The v7.0.23 GitHub release was created successfully, but the release workflow failed before npm publish because the tag checkout did not expose main for the Active Agents base-version guard test. This fetches full history during checkout and locks that behavior with metadata coverage so workflow_dispatch or release-tag runs can resolve the base ref consistently.

Constraint: The release workflow runs on published tags where the default checkout can omit origin/main
Rejected: Weaken the version-guard test on release runs | the guard stays useful when the workflow supplies the expected base ref
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep release verification able to resolve a protected base ref on tag-triggered runs; if checkout behavior changes again, update workflow + metadata test together
Tested: node --test test/metadata.test.js --test-name-pattern "release workflow publishes with provenance in CI|release workflow only publishes from published releases or manual dispatch"; openspec validate --specs
Not-tested: Full GitHub Actions rerun until after merge