fix(ci): close Smart CI merge-base receipt residuals

[Chris0Jeky]

Scope

Close the two bounded follow-ups recorded on #2508 after PR #2832:

1. failed diagnostic receipts must not preserve malformed or semantically invalid merge-base authority;
2. local no-event --pr what-if planning must remain annotation-only and never claim production PR merge binding.

Implementation

• preserve merge-base identities only for a successful PR plan whose merge ref is explicitly qualified;
• require full SHA syntax and the complete binding relationship:
  • null live tip means mergeBaseSha === baseSha;
  • moved base means mergeBaseSha === mergeBaseTipSha and the tip differs from baseSha;
• clear both fields atomically for malformed, mismatched, stale-base-unqualified, non-PR, or error plans;
• preserve the original failed verdict and gate diagnostics;
• validate local --pr as a positive integer;
• reject local --pr when a GitHub event payload is supplied;
• retain the number only as a human-readable note while keeping event.pullRequest null.

Regression coverage

• malformed base SHA;
• malformed tip SHA;
• null-tip/base mismatch;
• mismatched moved-base pair;
• redundant live tip equal to the control base;
• stale-base-unqualified plan carrying identities;
• non-PR plan carrying identities;
• local planner -> gate -> receipt annotation-only path.

Boundaries

• does not implement CI-03: Smart CI / Required Gate, branch-current contract, landed-commit verifier and event topology #2327's landed-commit verifier;
• does not change selection, branch protection, repository settings, trust classification, or runner routing;
• does not weaken actual pull_request / pull_request_target merge-binding validation.

Review response

Codex identified that syntactically valid but semantically invalid merge-base pairs could still be copied into a failed diagnostic receipt. Current head 9c99c59dbad40796732ec58b2de17e0fc167043c now applies the complete binding relationship before preserving either identity and clears the pair atomically otherwise. The focused regressions cover malformed, mismatched, redundant-tip, stale-base-unqualified, non-PR, and error-plan cases. The inline thread is resolved.

Exact-head verification

Head: 9c99c59dbad40796732ec58b2de17e0fc167043c

• Smart CI Self-Test: success — run 35286444753;
• required CI: success — run 35286445080;
• CI Extended: success — run 35286445033.

The implementation and exact-head qualification are complete. The PR is ready for the fresh Codex review triggered by leaving draft.

Refs #2508 and #2327.

[Chris0Jeky]

@codex review

Draft-time review requested on exact head aac691060fb3673919c17d21d8076031d4d06004. Smart CI Self-Test and CI Extended are green; required CI is still in progress. Please focus on fail-closed diagnostic receipt semantics and whether local --pr annotation can accidentally claim production PR authority.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T02:03:32.605313Z	9c99c59	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aac691060f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

@codex review

Please re-review exact head 9c99c59dbad40796732ec58b2de17e0fc167043c. The prior semantic-binding finding is addressed with full relationship checks and seven fail-closed mutation cases.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 9c99c59dba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Parked unmerged: this PR touches a ci/policy.v1.json control path. OUTSTANDING_TASKS.md J.3(b) is unanswered, so the ADR-0066 amendment of 2026-09-03 still binds — a control-plane PR merges only after the maintainer's own review plus one fresh-context review, and only when a named ruling covers this PR. Green hosted CI is the evidence gate, not authority. This comment is the park so the thread is not silent.

[Chris0Jeky]

Unparked under the maintainer directive of 2026-09-18, which names this PR in the PR-recovery-wave queue handed to this worker. That is the named ruling the ADR-0066 control-plane hold was waiting for.

Fresh-context adversarial review by an independent session. What I checked beyond the diff:

• merged current main, which had added scripts/ci/smart-ci/landed-verifier.mjs since this branch forked. landed-verifier consumes the same gate receipt this PR rewrites, so I read it: it gates on receipt.ok === true and never reads mergeBaseSha / mergeBaseTipSha, so nulling those on non-qualifying receipts cannot change its verdict;
• checked the other receipt/plan consumer, recall-report.mjs. It reads the plan artifact, not the gate receipt, and this PR does not change plan output, so its legacyMergeBaseReceipt fallback is unaffected;
• checked that normaliseMergeBaseBinding's preserve condition matches validatePlan's own rule in lib/plan.mjs: a successful pull-request plan must record mergeRefQualification, and qualified is exactly the case where the merge-base pair is authoritative. So a healthy green PR receipt keeps its identities;
• checked the production caller of plan.mjs (smart-ci-shadow.yml line 148). It passes --event and never --pr, so the new "--pr is only available for no-event local what-if planning" throw cannot fire in CI;
• node --test scripts/ci/smart-ci/*.test.mjs on the merged tree: 539/539 pass.

One non-blocking note: Number.isInteger(plan.event && plan.event.pullRequest) treats a pullRequest of 0 as a real PR. No producer can emit that (plan.mjs now rejects a non-positive --pr, and a GitHub event number is always positive), so it is a note rather than a finding.

Merging with a merge commit once exact-head required CI is green on the merge head.