ci: make governed estimation checks reproducible

.github/workflows/ci.yml

@@ -13,8 +13,10 @@ jobs:
     name: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Activate managed Git hooks
+        run: git config core.hooksPath .githooks
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: "3.12"
           cache: pip
@@ -27,7 +29,13 @@ jobs:
     name: windows-governance
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Preserve managed LF line endings
+        shell: pwsh
+        run: git config --global core.autocrlf false
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Activate managed Git hooks
+        shell: cmd
+        run: git config core.hooksPath .githooks
       - name: Run governance gate
         shell: cmd
         run: project\governance-check.bat

project/TICKETS.md

@@ -13,4 +13,5 @@ analysis artifacts.
 | **ticket-005** | [`README.md`](./ticket-005/README.md) | [`preprompt.md`](./ticket-005/preprompt.md) | - |  [`ai-codex.md`](./ticket-005/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-005/ai-codex-logs.txt) | [`changelog.md`](./ticket-005/changelog.md) |
 | **ticket-006** | [`README.md`](./ticket-006/README.md) | [`preprompt.md`](./ticket-006/preprompt.md) | - |  [`ai-codex.md`](./ticket-006/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-006/ai-codex-logs.txt) | [`changelog.md`](./ticket-006/changelog.md) |
 | **ticket-007** | [`README.md`](./ticket-007/README.md) | [`preprompt.md`](./ticket-007/preprompt.md) | - |  [`ai-codex.md`](./ticket-007/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-007/ai-codex-logs.txt) | [`changelog.md`](./ticket-007/changelog.md) |
+| **ticket-009** | [`README.md`](./ticket-009/README.md) | [`preprompt.md`](./ticket-009/preprompt.md) | - |  [`ai-codex.md`](./ticket-009/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-009/ai-codex-logs.txt) | [`changelog.md`](./ticket-009/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-009/README.md

@@ -0,0 +1,27 @@
+# Ticket 009: Make governed estimation CI reproducible
+
+- **ID**: ticket-009
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-08-25
+
+## Goal and scope
+
+Make governed CI reproduce the repository contract on Linux and Windows:
+activate the managed Git hook before invoking pytest/governance and normalize
+the Windows worktree to LF before validating hash-bound standard files.
+
+## Acceptance criteria
+
+- [x] AC-01: Scope is approved by the user's request to test and repair
+  autonomy and publish all changes.
+- [x] AC-02: Linux functional CI activates the managed hook.
+- [x] AC-03: Windows governance preserves LF and activates the managed hook.
+- [x] AC-04: Local pytest and governance pass.
+
+## Participants
+
+- Human participant: user:tom; authorization is recorded by the originating
+  request and no synthesized user file was created.
+- Agent participant: [ai-codex.md](ai-codex.md)

project/ticket-009/ai-codex-logs.txt

@@ -0,0 +1,9 @@
+2026-08-28 validation
+
+- `PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src python -m pytest -q`: PASS
+  (8 passed).
+- `PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src ./project/governance-check.sh`:
+  PASS (0 errors, 0 warnings).
+- Workflow actions are pinned by full commit SHA; Windows configures LF before
+  checkout and both runners activate `.githooks` before their governed gates.
+- GitHub repository setting `delete_branch_on_merge=true` was already correct.

project/ticket-009/ai-codex.md

@@ -0,0 +1,38 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-009
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+CI failed before testing the estimation change: fresh runners did not set
+core.hooksPath, Windows converted managed files to CRLF, and the repository
+setting did not delete merged head branches as required.
+
+## Execution plan
+
+1. Preserve LF before the Windows checkout materializes managed files.
+2. Configure the managed hook before functional and Windows governance jobs.
+3. Enable automatic head-branch deletion in repository settings.
+4. Validate locally and publish the CI repair before rebasing ticket-008.
+
+## Actual changes
+
+- Initialized the bounded ticket and recorded SESSION_EXECUTION_AUTHORIZATION
+  from the request to execute this work.
+- Selected immutable action revisions and a pre-checkout LF configuration so
+  the repair needs no destructive reset in the ephemeral runner.
+- Activated the managed hook in both jobs and verified that repository branch
+  deletion after merge is already enabled.
+- Passed the complete package suite and governance locally.
+
+## Blockers
+
+- None inside the recorded intent; proceed without a second confirmation.
+- New authority remains required for destructive action, secret access, new
+  external coordination or material objective expansion. Protected delivery
+  may be invoked without another prompt when publication is in scope; its
+  exact-head trusted approval remains independent evidence.

project/ticket-009/changelog.md

@@ -0,0 +1,9 @@
+# Ticket Changelog (ticket-009)
+
+- Pin checkout/setup actions, preserve LF before Windows checkout and activate
+  managed hooks in both CI jobs.
+
+## [0.1.0] - 2026-08-25
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.

project/ticket-009/intent.json

@@ -0,0 +1,71 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-009",
+  "summary": "Make governed estimation CI reproducible",
+  "workstream": "infrastructure",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "regression"
+  },
+  "allowedPaths": ["project/ticket-009/**", "TODO.md", "project/TICKETS.md", ".github/workflows/ci.yml"],
+  "delivery": {
+    "acceptedBaseSha": "8dd7bc814b0fa987e968524745913771910560c7",
+    "targetBranch": "main",
+    "outcome": "Linux and Windows CI satisfy the same managed-hook and content-digest preconditions as local governance.",
+    "nonGoals": [
+      "Change governance policy or weaken any gate.",
+      "Change estimation runtime behavior."
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Configure Windows LF handling before checkout, pin external actions immutably and activate repository-managed hooks explicitly in each CI runner.",
+      "components": [
+        {
+          "name": "continuous-integration",
+          "paths": [".github/workflows/ci.yml"]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Remove the CI setup steps; no runtime or persisted data changes are involved."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-02",
+        "commands": ["python -m pytest -q"],
+        "evidence": "Linux CI executes pytest after configuring core.hooksPath."
+      },
+      {
+        "criterion": "AC-03",
+        "commands": ["project\\governance-check.bat"],
+        "evidence": "Windows checkout uses LF and governance sees the managed hook."
+      },
+      {
+        "criterion": "AC-04",
+        "commands": ["PYTHONPATH=src python -m pytest", "PYTHONPATH=src ./project/governance-check.sh"],
+        "evidence": "Local functional and governance suites pass."
+      }
+    ]
+  },
+  "forbiddenPaths": ["project/ticket-*/user-*.md"],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null
+}

project/ticket-009/preprompt.md

@@ -0,0 +1,15 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-009
+- **Task title**: Make governed estimation CI reproducible
+- **Created**: 2026-08-25T17:22:05Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.
+The request to execute this work creates SESSION_EXECUTION_AUTHORIZATION;
+proceed within the recorded intent without a redundant confirmation prompt.
+Require new authority for destructive action, secrets, external coordination,
+or material objective expansion. When publication is in scope, session
+authorization permits the declared protected delivery process and its merge
+after exact-head trusted approval without another prompt. Session prose is
+never approval evidence and the agent must not merge directly.