Name every action by a tree that cannot change under it

[MongLong0214]

Follow-up to the release-path work; the Limit: line of #501 named this as the remaining exposure.

Scoping the release-write grant removed the worst thing a changed action could do. It did not stop one from running. Every workflow referenced actions/checkout@v4 and actions/setup-node@v4, and a major tag is a moving pointer — the same reference can resolve to different code tomorrow, in jobs that read this repository and hold their own tokens.

26 references now name a digest. The versions do not move: both digests are what v4 resolves to today, verified against the GitHub API. This changes what the reference guarantees, not what runs.

A test fails on any uses: that is not a 40-character digest — the next workflow someone adds will be written by copying an existing line, and copying is how the property would quietly end.

One correction rides along

A test was named for keeping the canonical commit at the event SHA. That is a property of the workflow wiring, not of the script the test drives; the case itself shows the resolver answering for the commit it is handed. It says that now, and the workflow-shape case beside it asserts the other half. A name that claims more than its body runs is the failure this suite exists to catch — it was written during the #499 review and lost when the work moved worktrees.

[github-actions]

CommitLore — record lint

Trailers: clean — 1 commit in origin/dev..c5a7cfa72509e0596273b5ecd4b931d61f622f89
Active constraints: 24 limits · 82 ruled-out · 19 warnings — from 38 records over 5 changed paths

Active constraints for the paths this PR touches

Limits (24)

• r-pindigest c5a7cfa — pinning fixes the tree, not its behaviour -- a pinned action still runs with the job's token and can read this repository, and upgrading now requires deliberately resolving a new digest rather than inheriting one
• r-leastpriv 7a27c82 — gate jobs still run mutable @v4 action references, so a changed action can read this repository's source and its own job's token -- what it can no longer do is create a release; pinning those actions by digest is a separate decision with its own upgrade cost
• r-canonsha499 46ab656 — the window between the binding check and gh release create is not itself covered by a check -- the ruleset is what holds it closed, and a bypass actor added to that ruleset would reopen it silently
• r-pubprereq 8ffb31c — the gates qualify the commit and its CI, not the tag's authorship or timing -- anyone who can push a v* tag to a qualified commit on main can still publish, and expiring or re-pointing a tag after these jobs pass is outside what any of them observe
• r-failclosed493 3216a54 — the job runs on ubuntu-latest only, so it qualifies the POSIX install; the Windows path is still covered by install-ps1 in CI against the branch rather than against the tag
• r-benchscope 67f4375 — nothing checks the shape of the eight metric-row files. This gate names them and steps over them, and bench/deterministic/types.ts is the only definition that family has -- there is no JSON schema for it, so drift on that side is still invisible
• r-benchscope 67f4375 — the pre-provenance exemption reads started_at, which is data on the row rather than a fact about the file. A row that misreported it would be held to the shorter list of requirements; that is a deliberate falsification rather than the omission this fixes, and nothing here detects it
• r-winsupported1124 6333251 — repositories that installed the hook before Windows: the commit-msg hook hangs instead of returning, and #71's containment can never match there #321 keep the old stub and must re-run commitlore hooks install; a corrected release does not reach them, and this row's claim is about a working install
• r-winderive1124 282693b — a diagnostic that retypes the code it describes goes stale silently, because nothing fails when the two drift apart -- it has to be read out of the artifact that ships
• r-winbound1124 156deed — an unbounded hang is not evidence; it is a job that dies at the runner timeout having printed nothing, so every hook-invoking commit here has to carry its own bound
• r-winassert1124 616005d — an assertion whose only oracle is an absent side effect cannot distinguish "refused" from "the mechanism never worked", so each one needs a positive control that fires before the attack
• r-winshell1124 aa68a9a — a GitHub Actions bash step is invoked as bash -eo pipefail, so set -uo pipefail inside the step does not clear -e and any bare command that fails ends the step at that line
• r-ps1scope282 72f23df — the hook-runtime probe spawns /bin/sh, so it cannot report on a Windows hook at all until T-1124 changes it
• r-ps1shell282 97735d6 — a step's shell key takes no expression, so a per-host matrix cannot select the interpreter
• r-t1120nodeinst 14deeb4 — git and node are hard prerequisites now, so a host without them installs nothing and says which one is missing
• r-instpath119 9e1fce7 — a user who ignores the printed line still gets "not found" on the next command
• r-7a3e91 cf859e4 — better-sqlite3 stays external because it is native — the bundle degrades to --no-index without it, which only works because r-6f2a08 made that load lazy first
• r-3b8f52 1f8b4be — the figure is one machine, one run — it establishes the order of magnitude, not a regression baseline anyone should tune against
• r-1e7b40 c3ecbb6 — the merge is the only moment the branch's commits are still reachable, so this has to be right the first time or the records are gone
• r-0c5d38 aeb54a6 — the suite runs against the source tree, so no test in it can observe what packaging drops
• r-6f2e58 ea9ae6d — a library test and a binary test cover different failures, and the packaging layer between them is exactly where a working module becomes a broken install
• r-7e5f02 e5f5e00 — npm installs through an engine mismatch, so the ecosystem's own signal cannot be relied on to stop anything
• r-3a9d68 6a3fc3b — a test runner reports what ran, and nothing in its summary distinguishes "did not run" from "does not exist"
• r-8e2d51 ef93c0e — git is the parser, so a git version that folds or bounds trailers differently is a correctness problem for us, not a compatibility footnote

Ruled out (82)

• r-pindigest c5a7cfa — upgrading to the latest major while pinning | two changes in one, and a version bump that arrives inside a security fix gets reviewed as a security fix
• r-pindigest c5a7cfa — a dependency bot to keep digests current | the pin is what removes silent movement, and a bot that updates it automatically restores the property being removed
• r-leastpriv 7a27c82 — pinning the actions to digests in this change | it is the right move and it is not this defect, and bundling it would put an unrelated upgrade burden inside a release blocker
• r-leastpriv 7a27c82 — keeping id-token/attestations for the attestation step someone may add later | the step is not here, and a permission waiting for a future caller is available to every present one
• r-canonsha499 46ab656 — anchoring the resolver on the live tag and relying on the ruleset alone | a ruleset is repository state that can be edited, and a gate that is correct only while a setting holds is a setting, not a gate
• r-canonsha499 46ab656 — comparing the tag object sha returned by a single ls-remote pattern | every annotated release would be refused, and the first fix for that would likely have been to trust the name again
• r-pubprereq 8ffb31c — expressing either check as an if: on publish | a condition in YAML has no test, and a release gate whose logic cannot fail in a suite is a claim rather than a control
• r-pubprereq 8ffb31c — treating a missing required check as nothing to report | that is the empty-set inversion above, and it is exactly how a release with no CI at all would have published
• r-failclosed493 3216a54 — reusing the workflow's checkout instead of cloning | the row asks whether a fresh clone works, and a checkout is not the thing users get
• r-failclosed493 3216a54 — making the stale-hook row non-blocking because its fixture also fails another check | the confounding finding is separable by reading the row, and a row excused for being awkward is the fail-open being repaired
• r-benchscope 67f4375 — A declared list of result files, in the gate or in a manifest | opt-in under another name, and a file left off it is silently ungated -- which is precisely the failure bench/verify.mjs is not run by anything, so the result schema drifted unnoticed #392 reports
• r-benchscope 67f4375 — Validating only the three files that pass today | a description of the present rather than a rule, and it goes stale the first time a matrix is added or the schema moves
• r-benchscope 67f4375 — A naming convention on results filenames | the runner's default output is an ISO stamp plus hex and the metric writers' is a family name plus an ISO stamp, but every run-record file in the tree was named by hand through --out (t702-m2, m5-off-design-20-tasks), so the convention is enforced nowhere and cannot carry a gate
• r-benchscope 67f4375 — A marker file dropped beside each gated result | still a step somebody has to remember, and a forgotten step is the defect being fixed
• r-benchscope 67f4375 — Widening result.schema.json to describe both row families | they share no required field, so the union would accept a run record with no task and a metric row with no metric, which is a schema that rejects nothing
• r-benchscope 67f4375 — Making harness_commit and dist_digest optional in the schema | weakens the gate for every future row in order to admit six historical files, and Make per-turn token usage observable, and say what it still cannot price #390's drift was an additionalProperties failure that a laxer schema catches later rather than sooner
• r-benchscope 67f4375 — Skipping the six pre-provenance files whole | cheaper to write, but it stops checking types, patterns and the closed property set on 380 rows in order to excuse two absent fields
• r-winsupported1124 6333251 — Flipping the cell on the throwaway verification head | the ticket requires the attacks to pass in a required job in this ticket's own pull request, and a head that exists to be discarded is not that
• r-winsupported1124 6333251 — Leaving the assertion pinned and editing only the document | the two contradict each other, so the suite would fail; a guard that blocks the change it was guarding for is a defect in the guard
• r-winsupported1124 6333251 — Widening this ticket to the hook fix so it could be self-contained | the stop condition sent that to T-1127 for good reason, and this ticket's job was to measure and then say the word once measurement allowed it
• r-winderive1124 282693b — Updating the two hardcoded lines to match the fixed stub | it would be correct today and wrong at the next change, for the same reason it is wrong now
• r-winderive1124 282693b — Dropping the two diagnostics and relying on the commit alone | the commit says whether the hook worked, not which branch decided it, and that is the reading the next Windows question starts from
• r-winbound1124 156deed — Fixing the walk in src/hooks/commit-msg.ts as part of this change | the stub is not this ticket's to own, and the ticket says to record a Windows failure as its own issue rather than absorb it
• r-winbound1124 156deed — Instrumenting the stub to report its internal state | same ownership objection, and the chained-hook slot already reads the same environment without touching it
• r-winbound1124 156deed — Raising the job timeout and letting the hang run to completion | it never completes, and the assertions behind it would never execute
• r-winassert1124 616005d — Keeping the extensionless payload for attack 2 | the stub execs a recorded value only inside the .mjs|.js arm, so an extensionless target is refused by a branch that was never going to run it, and the step asserted its own control flow back to itself
• r-winassert1124 616005d — Calling attack 2 evidence of containment once the payload is a .cmd | it guards a loosening, it does not exercise the install-root check; conflating the two is what would let a green sticker land on an untested branch
• r-winassert1124 616005d — Keeping the chained-hook slot as the probe | it was never invoked, and a scratch repo with its own hook measures the platform without depending on the stub's argv0 handling
• r-winassert1124 616005d — A trailing rm for the planted file | it is skipped by every early exit, and the install root is shared by every later step on the runner
• r-winshell1124 aa68a9a — set +e at the top of each step | it also disables the abort for genuinely unexpected failures, where stopping is the right answer; the || form is scoped to the one command whose failure is a measurement
• r-winshell1124 aa68a9a — Reading the outcome from the step's own exit code instead | 124 tells you a bound fired somewhere, not which commit, and it discards the probe output that explains why
• r-ps1scope282 72f23df — Making the hook probe pass by installing a shim named commitlore with no extension | Windows will not execute it, and inventing a second artifact to satisfy a probe is the wrong direction; the probe is what needs to learn about Windows
• r-ps1scope282 72f23df — Committing through the hook in this job to prove the hook works | the hook path on Windows is exactly what is unestablished, so the assertion would be testing T-1124's subject in T-1121's job
• r-ps1scope282 72f23df — Dropping the doctor call so the log stays clean | its output is the evidence T-1124 starts from, and a clean log that hides it would cost the next ticket the finding
• r-ps1shell282 97735d6 — Duplicating the job once per host | eighty lines twice, kept in step by hand, to assert the same things about two interpreters
• r-ps1shell282 97735d6 — Running everything through cmd with the host as a variable | every assertion would become a quoted one-liner passed to -Command, which is the least readable form of the most important job here
• r-ps1shell282 97735d6 — Testing only PowerShell 7 | 5.1 is what a Windows machine has before anyone installs anything, and a 7-only construct is a parse error for the whole file
• r-instps1121 7bf6ced — Writing the user-scope PATH with SetEnvironmentVariable | two active records on install.sh reject an installer that changes the user's environment behind their back, and the Windows registry spelling of that act is not a different decision
• r-instps1121 7bf6ced — An extensionless shim matching the shell wrapper's name | Windows will not execute it, and the git hook resolves through recorded config rather than PATH, so the name would buy nothing
• r-instps1121 7bf6ced — Testing only under PowerShell 7 | 5.1 is the version a Windows machine already has, and a 7-only construct is a parse error for the whole file rather than a failure in one branch
• r-instps1121 7bf6ced — Requiring a helper for JSON merges the way install.sh needs jq | PowerShell parses and writes JSON natively, so the cannot-merge branch has no counterpart and inventing one would be a copied limitation
• r-instps1121 7bf6ced — Passing the version through $args so irm | iex could take one | iex gives a piped script no arguments, so the pinned form is documented as a scriptblock invocation and COMMITLORE_VERSION is accepted as well
• r-nobin284 ab2f08f — Keeping the binary classification arm for the installer's wrapper | the wrapper is a shell script that execs node, so trusting it by name would re-admit any extensionless executable called commitlore while the bundle it runs is the thing with an interpreter to check
• r-nobin284 ab2f08f — Relaxing the dogfood Evidence check to allow a missing path | it exists to catch a citation nobody can follow, and dropping the check to accommodate a deletion would retire the guarantee instead of correcting the question it asked
• r-nobin284 ab2f08f — Leaving src/core/paths.ts alone because ADR-0026's inventory did not name it | it was the only remaining code that read files out of a compiled artifact, so leaving it would have left the invariant false while the test asserting it passed
• r-nobin284 ab2f08f — Keeping /dist/commitlore in gitignore in case a binary returns | an ignore rule for an artifact nothing produces is a claim that something might, and the ADR says otherwise
• r-t1120fatal 0412668 — Reading the remaining failure by inference from the generic advice line | two cycles already went that way, and the informative line was present in the log the whole time
• r-t1120cijob 1871106 — Keeping the separate staged clone and adding more mount configuration | each addition would be configuration protecting a copy that exists for no reason once the checkout can be cloned directly
• r-t1120cijob 1871106 — Dropping the container steps and relying on the vitest suite | the suite runs on a machine that has node and git; the point of a bare image is that the prerequisite is genuinely absent, which is the assertion the active record on this file asks for
• r-t1120clonemsg 55ffb0a — Keeping the guessed message and fixing only the CI mount | the guess would still be printed for every other clone failure, and this one was found only because a container happened to hit it
• r-t1120clonemsg 55ffb0a — Letting the clone's stderr through to the terminal unfiltered | it interleaves with the installer's own log lines and a piped installer should speak in one voice; the last lines quoted into one named error keep both
• r-t1120nodeinst 14deeb4 — Hardcoding the release version in install.sh as the default | it would add a bump obligation to every release and a stale default between a tag and the bump; git ls-remote resolves the newest tag with no API token and no rate limit
• r-t1120nodeinst 14deeb4 — Defaulting to a branch when no tag is given | installing a moving target is what pinning exists to prevent, and the release gate already forbids a dev-referencing one-liner
• r-t1120nodeinst 14deeb4 — Writing the wrapper with cp over the destination | an in-place overwrite of a file that may be executing is the defect that forced a same-day patch release; the wrapper is written beside the target and renamed
• r-t1120nodeinst 14deeb4 — Letting post-install verification decide the exit code | that was the other half of the same defect, where a killed --version became the installer's exit status; verification now retries once and reports, and an install that succeeded exits 0
• r-t1120nodeinst 14deeb4 — Editing the shell profile when the wrapper directory is not on PATH | an active record on this file rejects it, and printing the line is what this script does about PATH
• r-t1120nodeinst 14deeb4 — A test-only environment hook to force a verification failure | a source repository whose bundle exits non-zero is a real broken release and needs no seam in shipped code
• r-t1120nodeinst 14deeb4 — Checking for git with command -v alone | a git that cannot execute is as useless here as a missing one, so the check runs git --version and catches both
• r-instpath119 9e1fce7 — editing the user's shell profile from the installer | printing the line is honest, rewriting .bashrc silently is what makes people distrust curl-to-shell installers, and this project sells verifiability
• r-instci99a 318b9a2 — pre-installing curl/jq/tar/git in the containers before running install.sh | would hide exactly the gap this work exists to find — Debian ships neither curl nor wget by default, and asserting that failure cleanly is the point of the bare debian:stable-slim step, not an obstacle to route around
• r-instci99a 318b9a2 — publishing a -musl release target so Alpine could install successfully | a release.yml/build-matrix change, not an install.sh or CI-verification fix; out of scope here (DO NOT: no Docker in the release build matrix) and orthogonal to making the existing failure clear instead of a raw crash
• r-instci99a 318b9a2 — heuristically detecting musl before download (checking for /lib/ld-musl-*.so.1) | executing the freshly extracted, already checksum-verified binary directly is a stronger, more general check — it catches any reason the binary cannot run on this machine, not only the one musl signature this repository happens to know the path for
• r-instci99a 318b9a2 — a matrix job splitting debian/alpine | the two images need different assertions (debian: bare failure, then success once curl is added; alpine: one clean failure, nothing more to add) and share one staged release + HTTP server; one job with named, ordered steps keeps that shared setup and reads linearly in the log
• r-5e91c7 f991389 — leaving pull_request as the only check for develop | a direct push to an integration branch is exactly what nobody reviews
• r-7a3e91 cf859e4 — inlining spec/SPEC.md and the schema into the bundle | SPEC.md would need a codegen step that itself needs a drift guard, and the package-root walk removes the reason to want it
• r-7a3e91 cf859e4 — replacing the tsc output with the bundle | test/cli.test.ts, test/hooks.test.ts and test/mcp.test.ts import dist internals by path
• r-3b8f52 1f8b4be — enabling the large fixture for the whole default suite | generating 100k commits costs ~22s and the other tests in that file gain nothing from it, so it runs as its own step against its own file
• r-7f31c9 750ab17 — reporting both datasets from one source list | readSources groups by condition and cannot separate repositories, so any second dataset with a commitlore-on arm silently corrupts the headline test
• r-1e7b40 c3ecbb6 — retry every refused push | a permission failure is not a race, and retrying it produces the same refusal three times
• r-1e7b40 c3ecbb6 — act on any merge | rebase and merge commits keep the originals, so inheriting would duplicate rather than preserve
• r-1e7b40 c3ecbb6 — inherit from a shallow clone | it would silently carry a subset and report success
• r-0c5d38 aeb54a6 — smoke with --version only | it passes with the schema missing, which is the failure worth catching
• r-0c5d38 aeb54a6 — assert a file list in package.json | it goes stale silently, and installing is the actual question
• r-6f2e58 ea9ae6d — pin the adoption sha in the workflow | it is the same stale cutoff the dogfooding suite was written to avoid
• r-6f2e58 ea9ae6d — spawn git per commit to read trailers | one pass with %(trailers:key=…) uses git's parser and does not scale with history
• r-7e5f02 e5f5e00 — hold Node 20 and downgrade both dependencies | paying maintenance cost to keep supporting an unpatched runtime
• r-7e5f02 e5f5e00 — floor at 24 | excludes Node 22 users today for no benefit, and 22 outlives v0.1.0
• r-7e5f02 e5f5e00 — drop engines entirely | the failure moves from install time to runtime, where it is someone else's confusing bug
• r-3a9d68 6a3fc3b — pin an expected test count | it goes stale on the next file added, and a stale count reads as passing
• r-3a9d68 6a3fc3b — keep threads and skip the index tests in CI | that is the same hole with the sign flipped, made deliberate
• r-8e2d51 ef93c0e — pin one git version in CI | it would hide exactly the divergence the matrix exists to surface
• r-8e2d51 ef93c0e — allow shallow checkout and skip dogfooding | a skipped gate reports the same green as a passing one

Warnings (19)

• r-pindigest c5a7cfa (claim) — no comment can keep a digest honest, so the # v4 beside each is a label rather than a check; the version it names is verified once, here
• r-leastpriv 7a27c82 (claim) — permissions at job level replaces the workflow default rather than merging, so a job that later needs another scope must restate the ones it already had
• r-canonsha499 46ab656 (claim) — the canonical sha is carried as a job output, so a future job added without needs: release-target silently reverts to resolving the name -- the workflow tests assert the consumption, not merely the dependency names
• r-pubprereq 8ffb31c (claim) — the required-check list is a literal, so a job renamed in the CI workflow becomes a check this gate waits for and never finds -- it fails closed, which is right, and the failure will read as a CI problem rather than a rename
• r-failclosed493 3216a54 (claim) — publish now waits on a job that clones over the network, so a transient clone failure withholds a release for a tag that is already pushed -- the tag is the durable thing and re-running the job is the recovery
• r-instps1121 7bf6ced (claim) — nothing on this machine can execute this file -- there is no PowerShell here, so every claim about its behaviour comes from the Windows runner in this pull request rather than from a local run
• r-nobin284 ab2f08f (claim) — an extensionless COMMITLORE_BIN is now ignored rather than honoured -- the hook falls through to the recorded install and to PATH, so a caller who pointed it at the wrapper still gets a working hook, by a different route
• r-t1120nodeinst 14deeb4 (claim) — keep install.sh ASCII only -- a non-ASCII character in a string silently terminated /bin/sh here while sh -n accepted the file
• r-instci99a 318b9a2 (claim) — the new binary-execution guard's die() message names musl/glibc specifically because that is the only way this repository's own release actually fails to execute today (glibc-only "-gnu" targets, verified against Alpine). If a -musl target is ever published, or the binary can fail to execute for an unrelated reason, this message will misdiagnose it — revisit the wording if that guard ever needs to distinguish causes.
• r-7f24a9 96d960a (claim) — this file is still NOT validated as a GitHub workflow. actionlint is unavailable and the sandbox cannot reach the API. Conflating a YAML parse with workflow validation broke gitseed's CI earlier today; the first run is the proof
• r-7f24a9 96d960a (claim) — the same task was told to update the factory skill's Gitflow section and its phase-gate.py, and could not — it was launched rooted at this repository and had no write access to ~/.claude/skills. The gate still checks for a branch named develop and fails both repositories for having dev. My spec error, not the delegate's; it is the next task
• r-5e91c7 f991389 (claim) — these files are NOT validated as GitHub workflows. actionlint is unavailable and the sandbox cannot reach the API, so only the YAML parse and structural assertions ran. Conflating those two broke gitseed's CI four commits ago; the first GitHub run is the proof
• r-7a3e91 cf859e4 (claim) — hardcoding ../ counts back to the package root is what broke this — new code reads assets through installedPath(), never through import.meta.url
• r-7f31c9 750ab17 (claim) — adding a file to README_SOURCES pools it into every aggregate in the block, including the significance test — check the arm names first
• r-1e7b40 c3ecbb6 (claim) — this runs on pull_request closed with contents: write -- keep the permission scoped to that workflow and out of ci.yml
• r-0c5d38 aeb54a6 (claim) — spec/ ships on purpose -- alternative implementations are told the fixtures are the contract, and this step is what keeps that true
• r-7e5f02 e5f5e00 (claim) — raising the floor again needs an ADR superseding ADR-0010 -- a package.json-only change will pass tests and lie to users
• r-3a9d68 6a3fc3b (claim) — any native addon added later needs the fork pool -- moving back to threads will silently drop whatever loads it
• r-8e2d51 ef93c0e (claim) — keep fetch-depth 0 on any job that runs npm test -- the dogfooding suite fails deliberately on a shallow clone, and "fixing" that by relaxing the assertion removes the gate

git log --follow accepts exactly one pathspec, so renames are not followed for 5 paths; query one path at a time to follow its rename chain

withheld the content of 4 record(s) graded blocked: a Limit, Ruled-out, Verified trailers matching an injection pattern is reported, never quoted (SPEC §7)

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}