feat(scope): prefix-equivalent match.includes → build.scope migration

[3leapsdave]

Summary

Bounded fail-closed migration of prefix-shaped build.match.includes (literal non-root prefix + terminal /**) into explicit build.scope prefix_list for durable index builds.

• Library (Experimental pkg/scope): PlanMatchPrefixMigration → versioned MigrationPlan; storage-free (ADR-0006)
• Identity: optional IdentityComputer injected by CLI adapter (indexstore.ComputeIndexSetID); not imported by pkg/scope
• LIST plan equality: legacy anchor + DerivePrefixes (parent subsumption) vs compiled prefix_list after base-key relativization
• CLI: gonimbus index migrate-match-scope — no provider/authority/markers; safe exclusive/force emit
• Docs: parallel cutover (new identity); non-prefix match controls remain open

Review remediations (exact-head follow-up)

Closes the five golf-devrev findings:

1. Storage-free boundary — no indexstore/sqlite in pkg/scope; dep regression test
2. Emit safety — refuse source/alias, no-follow symlinks, atomic temp publish, force 0600
3. Independent projection oracle — LIST reachability + keys/sizes/totals/digest (bare prefix key included)
4. Public surface — product language in tree; planning identifiers scrubbed from tracked content
5. Grammar — raw backslash separators/escapes refused before normalization

Out of scope

• Non-prefix match controls (excludes, suffix globs, filters, include_hidden)
• Canonical authority / whole-set GC paths
• Silent translation in normal index build durable path
• Lineage / synthetic parent edges
• Field dirty-binary proof (separate validation gate)

Test plan

• make check-all green
• go list deps: pkg/scope has no indexstore/sqlite
• Allow/deny grammar matrix including backslash separators
• Independent projection oracle with sizes/bytes/digest
• Emit exclusive / force / source-alias / symlink refusal tests
• golf-devrev re-review at new head
• Field dirty-binary conversion proof after hermetic GREEN

[3leapsdave]

Golf-devrev review at exact head e07fffc7c580619d6318efc007038633c1a74be3 — CHANGES

Hosted CI is green and focused race tests pass, but the following correctness/contract issues remain.

1. P1 — pkg/scope now violates the storage-free dependency boundary. pkg/scope/migrate.go:15 imports pkg/indexstore; go list -deps ./pkg/scope consequently pulls modernc.org/sqlite. ADR-0006 explicitly says storage-free object-access/compiler packages must not inherit index-store/workflow dependencies. Keep the scope classifier/compiler storage-free: move the identity-enabled workflow to an appropriate storageful Experimental package, inject the identity calculator, or extract a pure identity package. Add a dependency-boundary regression so this cannot recur.

2. P1 — forced manifest emission is neither source-preserving nor safely owner-only. internal/cmd/index_migrate_match_scope.go:116-146 switches to O_TRUNC under --force. Passing the source path (or an alias) as --emit-manifest rewrites it in place despite the command promise; a symlink destination is followed; an existing permissive mode remains permissive because 0600 only applies at creation; write/sync/close failure can leave a partial file. Refuse source/destination identity, use a regular/no-follow destination policy plus same-directory atomic replacement for force, enforce the final 0600 mode, and cover direct path, hard-link/symlink alias, existing-mode, and failure cleanup cases.

3. P1 — the required independent row/byte equivalence proof is not present. pkg/scope/migrate_test.go:351-437 compares key-only helpers that both reuse the converter-owned anchorIncludePatterns; the legacy helper does not model LIST reachability, and the fixture omits sizes/total bytes. The bare-prefix test explicitly documents a projection difference instead of proving equality on one population. Add an independent legacy-vs-proposed execution/oracle tied to the actual build semantics (not converter helpers): same fake provider population and LIST plan, exact relative keys, per-row sizes, row count, total object bytes, and stable projection digest. Include the bare prefix key in the common population and let both real LIST paths exclude it.

4. P1 — public-surface hygiene is not met. Internal planning/coordination identifiers appear in tracked code/docs, the branch, PR title/body, and commit metadata. Remove them from the tree and rewrite the public Git surfaces to product-only terminology before merge, per the org-root public-surface policy.

5. P2 — the accepted grammar admits raw backslash separators. parseConvertibleInclude normalizes before checking forbidden characters, so a value such as cohort\day/** becomes cohort/day/** and is accepted even though the documented grammar excludes backslash/escape syntax. Reject forbidden syntax on the raw trimmed input before normalization and add both unescaped-separator and escaped-metacharacter negatives.

Validation performed: focused migration tests passed under -race (internal/cmd count=5; pkg/scope count=10); git diff --check passed; hosted checks are green. A broader local internal/cmd race run hit only sandbox HOME/data-root doctor failures, not feature failures.

GitHub rejected a formal request-changes review because the authenticated maintainer account is treated as the PR author, so this comment records the CHANGES disposition.

— agent-golf-devrev

[3leapsdave]

Superseded by #156 with a product-safe branch name and single-commit history. Prefer the new PR for review.