fix(ci): validate the batch checkpoint as the upstream merge parent

Author: codex

docs/upstream-sync/ci-policy.md

@@ -41,8 +41,8 @@ documents, and tags.
 
 `scripts/ci/check-sync-ancestry.py --checkpoint SHA --target SHA --merge SHA`
 requires full commit IDs, resolves each exact object, proves checkpoint is an
-ancestor of the pinned upstream target, and proves target is in a non-first
-parent's history for the integration merge. Git replacement refs are disabled
+ancestor of the pinned upstream target, and proves the checkpoint is an exact non-first parent of the integration
+merge. Early batches do not need to contain the final campaign target. Git replacement refs are disabled
 for these graph checks, so a synthetic replacement cannot manufacture the
 ancestry claim. The helper is local/manual and does not run hosted Actions.
 Jenkins runs its self-test, which constructs true and replacement-ref-faked
@@ -58,7 +58,7 @@ python3 scripts/ci/check-github-actions-policy.py
 python3 scripts/ci/test_github_actions_policy.py
   Ran 4 tests; OK (real workflows plus positive/negative fixtures)
 python3 scripts/ci/test_sync_ancestry.py
-  Ran 3 tests; OK (true ancestry, replacement-ref spoof, invalid inputs)
+  Ran 5 tests; OK (early checkpoint, exact parent, replacement-ref spoof, invalid inputs)
 git diff --check
   passed
 ```

scripts/ci/check-sync-ancestry.py

@@ -31,10 +31,8 @@ def verify(checkpoint: str, target: str, merge: str) -> None:
     parents = git("rev-list", "--parents", "-n", "1", merge).split()[1:]
     if len(parents) < 2:
         raise ValueError("result is not a merge commit")
-    if not any(subprocess.run(["git", "merge-base", "--is-ancestor", target, parent],
-                              env=os.environ | {"GIT_NO_REPLACE_OBJECTS": "1"},
-                              check=False).returncode == 0 for parent in parents[1:]):
-        raise ValueError("pinned target is not in a non-first merge-parent history")
+    if checkpoint not in parents[1:]:
+        raise ValueError("checkpoint is not an exact non-first merge parent")
 
 
 def main() -> int:

scripts/ci/test_sync_ancestry.py

@@ -46,7 +46,22 @@ def git(self, *args):
                                        text=True, stderr=subprocess.PIPE).strip()
 
     def test_accepts_real_checkpoint_and_second_parent(self):
-        ancestry.verify(self.base, self.target, self.merge)
+        ancestry.verify(self.target, self.target, self.merge)
+
+    def test_accepts_early_checkpoint_before_campaign_target(self):
+        self.git("checkout", "-q", "side")
+        self.git("commit", "--allow-empty", "-qm", "later campaign target")
+        campaign_target = self.git("rev-parse", "HEAD")
+        ancestry.verify(self.target, campaign_target, self.merge)
+
+    def test_rejects_first_parent_or_wrong_checkpoint(self):
+        with self.assertRaises(ValueError):
+            ancestry.verify(self.base, self.target, self.merge)
+        self.git("checkout", "-q", "side")
+        self.git("commit", "--allow-empty", "-qm", "unmerged checkpoint")
+        unmerged = self.git("rev-parse", "HEAD")
+        with self.assertRaises(ValueError):
+            ancestry.verify(unmerged, unmerged, self.merge)
 
     def test_rejects_ancestor_claim_using_replacement_ref(self):
         self.git("checkout", "--orphan", "unrelated")