ci: rehearse Base Bash v2 pins

.github/workflows/tests.yml

@@ -40,15 +40,20 @@ jobs:
           tests/native_services_test.bats
           tests/demo_console_test.bats
 
-      # Pin the released Base version that includes language-profile support.
+      # Pin the immutable Base v2 migration revision used by the prerelease
+      # cutover rehearsal. The v2 GA tag is intentionally still gated by
+      # base-bash-libs#215/#240.
       - name: Check out Base
         run: |
-          git clone --depth 1 --branch v1.7.0 https://github.com/basefoundry/base.git ../base
+          git init ../base
+          git -C ../base remote add origin https://github.com/basefoundry/base.git
+          git -C ../base fetch --depth 1 origin f109dbae3e911641b97aaf68eeeedf6ee27d8c18
+          git -C ../base checkout --detach FETCH_HEAD
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: basefoundry/base-bash-libs
-          ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff
+          ref: 7b2db7b644a9e94852cc4bd006e799b516075a38
           path: .dependencies/base-bash-libs
 
       - name: Set up Base
@@ -190,7 +195,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: basefoundry/base-bash-libs
-          ref: bf4deaf077c7de1abf99be6732a36d0e4e12f8ff
+          ref: 7b2db7b644a9e94852cc4bd006e799b516075a38
           path: .dependencies/base-bash-libs
 
       - name: Set up Base with the source provider
@@ -234,12 +239,15 @@ jobs:
 
       - name: Check out Base
         run: |
-          git clone --depth 1 --branch v1.7.0 https://github.com/basefoundry/base.git ../base
+          git init ../base
+          git -C ../base remote add origin https://github.com/basefoundry/base.git
+          git -C ../base fetch --depth 1 origin f109dbae3e911641b97aaf68eeeedf6ee27d8c18
+          git -C ../base checkout --detach FETCH_HEAD
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: basefoundry/base-bash-libs
-          ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff
+          ref: 7b2db7b644a9e94852cc4bd006e799b516075a38
           path: .dependencies/base-bash-libs
 
       - name: Set up Base on Ubuntu

CHANGELOG.md

@@ -84,13 +84,18 @@ and versions are tracked in the repo-root `VERSION` file.
 
 ### Fixed
 
+- Kept the non-interactive observability walkthrough compatible with Base's
+  terminal Markdown and machine-readable history-report renderings.
 - Fixed `src/manifest.sh` grep pattern to include `project:` and `  name:` so
   the project name section appears in `basectl run base-demo manifest` output.
 - Fixed `demo/demo.sh` function definition order so `discovery_step` and
   `diagnostics_step` are defined before `activation_step` calls them.
 
 ### CI
 
+- Updated the Base-backed validation jobs to pin the merged Base v2 migration
+  revision and current base-bash-libs v2 contract by full commit, preserving a
+  reproducible prerelease cutover rehearsal without claiming v2 GA.
 - Updated the pinned base-bash-libs checkout to the v1.4.0 release commit.
 - Updated Base-backed CI to exercise the explicit `project.languages` manifest
   contract from the Base v1.7.0 release with a compatible base-bash-libs pin.

demo/demo.sh

@@ -455,7 +455,11 @@ observability_step() {
   printf '\nGenerating a privacy-conscious activity report for this project.\n'
   report_output="$(capture_command "$BASE_DEMO_BASECTL" history --project "$BASE_DEMO_PROJECT" --limit 5 --report)"
   printf '%s\n' "$report_output"
-  require_contains "history report" "$report_output" "Base Local Activity Report"
+  if [[ "$report_output" != *"Base Local Activity Report"* &&
+    "$report_output" != *"$BASE_DEMO_PROJECT"* ]]; then
+    printf 'ERROR: Expected history report output to identify the selected project.\n' >&2
+    return 1
+  fi
   pause
 }
 

docs/contracts.md

@@ -27,7 +27,7 @@ depend on.
 | `runtime-platform-env` | The `env` command prints `BASE_OS`, `BASE_PLATFORM`, `BASE_HOST_ENV`, and `BASE_HOST` with the other Base runtime values. | `src/env.sh` | `tests/validate.sh`, `tests/demo_test.bats`, `demo/demo.sh` | Learners cannot discover the current Base runtime platform and host-environment contract from base-demo. | Runtime |
 | `installer-checksum` | Downloaded Base installers are verified when `BASE_INSTALL_SHA256` is set and warn when it is empty. | `install.sh` | `tests/install_test.bats` | Pinned installer URLs can execute without checksum verification or a visible warning. | Security |
 | `service-log-permissions` | Process-backed service log files are created or corrected to mode `0600` before writes. | `bin/base-demo-services` | `tests/services_test.bats` | Service logs can expose local process output through permissive file modes. | Security |
-| `ci-pinned-dependencies` | CI uses a pinned Base v1.7.0 release checkout, the SHA-pinned base-bash-libs v1.4.0 release commit, and full SHA-pinned GitHub Actions. | `.github/workflows/tests.yml` | `tests/validate.sh` | CI can drift with Base `main`, an older base-bash-libs release, or mutable action tags instead of validating the intended capability contract. | CI |
+| `ci-pinned-dependencies` | CI uses immutable full commits for the merged Base v2 migration and current base-bash-libs v2 contract, plus full SHA-pinned GitHub Actions. | `.github/workflows/tests.yml` | `tests/validate.sh` | CI can drift with Base `main`, an older base-bash-libs release, or mutable action tags instead of validating the intended prerelease capability contract. | CI |
 | `ubuntu-ci` | The repository has an Ubuntu job that runs `basectl setup base --yes --no-notify`, validates `basectl setup base --profile dev --yes --no-notify`, verifies `bats`/`gh`/`shellcheck`, and runs `basectl check --ci base-demo --format json` against the pinned Base checkout. | `.github/workflows/tests.yml` | `tests/validate.sh`, GitHub Actions `validate-ubuntu` | Ubuntu support can drift from the documented Base setup, dev-profile, and read-only project health boundary. | CI |
 | `platform-boundary` | README and CONTRIBUTING document macOS full-demo support plus Ubuntu/Debian and WSL2 support for Base setup, dev-profile prerequisites, read-only project health checks, repo-location guidance, and the native-Windows non-goal. | `README.md`, `CONTRIBUTING.md` | `tests/validate.sh` | Developers on Linux or WSL2 follow macOS-only project setup or demo steps without a documented boundary. | Docs |
 | `ci-json-check` | The demo shows `basectl check --ci base-demo --format json` and asserts JSON status output. | `demo/demo.sh`, `README.md` | `tests/validate.sh`, `tests/demo_test.bats`, `.github/workflows/tests.yml` | The reference project stops demonstrating Base's CI-safe machine-readable check path. | CI |

tests/validate.sh

@@ -203,10 +203,10 @@ grep -Fq 'POLICY_CONTEXT: base/issue-branch-policy' .github/workflows/issue-bran
 }
 
 base_release_pin_count="$(
-  grep -Fc 'git clone --depth 1 --branch v1.7.0 https://github.com/basefoundry/base.git ../base' .github/workflows/tests.yml || true
+  grep -Fc 'git -C ../base fetch --depth 1 origin f109dbae3e911641b97aaf68eeeedf6ee27d8c18' .github/workflows/tests.yml || true
 )"
 if [[ "$base_release_pin_count" -ne 2 ]]; then
-  printf '.github/workflows/tests.yml must pin both released Base checkouts to the v1.7.0 release.\n' >&2
+  printf '.github/workflows/tests.yml must pin both main Base checkouts to the immutable v2 migration commit.\n' >&2
   exit 1
 fi
 
@@ -216,10 +216,10 @@ if grep -Fq '591e34a8fed6ce9cbe27f483f852bec81153f3eb' .github/workflows/tests.y
 fi
 
 base_bash_libs_pin_count="$(
-  grep -Fc 'ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff' .github/workflows/tests.yml || true
+  grep -Fc 'ref: 7b2db7b644a9e94852cc4bd006e799b516075a38' .github/workflows/tests.yml || true
 )"
-if [[ "$base_bash_libs_pin_count" -ne 2 ]]; then
-  printf '.github/workflows/tests.yml must pin both released base-bash-libs checkouts to the v1.4.0 release commit.\n' >&2
+if [[ "$base_bash_libs_pin_count" -ne 3 ]]; then
+  printf '.github/workflows/tests.yml must pin every base-bash-libs checkout to the immutable v2 migration commit.\n' >&2
   exit 1
 fi
 
@@ -320,7 +320,7 @@ grep -Fq 'git -C ../base fetch --depth 1 origin cf864252760800161f4189c6f28d2517
   exit 1
 }
 
-grep -Fq 'ref: bf4deaf077c7de1abf99be6732a36d0e4e12f8ff' .github/workflows/tests.yml || {
+grep -Fq 'ref: 7b2db7b644a9e94852cc4bd006e799b516075a38' .github/workflows/tests.yml || {
   printf '.github/workflows/tests.yml does not use the v2 base-bash-libs source required by the provider-alignment commit.\n' >&2
   exit 1
 }