abhigyanpatwari/GitNexus · critical · ValueError

oracle sanitization requires a real self-contained clone: {r

Error message

oracle sanitization requires a real self-contained clone: {root}

What it means

Raised by sanitize_clone_for_hidden_oracles when the clone root or its '.git' is a symlink, not a directory, or the resolved root path differs from the lexical path (symlinked root). The sanitizer must operate on a real, non-symlinked clone so it can guarantee no path indirection hides oracle data or reintroduces it after pruning.

Source

Thrown at eval/workflow_bench/oracle_assets.py:266

    commit from the clone's existing index after removing the complete harness,
    discard every other reference/reflog, and prune unreachable objects before
    any task asset, setup command, or model session is allowed to run.
    """

    root = clone.expanduser().absolute()
    try:
        root_metadata = root.lstat()
        git_metadata = (root / ".git").lstat()
    except OSError as exc:
        raise ValueError(f"oracle sanitization requires a self-contained clone: {root}") from exc
    if (
        stat.S_ISLNK(root_metadata.st_mode)
        or not stat.S_ISDIR(root_metadata.st_mode)
        or root.resolve(strict=True) != root
        or stat.S_ISLNK(git_metadata.st_mode)
        or not stat.S_ISDIR(git_metadata.st_mode)
    ):
        raise ValueError(f"oracle sanitization requires a real self-contained clone: {root}")

    original_head = _git_checked(root, ["rev-parse", "--verify", "HEAD^{commit}"])
    if len(original_head) not in {40, 64} or any(
        character not in "0123456789abcdefABCDEF" for character in original_head
    ):
        raise ValueError("clone HEAD is not an immutable commit")

    hidden_tree_result = run_managed(
        [
            "git",
            "-C",
            str(root),
            "ls-tree",
            "-d",
            "--format=%(objectname)",
            "HEAD",
            "--",
            HIDDEN_HARNESS_PATH.as_posix(),

View on GitHub (pinned to d540b00184)

Solutions

1. Use a full `git clone` (not a worktree) so '.git' is a real directory.
2. Resolve all symlinks in the path and pass the real absolute directory.
3. Avoid git worktree / gitfile-style repos for the disposable sanitized clone.
4. Re-clone into a fresh, non-symlinked location.

import stat
from pathlib import Path

def assert_real_clone(clone: Path) -> None:
    root = clone.expanduser().absolute()
    rmd = root.lstat()
    gmd = (root / ".git").lstat()
    if (stat.S_ISLNK(rmd.st_mode) or not stat.S_ISDIR(rmd.st_mode)
            or root.resolve(strict=True) != root
            or stat.S_ISLNK(gmd.st_mode) or not stat.S_ISDIR(gmd.st_mode)):
        raise ValueError(f"{root} must be a real non-symlink clone with real .git")

def is_real_self_contained_clone(clone) -> bool:
    import stat
    root = Path(clone).expanduser().absolute()
    try:
        rmd = root.lstat(); gmd = (root / ".git").lstat()
    except OSError:
        return False
    return (not stat.S_ISLNK(rmd.st_mode) and stat.S_ISDIR(rmd.st_mode)
            and root.resolve(strict=True) == root
            and not stat.S_ISLNK(gmd.st_mode) and stat.S_ISDIR(gmd.st_mode))

try:
    head = sanitize_clone_for_hidden_oracles(clone)
except ValueError as exc:
    if "real self-contained clone" in str(exc):
        real = clone.resolve(strict=True)
        head = sanitize_clone_for_hidden_oracles(real)
    else:
        raise

When it happens

Trigger: clone is a symlink to another directory; '.git' is a symlink (e.g. a gitfile-style worktree pointer rather than a real .git directory); an intermediate path component is a symlink causing resolve() to diverge; clone is a regular file, not a directory.

Common situations: Using `git worktree` (which uses a .git file, not directory); a convenience symlink to the real clone; running through a symlinked parent like /tmp on some OSes; a corrupted clone where .git is a file.

Related errors

• oracle sanitization requires a self-contained clone: {root}
• clone HEAD is not an immutable commit
• cannot inspect the clone for committed benchmark harness dat
• committed benchmark harness is not a single bounded tree
• oracle root must be a real non-symlink directory: {lexical}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/714185de2ff4d54f. Report an issue: GitHub.