chore(api): align initial policy-pin review with active main

.castiron.stats.yml

@@ -1,8 +1,8 @@
 schema_version: 1
-generation_id: f664572a-7dc0-499b-9a19-46357300068f
+generation_id: 7b8e4f9d-66bd-465d-97d2-cbe0f41aadaf
 openapi_spec_hash: 28504532afa0c3f477f005e641ec7d6d
 openapi_transformed_spec_hash: 13422b63a47a5d25533cf55573de7632
 config_hash: 4446d9cc8e7a00d29ce72282aa5616f9
-codegen_sha: 46b4c0fbaf91c9d178f4b29d2fed8a03794b5662
-codegen_hash: 753430c43af080e5995298094195c43f14ec9db4b146a14c7e33bf2c2d12df8b
-public_codegen_sha: 89db964dcda3fa55c381ce03108f5d46b61279eb
+codegen_sha: b231d2133bce32566450e5544a3205825be270b7
+codegen_hash: bafe248e46487a4eb8ea6868d7fa57e6453e489bf7522869c0ad8eb8125e247d
+public_codegen_sha: bb32fa596d2a5e59ed4b7a908aebcdf347cced9d

.github/workflows/castiron-custom-code-comment.yml

@@ -79,7 +79,7 @@ jobs:
               if (!proposedChecker || !/^[0-9a-f]{40}$/.test(previousChecker || '') ||
                   !/^[0-9a-f]{40}$/.test(mainSha || '')) return true;
               const [previous, proposed, previousBase, proposedBase] = await Promise.all([
-                targetPolicy.next_policy ? readPolicy(previousChecker) : targetPolicy,
+                readPolicy(previousChecker),
                 readPolicy(proposedChecker), mergeBase(previousChecker, proposedChecker),
                 mergeBase(proposedChecker, mainSha),
               ]);

scripts/castiron/CUSTOM_CODE.md

@@ -210,7 +210,8 @@ base, never the candidate. Pin-only updates and initial pin adoption use ordinar
 CODEOWNERS and required reviews when the pin does not roll back to an older main
 checker, the effective pinned budget stays the same or decreases, and its schema,
 strictness and ratchet mode stay unchanged. Initial adoption compares checker age
-with authenticated bootstrap main; later updates compare with the current protected
+and effective policy with authenticated bootstrap main, not the unpinned target's
+local policy fields; later updates compare with the current protected
 target pin and effective policy, even for stale PRs. A
 checker rollback, an effective pinned-budget increase or mode transition, a local numeric budget increase, or Go
 ratchet activation still requires an exact-head human approving review from a

scripts/castiron/custom_code_policy.py

@@ -278,8 +278,9 @@ def select_policy(
                 repo, next_policy_sha(repo, repository, candidate, authenticated_main)
             )
             # Authored changes come from the merge base, but their safety must be
-            # measured against the protected target that will actually be replaced.
-            previous = read_policy(repo, policy) if "next_policy" in base_policy else base_policy
+            # measured against the active policy: the protected target's pin, or
+            # authenticated main during bootstrap.
+            previous = read_policy(repo, policy)
             # Bootstrap executes authenticated main; initial adoption must not silently
             # replace it with older checker code, even when policy fields match.
             previous_checker = (

scripts/castiron/generated-files.json

@@ -3,7 +3,7 @@
   "files": {
     ".github/workflows/castiron-custom-code-comment.yml": {
       "mode": "100644",
-      "sha256": "afebb2d21c7b322905e67452004da087d5bd3f60fc3c0cc11d9bccad9900103d"
+      "sha256": "a896f4bac69c6f8debe7b4bf540129466be04cb62b75c60f5f80a37f5739b0a5"
     },
     ".github/workflows/castiron-custom-code.yml": {
       "mode": "100644",
@@ -15911,7 +15911,7 @@
     },
     "scripts/castiron/CUSTOM_CODE.md": {
       "mode": "100644",
-      "sha256": "c0315b363849bcebb2819d07ed84615db47f03132ad3f59f1fcdfcf9ffad2ece"
+      "sha256": "e7ac634501e8f21144cc5678539282b50b64830a0455b5b840f8ca4010033d3b"
     },
     "scripts/castiron/README.md": {
       "mode": "100644",
@@ -15923,7 +15923,7 @@
     },
     "scripts/castiron/custom_code_policy.py": {
       "mode": "100755",
-      "sha256": "b1425b2c9c5fcf47897c266776fbd1ce28f98df1cfd8af492335589a707f840a"
+      "sha256": "c0c4d5191b90880c881675816ec18ea0bd4b078838ef663513159b2d157edb47"
     },
     "scripts/castiron/custom_code_report.py": {
       "mode": "100755",
@@ -15951,11 +15951,11 @@
     },
     "scripts/castiron/test_custom_code_policy.py": {
       "mode": "100644",
-      "sha256": "5de73d64a2f89a4b7bd805f59f0c6a6d29452866ef050c1191e04a8c48e6db25"
+      "sha256": "22405957bac59e79943a3ea5c72a5657cea5ae3b3b7a5d9ed80966edf2e94b23"
     },
     "scripts/castiron/test_custom_code_publication.py": {
       "mode": "100644",
-      "sha256": "4e9077ffc214685e49d4156163eaf904e650bc9ed82ecbdb03a19fc22bd4fbbf"
+      "sha256": "8548acaf8958bf745759ba5c7a08791cb72793aa0a780d027a2a686e0464ac8e"
     },
     "scripts/castiron/test_custom_code_report.py": {
       "mode": "100644",

scripts/castiron/test_custom_code_policy.py

@@ -475,20 +475,21 @@ def test_pin_effective_policy_review_for_pr_and_queue(self) -> None:
                 self.head = self.commit("request pin without changing local budget")
                 for heads in (None, [self.head]):
                     with self.subTest(proposed=proposed, bootstrap=bootstrap, heads=heads):
+                        needs_proof = requires_human and not bootstrap
                         with mock.patch.object(
                             selector,
                             "require_human_policy_review",
                             side_effect=ValueError("human review missing"),
                         ) as review:
-                            if requires_human:
+                            if needs_proof:
                                 with self.assertRaisesRegex(ValueError, "human"):
                                     self.select(base=base, main=newer, pull_heads=heads)
                                 review.assert_called_once_with(REPO, self.head)
                             else:
                                 result = self.select(base=base, main=newer, pull_heads=heads)
                                 review.assert_not_called()
                                 self.assertEqual(result["policy_reviews"], [])
-                        if requires_human:
+                        if needs_proof:
                             with mock.patch.object(
                                 selector.report,
                                 "api",
@@ -606,6 +607,40 @@ def test_initial_older_pin_keeps_human_proof_for_pr_and_queue(self) -> None:
                         [{"number": 3, "head_sha": self.head}] if pin_sha == self.main else [],
                     )
 
+    def test_bootstrap_uses_active_main_policy_for_pr_and_queue(self) -> None:
+        self.git("checkout", "-q", "--detach", self.main)
+        self.write_policy(
+            {"schema_version": 2, "max_custom_patch_lines": 0, "generated_files": "strict"}
+        )
+        current = self.commit("main activates strict zero policy")
+        self.git("update-ref", "refs/remotes/origin/main", current)
+        for proposed in (self.main, current):
+            self.git("checkout", "-q", "--detach", self.main)
+            self.write_policy(
+                {**self.policy, "next_policy": {"repository": REPO, "main_sha": proposed}}
+            )
+            self.head = self.commit("initial pin with unchanged legacy local ceiling")
+            for heads in (None, [self.head]):
+                with self.subTest(proposed=proposed, heads=heads):
+                    with mock.patch.object(selector.report, "api", side_effect=self.review_api([])):
+                        if proposed == self.main:
+                            with self.assertRaisesRegex(ValueError, "human"):
+                                self.select(base=self.main, main=current, pull_heads=heads)
+                        else:
+                            result = self.select(base=self.main, main=current, pull_heads=heads)
+                            self.assertEqual(result["policy_reviews"], [])
+                            self.assertEqual(result["policy_sha"], current)
+                    with mock.patch.object(
+                        selector.report, "api", side_effect=self.review_api([self.approved()])
+                    ):
+                        result = self.select(base=self.main, main=current, pull_heads=heads)
+                        self.assertTrue(result["bootstrap"])
+                        self.assertEqual(result["policy_sha"], current)
+                        self.assertEqual(
+                            result["policy_reviews"],
+                            [{"number": 3, "head_sha": self.head}] if proposed == self.main else [],
+                        )
+
     def test_incapable_policy_is_not_executed(self) -> None:
         self.git("checkout", "-q", "--detach", self.main)
         (self.repo / "scripts/castiron/custom_code_budget.py").write_text(

scripts/castiron/test_custom_code_publication.py

@@ -1486,13 +1486,22 @@ def test_initial_pin_at_current_main_keeps_statuses(self) -> None:
         payload = self.payload()
         checker = "f" * 40
         payload["main_sha"] = checker
-        payload["policies_by_sha"][checker] = payload["policies_by_sha"]["b" * 40]
+        payload["policies_by_sha"]["b" * 40] = {
+            "schema_version": 1,
+            "max_custom_patch_lines": 4000,
+        }
+        payload["policies_by_sha"][checker] = {
+            "schema_version": 2,
+            "max_custom_patch_lines": 0,
+            "generated_files": "strict",
+        }
         payload["policies_by_sha"]["a" * 40] = {
             **payload["policies_by_sha"]["b" * 40],
             "next_policy": {"repository": "openai/example", "main_sha": checker},
         }
         self.assertEqual(self.invoke(payload), [])
         advanced_main = "e" * 40
+        payload["policies_by_sha"][advanced_main] = payload["policies_by_sha"][checker]
         payload["main_sha_sequence"] = [checker, advanced_main]
         payload["main_sha"] = advanced_main
         payload["comparisons"] = {