[Antawari]

Why

The brief I was given said the shared workflow checks out the kit "with no ref". That is not true of kit main. quality-gate.yml passes ref: ${{ github.job_workflow_sha }}, and since e842029 a step named "Honor the consumer's declared kit pin" re-anchors the kit checkout to the SHA the consumer committed, refusing to run when there is no pin or more than one.

What a CI log actually showed (a consumer run today, 22:16Z): the ref rendered empty and the kit was fetched at main. That consumer pins the shared workflow at a commit older than e842029, so it runs a workflow that has no re-anchor step. A consumer pinned after e842029 logs "kit checkout already rides the declared pin". The fix for that consumer is a pin bump in the consumer repo, which is outside this PR.

That left two real gaps here, and this PR closes both:

1. The re-anchor step was unrodded. Only a string check on the checkout's ref guarded it, so deleting or reordering the step stayed green. tests/test_kit_pin_reanchor.py runs the step's own script from the parsed YAML against a real git world. It covers: re-anchor to the pin, already on the pin, two pins refused, a repeated pin counted once, no pin and an empty job_workflow_sha refused, and the job_workflow_sha fallback both ways. It also checks the step sits between the kit checkout and the kit install.
2. Kit main is red today with no code change. In tests/test_mirror_check.py, the main() "clean" tests wrote a fixed 2026-06-01 pin while main() judges staleness against the real clock, so they failed once the pin passed 90 days old (it is 124 days old now). Those tests now pin relative to today. Two real-clock controls were added: a pin 91 days old is refused, and a pin exactly 90 days old passes.

Evidence (all run by the conductor)

• Red observed on pristine main: pytest gives 2 failed (test_main_clean_exits_zero, test_clean_emits_passing_verdict_json: MIRROR_PIN_STALE ... 124 days old (max 90)).
• Gate (fresh venv on this tree's exact [dev] pins, PATH scrubbed, no API key): cf-gate passes 10/11 gauges. pytest gives 584 passed, 3 errors. The 3 errors are test_packaging wheel tests, and they are a local-instrument artefact: the uv-built interpreter has no ensurepip, while CI uses setup-python. Read CI on this PR for those three.
• Mutation, re-anchor rod: 9/9 mutants killed (delete or move the step, drop checkout --detach, drop sort -u, let multi-pin through, change the message, two elif edits, remove the final refusal). The workflow's sha256 was verified restored.
• Mutation, time-bomb controls (run against this tree's src/): 3/3 killed (max age 90→200, boundary >→>=, real clock frozen).
• Only test files change. The workflow is byte-identical.
• LawGiver pre-gate: not live.

Operator's hand (not done here)

• Branch protection on main is absent (GET .../branches/main/protection returns 404). A draft command is in the closeout and has not been applied.
• The consumer pinned before e842029 still floats on kit main until its caller stub is bumped. A bump can move gauge verdicts there, so it is the operator's call.

🤖 Generated with Claude Code