{"record":{"id":"b514fd1c5f415810","repo":"abhigyanpatwari/GitNexus","slug":"oracle-sanitization-left-the-label-recoverable","errorCode":null,"errorMessage":"oracle sanitization left the {label} recoverable","messagePattern":"oracle sanitization left the (.+?) recoverable","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"eval/workflow_bench/oracle_assets.py","lineNumber":437,"sourceCode":"        [\"git\", \"-C\", str(root), \"fsck\", \"--full\", \"--no-progress\", \"--no-reflogs\", \"--unreachable\"],\n        timeout=600,\n        tail_bytes=MAX_CLONE_REF_BYTES,\n    )\n    if fsck.stdout_tail.strip() or fsck.stderr_tail.strip():\n        raise ValueError(\"oracle sanitization left unreachable Git objects recoverable\")\n\n    forbidden_objects: list[tuple[str, str]] = []\n    if original_head != sanitized_head:\n        forbidden_objects.append((original_head, \"original commit\"))\n    if hidden_tree:\n        forbidden_objects.append((hidden_tree, \"hidden harness tree\"))\n    for forbidden_object, label in forbidden_objects:\n        probe = run_managed(\n            [\"git\", \"-C\", str(root), \"cat-file\", \"-e\", forbidden_object],\n            timeout=60,\n        )\n        if probe.ok:\n            raise ValueError(f\"oracle sanitization left the {label} recoverable\")\n        if probe.state != \"exited\" or probe.returncode not in {1, 128}:\n            raise ValueError(f\"oracle sanitization could not verify removal of the {label}\")\n\n    hidden_listing = _git_checked(\n        root,\n        [\"ls-tree\", \"-r\", \"--name-only\", \"HEAD\", \"--\", HIDDEN_HARNESS_PATH.as_posix()],\n        timeout=60,\n    )\n    if hidden_listing or current.exists() or current.is_symlink():\n        raise ValueError(\"oracle sanitization left the benchmark harness visible\")\n    if _git_checked(root, [\"status\", \"--porcelain=v1\", \"--untracked-files=all\"], timeout=60):\n        raise ValueError(\"oracle sanitization did not produce a clean task snapshot\")\n    if _git_checked(root, [\"rev-parse\", \"--verify\", \"HEAD^{commit}\"], timeout=60) != sanitized_head:\n        raise ValueError(\"oracle sanitization did not retain its parentless task snapshot\")\n    parents = _git_checked(root, [\"show\", \"-s\", \"--format=%P\", \"HEAD\"], timeout=60)\n    if parents:\n        raise ValueError(\"oracle sanitization snapshot unexpectedly retained parent history\")\n    if _git_checked(root, [\"remote\"], timeout=60):","sourceCodeStart":419,"sourceCodeEnd":455,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/oracle_assets.py#L419-L455","documentation":"The harness probes each forbidden object (the original HEAD commit, and the hidden harness tree) with `git cat-file -e <sha>`. If the probe exits 0 (probe.ok), the object is still present in the object store and recoverable by the model, so sanitization has failed to purge it.","triggerScenarios":"Triggered when repack/prune left the original commit or the eval/workflow_bench tree reachable-by-SHA in a packfile or loose object after HEAD was rewritten and refs/reflogs were cleared.","commonSituations":"A .keep file pinning the original pack; gc.bigPackThreshold keeping large packs un-pruned; concurrent gc; a git version that does not prune objects referenced only by the reflog before reflog expiry took effect.","solutions":["Confirm: `git -C <clone> cat-file -e <original_head>`; if it prints nothing and exits 0, the object lives.","Remove .keep files and repack aggressively: `rm -f <clone>/.git/objects/pack/*.keep && git -C <clone> repack -ad && git -C <clone> prune --expire=now`.","Override pack retention: `git -C <clone> -c gc.bigPackThreshold=0 gc --prune=now`.","If the object persists, re-clone from a sanitized source — the object store cannot be trusted."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"from pathlib import Path\nfrom eval.workflow_bench.process_control import run_managed\n\ndef object_is_gone(clone: Path, sha: str) -> bool:\n    r = run_managed([\"git\", \"-C\", str(clone), \"cat-file\", \"-e\", sha], timeout=60)\n    return not r.ok\n","typeGuard":"def is_forbidden_object_recoverable(exc: BaseException) -> bool:\n    return isinstance(exc, ValueError) and \"left the\" in str(exc) and \"recoverable\" in str(exc)\n","tryCatchPattern":"try:\n    oracle_assets.sanitize_clone_for_hidden_oracles(clone)\nexcept ValueError as exc:\n    # The original commit or harness tree is still cat-file-able: a real leak.\n    quarantine(clone)\n    raise AbortTask(str(exc)) from exc\n","preventionTips":["Drop .keep files and set gc.bigPackThreshold=0 for benchmark clones.","Never trust a partially pruned object store; re-clone when a forbidden object survives."],"tags":["git","cat-file","prune","repack","data-leak","oracle","sanitization","postcondition","invariant"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}