fix(C0-2): pin sovereign-ci.yml by sha; CB-2100 reachability finding filed (#3029) — PMAT-976

[noahgift]

Ticket

PMAT-976 · DAG row C0-2 · epic #2873 · issue #2891 · pp-066 inst:C C0-2

Claim

Pins .github/workflows/ci.yml's sovereign-ci.yml reference to a commit sha
(real, independent supply-chain-provenance value) and wires a guard proving it
stays pinned. Does not close CB-2100 — filed as #3029 with the full finding
(pinning does not change pmat's gate-effect reachability verdict; closing it for
real needs either six new ratchet-baseline rows for untracked comply debt, or
cross-repo manifest tooling in paiml/.github + pmat, neither in scope here).
Receipt is status: partial.

RED test (sha)

f46824526 — scripts/check_ci_reusable_workflow_pinned.sh added standalone
(ci.yml still @main); live check fails naming @main as "not a full 40-char
commit sha".

Acceptance (accept.sh output — re-run at HEAD)

A_i	command	result
A1	pmat comply check | grep CB-2100 shows ✓	NOT MET — still ✗, "whose steps this repository cannot read" (unchanged by the pin; see #3029)
A2	ci.yml references …sovereign-ci.yml@<sha>, not @main	MET — @4453399ee3794714800ff8db316ea7e1d3705a00

$ bash scripts/check_ci_reusable_workflow_pinned.sh --self-test
=== case table: check_ci_reusable_workflow_pinned.sh ===
  ok   ref: 40-char lowercase hex sha                 rc=0
  ok   ref: all-zero but valid 40-hex sha             rc=0
  ok   ref: @main (the registered mutation)           rc=1
  ok   ref: @master                                   rc=1
  ok   ref: a tag                                     rc=1
  ok   ref: a short (abbreviated) sha                 rc=1
  ok   ref: 40 chars but non-hex tail                 rc=1
  ok   ref: empty                                     rc=1
  ok   find_uses_ref: locates the pinned line         rc=0
  ok   find_uses_ref: extracts the exact sha          rc=0
  ok   find_uses_ref: locates the @main line too      rc=0
  ok   find_uses_ref: extracts "main" verbatim        rc=0
  ok   find_uses_ref: unrelated callee is not a match rc=1
  ok   find_uses_ref: missing file is not clean       rc=2
PASS: all cases behave as declared.

$ bash scripts/check_ci_reusable_workflow_pinned.sh
PASS: .github/workflows/ci.yml references paiml/.github/.github/workflows/sovereign-ci.yml@4453399ee3794714800ff8db316ea7e1d3705a00 (a pinned commit sha).

Reproduced against the real pre-fix tree directly (not only synthetic fixtures):
git show origin/main:.github/workflows/ci.yml swapped in → guard FAILs naming
@main; restored → PASSes.

Mutation (RED → GREEN)

Commit-level: f46824526 (guard only, ci.yml unpinned) is RED;
2e6a3805b (pin + wiring) is GREEN. CI-level: mutant commit a642a6077
(reverted the pin to @main) → guard-runner-labels job
101535304151
RED, step "ci.yml must pin sovereign-ci.yml by commit sha, not @main" failed
naming @main. Reverted at d06b21dc5 → guard-runner-labels job
101548517884
GREEN, both new steps passed.

Contract

contracts/apr-required-checks-v1.yaml (the DAG's named contract for this row)
— extended, not replaced: equation c0_2_reusable_workflow_pinned_by_sha,
proof obligation RC-OB-008, falsification test RC-F-008 bound to
check_ci_reusable_workflow_pinned.sh --self-test.

$ bash -c 'source scripts/pv_bin.sh; "$PV" validate contracts/apr-required-checks-v1.yaml'
0 error(s), 0 warning(s)
Contract is valid.

$ bash -c 'source scripts/pv_bin.sh; "$PV" lint contracts/ --diff origin/main'
Diff-aware: 1 contracts changed since origin/main
  apr-required-checks-v1
...
  Gate 4: verify               ✓  (26 refs, 26 found, 0 missing)
...
Summary: 0 errors, 1082 warnings, 0 suppressed
Result: PASS

$ bash scripts/check_contract_test_binding.sh
ok    ratchet  scripts/contract_test_binding_baseline.txt did not grow (0 removed) vs 3792afa3d
Resolved 530 test references; 27 dangling across 13 contract(s).
PASS: no contract cites more nonexistent tests than its baseline allows.

Quorum (teamwork, per DAG)

paiml-agy-delegate, lane=teamwork width=1, two runs (primary + mechanism-check
retry): both PROCEED/PASS, no dissent, on the plan (pin now, file the CB-2100
finding, receipt partial, continue to C0-4). The delegate's own receipt flags
this as a weak quorum — agy 1.1.27 headless -p mode did not engage true
/teamwork-preview fan-out (2 turns, ~27s each, zero child agents, every
finding grounding=asserted). Load-bearing evidence in this PR is the
orchestrator's own direct pmat-source reading and empirical reproduction (RED
against origin/main's real ci.yml, GREEN against the fix), not the quorum
lane. Recorded as a lesson in the delegate's agent-memory
(feedback_teamwork_lane_does_not_fan_out.md) for future sessions.

Receipt

docs/audits/impl-PMAT-976-receipt.md — status: partial. A2 met, A1 not;
follow-up tracked in #3029.

Writes

• .github/workflows/ci.yml (sha pin + guard wiring)
• contracts/apr-required-checks-v1.yaml (extended)
• scripts/check_ci_reusable_workflow_pinned.sh (new)
• docs/audits/impl-PMAT-976-receipt.md (new)

No shared file touched (check_row_pr_write_set.sh PASS): not
docs/specifications/pp-066-dag.yaml, not docs/roadmaps/roadmap.yaml, not
docs/specifications/PP-066-release-spec.md, no README count line.

Follow-up

#3029 — CB-2100 remedy (ratchet-baseline 6 untracked comply debts, or cross-repo
manifest tooling). Linked from #2891.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3031 head=d06b21dc53c3e819177d5b823d725ebefe5eeb2a verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

Auto-merge armed. Currently BLOCKED in the merge queue on two unrelated, already-tracked fleet issues (not this PR's diff): (1) #3028/PR #3030 — main's roadmap.yaml carries 12 legacy duplicate ids that pmat 3.39.0 rejects, redding ci / security on every PR; (2) a fleet-wide gap where scripts/pmat_bin.sh's pinned pmat 3.37.0 analyser is missing on at least two runner hosts (paiml/infra#468 comment). Will merge automatically via the queue once both clear.