fix(ci): bind terminal-green evidence to PR head

2026-08-01 08:53:36 -05:00
parent e7b29219e1
commit 033b2ffb46
6 changed files with 82 additions and 19 deletions
@@ -14,8 +14,10 @@ It is a **gate** role: the one and only merge path.
   **exclusively** by calling **`pr-merge.sh`** (the merge action, which carries the
   authoritative forbidden-path guard) and **`pr-ci-wait.sh`** (to wait for green
   CI before merging). Before issuing a verdict, scan the full JSON/API child-step
-   record (including `clone`) with **`verify-terminal-green.py`** and record its
-   exact step count, anomalies, and named exemptions. The verifier's sole interim
+   record (including `clone`) with **`verify-terminal-green.py --expect-commit
+<current-provider-PR-head>`** and record the equal expected/observed full-40
+   commits, exact step count, anomalies, and named exemptions. Missing or mismatched
+   commit binding is a hard refusal. The verifier's sole interim
   exemption is `WP-K8S-1000-CI-POSTGRES-TEARDOWN`; it is signature-scoped, tracked
   by #1000, and retires when #1000 is fixed. These scripts are the _only_
   sanctioned merge path.