docs: record the next 30 GitPython dependent audits

Extend the prior 31-project audit with the next 30 declared GitPython
consumers ranked by the same September 2026 PyPI snapshot. Inspect another
5,500 package metadata records, download released sources or verified official
archives, and assign every dependent its own subagent task. Commit the release,
selection, command, editable-import, result and coverage evidence in a durable
Markdown report and JSON manifest; retain third-party sources, environments,
logs, XML and supplemental runners in the ignored audit cache.

The final selections record 1,172 upstream passes, 177 supplemental passes,
21 failures and six skips per backend. Distinguish real GitPython callers from
upstream mocks, pygit2, subprocess-only cases, isolated unchanged AST helpers,
closed-source binary helpers and unused dependency declarations. Four fixes
were committed separately: the managed `GitDB` selector alias, local tracking
resolution, revision root-tree/path diagnostics, and explicit literal-path
constructor compatibility.

Preserve five sbxloop compatibility failures absent with released GitPython
3.2.1: its `config_reader()` subclass override no longer controls native
repository discovery. Document the breaking constructor contract, observed
Git/Gix validation and missing GixPython include-suppression capability rather
than bypassing validation or rebuilding Git discovery in Python. Classify
other failures separately: Plato's unsafe-option omission, SDMX refresh logic,
ComfyUI test defects, sbxloop's eight fixed-PATH LFS fixture failures, inherited
submodule assertion, and bounded wrong-token LFS timeout. Read-only index
mapping mutation and automatic environment expansion remain unsupported.

Full GitPython suites pass after all four production fixes: CLI 1,825 passed,
162 skipped and one xfail; Gix 1,927 passed, 60 skipped and one xfail; each has
59 passing subtests. Supplying the cached official GixPython release wheel
resolves an earlier installation-test disk-quota failure. Focused regressions,
lint/format, relevant type/fixture checks and local review of the last two
fixes passed. Verify all 30 unique selections, retained archive hashes,
source/import proofs, manifest counts, report links and `git diff --check`.
Link both audit batches from the downstream README. No sources or test
expectations upstream were changed, and no push or PR is included.

Author: codex

doc/gix-backend.md

@@ -51,6 +51,24 @@ variables literal; `expand_vars=True` is unsupported. Callers wanting expansion
 must perform it before passing the path. Discovery still uses Gix/Git after
 ordinary input-path canonicalization.
 
+Repository construction validates storage and configuration through Gix/Git;
+overriding `Repo.config_reader()` does not replace that native discovery parser.
+sbxloop 2.1.36's `_MetadataRepo` subclass relied on the released constructor's
+permissive Python discovery and overridden no-includes reader. Five upstream
+tests still differ: malformed includes prevent opening, malformed local config
+is rejected before its custom `ProvisionError`, and version-0 repositories
+with version-1 storage extensions are rejected before its format check. Released
+GitPython 3.2.1 passes those five tests. This is a breaking subclass contract,
+not a demonstrated Gix-versus-Git mismatch: both backends reject the metadata.
+GixPython `OpenOptions` has strict/lossy configuration controls and overrides,
+but no supported option to open a repository while omitting its local include
+graph. A replacement must expose separately controlled metadata discovery and
+literal local configuration access with Git-compatible format validation.
+Do not bypass validation or reconstruct discovery/storage in Python to restore
+the old constructor. Downstream must construct its trusted metadata view before
+opening it with `Repo`, and handle native discovery errors explicitly; its
+original tests remain failed in the audit.
+
 `git.GitDB` and `git.db.GitDB` remain compatibility aliases for
 `GitCmdObjectDB`, so legacy `Repo(..., odbt=GitDB)` selectors use the same
 managed backend. Aider 0.86.2 uses that selector for every repository open.

doc/source/changes.rst

@@ -51,6 +51,12 @@ Git executable and safety
 API changes
 -----------
 
+* ``Repo`` construction validates repository configuration through Git/Gix.
+  A subclass override of ``config_reader()`` no longer controls discovery or
+  suppresses its include graph. Malformed configuration and invalid repository
+  extensions can fail before downstream custom validation runs. sbxloop's
+  metadata-reader subclass exposes this remaining compatibility break; callers
+  must prepare their trusted metadata view before opening it with ``Repo``.
 * Revision root trees such as ``Repo.rev_parse("HEAD:")`` retain their empty
   path and can be iterated. Missing paths within a valid tree revision retain
   ``Tree.join()``'s ``KeyError`` and missing-component message, restoring MCP

test/downstream/README.md

@@ -5,6 +5,12 @@ runtime, development and documentation users. Its [manifest](audit-2026-10-22.js
 records releases, source hashes, commands, results and coverage limits. The runner
 below automates five CI profiles; it is not the complete audit inventory.
 
+The [second 30-project batch](audit-2026-10-22-batch-2.md) brings the total to
+61 processed projects, with four further local fixes and explicitly retained
+compatibility, downstream and harness failures. Its
+[manifest](audit-2026-10-22-batch-2.json) records the next popularity-ranked
+selection and results on both backends.
+
 Run released projects' GitPython-related tests against this checkout with
 [uv](https://docs.astral.sh/uv/) and Git 2.52 or newer: