OpenMind v2 Phase 7: Git Change Intelligence, Branch/PR Overlays and Evidence-Bound Impact Analysis

[HelloThisWorld]

Summary

Phase 7 adds an isolated, read-only Git Overlay plane: it projects a branch, pull request, commit-range or working-tree change onto a coherent snapshot of the canonical Base Workspace and reports evidence-cited impact — without ever mutating Git, contacting a remote, or writing a single canonical row.

Runtime 1.6.0-dev → 1.7.0-dev; migration head v0007 → v0008; .openmind stays 1.1.0; Knowledge Bundle stays 2.0.0-draft.2; new Change Impact Packet 1.0.0-draft.1.

What changed & why

openmind/git/ — the Git reader. One subprocess.run(shell=False) boundary with a read-only allow-list (rev-parse, diff, cat-file, merge-base, …); forbidden families (checkout/reset/merge/fetch/push/config/…) are denied before a process spawns. Refs are validated and resolved via --verify --end-of-options so a hostile value can never become a Git option; no command contacts a remote. Plus repository discovery (portable git:<rel> keys; absolute roots stay machine-local), coherent Git baselines, and diff/hunk/content extraction covering rename/copy/binary/symlink/submodule/Git-LFS.

openmind/overlays/ — the overlay plane. Overlay store/builder, bytes-based segmentation (reuses segment_source, no parser duplication), immutable oev_ before/after Evidence, composed Base+overlay search with masked superseded paths, a read-only GraphView port with CanonicalGraphView/OverlayGraphView, a graph-delta projector keyed on the exact canonical identity functions, Requirement/Test/Trace/Gap impact (reverse Base traceability revalidated against the virtual graph), Conflict impact (Phase 6 comparable-fact detectors over changed subjects only), deterministic rule-based risk (unknown never downgraded), a byte-deterministic Change Impact Report + Packet, and explicit post-merge reconciliation (never merges, never auto-promotes).

Migration v0008 — 13 additive tables. FKs cascade only within an overlay; none into any canonical table. delete_project extended to wipe overlay data.

Adapters — git/overlay/pr/impact CLI groups, 23 additive REST routes, 8 read-only MCP tools (43 → 51), and a standalone python -m openmind.impact_verify.

Isolation is the headline guarantee

Building an overlay changes zero canonical rows — assets/graph/trace/conflict tables and the Knowledge Revision ledger are provably untouched (measured drift: NONE). Overlay delete cascades only overlay data. Projected gaps/conflicts are never written to canonical tables; tests are recommended, never executed.

Testing

• New CORE suites: verify_git_security (38), verify_overlay_model (26, incl. measured zero canonical drift), verify_impact_packet (27), verify_overlay_adapters (41). Registered in run_acceptance.py, the CI Ubuntu gate, and a cross-platform overlay smoke.
• Updated the adapter/migration compatibility tests for the additive MCP tools and the v0008 head (they pinned 43 tools / v0007 / 1.6.0-dev).
• Full acceptance suite: 83 passed, 0 failed, 0 skipped (all tiers) — 79 Phase 1–6 (regression-free) + 4 Phase 7.

Reviewer notes

• All 43 existing MCP tools keep their names/args/behavior; the 8 new tools are read-only and provisional (docstrings say so). CI's MCP smoke now asserts 51.
• The overlay build runs synchronously in OverlayService (fully functional); the git_overlay_* job types are not yet wired to the worker.
• Requirement/Conflict impact depth is bounded by what the canonical graph records — on a minimal graph it correctly reports empty rather than inventing links. The mechanism is validated end-to-end; a richer requirement→code fixture for finer-grained impact assertions is noted as follow-up in docs/v2/phase-7-progress.md.
• No Git mutation, no remote contact, no provider call anywhere in the overlay build/impact path.

Design and full guarantees: docs/v2/phase-7-git-overlays.md.