[ticket-088] fix(ci): validate the GitHub event commit range

.github/workflows/ci.yml

@@ -49,6 +49,8 @@ jobs:
           python -m pip install -e ".[dev]"
 
       - name: Run tests
+        env:
+          WELLMANIFEST_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           python -m pytest tests/ -v --tb=short
 

project/ticket-088/README.md

@@ -0,0 +1,20 @@
+# Ticket 088: Bind CI governance to the pushed commit range
+
+- **ID**: ticket-088
+- **Owner**: codex
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-09-06
+
+## Authorization and diagnosis
+
+SESSION_EXECUTION_AUTHORIZATION: continue repairs and publish all changes. Main CI run 34028157956 fails before collecting tests with GOV-SYNC-001, including on retry. Without a PR event base, the pytest plugin compares HEAD to origin/main (the same SHA), so no changed ticket restricts historical adoption records. The PR suite passed because its event included a real base SHA.
+
+## Acceptance criteria
+
+- [x] AC-01: PR and push CI use the event's real base through the existing plugin interface, preserving all governance and test gates.
+- [ ] AC-02: Exact-head protected review merges the workflow repair and main CI succeeds.
+
+## Validation
+
+The existing plugin honors the explicit push base and identifies the delivered ticket. Local managed governance and Docker Compose configuration pass. Full tests and exact-head CI validate this unchanged suite; post-merge CI is the acceptance readback.

project/ticket-088/intent.json

@@ -0,0 +1,77 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-088",
+  "summary": "Bind CI governance validation to the actual pushed commit range",
+  "workstream": "infrastructure",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "regression"
+  },
+  "allowedPaths": [
+    ".github/workflows/ci.yml",
+    "project/ticket-088/**"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [
+    "python",
+    "docker"
+  ],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "64d230b2526fec5c90f4c1a842923e37dd56789c",
+    "targetBranch": "main",
+    "outcome": "Publish CI that passes the actual GitHub push before SHA or PR base SHA to the existing governance pytest gate.",
+    "nonGoals": [
+      "Managed standard implementation changes",
+      "Ticket closure projections",
+      "Package version changes"
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Use the existing WELLMANIFEST_BASE_SHA interface to bind validation to the event commit range.",
+      "components": [
+        {
+          "name": "ci-governance-range",
+          "paths": [
+            ".github/workflows/ci.yml"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert the workflow environment binding."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "Verify GitHub expression and existing plugin base selection",
+          "python -m pytest tests/ -v --tb=short",
+          "./project/governance-check.sh --actor agent",
+          "docker compose config --quiet"
+        ],
+        "evidence": "CI before/after immutable run evidence."
+      }
+    ]
+  }
+}