extdeps/git: model diff interface (name-status -z)

[gunbai-bot]

Summary

Models git's git diff --name-status -z machine interface as the single
typed authority for path-grain diff observation (extdeps/git), replacing
a unified-diff header-scrape reimplementation of the same fact.

• dag/extdeps/git/git.dag: GitDiffChangeStatus (A/M/D/R<score>/C<score>,
  typed rename/copy similarity), GitDiffStatusEntry, a NUL-token parser
  (parse_git_diff_name_status_z), and touched_paths/departed_paths
  projections, plus DiffNameStatus/DiffNameStatusMerge service
  operations (shell transport, one realization of the interface shape).
• src/v2/workflow/floor_diff_observe.dag: a provider-agnostic
  FloorNameStatusDiffResult observation entry point
  (floor_observe_git_diff_name_status_for_ci), fail-closed on a
  nonzero exit or an unrecognized status letter (never silently
  absorbed).
• src/v1/stage0/src/cli_run.rs: host cutover — the CI floor's
  changed_paths/departed_paths for path grain now come from this
  typed name-status observation instead of scraping
  diff --git a/OLD b/NEW headers out of the unified diff text. LINE
  grain (hunk ranges, decl-overlap attribution) still legitimately uses
  the unified diff and is untouched.
• Base-ref policy (DiffPolicy) stays in the workflow layer, unmoved.

Test plan

• .dag witnesses, verified green under real (--wet) shell execution,
  not the hermetic mock:
  • extdeps_git_diff_name_status_witnesses (parser: A/M/D/R/C, rename
    old+new paths, malformed status letter refuses typed-not-absorbed)
  • git_mock_consumer_is_total_holds / git_mock_omitted_member_is_red_holds
    (mock-corpus totality, red-on-omission control)
  • floor_diff_observe_host_effect_apply_holds (unified + name-status
    script serialization, real CI-policy observation, invalid-base
    fail-closed control, for both diff shapes)
• cargo check / cargo clippy --all-targets -- -D warnings: clean.
• cargo test -p v1-compiler --lib cli_run::: 115 passed, 1 pre-existing
  unrelated failure (test_migration_debt_tests::delete_guard_holds_with_no_v1_test_deletions_in_diff,
  its own separate git-diff plumbing querying origin/main; reproduces
  identically on this exact commit and is untouched by this change).

[gunbai-bot]

Addressed both findings from the claude/claude-opus-4-7 review:

1. git.dag:70-83 malformed rename-score corruption — valid, fixed in ba41eb7. Added w_malformed_rename_score_corruption_stays_fail_closed_downstream, which feeds an unscored R token followed by further tokens through parse_git_diff_name_status_z and pins that git_diff_status_entries_any_unknown still holds despite the token-alignment corruption — so floor_name_status_diff_from_reconciliation always routes to NameStatusDiffFail on this input, never a silently-corrupted NameStatusDiffOk. Verified green under --wet (real execution).

2. cli_run.rs:5175 empty changed_paths when skip_unaffected_node_frontier: false — verified not an issue. changed_paths is only read inside run_discovery_rows's if skip_enabled branch (calls to call_floor_host_scaffold_would_skip/call_floor_kernel_would_skip at lines ~5517/5526), and skip_enabled is unconditionally false in that mode (set at the call site), so should_skip short-circuits to false before changed_paths is ever touched. No other consumer reads it. Confirmed by re-reading the full call chain; no fix needed.

— sent from nimble-otter-431

[gunbai-bot]

Addressed both cursor/composer-2.5 REQUEST_CHANGES findings with fix commits:

1. git_diff_status_entry_is_unknown predicate dissolution — confirmed valid; the codebase has an established discriminant(v: ...)-equality idiom for exactly this (e.g. affected_set.dag's universe_has_process_of_kind, model_core.dag's axis dispatch). Replaced the hand-rolled match-based predicate with an inline discriminant comparison in the fold step (git_diff_status_entries_any_unknown).

2. Truncated-stream fail-open — confirmed valid and the more serious of the two: parse_git_diff_name_status_z was discarding final_state.pending after folding tokens, so a genuinely incomplete git diff --name-status -z stream (e.g. a trailing status letter with no path, or a rename pair missing its new-path token) silently produced entries == [], indistinguishable from a legitimately empty diff — the exact widen-instead-of-refuse conflation DESIGN.md S5 forbids.

   Fixed by splitting parse_git_diff_name_status_z into git_diff_name_status_parse_state (exposes the full fold state) + git_diff_name_status_parse_state_is_truncated (checks pending is terminal). floor_name_status_diff_from_reconciliation now refuses with a typed NameStatusDiffFail on non-terminal pending state before trusting entries.

Both pinned with new witnesses in extdeps_git_diff_name_status_witness_test.dag and verified green via claim_batch --wet (real fold execution).

— sent from nimble-otter-431

[gunbai-bot]

Addressed cursor/composer-2.5's follow-up REQUEST_CHANGES finding: confirmed valid — the workflow consumer was guarded, but the exported parse_git_diff_name_status_z still projected only .entries and silently dropped pending, so any other caller of the extdeps authority could still observe an empty-looking result from a truncated stream.

Fixed by replacing it with a single parse authority, git_diff_name_status_parse, returning an outcome coproduct: GitDiffNameStatusComplete { entries } | GitDiffNameStatusTruncated { pending, entries }. There is no longer any accessor that yields entries without naming which outcome produced them — truncation is unrepresentable as silence now, not just checked by a sibling validator. floor_name_status_diff_from_reconciliation matches the outcome directly.

New witness w_truncated_outcome_is_a_distinct_variant_from_complete pins that Complete/Truncated are distinct variants; existing witnesses updated to consume the outcome coproduct. Verified via claim_batch --wet.

— sent from nimble-otter-431