release-exercise stubs `gh` to answer the one API fact the ceremony path
consults. Since #191 facts.sh selects a backend, and on this Forgejo runner
it selected the forgejo one — which speaks curl and walked straight past the
stub to the live instance, read the fixture's SHA against the real
repository, found no merged release-labeled PR behind it and refused.
The exercise rehearses the WIRING — facts → decide → notes through the real
$GITHUB_OUTPUT plumbing. Which backend answers is lib/forge.sh's own
contract and is covered in test/forge*.test.sh. So the facts step now pins
CEREMONY_FORGE=github, the backend its stub is shaped for, and the stub
returns the array shape the new label read expects.
Refs #191
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
release-exercise.yml's fixture arms with changelog.d/ and stamps through
the real assembler (#112 D12). The assembled suite's trio row expected
changelog-armed green on the dropped-entry tree — true when #116 was
written, false since #115's fragment mode landed after it (main is red at
736733e on exactly this row); the row now asserts the interaction as it
stands, and the hand-edited tree carries the only-red claim.
Round 1's shared blocking catch: release-exercise's call job proves the
parse but executes no steps (both doors are push-gated, by design), and
fixture-chain drives the scripts, not the workflow. The new step-replay
job executes the merge door's early sequence for real — both checkout
shapes including path: .ceremony-src, both branches of the bypass via a
matrix standing in for the repository test, the CEREMONY_DIR wiring, and
facts → decide → notes through genuine $GITHUB_OUTPUT plumbing — against
a fixture tree with a stubbed gh. Wired into PR CI as standing evidence;
PR-only, because a push-to-main workflow_call would hand release.yml the
merge door's exact gate. release.yml's honest-gap paragraph narrows to
what stays untested until #11: the doors themselves.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Closes#9. .github/workflows/release.yml (workflow_call) replaces box's,
rig's and cast's release.yml: the merge door (facts -> decide -> notes ->
tag+publish+bump, every decision in a tested lib script) and the tag door
(the manual fallback and backfill, no bump). Plus lib/facts.sh (the merge
door's impure half, contract-tested against fixture repos with a stubbed
gh), the self-ref pin guard (.github/scripts/self-ref-check.sh + CI step +
tests), the release-exercise scratch caller (dry wiring), the end-to-end
script-chain rehearsal, and the caller + artifact-hook contracts in
docs/CONSUMERS.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
