fix(gate): the CI gate calls the verb it claimed to mirror — closes #278, #260, #284

[thrillmot]

Stacked on #287 — it consumes the --base/--head range mode that PR adds. Merge #287 first; this retargets to dev automatically.

The template's own header said it "mirrors the local logmind check-decisions pre-commit hook." It did not mirror it — it reimplemented it in bash, and the copy had drifted five ways:

#	drift	issue
1	*.md wholesale in the exclusion case	#260
2	live-PR-title [skip-logmind] read	#278
3	path-match decision test instead of §3.1 shape	#278
4	hardcoded THRESHOLD: "20", never read commit_line_threshold	#284
5	a second exclusion list	§3.4

The gate now invokes the verb and the bash decides nothing, so all five die at once — rather than five patches inviting a sixth drift.

The base-ref checkout is load-bearing, not incidental

The workspace is github.event.pull_request.base.sha, never the merge ref. That matters because the verb reads git.commit_line_threshold from the checkout — so a merge-ref workspace would let a pull request raise its own threshold in the diff under judgement.

Proven live in a scratch repo. A PR setting commit_line_threshold: 10000 in its own diff:

workspace	result
merge ref	✓ 30 lines changed (below 10000-line threshold) — passes
base ref	⚠ 30 lines changed…, exit 1

That is SPEC §6.3 — a gate is never satisfiable by the change it judges. Without the base-ref checkout, the config threshold added in #287 would itself have been a new self-service escape. Found by the build agent, and it is the single most important line in this diff.

Shape

1. actions/checkout@v7 at the base sha, fetch-depth: 0
2. git fetch --no-tags origin +refs/pull/N/head — the range needs the head commit, which for a fork PR is on no branch here
3. thrillmade/setup-logmind@v1.0.0 — a pinned release, never built from the PR's checkout; a PR that can rebuild the binary can rewrite its own gate
4. logmind check-decisions --base "$BASE_SHA" --head "$HEAD_SHA", three ::error:: lines, exit 1

permissions: drops to contents: read alone — deleting the PR-title read removed the only consumer of pull-requests: read.

Deliberately NOT done

logmind's own .github/workflows/check-decisions.yml is not regenerated here. setup-logmind installs the latest release, and --base/--head exists only on the unmerged parent — regenerating now turns logmind's own gate red on every PR, including this one.

The same ordering binds every consumer: the fleet cannot take this template until a release carries the verb. That is now a documented prerequisite on #257 alongside #288 and #289.

Tests

TestCheckDecisionsTemplate_V4_LivePRTitle → …_V5_CallsTheVerb, pinning the marker, the verb invocation, and each of the five defects as a must-not-contain — scanned against a comment-stripped body so the header can still name what it removed. Added to TestWorkflowTemplates_UseSetupLogmindAction and …SetupLogmindStepsCarryToken.

Rendered through a real logmind init, parsed with PyYAML, and actionlint (with shellcheck) exit 0. Full suite exit 0, all 21 packages.

Two findings recorded, not fixed

• The verb's over-threshold text prints To skip this check: git commit --no-verify — a local-hook hint that is meaningless at the gate and reads as an escape §3.4 forbids. Lives in the parent branch under a byte-identical-output contract.
• logmind's own check-decisions.yml is already drifted: no version marker, checkout@v7 vs the old template's @v6. No lockstep pair-diff test exists for it — only TestRegenTimelineWorkflow_LockstepWithTemplate. Worth adding when it is regenerated.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
logmind-site	Ready	Preview	Aug 7, 2026 9:41pm