fix(pipeline): guard GitHub fork PR destinations - #891

Intent

Superseding Decisions

Later recorded decisions take precedence over conflicting wording in the original intent below. Within this list, later entries supersede earlier conflicting entries.

• Authoritative, structure-preserved explicit intent from no-mistakes axi run --intent, no-mistakes rerun --intent, or the existing notify-push push-option intent may authorize publication when PR destination: owner/repo matches the selected parent.

• An intermediate review decision restricted fork-PR authorization to AXI provenance and rejected the direct-push intent transport.

• The final decision restores the first rule: authoritative, structure-preserved explicit intent from AXI, rerun, or notify-push may authorize publication. No AXI-provenance machinery remains.

The final entry is authoritative. It also corrects the earlier cost disclosure: it was overstated to say that direct pushes necessarily validate and push before refusing. Only a bare direct push without authoritative intent takes that late-refusal path; a direct push carrying the existing authoritative notify-push intent can authorize publication. The earlier AXI-only wording in this PR body and review discussion is superseded.

What Changed

• Before any GitHub PR lookup, update, or creation, require the selected parent repository to agree exactly with an explicit PR destination: owner/repo declaration carried by authoritative, structure-preserved run intent.
• Refuse caller-visibly when the destination is missing, malformed, ambiguous, or disagrees with the selected parent, so a parent-plus-fork registration cannot silently default to a public parent PR.
• Preserve the supported fork-head-to-parent-PR path when the explicit destination is the parent, preserve unaffected non-fork behavior, and keep provider-unavailable runs on the existing skip path.
• Preserve exact decision chronology in generated PR bodies: decisions are ordered globally by created_at and stable ID, and repeated A -> B -> A reversals keep the final A.

Closes #884.

Maintainer Reproduction

The maintainer reproduced the defect on current main at 13cdf1aac70e7cd07525e1729f3dd2399bb76217: buildHost in internal/pipeline/steps/host.go selected GitHub --repo from Repo.UpstreamURL, used Repo.ForkURL only for the --head owner, and PRStep could call CreatePR without checking that repository choice against the run's delivery intent. This change implements that already-established diagnosis.

In our own contribution workflow, we do not yet carry a local automatic guard ourselves; we currently check the target manually.

Observable Publication Contract

• Destination validation runs after provider availability but before drafting or any pr list, pr edit, or pr create operation. If gh is absent or unauthenticated, the existing provider-unavailable skip remains unchanged.
• A mismatched fork destination and every unknown, malformed, ambiguous, or legacy structure-unproven destination refuse before publication.
• An explicit parent destination still creates the parent PR with <fork-owner>:<branch> as its head, preserving the upstream-contribution path from fix(scm): no-mistakes cannot ship fork-based contributions — push and PR share one upstream_url, no fork→parent routing #293.
• A bare direct push has no authoritative destination. It may complete validation and push the branch to the fork, then refuse caller-visibly at the PR step. This is intentionally a late publication guard; no earlier push-time failure was implemented.
• axi run --intent, rerun --intent, and the existing notify-push push-option intent are all accepted when they preserve the explicit leading destination structure. Repository topology, issue links, incidental prose, and transcript text do not grant authorization.

Test Evidence

The narrow regression was added first and run against unmodified 13cdf1aac70e7cd07525e1729f3dd2399bb76217 with:

GIT_CONFIG_GLOBAL=/dev/null go test ./internal/pipeline/steps -run 'TestPRStep_GitHubFork(RefusesUnverifiedDestination|CreatesParentPRWithForkHead)$' -count=1

Red before: the mismatch, unknown, and ambiguous cases failed with Execute() error = nil, and the fake GitHub CLI transcript proved PR creation remained reachable. Green after: the same command passed, proving refusal before PR operations and preserving the positive explicit-parent case.

Two executable end-to-end proofs also pass:

go test -tags=e2e ./internal/e2e -run '^(TestForkRouting|TestForkRoutingDirectPushRefusesPRWithoutDestination)$' -count=1 -v

TestForkRouting proves an authoritative explicit parent destination completes with a fork push and parent PR. TestForkRoutingDirectPushRefusesPRWithoutDestination proves a bare direct push completes validation and fork push, then refuses before PR publication. The focused PR-step suite additionally covers the provider-unavailable skip, literal .git repository names, mismatch/unknown/ambiguous refusal, explicit-parent publication, and generated decision chronology.

For the body-history correction, reverting only the chronology implementation reproduced the old A -> B rendering with the final A missing. At 17a39993e318008f859311ccc0242d4e035d2a1c, the focused generated-body test renders A -> B -> A and exactly one live pipeline attestation.

Broad validation completed with make lint, go test ./..., make e2e, and go build -o ./bin/no-mistakes ./cmd/no-mistakes. The managed no-mistakes review, test, document, lint, and push stages completed for exact pushed head 17a39993e318008f859311ccc0242d4e035d2a1c. This PR does not claim a green local go test -race ./...; two attempts hit the repository-documented macOS fork/pre-exec failure in unrelated existing tests.

Scope

This deliberately does not implement issue #552's branch/base binding, add a new push-time destination channel, add authorization/provenance machinery, or redesign unrelated SCM routing. The declaration remains owner/repo; host-qualified destination authorization is a separate follow-up.

Pipeline

Updates from git push no-mistakes

• Review: completed with no remaining findings.
• Test: completed; focused unit, generated-body, and fork-routing E2E proofs passed.
• Document and lint: completed.
• Push: exact head 17a39993e318008f859311ccc0242d4e035d2a1c published from tiago-peixoto:fm/no-mistakes-pr-destination-guard.