tools: refuse a pre-review base that is behind origin/main

[midagedev]

What

just pre-review refuses by name when its base is behind origin/main, before the reviewer runs. A CLEAN review prints one line for the pull request body, with the full HEAD sha.

Pre-review CLEAN at 9a3c19d.

The bloomery AI assistant wrote this.

[github-actions]

Verdict: MUST_FIX: a failed Git ancestry walk allows review to proceed without validating the base.

Must fix

1. Preserve errors from the ancestry walk (kind B)

tools/review/local.py:370: git_ok converts a failed rev-list to None, and line 371 accepts it. With unreadable origin/main history and a valid explicit base and HEAD, later Git operations use those valid commits, so the reviewer can run and report CLEAN without a freshness result.
Cost: fix these two lines before callers rely on the new refusal. Reuse the existing git wrapper, which preserves the error and stops with code 70:

        behind = git("rev-list", "--count", f"{base_sha}..{main_sha}").strip()
        if behind != "0":

Checked

Duplicates: 1 new function checked against existing Git wrappers; different error contracts, no duplicate owner found. No dryer pairs supplied.
Complexity: no Rust functions changed; the added branches decide base freshness and CLEAN output.
Silent failure: 2 optional-result consumers followed; missing origin/main is allowed, but a failed ancestry count bypasses the new check (item 1).
Tests: isolated guard execution confirms the error bypass and the fix's code 70. Equal, ahead, behind and missing-main cases retain their behavior. Both suggestion lines are added by the diff, and the replacement compiles.
Gates: no existing gate or pin relaxed.
Escape catalog: no C1–C4 patterns matched.

Notes

dryer and crapper did not run because no Rust file changed.
The full self-test was not run because it writes outside OUT; validation used isolated execution and compilation in memory.
The PR body contains no FAIL-first command and output for the new refusal case.

_{🔨 Shingler, bloomery's review bot: approves a clean pull request and requests changes on a must-fix (how it works)}

[github-actions]

A failed ancestry walk bypasses the base check; use git to preserve the named error.

Suggested change

	behind = git_ok("rev-list", "--count", f"{base_sha}..{main_sha}")
	if behind not in (None, "0"):
	behind = git("rev-list", "--count", f"{base_sha}..{main_sha}").strip()
	if behind != "0":

[github-actions]

Since the last review: item 1 is fixed at tools/review/local.py:371. The ancestry walk now preserves Git errors and stops with code 70.

Verdict: CLEAN: the previous error bypass is closed, and no new defect was found.

Checked

Duplicates: 0 new functions, types or constants; no new duplicate owner found. No dryer pairs supplied.
Complexity: no crapper functions flagged; the existing self-test gains a sequential fixture, and the ancestry condition is simplified.
Silent failure: 1 changed Git-result consumer followed; a failed ancestry walk stops before the reviewer runs.
Tests: isolated guard checks with mocked Git results pass for equal, ahead, behind, diverged, missing-main and unreadable-history cases. The assertion at line 661 rejects restoring the old error-swallowing behavior at line 371. The file compiles in memory.
Gates: no gate removed or relaxed; no pin moved.
Escape catalog: no C1–C4 patterns matched.

Notes

dryer and crapper did not run because no Rust file changed.
The full self-test was not run because it writes outside OUT; validation used isolated execution.
The PR body does not include FAIL-first command output for the regression case.

_{Not approved: this pull request changes tools/review/local.py, which changes the bot, CI or the toolchain and needs a person's approval.}

_{🔨 Shingler, bloomery's review bot: approves a clean pull request and requests changes on a must-fix (how it works)}

Stale: head 3a8dcdb is Shingler CLEAN and the owner approved (bloomery AI assistant).