[the-sarge]

Summary

CI range selection and consumer-floor checks were maintained in two places, and scheduled deep checks repeated preflight's core command sequence. This change gives each behavior one owner while preserving the callers' different failure/comparison policies and independent jobs.

Add 20 real-Git regression cases and a maintenance inventory for action pins, lint configuration, and inherited release/coverage settings. External consumers remain unconfirmed, so inherited config is retained.

Closes #133.

Validation

• All 20 shell cases pass before and after extraction; ShellCheck and Bash syntax pass.
• Actionlint passes; composite manifests parse and their run steps declare shells. Named action-pin families have equal SHAs.
• Preflight's existing execution order is preserved with the focused suite added; release-gate's execution plan is unchanged.
• Consumer-floor task check passes on Go 1.27.1 (go.mod declares 1.27; validation pin is 1.27.1).
• Release-gate, RAS review, final exact-head preflight, and post-ready CI receipts will be recorded in PR discussion before merge.

Current approved contract

Outcome: give repeated validation behavior one owner and make remaining configuration ownership explicit in one implementation PR. The user approved this plan on 2026-09-15.

Acceptance criteria (verbatim from issue #133)

• Share commit-range resolution while preserving classifier fallback versus docs-lane failure behavior, with focused shell cases.
• Reuse the consumer-floor behavior and shared deep-validation target without changing the portfolio-required independent CI job structure.
• Record repeated action-pin ownership/equality; establish external consumers before removing inherited release/coverage config. Preserve historical secret-scan fingerprints and avoid duplicating issue Evaluate validating workflow-to-Taskfile Task tokens in required CI #116 or the already-fixed Task pin.

Implementation and preservation requirements

• Extract one Bash range resolver used by the classifier and docs entrypoints. Preserve environment precedence, remote/local discovery, ref verification, explicit endpoint comparison by the classifier, and merge-base comparison by the docs lane. Preserve the classifier's unavailable/empty-range full-validation fallback and docs-lane failure, working-tree whitespace checks, and documentation-glob behavior.
• The 20 named shell cases discharge this bounded preservation obligation: explicit docs endpoints; explicit code endpoint overrides HEAD; explicit base overrides unavailable branch; remote main fallback; empty diff; invalid base; invalid head; unavailable branch; disconnected history; divergent endpoint versus merge-base policy; committed whitespace; custom documentation globs; working-tree whitespace; remote HEAD discovery; GitHub base overrides remote HEAD; explicit branch overrides GitHub base; custom remote; remote branch precedes local branch; local branch fallback; local main fallback without remote. These passed on the unmodified scripts before extraction and after extraction.
• Move consumer-floor setup, Go-owned version parsing, latest-patch setup, and local-toolchain tests into one composite action; retain both separate floor jobs and their checkout behavior. Cover the new action in Dependabot.
• Share the six deep-validation commands via task deep-check; preserve the preflight command sequence, additional secret scan and receipt, and release-gate behavior.
• Record pin equality groups and ownership, lint config/hash pairing, and inherited configuration status. Retain inherited release/coverage config while external consumers remain unconfirmed; preserve historical secret fingerprints and avoid implementing issue Evaluate validating workflow-to-Taskfile Task tokens in required CI #116.

Boundary, representation, and artifacts

Approved blast radius: validation scripts and their focused tests, Task orchestration, local composite actions, their deep/release workflow callers, Dependabot directory coverage, and maintenance documentation. Existing required ci.yml jobs, guards, permissions, triggers, tool versions, release tags, Go runtime code, dependencies, secret-scanning policy, and historical fingerprints are preserved.

The supported domain is the current CI environment interface and the named real-Git fixture cases. Git owns refs/history/diff representation; Go owns module parsing; Task and actionlint own their configuration semantics. The guarantee is example-level regression coverage, not exhaustive Git, Bash, YAML, or external-protocol conformance. Contract closure is not triggered: ordinary focused cases adequately bound the accepted refactor. No general scanner, workflow-to-Task validator, syntax enumeration, mutation campaign, timing/stress expansion, or platform cross-product is authorized.

Scripts, actions, Task targets, and tests are maintained verification aids. Their approved payoff is consistent validation across existing entrypoints; repository maintainers own them and retire helpers/tests when callers disappear or authoritative tooling replaces them. The range suite is approved as part of workflow-check, without a new required CI job. Inventory, contracts, and receipts are process metadata. No shipped runtime behavior or new required safety enforcement is introduced.

Finite evidence and review budget

Evidence: the 20 before/after shell cases; ShellCheck and Bash syntax; workflow validation; parsed composite manifests with explicit run shells; equality of named action-pin groups; Task execution-plan comparison; task check under the consumer Go floor; affected targets including release-gate; final task preflight at the exact pushed SHA under the validation Go pin; successful post-ready hosted required CI on that head. Go 1.27.1 currently satisfies both floor major/minor 1.27 and validation pin.

One fully briefed initial RAS review, accepted fix-now findings independently judged and verified, and at most one replacement review. Review findings are evidence, not authority. Adjacent issues, stronger unsupported input guarantees, and speculative evidence infrastructure are defer/reject rather than silently expanding scope. Stop for a boundary expansion, inability to preserve accepted behavior within this PR, or a second distinct semantic counterexample at the same precise invariant and enforcement owner. Chronology and receipts belong in PR comments rather than the normative contract.

After review and certification: make the draft ready, require successful ci-required and ci workflow on the certified head, and squash-merge that exact head. If main advances, update and repeat the prescribed gates. Only after product merge, complete the journal workflow, revalidate deferred findings against the merged code, and complete OmniFocus task pbItPLAkLXQ.

[the-sarge]

Initial review dispositions

RAS review 20260915T162625-3d27fb421879105d12af2684 completed with six successful R1 reviewers, six successful adjudicators, and a synthesis. It reviewed b3202e5acf188fa38a7e8e46692cae99dd6a6f61; RAS did not post automatically.

Cluster	Independent disposition	Evidence and boundary
C-005: docs merge-base fixture	fix-now, implemented	The approved named divergent case did not discriminate docs endpoint versus merge-base comparison. This is an obligation of the explicitly maintained example-level suite. Change the existing fixture's initial commit to contain inherited whitespace; its sibling fixes that whitespace and adds code. The same 20 cases now distinguish both callers: endpoint comparison reintroduces whitespace (status 2), while the docs lane's merge-base comparison passes; the classifier still sees the sibling code deletion. No production code change or new semantic family is required.
C-002: classifier failure diagnostics	defer, nonblocking polish	At scripts/ci/tests/range.sh, nonzero classifier exit already fails the suite through errexit; output mismatch already fails explicitly. Showing the case and stderr would improve diagnosis, but no acceptance criterion or named regression is unmet. This marginal aid improvement does not justify a tracked follow-up or extending this PR's evidence budget.
C-004: classifier diagnostics duplicate	reject as duplicate	Same assignment and invariant as C-002; its output-mismatch observation is included in that disposition.
C-003: disconnected fixture tightening	defer, optional example refinement	The case's classifier half exercises empty-diff fallback while its docs half establishes missing-merge-base failure. Other named cases establish explicit endpoint comparison. The accepted example-level contract does not require a second disconnected classifier example. No standalone follow-up is warranted.
C-001: sourced shell options	reject for this contract	Both supported callers already set the identical shell options. Hypothetical future/interactive callers are outside the approved domain; there is no current preservation regression.

The precise accepted invariant for C-005 is that the named divergent-case fixture discriminates the docs entrypoint's merge-base comparison. Its owner is that fixture arrangement in scripts/ci/tests/range.sh. No prior finding/fix exists at this invariant and owner, and the remaining claims concern different invariants or are outside scope; no repeated-root or approach stop applies. Contract closure remains untriggered for this bounded verification-aid change.

Validation after the fixture change: all 20 cases pass against both the pre-extraction scripts at 308408e and the current scripts; a direct Git countercheck on the same divergent fixture returns 2 for endpoint whitespace checking while the actual docs lane returns 0. ShellCheck, Bash syntax, and task workflow-check pass. Verification is requested only for the independently accepted C-005 obligation; C-002 may remain open in the verifier output without blocking completion.

[the-sarge]

Verification receipt

Verification of review 20260915T162625-3d27fb421879105d12af2684 completed at pushed head e946558b7e5762674b072626ec9faa7e8c887e4d, with prior-cluster coverage 5/5 and blocking projection clear.

C-005 is resolved. The verifier reproduced all 20 passing cases and confirmed that an endpoint-based docs comparison fails the revised divergent case (status 2 instead of 0). No new observations were reported.

C-001 through C-004 remain listed as open because their code was deliberately unchanged. Their independent dispositions remain applicable: hypothetical unsupported callers, optional diagnostics, optional disconnected-case refinement, and a duplicate. There is no unresolved fix-now or stop-for-decision item. The bounded replacement review is now running against the same head.

[the-sarge]

Final local certification and review receipt

• Candidate: e946558b7e5762674b072626ec9faa7e8c887e4d.
• Base: 308408e027173c6c7420c104c1dbaebe65380ea4.
• Worktree: /Volumes/worktrees/turn/ci-policy-133, branch codex/ci-policy-133, clean before and after certification.
• Final task preflight passed on Go 1.27.1: core formatting/vet/tests/lint, docs, race, module verification/tidy/vulnerability checks, Darwin/Windows cross-builds, actionlint and the 20 shell cases, and historical secret scanning. It printed the exact head/base above.
• task release-gate passed earlier, including all three 30-second proto fuzz runs. Later edits changed only the shell fixture; those changes passed the focused before/after suite, ShellCheck, Bash syntax, workflow-check, verification, and this final preflight.
• Replacement review 20260915T164103-87d0adcb87e098ab429f41d5 completed at this head with zero findings and no required fixes or follow-ups. Four R1 reviewers succeeded (codex-astra, codex-sol, cursor-kimik3, grok); claude-fable and claude-opus failed during process execution. The run met its configured minimum of two successful reviewers and produced a successful synthesis. These failures are recorded rather than counted as clean reviews.
• The accepted initial C-005 finding was verified resolved; all other initial observations retain their documented nonblocking dispositions. No unresolved fix-now or stop-for-decision remains. Both authorized fresh review rounds are complete.

The draft is being marked ready now. The earlier skipped draft check is not certification evidence; merge requires a successful post-ready ci workflow and ci-required job on this same head.