Retry Smart CI merge-ref resolution against the run control base

[Chris0Jeky]

Summary

• bind the pull_request_target Smart CI run to one trusted control base (github.sha) instead of the potentially stale event payload base
• resolve each live merge-ref attempt as one coherent merge/base/head/tree observation, retry unavailable or mismatched observations at most three times, and publish no identities unless both parents match
• pass the same control base through planner and gate evaluation while leaving policy, execution mode, required CI, and branch protection unchanged

The issue's earlier SHA/tree-straddle diagnosis was corrected before implementation. A fetched local FETCH_HEAD is coherent; the observed defect was stale event base metadata versus an already-recomputed live merge ref.

Verification

• failing-first resolver spec: ERR_MODULE_NOT_FOUND before the helper existed
• node --test scripts/ci/smart-ci/*.test.mjs: 85/85 passed
• Actionlint bootstrap contract subset: 5/5 passed
• smart-ci-shadow.yml parsed with PyYAML
• node --check passed for resolver and resolver spec
• real synthetic depth-2 merge-ref fixture passed through the resolver with Git --config-env
• git diff --check origin/main...HEAD: passed
• exact-head Codex connector review and fresh-context base-interaction review: no merge-blocking findings
• hosted exact-head required CI 33701229648, Workflow Lint 33701229667, Planner Self-Test 33701229556, Plan and Required Gate 33701225976: passed
• live post-base-advance convergence: Smart CI 33701225976 passed against base b66da8fd43eebad7ee3a7c21c38df7e48fe9ed97; the repaired control workflow becomes active on main after merge and remains under CI-02: Deterministic risk/impact planner with fail-closed policy, shadow mode and recall report #2326 observation

Documentation

• docs/STATUS.md updated (issue-scoped repair; no roadmap or operating-mode change)
• docs/IMPLEMENTATION_MASTERPLAN.md updated (no roadmap or mode change)
• docs/TESTING_GUIDE.md updated (no recurring operator command changed)

CLAUDE_SYNC_PACKET

• canonical truth changes: none
• issue/project changes: Smart CI compares a stale event base with the recomputed merge ref after main moves #2401 and PR Retry Smart CI merge-ref resolution against the run control base #2404 are verified Project status Done with Priority I; merge commit 62f8686421e1d5274c01861e908288d7fae56c4f
• architecture/decision impact: none; ADR-0066 shadow/observation posture is unchanged
• manual validation still needed: none for this repair; the next organic event using the merged control workflow remains part of CI-02: Deterministic risk/impact planner with fail-closed policy, shadow mode and recall report #2326 observation
• human actions: none specific to Smart CI compares a stale event base with the recomputed merge ref after main moves #2401

Tracking

• Closes Smart CI compares a stale event base with the recomputed merge ref after main moves #2401
• Project issue and PR items verified Done with Priority I

CI Workflow Validation

• Confirm exact-head required CI and hosted Workflow Lint
• Confirm Smart CI Planner Self-Test, Plan, and Required Gate on exact head 63f3816f568422c852e324ebd9621cd928b78cc9

Risk Notes

• Security impact: authenticated Git fetch keeps the job token in an environment-backed Git config value rather than child-process arguments; no head code is executed
• Behavior/regression risk: R4 CI control-path change; persistent base/head drift remains fail-closed and selects no reduced test plan
• Follow-up tasks: CI-02: Deterministic risk/impact planner with fail-closed policy, shadow mode and recall report #2326 continues collecting organic observations after this workflow reaches main; selection mode remains disabled

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T00:53:53.926466Z	63f3816	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Chris0Jeky]

Fresh exact-head reproduction for this repair from Alpha PR #2388:

• PR head 7b3994e61ec56f18dc1716105270890eaef7b192 is a merge of live main 57821f076f74c4715dd359ff29431df2d604bc5c plus the product branch.
• Smart CI run 33699697079 Plan passed and the Required Gate checkout fetched 57821f076f74c4715dd359ff29431df2d604bc5c as origin/main.
• The gate event still supplied EXPECTED_BASE=dcd258af262a0b7179b58ac3fb36f744f92255da, then failed with pull-request planning requires merge SHA and tree SHA from the same fetched merge ref plus the T3/T1 trust mismatch.

This is the same stale control-event base defect as #2401 on a newly synchronized, current-main-containing head. Please use run 33699697079 as a real regression fixture for this PR's retry path. No Smart CI files were changed by the Alpha lane.

[Chris0Jeky]

A second in-lane PR reproduced the same stale control-event base failure after a current-base refresh:

• PR [Frontend][Inbox] Poll legacy batch triage to terminal detail #2299 head fa0f94d
• Smart CI run 33701783698, Required Gate job 100482476865
• checkout/live main: b66da8f
• event EXPECTED_BASE: 57821f0
• result: same merge-ref planner error plus T3/T1 trust mismatch

#2299 remains unmerged. This is dependency evidence only; no request to bypass or rerun the gate.

[Chris0Jeky]

Dependency-ready checkpoint for the beta-platform-integrity owner:

• exact head 63f3816
• exact base b66da8f
• ready, mergeable, and clean
• 0 failed checks, 0 pending checks, including successful E2E
• Codex review completed at this head with no inline findings
• 0 unresolved review threads
• the three-minute aging floor is satisfied

Alpha PRs #2299 and #2388 are both held on reproduced #2401 stale-base failures. This is a merge-readiness handoff only; the platform lane retains merge ownership.