ci: pin family-dev-handbook reusable workflows to ci-v1 peeled SHA (#245)

[shojikumaru]

Closes #245

Pin the six caty-ai/family-dev-handbook reusable-workflow references from the mutable @ci-v1 tag to its current peeled commit SHA 8430452c1a22943c805ba2a940a75960299cfb2f (tracking tag kept as a trailing # ci-v1 comment), justify release-sync.yml's contents: write next to the pin, and document the pin-roll procedure in docs/engineering.md / docs/engineering.ja.md (hardened per 5-seat review).

Owner-approved posture: SHA pinning (issue-title option, selected 2026-09-01). Note: ci-v1 is an annotated tag — tag object 79bd3f3, peeled commit 8430452c...; uses: pins must use the peeled commit.

Files touched (= WIP declaration, 8 files)

• .github/workflows/test-lint.yml
• .github/workflows/gitleaks.yml
• .github/workflows/history-check.yml
• .github/workflows/pr-size.yml
• .github/workflows/review-labels.yml
• .github/workflows/release-sync.yml
• docs/engineering.md
• docs/engineering.ja.md

git diff --stat origin/main...c257fca = exactly these 8 files (47 insertions / 12 deletions across 2 commits). No undeclared files.

完了記録 (L1-7)

候補 commit SHA: c257fca (= PR head at review completion; 5fcae53 implementation + c257fca docs-hardening delta)

Done when → PASS/FAIL

1. Six callers pinned to a full commit SHA with tracking-tag comment — PASS.
   Evidence (2026-09-01): git ls-remote https://github.com/caty-ai/family-dev-handbook.git 'refs/tags/ci-v1*' → 79bd3f30... refs/tags/ci-v1 (tag object) / 8430452c... refs/tags/ci-v1^{} (peeled commit). All six uses: lines carry @8430452c1a22943c805ba2a940a75960299cfb2f # ci-v1; grep 'yml@ci-v1' .github/ -r → 0 hits. All six reusable-*.yml exist at that commit (gh api 'repos/caty-ai/family-dev-handbook/contents/.github/workflows?ref=8430452c...' → 6 files). Independently re-derived by all 5 review seats.
2. release-sync.yml permissions re-reviewed; contents: write justified next to the pin — PASS.
   Evidence: reusable workflow at the pinned SHA declares permissions: contents: write and runs gh release create --verify-tag; it contains zero uses: steps and no checkout (write token never crosses into tag-controlled code — verified by Opus/GLM/Kimi/Grok seats independently). Justification comment added at release-sync.yml:12. Narrowing impossible (caller cannot grant less than the callee declares).
3. Documented pin-roll procedure — PASS.
   Evidence: docs/engineering.md "Updating CI reusable-workflow pins" + ja mirror (6 steps, en/ja parity verified by 5 seats + delta pass): ls-remote → peeled ^{} copy (annotated-tag trap named) → existence check + upstream diff review at the new SHA → permissions re-check → 5-of-6 PR-probe scope + risk-reviewed process note → merge-after-green + release-sync verification at next v* tag. Anti-rot: manual detection stated honestly (no automation claimed).
4. All six workflows pass on a probe PR — PASS (5 of 6 on this PR; release-sync structurally tag-only).
   Evidence: this PR's CI on head c257fca: gitleaks PASS / history-check PASS / pr-size PASS / test-lint (lint PASS 6s / test PASS 22m4s / test-macos PASS 29m56s) / risk-review-gate detect+labels PASS — all five PR-triggered reusable workflows resolved and executed at the pinned SHA. release-sync triggers only on v* tag push (on.push.tags); verified at this lane's own release tag immediately after merge (release 欄参照). The risk-review-gate / risk-review-gate red before the roster label is the repo's human gate on .github/workflows/* (annotation: "high-risk paths changed but the risk-reviewed label is not present"), not a resolution failure.

宣言ファイル集合と diff の照合

git diff --stat origin/main...c257fca → exactly the 8 declared files above; nothing in the diff is outside the declaration.

実装者 / レビュアー

• Implementer: Codex GPT-5.6 Sol (--profile sol, sessions: implementation + delta resume), orchestration/inspection: Alpha (Claude Fable 5, session 29e8c072).
• 5-seat heterogeneous review (high-risk area: required merge-gate / supply-chain boundary → 5 seats per L1-11), blind, fresh-context, read-only, on candidate 5fcae53:
  • Opus 5 (requested opus / actual claude-opus-5, Agent seat): GO-WITH-CHANGES → delta pass on c257fca: CUMULATIVE GO
  • GLM 5.3 (requested/actual glm-5.3): GO
  • Grok 4.6 (requested/actual grok-4.6): GO
  • Kimi K3 (requested/actual kimi-k3): GO
  • Codex GPT-5.6 Sol (same-family-as-writer seat under the recorded correlated-seats exception, review_council 2026-08-12, 6-field record; fresh read-only session): GO-WITH-CHANGES → delta pass on c257fca: CUMULATIVE GO
• Adjudication: CRITICAL 0 / MAJOR 1 (Codex: release-sync verification gap in docs — 3-seat convergence with Kimi/Grok MINORs) / adopted 4 changes, all docs-only, shipped as c257fca. Follow-up out-of-scope finding (4 seats): repo-state.yml mutable ref → issue CI: repo-state.yml pins caty-ai/family-os reusable workflow at mutable tag @v0.13.1 (contents: write, secrets: inherit) with no accepted-posture record #256.
• Review records: seat outputs archived in session scratchpad seats-245/; this record is the canonical inline summary.

CI 状態

Head c257fca (2026-09-01): gitleaks PASS / history-check PASS / pr-size PASS / repo-state PASS / test-lint lint+test+test-macos PASS (22m4s / 29m56s) / risk-review-gate detect-risk-paths + apply-visibility-labels PASS. Only red: risk-review-gate / risk-review-gate — pending the roster human's risk-reviewed label (this PR touches .github/workflows/* high-risk paths by design; annotation: "high-risk paths changed but the risk-reviewed label is not present"). No unrelated red.

release

• release: v0.23.7 (annotated tag + GitHub Release via release-sync on tag push — the tag push also completes Done-when 4's release-sync verification)
• previous release: v0.23.6 — 履行済み (https://github.com/caty-ai/caty-agent-harness/releases/tag/v0.23.6 — verified existing, published 2026-08-31)

🤖 Generated with Claude Code

[shojikumaru]

レビュー記録（L1-9/L1-10/L1-11・高リスク領域=異種5席）

対象: 候補 5fcae53（r1）→ 採用 delta 反映後 c257fca（累積）。全席ブラインド・fresh-context・read-only 起動。writer=Codex GPT-5.6 Sol。

席	requested	actual	r1 verdict	累積 verdict (c257fca)
Opus 5 (Agent 席)	opus	claude-opus-5	GO-WITH-CHANGES（flip=posture 文の事実誤り）	CUMULATIVE GO（flip 字義充足を実測確認・ローカルスイート 43 PASS 追補あり）
GLM 5.3	glm-5.3	glm-5.3	GO（MINOR 1 / INFO 3）	—（blocking なしのため delta 対象外）
Grok 4.6	grok-4.6	grok-4.6	GO（MINOR 2 / INFO 2）	—（同上）
Kimi K3	kimi-k3	kimi-k3	GO（MINOR 2 / INFO 3）	—（同上）
Codex GPT-5.6 Sol	codex-sol	gpt-5.6-sol	GO-WITH-CHANGES（MAJOR 1=release-sync 検証欠落）	CUMULATIVE GO（flip verbatim 充足確認）

• correlated-seats 例外の適用明記: Codex 席は writer と同系統。review_council 5（2026-08-12・オーナー承認済み 6 フィールド例外レコード: scope=writer=codex-sol の5席パネル / pair=codex-sol×codex-sol / approved_by=翔さん / date=2026-08-12 / writer条件=codex-sol）に基づく着席。席自体は fresh な read-only セッションで、実装セッションとは別。
• 裁定: CRITICAL 0 / MAJOR 1 / 収束 MINOR 2系統（3〜4席独立収束）→ 採用4点すべて c257fca（docs 2ファイルのみ）で反映。スコープ外残差（repo-state.yml 可変参照・4席言及）は CI: repo-state.yml pins caty-ai/family-os reusable workflow at mutable tag @v0.13.1 (contents: write, secrets: inherit) with no accepted-posture record #256 起票で追跡。
• 席の一次成果物はセッション scratchpad seats-245/（glm-review.md / kimi-review.md / grok-raw.out / codex-review.md / codex-delta-verdict.md / Opus=Agent 応答）。
• 席数の根拠: 高リスク領域（required merge gate=公開前ゲート/供給網境界）→ L1-11 の5席床。loom-seats 決定論導出（size=M / risk=release-gate / fable-5 quota 欠席→kimi-k3 代替・selection_fn_version=7）。