fix(ci): run exact-head gates on stacked pull requests

[seonghobae]

Current authoritative state

The stacked-PR/exact-checkout CI evidence defects and bounded browser-evidence timeout defect are repaired on canonical single-writer Ready PR #299 / branch fix/stacked-pr-ci-gates-298. Protected shipped truth remains exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact #299 head is 1efbd632719b0e54c5a33e3a95224a4bd2f869d3, mechanically mergeable against that unchanged protected base. The effective Inkspan delta remains only .github/workflows/ci.yml plus src/workflowExactHead.test.ts; do not create a competing CI writer.

Repaired Inkspan-owned evidence defects

1. Canonical CI restricted pull_request to base main, leaving stacked PR heads without the ordinary repository matrix.
2. Contributor-head checkout lacked an immediate runtime equality proof before setup/repository-code consumption.
3. Browser evidence had the same 30-minute ceiling as ordinary jobs even though dependency-locked playwright install --with-deps can consume that budget during infrastructure/package-mirror latency.
4. The predecessor contract test relied on global string counts, so job-local timeout or exact-checkout verification order could move and false-green.

Historical TDD lineage: stacked-trigger RED e75a0035d753d8d58a9c04a8c254bf8914135e24 -> trigger repair 3ea55387d8d7d88a80933b398abda78e42a4496b; runtime-checkout RED 85572a50d79a11c27c9171cc9180d7a53128bea0 -> exact checkout attestation; browser-timeout RED a74e150c06c22e3caee48446d03c3b0726bfc0f5 -> browser-only 60-minute ceiling while build/Office stay at 30.

After #299 moved Ready, CodeRabbit identified the fourth, still-valid false-green weakness on predecessor b7e9bb8156a3e46204523ab37292566811f560f8. Current 1efbd632719b0e54c5a33e3a95224a4bd2f869d3 slices the three repository workflow jobs independently, binds each timeout and checkout contract to its own job, requires exact-head verification immediately after checkout and before pnpm/setup-python consumers, and checks the pull_request YAML trigger structurally without a base-branch filter. CodeRabbit marks that Major thread addressed/resolved.

A later Devin informational observation correctly notes that the repository runtime check compares local HEAD with the same immutable event SHA supplied to checkout. That proves checkout honored the event-bound ref; independent live PR/base resolution remains the separate governance/review step before lifecycle mutation and is not silently claimed by the job assertion.

Exact-current-head evidence

For unchanged exact #299 head 1efbd632719b0e54c5a33e3a95224a4bd2f869d3:

• repository CI 32635939468: completed / success;
• build-and-test 97185600342: success, including exact source-head checkout verification, typecheck, exact 100% owned-production coverage, library build, packed-package verification, and demo build;
• browser 97185600177: success, including exact source-head checkout verification, Playwright dependency/revision installation, and real cross-engine evidence inside the bounded 60-minute ceiling;
• Office Python 3.11 97185600282, 3.12 97185600292, 3.13 97185600341, 3.14 97185600286: success with exact source-head checkout verification, dependency consistency, 100% docstring/branch coverage, wheel, and packaged schema/license gates;
• central Security Scan 32635939483: GitHub aggregate status is success, but this is non-passing / false-green supply-chain evidence. Dependency-review job 97185600223 checked out synthetic merge 12668622e38473c14dbb7d22bb9e3e0c05f1ea8a; its exact 3b38ead2d00f44eb578d0689087b9293b3dabe1e...1efbd632719b0e54c5a33e3a95224a4bd2f869d3 support probe returned HTTP 403, emitted Dependency review is unavailable for ContextualWisdomLab/inkspan; skipping dependency-review hard gate., wrote supported=false, skipped the pinned dependency-review action, and still concluded green. Foreign owner: ContextualWisdomLab/.github#810, active repair PR #897;
• central SAST Semgrep 32635939469: GitHub aggregate status is success and the scan reported no findings, but exact-source evidence is non-passing because job 97185600190 checked out synthetic merge 12668622e38473c14dbb7d22bb9e3e0c05f1ea8a rather than source head 1efbd632719b0e54c5a33e3a95224a4bd2f869d3. Foreign exact-submitted-revision owner: ContextualWisdomLab/.github#1222, active repair PR #941;
• formal submitted reviews: automated COMMENTED reviews and maintainer thread replies only, qualifying approvals 0;
• unresolved inline review threads: 0; the three Devin informational observations were verified against this exact head, answered with their intended scope, and resolved without treating them as approval;
• PR lifecycle: Ready / unmerged; GitHub reports mechanically mergeable.

The repository-local #299 CI repair is technically green, but the complete required evidence set is not. A green aggregate central status cannot substitute for a skipped hard gate or a wrong checkout SHA. OSV/Trivy/Scorecard success is not a semantic substitute for the skipped dependency-review action. Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, status-only, model-only, wrong-checkout, or synthetic-merge evidence is non-passing.

Foreign owner acceptance and downstream boundary

There is no correct Inkspan-local source workaround for the central dependency-review capability path or the central synthetic-merge checkout. The existing foreign owners have been advanced with the exact affected Inkspan SHAs/runs/jobs; do not add a leaf workaround or create duplicate central writers.

Before #299 can be treated as merge-ready under the evidence contract, the corresponding central repairs must reach protected .github/main, then unchanged or descendant #299 must acquire fresh central evidence that proves:

• dependency-review support comparison returns a transport-successful HTTP 200, the pinned dependency-review action actually executes and succeeds, and no supported=false/skip path is taken;
• central Security/SAST jobs bind and attest the exact Inkspan source head/repository identity before repository-code consumption/scanning rather than relying on refs/pull/*/merge checkout evidence.

After #299 eventually integrates, every stacked PR must independently acquire its own exact-current-head repository workflow generation; parent/predecessor evidence cannot substitute. The 60-minute browser bound is a finite infrastructure allowance, not permission to make browser evidence optional or unbounded.

The repair is active-PR truth only. Keep #299 Ready but unmerged while these central exact-evidence blockers and every then-live governance requirement remain unresolved. Before merge, refetch unchanged exact head/live protected base, ancestry/mergeability, live governance, formal reviews/threads, and every applicable repository/central workflow. Do not self-approve, transfer predecessor evidence, weaken gates, move protected main, or fabricate release identity.

[seonghobae]

Fresh stacked-consumer reproduction for the existing #298/#299 owner path (2026-08-20 UTC):

• Draft test(diagnostics): add hostile-input and browser assurance #285 remains stacked on feat/writing-diagnostics-package@cb49b1a6d646b5ba15f6aa88e568adf323fe05fc; current exact head is 599d2eb86bf60750a26dcfa6b0d69facc1588cc4.
• That head contains the release-workflow RED→GREEN repair f9ab67c... → 599d2eb...: src/releaseWorkflowSyntax.test.ts now requires a finite 60-minute browser-release-evidence ceiling, and .github/workflows/release.yml changes the same Playwright/system-dependency job from 30 to 60 minutes after the real docs(adr): define revision-bound host-owned writing diagnostics #248/job 95570983695 mirror-latency reproduction already captured here.
• The current exact-head PR-workflow query for 599d2eb... returns zero pull-request workflow generations, while combined status exposes CodeRabbit only. This is therefore a second concrete consumer of the protected-main stacked-base trigger defect; predecessor test(diagnostics): add hostile-input and browser assurance #285 workflow evidence must not be transferred.
• Canonical CI repair fix(ci): run exact-head gates on stacked pull requests #299 is still unchanged exact head b7e9bb8156a3e46204523ab37292566811f560f8, base main@3b38ead2d00f44eb578d0689087b9293b3dabe1e, Draft, mechanically mergeable, and retains the two-file ownership boundary (.github/workflows/ci.yml, src/workflowExactHead.test.ts). Its exact-head CI/Security/SAST GREEN evidence remains the owner proof.

Acceptance remains unchanged: after #299 eventually integrates under #118/live review governance, #285 and every other stacked PR must independently acquire a fresh exact-current-head repository workflow generation; no parent/predecessor/status/model evidence may substitute. Do not patch #285 CI triggers locally or create a competing CI writer.

[seonghobae]

Fresh stacked-consumer reproduction on the existing #298/#299 owner path:

• Draft test(input): add multilingual browser input baseline #380 is unchanged at exact child head 4d8ee51012a650fbafa0e6188173c4ca328b416e, stacked on canonical parent/base fix/atomic-controlled-sync-200@343d4132574f4cb20eb561928df034154609bab7 (fix(data-integrity): keep controlled value sync atomic #201), and GitHub reports it mechanically mergeable.
• The exact-current-head workflow query for 4d8ee51012a650fbafa0e6188173c4ca328b416e returns zero repository workflow generations. Parent/predecessor workflow evidence is therefore non-transferable and this head has no passing CI/Security/SAST evidence.
• The child-owned delta remains test/harness-only; patching CI triggers in test(input): add multilingual browser input baseline #380 would create a competing workflow writer rather than repair the causal boundary.
• Canonical CI owner fix(ci): run exact-head gates on stacked pull requests #299 is unchanged at exact head b7e9bb8156a3e46204523ab37292566811f560f8 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e, Draft and mechanically mergeable, with the ownership boundary still limited to .github/workflows/ci.yml and src/workflowExactHead.test.ts.

RCA remains falsifiable and unchanged: protected-main CI currently scopes PR execution such that stacked child heads can receive no repository generation; #299 removes that base restriction and independently attests the checked-out exact head. After #299 integrates under #118/live governance, #380 must itself acquire fresh exact-head CI, Security Scan, and SAST generations before any downstream evidence is accepted. No child-local trigger patch, retry of a nonexistent run, or predecessor/parent/status/model evidence should substitute.