Refuse a tag that is not on main or whose CI did not pass

[MongLong0214]

Correction lane for the v0.7.1 promotion FAIL. Stacked on #495.

The section-4 job (#495) made the installation a prerequisite. The review found the gap that left: the workflow accepts every v* tag. Nothing asked whether the tagged commit is on the release branch, and nothing asked whether CI passed at that exact commit. Tagging any dev commit published it; tagging a commit whose CI failed published that.

Two scripts rather than two if: expressions, because a condition in YAML cannot be tested and these are the conditions that decide whether a wrong artefact reaches users.

The CI gate asks whether the required checks passed, not whether any failure is visible. Everything that is not a success refuses — failure, cancelled, timed out, skipped, queued, still running, and a required check absent from the response entirely. An empty result set is a refusal rather than a quiet pass; that inversion is the defect this repository has now published twice.

The ancestry gate refuses when it cannot see enough history to answer, so a shallow checkout produces a refusal rather than an accident.

publish waits on all four jobs and has no if:. An omitted dependency is itself a bypass — nothing can withhold a release for a job it was never asked to wait for — so the test asserts the complete set, not just the absence of an escape hatch.

Evidence

Both scripts were driven directly, not only through the suite:

case	result
six required checks all success	accept
failure / cancelled / timed_out / skipped / in_progress	refuse
a required check absent, and an empty payload	refuse
successes recorded for a different commit	refuse
tag on main / tag on a side branch	accept / refuse
shallow clone that cannot answer	refuse

15 cases pass. The six required check names were also compared against a real CI run on main: exact match, so the gate cannot deadlock the release it guards.

[github-actions]

CommitLore — record lint

Trailers: clean — 2 commits in origin/dev..8ffb31c7375a2bb7df6dd4ce96084dda1a033916
Active constraints: 4 limits · 12 ruled-out · 6 warnings — from 8 records over 5 changed paths

Active constraints for the paths this PR touches

Limits (4)

• r-pubprereq 8ffb31c — the gates qualify the commit and its CI, not the tag's authorship or timing -- anyone who can push a v* tag to a qualified commit on main can still publish, and expiring or re-pointing a tag after these jobs pass is outside what any of them observe
• r-failclosed493 3216a54 — the job runs on ubuntu-latest only, so it qualifies the POSIX install; the Windows path is still covered by install-ps1 in CI against the branch rather than against the tag
• r-plugres483 7dab3e3 — the gate now catches the mismatch at release time, and doctor's inject-version check catches it for a user, but nothing tells a user who has never run doctor
• r-exit065 e545dee — any new command's exit codes must be drawn from SPEC §10, not invented locally

Ruled out (12)

• r-pubprereq 8ffb31c — expressing either check as an if: on publish | a condition in YAML has no test, and a release gate whose logic cannot fail in a suite is a claim rather than a control
• r-pubprereq 8ffb31c — treating a missing required check as nothing to report | that is the empty-set inversion above, and it is exactly how a release with no CI at all would have published
• r-failclosed493 3216a54 — reusing the workflow's checkout instead of cloning | the row asks whether a fresh clone works, and a checkout is not the thing users get
• r-failclosed493 3216a54 — making the stale-hook row non-blocking because its fixture also fails another check | the confounding finding is separable by reading the row, and a row excused for being awkward is the fail-open being repaired
• r-plugres483 7dab3e3 — preferring CLAUDE_PLUGIN_ROOT over PATH | it reopens how ADR-0011's ship-dist-in-the-repo interacts with the installer's wrapper, and the node-resolution advantage that motivated the current order would need re-examining rather than reversing
• r-plugres483 7dab3e3 — comparing versions inside the run script | it sits on the hot path of every edit and would spend a second process launch there to report a condition doctor already reports
• r-nobin284 ab2f08f — Keeping the binary classification arm for the installer's wrapper | the wrapper is a shell script that execs node, so trusting it by name would re-admit any extensionless executable called commitlore while the bundle it runs is the thing with an interpreter to check
• r-nobin284 ab2f08f — Relaxing the dogfood Evidence check to allow a missing path | it exists to catch a citation nobody can follow, and dropping the check to accommodate a deletion would retire the guarantee instead of correcting the question it asked
• r-nobin284 ab2f08f — Leaving src/core/paths.ts alone because ADR-0026's inventory did not name it | it was the only remaining code that read files out of a compiled artifact, so leaving it would have left the invariant false while the test asserting it passed
• r-nobin284 ab2f08f — Keeping /dist/commitlore in gitignore in case a binary returns | an ignore rule for an artifact nothing produces is a claim that something might, and the ADR says otherwise
• r-exit065 e545dee — leaving guard's inversion in place and only documenting it | guard and inject are the two commands wired into hooks and CI, so a script written against guard today is already trusting the number; a documented inversion is still an inversion, and it gets load-bearing the longer it sits. The surface is one boolean per command right now — cheaper to fix once than to explain forever.
• r-7a48c3 b85d847 — a CONFLICTED lifecycle state for divergent declarations | see above — it would block work on records that have a correct answer

Warnings (6)

• r-pubprereq 8ffb31c (claim) — the required-check list is a literal, so a job renamed in the CI workflow becomes a check this gate waits for and never finds -- it fails closed, which is right, and the failure will read as a CI problem rather than a rename
• r-failclosed493 3216a54 (claim) — publish now waits on a job that clones over the network, so a transient clone failure withholds a release for a tag that is already pushed -- the tag is the durable thing and re-running the job is the recovery
• r-plugres483 7dab3e3 (claim) — the narrowed PATH in the gate includes the interpreter's directory, so a machine whose node lives beside a commitlore wrapper still shadows the plugin and the check will pass for the wrong reason
• r-nobin284 ab2f08f (claim) — an extensionless COMMITLORE_BIN is now ignored rather than honoured -- the hook falls through to the recorded install and to PATH, so a caller who pointed it at the wrapper still gets a working hook, by a different route
• r-exit065 e545dee (claim) — guard's swap is a breaking change for anything scripted against the old exit 2 for "matched" — see CHANGELOG Unreleased/Breaking
• r-7a48c3 b85d847 (claim) — these two changes were developed concurrently in one worktree and share a built dist/. Splitting them would leave one commit whose dist/ did not match its src/, so they land together and are described together

git log --follow accepts exactly one pathspec, so renames are not followed for 5 paths; query one path at a time to follow its rename chain

withheld the content of 1 record(s) graded blocked: a Verified trailer matching an injection pattern is reported, never quoted (SPEC §7)

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}