@pareto4/pp-core 1.9.0 → 1.11.0

package/pp-core/bin/lib/platform-bindings.cjs

@@ -23,14 +23,18 @@
  *     per D-03; provisional namespaces are validated leniently — an unknown or
  *     missing namespace never makes the object invalid.
  *
- * The core regexes below MUST mirror the `pattern` strings in
- * `schemas/platform-bindings.schema.json`; the schema↔validator coupling test
- * machine-enforces this so neither side can drift silently.
+ * `platform.repo.pattern` and `client.vaultRepo.pattern` in
+ * `schemas/platform-bindings.schema.json` are GENERATED from the two exported
+ * pattern-source constants below by `scripts/gen-platform-bindings-schema.cjs`
+ * (32-02, D-06) — a hand edit to either pattern in the schema is caught by
+ * `tests/gen-platform-bindings-schema.test.cjs`; the schema↔validator coupling
+ * test in `tests/platform-bindings.test.cjs` remains as the second net.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MACHINE_SPECIFIC_CLONE_TARGET_PATTERNS = exports.VAULT_REPO_PATTERN_SOURCE = exports.PLATFORM_REPO_PATTERN_SOURCE = exports.CONTRACT_SCHEMA_VERSION = void 0;
 exports.validateBindings = validateBindings;
 exports.cmdPlatformBindings = cmdPlatformBindings;
 exports.cmdValidateBindings = cmdValidateBindings;
@@ -41,19 +45,99 @@ const io = require("./io.cjs");
 const { output, error, ERROR_REASON } = io;
 const project_root_cjs_1 = require("./project-root.cjs");
 const semver_compare_cjs_1 = require("./semver-compare.cjs");
-// Core load-bearing patterns (D-01). These MUST mirror the `pattern` fields in
-// schemas/platform-bindings.schema.json — the coupling test fails if they drift.
+const git_provider_cjs_1 = require("./git-provider.cjs");
+// Core load-bearing patterns (D-01). SCHEMA_VERSION_RE, PLATFORM_TAG_RE and
+// SLUG_RE are unchanged by 32-02 and stay hand-authored, mirroring the
+// schema's `pattern` fields for those three by convention (no generator owns
+// them). PLATFORM_REPO_RE and VAULT_REPO_RE are compiled below from the two
+// exported pattern-source constants, which ARE what the generator owns.
 const SCHEMA_VERSION_RE = /^\d+\.\d+\.\d+$/;
-const PLATFORM_REPO_RE = /^[\w.-]+\/[\w.-]+$/;
+/**
+ * The contract version a **newly composed** binding emits (34-02). This is
+ * deliberately NOT a validation constraint: Phase 32 D-08 keeps every
+ * `1.0.0` file valid indefinitely, so `SCHEMA_VERSION_RE` above stays a shape
+ * check (any semver triplet) rather than an equality check against this
+ * constant. `scripts/gen-platform-bindings-schema.cjs` carries this value
+ * into the committed schema's `properties.schemaVersion.default` (an
+ * annotation-only JSON Schema keyword) so the two can never drift.
+ */
+exports.CONTRACT_SCHEMA_VERSION = '1.1.0';
 const PLATFORM_TAG_RE = /^v\d+\.\d+\.\d+/;
 // Provisional namespace pattern (lenient): only enforced if client.slug is present.
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
-// Provisional vault repo pattern (lenient): only enforced if client.vaultRepo is present.
-// MUST mirror schemas/platform-bindings.schema.json vaultRepo.pattern byte-for-byte —
-// the schema↔validator coupling test machine-enforces this so neither side can drift.
-// ReDoS note (T-11-01): anchored at both ends; single non-overlapping + quantifiers over
-// disjoint character classes — no nested/ambiguous quantifier, linear complexity only.
-const VAULT_REPO_RE = /^[\w.-]+(\/[\w.-]+)+$/;
+// A host-relative path of two or more slash-separated segments built from
+// word/dot/hyphen characters — e.g. `pareto4/pareto-platform-gcp` or Azure's
+// four-segment `org/project/_git/repo`. This is the pre-v1.1.0 vault-repo
+// pattern's shape; it now serves two fields (D-05, D-06). Linear complexity:
+// anchored at both ends, a single non-capturing repeated group over a
+// disjoint character class — no nested or ambiguous quantifier (T-11-01).
+const HOST_RELATIVE_SLUG_SOURCE = '^[\\w.-]+(?:\\/[\\w.-]+)+$';
+/**
+ * A host-relative path of two or more segments. Compiled into
+ * `platform.repo.pattern` by `scripts/gen-platform-bindings-schema.cjs` so
+ * the runtime regex and the schema pattern cannot drift (D-06). Deliberately
+ * accepts no URL and no SSH form: `resolveLatestTagViaGitRemote` composes the
+ * host from `platform.host` itself (Phase 31 D-09), so a full URL here would
+ * give the host two competing encodings — `platform.host` is authoritative.
+ */
+exports.PLATFORM_REPO_PATTERN_SOURCE = HOST_RELATIVE_SLUG_SOURCE;
+// The literal-forms alternative: LITERAL_CLONE_TARGET_PATTERNS entries with
+// their leading caret stripped, joined by the alternation bar, guarded by a
+// single leading negative lookahead refusing a leading hyphen (T-32-02,
+// SC4/T-29-26). Built programmatically from the imported array — never by
+// pasting the seven fragments here, which would be invisible to the BIND-02
+// regression lock (32-01) and would reintroduce the WR-01 defect this plan
+// closes.
+const literalFormsAlternative = '^(?!-)(?:' + git_provider_cjs_1.LITERAL_CLONE_TARGET_PATTERNS.map((source) => source.slice(1)).join('|') + ')';
+/**
+ * The union of the host-relative slug shape (unchanged) with the seven
+ * literal clone-target forms from `LITERAL_CLONE_TARGET_PATTERNS`. Compiled
+ * into `client.vaultRepo.pattern` by `scripts/gen-platform-bindings-schema.cjs`
+ * (D-06).
+ *
+ * The leading-hyphen negative lookahead guards ONLY the literal-forms
+ * alternative, appearing exactly once. It is deliberately NOT added to the
+ * slug alternative: a dash-leading slug (`-x/y`) matches today, is not a
+ * literal clone target, and is therefore always routed through URL
+ * composition rather than handed to git verbatim — a second guard here would
+ * reject a value the runtime already handles safely. Do not "fix" this later.
+ *
+ * ReDoS (T-11-01, restated for the union): both alternatives use only
+ * non-nested quantifiers over disjoint character classes, and the
+ * alternation adds no ambiguity — a literal-form prefix and a slug prefix
+ * cannot both consume an unbounded prefix of the same input.
+ */
+exports.VAULT_REPO_PATTERN_SOURCE = '(?:' + HOST_RELATIVE_SLUG_SOURCE + ')|(?:' + literalFormsAlternative + ')';
+const PLATFORM_REPO_RE = new RegExp(exports.PLATFORM_REPO_PATTERN_SOURCE);
+const VAULT_REPO_RE = new RegExp(exports.VAULT_REPO_PATTERN_SOURCE);
+// The four MACHINE-SPECIFIC forms among LITERAL_CLONE_TARGET_PATTERNS: explicit
+// relative (`./`), parent-relative (`../`), home-relative (`~`), and Windows
+// drive (`C:\`). These are valid clone targets (D-03) but resolve differently
+// on each developer's machine, unlike an absolute unix path, a scheme URL, or
+// an scp-style SSH target — all of which are shareable coordinates. This is
+// D-04's line between validity and advisability; D-07 records that the schema
+// cannot express it, so the advisory lives only here.
+//
+// Derived by FILTERING LITERAL_CLONE_TARGET_PATTERNS, not by retyping the four
+// fragments: a future edit to any of those four entries in
+// `src/git-provider.cts` drops the length below four and fails the subset-pin
+// test in tests/platform-bindings.test.cjs, whereas a retyped copy would
+// silently diverge.
+const MACHINE_SPECIFIC_SOURCE_SET = new Set([
+    '^\\.\\/', // explicit relative — ./path
+    '^\\.\\.\\/', // parent-relative — ../path
+    '^~', // home-relative — ~ or ~/path
+    '^[A-Za-z]:[\\\\/]', // Windows drive path — C:\ or C:/
+]);
+exports.MACHINE_SPECIFIC_CLONE_TARGET_PATTERNS = Object.freeze(git_provider_cjs_1.LITERAL_CLONE_TARGET_PATTERNS.filter((source) => MACHINE_SPECIFIC_SOURCE_SET.has(source)));
+// Compiled once at module load, as the predicate above does for the full set.
+const compiledMachineSpecificPatterns = exports.MACHINE_SPECIFIC_CLONE_TARGET_PATTERNS.map((source) => new RegExp(source));
+// Fixed, single-line advisory text (T-32-05): neither warning interpolates any
+// binding-supplied value, so no bounding/truncation helper (sanitizeForWarning
+// in src/git-provider.cts) is needed a third time in this file. Naming the
+// field and the cause is enough for an operator to act.
+const TAG_ABSENT_WARNING = 'platform.tag is absent: the platform is unpinned and drift checking is degraded.';
+const MACHINE_SPECIFIC_VAULT_WARNING = 'client.vaultRepo is machine-specific (dot-, parent-, home-relative, or drive-letter) — will not resolve elsewhere.';
 function isObject(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
 }
@@ -66,24 +150,33 @@ function isObject(v) {
  */
 function validateBindings(o) {
     const errors = [];
+    const warnings = [];
     if (!isObject(o)) {
-        return { valid: false, errors: ['root: expected a JSON object'] };
+        return { valid: false, errors: ['root: expected a JSON object'], warnings: [] };
     }
     // schemaVersion — required, semver triplet.
     if (typeof o.schemaVersion !== 'string' || !SCHEMA_VERSION_RE.test(o.schemaVersion)) {
         errors.push('schemaVersion: missing or not a semver triplet (e.g. "1.0.0")');
     }
-    // platform — required object with repo + tag.
+    // platform — required object with repo; tag is present-only (D-01/D-02).
     if (!isObject(o.platform)) {
         errors.push('platform: missing or not an object');
     }
     else {
         const platform = o.platform;
         if (typeof platform.repo !== 'string' || !PLATFORM_REPO_RE.test(platform.repo)) {
-            errors.push('platform.repo: missing or not a "group/project" path');
+            errors.push('platform.repo: missing or not a host-relative path of two or more segments');
         }
-        if (typeof platform.tag !== 'string' || !PLATFORM_TAG_RE.test(platform.tag)) {
-            errors.push('platform.tag: missing or not a "v<semver>" tag');
+        // D-01: absence is valid but advisory (D-02) — a tagless client platform
+        // repo can bind. Absence means the key is `undefined`; a present empty
+        // string, a present non-string, or a present malformed string all stay
+        // errors, mirroring the present-only idiom already used below for
+        // client.slug, client.vaultRepo and project.slug.
+        if (platform.tag === undefined) {
+            warnings.push(TAG_ABSENT_WARNING);
+        }
+        else if (typeof platform.tag !== 'string' || !PLATFORM_TAG_RE.test(platform.tag)) {
+            errors.push('platform.tag: present but not a "v<semver>" tag');
         }
     }
     // Provisional namespaces — lenient. A missing/unknown namespace is fine; only
@@ -96,8 +189,14 @@ function validateBindings(o) {
     // client.vaultRepo — lenient present-only check, mirrors client.slug pattern.
     // Only fires when vaultRepo is actually present; absent vault fields are fully valid (D-03).
     if (isObject(o.client) && o.client.vaultRepo !== undefined) {
-        if (typeof o.client.vaultRepo !== 'string' || !VAULT_REPO_RE.test(o.client.vaultRepo)) {
-            errors.push('client.vaultRepo: present but not a valid nested group/project path (e.g. pareto4-clients/acme/acme-vault)');
+        const vaultRepo = o.client.vaultRepo;
+        if (typeof vaultRepo !== 'string' || !VAULT_REPO_RE.test(vaultRepo)) {
+            errors.push('client.vaultRepo: present but not a host-relative path or a literal clone target (URL, scp-style SSH, absolute, relative, home or Windows drive path)');
+        }
+        else if (compiledMachineSpecificPatterns.some((re) => re.test(vaultRepo))) {
+            // D-04: only reachable once the pattern check above passed — a rejected
+            // value already has an error and does not need a second line about it.
+            warnings.push(MACHINE_SPECIFIC_VAULT_WARNING);
         }
     }
     // IN-03: project.slug — symmetric lenient check matching client.slug behaviour.
@@ -107,7 +206,7 @@ function validateBindings(o) {
             errors.push('project.slug: present but not a url-safe lowercase slug');
         }
     }
-    return { valid: errors.length === 0, errors };
+    return { valid: errors.length === 0, errors, warnings };
 }
 /**
  * Reader handler for `pp-tools query platform-bindings`.
@@ -161,24 +260,40 @@ function cmdPlatformBindings(cwd, args, raw) {
 // no YAML dependency, no shell-eval).
 const GITLAB_CI_MODULE_REF_RE = /\?ref=([^\s'"&)\]]+)/g;
 /**
- * Extracts `ref:` values that belong to the top-level `include:` block in a
+ * Extracts pin values that belong to the top-level `include:` block in a
  * .gitlab-ci.yml file, using a stateful line-scan.
  *
  * APPROXIMATION: Parses YAML structure via indentation tracking — handles the
- * common block-sequence form (`include: [- project: ... ref: ...]`). It does NOT
- * capture `ref:` values from `trigger:`, `needs:`, or other non-include stanzas,
- * because those appear under job-level keys (indent = 0) which close the include
- * context. May mis-classify exotic YAML (flow mappings, anchors, multi-document
- * files). Uses no YAML parser to avoid runtime dependencies (T-07-04).
+ * common block-sequence form (`include: [- project: ... ref: ...]`), the
+ * list-item-first form where `ref:` is the first key of the item (`- ref: ...`,
+ * CR-01), the single-line flow-style form (`include: [{project: p/q, ref:
+ * v3.0.0}]`, CR-01), and CI/CD component pins (`- component: <path>@<version>`,
+ * CR-01 — the currently GitLab-recommended pin form). It does NOT capture
+ * `ref:`/`component:` values from `trigger:`, `needs:`, or other non-include
+ * stanzas, because those appear under job-level keys (indent = 0) which close
+ * the include context. May still mis-classify more exotic YAML (anchors,
+ * multi-document files, multi-line flow spanning several lines). Uses no YAML
+ * parser to avoid runtime dependencies (T-07-04).
  *
  * @param content - Raw string content of the .gitlab-ci.yml file.
- * @returns Array of `ref:` values found inside the `include:` block.
+ * @returns Array of pin values (tag/branch refs and component `@version`
+ *          pins) found inside the `include:` block.
  */
 function extractGitlabCiIncludeRefs(content) {
     const refs = [];
     const lines = content.split('\n');
     let inIncludeBlock = false;
-    const REF_LINE_RE = /^ref:\s+['"]?([^\s'"#,\]]+)['"]?/;
+    // CR-01: optional leading list-item marker (`- `) so `ref:` as the first
+    // key of a sequence item is still anchored-matched (YAML mapping key order
+    // is arbitrary; `- ref: ...` / `- project: ...` are both ordinary).
+    const REF_LINE_RE = /^(?:-\s+)?ref:\s*['"]?([^\s'"#,\]}]+)['"]?/;
+    // CR-01: CI/CD component pin — `- component: <path>@<version>`.
+    const COMPONENT_LINE_RE = /^(?:-\s+)?component:\s*['"]?\S+@([^\s'"#,\]}]+)['"]?/;
+    // CR-01: same `ref:` shape, applied to a flow-style inline sequence/mapping
+    // (e.g. the remainder of `include: [{project: p/q, ref: v3.0.0}]`), where
+    // multiple entries may share one line and are not indent-delimited.
+    const INLINE_REF_RE = /ref:\s*['"]?([^\s'"#,\]}]+)['"]?/g;
+    const INLINE_COMPONENT_RE = /component:\s*['"]?\S+?@([^\s'"#,\]}]+)['"]?/g;
     for (const line of lines) {
         const trimmed = line.trimStart();
         // Skip blank lines and comment lines — they do not change YAML context.
@@ -188,18 +303,81 @@ function extractGitlabCiIncludeRefs(content) {
         // A new top-level key (indent = 0) either enters or exits the include block.
         if (indent === 0) {
             inIncludeBlock = trimmed === 'include:' || trimmed.startsWith('include:');
+            // CR-01: a flow-style include can carry its entries on the SAME line as
+            // the `include:` key (e.g. `include: [{project: p/q, ref: v3.0.0}]`).
+            // Scan the remainder of this line for inline ref/component pins before
+            // moving on — the block below only sees subsequent, indented lines.
+            if (inIncludeBlock) {
+                const remainder = trimmed.slice('include:'.length);
+                let m;
+                const inlineRefRe = new RegExp(INLINE_REF_RE.source, INLINE_REF_RE.flags);
+                while ((m = inlineRefRe.exec(remainder)) !== null) {
+                    refs.push(m[1].trim());
+                }
+                const inlineComponentRe = new RegExp(INLINE_COMPONENT_RE.source, INLINE_COMPONENT_RE.flags);
+                while ((m = inlineComponentRe.exec(remainder)) !== null) {
+                    refs.push(m[1].trim());
+                }
+            }
             continue;
         }
-        // Within the include block, capture any `ref: <value>` line.
+        // Within the include block, capture any `ref:` or `component:` pin line.
         if (inIncludeBlock) {
-            const m = trimmed.match(REF_LINE_RE);
-            if (m) {
-                refs.push(m[1].trim());
+            const refMatch = trimmed.match(REF_LINE_RE);
+            if (refMatch) {
+                refs.push(refMatch[1].trim());
+                continue;
+            }
+            const componentMatch = trimmed.match(COMPONENT_LINE_RE);
+            if (componentMatch) {
+                refs.push(componentMatch[1].trim());
             }
         }
     }
     return refs;
 }
+/**
+ * Collects pin-site tags from the REAL on-disk `.gitlab-ci.yml` at `root`
+ * (D-06): the top-level `include:` block's `ref:` values and any module
+ * `?ref=` values in source lines. Returns an empty record when the file does
+ * not exist. Moved verbatim out of `cmdValidateBindings` (32-03, D-12) so the
+ * D-12 tagless/competing-pin-site split can collect this evidence BEFORE
+ * deciding on a missing `platform.tag` — the two loops, the site key naming
+ * (first ref unnumbered, subsequent ones bracket-numbered), and the
+ * freshly-constructed module-ref regex are byte-equivalent to the pre-32-03
+ * inline block.
+ *
+ * @param root - Project root; the file checked is `<root>/.gitlab-ci.yml`.
+ * @returns A `PinSites` record, empty when no `.gitlab-ci.yml` exists.
+ */
+function collectGitlabCiPinSites(root) {
+    const sites = {};
+    const gitlabCiPath = node_path_1.default.join(root, '.gitlab-ci.yml');
+    if (node_fs_1.default.existsSync(gitlabCiPath)) {
+        const ciContent = node_fs_1.default.readFileSync(gitlabCiPath, 'utf-8');
+        // Extract `ref:` values from include blocks using a stateful line-scan (WR-02).
+        // Avoids false positives from `trigger:`, `needs:`, and other non-include stanzas.
+        const includeRefs = extractGitlabCiIncludeRefs(ciContent);
+        for (let refIdx = 0; refIdx < includeRefs.length; refIdx++) {
+            const key = refIdx === 0
+                ? '.gitlab-ci.yml include ref'
+                : `.gitlab-ci.yml include ref[${refIdx + 1}]`;
+            sites[key] = includeRefs[refIdx];
+        }
+        // Extract `?ref=` values from module source lines.
+        const moduleRefRe = new RegExp(GITLAB_CI_MODULE_REF_RE.source, GITLAB_CI_MODULE_REF_RE.flags);
+        let m;
+        let modIdx = 0;
+        while ((m = moduleRefRe.exec(ciContent)) !== null) {
+            modIdx++;
+            const key = modIdx === 1
+                ? '.gitlab-ci.yml module ?ref'
+                : `.gitlab-ci.yml module ?ref[${modIdx}]`;
+            sites[key] = m[1].trim();
+        }
+    }
+    return sites;
+}
 /**
  * Pin-site consistency check for `pp-tools query validate-bindings` (BIND-03).
  *
@@ -207,16 +385,34 @@ function extractGitlabCiIncludeRefs(content) {
  * cross-checks them against `platform.tag` in `.platform-bindings.json`.
  *
  * Behaviour matrix (locked by tests/platform-bindings.test.cjs):
- *   absent .platform-bindings.json    → output({present:false})                  exit 0 (inert, D-07)
- *   internal mismatch (>1 distinct)   → output({..., status:'block'})            exit 0 (D-04)
- *   all-agree, behind --latest-tag    → output({..., status:'warn'})             exit 0 (D-05)
- *   all-agree, at/ahead of latest     → output({..., status:'pass'})             exit 0
+ *   absent .platform-bindings.json           → output({present:false})                  exit 0 (inert, D-07)
+ *   tag key absent, no competing pin-site    → output({..., status:'warn'})             exit 0 (D-12, tagless)
+ *   tag key absent, a pin-site carries a tag → output({..., status:'block'})            exit 0 (D-12, drift)
+ *   tag present but empty/non-string/missing platform → output({..., status:'block'})   exit 0 (WR-01, unchanged)
+ *   internal mismatch (>1 distinct)          → output({..., status:'block'})            exit 0 (D-04)
+ *   all-agree, behind --latest-tag           → output({..., status:'warn'})             exit 0 (D-05)
+ *   all-agree, at/ahead of latest            → output({..., status:'pass'})             exit 0
+ *
+ * D-12: a tagless platform (D-01/D-02) must not be confused with a genuine
+ * drift signal. `platform.tag` being absent (the KEY is `undefined`) is
+ * distinguished from it being present-but-empty/malformed: the former, when
+ * no `.gitlab-ci.yml` pin-site carries a tag either, is the tagless-client
+ * case D-01/D-02 exist to support and degrades to a `warn`; the former, when
+ * a pin-site DOES carry a tag, is loud drift and stays a `block` — "without
+ * weakening the guards" applies to this case directly. The latter
+ * (present-but-empty/non-string, or no `platform` object at all) is
+ * malformed, not tagless by design, and keeps the pre-32-03 WR-01 block
+ * unconditionally, whether or not a `.gitlab-ci.yml` exists.
  *
  * Threat mitigations:
  *   T-07-04  Anchored regex on `ref:`/`?ref=`; file content is untrusted text — never shell-eval.
  *   T-07-05  Unresolved/offline remote is a soft note, never a hard block; caller passes
  *            `--latest-tag <tag>` when a network lookup succeeded; absent = skip drift check.
  *   T-07-06  `compareSemverCore === 0` normalises v-prefix differences; literal diff surfaced in `sites`.
+ *   T-32-07  D-12's split: an absent tag alongside any CI-carried tag stays a hard block, so
+ *            relaxing the tagless case can never silence a genuine drift signal.
+ *   T-32-08  A malformed (present-but-empty/non-string) tag does not inherit the tagless
+ *            relaxation — the WR-01 guard is preserved byte-for-byte for that case.
  *
  * @param cwd  - Working directory; resolved to repo root via findProjectRoot.
  * @param args - Handler-local args (already sliced past the subcommand name).
@@ -256,9 +452,38 @@ function cmdValidateBindings(cwd, args, raw) {
     const bindingsObj = parsed;
     const platform = isObject(bindingsObj.platform) ? bindingsObj.platform : null;
     const bindingsTag = typeof platform?.tag === 'string' ? platform.tag.trim() : '';
-    // WR-01: guard on a missing/empty canonical tag — without it, the function
-    // would fall through to emit status:'pass' with zero pin-sites, misleadingly
-    // signalling a correct pin on a binding that validateBindings would reject.
+    // D-12, case 1: the `platform` object is present and its `tag` KEY is
+    // absent (not present-but-empty/malformed — that stays WR-01 below).
+    // Collect the CI pin-sites BEFORE deciding: a tagless project degrades to a
+    // warn only when no other pin-site carries a tag either; a pin-site that
+    // DOES carry one is drift and must stay a block (T-32-07).
+    if (platform !== null && platform.tag === undefined) {
+        const ciSites = collectGitlabCiPinSites(root);
+        if (Object.keys(ciSites).length > 0) {
+            output({
+                present: true,
+                consistent: false,
+                status: 'block',
+                message: 'platform.tag is absent from .platform-bindings.json while other pin-sites carry a tag — run --validate to diagnose',
+                sites: ciSites,
+            }, raw);
+            return;
+        }
+        output({
+            present: true,
+            consistent: true,
+            status: 'warn',
+            message: 'platform.tag is absent — the platform is unpinned and pin-site drift checking is degraded',
+            sites: {},
+        }, raw);
+        return;
+    }
+    // WR-01: guard on a missing/empty canonical tag — a present-but-empty or
+    // non-string tag, or no `platform` object at all, is malformed rather than
+    // tagless by design (T-32-08) and stays a block unconditionally. Without
+    // this guard the function would fall through to emit status:'pass' with
+    // zero pin-sites, misleadingly signalling a correct pin on a binding that
+    // validateBindings would reject.
     const sites = {};
     if (!bindingsTag) {
         output({
@@ -271,31 +496,10 @@ function cmdValidateBindings(cwd, args, raw) {
         return;
     }
     sites['platform.tag'] = bindingsTag;
-    // D-06: read the REAL on-disk .gitlab-ci.yml and extract ref values.
-    const gitlabCiPath = node_path_1.default.join(root, '.gitlab-ci.yml');
-    if (node_fs_1.default.existsSync(gitlabCiPath)) {
-        const ciContent = node_fs_1.default.readFileSync(gitlabCiPath, 'utf-8');
-        // Extract `ref:` values from include blocks using a stateful line-scan (WR-02).
-        // Avoids false positives from `trigger:`, `needs:`, and other non-include stanzas.
-        const includeRefs = extractGitlabCiIncludeRefs(ciContent);
-        for (let refIdx = 0; refIdx < includeRefs.length; refIdx++) {
-            const key = refIdx === 0
-                ? '.gitlab-ci.yml include ref'
-                : `.gitlab-ci.yml include ref[${refIdx + 1}]`;
-            sites[key] = includeRefs[refIdx];
-        }
-        // Extract `?ref=` values from module source lines.
-        const moduleRefRe = new RegExp(GITLAB_CI_MODULE_REF_RE.source, GITLAB_CI_MODULE_REF_RE.flags);
-        let m;
-        let modIdx = 0;
-        while ((m = moduleRefRe.exec(ciContent)) !== null) {
-            modIdx++;
-            const key = modIdx === 1
-                ? '.gitlab-ci.yml module ?ref'
-                : `.gitlab-ci.yml module ?ref[${modIdx}]`;
-            sites[key] = m[1].trim();
-        }
-    }
+    // D-06: read the REAL on-disk .gitlab-ci.yml and extract ref values. Seed
+    // the sites record with the canonical tag first (above) so key order is
+    // unchanged, then merge in the collected CI sites.
+    Object.assign(sites, collectGitlabCiPinSites(root));
     // Build distinct semver set across all pin-sites.
     // `compareSemverCore === 0` normalises v-prefix differences (T-07-06).
     const tagValues = Object.values(sites).filter(Boolean);