Guard progress state against stale branch heads

docs/development/architecture.mdx

@@ -28,6 +28,17 @@ bot-owned plan, direct-answer, and current or legacy welcome markers. An unavail
 closed by omitting the welcome. An unchanged stored recommendation is projected
 again so the status reconciler can adopt, preserve, or recreate its plan card.
 
+Commit-derived progress crosses an additional source-freshness boundary. A
+provider-neutral application port reads the authoritative branch `HEAD`; the
+progress workflow snapshots it before agent analysis and checks it again
+immediately before changing issue or PR labels. The status-card reconciler
+rechecks that same expected object ID before every create or update. A push
+event or CLI workspace whose source is already old is discarded before agent work. A branch that
+advances during the run produces a successful, skipped `stale-source` outcome,
+leaves native state and conversation state untouched, and is explained only in
+the Job Summary. Git object-ID validation accepts canonical SHA-1 and SHA-256
+forms; Octokit and credentials remain confined to the data/composition layers.
+
 Repository-facing language follows the same boundary. Entrypoints build one
 canonical, frozen locale profile: `repository-locale` defaults to `en-US`, and
 empty issue or pull-request overrides inherit it. Presentation policies request

docs/features.mdx

@@ -127,7 +127,7 @@ Codex is the default runtime for the repository's AI feature paths. OpenCode and
 
 | Feature | Where it runs | Description |
 |--------|----------------|-------------|
-| **Check progress** | Push (commit) pipeline; optional single action `check_progress_action` / CLI `check-progress` | Compares issue vs branch diff, updates progress labels, and reconciles one issue progress card only when its semantic projection changes. It does not post per-commit narration. |
+| **Check progress** | Push (commit) pipeline; optional single action `check_progress_action` / CLI `check-progress` | Compares issue vs branch diff, updates progress labels, and reconciles one issue progress card only when its semantic projection changes and the analyzed branch `HEAD` is still current. Stale results change nothing and are explained in the Job Summary. It does not post per-commit narration. |
 | **Bugbot (potential problems)** | Push (commit) pipeline; optional single action `detect_potential_problems_action` / CLI `detect-potential-problems` | Analyzes branch vs base and posts bounded findings near code plus one concise aggregate status card. A clean full-coverage card omits empty tables and technical detail; incomplete coverage names an effective recovery action instead of requesting identical rechecks. |
 | **Do user request** | Issue comment; PR review comment | When you comment asking to perform a change in the repo (or use `/copilot implement <request>`), the configured agent applies the changes in the workspace, runs verify commands, and the action commits and pushes with a generic message. Organization repositories require an org member; personal repositories require the owner or a `push`/`maintain`/`admin` collaborator. Uses the same `bugbot-fix-verify-commands` and agent CLI setup. |
 | **Think / reasoning** | Issue/PR comment pipeline; single action `think_action` | Deep code analysis and change proposals (configured agent CLI). On GitHub, returns one sanitized, correlated semantic answer to an explicit `/copilot` command or exact bot mention; Think itself has no comment mutation capability. In the CLI, it prints the answer locally and `--issue` is optional context. |
@@ -151,6 +151,10 @@ description refreshes, pushes, reopens, merges, and closes do not create a
 generic roll-up. The Job Summary keeps aggregate result counts and expands only
 safe error recovery evidence; internal result names, step narration, and arbitrary
 error text remain in logs.
+Progress is guarded twice against branch movement: before native label writes
+and before every progress-card mutation. This also applies to the on-demand
+Action and repository-aware CLI because both snapshot the authoritative remote
+branch before analysis.
 Hidden markers provide stable identity and are trusted only when the comment is
 authored by the configured bot. Decorative image inputs default to `false` and
 are deprecated.

docs/issues/notifications-and-auto-close.mdx

@@ -16,6 +16,12 @@ current progress, an action, a direct answer, or a terminal policy explanation.
 When the push workflow runs for a branch linked to an issue, Copilot updates one
 owned progress card only when the progress projection changes. It does not post
 a commit list, image, reopen notice, debug report, or generic “Actions” summary.
+The run snapshots the branch's authoritative GitHub `HEAD` before analysis and
+revalidates it before changing progress labels and again before each card
+mutation. If the event is already old, no agent call is made. If the branch
+advances during analysis or publication, the stale result cannot replace newer
+native or conversation state; the Job Summary shows **Source freshness** with
+the reason that the stale result was suppressed.
 The workflow Job Summary remains the place for bounded operational state. Its
 headings and explanatory labels use `repository-locale` (English by default),
 while event names, lifecycle values, error codes, and other machine facts remain
@@ -29,7 +35,8 @@ locales plus exact, base-language, dynamic, or English-fallback catalog evidence
 - **Where:** the issue associated with the branch (for example,
   `feature/123-title` → issue `123`).
 - **Identity:** one hidden, bot-owned semantic marker identifies the progress
-  card. Equivalent retries create or update nothing.
+  card and records the analyzed branch-head object ID. Equivalent retries
+  create or update nothing.
 - **Content:** outcome, current status, and the next useful action only. Agent
   reasoning and internal step names are excluded.
 

docs/single-actions/available-actions.mdx

@@ -13,7 +13,7 @@ These actions need **`single-action-issue`** set to the issue number. The workfl
 
 | Action | Required inputs | Description | When to use |
 |--------|-----------------|-------------|-------------|
-| **`check_progress_action`** | `single-action-issue` | Runs **progress check** on demand. The configured agent compares the issue description with the branch diff, updates the **progress** label (0–100%) on the issue and any open PR for that branch, and creates or updates one progress card. | Progress is normally updated on every **push** (commit workflow). Use this to re-run without pushing, or when you don’t use the push workflow. |
+| **`check_progress_action`** | `single-action-issue` | Runs **progress check** on demand. The configured agent compares the issue description with the branch diff, updates the **progress** label (0–100%) on the issue and any open PR for that branch, and creates or updates one progress card. It snapshots the remote branch `HEAD` before analysis and suppresses every mutation if that source changes. | Progress is normally updated on every **push** (commit workflow). Use this to re-run without pushing, or when you don’t use the push workflow. Check out the branch you intend to assess; an absent remote branch fails closed. |
 | **`detect_potential_problems_action`** | `single-action-issue` | **Bugbot:** the configured agent analyzes the branch vs base and reports findings on the issue when no PR exists, or in one summarized review on an open PR; updates stored findings and resolves PR threads when findings are fixed. | Same as push-time Bugbot but on demand. See [Bugbot](/bugbot). |
 | **`recommend_steps_action`** | `single-action-issue` | Uses the configured agent's analysis role to recommend **implementation steps** from the issue description and creates or updates one bounded plan card. | When you want a one-off suggestion for how to implement the issue. |
 | **`publish_issue_comment`** | `single-action-issue`, `single-action-message` | Creates a Markdown comment. With `single-action-comment-id`, it replaces that issue comment by default; set `single-action-comment-mode: append` to preserve its current content and append the message. | Reusable workflow notifications such as release or hotfix failures. |

docs/single-actions/workflow-and-cli.mdx

@@ -328,6 +328,13 @@ The first version deliberately scopes reconciliation to workflow templates. Bran
 ### `copilot check-progress`
 
 Checks the progress of an issue from the selected branch and updates the progress label on the issue and its related open pull requests.
+The command sends the current workspace object ID, verifies that it matches the
+selected remote branch `HEAD` before agent analysis, then revalidates that
+remote snapshot before changing labels. The shared publisher performs the
+same check before each progress-card mutation in GitHub Actions. If the branch
+advances, the run succeeds as **No changes**, the stale result is suppressed,
+and newer state remains untouched. The selected branch must therefore exist on
+the configured GitHub remote.
 
 | Option | Required | Default | Description |
 | --- | --- | --- | --- |

scripts/coverage-budgets.json

@@ -240,6 +240,33 @@
       ],
       "successMessage": "execution-boundary closure coverage: PASS (changed path 95% lines/statements, 90% branches/functions)"
     },
+    {
+      "name": "Semantic publication freshness",
+      "missingEntryLabel": "semantic publication freshness",
+      "rules": [
+        {
+          "files": [
+            "src/domain/git_object_id.ts",
+            "src/application/policies/publication_outcome_policy.ts"
+          ],
+          "mode": "each",
+          "thresholdProfile": "exhaustive"
+        },
+        {
+          "files": [
+            "src/application/policies/semantic_result_publication_policy.ts",
+            "src/application/usecases/actions/check_progress_workflow.ts",
+            "src/application/usecases/steps/common/publish_resume_workflow.ts",
+            "src/application/usecases/steps/common/status_card_publication_workflow.ts",
+            "src/data/repository/github_publication_source_repository.ts",
+            "src/infrastructure/composition/shared_capability_port_binding.ts"
+          ],
+          "mode": "aggregate",
+          "thresholdProfile": "default"
+        }
+      ],
+      "successMessage": "semantic publication freshness coverage: PASS (object-id/outcome policies 100%; guarded path 95% lines/statements, 90% branches/functions)"
+    },
     {
       "name": "Repository localization",
       "missingEntryLabel": "repository localization",