go-git-engine-stale-clone-origin-mismatch-silent-wrong-source-import
I diagnosed the issue and wrote the verified solution to ~/solution.md.
Root cause: Both internal/import/git.go and internal/export/git.go had an existing-clone branch that reused any clone at LocalDir/.git unconditionally — running git fetch/checkout/pull origin against whatever origin the previous import left behind, never validating cfg.RepoURL. The stale repo was re-scanned and the walk returned a normal-looking ImportResult, so a wrong/dead source_repo produced a benign 200 {"added":0,"updated":0,"skipped":1,"conflicted":0}.
Fix: In the existing-clone branch, read git remote get-url origin before any fetch and compare (after TrimSpace, strip one trailing / and one trailing .git) to cfg.RepoURL. On mismatch return fmt.Errorf("%w: existing clone origin %q, requested source_repo %q", ErrRepoMismatch, got, want) with zero fetch/pull. handleImport checks errors.Is(err, importgit.ErrRepoMismatch) first → 409 source_repo_mismatch, retaining the generic 500 import_failed path. Mirrored into export.
Verification (actually run, not just asserted): The upstream repo wasn't present in this sandbox, so I reconstructed the two branches, sentinel, normalizer, and handler mapping 1:1 in /tmp/verify and tested against real bare git remotes. Results:
- Pre-fix: err=nil, the stale origin's origin/main advanced (fetch happened), handler returned 200 skipped:1 — the exact silent symptom.
- Post-fix: ErrRepoMismatch, origin/main unchanged (no fetch), handler returned 409 source_repo_mismatch naming both URLs.
- Normalization: trailing-slash spelling of the matching origin still imports 200.
go test ./... passes for both packages. The markdown also includes the real-repo side-by-side old/new binary procedure and the surgical RED-proof instructions.
# Evidence - Problem class: go-git-engine-stale-clone-origin-mismatch-silent-wrong-source-import - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-13T01:20:06.633Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Off-by-One foreman tick 368 (2026-09-12) post-debug submission.\n\nSYMPTOM: POST /api/v1/import {source_repo: <bogus path>} returned HTTP 200 {\"added\":0,\"updated\":0,\"skipped\":1,\"conflicted\":0} - byte-identical in shape to a benign dedup response - while a first import into an empty dir with a dead URL correctly failed. Silent wrong-source import on any multi-import server.\n\nROOT CAUSE (verified): internal/import/git.go prepareClone reused ANY existing clone at LocalDir/.git: it ran `git fetch origin`, `checkout <branch>`, `pull origin <branch>` against whatever origin the previous import left behind. cfg.RepoURL was never validated, so the stale repo was re-scanned and the walk returned a normal ImportResult. internal/export/git.go had the same near-copied defect.\n\nFIX (commits 1af356e + 7899fe8, repo totalwindupflightsystems/off-by-one): in the existing-clone branch, read `git remote get-url origin` BEFORE any fetch and compare it to cfg.RepoURL after normalization (TrimSpace, strip one trailing '/' and one trailing '.git'); on mismatch return fmt.Errorf(\"%w: existing clone origin %q, requested source_repo %q\", ErrRepoMismatch, got, want) with zero fetch/pull. handleImport (internal/api/handlers.go) checks errors.Is(err, importgit.ErrRepoMismatch) FIRST and returns HTTP 409 error=source_repo_mismatch; the generic 500 import_failed path is retained. A sentinel + guard were mirrored into internal/export.\n\nVERIFICATION: pre-fix binary built at HEAD^ and run side by side with the post-fix binary on scratch ports (DB copies) - pre-fix 200 skipped:1 for both a nonexistent path and a different real repo; post-fix 409 naming both URLs, while a trailing-slash spelling of the matching origin still imported 200. Behavioral RED proven by surgically removing the guard (symbols kept): engine/handler tests failed with err=nil; files restored md5-identical. Tests added: TestImport_ExistingCloneMismatchedRepo_Errors, TestImport_ExistingCloneMismatchedRepo_NoFetch, TestImport_ExistingCloneMatchingRepo_Proceeds, TestNormalizeRepoURL, TestImportSourceRepoMismatch_Conflict, TestExport_ExistingCloneMismatchedRepo_Errors (no-fetch asserted via refs/remotes/origin/main unchanged after the remote advanced).\n\nREUSABLE RULE: whenever a git-backed engine caches a clone across requests, validate remote.origin.url against the requested URL before fetch; a mismatch must be a loud client error, never a silent re-scan. Run the old and new binaries side by side against DB copies to prove the before/after - a single green suite does not prove the bug existed.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "go-git-engine-stale-clone-origin-mismatch-silent-wrong-source-import", "provider": "openrouter", "solved_at": "2026-09-13T01:20:06.633Z", "version": ""}I diagnosed the issue and wrote the verified solution to ~/solution.md.
Root cause: Both internal/import/git.go and internal/export/git.go had an existing-clone branch that reused any clone at LocalDir/.git unconditionally — running git fetch/checkout/pull origin against whatever origin the previous import left behind, never validating cfg.RepoURL. The stale repo was re-scanned and the walk returned a normal-looking ImportResult, so a wrong/dead source_repo produced a benign 200 {"added":0,"updated":0,"skipped":1,"conflicted":0}.
Fix: In the existing-clone branch, read git remote get-url origin before any fetch and compare (after TrimSpace, strip one trailing / and one trailing .git) to cfg.RepoURL. On mismatch return fmt.Errorf("%w: existing clone origin %q, requested source_repo %q", ErrRepoMismatch, got, want) with zero fetch/pull. handleImport checks errors.Is(err, importgit.ErrRepoMismatch) first → 409 source_repo_mismatch, retaining the generic 500 import_failed path. Mirrored into export.
Verification (actually run, not just asserted): The upstream repo wasn't present in this sandbox, so I reconstructed the two branches, sentinel, normalizer, and handler mapping 1:1 in /tmp/verify and tested against real bare git remotes. Results:
- Pre-fix: err=nil, the stale origin's origin/main advanced (fetch happened), handler returned 200 skipped:1 — the exact silent symptom.
- Post-fix: ErrRepoMismatch, origin/main unchanged (no fetch), handler returned 409 source_repo_mismatch naming both URLs.
- Normalization: trailing-slash spelling of the matching origin still imports 200.
go test ./... passes for both packages. The markdown also includes the real-repo side-by-side old/new binary procedure and the surgical RED-proof instructions.
# Evidence - Problem class: go-git-engine-stale-clone-origin-mismatch-silent-wrong-source-import - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-13T01:20:06.633Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Off-by-One foreman tick 368 (2026-09-12) post-debug submission.\n\nSYMPTOM: POST /api/v1/import {source_repo: <bogus path>} returned HTTP 200 {\"added\":0,\"updated\":0,\"skipped\":1,\"conflicted\":0} - byte-identical in shape to a benign dedup response - while a first import into an empty dir with a dead URL correctly failed. Silent wrong-source import on any multi-import server.\n\nROOT CAUSE (verified): internal/import/git.go prepareClone reused ANY existing clone at LocalDir/.git: it ran `git fetch origin`, `checkout <branch>`, `pull origin <branch>` against whatever origin the previous import left behind. cfg.RepoURL was never validated, so the stale repo was re-scanned and the walk returned a normal ImportResult. internal/export/git.go had the same near-copied defect.\n\nFIX (commits 1af356e + 7899fe8, repo totalwindupflightsystems/off-by-one): in the existing-clone branch, read `git remote get-url origin` BEFORE any fetch and compare it to cfg.RepoURL after normalization (TrimSpace, strip one trailing '/' and one trailing '.git'); on mismatch return fmt.Errorf(\"%w: existing clone origin %q, requested source_repo %q\", ErrRepoMismatch, got, want) with zero fetch/pull. handleImport (internal/api/handlers.go) checks errors.Is(err, importgit.ErrRepoMismatch) FIRST and returns HTTP 409 error=source_repo_mismatch; the generic 500 import_failed path is retained. A sentinel + guard were mirrored into internal/export.\n\nVERIFICATION: pre-fix binary built at HEAD^ and run side by side with the post-fix binary on scratch ports (DB copies) - pre-fix 200 skipped:1 for both a nonexistent path and a different real repo; post-fix 409 naming both URLs, while a trailing-slash spelling of the matching origin still imported 200. Behavioral RED proven by surgically removing the guard (symbols kept): engine/handler tests failed with err=nil; files restored md5-identical. Tests added: TestImport_ExistingCloneMismatchedRepo_Errors, TestImport_ExistingCloneMismatchedRepo_NoFetch, TestImport_ExistingCloneMatchingRepo_Proceeds, TestNormalizeRepoURL, TestImportSourceRepoMismatch_Conflict, TestExport_ExistingCloneMismatchedRepo_Errors (no-fetch asserted via refs/remotes/origin/main unchanged after the remote advanced).\n\nREUSABLE RULE: whenever a git-backed engine caches a clone across requests, validate remote.origin.url against the requested URL before fetch; a mismatch must be a loud client error, never a silent re-scan. Run the old and new binaries side by side against DB copies to prove the before/after - a single green suite does not prove the bug existed.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "go-git-engine-stale-clone-origin-mismatch-silent-wrong-source-import", "provider": "openrouter", "solved_at": "2026-09-13T01:20:06.633Z", "version": ""}