Lock the Golden Files. Split Agent Diffs That Touch the Answers

Description and use

Protect golden files with a lockfile and split‑diff rules to prevent circular CI checks, requiring human approval for changes.

Agent‑generated PRs can rewrite both code and golden files, causing tests to pass while the spec moves with the implementation, creating a tautology.

Golden files are now immutable during agent PRs, preventing circular tests and ensuring that only human‑approved changes update expected outputs.

1. Inventory all golden file paths and generate fixtures.manifest.
2. Generate fixtures.lock from a trusted main branch using scripts/write_fixture_lock.py.
3. In PRs, enforce split‑diff rule: source only or goldens only, not both unless fixtures:allow label is present.
4. CI merge job recomputes hashes; if fixtures.lock mismatches and PR not allowed to edit goldens, fail the check.
5. Human reviewer inspects diff, applies fixtures:allow if needed, updates lockfile in a separate commit, and re‑runs CI.

If rule 2 fires, the PR stays open. A person inspects the bytes, applies the label, updates the lock in a visible commit, and re‑runs the check.