On this page
Freeze the superproject commit and tree
Record the repository identity, exact commit ID, tree ID if available, branch or tag reference, export command, archive digest, and whether the working tree was clean. A folder listing is not a Git tree. Keep tracked files, ignored files, generated files, and untracked files in separate sets so the handoff does not imply that an uncommitted working copy is part of the commit.
The source dates in this guide use 22 October 2026 as retrieval evidence for documentation without a verified publication date. They are not publication claims. Where a verified publication date is available, it is recorded in the source ledger.
| Tree evidence | Record | Stop if |
|---|---|---|
| Commit | Exact object ID and ref used | A moving branch is the only identity |
| Tree | Tree path and mode per entry | An export omits a path without explanation |
| Working tree | Clean, modified, or unknown | Local edits are mixed into the packet |
| Attributes | Relevant .gitattributes at commit | LFS rules come from a local override |
| Ignore rules | Tracked versus ignored state | Ignored files are treated as committed |
| Export digest | Digest and byte scope | Archive is compared by filename only |
Use a synthetic repository fixture for a public worksheet. Do not include real source code, private URLs, credentials, or developer names. A commit ID proves which Git object was selected; it does not prove that every external object is available.
Resolve every submodule gitlink recursively
The Git Documentation, (opens in a new tab) page says the superproject tracks a submodule through a gitlink and .gitmodules path mapping. Record submodule path, expected commit ID, URL hint, initialized state, checked out commit, nested submodules, and whether the expected commit is reachable from the supplied repository. The working directory contents cannot replace the gitlink evidence.
| Submodule field | Record | Hold when |
|---|---|---|
| Path mapping | Superproject path and .gitmodules name | Two names resolve to one path |
| Expected commit | Gitlink object ID in the tree | Only the current branch is recorded |
| Checked out commit | Observed HEAD and status marker | It differs from the gitlink |
| Remote hint | URL from .gitmodules, not proof of access | URL is missing or rewritten |
| Nested status | Recursive status for descendants | Nested repositories are skipped |
| Reachability | Commit exists in the supplied object set | Clone depth hides the commit |
The Git Documentation, (opens in a new tab) documentation describes recursive status and mismatch markers. Keep a missing clone, an uninitialized submodule, a checked out wrong commit, and a dirty submodule as different findings. Do not run commands against an untrusted repository without a controlled environment policy.
Match LFS pointers to hydrated content
The Git LFS, (opens in a new tab) describes a pointer as UTF-8 key and value lines with version first, sorted keys, an OID using a hash method, and a byte size. Record the pointer blob, path, version, OID, declared size, filter rule, hydrated file digest, and observed size. A pointer file in an archive is evidence of an LFS reference, not the large file itself.
| LFS evidence | Supports | Cannot prove |
|---|---|---|
| Pointer version | Parser format identifier | Object availability |
| OID | Content identity reference | That the local file matches it |
| Size | Declared content size in bytes | That the export contains those bytes |
| Filter rule | Path expected to use LFS | That every matching path was hydrated |
| Hydrated digest | Observed local content identity | Server-side access rights |
| Pointer extension | Extra metadata to preserve | Meaning of an unknown extension |
Synthetic LFS ledger
{"path":"assets/fixture.bin","pointer":{"version":"https://git-lfs.github.com/spec/v1","oid":"sha256:fixture-digest","size":"fixture-bytes"},"hydrated":{"state":"not-tested","digest":"not-recorded","size":"not-recorded"},"decision":"hold"}Reconcile export layers without inflating completeness
Compare the Git tree path set, submodule path set, LFS pointer path set, hydrated content path set, and archive path set. Record exclusions and the command or tool that produced each set. A matching file count is not enough: one missing submodule commit or one unhydrated pointer can change the usable export while the archive still opens.
| Comparison | Record | Open question |
|---|---|---|
| Tree to archive | Missing and extra tracked paths | Were submodule entries expanded or left as gitlinks? |
| Gitlink to checkout | Expected and observed commits | Was the exact commit fetched? |
| Pointer to content | OID and size comparison | Was content hydrated or copied as a pointer? |
| Nested traversal | Submodule descendants and LFS paths | Did a shallow boundary hide objects? |
| Attributes to paths | Rule matches at commit | Did export tooling honor filters? |
| Reproducibility | Command, version, and digests | Can a reviewer recreate the same packet? |
Stop when an external object is unresolved
Stop conditions
- Stop if the superproject commit, tree, attributes, or export digest is not fixed.
- Stop if a gitlink commit differs from the checked out submodule or nested status is unknown.
- Stop if an LFS pointer lacks a matching hydrated object, digest, or declared size comparison.
- Stop if archive tooling expands or omits submodules without an explicit record.
- Stop if shallow history, unavailable remotes, or filters make object reachability unknown.
- Stop before sharing real code or binary content when the report has not been redacted.
Pair this worksheet with the data provenance log for repository and export history and the data card template for collection context. A complete object map does not prove ownership, privacy clearance, or permission.
For a supported non-health collection, after the owner has authority to describe the scope and a controlled metadata packet, the qualified code appraisal request path may be a preparation step. It does not clone repositories, fetch LFS objects, review source code, create a quote, match a buyer, or grant a license.