire its whole process tree (loopx/registry.py:133 _registry_git_probe, :151 subprocess.Popen, with except OSError falling through to the git_unavailable shape). The shipped no-git fixture still patched only subprocess.run, so on any runner that has git installed the patch intercepts nothing: payload["git"]["available"] stays True, probe_status stays ok, and the assertion payload["git"]["available"] is False fails.
  The consequence is larger than one red smoke: the git_unavailable fail-closed branch was no longer being exercised at all. I searched the whole repository for other no-git fixtures — grep -rn 'run_without_git|FileNotFoundError("git")|subprocess.Popen = ' --include=*.py examples tests scripts returns only this file — so this fixture is the sole owner of that branch, and it had silently stopped testing it.
• Observable before → after, with the validation row that proves it: before, the smoke fails at the git.available assertion; after, it prints registry-boundary-contract-smoke ok, and the same run with the fixture restored to its pre-fix form fails again — so the restored coverage is the fixture, not a loosened expectation.
• Issue/task and intended base: no pre-existing issue. Intended base is loopx-project/loopx:main at 54e26effd9cc958179b9fe555d50ba22d13538a6.

Onset evidence

Reading	Result
nightly 41937099939 (2026-11-04T23:52:34Z)	smoke not in the failed set → green
nightly 42132115859 (2026-11-05T23:47:56Z)	smoke in the failed set → red
commits touching loopx/registry.py in that window	one behavioural one: #8115 (c917c8936), which introduced the Popen seam

Author Declaration

• Written by: model_agent — Qoder AI assistant, at the contributor's direction; no human review has occurred.

Implemented against

• Specification and revision: the probe and its fail-closed shape in loopx/registry.py at 54e26effd9cc (_registry_git_probe, unavailable() reporting available=False, probe_status="git_unavailable", inside_worktree=False), and the fixture's own assertions in examples/project/registry-boundary-contract-smoke.py:162-165.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
A no-git fixture must drive the probe's OSError path, whichever seam it uses	implemented	examples/project/registry-boundary-contract-smoke.py:133-158	the smoke
git.available is False, probe_status == "git_unavailable", inside_worktree is False, risks == []	unchanged, now actually reached	:162-165	the smoke
Both patched seams are restored in finally, so no other check inherits the stub	implemented	:157-158	the smoke
Probe production code (loopx/registry.py)	out_of_scope	loopx/registry.py:133-151	unchanged; this repairs the consumer only

• Self-check before submission: read _registry_git_probe to confirm Popen (not run) is now the seam and that OSError is what routes to the unavailable shape; enumerated the equivalence class of no-git fixtures across examples, tests and scripts and found exactly one site, so no sibling fixture was left patched against the old seam; ran the fix twice (once as the working copy, once after restoring it byte-identically from a saved copy) and ran the negative control by writing the pre-fix file back, which fails. Deliberately did not touch the probe, did not weaken any assertion, and did not add a skip or an environment guard — the branch is supposed to be covered, not excused.

Scope And Continuation

• Completed scope and remaining work: complete within this scope. If maintainers would rather give the probe an injectable seam than have fixtures patch subprocess, that is a product decision in loopx/registry.py and belongs to a separate, owner-led change.
• Slice boundary / successor: one fixture, independently reversible, no successor.

Validation

• Tested revision: 03caf71ce2e85395757803adebbd07b833858c18
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
integration	passed	PYTHONUTF8=1 python examples/project/registry-boundary-contract-smoke.py → registry-boundary-contract-smoke ok, run twice on the tested revision.
regression_parity	passed	Writing the pre-fix fixture back over the same tree makes the smoke fail at the git.available assertion; nightly records show green 2026-11-04 and red 2026-11-05, which dates the break to #8115.
static	passed	python -m py_compile; git diff --check.
unit	not_run	No unit test covers a shipped smoke's fixture harness; the smoke is its own harness.

• Coverage and gaps: covered — the git_unavailable fail-closed projection path, restored to actually running. Not covered — hosted CI on this head: fork workflows wait on the maintainer approve workflows gate, so no required-check result is attached yet. The remaining nightly failures on this head are unrelated (context_capture_navigation_v1 envelope migration, the loopx.status facade re-exports addressed by fix(status): restore the open_todo_items and todo_item_task_class compat re-exports #8160, and two module-size ratchet rows whose files already have open PRs).

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• First viewport and preview: N/A
• States and viewports shown: N/A
• Source data: synthetic
• Attention review: N/A
• Craft review: N/A

Type of Change

• Bug fix
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)

Technical Direction

• Direction / acceptance reference, when applicable: Core control-plane hardening; repairs the fixture left behind by the git probe process-tree change (fix(registry): retire the git probe process tree on timeout #8115).

Shared-authority RFC fixture impact

• Production-scale fixture schema: N/A
• Semantic dimensions changed, or reviewed no-impact rationale: N/A — no schema, provider arm, dimension or fixture row added; one existing fixture's seam was corrected.
• Provider conformance arms run: N/A
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): N/A — no projection or routing change.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md). Temporary fixture directories and local tracebacks are deliberately omitted from this description.
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Existing English/Chinese RFC pairs both have a diff, and the local premerge check passes, or no paired RFC changed (no RFC changed here).
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

动机 / Motivation

维护者运行现有 registry 边界 smoke 时，缺失 Git 的用例实际仍调用本机 Git。 旧 fixture 没拦住生产代码使用的 Popen，断言总落到健康 Git；补丁补齐拦截后，原有降级断言才真正执行。 这让已有边界保护重新具备维护价值，而不是为了增加通过数量。完整 smoke 在 base 失败、head 通过，且正常与异常路径都恢复 subprocess 全局对象。 本次只修复测试隔离，不改变生产 registry、CLI、权限或默认策略。

改动思路 / Approach

保留现有 fixture 和所有结果断言，让同一个 reject_git 在 run 与 Popen 两个本地 seam 都拒绝 Git。生产 probe 已使用可清理进程树的 Popen，因此只拦 run 无法形成缺失 Git 的前置状态。两个原对象在进入临时 patch 前保存，并在同一个 finally 恢复；成功与异常都回到可继续运行真实 Git 的状态。这个边界属于测试隔离，现有生产 owner 足够，不需要新 runtime 状态或抽象。

具体改动 / Changes

完整评审 base 54e26effd9cc958179b9fe555d50ba22d13538a6 → head 03caf71ce2e85395757803adebbd07b833858c18，仅一个现有文件 +16/−2。先读原有 fixture 的全部断言及 docs/development/good-smokes.md，规范固定版本 54e26effd9cc958179b9fe555d50ba22d13538a6。原文无编号，本次段落映射 durable-boundary-guard 与 independent-negative-oracle 均已实现：守护已交付的 registry 公私边界，负例使用原有独立断言且没有新增重复 smoke。

关键内容讲解

fixture_without_git 增加 Popen 的保存、Git 拦截与 finally 恢复；run_without_git 复用同一个命令识别 helper，非 Git 调用仍委托原函数。原有 available=False、git_unavailable、inside_worktree=False、空 risks 断言全部保留，没有跳过或放宽。源码比对确认生产 registry 与 CLI 整体未变。

对主干的风险 / Risks

未发现阻塞问题。主要风险是 monkeypatch 泄漏到后续用例：独立检查实际调用修改后的 fixture，分别验证正常路径、在 inspect 时注入异常、两函数原对象身份恢复、恢复后真实 git --version 可运行，以及再次调用 fixture，均 PASS。完整 public smoke 在 base 按原断言 FAIL、head PASS，说明新 seam 确实覆盖原来漏掉的路径。底层 probe 的五项测试两端也 PASS；它们的 which=None 快路不能代替这里的 Popen 异常路径，因此不是重复新增测试。

PASS：CI 声明的 Ruff 范围、配置 mypy 范围、变更编译、全 semantic vocabulary、diff advisory 与 public scan；native quick 的直接检查和必要选中检查通过，change-quality receipt 有效。保留一项 diagnostic FAIL：原始 maintainability ratchet 在两端同样报告未改动的 _admitted_interaction_next_cli_actions，完整失败内容一致、相关因果源码未变，独立 smoke 已覆盖本次变化；native 将其列为 inherited advisory。未轮询或等待 CI。UNVERIFIED：原生 Windows 与完整远端套件，不将本地结果说成平台或安装态资格。

我的整体评价 / Verdict

批准当前 exact head，无阻塞 finding。这是有独立仓库价值的既有 harness 修复，同作者当前批次的另一 PR 修复实际 CLI 导入边界，没有重复堆积 fixture 的证据。长程行为保持原样，只恢复可重复的保护；用户体验改善为同一条验证命令能测试其本来要测试的降级场景，无额外准备或确认。Popen 单 seam 可作为可选简化，但保留两个局部 seam 不构成维护阻塞，也无需新建后续任务。没有渲染界面变更，视觉检查不适用；原生 Windows 仍未验证。评审结论与合并权限、独立 readiness 门禁分别成立。

English verdict: APPROVE — the existing no-Git smoke now exercises the real probe and restores both subprocess seams.