ascmhl-debug verify does not honor root-anchored ignore patterns stored in a history

[grantsinger]

Summary

ascmhl-debug verify does not honor root-anchored ignore patterns such as /ignored.txt when they are loaded from an existing ASC-MHL history.

The same pattern is honored during ascmhl create, and directory-hash verification succeeds. Ordinary file verification instead reports the ignored file as an untracked new file. I discovered this while implementing ASC MHL generation in a DIT app I am currently developing. I hope this is helpful!

Environment

• ascmhl: 1.2
• ascmhl-debug: 1.2
• Python: 3.14
• macOS: 26.4.1
• Architecture: arm64

Minimal reproduction

mkdir -p /tmp/ascmhl-ignore-repro/root
touch /tmp/ascmhl-ignore-repro/root/payload.bin
touch /tmp/ascmhl-ignore-repro/root/ignored.txt

ascmhl create \
  -h xxh3 \
  -i '/ignored.txt' \
  /tmp/ascmhl-ignore-repro/root

ascmhl-debug verify /tmp/ascmhl-ignore-repro/root

The generated manifest correctly contains:

<ignore>
  <pattern>.DS_Store</pattern>
  <pattern>ascmhl</pattern>
  <pattern>ascmhl/</pattern>
  <pattern>/ignored.txt</pattern>
</ignore>

Actual result

ascmhl-debug verify exits with status 21:

found new file ignored.txt
Error: New files not referenced in the ASC MHL history have been found

Expected result

Verification should succeed because /ignored.txt is anchored to the root of the ASC-MHL history and was intentionally excluded when the generation was created.

Additional observation

Directory-hash verification honors the same pattern and succeeds:

ascmhl-debug verify -dh /tmp/ascmhl-ignore-repro/root

Suspected cause

verify_entire_folder constructs MHLIgnoreSpec directly and passes its
PathSpec to post_order_lexicographic:

ignore_spec = ignore.MHLIgnoreSpec(
    existing_history.latest_ignore_patterns(),
    ignore_list,
    ignore_spec_file,
)

for folder_path, children in post_order_lexicographic(
    root_path,
    ignore_spec.get_path_spec(),
):
    ...

post_order_lexicographic tests the pathspec against absolute filesystem paths:

file_path = os.path.join(top, name)

if ignore_pathspec and ignore_pathspec.match_file(file_path):
    ...

Consequently, the root-anchored pattern /ignored.txt is tested against a path
such as:

/tmp/ascmhl-ignore-repro/root/ignored.txt

and does not match.

Other code paths, including directory-hash verification, call get_ignore_spec_including_nested_ignores, which expands history-relative patterns before traversing absolute paths. That appears to explain why verify -dh succeeds while ordinary verify fails.

Suggested direction

Ordinary verification should normalize history-relative ignore patterns in the same way as creation and directory-hash verification, or traversal should consistently match paths relative to the applicable ASC-MHL history root.

Changing /ignored.txt to the unanchored pattern ignored.txt is not an equivalent workaround: it also ignores same-named files in nested directories.