PR 3's re-check survivors are killed: tests/test_release_workflow.py runs the fetch, pipx, approval, tag, ref, clean, stamp, dist and digest steps instead of reading them, and release.yml changes only in comments (#228, PR 3b)

.github/workflows/release.yml

@@ -22,6 +22,10 @@ name: release
 #     `/bin/bash` 3.2, and compiling the payload's two Python commands on
 #     3.9;
 #   - no step reads the release notes (WHAT THIS WORKFLOW NEVER READS).
+# It also holds more than the model where FR-029 and contracts/workflows.md
+# ask for it: the gate names `tests.yml`'s four jobs, the build checks out
+# full history with the submodule, and the ref step fetches the tag again
+# without `--depth`.
 #
 # FOUR JOBS, EACH GATED ON THE ONE BEFORE IT:
 #   build     the version and the repository guard; the tag, the branch, the
@@ -289,7 +293,8 @@ jobs:
         with:
           python-version: '3.12'
 
-      # STEP 1, BEFORE ANYTHING ASKS THE FORGE: THE VERSION, AND THE
+      # STEP 1, THE JOB'S FIRST SCRIPT, AFTER THE CHECKOUT AND THE PYTHON
+      # SETUP AND BEFORE ANY SCRIPT ASKS THE FORGE: THE VERSION, AND THE
       # REPOSITORY GUARD (FR-048). The model has no guard; this one puts
       # Brett Heap's answers on where releases come from into code.
       #
@@ -306,7 +311,7 @@ jobs:
       #   opensoft/openRepoTools       a tag     X.Y.ZrcN  TestPyPI alone
       #   opensoft/openRepoTools       a tag     X.Y.Z     refused
       #   any other repository         a tag     any       refused
-      #   any repository               a branch  any       neither: the rehearsal
+      #   any repository               a branch  any       nothing: the rehearsal
       # The two names are compared exactly, as GitHub spells them in
       # `$GITHUB_REPOSITORY`, so any other spelling is "any other" and fails
       # closed. A ref that is neither a tag nor a branch is refused here too,

specs/006-release-pypi/spec.md

@@ -279,9 +279,9 @@ workflow's stamp writer.
    refuses before any approval is asked, and nothing is uploaded (FR-048).
 9. **Given** an upload job and no approval for its environment, **When** the
    run reaches it, **Then** the job waits, and nothing is uploaded.
-9. **Given** the macOS leg of the install check, **When** it reruns
-   `--install` under `/bin/bash`, **Then** it prints a `BASH_VERSION` of 3.2,
-   and the install succeeds with the same skip and count lines.
+10. **Given** the macOS leg of the install check, **When** it reruns
+    `--install` under `/bin/bash`, **Then** it prints a `BASH_VERSION` of
+    3.2, and the install succeeds with the same skip and count lines.
 
 ---
 
@@ -605,7 +605,9 @@ passages, and the absence of the pipx route.
   - it runs one release at a time, and never cancels one in progress;
   - it is adapted from openRepoShape v1.1.0's (`190133d`), taking over that
     workflow's checks as they are, except where design.md Decision 10 names
-    a difference.
+    a difference, and holding more where FR-029 and contracts/workflows.md
+    ask for it: the gate on `tests.yml`'s four jobs, the build's full-history
+    checkout with its submodule, and the tag fetch without `--depth`.
 - **FR-029**: The build MUST refuse unless every one of these holds:
   - the version is a final `X.Y.Z` other than `0.0.0`, or a pre-release
     `X.Y.ZrcN` bound for TestPyPI;