fix(decision-brief): a 404 on the branch-ref lookup is a fresh branch, not a parent SHA
What broke
The first live decision-brief run (run 39498549439, combsmith/incubator Discussion #5) drafted and validated the package, then land failed:
Get "repos/combsmith/incubator/git/commits/%7B%22message%22:%22Not%20Found%22,…%7D": unsupported protocol scheme ""
gh api prints the error body to stdout on a non-2xx (the HTTP line goes to stderr), so in open-pr.sh
parent_sha="$(gh api "repos/${REPO}/git/ref/heads/${branch}" --jq '.object.sha' 2>/dev/null || true)"
captured {"message":"Not Found",…} as the parent SHA on the first run for any slug, branch_exists became 1, and the tree lookup used the JSON as a commit id. Every first-time brief would fail the same way.
Fix
Resolve the branch ref the way the brief read a few lines below already does: capture stderr, treat only a 404 as "no branch yet", fail closed on anything else, and require both resolved SHAs to be 40 hex.
Tests
The mock_gh_live stub now prints a 404 body to stdout as real gh does, so the existing "live, new branch" test exercises the bug (it passed before only because the stub printed nothing). Two new tests pin the fresh-branch and fail-closed cases; both fail against the original script and pass with the fix. bats tests/test_decision_brief.bats: 59/59 (bash 5; macOS bash 3.2 cannot parse the existing heredoc, unrelated). shellcheck clean.
After merge
Cut decision-brief/v1.0.1 and move decision-brief/v1-stable, then re-label incubator Discussion #5 needs-brief (remove and re-add) to land the BlockVault brief.
🤖 Generated with Claude Code
Problem
See the linked issue.
Risk
Low — changes automation shell logic under scripts/, covered by shellcheck (--severity=warning) and the bats suite.
Test plan
Tests added/updated: tests/test_decision_brief.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.
Rollback
Revert this PR. No non-revertible side effects (no tags, migrations, or external state).
Monitoring
This PR's Lint (shellcheck) and bats checks show pass/fail; watch subsequent dev-lead / pr-review runs for behavioral regressions.