abhigyanpatwari/GitNexus · critical · ValueError

oracle sanitization left unreachable Git objects recoverable

Error message

oracle sanitization left unreachable Git objects recoverable

What it means

Post-condition: after repack + prune, `git fsck --full --no-reflogs --unreachable` must produce no output. Any stdout/stderr means unreachable objects (including the original commit or harness tree) are still present and could be read via `git cat-file`, so the harness treats the clone as leaking oracle data.

Source

Thrown at eval/workflow_bench/oracle_assets.py:424

        logs_metadata = logs.lstat()
        if stat.S_ISLNK(logs_metadata.st_mode) or not stat.S_ISDIR(logs_metadata.st_mode):
            raise ValueError("unsafe Git reflog metadata blocks oracle sanitization")
        shutil.rmtree(logs)

    _git_checked(root, ["repack", "-A", "-d"], timeout=600)
    _git_checked(root, ["prune", "--expire=now"], timeout=600)
    _git_checked(root, ["prune-packed"], timeout=600)

    remaining_refs = _git_checked(root, ["for-each-ref", "--format=%(refname)"], timeout=60)
    if remaining_refs:
        raise ValueError("oracle sanitization left clone references recoverable")
    fsck = run_checked(
        ["git", "-C", str(root), "fsck", "--full", "--no-progress", "--no-reflogs", "--unreachable"],
        timeout=600,
        tail_bytes=MAX_CLONE_REF_BYTES,
    )
    if fsck.stdout_tail.strip() or fsck.stderr_tail.strip():
        raise ValueError("oracle sanitization left unreachable Git objects recoverable")

    forbidden_objects: list[tuple[str, str]] = []
    if original_head != sanitized_head:
        forbidden_objects.append((original_head, "original commit"))
    if hidden_tree:
        forbidden_objects.append((hidden_tree, "hidden harness tree"))
    for forbidden_object, label in forbidden_objects:
        probe = run_managed(
            ["git", "-C", str(root), "cat-file", "-e", forbidden_object],
            timeout=60,
        )
        if probe.ok:
            raise ValueError(f"oracle sanitization left the {label} recoverable")
        if probe.state != "exited" or probe.returncode not in {1, 128}:
            raise ValueError(f"oracle sanitization could not verify removal of the {label}")

    hidden_listing = _git_checked(
        root,

View on GitHub (pinned to d540b00184)

Solutions

Force expiry and prune: `git -C <clone> -c gc.reflogExpire=now -c gc.reflogExpireUnreachable=now reflog expire --all && git -C <clone> gc --prune=now`.
Remove .keep files: `rm -f <clone>/.git/objects/pack/*.keep`, then `git -C <clone> repack -ad && git -C <clone> prune --expire=now`.
Check config: `git -C <clone> config --get gc.pruneExpire` and override to 'now' for the benchmark.
Re-clone and sanitize in a clean environment.

Defensive patterns

Strategy: try-catch

Validate before calling

from pathlib import Path
from eval.workflow_bench.process_control import run_managed

def no_unreachable_objects(clone: Path) -> bool:
    r = run_managed(["git", "-C", str(clone), "fsck", "--full", "--no-progress", "--no-reflogs", "--unreachable"], timeout=600)
    return not (r.stdout_tail.strip() or r.stderr_tail.strip())

Type guard

def is_unreachable_recoverable(exc: BaseException) -> bool:
    return isinstance(exc, ValueError) and "unreachable Git objects recoverable" in str(exc)

Try / catch

try:
    oracle_assets.sanitize_clone_for_hidden_oracles(clone)
except ValueError as exc:
    # Unreachable oracle-bearing objects may still be cat-file-able; abort.
    quarantine(clone)
    raise AbortTask(str(exc)) from exc

Prevention

Set gc.pruneExpire=now and gc.reflogExpireUnreachable=now in the clone config before sanitizing.
Do not place .keep files on benchmark-clone packs.
Treat this as a potential oracle leak, not a recoverable error.

When it happens

Trigger: Triggered when git prune/repack did not actually remove unreachable objects — commonly because gc.pruneExpire or gc.reflogExpireUnreachable kept them, a leftover .keep file pinned a pack, or prune ran with a grace period.

Common situations: Repo config with gc.pruneExpire=2weeks; a .keep file on the pack holding the original commit; running on a git with default gc that respects a recent-object grace; reflog entries that were not expired before prune.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/55e99d95b3aceeee. Report an issue: GitHub.