[GH-ISSUE #66] Import historical source trees as reference-only evidence #52

New issue

Closed

opened 2026-10-15 18:20:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:20:32 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/66

Problem

Historical source can restore names, boundaries, comments, tests, and build context, but it is not current behavioral authority.

Outcome

Add import_reference_source and a historical-reference artifact graph without executing source.

Contract

Record root/per-file hashes, local VCS metadata, languages/manifests, source/test/config/generated/vendor classifications, module/import relationships, parse failures, exclusions, caller provenance, and authority fixed to historical reference.

Safety

Never execute hooks, builds, package managers, or source. Ignore VCS credentials, redact configured secret files, prevent symlink escape, and bound file and inventory sizes. Preserve inputs read-only.

Acceptance criteria

Import is deterministic and path-independent; every record is visibly historical; partial parses do not erase unrelated evidence; no workflow automatically promotes history to shipped observation.

Dependencies

Parent #35. Requires Evidence v2 authority and bundles.

Verification

Multi-language, Git/non-Git, symlink, unreadable/large file, generated/vendor, secret, relocation, modification, and malformed-manifest fixtures.

Non-goals

Building imported projects, assuming currency, mapping to current bundles, or recovering absent information.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/66 ## Problem Historical source can restore names, boundaries, comments, tests, and build context, but it is not current behavioral authority. ## Outcome Add `import_reference_source` and a historical-reference artifact graph without executing source. ## Contract Record root/per-file hashes, local VCS metadata, languages/manifests, source/test/config/generated/vendor classifications, module/import relationships, parse failures, exclusions, caller provenance, and authority fixed to historical reference. ## Safety Never execute hooks, builds, package managers, or source. Ignore VCS credentials, redact configured secret files, prevent symlink escape, and bound file and inventory sizes. Preserve inputs read-only. ## Acceptance criteria Import is deterministic and path-independent; every record is visibly historical; partial parses do not erase unrelated evidence; no workflow automatically promotes history to shipped observation. ## Dependencies Parent #35. Requires Evidence v2 authority and bundles. ## Verification Multi-language, Git/non-Git, symlink, unreadable/large file, generated/vendor, secret, relocation, modification, and malformed-manifest fixtures. ## Non-goals Building imported projects, assuming currency, mapping to current bundles, or recovering absent information.

bsakaguchi

2026-10-15 18:20:32 +00:00