Recorded tags now re-peel before repair (#174) and branch normalization
needs a head proof (#165), so same-run conflicting repairs can no longer
be planned. Fixtures ported from candidate commit 3eb0100.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Parity now resolves recorded branch heads and fails closed when the
recorded ref is inconclusive (#174). Stub fixtures ported from candidate
commits 3eb0100 and 22e894c.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

CHECKOUT_SHA was the actions/checkout v6.0.2 commit while the fixtures
record it under v4 and main. Recorded-ref tracing (#174) correctly rejects
that; use the real v4.2.2 commit the stub tag list already names.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Restores the #167 same-run scenario with a recorded tag instead of
swapping it for a branch, which only exercised the missing-head exit.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Keep the original --verify bodies, adjusted for ref-qualified lookups and
fail-closed inconclusive checks; replace the mode cross-products with one
default/--no-fix test, and drop full-SHA and entry-ref cases that
TestParityFinding_FullSHAKey and TestValidEntryRef already cover.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The backend resolver, not the runner, looks up and rejects lock entry
refs; say so in comments, docs and the missing-ref finding detail.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Tags move, and the Actions backend accepts a pin whose commit is still in
its tag's history. Every lock entry ref is now checked by reachability:
a tag that lost the commit still blocks and an inconclusive check still
fails closed, but a tag that moved ahead only warns under --verify.

Dropping the separate tag-equality lookup also saves the extra REST
commit call when a ref still points at its locked commit.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

An error-severity finding blocks the run, so it never renders as a
warning. Under --verify the terminal now shows an exact tag that moved
ahead of its locked commit, matching the JSON warning, and the
inconclusive-check remediation names the Actions backend.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

A ref like main~1 or v1@{1} is not a tag or branch name, but a commit-ish
lookup evaluates it as a revision. Validate names with git
check-ref-format rules, matching actions-lockfile's RefName: an entry ref
that fails makes the lockfile unreadable, and parity never builds a
lookup expression from one.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

--relock drops findings for recorded pins because it replaces them, but
it also dropped them for pins it had just resolved, so it could write a
lock that the next --verify rejects.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

A full-SHA entry whose recorded tag or branch no longer vouches for it
recommended --accept-moved, which then refused it. --accept-moved now
accepts it as a warning and re-records a tag or branch that contains the
commit, chosen by reverse lookup; a commit no branch contains still fails.
Fresh full-SHA pins are no longer checked against a pre-planning ref.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The Actions backend resolver looks a recorded ref up as a tag before a
branch, so reverse lookup now skips a containing branch whose name is
also a tag.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

A ref counts only if a tag or branch exists by exactly that name: GraphQL
also asks ref(qualifiedName:), and REST reads git/ref/{tags|heads}/<name>.
Like the Actions backend, names ending in -g plus four or more hex
digits are not accepted as recorded or uses: refs, so an entry with one
makes the lockfile unreadable and a uses: ref with one is never locked.

Adapted from 2134d14 and 93b2f4a.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

A full-SHA pin whose recorded tag or branch no longer exists was titled
"Pinned commit not in upstream history". It is now "Ref no longer
exists", like any recorded ref that is gone.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Command tests now live in the test file of the source that implements the
behavior: runCheck wiring in run_test.go, root command flags, paths and
the shared command harness in root_test.go, cooldown resolution in
fresh_tag_test.go, the no-onboard gate in onboard_gate_test.go. Pure
moves: the same 154 test functions run before and after.

With no orphans left, TestEveryTestFileHasSource drops its allowlist.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

httpmock now owns the shapes command and API tests kept re-declaring:
StubRepo for the batched resolve query, ParityIntact/ParityQuery,
RoundTripFunc and CountingTransport. Command tests use workflowUsing
for the standard one-job workflow and runCheckJSON/checkResult for the
--json=valid,findings payload instead of hand-decoding it.

The four reachability tests that differed only in the compare response
are one table, TestCheck_RelockAncestry. Tenant-host tests get neutral
names.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Go tests that spelled out actions/checkout and actions/setup-go release
commits now reference testfixture pins, so each literal carries the
release it came from and the fixture guard checks it. Adds the
checkout v4.2.1 pin those tests use.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lockfile, pin and pipeline tests each declared their own RepoIDs fake
returning fixed IDs; testfixture.Metadata replaces all three.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

These files already asserted with testify everywhere else.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

ServeHTTP and RegisterRepeated let a subprocess under test talk to the
same stub registry the command tests use.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

test/e2e builds the binary once and runs every catalog scenario in a
fresh git repo. Stub scenarios name a fake-GitHub profile (stub:) served
by httpmock over TLS and run in go test ./...; live scenarios need
E2E_LIVE=1. Custom assertions become declarative output_count and
then_run, exit codes are matched exactly, and every no-token scenario is
tagged stub so it guards merge.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

make test-integration, test-live, test-smoke, test-stub, and test-real
now run go test ./test/e2e with E2E_LIVE / E2E_TAGS. CI no longer
installs Ruby. The interactive shell and review/report tooling go with
the harness.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

relock_bumps_stale_branch_ref restated TestCheck_Relock_BumpsMovedBranchRef;
verify_local_conflict_relock restated TestValidateOutputFlags_VerifyConflicts
(verify_conflict_verify_local still proves the real binary's usage exit
code); no_workflows_summary folds into no_workflows.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The impostor-pin guard accepted any lookup error, so a 401, rate limit
or outage passed it. It now requires a 404 or 422 and fails on
anything inconclusive.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Three gaps in the runner:

- Scenarios ran under the developer's HOME, so every run wrote its run
  log to the real user cache dir (where its retention GC could delete
  real logs), and live scenarios read the real user config file. Each
  scenario now gets its own HOME, XDG and gh config dirs; the unused
  GH_ACTIONS_LOCK_CACHE_DIR is gone.
- The lockfile coherence check matched `uses:` by prefix, so a stale
  `actions/checkout@v4` entry passed against `@v4.2.2`. usesRef now
  requires the exact ref, with owner/repo folding case.
- A relative E2E_COVERDIR resolved against each scenario's repository,
  silently dropping all coverage. It is now made absolute and created.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

TestCatalogSHAsAreNamedPins accepted any pin with the same SHA, so a real
commit attached to another repository or recorded under the wrong ref
passed. Bare `owner/repo@sha` uses must match the pin's repository, and
expected-JSON nwo/ref/sha triples must match a pin exactly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

- Scenarios no longer inherit GH_HOST or enterprise tokens, so a
  developer's configured host can't redirect live runs.
- The package builds on Windows: the binary gets its .exe suffix,
  USERPROFILE and AppData move into the scenario home, and the PTY
  runner is limited to platforms that have one.
- lockfile_deps_cover_direct now also fails when a workflow uses a
  remote action its lockfile entry doesn't list, not only the reverse.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>