CIH-S00: Restore green main by reinstating the determinism double-run test #167

Severity: High (main is red, so no tag can pass verify-tag-gate) · Epic: CIH · Landing order: 1 of 21 · Blocked by: none

Push verify on main (1c4e71e) is red: step "AUD audit exit gate (AUD-S18)" reports TestDeterminismDoubleRun passed 0 time(s) under -count=2. Root cause: refactor 5a01ba0 ("single guarded engine entry Decide") deleted the test; the name survives only in the -run regex at Taskfile.yml:253 and verify.yaml:125. Restore an equivalent double-run test over Decide under the same name (removing the name from the gate would be a loosening), and make a zero-match -run name red on the PR, not only on push.

Spec: openspec/specs/p5-cih-ci-hardening/spec.md — CIH-S00, REQs REQ-CIH-S00-01, REQ-CIH-S00-02, REQ-CIH-S00-03; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Acceptance (one PR; TDD — failing test first):

• REQ-CIH-S00-01 — restored test executes twice under -count=2 — go test -count=2 -run '^TestDeterminismDoubleRun$' -v ./... | rg -c '^--- PASS: TestDeterminismDoubleRun' prints 2
• REQ-CIH-S00-02 (adversarial) — every -run name in the determinism gates in Taskfile.yml/verify.yaml resolves to >= 1 test (go test -list), as an argument-pinned PR step; fixture proves the failing direction — bash hack/lint/run_names_resolve_test.sh && bash hack/lint/run_names_resolve_test.sh --self-test
• REQ-CIH-S00-03 (post-merge) — push verify on main is green on the fix commit — gh run list -R PlatformRelay/assent -w verify -b main -L1 --json conclusion

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).