Git import verified commit by commit; two dependency bugs fixed 62794ecc7f74

    /// The changes that inserted a live atom directly after `k`. A change

    /// that deletes `k` must depend on them (spec §8.1), or `is_ghost`

    /// reads the deletion as concurrent with those insertions.

    pub fn live_successor_changes(&self, k: &AtomKey) -> Vec<ChangeHash> {

        self.succ

            .get(&Vertex::Atom(*k))

            .map(|ss| {

                ss.iter()

                    .filter_map(|s| match s {

                        Vertex::Atom(y) if self.is_live(y) => Some(y.0),

                        _ => None,

                    })

                    .collect()

            })

            .unwrap_or_default()

    }

use std::sync::Arc;

            let mut built =

                self.build_from_entries(&base, &base_snapshot, HashMap::new(), &entries)?;

            // A file or submodule with several live blobs (branches that

            // replaced it independently) is resolved to the commit's blob:

            // Git's merge is the authority here, unlike a working copy,

            // where a candidate on disk is not yet a decision (spec §23).

            for (path, f) in &base_snapshot.files {

                let (FileContent::Opaque { blobs }, Some(e)) = (&f.content, entries.get(path))

                else {

                    continue;

                };

                if blobs.len() < 2 || f.kind != e.kind {

                    continue;

                }

                let chosen = self.store_blob(&e.content)?;

                for b in blobs {

                    built.edits.push(Edit::Replace {

                        node: f.node,

                        old: Some(*b),

                        new: Some(chosen),

                    });

                }

                built.resolves = true;

                built

                    .contributors

                    .extend(base.live_replaces(&f.node).into_iter().map(|(c, _)| c));

            }

/// What `verify_git_import` found (spec §23: import must reproduce every tree).

#[derive(Debug, Clone, Default, PartialEq, Eq)]

pub struct GitVerifyReport {

    pub commits: usize,

    pub files_compared: usize,

    /// `(commit, what differs)`; empty when every commit's tree is reproduced.

    pub mismatches: Vec<(String, String)>,

}

impl Repo {

    /// Check an import against its Git source: for every commit of

    /// `branch`, the state formed by the changes imported for it and all

    /// its ancestors must materialize to exactly that commit's tree, byte

    /// for byte, with the same executable bits, symlink targets and

    /// submodule pins. Reads only; stops listing after 50 differences.

    pub fn verify_git_import(&self, git_dir: &Path, branch: &str) -> Result<GitVerifyReport> {

        let commits = list_commits(git_dir, branch)?;

        let imported = self.imported_commits()?;

        let mut cat = CatFile::start(git_dir)?;

        let mut rep = GitVerifyReport::default();

        // Changes of each commit and all its ancestors, built up in topological order.

        let mut closure: HashMap<String, Arc<BTreeSet<ChangeHash>>> = HashMap::new();

        for c in &commits {

            rep.commits += 1;

            let mut set: BTreeSet<ChangeHash> = BTreeSet::new();

            for p in &c.parents {

                if let Some(ps) = closure.get(p) {

                    set.extend(ps.iter().copied());

                }

            }

            match imported.get(&c.sha) {

                Some(h) => {

                    set.insert(*h);

                }

                None => {

                    rep.mismatches.push((

                        c.sha.clone(),

                        "no imported change carries this commit".into(),

                    ));

                }

            }

            let set = Arc::new(set);

            closure.insert(c.sha.clone(), set.clone());

            if rep.mismatches.len() >= 50 {

                break;

            }

            let heads: Vec<ChangeHash> = set.iter().copied().collect();

            let state = self.load_state(&heads)?;

            let snap = state.materialize();

            let tree = list_tree(git_dir, &c.sha)?;

            let short = &c.sha[..12.min(c.sha.len())];

            let mut differ = |what: String| rep.mismatches.push((c.sha.clone(), what));

            if snap.is_conflicted() {

                // Name the changes behind each conflicted file, by their Git commits.

                let mut detail = Vec::new();

                for (path, f) in &snap.files {

                    if !f.is_conflicted() {

                        continue;

                    }

                    let who: Vec<String> = state

                        .conflict_regions(&f.node)

                        .contributors

                        .iter()

                        .filter_map(|h| state.get(h))

                        .map(|m| {

                            let sha = m

                                .message

                                .lines()

                                .rev()

                                .find_map(|l| l.strip_prefix("Git-Commit: "))

                                .unwrap_or("?");

                            format!(

                                "{} {:?}",

                                &sha[..12.min(sha.len())],

                                m.message.lines().next().unwrap_or("")

                            )

                        })

                        .collect();

                    detail.push(format!("{path} between {}", who.join(" and ")));

                }

                differ(format!(

                    "{short}: the state is conflicted: {}",

                    detail.join("; ")

                ));

            }

            for (path, (mode, sha)) in &tree {

                let Some(f) = snap.files.get(path) else {

                    differ(format!("{short}: {path} is missing"));

                    continue;

                };

                rep.files_compared += 1;

                match mode.as_str() {

                    "160000" => match (&f.kind, &f.content) {

                        (NodeKind::Subrepo, FileContent::Opaque { blobs }) if blobs.len() == 1 => {

                            let pin = crate::subrepo::Pin::decode(&self.read_blob(&blobs[0])?)?;

                            if !matches!(&pin, crate::subrepo::Pin::Git { sha: s, .. } if s == sha)

                            {

                                differ(format!("{short}: {path} pins another commit"));

                            }

                        }

                        (kind, content) => differ(format!(

                            "{short}: {path} is not one submodule pin: {kind:?} with {}",

                            match content {

                                FileContent::Opaque { blobs } => format!("{} pins", blobs.len()),

                                FileContent::Text { .. } => "text".into(),

                                FileContent::Dir => "a directory".into(),

                            }

                        )),

                    },

                    "120000" => {

                        let target = cat.read(sha)?;

                        match (&f.kind, &f.content) {

                            (NodeKind::Symlink, FileContent::Opaque { blobs })

                                if blobs.len() == 1 && self.read_blob(&blobs[0])? == target => {}

                            _ => differ(format!("{short}: symlink {path} differs")),

                        }

                    }

                    _ => {

                        let want = cat.read(sha)?;

                        let have = match &f.content {

                            FileContent::Text { bytes, .. } => bytes.clone(),

                            FileContent::Opaque { blobs } if blobs.len() == 1 => {

                                self.read_blob(&blobs[0])?

                            }

                            _ => {

                                differ(format!("{short}: {path} is not one file"));

                                continue;

                            }

                        };

                        if have != want {

                            differ(format!(

                                "{short}: {path} differs: {}",

                                first_difference(&have, &want)

                            ));

                        }

                        if f.mode.exec != (mode == "100755") {

                            differ(format!("{short}: {path} executable bit differs"));

                        }

                    }

                }

            }

            // Import records submodules in `.oxymodules` as well (spec §23),

            // and export leaves it out again.

            let has_submodules = tree.values().any(|(m, _)| m == "160000");

            for (path, f) in &snap.files {

                if f.kind != NodeKind::Dir

                    && !tree.contains_key(path)

                    && !(has_submodules && path == ".oxymodules")

                {

                    differ(format!("{short}: {path} is extra"));

                }

            }

            if rep.mismatches.len() >= 50 {

                break;

            }

        }

        Ok(rep)

    }

}

/// Where two versions of a file first part, for a verification report.

fn first_difference(have: &[u8], want: &[u8]) -> String {

    let (h, w): (Vec<&[u8]>, Vec<&[u8]>) = (

        have.split(|b| *b == b'\n').collect(),

        want.split(|b| *b == b'\n').collect(),

    );

    let i = h

        .iter()

        .zip(&w)

        .position(|(a, b)| a != b)

        .unwrap_or(h.len().min(w.len()));

    let show = |l: Option<&&[u8]>| {

        l.map(|l| String::from_utf8_lossy(&l[..l.len().min(60)]).into_owned())

            .unwrap_or_else(|| "(end)".into())

    };

    format!(

        "line {}: has {:?}, Git has {:?} ({} lines, Git has {})",

        i + 1,

        show(h.get(i)),

        show(w.get(i)),

        h.len(),

        w.len()

    )

}

pub use git::{GitExportReport, GitImportReport, GitVerifyReport};

                // Deleting an atom also depends on whoever inserted the live

                // atoms right after it: the author saw those insertions, and

                // without the dependency spec §9.1 would call the deletion

                // concurrent with them (a delete/insert conflict).

                let graph = base.file(&e.node());

                    if let Some(g) = graph {

                        for i in r.from..r.to {

                            out.extend(

                                g.live_successor_changes(&(r.change, i))

                                    .into_iter()

                                    .filter(|c| !c.is_zero()),

                            );

                        }

                    }

            // Replacing a blob depends on the change that made it current,

            // as deleting a line depends on the line's introducer.

            Edit::Replace {

                node,

                old: Some(old),

                ..

            } => {

                out.extend(

                    base.live_replaces(node)

                        .into_iter()

                        .filter(|(c, b)| b == old && !c.is_zero())

                        .map(|(c, _)| c),

                );

            }

/// Spec §8.1: deleting a line depends on whoever inserted the lines right

/// after it. Inserting after `b` and then deleting `b`, one commit after

/// the other, must not leave a delete/insert conflict.

#[test]

fn deleting_a_line_after_an_insertion_below_it_is_not_a_conflict() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "f", b"a\nb\nc\n");

    repo.commit("base", &[]).unwrap();

    write(root, "f", b"a\nb\nx\nc\n");

    let insert = repo.commit("insert x after b", &[]).unwrap();

    write(root, "f", b"a\nx\nc\n");

    let delete = repo.commit("delete b", &[]).unwrap();

    assert!(

        repo.store()

            .get_change(&delete)

            .unwrap()

            .deps

            .contains(&insert),

        "the deletion depends on the insertion below the deleted line"

    );

    let heads = repo.bookmark_heads().unwrap();

    assert_eq!(heads, vec![delete]);

    let snap = repo.load_state(&heads).unwrap().materialize();

    assert!(!snap.is_conflicted());

    assert!(

        matches!(&snap.files["f"].content, FileContent::Text { bytes, .. } if bytes == b"a\nx\nc\n")

    );

}

/// Spec §9.3: a binary file reverted to an earlier blob keeps it, and each

/// replacement depends on the change that set the blob it replaces.

#[test]

fn a_binary_file_reverted_to_an_earlier_blob_keeps_it() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "bin", b"\0A");

    let v1 = repo.commit("v1", &[]).unwrap();

    write(root, "bin", b"\0B");

    let v2 = repo.commit("v2", &[]).unwrap();

    assert!(repo.store().get_change(&v2).unwrap().deps.contains(&v1));

    write(root, "bin", b"\0A");

    let v3 = repo.commit("back to A", &[]).unwrap();

    assert!(repo.store().get_change(&v3).unwrap().deps.contains(&v2));

    assert_eq!(repo.bookmark_heads().unwrap(), vec![v3]);

    let state = repo.load_state(&[v3]).unwrap();

    let snap = state.materialize();

    let FileContent::Opaque { blobs } = &snap.files["bin"].content else {

        panic!("opaque")

    };

    assert_eq!(blobs.len(), 1, "one live blob, not none and not two");

    assert_eq!(repo.read_blob(&blobs[0]).unwrap(), b"\0A");

}

/// Spec §23: a binary file changed on two branches and merged in Git to

/// one side's version comes back as that version at the merge, and the

/// import verifies commit by commit.

#[test]

fn git_import_resolves_a_binary_merged_in_git_and_verifies() {

    hermetic();

    if std::process::Command::new("git")

        .arg("--version")

        .output()

        .is_err()

    {

        eprintln!("git not installed; skipping");

        return;

    }

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let g = root.join("src.git");

    fs::create_dir_all(&g).unwrap();

    let git = |args: &[&str]| -> String {

        let out = std::process::Command::new("git")

            .arg("-C")

            .arg(&g)

            .args([

                "-c",

                "user.name=Grace",

                "-c",

                "[email protected]",

                "-c",

                "commit.gpgsign=false",

            ])

            .args(args)

            .output()

            .unwrap();

        assert!(

            out.status.success(),

            "git {args:?}: {}",

            String::from_utf8_lossy(&out.stderr)

        );

        String::from_utf8_lossy(&out.stdout).trim().to_string()

    };

    git(&["init", "-q", "-b", "main"]);

    write(&g, "logo.bin", b"\0base");

    write(&g, "notes.txt", b"a\nb\nc\n");

    git(&["add", "."]);

    git(&["commit", "-qm", "base"]);

    git(&["checkout", "-qb", "side"]);

    write(&g, "logo.bin", b"\0side");

    write(&g, "notes.txt", b"a\nb\nx\nc\n");

    git(&["commit", "-qam", "side"]);

    git(&["checkout", "-q", "main"]);

    write(&g, "logo.bin", b"\0main");

    git(&["commit", "-qam", "main"]);

    // Git cannot merge the binary; the merge takes main's and keeps side's text.

    let _ = std::process::Command::new("git")

        .arg("-C")

        .arg(&g)

        .args([

            "-c",

            "user.name=G",

            "-c",

            "user.email=g@e",

            "merge",

            "-q",

            "side",

        ])

        .output();

    write(&g, "logo.bin", b"\0main");

    git(&["add", "."]);

    git(&["commit", "-qm", "merge side"]);

    // Then a revert of the binary to its first version.

    write(&g, "logo.bin", b"\0base");

    git(&["commit", "-qam", "back to base"]);

    let repo = Repo::init(&root.join("o")).unwrap();

    let rep = repo.import_git(&g, "main").unwrap();

    assert_eq!(rep.merges, 1);

    let v = repo.verify_git_import(&g, "main").unwrap();

    assert!(v.mismatches.is_empty(), "{:?}", v.mismatches);

    assert_eq!(v.commits, 5);

    let snap = repo

        .load_state(&repo.bookmark_heads().unwrap())

        .unwrap()

        .materialize();

    assert!(!snap.is_conflicted());

    let FileContent::Opaque { blobs } = &snap.files["logo.bin"].content else {

        panic!("opaque")

    };

    assert_eq!(repo.read_blob(&blobs[0]).unwrap(), b"\0base");

}

        let mut live: Vec<ObjectRef> = self

            .live_replaces(node)

            .into_iter()

            .map(|(_, n)| n)

    /// The replace records whose blob is live, with the change that set it

    /// (spec §9.3). A record's blob is superseded by a later replacement of

    /// that blob: one whose change depends on the record's change, as every

    /// replacement depends on the change that made its old blob current

    /// (§8.1). Two replacements that do not know each other both stay live

    /// (a replace conflict), and a file reverted to an earlier blob keeps it.

    /// A replacement without that dependency, from before the rule, is read

    /// as before: it supersedes every record that did not come after it.

    pub fn live_replaces(&self, node: &NodeId) -> Vec<(ChangeHash, ObjectRef)> {

        let Some(rs) = self.replaces.get(node) else {

            return vec![];

        };

        let knows_its_old = |s: &ChangeHash, old: &ObjectRef| {

            rs.iter()

                .any(|(q, _, n)| n.as_ref() == Some(old) && q != s && self.closure(s).contains(q))

        };

        rs.iter()

            .filter_map(|(c, _, n)| n.map(|n| (*c, n)))

            .filter(|(c, n)| {

                !rs.iter().any(|(s, o, _)| {

                    s != c

                        && *o == Some(*n)

                        && (self.closure(s).contains(c)

                            || (!knows_its_old(s, n) && !self.closure(c).contains(s)))

                })

            })

            .collect()

    }

| **Status** | Draft 0.8i |

`deps(C)` MUST contain the ChangeHash of the introducing change of every element of `scope(C)`, excluding `C` itself, START, END, and the root node. It MUST also contain, for every atom `C` deletes, the introducing change of every atom live directly after it in the author's state, since without it the deletion reads as concurrent with those insertions and materializes as a delete/insert conflict (§9.1); and, for every `Replace` whose `old` is a blob, the change(s) whose replace record made that blob current. 

Which blobs are live: a replace record is superseded by a later replacement of its blob, a record whose `old` is its `new` and whose change depends on its change (§8.1 makes every replacement depend on the change that made its `old` current). Replacements that do not know each other both stay live, and a file reverted to an earlier blob keeps it. A replacement recorded without that dependency (before Draft 0.8i) supersedes every record with its `new` that does not come after it, the rule until then.

- **Merges of opaque files.** When the union of a merge commit's parents holds several live blobs for a file or submodule, the merge's change replaces each of them with the commit's blob and is a resolution: Git's merge is the authority, unlike a working copy, where a candidate on disk is not yet a decision.

- **Round trip.** Import followed by export MUST reproduce every tree hash. Export followed by import MUST reproduce every ChangeId. `oxy git verify GIT_DIR` checks an import commit by commit: for each commit, the state formed by the changes imported for it and all its ancestors must materialize to exactly that commit's tree (content, executable bits, symlink targets, submodule pins; `.oxymodules` is allowed beside submodules).

oxy git import|export|fetch|push|verify   (fetch and push go through a bare mirror under .oxy/git/)

*Changelog.* Draft 0.8i (2026-09-28): found by verifying a real Git import commit by commit: deletions depend on the inserters of the lines right after them, and replacements on the change that set their old blob (§8.1); replace records are superseded causally, so a reverted binary keeps its blob (§9.3); merges resolve opaque conflicts to the commit's blob, and `oxy git verify` (§23). Draft 0.8h (2026-09-28): `oxy fsck` (§21.1); durability rules and the operation head as commit point (§13.6); the operation head moves by compare-and-swap and concurrent operations are merged (§12.1); `oxy doctor` (§21.2). Draft 0.8g (2026-09-27): delegates of a rule's identities may sign reference attestations (§14.5); local-path pushes bind unbound repositories like HTTP ones. Draft 0.8f (2026-09-27): challenge signatures (§14.3) for hosts. Draft 0.8e (2026-09-27): anonymous changes (zero author) are authenticated by a seal from any key, so imported and pre-identity history can be pushed under a policy (§14.4). Draft 0.8d (2026-09-27): unbound hosted repositories adopt the first pusher's id (§16.1). Draft 0.8c (2026-09-27): bare repositories (`oxy init --bare`, §12.2: no workspace, no working copy; hosting) and the reference server as an embeddable library (§15.1). Draft 0.8b (2026-09-27): the machine interface for editors (§24): `root`, `cat`, `version`, `hunks`, `discard`, and `--json` on the reporting commands.

    /// Check this repository's import of a Git branch: every commit's tree must be reproduced exactly

    Verify {

        /// The Git repository the import came from

        git_dir: PathBuf,

        /// Branch that was imported

        #[arg(long, default_value = "main")]

        branch: String,

    },

        Cmd::Git {

            cmd: GitCmd::Verify { git_dir, branch },

        } => sync::git_verify(&git_dir, &branch),

/// `oxy git verify`: exit 1 if any commit's tree is not reproduced.

pub fn git_verify(git_dir: &std::path::Path, branch: &str) -> Result<i32> {

    let repo = open()?;

    let started = std::time::Instant::now();

    let sp = ui::spinner(&format!(

        "Rebuilding every commit of {} {branch}…",

        git_dir.display()

    ));

    let r = repo.verify_git_import(git_dir, branch)?;

    sp.clear();

    for (_, what) in &r.mismatches {

        println!("{} {what}", ui::err(ui::glyph("✖", "x")));

    }

    if r.mismatches.is_empty() {

        println!(

            "{}",

            ui::done(format!(

                "Every commit reproduced: {} commits, {} files compared, in {:.1}s",

                r.commits,

                r.files_compared,

                started.elapsed().as_secs_f64()

            ))

        );

        Ok(0)

    } else {

        println!(

            "{} differences in {} commits checked",

            r.mismatches.len(),

            r.commits

        );

        Ok(1)

    }

}