[aitrawog]

Summary

sdk/candywalk.collectRefs regex-scanned a fetched repo's root manifest as raw text, so a ref a
manifest merely CONTAINS was collected as though it were DECLARED. plugin-box's R10 bed
box-reconcile-closure-reports-unfetchable writes
@github.com/opencharly/this-repo-does-not-exist-zzz/candy/nope:v1.2.3 into a scratch project at
runtime, on purpose, to prove charly box reconcile --closure reports an unfetchable ref instead
of swallowing it. The scanner collected the bed's own fixture and the corpus generator died resolving
it, rc=1, for every consumer of the corpus (opencharly/sdk#455).

I picked candidate 1 — exclude block scalars — and the instrument is the YAML parser, not a
narrower regex. Candidate 2 ("only scan a root manifest when the ref named the ROOT") only narrows
when the raw-text scan runs; it leaves the defective instrument in place, so a root-pinned repo with
an embedded fixture still kills the walk. Parsing fixes the class: a ref in a scalar is a declaration,
a ref inside a | / > body is data, whether that body is a shell script, a generated manifest
template, or prose.

The change, per file:

• candywalk/candywalk.go — collectRefs now parses the file and reads refs off its scalar
  nodes, skipping LiteralStyle/FoldedStyle entirely. A file that does not parse as a manifest
  (prose, a CHANGELOG) keeps the text scan, because there the text IS the declaration surface. The
  ref policy — skip the pre-cutover in-repo charly form, drop prose notation — moved into one
  acceptedRef home shared by both readers, so no policy was duplicated (R2).
  manifestRoot + collectRefsNode are the new parser reader; the package doc's claim that this is
  a raw-byte scan was corrected in the same edit (R4/R5).
• candywalk/candywalk_refs_declared_test.go (new) — three arms: the fixture-shaped bed's ref is
  NOT collected while the ref declared beside it IS; the SAME ref string in a DECLARED position IS
  collected (the negative arm — the scanner must not blind itself); and a versioned ref in a COMMENT
  is no longer fetched as though declared.

The fixture is untouched. plugin-box's bed and its realistic ref stay exactly as they are — a
predecessor refused to rewrite it, because that "hides the defect and breaks on the next repo with an
embedded fixture" (opencharly/sdk#455, "What I did NOT do").

Two consequences of parsing, both measured rather than assumed:

• a versioned ref in a COMMENT is no longer collected (a comment declares nothing). Org-wide there is
  exactly one such token — plugin-quickshell documenting its own pin — and that repo is a DIRECT pin
  already, so nothing is lost;
• four refs org-wide live ONLY inside block scalars: eval-omarchy's generated-manifest template:
  (plugin-record / plugin-spice / plugin-vision) and plugin-migrate's bed (plugin-pipeline).
  plugin-vision owns no skill and plugin-pipeline is already a DIRECT pin, so the corpus cost is
  record + spice — which arrive today only through that template. They are repaid by DIRECT pins
  in the marketplace refs list at the same tags (their newest), which is what
  opencharly/plugin-marketplace#41 asks for anyway: a skill reached only through the closure
  publishes whatever tag a sibling happens to name.

How tested

Change class: Go source in a shared kit (no runtime target, no image). The repo's gate is
ci.yml's Go gate; the changed path is additionally executed LIVE, through the real corpus generator,
because the defect only exists at that boundary.

The control that fails — RED, generator without the fix

A refs list carrying @github.com/opencharly/plugin-box/candy/plugin-box:v2026.295.2027 (the issue's
repo, at the tag its own merge minted) and the pristine tools/marketplace-cli/go.mod (sdk
v0.2026289.157 from the proxy):

$ cd /home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/refs-cutover/marketplace
$ PATH=/home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/refs-cutover/charly/bin:$PATH charly marketplace generate --root . --out /tmp/cs/red > /tmp/cs/red.log 2>&1; echo "rc=$?"
rc=1
$ tail -4 /tmp/cs/red.log
Downloading github.com/opencharly/layer-charly-internals:v2026.296.1907...
charly marketplace: collect entities: resolve @github.com/opencharly/this-repo-does-not-exist-zzz/candy/nope:v1.2.3: resolving github.com/opencharly/this-repo-does-not-exist-zzz:v1.2.3: git ls-remote https://github.com/opencharly/this-repo-does-not-exist-zzz.git v1.2.3: exit status 128
remote: Repository not found.
fatal: repository 'https://github.com/opencharly/this-repo-does-not-exist-zzz.git/' not found

GREEN — the same refs list, the same generator, this head's candywalk

tools/marketplace-cli/go.mod carries a local replace github.com/opencharly/sdk => <this branch's worktree>; the shim is rebuilt from it (go mod tidy && go build ./...). The consumer-side bump that
carries this fix into the real pin is the producer-first follow-up (sdk tag, then the
plugin-marketplace require, then the marketplace shim's require).

$ cd /home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/refs-cutover/marketplace
$ PATH=/home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/refs-cutover/charly/bin:$PATH GOTMPDIR=$HOME/.cache/go-tmp charly marketplace generate --root . --out $HOME/.cache/refs-cutover/green > $HOME/.cache/refs-cutover/green.log 2>&1; echo "rc=$?"
rc=0
$ find $HOME/.cache/refs-cutover/green -name SKILL.md | wc -l
361
$ grep -n 'resolving github.com/opencharly/plugin-box' $HOME/.cache/refs-cutover/green.log
220:charly: resolving github.com/opencharly/plugin-box:v2026.295.2027 (218 resolved, 1157 queued)
$ grep -c 'this-repo-does-not-exist' $HOME/.cache/refs-cutover/green.log
0

So plugin-box WAS fetched (line 220) and its root manifest WAS read as a candy source; its bed's
fixture simply no longer reaches the resolver. The 361 is that refs list's own corpus (the baseline
360 plus the skill plugin-box owns), not a claim about the refs cutover.

The negative arm — the scanner is not blinded

A scratch project whose ONLY ref is a DECLARED, genuinely unresolvable ref (a candy: list entry,
i.e. a root ref), generated by the SAME fixed generator:

$ cd $HOME/.cache/refs-cutover/neg
$ cat candy/charly-marketplace/charly.yml
charly-marketplace:
    candy:
        description: negative arm — a DECLARED root ref that genuinely cannot resolve
        candy:
            - '@github.com/opencharly/this-repo-does-not-exist-zzz/candy/nope:v1.2.3'
$ PATH=/home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/refs-cutover/charly/bin:$PATH GOTMPDIR=$HOME/.cache/go-tmp charly marketplace generate --root . --out $HOME/.cache/refs-cutover/neg-out > $HOME/.cache/refs-cutover/neg.log 2>&1; echo "rc=$?"
rc=1
$ tail -3 $HOME/.cache/refs-cutover/neg.log
charly marketplace: collect entities: resolve @github.com/opencharly/this-repo-does-not-exist-zzz/candy/nope:v1.2.3: resolving github.com/opencharly/this-repo-does-not-exist-zzz:v1.2.3: git ls-remote https://github.com/opencharly/this-repo-does-not-exist-zzz.git v1.2.3: exit status 128
remote: Repository not found.
fatal: repository 'https://github.com/opencharly/this-repo-does-not-exist-zzz.git/' not found

The same string is ignored inside a block scalar and caught when declared — that is the whole
property, and it is why the fix cannot be "stop collecting refs from this file".

Go gates on this head (2b59aad)

$ cd /home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/refs-cutover/sdk
$ git rev-parse HEAD
2b59aad74b921e945aa9b5540b9218bee07c0788
$ git diff --stat origin/main...HEAD
 candywalk/candywalk.go                    |  99 +++++++++++++++++++++-----
 candywalk/candywalk_refs_declared_test.go | 113 ++++++++++++++++++++++++++++++
 2 files changed, 196 insertions(+), 16 deletions(-)
$ test -z "$(gofmt -l .)" && echo 'gofmt: clean'
gofmt: clean
$ go vet ./... && echo 'vet: clean'
vet: clean
$ go test ./candywalk/ -v -run 'TestCollectRefs|TestAcceptableVersion'
=== RUN   TestAcceptableVersion_RejectsEveryProseFormAndKeepsEveryRealOne
--- PASS: TestAcceptableVersion_RejectsEveryProseFormAndKeepsEveryRealOne (0.00s)
=== RUN   TestCollectRefs_DropsTheProseFormsAndKeepsTheRealRefsBesideThem
--- PASS: TestCollectRefs_DropsTheProseFormsAndKeepsTheRealRefsBesideThem (0.00s)
=== RUN   TestCollectRefs_IgnoresRefsInsideBlockScalars
--- PASS: TestCollectRefs_IgnoresRefsInsideBlockScalars (0.00s)
=== RUN   TestCollectRefs_StillCollectsAGenuinelyMalformedRef
--- PASS: TestCollectRefs_StillCollectsAGenuinelyMalformedRef (0.00s)
=== RUN   TestCollectRefs_ReadsDeclarationsNotComments
--- PASS: TestCollectRefs_ReadsDeclarationsNotComments (0.00s)
=== RUN   TestCollectRefs_IgnoresProseTemplates
--- PASS: TestCollectRefs_IgnoresProseTemplates (0.00s)
=== RUN   TestCollectRefs_AcceptsEveryRefForm
--- PASS: TestCollectRefs_AcceptsEveryRefForm (0.00s)
=== RUN   TestCollectRefs_IgnoresATruncatedPlaceholderVersion
--- PASS: TestCollectRefs_IgnoresATruncatedPlaceholderVersion (0.00s)
PASS
ok  	github.com/opencharly/sdk/candywalk	0.029s
$ go test ./...
ok  	github.com/opencharly/sdk/vmshared	(cached)
ok  	github.com/opencharly/sdk/workflowkit	(cached)

The whole module's suite passes (19 packages ok, zero failures); the new arms and the sibling tests
that pin the earlier #322 / #408 / #410 / #412 behaviour pass together, so the fix does not
walk back a precedent.

The ci.yml cross-compile matrix, run from this head:

$ for a in amd64 arm64 arm 386; do GOOS=linux GOARCH=$a CGO_ENABLED=0 go build ./... || echo "FAIL $a"; done
$ echo "all four arches: rc=0, no output"
all four arches: rc=0, no output

The one gate that could not run, and its control

golangci-lint v2.13.2 — the ci.yml pin — cannot typecheck ANY tree on this host: its go/types
understands export data version 4 and the Go 1.27.3 stdlib writes version 5. It fails identically on
origin/main, on four findings in a file this branch does not touch, so the skew is the toolchain's,
not this diff's. Filed as opencharly/sdk#466 with the evidence and the fix. The tier below reflects
that honestly rather than claiming a gate that did not run.

Rulebook compliance

• R0 — loaded /charly-internals/go, /charly-internals/git-workflow, /charly-internals/plugin,
  /charly-internals/marketplace and this repo's AGENTS.md before the first edit; every command
  here was run after that.
• R1 — two anomalies met: the defect itself (RCA in opencharly/sdk#455: mechanism = raw-text
  scan, missed control = no parser/unit arm on block scalars, blast radius = every corpus consumer,
  root fix = this) and the local golangci-lint skew (RCA + fix filed as opencharly/sdk#466,
  reproduced on origin/main). Nothing is parked as "pre-existing" without an issue number.
• R2 — one ref policy: acceptedRef is the single home for the in-repo-charly skip and the
  prose-notation drop, shared by the parser reader and the text fallback. No second implementation.
• R3 — no sleep, retry, suppression or fallback branch added; the fixture was not rewritten and
  no ref string was split to dodge the scanner.
• R4 — the package doc's own claim that this scans "RAW file bytes, comments included" is false
  after the change and was corrected in the same commit, beside the code that decides it.
• R5 — the retired behaviour (comment refs fetched; block-scalar refs fetched) is deleted, not
  shimmed; the new tests name both so a re-introduction fails.
• R6 — git status --short was read before every staging step; no force-push, no --no-verify,
  no direct main push, no foreign file touched. One commit, one push.
• R7 — the coverage fails without the change: TestCollectRefs_IgnoresRefsInsideBlockScalars
  asserts exactly the fixture ref the old scanner returned, and the RED/GREEN pair above exercises
  the changed path live through the real generator.
• R8 — no live service boundary is involved (N/A — pure filesystem discovery; no network
  service is mocked or skipped).
• R9 — no binary is deployed by this repo and no runtime OS dependency was added; the live runs
  used a worktree-local charly built from origin/main (2026.296.2116), not a shared install.
• R10 — change class is Go source in a shared kit: the repo's Go gate ran on this head (above)
  plus the live generator run on the changed path; the one unavailable gate is filed, not waved
  through.

Attribution (A3). The runtime names are the session's, not an inference: the delivered system
message reads "You are a coding agent powered by the deepseek-v4.1-flash model." — harness
DeepSeek Harness (the dsh CLI, @deepseek-ai/dsh), provider ollama-cloud, model id
deepseek-v4.1-flash. opencharly/opencharly#538 records why that pair is correct and why a
validator's model allowlist must accept it rather than push an agent to edit a true attribution line.

Change classification

• Class: Go source change in a shared kit (github.com/opencharly/sdk, package candywalk) —
  a mechanism library consumed by both out-of-process generators (plugin-marketplace,
  plugin-docs) and by deploykit's collectors. NOT documentation-only: two .go files changed.
• Tier: analysed on a live system — the changed path ran live with retained output (RED/GREEN/
  negative arm above); every local Go gate except golangci-lint passed, and that one cannot run on
  this host at any tree (opencharly/sdk#466).
• Consumers to follow (producer-first): sdk tag → plugin-marketplace require bump →
  marketplace's tools/marketplace-cli require bump → the refs cutover that needs the fix.

Filed issues

• opencharly/sdk#466 — golangci-lint v2.13.2 cannot decode the Go 1.27.3 stdlib export data; the
  local lint gate is red on main too. Non-blocking for this diff (the findings name a file this
  branch does not touch), separable, and it has the RCA plus the fix.

Agent: charly

Assisted-by: DeepSeek Harness ollama-cloud deepseek-v4.1-flash (analysed on a live system)

[github-actions]

Review — PASS

What the diff does

collectRefs now attempts yaml.Unmarshal on the file; when the result is a single-document root mapping it walks the node tree (collectRefsNode) and reads refs off scalar nodes only, skipping LiteralStyle/FoldedStyle bodies entirely. When the file is not a mapping-shaped document (prose, changelog, unparseable) it falls back to the previous raw-text scan. The ref policy (skip the pre-cutover in-repo charly form, drop prose-notation versions) is hoisted into one acceptedRef helper used by both readers, so no policy is duplicated.

Correctness against the body's claims

• The stated mechanism matches the code: block scalars (|, >) are excluded, declarations are read, comments are not nodes so comment refs disappear as claimed.
• The body's stat block (2 files, +196/−16; candywalk.go 99 changed lines, test file 113) reproduces exactly from the diff hunks.
• The three new tests correspond to the three arms described: (1) block-scalar fixture ignored while the declared ref beside it survives — this arm fails against the old raw scan, since the old regex would return the fixture ref; (2) the same unfetchable string collected when genuinely declared — a guard, correctly labelled "negative arm" rather than a regression test; (3) a comment-only ref dropped while a declared one is kept — also fails without the change, since the old scan returned the commented token. So R7's claim ("coverage fails without the change") holds for two of the three arms and is honestly characterised for the third.
• Ordering claim ("same order the old byte scan produced") is consistent with node traversal: mapping keys precede values and sequence entries precede successors in document order.
• The live RED/GREEN/negative-arm transcripts are internally consistent (RED names the fixture ref and rc=1; GREEN shows plugin-box fetched at line 220 with zero occurrences of the fixture token; negative arm still rc=1), and they exercise the exact boundary the defect lives on. The golangci-lint gap is disclosed with an issue number rather than waved through — acceptable, and it does not affect this diff's validity.

Scope and cleanliness

The change is coherent: one reader swap, one shared policy helper, one new test file, and the stale "RAW file bytes" doc claim corrected in the same hunk. No shim or dual path for the retired behaviour; no fixture rewrite; no sleeps/retries. No secrets, no new dependencies, no injection surface — this is filesystem discovery over local manifests.

Comments

There are no comments in the thread, so there is nothing to re-derive and no maintainer sign-off to weigh; the change stands on its own evidence, which it does.

Non-blocking observations (do not gate)

• manifestRoot's doc comment says a "multi-document bed" makes it return nil so the caller falls back to the text scan. With yaml.v3, Unmarshal decodes only the first document and does not error on trailing ones, so a multi-document file would be parsed from document 1 and later documents would not be walked at all — refs declared there would be silently dropped rather than text-scanned. The author's org-wide measurement (596 manifests, one added skill in the corpus) shows no such loss today, so this is a documentation/edge-case inaccuracy, not a demonstrated defect. Worth a follow-up test if multi-doc manifests ever appear.
• The parser treats any non-block scalar (including a plain description: value) as a declaration surface. That is the model the body states, so it is consistent, but it means "declared" is broader than require:/candy: entries.

Neither point undermines the fix, the tests, or the honesty of the body.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run