fix(ci): a tag push runs the full workspace and pins its first parent as the base (Fixes #5172)

[noahgift]

Fixes #5172

The v0.71.0 tag push (CI run 38186659898, cc71bde) went red, and it ran no workspace test:

• Tier. scripts/ci_test_tier.sh printed tier=reuse. It cited the merge-queue result on the tagged commit.
• Base pin. The "Pin the event's base commit as origin/main" step in ci/sections.yml failed. A push that creates a ref carries before = 40 zeros: ::error::refinement base: push event carries no base sha (got "0000…0000"). That failed shards 1–3, workspace-test and gate.

Change

• scripts/ci_test_tier.sh.
  • A push whose GITHUB_REF is refs/tags/* gets tier=full. It never reuses a merge-queue result and never refines a diff.
  • The refusal line carries # R-TAGREF, so the mutation self-test covers it.
  • The self-test unsets an inherited GITHUB_REF. A new row asserts that a tag push prints exactly ONE tier= line and that it is full.
• ci/sections.yml base pin. A tag push pins the tagged commit's first parent as origin/main. It fetches that parent at depth 2 if the tier step's best-effort deepen missed it. A branch push with a zero before still fails loudly. Branch push, pull_request, merge_group and workflow_dispatch are unchanged.
• scripts/check_ci_push_reuse.sh. New rows T1–T3:
  • T1: tag push with a queue success → full.
  • T2: tag push with no queue result → full.
  • T3: a refs/heads/main push → still reuse.
  • tier() now unsets an inherited GITHUB_REF.

RED before, GREEN after

• RED (table with the new rows, on cc71bde's tier script): FAIL T1 a tag push with a merge_group success on its commit -> full, never reuse, FAIL T2 a tag push with no merge_group result -> full … (rows then labelled D10/D11). Result: check_ci_push_reuse: 3 assertion(s) FAILED.
• GREEN (head): check_ci_push_reuse: OK - push reuses only a merge-queue success on its own sha …, rc 0. --self-test: mutants 30/30 killed (incl. ci_test_tier.sh R-TAGREF). ci_test_tier.sh --self-test: 98 checks, 0 failed.
• Base-pin step, extracted from both versions and run in a depth-1 clone of a scratch repo. The tag push is GITHUB_REF=refs/tags/v9.9.9, before=zeros.
  • Old step: ::error::refinement base: push event carries no base sha rc=1.
  • New step: refinement base: push base <first parent> pinned as origin/main rc=0.
  • Controls on the new step:
    • Tag push with a non-zero before → first parent, rc=0.
    • Branch push with a zero before → the same error, rc=1.
    • Branch push with a real before → that sha, rc=0.

Gate change

This changes what CI runs on a tag push. C314 planted quorum, sonnet + haiku lanes (not the author's model): the plant was caught 2/2. The lanes found no defect in the logic beyond the plant. Their findings went into the second commit:

• The self-test row counts tier= lines.
• A tag push always uses the first parent.

A non-author sign-off bound to the final commit is still required.

keep-open: none
ont-delta: none not a sweep PR (CI tier script, its case table and one workflow section)

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5178 head=c9f2b14565ce8546c3b7dfd25d36487fe79a6f8d verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

APPROVE seat 1, aprender-a7n, c9f2b14

Non-author sign-off on the C314 receipt (handoff/quorum-w71e3a-5172-receipt.md, ACCEPT 2/2, plant caught 2/2), bound to the final commit c9f2b14. Author: w71-e3a; I did not write any of it.

Read at head (3 files):

• ci/sections.yml, push arm: on refs/tags/* the base is the tagged commit's first parent, fetched at depth 2 only if absent. If that fetch or rev-parse HEAD^1 fails, base is empty and the existing check below the case block (^[0-9a-f]{40}$, not all-zero) exits 1. Fail closed, no new state.
• scripts/ci_test_tier.sh decide(): a tag ref returns tier=full before any reuse logic (R-TAGREF). The self-test unsets GITHUB_REF so the ambient runner value cannot leak into the other rows, and its new row asserts exactly one tier=full line.
• scripts/check_ci_push_reuse.sh: tier() runs with -u GITHUB_REF and sets it only per row; T1 (tag + green merge_group → full, reason names the tag), T2 (tag, no merge_group → full), T3 (refs/heads/main still reuses) cover both directions.
• The change only moves tag pushes from reuse to full, which is stricter. No check is loosened, and there is no third state (C324).

Not run by me: the tier self-test and the push-reuse mutants (98/0 and 30/30 are the author's figures). Both scripts are under a run ban for my session; this seat is a read of the diff plus the receipt.

[noahgift]

Non-author gate-change sign-off, aprender-wprodmodels APPROVE @ c9f2b14

• Subject: tag push runs the full suite and pins its first parent as the refinement base
• Bound to head: c9f2b14 (merge-base cc71bde); diff sha256 b181ff6f440d3d94 (git diff merge-base..head, read 03:1xZ 2026-10-12)
• Author: aprender-w71-e3a (claude-opus-5-5). Signer: aprender-wprodmodels. Lanes never the author id: sonnet + haiku.
• Author receipt read: quorum-w71e3a-5172-receipt.md (ACCEPT 2/2, plant caught 2/2).

Round 1 (02:5xZ): VOID

Lane prompts named a diff path that did not exist; the sonnet lane reviewed the real diff and saw the plant file, the haiku lane read nothing. Not counted.

Round 2 (03:12Z), planted

• Plant (diff sha256 d212cb1518b5208a): in the sections.yml tag arm, base="$(git rev-parse ... 'HEAD^1^{commit}' ...)" became base="${base:-$(git rev-parse ... )}". With before=0000...0 (non-empty), base keeps the zero sha and the tag run fails exactly as #5172.
• sonnet: REJECT, blocking = the plant line, traced to the zero-sha validation exit 1. CAUGHT.
• haiku: REJECT, blocking = the plant line, same trace. CAUGHT.
• Plant caught 2/2. Shared non-blocking finding: no self-test row covers the sections.yml tag arm (only the tier script). Noted for a follow-up, not a block.

Signer's own checks on the real head

• Real tag arm assigns unconditionally; expansion trace (bash): real -> first parent, plant -> zero sha. Branch push with zero before still fails (case matches refs/tags/* only).
• check_ci_push_reuse.sh --self-test on c9f2b14 (worktree): rc=0, mutants 30/30 killed incl. ci_test_tier.sh R-TAGREF (log sha256 bb8134a06093d0b0).
• ci_test_tier.sh --self-test on c9f2b14: rows 1-81 ok incl. row 41 "push of a TAG (#5172) -> ONE tier line, full", 0 not-ok; run hit the signer's own 540 s timebox before finishing (log sha256 5290eae49ec77d9d). CI runs the full table.

Verdict

ACCEPT the real change at c9f2b14. Any new commit voids this sign-off.

[noahgift]

seat 2, aprender-df APPROVE @ c9f2b14

This is the non-author sign-off bound to this final commit for the gate change in #5172. The quorum round (2 lanes, non-author models) returned ACCEPT 2/2. Its findings were folded into this head, and its plant (dropping the early return) was caught by both lanes.

Read: the full diff (3 files).

• the CI test-level script (scripts/ci_test_.sh): the tag arm is inside the push branch only, so pull_request, merge_group and workflow_dispatch are unchanged. GITHUB_REF=refs/tags/ prints full with a reason naming the tag and returns before any merge_group reuse or diff refinement. The self-test unsets GITHUB_REF first, so a tag-push run cannot turn every push row full. The new row counts the test-level lines (expects exactly one), which kills a fall-through mutant that would print a second line.
• ci/sections.yml: a tag push takes its base from HEAD^1 (fetched at depth 2 only if missing), never from before. That is right for a created ref (zeros) and for a moved tag (old target). A branch push with a zero before still fails loudly; no new silent path.
• scripts/check_ci_push_reuse.sh: T1 (tag + queue success -> full, the reason names the tag), T2 (tag, no queue result -> full, not the docs-only result), and T3 (refs/heads/main + queue success -> reuse, control) are the right three rows. The env -u in the helper isolates the caller's ref.

Measured at this head, on a clean checkout verified equal to c9f2b14:

• bash scripts/check_ci_push_reuse.sh -> OK (D, T, W, A, P and X rows ok)
• bash scripts/check_ci_push_reuse.sh --self-test -> mutants 30/30 killed
• bash the CI test-level script (scripts/ci_test_*.sh) --self-test -> rows 1-44 all ok, including row 41 (the new tag row); the run was still in progress past row 44 when this was posted, so the remaining rows are covered by CI's own run, not by this seat.

CI at post time: shards 2 and 3 green, mg-reuse-self-test green; shard 1 and x86-main still running. This seat is the review only; arming stays with the slot owner.