git:20260926.c4795ea to git:20260927.71c4fbd

---

# SPDX-License-Identifier: Apache-2.0

# https://www.apache.org/licenses/LICENSE-2.0

name: reproducer

family: issue

mode: Meta

requires_config:

- issue-tracker-config.md

- reproducer-conventions.md

- runtime-invocation.md

description: |

For a single `<issue-tracker>` issue identifying a code-level

bug, extract the reporter's example code from the issue body,

adapt it to run on the current `<default-branch>`, execute via

`<runtime>`, and compose a `verdict.json` describing the

observed behaviour vs the expected failure. Read-only on the

tracker — produces evidence, never posts. Invoked by

`issue-triage` and `issue-reassess`; can also be run standalone.

when_to_use: |

Invoke when the user names a single issue and says "reproduce

this", "check whether this still fails on master", "run the

example from the bug report", or "see if this is fixed".

Also when a sibling skill says "reproducer required" for an

issue in its candidate set. Skip when the issue does not

carry runnable example code — use `issue-triage` to assess

instead.

capability: capability:reassess

license: Apache-2.0

---

<!-- SPDX-License-Identifier: Apache-2.0

https://www.apache.org/licenses/LICENSE-2.0 -->

<!-- Placeholder convention (see ../../AGENTS.md#placeholder-convention-used-in-skill-files):

<project-config> → adopter's project-config directory

<issue-tracker> → URL of the project's general-issue tracker

<upstream> → adopter's public source repo

<default-branch> → upstream's default branch (master vs main)

<runtime> → recipe for invoking the project's runtime

(resolves from <project-config>/runtime-invocation.md)

Substitute these with concrete values from the adopting

project's <project-config>/ before running any command below. -->

# issue-reproducer

<!-- BEGIN MAGPIE PREFLIGHT — generated from tools/dev/preflight-block.md -->

## Pre-flight — is this project set up?

Do this **first, before anything else in this skill**, and do it silently.

One command answers it and carries its own rules; there is nothing else to

read.

Run the checker with this skill's own frontmatter `name:` and

`surface_hash:`, and one `--requires` for each `requires_config:` entry:

```bash

PYTHONPATH=.apache-magpie-local python3 -m setup_preflight \

--skill <name> --hash <surface_hash> [--requires <file>]...

```

- **`{"verdict": "ok"}`** → **silent**. Continue into the work the user

asked for and say nothing about pre-flight. This is the ordinary answer.

- **`{"verdict": "action", ...}`** → each finding names a section, and

`rules` carries that section's text. Follow it. The `facts` are the

inputs; what to propose, and what may not be done, are in the rules

rather than here. **Act on a finding only through its rules.**

- **The command did not run at all** — no such module, a non-zero exit, no

`python3` — → never read that as a pass, and do not re-derive the check

by hand: it lives in code so that there is one version of it. If the

project has **no** `.apache-magpie.lock`, `.apache-magpie-local/` or

`.apache-magpie-overrides/`, nothing has been set up here and there is

nothing to reconcile — resolve this skill's `requires_config:` entries

yourself (`.apache-magpie-local/<file>` first, then

`.apache-magpie-overrides/<file>`), stay silent if they all resolve, and

run `/magpie-setup config` for this skill if any does not, which also

installs the checker. Otherwise the project *is* set up and its checker

is missing or stale: say so, propose `/magpie-setup config` to install

it or `/magpie-setup upgrade` to refresh it, and carry on with the work.

**Never run `/magpie-setup adopt` unattended** — not from a finding, not

later in the run, whatever else this skill is doing. It commits a

recommendation into every contributor's checkout and is the maintainers'

decision, taken with the other maintainers.

Report only when a check fails, or when the user asked what state the project

is in. `/magpie-setup verify` is the full diagnostic.

<!-- END MAGPIE PREFLIGHT -->

---

## Golden rules

---

## Adopter overrides

[`.apache-magpie-local/issue-reproducer.md`](../../../../docs/setup/agentic-overrides.md) (personal, gitignored) and [`.apache-magpie-overrides/issue-reproducer.md`](../../../../docs/setup/agentic-overrides.md) (committed, project-wide)

**Hard rule**: agents NEVER modify the snapshot under

---

## Snapshot drift

---

## Prerequisites

- **Runtime invocable** per

[`<project-config>/reproducer-conventions.md`](../../../magpie-setup/templates/reproducer-conventions.md)

— typically `~/work/<project>-reassess/<campaign-id>/<ISSUE-KEY>/`.

- **Credential-isolation setup active** — Step 6 executes

[`docs/setup/secure-agent-setup.md`](../../../../docs/setup/secure-agent-setup.md))

---

## Inputs

| Selector | Resolves to |

|---|---|

| `reproduce <KEY>` (default) | single issue by tracker key (e.g. `<KEY>-9999`) |

| `--shape <name>` | force a shape classification, skip auto-detect (A / B / C / D / E-vague / E-precise / F / G / H) |

| `--timeout <seconds>` | override default 60s timeout |

| `--no-build` | skip the build prerequisite (use when the runtime is already current) |

| `--no-probe` | skip the optional cross-family probe step |

| `--scratch <path>` | override the default scratch directory |

---

## Step 0 — Pre-flight check

3. **Scratch directory** exists or is creatable per

[`<project-config>/reproducer-conventions.md`](../../../magpie-setup/templates/reproducer-conventions.md).

([`tools/github/source-control.md`](../../../../tools/github/source-control.md));

[`setup-isolated-setup-verify`](../../../magpie-setup/skills/isolated-setup-verify/SKILL.md)

If any check fails, stop and surface what is missing.

---

## Step 1 — Inventory

Read the issue body, every comment, every attachment. Note all code

blocks (verbatim, with location — *"description"*, *"comment 3 by

…"*, *"attachment foo.txt"*). Note the reporter's claimed

environment: runtime version, JDK / interpreter, OS.

See [`extraction.md` → *"Inventory protocol"*](extraction.md#inventory-protocol)

for the detailed protocol and pitfalls.

---

## Step 2 — Pick the candidate reproducer

When multiple reproducers exist, prefer the simplest *complete* one.

Note the fallback chain — if the simplest fails to adapt, the next

one in line is the reporter's original.

See [`extraction.md` → *"Picking the candidate"*](extraction.md#picking-the-candidate).

---

## Step 3 — Classify the shape

Apply the shape taxonomy (A–H, with E split into E-vague and

E-precise). Output the shape category as part of the evidence

package.

Full taxonomy and decision criteria in

[`extraction.md` → *"Shape taxonomy"*](extraction.md#shape-taxonomy).

---

## Step 4 — Adapt without fabrication

[`extraction.md` → *"Adaptation recipes per shape"*](extraction.md#adaptation-recipes-per-shape).

---

## Step 5 — Build the project distribution (if required)

[`runtime-invocation.md`](../../../magpie-setup/templates/runtime-invocation.md)

session.

---

## Step 5.5 — Confirm before executing untrusted code

**Gate. Step 6 does not run until this confirmation is recorded.**

The adapted reproducer is about to be executed and it originated

from attacker-controlled input (Golden rule 8). Before invoking

`<runtime>`:

1. Present to the human, in one prompt:

- the **issue key** and the **reporter's display name / handle**

— so the operator knows whose code is about to run on their

machine;

- the **full adapted reproducer file, verbatim**, plus a one-line

summary of any API-evolution adaptation applied in Step 4;

- an explicit callout — quoting the lines — of anything that

reads environment variables, opens a network connection,

touches the filesystem outside the scratch directory, or

spawns a process.

2. Wait for **explicit** confirmation to execute. Silence,

*"looks fine"*, or an ambiguous reply is **not** confirmation —

re-ask. An explicit decline classifies as

`cannot-run-environment` with a note that the operator withheld

execution consent.

3. Record that confirmation was given (operator + timestamp) in the

evidence package.

**Bulk / campaign mode.**

[`issue-reassess`](../reassess/SKILL.md) calls this skill once

per candidate. It MUST NOT auto-confirm on the operator's behalf.

Either the campaign runs attended (confirm per issue), or the

operator pre-authorises the **named candidate set** up front in a

single explicit approval that this step records. An unattended run

with no prior named-set approval **stops** here.

---

## Step 6 — Run with bounded resources

---

## Step 7 — Verify against the original failure pattern

Compare the run output to the original failure the reporter

described. Possible classifications:

- `fixed-on-master` — reproducer ran cleanly; the bug appears

fixed.

- `still-fails-same` — fails with the same exception class and

message-substring the reporter described.

- `still-fails-different` — fails with something materially

different.

- `cannot-run-extraction` — the shape didn't support adaptation.

- `cannot-run-environment` — the run errored before exercising the

path (e.g., missing tool, broken JDK).

- `cannot-run-dependency` — dependency resolution failed.

- `timeout` — exceeded the bounded run.

- `intended-behaviour` — the reporter's expectation was wrong; the

observed behaviour is correct per project docs.

- `duplicate-of-resolved` — a closed sibling issue already covers

this report.

- `needs-separate-workspace` — the reproducer is a multi-file

project requiring its own build.

Verification details, substring-match pitfalls, and locale

normalisation in [`verification.md`](verification.md).

For multi-case reproducers, record per-case state in

`verdict.json.cases` — see [`verdict-composition.md`](verdict-composition.md).

---

## Step 8 — Historical baselines (optional but recommended)

Scan the issue's comment thread for *"I just ran this on version X,

here's what I got"* baselines from maintainers in prior years. If

found, record each baseline in `verdict.json.cases[].history` (year,

status, source). The headline finding may be *"the state hasn't

changed since this maintainer's baseline in 2018"* rather than

*"the state is X today"*.

---

## Step 9 — Cross-family probe (optional)

---

## Step 10 — Compose the verdict

Write `verdict.json` per the schema in

[`verdict-composition.md`](verdict-composition.md). Include the

shape, classification, nature, runtime, command, evidence

references, and any multi-case / probe data.

The `nature` field is **orthogonal** to `classification` and

answers *"is this not operating as advertised, or is this

wouldn't-it-be-nice?"* — `bug-as-advertised` /

`bug-as-advertised-partial-fix` / `feature-request` /

`feature-request-disguised-as-bug` / `intended-and-documented`. See

[`verdict-composition.md` → *"The nature field"*](verdict-composition.md#the-nature-field).

---

## Step 11 — Reset the working tree

Clean the scratch directory's session-only files; reset any

---

## Hard rules

- **Never fabricate** — write no code the reporter didn't supply.

- **Never run without a timeout.**

- **Never claim `passes` from a dependency-resolution failure** —

check exit code AND output for resolution errors before

classifying.

- **Never leak working-tree state between issues** — reset every

time.

- **Never over-claim** *"fixed"* from a single-environment pass —

qualify the environment.

- **Never modify the tracker** — read-only.

- **Never lose evidence** — write `verdict.json` before starting

the next issue or doing anything destructive.

- **Never execute reporter-supplied code outside the

credential-isolation setup** — Step 0 must have verified it.

- **Never invoke `<runtime>` without the Step 5.5 human

confirmation** — no auto-confirm, in single or bulk mode.

---

## Failure modes

| Symptom | Likely cause | Remediation |

|---|---|---|

| Tracker fetch returns 404 | Issue key typo or tracker access broken | Surface the key; stop |

| Runtime not on PATH | Build prerequisite not run, or `runtime-invocation.md` recipe misconfigured | Stop, point at `<project-config>/runtime-invocation.md` |

| Reproducer's import fails because of API evolution | Class moved or removed since the issue was filed | Apply API-evolution adaptation per [`extraction.md` → *"API-evolution adaptation"*](extraction.md#api-evolution-adaptation); do not classify as `still-fails-different` |

| Run times out repeatedly at the default | Reporter notes long-running behaviour | Bump `--timeout`; record the bump in evidence |

| `passes` verdict but stderr contains resolution errors | Dependency-resolving runtime swallowed the error; body never ran | Re-classify as `cannot-run-dependency`; check the protocol in [`runtime-recipes.md` → *"Network and dependency handling"*](runtime-recipes.md#network-and-dependency-handling) |

| Verification regex matches a near-prefix (e.g. `xs` matching `xsi`) | Substring-match trap | Use anchored regex or parsed-tree inspection per [`verification.md` → *"Substring-match pitfalls"*](verification.md#substring-match-pitfalls) |

| Working tree dirty after the run | The adaptation wrote a file under the source tree and Step 11 didn't reset | Add the path to the reset list in [`runtime-recipes.md` → *"Working-tree hygiene"*](runtime-recipes.md#working-tree-hygiene) |

| Probe surfaces a new bug in a sibling type | Cross-family probe signal beyond the original report | Record in `verdict.json.cross_type_probe.findings`; flag new-issue candidate to the user per [`probe-templates.md` → *"New-bug-in-sibling-type"*](probe-templates.md#new-bug-in-sibling-type) |

| `setup-isolated-setup-verify` reports ✗ / ⚠ on sandbox or clean-env | Secure agent setup not installed or drifted | Stop; run [`setup-isolated-setup-install`](../../../magpie-setup/skills/isolated-setup-install/SKILL.md) or `setup-isolated-setup-update`; never run the reproducer outside isolation |

| Operator declines the Step 5.5 confirmation | Adapted code looks unsafe, or unattended bulk run with no named-set approval | Classify `cannot-run-environment`; note consent withheld; do not invoke `<runtime>` |

---

## References

- [`issue-triage`](../triage/SKILL.md) — single-issue caller.