From f2174616da674850629136d459f0ceb4119cb2bb Mon Sep 17 00:00:00 2001
From: Erik <262919414+try-works@users.noreply.github.com>
Date: Mon, 31 Aug 2026 22:13:40 +0800
Subject: [PATCH 1/2] fix(release): require exact private stage head

---
 .github/workflows/build-binaries.yml     | 5 +++--
 scripts/build-binaries-workflow.test.mjs | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 0856d752..18e3ad6c 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -327,8 +327,9 @@ jobs:
             exit 1
           fi
           git fetch --no-tags origin "+refs/heads/${REQUIRED_PRIVATE_BRANCH}:refs/remotes/origin/${REQUIRED_PRIVATE_BRANCH}"
-          if ! git merge-base --is-ancestor "$RELEASE_PRIVATE_SHA" "origin/$REQUIRED_PRIVATE_BRANCH"; then
-            echo "Private revision must be promoted through role-model-internal/$REQUIRED_PRIVATE_BRANCH before $ROLE_MODEL_BUILD_CHANNEL packaging."
+          required_private_head="$(git rev-parse "origin/$REQUIRED_PRIVATE_BRANCH")"
+          if [[ "$RELEASE_PRIVATE_SHA" != "$required_private_head" ]]; then
+            echo "Paired private revision must equal the current role-model-internal/$REQUIRED_PRIVATE_BRANCH head before $ROLE_MODEL_BUILD_CHANNEL packaging."
             exit 1
           fi
 
diff --git a/scripts/build-binaries-workflow.test.mjs b/scripts/build-binaries-workflow.test.mjs
index f35cabed..526e0597 100644
--- a/scripts/build-binaries-workflow.test.mjs
+++ b/scripts/build-binaries-workflow.test.mjs
@@ -54,7 +54,8 @@ test("the public release orchestrator enforces paired private promotion", () =>
   assert.match(workflow, /fetch-depth: 0/);
   assert.match(workflow, /Verify private revision passed paired promotion branch/);
   assert.match(workflow, /REQUIRED_PRIVATE_BRANCH:[\s\S]*?'main'[\s\S]*?'stage'/);
-  assert.match(workflow, /git merge-base --is-ancestor/);
+  assert.match(workflow, /required_private_head="\$\(git rev-parse "origin\/\$REQUIRED_PRIVATE_BRANCH"\)"/);
+  assert.match(workflow, /\[\[ "\$RELEASE_PRIVATE_SHA" != "\$required_private_head" \]\]/);
 });
 
 test("paired private checkout never dirties the public package provenance worktree", () => {

From 6632790b9a2692bfa83d21175975080f78900b3c Mon Sep 17 00:00:00 2001
From: Erik <262919414+try-works@users.noreply.github.com>
Date: Mon, 31 Aug 2026 22:14:54 +0800
Subject: [PATCH 2/2] style(release): format provenance contract test

---
 scripts/build-binaries-workflow.test.mjs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/build-binaries-workflow.test.mjs b/scripts/build-binaries-workflow.test.mjs
index 526e0597..630380c1 100644
--- a/scripts/build-binaries-workflow.test.mjs
+++ b/scripts/build-binaries-workflow.test.mjs
@@ -54,7 +54,10 @@ test("the public release orchestrator enforces paired private promotion", () =>
   assert.match(workflow, /fetch-depth: 0/);
   assert.match(workflow, /Verify private revision passed paired promotion branch/);
   assert.match(workflow, /REQUIRED_PRIVATE_BRANCH:[\s\S]*?'main'[\s\S]*?'stage'/);
-  assert.match(workflow, /required_private_head="\$\(git rev-parse "origin\/\$REQUIRED_PRIVATE_BRANCH"\)"/);
+  assert.match(
+    workflow,
+    /required_private_head="\$\(git rev-parse "origin\/\$REQUIRED_PRIVATE_BRANCH"\)"/,
+  );
   assert.match(workflow, /\[\[ "\$RELEASE_PRIVATE_SHA" != "\$required_private_head" \]\]/);
 });