GeezerVison

Copy link

Copy Markdown

Collaborator

cursor Bot reviewed Oct 2, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed Oct 2, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed Oct 3, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed Oct 3, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Tanmay Singla (Tanmay182003) approved these changes Oct 5, 2026

View reviewed changes

245 checks passed

Mikola Lysenko (mikolalysenko) deleted the ci-janitor/poetry-transport-retry branch October 5, 2026 11:13

The PDM matrix runs against production PyPI and the public patch API.
Over the last 7 days 25 pdm-compatibility runs failed on one random
cell each, on unrelated PRs. The version, OS, shape, mode and check
differed every time (rescanIdempotent, appliedExactlyOne,
rescanAfterRelockApplies, ...). Each check judges a CLI scan, install
or rollback. `Run` retries a command once, and only on a non-zero
exit. The CLI usually reports an exhausted patch API fetch in its
JSON while exiting zero, so the cell just fails a later check.

Port backtest-poetry.py's case-level retry (#596). A case is re-run
from a fresh directory, at most three attempts, only when every
failed check recorded transport evidence from the operation it
judged. Evidence is a failed command's request error, PyPI give-up,
patch API 5xx or exhausted 429, or the same in the CLI's JSON error
records. Functional failures are never retried, even when a later
step raises a transport error. Failed attempts' logs go under
attempts/ and are uploaded. A failing case now prints its failed
checks' notes, since the job log alone never said why.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01N8YeCUhdg2tKdqyyY7z3sV
(cherry picked from commit 4329170)

* Start fix for #652

Assisted-by: Claude Code:claude-opus-5-5

* Refuse gem lines pulled from git sources

Hosted scans moved a gem declared with `gitlab:`, a custom
`git_source(:name)` key or a string-keyed `"git" =>` option into the
Socket source block. The option still overrode the block, so bundler
kept loading the unpatched git checkout while scan reported the gem
redirected and VEX attested it not_affected. String-keyed options
such as `"require" => false` were also silently dropped.

Both hosted and vendored modes now read gem options through one
shared reader that understands every key spelling and treats any key
outside bundler's non-source options as a source. Hosted mode also
refuses a gem the lock resolves from a GIT, PATH or plugin section.

Fixes #652

Assisted-by: Claude Code:claude-opus-5-5

* Add e2e and escape tests for gem git sources

Adds a real-bundler capstone where the gem comes from a custom
`git_source` key: the hosted scan must refuse it, write nothing and
attest nothing, and bundler must still install the project. The
option reader now also honors backslash escapes in single-quoted
strings, so a quote inside a value cannot hide a later git option.

Refs #652

Assisted-by: Claude Code:claude-opus-5-5

* Read the gem lock's git sections once per scan

The new git/path refusal re-parsed Gemfile.lock for every patched
gem, which made hosted bundler scans about 15% slower on the bench
fixture (800 gems, 20 patched). The lock is now parsed once per
rewrite; our own edits only touch GEM sections and CHECKSUMS, so
the GIT/PATH membership read up front stays accurate.

Refs #652

Assisted-by: Claude Code:claude-opus-5-5

* Fix vex alias tests broken by store-copy merge

#605 taught the name-keyed npm resolver to probe bundled store
trees, so it now finds aliased copies (node_modules/lp) and a nested
host's store peers itself. Two vex_consumed tests from #738 assumed
that set never held aliases, so main's CI went red after both merged.

The tests now feed the alias-free set explicitly to keep covering
alias expansion, and also check the resolver's own set reaches the
same copies with no duplicates. No production code changes.

Assisted-by: Claude Code:claude-opus-5-5
(cherry picked from commit 40dac07)

* Retry PDM backtest cases on transport errors

The PDM matrix runs against production PyPI and the public patch API.
Over the last 7 days 25 pdm-compatibility runs failed on one random
cell each, on unrelated PRs. The version, OS, shape, mode and check
differed every time (rescanIdempotent, appliedExactlyOne,
rescanAfterRelockApplies, ...). Each check judges a CLI scan, install
or rollback. `Run` retries a command once, and only on a non-zero
exit. The CLI usually reports an exhausted patch API fetch in its
JSON while exiting zero, so the cell just fails a later check.

Port backtest-poetry.py's case-level retry (#596). A case is re-run
from a fresh directory, at most three attempts, only when every
failed check recorded transport evidence from the operation it
judged. Evidence is a failed command's request error, PyPI give-up,
patch API 5xx or exhausted 429, or the same in the CLI's JSON error
records. Functional failures are never retried, even when a later
step raises a transport error. Failed attempts' logs go under
attempts/ and are uploaded. A failing case now prints its failed
checks' notes, since the job log alone never said why.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01N8YeCUhdg2tKdqyyY7z3sV
(cherry picked from commit 4329170)

* Judge PDM rollback and VEX checks by their run

Bugbot: the final hosted/vendored rollback checks, the unverifiable-
write rollback, the refused-lock VEX and the reverted-lock VEX runs
named no operation, so a transport failure there never made the case
retryable. installedBytesPatched fails together with a blipped pdm
sync and blocked the retry the same way.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01N8YeCUhdg2tKdqyyY7z3sV
(cherry picked from commit 6b0302a)

---------

Co-authored-by: Claude <[email protected]>

* Retry PDM backtest cases on transport errors

The PDM matrix runs against production PyPI and the public patch API.
Over the last 7 days 25 pdm-compatibility runs failed on one random
cell each, on unrelated PRs. The version, OS, shape, mode and check
differed every time (rescanIdempotent, appliedExactlyOne,
rescanAfterRelockApplies, ...). Each check judges a CLI scan, install
or rollback. `Run` retries a command once, and only on a non-zero
exit. The CLI usually reports an exhausted patch API fetch in its
JSON while exiting zero, so the cell just fails a later check.

Port backtest-poetry.py's case-level retry (#596). A case is re-run
from a fresh directory, at most three attempts, only when every
failed check recorded transport evidence from the operation it
judged. Evidence is a failed command's request error, PyPI give-up,
patch API 5xx or exhausted 429, or the same in the CLI's JSON error
records. Functional failures are never retried, even when a later
step raises a transport error. Failed attempts' logs go under
attempts/ and are uploaded. A failing case now prints its failed
checks' notes, since the job log alone never said why.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01N8YeCUhdg2tKdqyyY7z3sV

* Judge PDM rollback and VEX checks by their run

Bugbot: the final hosted/vendored rollback checks, the unverifiable-
write rollback, the refused-lock VEX and the reverted-lock VEX runs
named no operation, so a transport failure there never made the case
retryable. installedBytesPatched fails together with a blipped pdm
sync and blocked the retry the same way.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01N8YeCUhdg2tKdqyyY7z3sV

* Port #851: fix vex alias tests broken on main

Main is red since #605 (4646693): two commands::vex_consumed tests
assume the name-keyed resolver never returns npm-aliased copies, and
#605 taught it to find them. This fails socket-patch-cli --lib in
coverage and test on every PR. Port #851's test-only fix so this PR
can go green; it no-ops once #851 lands.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01N8YeCUhdg2tKdqyyY7z3sV

---------

Co-authored-by: Claude <[email protected]>