I3017 — Discovering the repository outside the model is refused
A test scans the crate's sources and refuses a Repository::discover or Repository::open outside repository.rs and the owners it names, each with its reason, naming the file and line; a second test refuses an owner entry whose call went away. The discovery's cost budget belongs to I1107 (its cost is known), which needs a bench target for discovery that does not exist yet.
BLOCKED wave 2 · p0 · implementation profile · parallel safe
Blocked. This issue cannot start until I3015, I3016 are done. The status is derived from that, not declared.
Objective
A test scans the crate's sources and refuses a Repository::discover or Repository::open outside repository.rs and the owners it names, each with its reason, naming the file and line; a second test refuses an owner entry whose call went away. The discovery's cost budget belongs to I1107 (its cost is known), which needs a bench target for discovery that does not exist yet.
Why
The last slice of I1105, its fourth acceptance criterion (no consumer reads the filesystem for a fact the model carries, proved by a check rather than by review) and the risk it names (the model's cost is measured in the same issue that makes it mandatory). Without the check the next capability re-opens the repository and nobody notices.
Current state
Nothing refuses a new discovery; App::load's budget is named in prose (plan.rs) but no number is declared.
Desired state
A discovery outside the model fails a test that names the file, the line and how to ask the context instead.
Scope
- apps/majordomus-cli/tests
Out of scope
- Discovery of facts the model does not carry yet (I1106, I1107)
Dependencies
- I3015BLOCKED serve and mcp discover the repository once, through the shared model
- I3016BLOCKED A capability reads the repository from its context, never by opening it again
What waits on this
Acceptance criteria
- A source scan test fails on a Repository::discover or Repository::open outside the allowed files, naming file and line
- An owner named in the list whose call went away fails the test, so the list cannot hold a stale entry
Validation
- cargo test --workspace --all-features
Evidence required
- discovery_guard_test
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I3017.yaml. Read it back with majordomus plan show I3017.