fix(spec): do not read a shallow checkout as a forged anchor baseRev (#5235)

First CI run on this branch failed every job: `merge-base --is-ancestor` answers
"not an ancestor" in a depth-1 checkout, because the anchor's commit is fetched
as its own shallow root and there is no history to walk between it and the tip.
The ancestry half of the anchor verification therefore rejected a baseRev that
demonstrably IS on main, exactly the way the merge-base fallback a few lines
above already anticipates for the baseline itself.

Ancestry is now judged only where it can be: `rev-parse --is-shallow-repository`
gates it, and a shallow run says so and verifies the recorded KEYS alone — the
half truncation cannot take away, since the fetched commit's tree is present.
A full clone (every dev checkout — where the anchor is regenerated, and where a
hand-edit is therefore caught) still checks both.

Two tests pin it, using `$GIT_DIR/shallow` to truncate the sandbox repo exactly
as `--depth=1` does: a lagging-but-authentic anchor stays green, and a shed line
still goes red there.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ErbEDVAg1No9gdg1pgDAGB

Author: claude

packages/spec/scripts/build-schemas-check-mode.test.ts

@@ -729,6 +729,58 @@ describe('build-schemas.ts — an in-tree anchor carries the deletion gate offli
     },
   );
 
+  it(
+    'does not mistake a shallow checkout for a forged baseRev — CI is shallow, and ancestry there is unwalkable',
+    { timeout: SPAWN_TIMEOUT_MS },
+    () => {
+      // The shape that broke this change's own first CI run. CI checks out
+      // depth 1, the anchor's commit is fetched as its own shallow root, and
+      // `merge-base --is-ancestor` then answers "not an ancestor" about a commit
+      // that plainly is one. Trusting that answer fails every build.
+      //
+      // `$GIT_DIR/shallow` is what makes a repository shallow, so writing the
+      // current tip into it truncates history exactly the way `--depth=1` does —
+      // no clone, and `git show BASEREV:file` still works, which is what keeps
+      // the KEYS half of the verification alive here.
+      const older = head;
+      const tip = seedBase((s) => s);
+      seedSurface((s) => s);
+      seedSurfaceBase(older, (k) => k);
+      fs.writeFileSync(path.join(sandbox, '.git', 'shallow'), `${tip}\n`);
+      try {
+        expect(git('rev-parse', '--is-shallow-repository')).toBe('true');
+        const { status, output } = run(['--check']);
+
+        expect(output).toContain('shallow checkout');
+        expect(output).not.toContain('NOT an ancestor of');
+        expect(status).toBe(0);
+      } finally {
+        fs.rmSync(path.join(sandbox, '.git', 'shallow'), { force: true });
+      }
+    },
+  );
+
+  it(
+    'still compares the anchor keys in a shallow checkout — the half that survives truncation',
+    { timeout: SPAWN_TIMEOUT_MS },
+    () => {
+      const older = head;
+      const tip = seedBase((s) => s);
+      seedSurface((s) => s);
+      seedSurfaceBase(older, (k) => k.filter((x) => x !== SHED_FROM_ANCHOR));
+      fs.writeFileSync(path.join(sandbox, '.git', 'shallow'), `${tip}\n`);
+      try {
+        const { status, output } = run(['--check']);
+
+        expect(status).toBe(1);
+        expect(output).toContain('is not the baseline it claims to be');
+        expect(output).toContain(SHED_FROM_ANCHOR);
+      } finally {
+        fs.rmSync(path.join(sandbox, '.git', 'shallow'), { force: true });
+      }
+    },
+  );
+
   it(
     'is a committed artifact: --check reports it missing without writing it, gen:schema creates it from the git baseline',
     { timeout: SPAWN_TIMEOUT_MS * 2 },

packages/spec/scripts/build-schemas.ts

@@ -860,14 +860,16 @@ type GitRun = (...args: string[]) => { status: number | null; stdout: string; st
  * commit under test controls:
  *
  *   1. `baseRev` is an ancestor of origin/main — a PR cannot point it at one of
- *      its own commits, because its own commits are not upstream;
- *   2. the recorded keys ARE that commit's `authorable-surface.json` keys.
+ *      its own commits, because its own commits are not upstream. Decidable only
+ *      where history is walkable, so a shallow checkout says so and skips it;
+ *   2. the recorded keys ARE that commit's `authorable-surface.json` keys. This
+ *      one holds everywhere the object can be read, shallow included.
  *
  * Together those make hand-editing the anchor pointless: the only way to shed a
  * line from it is to shed the line from an already-merged upstream commit, which
- * a PR cannot do. A shallow clone may not hold the object; the run then says so
- * and continues, because in that environment the merge-base anchor — not this
- * file — is what the deletion check ran on anyway.
+ * a PR cannot do. A shallow clone may not hold the object at all; the run then
+ * says so and continues, because in that environment the merge-base anchor — not
+ * this file — is what the deletion check ran on anyway.
  */
 function verifyCommittedSurfaceBase(
   git: GitRun,
@@ -904,7 +906,18 @@ function verifyCommittedSurfaceBase(
     );
     return;
   }
-  if (git('merge-base', '--is-ancestor', rev, tip).status !== 0) {
+  // Ancestry is only decidable where history is WALKABLE. CI checks out shallow
+  // (depth 1) and the fetch above grafts `rev` as its own shallow root, so
+  // `merge-base --is-ancestor` answers "not an ancestor" for a commit that
+  // demonstrably is one — the same truncation the merge-base fallback above
+  // already accounts for, and it fails the whole build if trusted (caught on this
+  // change's own first CI run). Ask whether the answer can mean anything first.
+  if (git('rev-parse', '--is-shallow-repository').stdout.trim() === 'true') {
+    console.log(
+      `ℹ️  ${SURFACE_BASE_FILE_NAME}: shallow checkout — cannot walk history to confirm ${short} is\n` +
+        `   on origin/main, so only its recorded keys are verified here (#5235). A full clone checks both.`,
+    );
+  } else if (git('merge-base', '--is-ancestor', rev, tip).status !== 0) {
     console.error(
       `\n❌ ${SURFACE_BASE_FILE_NAME} names a baseRev (${short}) that is NOT an ancestor of\n` +
         `   origin/main (#5235).\n\n` +