fix(workflow): reject abbreviated base SHA identities

[Wibias]

Summary

Reject abbreviated or otherwise non-canonical base SHAs at local-PR workflow bootstrap instead of allowing them to surface later as a misleading checkpoint base mismatch.

Trace evidence

The newest Grok trace invoked bootstrap with the abbreviated base 35b190a05 while the existing checkpoint stored the full base identity. The resulting workflow_bootstrap_checkpoint_base_mismatch sent the agent into checkpoint-recovery investigation even though the immediate caller error was simply a short SHA.

Fix

• validate baseSha with the same exact 40–64 hex identity contract used for headSha
• normalize accepted base identities before storing/comparing them
• fail immediately with workflow_bootstrap_base_invalid for abbreviated input

This prevents a bad bootstrap argument from being mistaken for corrupt or conflicting persisted state.

No merge or release publication is authorized by this PR.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 577246bc-6da1-4c51-90d6-f17c0a98f67c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}