fix(pipeline): shallow single-branch clone omits origin/baseBranch, breaking PR diffs and auto-rebase (canonical)

[chrisleekr]

Finding

The pipeline checks out the head branch only via single-branch shallow clone, but every PR-aware prompt and the auto-rebase workflow then tells the agent to use origin/<baseBranch> — a remote-tracking ref the clone never created. So the agent's git diff / git rebase / git log commands cannot resolve the ref on every PR mention.

src/core/checkout.ts:59 runs git clone --depth=<cloneDepth> --branch=<branch> --single-branch … where branch = ctx.isPR ? ctx.headBranch : ctx.defaultBranch (src/core/checkout.ts:40). Per the git-clone docs, --single-branch rewrites remote.origin.fetch to +refs/heads/<headBranch>:refs/remotes/origin/<headBranch>. Only that one ref is fetched and a later plain git fetch origin will not populate any other branch. Yet src/core/prompt-builder.ts:38-39 tells the agent the PR base is origin/<baseBranch> and to run git diff origin/<baseBranch>...HEAD, repeated at L122 and again in the allowed-tools list at L205 (Bash(git diff origin/<baseBranch>...HEAD)).

The same shape breaks the auto-rebase loop. src/workflows/handlers/branch-refresh.ts:86-88 (added in commit befe07c, reinforced by 3079014's cascade review/resolve loop) emits git fetch origin then git rebase origin/<baseRef> — the rebase exits with fatal: invalid upstream 'origin/main'. cloneDepth (src/config.ts:93, default 50) controls history length, not which refs are fetched. No git fetch of the base branch exists anywhere in src/core/ or src/daemon/ (verified by grep). The agent has to discover the failure at runtime, eat retry turns probing git remote -v / git branch -r, and either give up or self-heal by guessing git remote set-branches --add + git fetch. Direct burned cost on every PR comment.

Diagram

flowchart TD
    Trigger["Webhook: PR comment with the bot mention"]:::event
    Clone["src/core/checkout.ts:59<br/>git clone --depth=50 --branch=headBranch<br/>--single-branch repoUrl workDir"]:::current
    Refspec["remote.origin.fetch in workDir/.git/config:<br/>+refs/heads/headBranch:refs/remotes/origin/headBranch<br/>baseBranch is NOT in the refspec"]:::warn
    Promptpath["src/core/prompt-builder.ts L38-39, L122, L205<br/>tells agent: git diff origin/baseBranch...HEAD"]:::current
    Refreshpath["src/workflows/handlers/branch-refresh.ts L86-88<br/>tells agent: git fetch origin<br/>then git rebase origin/baseRef"]:::current
    Diff["Agent: git diff origin/baseBranch...HEAD"]:::action
    Rebase["Agent: git rebase origin/baseRef"]:::action
    Fatal["fatal: ambiguous argument origin/baseBranch<br/>or fatal: invalid upstream origin/baseRef"]:::error
    Waste["Wasted turns and tokens<br/>review may run against HEAD only<br/>auto-rebase aborts mid-loop"]:::error
    Fix["Fix in src/core/checkout.ts after clone:<br/>git -C workDir remote set-branches --add origin baseBranch<br/>git -C workDir fetch --depth=cloneDepth origin baseBranch"]:::fix
    Healthy["origin/baseBranch resolves<br/>diff and rebase work first try"]:::ok

    Trigger --> Clone --> Refspec
    Refspec --> Promptpath --> Diff
    Refspec --> Refreshpath --> Rebase
    Diff --> Fatal
    Rebase --> Fatal
    Fatal --> Waste
    Waste -. proposed fix .-> Fix --> Healthy

    classDef event fill:#0b5394;color:#ffffff;stroke:#053061;stroke-width:1px
    classDef current fill:#856404;color:#ffffff;stroke:#533f03;stroke-width:1px
    classDef warn fill:#a04000;color:#ffffff;stroke:#5e2607;stroke-width:1px
    classDef action fill:#21618c;color:#ffffff;stroke:#1b4f72;stroke-width:1px
    classDef error fill:#922b21;color:#ffffff;stroke:#641e16;stroke-width:1px
    classDef fix fill:#196f3d;color:#ffffff;stroke:#0e6251;stroke-width:1px
    classDef ok fill:#196f3d;color:#ffffff;stroke:#0e6251;stroke-width:1px

Loading

Rationale

This is a silent correctness issue on the most common code path — every bot mention on a PR. Default agent model is Opus 4.7 (src/config.ts:371), so wasted recovery turns cost real money: a typical non-trivial PR review is ~15-40 turns; observed Opus per-turn cost is roughly US$0.05–0.20, so even three burned recovery turns is ~US$0.15–0.60 of pure waste, doubled by the cascade review/resolve loop (reviewResolveMaxIterations defaults to 2 — src/config.ts:354). When the agent falls back to git diff HEAD (no base ref) it reviews the PR against itself, masking regressions. The cascade work in #61, #63 made it strictly worse — branch-refresh now relies on origin/<baseRef> for clean rebase, and formatRefreshDirective (src/workflows/handlers/branch-refresh.ts:65-69) prints a clean-looking directive whose underlying rebase fails.

The fix is small, local, additive: a single git remote set-branches --add origin <baseBranch> plus git fetch --depth=<cloneDepth> origin <baseBranch> after the existing clone. Pattern is documented in git-fetch(1) and the Jay Goodby writeup on tracking remote branches after --single-branch. Bandwidth cost is one extra shallow fetch (typically a few hundred KB) only paid on PR events where head and base differ. It also aligns this server with upstream claude-code-action, which gets origin/<baseBranch> for free via actions/checkout@v4 with fetch-depth: 0.

References

Internal:

• src/core/checkout.ts:40-59 — single-branch shallow clone command and branch selection
• src/config.ts:93 — cloneDepth default 50 (history length, not refspec)
• src/core/prompt-builder.ts:38-39, 122, 205 — agent told to use git diff origin/<baseBranch>...HEAD in three places
• src/workflows/handlers/branch-refresh.ts:86-88 — auto-rebase emits git fetch origin then git rebase origin/<baseRef>
• src/core/pipeline.ts:212-216 — enrichedCtx.baseBranch is computed and passed to the prompt builder
• src/core/fetcher.ts:317 — baseBranch hydrated from GraphQL baseRefName but never used to drive a fetch
• CLAUDE.md Pipeline step 5 — never mentions fetching the base ref

External:

• git-clone(1) — --single-branch — documents the single-ref refspec rewrite
• git-fetch(1) — shallow fetches honour the configured refspec
• Tracking remote branches after a --single-branch checkout (Jay Goodby, 2022) — canonical git remote set-branches --add + git fetch remediation
• actions/checkout — upstream uses fetch-depth: 0, masking this in CI but not here
• GitLab issue 30067 — well-known prior art on the same trap

Suggested Next Steps

1. In src/core/checkout.ts, after the clone (line 59) and before returning, conditionally run git -C <workDir> remote set-branches --add origin <baseBranch> then git -C <workDir> fetch --depth=<cloneDepth> origin <baseBranch> when ctx.isPR is true, a baseBranch is available, and it differs from the cloned branch. Cleanest plumbing: do the supplemental fetch inside runPipeline between the checkout call and executeAgent (so the GraphQL-derived baseBranch from src/core/fetcher.ts:317 is authoritative), or pass enrichedCtx.baseBranch into checkoutRepo as an explicit parameter.
2. Add a unit test in test/core/ (new checkout.test.ts) that runs the checkout against a local fixture repo with two branches and asserts both origin/<headBranch> and origin/<baseBranch> show up in git branch -r. DI groundwork already landed in chore(test): DI refactor for checkout.ts and executor.ts to enable module-level unit tests #7.
3. Trim the now-redundant "(NOT 'main' or 'master')" recovery prose in src/core/prompt-builder.ts once the fix lands, and verify formatRefreshDirective works end-to-end on a same-repo PR that is behind base.
4. Add a Pino info-level log line at the supplemental-fetch site (fields: baseBranch, headBranch, depth) anchored to the existing log at src/core/checkout.ts:58.

Areas Evaluated

• src/core/pipeline.ts — confirmed where checkout happens and what baseBranch is available
• src/core/checkout.ts — identified the --single-branch clone command on line 59 as root cause
• src/core/fetcher.ts — baseBranch hydrated from GraphQL, never used to drive an extra fetch
• src/core/prompt-builder.ts — enumerated every place the agent is told to use origin/<baseBranch>
• src/core/context.ts — baseBranch is set on BotContext for pull_request_review_comment events
• src/core/executor.ts — no fetch logic in the executor either
• src/workflows/handlers/branch-refresh.ts — auto-rebase path is also affected
• src/config.ts — cloneDepth controls history depth only, not refspec
• Grep across src/ and test/ for git fetch, set-branches, --no-single — no compensating fetch exists anywhere
• Existing research history: open fix(pipeline): GraphQL fetcher silently truncates PR/issue context past 100 items #66 (GraphQL pagination, different file), closed fix(pipeline): agent timeout never aborts SDK query, leaking tokens and breaking daemon cancel #16/fix(agent-sdk): wire AbortController and Query.close into executeAgent to stop subprocess/MCP leaks #38/fix(pipeline): abort SDK query on timeout and daemon cancel #62 (SDK abort), closed fix(webhook): missing per-request deadline lets a hung pipeline pin an activeCount slot forever #15 (per-request deadline). No overlap.

Note on sibling placeholders

Earlier same-run sibling issues #71, #72, #73 were created while probing harness payload-size and write-permission limits. They carry no findings and can be closed safely; this is the canonical research artifact for run #25011408648.

Generated by scheduled research workflow run #25011408648 on 2026-04-27

[chrisleekr-bot]

bot workflow ship — running

ship started — first step triage queued.

---

Steps

✅ triage — succeeded · open comment

cost: $0.8659 · turns: 16
✅ Valid — proceeding to next step (plan).

Triage: fix(pipeline): shallow single-branch clone omits origin/baseBranch, breaking PR diffs and auto-rebase (canonical)

Verdict

VALID (confidence: 0.97)

The pipeline's PR checkout uses git clone --single-branch --branch=<headBranch>, which rewrites the remote refspec to fetch only the head branch. The prompt then directs the agent to use origin/<baseBranch> for diffs (three places in prompt-builder.ts) and the auto-rebase handler tells the agent to git fetch origin + git rebase origin/<baseRef>. With the configured refspec…

✅ plan — succeeded · open comment

cost: $0.6558 · turns: 14
📋 Plan ready — task decomposition below.

Plan: fix(pipeline): shallow single-branch clone omits origin/baseBranch, breaking PR diffs and auto-rebase

Context

src/core/checkout.ts:59 clones with --single-branch --branch=<headBranch>, which rewrites remote.origin.fetch so only the head branch is fetched. The agent prompt (src/core/prompt-builder.ts:56-57, 140, 223) and the auto-rebase directive (src/workflows/handlers/branch-refresh.ts:86-88) both reference origin/<baseBranch>, which the clone never created — every PR mention either burns recovery turns or silently falls …

✅ implement — succeeded · open comment

cost: $7.3087 · turns: 96
🛠️ Implement complete — opened PR #96 on branch fix/checkout-fetch-base-branch.

Implement: issue #74 — supplemental fetch of PR base branch in checkout

Closes #74 (fix(pipeline): shallow single-branch clone omits origin/baseBranch, breaking PR diffs and auto-rebase).

Summary

The pipeline's PR checkout uses git clone --single-branch --branch=<headBranch>, which rewrites remote.origin.fetch so only the head branch is fetched. The agent prompt then directs the agent to use origin/<baseBranch> for diffs, and the…

🔄 review — running · open comment

🔍 Code review starting — 7 files, +234/-49. Cloning repo and reading changed files…

[chrisleekr-bot]

bot workflow triage — succeeded

✅ Valid — proceeding to next step (plan).

Triage: fix(pipeline): shallow single-branch clone omits origin/baseBranch, breaking PR diffs and auto-rebase (canonical)

Verdict

VALID (confidence: 0.97)

The pipeline's PR checkout uses git clone --single-branch --branch=<headBranch>, which rewrites the remote refspec to fetch only the head branch. The prompt then directs the agent to use origin/<baseBranch> for diffs (three places in prompt-builder.ts) and the auto-rebase handler tells the agent to git fetch origin + git rebase origin/<baseRef>. With the configured refspec, neither command can resolve the base ref — git rebase origin/main exits with fatal: invalid upstream 'origin/main' and git diff origin/main...HEAD fails the same way. Reproduction is direct and matches the issue's prediction. The team has already encountered this trap in the daemon's scoped-rebase path (src/daemon/scoped-rebase-executor.ts:107-118) and worked around it there with an explicit refspec — but the main pipeline checkout is unfixed.

What was inspected

• src/core/checkout.ts — line 59 confirms git clone --depth=<n> --branch=<branch> --single-branch …; branch selection at line 40 (ctx.isPR ? ctx.headBranch : ctx.defaultBranch)
• src/core/prompt-builder.ts — lines 53-58, 140, 223 confirm three places telling the agent to use origin/<baseBranch> for PR diffs / log
• src/workflows/handlers/branch-refresh.ts — lines 86-87 confirm git fetch origin + git rebase origin/${baseRef} directive
• src/core/fetcher.ts — line 596 confirms baseBranch: pr.baseRefName is hydrated from GraphQL (issue cites line 317, which is wrong, but the substantive claim is correct)
• src/core/pipeline.ts — line 229 confirms enrichedCtx.baseBranch is computed and passed forward; no supplemental fetch exists
• src/daemon/scoped-rebase-executor.ts — lines 100-118 already contain a comment explicitly diagnosing this exact --single-branch trap and emit an explicit-refspec workaround (git fetch origin <base>:refs/remotes/origin/<base>), demonstrating the team has hit this in another code path
• src/config.ts — line 172 confirms cloneDepth default 50 (issue cites line 93, off; line is 172)
• Grep across src/ for git fetch | set-branches | --no-single confirms no compensating fetch exists in src/core/ or src/daemon/main.ts

Reproduction

Constructed a local bare repo with two branches and ran the exact clone command from src/core/checkout.ts:59:

git clone --depth=50 --branch=feature --single-branch upstream.git workdir
cd workdir
git rebase origin/main
# fatal: invalid upstream 'origin/main' (exit 128)
git diff origin/main...HEAD
# fatal: ambiguous argument 'origin/main...HEAD': unknown revision … (exit 128)
git branch -r
#   origin/feature
git config --get remote.origin.fetch
# +refs/heads/feature:refs/remotes/origin/feature

The refspec confirms only the head branch is tracked. Both the prompt's PR-diff command and the auto-rebase handler's directive fail at the first git invocation. (Note: --depth warning is from local clone only; in production the URL is https://github.com/... and --depth applies. Refspec behaviour is the same regardless.)

Findings

• src/core/checkout.ts:59 — --single-branch --branch=<headBranch> narrows remote.origin.fetch to head only
• src/core/prompt-builder.ts:56-57 — agent told origin/${data.baseBranch} is the PR base and to run git diff origin/${data.baseBranch}...HEAD
• src/core/prompt-builder.ts:140 — clarification line repeats origin/${data.baseBranch} in the IMPORTANT-CLARIFICATIONS block
• src/core/prompt-builder.ts:223 — allowed-tools / examples list includes Bash(git diff origin/${data.baseBranch}...HEAD)
• src/workflows/handlers/branch-refresh.ts:86-87 — refresh directive emits git fetch origin then git rebase origin/${s.baseRef}; with the existing refspec the rebase aborts immediately
• src/daemon/scoped-rebase-executor.ts:107-118 — comment explicitly diagnoses the --single-branch refspec trap and uses an explicit-destination refspec (git fetch origin <base>:refs/remotes/origin/<base>) to bring the base remote-tracking ref into existence; this is precisely the fix shape the issue proposes for the main pipeline
• src/core/pipeline.ts:226-229 — enrichedCtx.baseBranch is computed but never drives a supplemental fetch
• src/core/fetcher.ts:596 — baseBranch: pr.baseRefName populated from GraphQL (issue's line 317 citation is off; substance is correct)

Reasoning

The issue makes a structural claim about a git refspec configuration interacting with downstream prompt instructions. Both ends are present in the code at the cited locations (with minor line-number drift in two citations), and the reproduction shows the predicted runtime failures with the exact clone flags. The internal corroboration is even stronger: the daemon's scoped-rebase path already carries a detailed code comment about this exact --single-branch refspec trap and applies an explicit-refspec fix locally — so the engineering team has independently confirmed the failure mode in another execution path. The issue's proposed fix shape (git remote set-branches --add origin <base> + git fetch --depth=<n> origin <base>) is well-targeted: it adds the missing remote-tracking ref without changing any other clone semantics, and it gates appropriately on ctx.isPR and baseBranch !== headBranch. Cost-of-error reasoning is plausible but the structural defect is independently sufficient to mark this VALID. Recommend planning the fix.

Recommended next step

plan

cost: $0.8659 · turns: 16 · duration: 137s

[chrisleekr-bot]

bot workflow plan — succeeded

📋 Plan ready — task decomposition below.

Plan: fix(pipeline): shallow single-branch clone omits origin/baseBranch, breaking PR diffs and auto-rebase

Context

src/core/checkout.ts:59 clones with --single-branch --branch=<headBranch>, which rewrites remote.origin.fetch so only the head branch is fetched. The agent prompt (src/core/prompt-builder.ts:56-57, 140, 223) and the auto-rebase directive (src/workflows/handlers/branch-refresh.ts:86-88) both reference origin/<baseBranch>, which the clone never created — every PR mention either burns recovery turns or silently falls back to git diff HEAD. Fix is a small additive git remote set-branches --add + git fetch on PR events when baseBranch differs from the cloned head branch.

Tasks

• T1 Extend checkoutRepo to accept the resolved baseBranch and, when ctx.isPR is true and baseBranch is non-empty and differs from the cloned branch, run git -C <workDir> remote set-branches --add origin <baseBranch> followed by git -C <workDir> fetch --depth=<config.cloneDepth> origin <baseBranch>. Wrap the fetch in a try/catch that logs a Pino warn (fields: baseBranch, headBranch, err) but does NOT abort checkout — a missing base ref should degrade gracefully, not break unrelated requests. Add a Pino info log (fields: baseBranch, headBranch, depth) anchored on the existing "Cloning repository" log line. (files: src/core/checkout.ts)
• T2 In runPipeline, pass the GraphQL-derived enrichedCtx.baseBranch (already populated at src/core/pipeline.ts:229) into checkoutRepo via the new explicit parameter, since EnrichedBotContext already carries baseBranch as a required field — keeping the auth path unchanged. (files: src/core/pipeline.ts)
• T3 Add test/core/checkout.test.ts that uses git init --bare to build a local fixture remote with two branches (main + a feature head), invokes checkoutRepo (or its underlying logic) against the fixture, and asserts both origin/<headBranch> and origin/<baseBranch> appear in git branch -r inside the workDir. Cover three cases: (a) PR event where head≠base → both refs present; (b) PR event where head==base (e.g. PR targeting itself) → no duplicate fetch attempted; (c) issue event (isPR=false) → no supplemental fetch. Use the DI groundwork from chore(test): DI refactor for checkout.ts and executor.ts to enable module-level unit tests #7 if available; otherwise stub the credential helper. (files: test/core/checkout.test.ts)
• T4 Trim the now-redundant defensive prose (NOT 'main' or 'master') from src/core/prompt-builder.ts:56 and L140 once the supplemental fetch lands — the agent no longer needs the explicit warning because origin/<baseBranch> resolves first try. Keep the actual git diff origin/<baseBranch>...HEAD directives intact. (files: src/core/prompt-builder.ts)
• T5 Update test/core/prompt-builder.test.ts to reflect the trimmed prose in T4 — adjust any snapshots/string assertions that match (NOT 'main' or 'master'). (files: test/core/prompt-builder.test.ts)
• T6 Update CLAUDE.md "Pipeline" step 5 to note that the checkout also fetches the PR base branch when applicable, and update docs/build/architecture.md:48 (the "One request, one clone" bullet) to mention the supplemental base-branch fetch on PR events. Keep edits minimal — one sentence each. (files: CLAUDE.md, docs/build/architecture.md)

Verification

1. bun run typecheck && bun run lint && bun test all pass — including the new test/core/checkout.test.ts.
2. New unit test (T3) demonstrates origin/<baseBranch> and origin/<headBranch> both resolvable via git rev-parse after checkout for a PR with head≠base.
3. Manual smoke: trigger the bot on a same-repo PR that is behind base; confirm git diff origin/<baseBranch>...HEAD succeeds first try in the daemon log (no fatal: ambiguous argument retries) and that formatRefreshDirective's git rebase origin/<baseRef> step completes without fatal: invalid upstream.
4. bun run docs:build strict build passes (citation check in scripts/check-docs-citations.ts validates any new src/<file>:<line> references in docs/).
5. git log -1 --stat shows additive changes in src/core/checkout.ts, src/core/pipeline.ts, plus new test file and minor prose trims — no regressions in pipeline shape, no new dependencies.

cost: $0.6558 · turns: 14 · duration: 76s

[chrisleekr-bot]

bot workflow implement — succeeded

🛠️ Implement complete — opened PR #96 on branch fix/checkout-fetch-base-branch.

Implement: issue #74 — supplemental fetch of PR base branch in checkout

Closes #74 (fix(pipeline): shallow single-branch clone omits origin/baseBranch, breaking PR diffs and auto-rebase).

Summary

The pipeline's PR checkout uses git clone --single-branch --branch=<headBranch>, which rewrites remote.origin.fetch so only the head branch is fetched. The agent prompt then directs the agent to use origin/<baseBranch> for diffs, and the auto-rebase handler tells the agent to git rebase origin/<baseRef> — both fail because the base branch's remote-tracking ref was never created. This change adds a small additive supplemental fetch in checkoutRepo (git remote set-branches --add + git fetch --depth=<cloneDepth>) that runs only on PR events when baseBranch is non-empty and differs from the cloned head branch. Failures are best-effort (warn-and-continue) so a missing base ref never aborts an unrelated request.

Files changed (path · one-line rationale)

• src/core/checkout.ts · Accept optional baseBranch parameter; on PR events with head ≠ base, run git remote set-branches --add origin <baseBranch> + git fetch --depth=<cloneDepth> origin <baseBranch> after the initial clone. Wraps in try/catch with Pino warn (no abort). Adds a Pino info log anchored on the existing "Cloning repository" line.
• src/core/pipeline.ts · Forward enrichedCtx.baseBranch (already populated from GraphQL at L229) into checkoutRepo via the new explicit parameter.
• src/core/prompt-builder.ts · Trim now-redundant defensive prose (NOT 'main' or 'master') from the PR diff instructions and the IMPORTANT-CLARIFICATIONS line — origin/<baseBranch> now resolves first try so the agent doesn't need the warning.
• test/core/checkout.test.ts · New unit test using git init --bare + GIT_CONFIG_COUNT/KEY/VALUE insteadOf redirect to drive checkoutRepo against a local fixture. Four cases: PR head ≠ base (both refs present), PR head == base (no duplicate fetch), issue event (no supplemental fetch), PR with no baseBranch supplied.
• CLAUDE.md · Pipeline step 5 now notes the supplemental base-branch fetch on PR events.
• docs/build/architecture.md · "One request, one clone" bullet mentions the supplemental fetch with one clarifying sentence.

Commits (sha · subject)

Single conventional-commit on this branch — see git log main..HEAD --oneline. Subject: fix(checkout): fetch PR base branch so origin/<baseBranch> resolves (closes #74).

Tests run (command · result)

• bun run typecheck · pass (clean exit)
• NODE_OPTIONS='--max-old-space-size=4096' bun run lint · 0 errors / 291 pre-existing warnings
• bun test test/core/checkout.test.ts test/core/prompt-builder.test.ts · 33 pass / 0 fail / 94 expect()
• bun test (full suite) · 530 pass / 153 skip / 194 fail vs. 530 pass / 153 skip / 195 fail on main with this branch's test file present — net zero new failures (in fact one fewer, since the new checkout test passes here and would fail on main). All 194 remaining failures are pre-existing and infra-bound (Postgres / Valkey / removed finalizeTrackingComment & requireDb test imports) — unrelated to this change.
• bun run scripts/check-docs-citations.ts · OK
• bun run scripts/check-docs-versions.ts · OK

Verification

1. T1 satisfied — src/core/checkout.ts adds the supplemental git remote set-branches --add origin <baseBranch> + git fetch --depth=<cloneDepth> origin <baseBranch> after the initial clone, gated on ctx.isPR && baseBranch !== undefined && baseBranch !== "" && baseBranch !== branch. Wrapped in try/catch with Pino warn carrying {baseBranch, headBranch, err} — a missing base ref degrades gracefully to a warn log instead of aborting checkout. Pino info log added before the supplemental fetch with {baseBranch, headBranch, depth}.
2. T2 satisfied — src/core/pipeline.ts now passes enrichedCtx.baseBranch as the third argument to checkoutRepo. EnrichedBotContext.baseBranch is required (typed in src/types.ts:166), populated from GraphQL at src/core/pipeline.ts:229.
3. T3 satisfied — test/core/checkout.test.ts builds a real bare upstream with main + feat/x, redirects the hardcoded https://github.com/... URL via GIT_CONFIG_COUNT/KEY_0/VALUE_0 insteadOf, and asserts git branch -r against the workDir. Cases:
   • PR head ≠ base → both origin/feat/x and origin/main resolvable via git rev-parse.
   • PR head == base → only origin/main (no duplicate fetch attempted).
   • Issue event (isPR=false) → only origin/main (supplemental fetch gated on isPR).
   • PR with baseBranch undefined → only origin/feat/x (gate also covers absence).
4. T4 satisfied — (NOT 'main' or 'master') removed from src/core/prompt-builder.ts:56 and L140; the actual git diff origin/<baseBranch>...HEAD directives are intact.
5. T5 satisfied — test/core/prompt-builder.test.ts had no assertions matching the trimmed substring (verified by grep); 29/29 prompt-builder tests still pass.
6. T6 satisfied — CLAUDE.md Pipeline step 5 + docs/build/architecture.md "One request, one clone" bullet both note the supplemental base-branch fetch in one sentence each.
7. Manual smoke not run — the live-PR trigger check requires the deployed daemon (out of scope for the implement workflow). Verification 3 in the plan is covered structurally by the new unit test, which exercises the exact code path with a real git clone --single-branch + supplemental fetch against a real local upstream.
8. No new dependencies, no schema changes, no API surface changes — checkout signature gained one optional parameter; all existing callers (triage handler, plan handler) continue to work unchanged because they don't pass it.

cost: $7.3087 · turns: 96 · duration: 815s