🐛 fix(ci): -count=1 on the cache-blind dogfood gates (COUNT1)

.github/workflows/verify.yaml

@@ -37,6 +37,20 @@ jobs:
       # toolchain, so it runs first and fails in seconds.
       - name: workflow supply-chain pins (AUD-S09 — SEC-04)
         run: bash hack/lint/workflow_pins_test.sh
+      - name: dogfood + -count=1 wiring pin (EX-S08 — REQ-EX-S08-02/03)
+        # RELSE-08, following the AUD2-S05 precedent below. This gate otherwise
+        # reaches CI only through `task check` -> release-exitgate, whose
+        # `if: github.event_name != 'pull_request'` means a PR that strips
+        # `-count=1` from THIS FILE would merge green and redden main
+        # afterwards — the gate's own thesis failing to apply to the gate.
+        # Pure text over Taskfile.yml + this workflow, no toolchain, so it
+        # belongs here beside workflow_pins_test.sh and before setup-go.
+        # Keep it argument-free and undisarmed: the script asserts its own step
+        # (section 7) is present, unargumented and free of
+        # `if:`/`continue-on-error:`, so weakening this reddens it. These
+        # comment lines live INSIDE the step on purpose, as the AUD2 step
+        # documents.
+        run: bash hack/examples/dogfood_wiring_test.sh
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable # go.mod stays the minimum; CI runs latest stable (govulncheck needs it)
@@ -99,7 +113,22 @@ jobs:
       - name: dogfood examples (EX-S08 — shared discovery script; every examples/packs/<name> with .assent/tests gates itself green under the real `assent test` CLI)
         run: bash hack/dogfood-examples.sh
       - name: comparison corpus dogfood (PCS-S08 — examples/comparison validates and runs green)
-        run: go test ./examples/comparison/...
+        # -count=1 IS THE GATE, exactly as in Taskfile.yml's dogfood-comparison.
+        # examples/comparison is an EXTERNAL test package referencing only
+        # exported constants from internal/compare, so the compare logic is
+        # unreachable from the test binary the Go cache keys on (the linker
+        # strips it) and the real logic runs in a `go build -o … ./cmd/assent`
+        # subprocess outside the cache key. actions/setup-go restores GOCACHE
+        # across commits, so without this flag this step reports `ok … (cached)`
+        # and contributes NOTHING to the PR: not the JSON-schema validation of
+        # the suite docs, not the corpusGateCoverage gate-ID map, not
+        # TestCompareCorpusGateFailurePath. (The corpus OUTCOME stays defended
+        # on PRs by hack/compare/exitgate_test.sh, which drives the built binary
+        # through bash with no Go test cache in the path.) Fix it HERE, per
+        # invocation — do NOT "fix" it by setting `cache: false` on setup-go:
+        # that would slow every job in every workflow to close one blind
+        # invocation. Pinned by hack/examples/dogfood_wiring_test.sh.
+        run: go test -count=1 ./examples/comparison/...
       - name: PCS compare exit gate (RELSE-03 — REQ-PCS-S09)
         run: bash hack/compare/exitgate_test.sh
       # AUD-S02 (REQ-AUD-S02-02) — CHANGELOG.md drift gate, main + schedule only.

CHANGELOG.md

@@ -97,6 +97,10 @@ repository still gets a decision, never by following the link; no release carrie
 - :bug: fix(audit): measure the REL-03 guard's terminal path, not "a return appears"
 - :bug: fix(audit): assert no fall-through, not where the return sits
 - :bug: fix(audit): require an ALL-of FAIL quorum and refuse bash < 4.3
+- :bug: fix(taskfile): -count=1 on the cache-blind dogfood-comparison and e2e gates
+- :bug: fix(ci): -count=1 on verify.yaml's comparison corpus dogfood
+- :bug: fix(ci): run the -count=1 wiring pin in the PR-visible verify job
+- :bug: fix(ci): pin COUNT1-F01 and refuse a merged gate step
 
 ### Refactoring
 - :recycle: refactor(audit): pin REL-03 and REL-07 by test name, demote source shape

Taskfile.yml

@@ -66,7 +66,22 @@ tasks:
   dogfood-comparison:
     desc: "Dogfood gate (PCS-S08): comparison corpus validates and runs green under assent compare --suite"
     cmds:
-      - go test ./examples/comparison/...
+      # -count=1 IS THE GATE. Without it this stage reports `ok … (cached)` and
+      # exits 0 on a tree where the same test genuinely fails. The Go test cache
+      # keys on the test BINARY's content ID, and examples/comparison is an
+      # EXTERNAL test package that references only exported constants from
+      # internal/compare (GateZeroMissedDestructive, ExitCodeForGate) — the
+      # comparison logic itself is unreachable from that binary and the linker
+      # strips it, so the content ID does not move when internal/compare
+      # changes. The real logic runs in a subprocess the test builds at runtime
+      # (`go build -o … ./cmd/assent`), entirely outside the cache key. Measured
+      # 2026-08-19: deleting `|| e == aggregate.EffectChallenge` from
+      # isStricterInterventionEffect left this stage green-and-cached while
+      # `-count=1` on the identical tree failed with exit status 6. Corpus DATA
+      # edits do invalidate (copyDir os.ReadFile's them, so testlog records
+      # them); production code changes do not. Pinned by
+      # hack/examples/dogfood_wiring_test.sh.
+      - go test -count=1 ./examples/comparison/...
 
   check:
     desc: "Gate: fmt + vet + lint + test + build (must pass before every commit)"
@@ -192,7 +207,15 @@ tasks:
   e2e:
     desc: E2E tests against a real GitLab (build tag e2e) — see test/e2e/README.md
     cmds:
-      - go test -tags e2e ./test/e2e/...
+      # -count=1 for the same reason as dogfood-comparison: this suite's subject
+      # is a PREBUILT bin/assent (test/e2e/skeleton_test.go) driven against a
+      # live GitLab endpoint named by ASSENT_E2E_GITLAB. Neither the binary's
+      # bytes nor the forge's state is in the test cache key, so a cached PASS
+      # would assert nothing about the run the operator just asked for. Costs
+      # nothing: this task is never part of `task check` and the suite skips
+      # unless the endpoint env var is set. Pinned by
+      # hack/examples/dogfood_wiring_test.sh.
+      - go test -count=1 -tags e2e ./test/e2e/...
 
   docs:
     desc: Serve the docs site locally