Branches, diffs, and review
Agent assistance is optional and follows a written plan; the learner owns permissions and verifies every diff and command result. If the selected agent is unavailable, the assisted portion is recorded blocked/unexecuted — never simulated.
Prerequisites
Day 13 project artifacts and basic Git status/log/diff.
Learning Objective
Create a disposable clone, make a focused branch change to the text project, and review the diff before committing.
Instructions
Required work: build the private base + clone exactly as the reference answer shows (copy ONLY projects/text_tools/{__init__.py,core.py,cli.py} into a new private base — never clone, publish, or mutate the learning repository or its .git, database, .venv, or secrets), then create branch parser-help, make the specified one-line --input help improvement, and record branch, status, log, staged + unstaged diffs, and git diff --check before a single focused commit. Prove behavior with the public --help check — a diff plus exit code 0 is evidence, not proof. Each block runs inside ( ... ) with set -e: it validates the fresh WORKDIR before any use and aborts inside the subshell on a failed mkdir/cp/cd, so a failed command can never fall through and run Git in your current repository - and exports stay out of your caller shell. d14env wraps external commands in env -i, dropping ambient GIT_DIR/GIT_WORK_TREE/index/object/alternates, GIT_CONFIG*, XDG, template, hook, and signing variables so they cannot steer THESE authored commands; env -i alone does not stop a command from writing outside WORKDIR - the validated preconditions and fail-stop are what keep the authored commands inside it. PATH only selects which executables run (resolved paths are printed; Python is pinned to the absolute PYTHON_BIN) - it is not a trusted-tool list or a filesystem boundary. Environment hygiene, NOT an OS sandbox. Export the printed WORKDIR value yourself - later activity blocks require it. Optional work: a real agent may review your diff against the written plan; if the selected tool is unavailable, record that portion blocked/unexecuted and never fabricate a transcript.
Practice and prediction
Predict exactly which line of projects/text_tools/cli.py changes for the --input help improvement and which of the three copied files must remain byte-identical (verify with sha256sum). Explain why git diff plus a zero exit code is evidence, not proof, of behavior — and why running through d14env (env -i + private HOME/XDG/config/template + signing off) matters when GIT_DIR could point at a different repository - and why ( set -e fail-stop plus the WORKDIR validation keeps a failed cd from ever running Git in the caller's repository. Run this complete private setup and check:
(
set -e
WORKDIR=$(mktemp -d)
[ -n "$WORKDIR" ] && [ -d "$WORKDIR" ] && [ -w "$WORKDIR" ] && [ -x "$WORKDIR" ] || {
echo "abort: WORKDIR '$WORKDIR' is missing or unusable - refusing to run anything outside it" >&2
exit 1
}
LEARN=/absolute/path/to/your/clone
[ -f "$LEARN/projects/text_tools/cli.py" ] || {
echo "abort: LEARN must point at a checkout containing projects/text_tools/cli.py" >&2
exit 1
}
export WORKDIR LEARN
mkdir -p "$WORKDIR/home" "$WORKDIR/xdg" "$WORKDIR/tpl" "$WORKDIR/tmp"
d14env() {
env -i PATH="$PATH" HOME="$WORKDIR/home" XDG_CONFIG_HOME="$WORKDIR/xdg" \
TMPDIR="$WORKDIR/tmp" WORKDIR="$WORKDIR" LEARN="$LEARN" \
GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null \
GIT_TEMPLATE_DIR="$WORKDIR/tpl" \
GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false \
LC_ALL=C PYTHONDONTWRITEBYTECODE=1 "$@"
}
command -v git sed python3
PYTHON_BIN="$(command -v python3)"
mkdir -p "$WORKDIR/base/projects/text_tools"
cp "$LEARN"/projects/text_tools/__init__.py "$LEARN"/projects/text_tools/core.py "$LEARN"/projects/text_tools/cli.py "$WORKDIR/base/projects/text_tools/"
cd "$WORKDIR/base"
d14env git init
d14env git config user.name "Learner"
d14env git config user.email "[email protected]"
d14env sha256sum projects/text_tools/*.py
d14env git add projects/
d14env git commit -m "text_tools snapshot"
d14env git clone "$WORKDIR/base" "$WORKDIR/clone"
cd "$WORKDIR/clone"
d14env git config user.name "Learner"
d14env git config user.email "[email protected]"
d14env git switch -c parser-help
d14env sed -i 's|corpus file\.|corpus file (UTF-8 by default; override with --encoding/--errors).|' projects/text_tools/cli.py
d14env git status --short
d14env git diff
d14env git diff --cached
d14env git diff --check
d14env git add projects/text_tools/cli.py
d14env git commit -m "cli: document --input decoding defaults"
d14env git log --oneline -3
d14env "$PYTHON_BIN" projects/text_tools/cli.py --help | grep -F "UTF-8 by default"
printf 'export WORKDIR=%s # run this before the later activity blocks\n' "$WORKDIR"
)
A git worktree is not an independent clone: it shares the base repository's refs and writes .git/worktrees metadata (verified). Clone the private base instead. Ambient GIT_DIR/GIT_WORK_TREE/GIT_CONFIG*/XDG variables can redirect git at a different repository or config — env -i drops them; it does NOT sandbox the filesystem. Never run reset --hard, clean, force-push, or recovery commands against the learning repository.
Verified observations (Linux, bash, git 2.56; your hashes/timestamps differ):
- sha256sum prints three hashes — the base identity; core.py and __init__.py stay byte-identical throughout.
- git status --short shows only M projects/text_tools/cli.py; git diff shows the single --input help line; git diff --cached is empty until git add.
- git log --oneline shows the focused commit on top of text_tools snapshot.
- The behavioral check: --help prints Path to the input text corpus file (UTF-8 by default; ... — public evidence the change took effect; the diff alone would only show text moved.
Boundaries: a git worktree shares the base's refs and mutates .git/worktrees — not an independent clone. Ambient Git environment variables were demonstrated hostile: with GIT_DIR/GIT_WORK_TREE aimed at an unrelated private repository plus a trap global config (foreign user.name, malicious template hooks), this exact block still configured only the private base/clone — the unrelated repository's HEAD and user.name were unchanged, no sentinel hook ran, and commits show Learner, not the trap identity. env -i keeps only the listed variables; PATH merely locates tools and grants no repository access — this is hygiene, not a filesystem sandbox. __pycache__/ may appear after running cli.py — untracked build output (PYTHONDONTWRITEBYTECODE=1 prevents it). Linux/bash scope; sed -i is GNU-style — macOS needs sed -i '', Windows differs (reference only, unexecuted).
Learning Project Submission & Evidence
Learner can explain branch, commit, diff, and review boundaries with command output attached — including the public --help check demonstrating the new help text — and states that optional agent review was executed, or honestly recorded as blocked/unexecuted.
Source resources and provenance
Pro Git, Second Edition
Relevant Section / Range: Chapter 3 (Git Branching: branches, basic merging and conflicts), Chapter 7.7 (Reset Demystified), Chapter 5.2 (Contributing to a Project)
Verified Version & Date: Second edition (Apress, 2014); verified 2026-10-30
Freely licensed reference for branching, merging, conflict resolution, and safe recovery vocabulary.
Basic git status/log/diff vocabulary from earlier study days
git help <command> and the Git manual pages ship with Git and cover the same commands offline; every required workflow is stated locally in the lesson.
Compared Candidate Sources & Selection Analysis (2)
Interactive but requires a GitHub account and an external service; disposable local repositories keep the exercise self-contained.
Vendor-owned prose with no permissive license; Pro Git covers the same ground under CC BY-NC-SA.