test(e2e): cover git-refs backend on push + assert no v1 branch

Two changes to lock in the git-refs checkpoint backend (the default for
fresh `entire enable` setups) as an exercised, guarded path:

1. Per-test guard: SetupRepo now registers a cleanup (only under the
   git-refs backend) that fails the test if a local entire/checkpoints/v1
   branch exists. Under git-refs, checkpoints live in per-checkpoint refs
   and nothing should ever seed v1; a v1 branch means a flow regressed.

2. CI coverage: the on-push e2e.yml matrix pins git-branch, so git-refs
   had no automatic coverage. Make e2e-checkpoint-store.yml callable
   (workflow_call) and add an e2e-git-refs job to e2e.yml that runs on
   every push to main, wired into the Slack failure notification. The
   agent (claude-code) and backend (git-refs) are fixed by the reusable
   workflow's input defaults, so the caller parameterizes neither and the
   leg always covers exactly one agent on one backend.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01KY4RVXK1PCVYV31TMC73VS6P

Author: gtrrz-victor

.github/workflows/e2e-checkpoint-store.yml

@@ -26,6 +26,25 @@ on:
         options:
           - git-branch
           - git-refs
+  # Reusable entry point so e2e.yml can run a fixed agent/backend leg (e.g.
+  # claude-code against git-refs) as part of the on-push matrix. The `inputs`
+  # context is shared by workflow_dispatch and workflow_call, so the jobs below
+  # read `inputs.*` for both triggers.
+  workflow_call:
+    inputs:
+      agent:
+        # Fixed to claude-code by default: the on-push leg in e2e.yml relies on
+        # this and passes no agent, so that leg always covers exactly one agent.
+        # A future caller may still override it explicitly.
+        description: "Agent to run"
+        required: false
+        type: string
+        default: "claude-code"
+      checkpoint_store:
+        description: "Checkpoint storage backend to run the suite against"
+        required: false
+        type: string
+        default: "git-refs"
 
 jobs:
   # Build the agent matrix dynamically: a single selected agent, or all of them
@@ -38,9 +57,10 @@ jobs:
       - id: set
         # Pass the input through env rather than interpolating it into the script:
         # `type: choice` only constrains the UI, so a REST-API dispatch could inject
-        # shell metacharacters here otherwise.
+        # shell metacharacters here otherwise. `inputs.agent` covers both the
+        # workflow_dispatch and workflow_call triggers.
         env:
-          AGENT_INPUT: ${{ github.event.inputs.agent }}
+          AGENT_INPUT: ${{ inputs.agent }}
         run: |
           input="$AGENT_INPUT"
           if [ -n "$input" ]; then

.github/workflows/e2e.yml

@@ -143,10 +143,22 @@ jobs:
     uses: ./.github/workflows/e2e-windows.yml
     secrets: inherit
 
+  # Cover the git-refs checkpoint backend — the default for fresh `entire enable`
+  # setups — which the matrix above does not exercise (it pins git-branch). Agent
+  # (claude-code) and backend (git-refs) are fixed by the reusable workflow's
+  # input defaults, so this leg always covers exactly one agent on one backend.
+  e2e-git-refs:
+    uses: ./.github/workflows/e2e-checkpoint-store.yml
+    permissions:
+      actions: read
+      contents: read
+      copilot-requests: write
+    secrets: inherit
+
   notify-slack:
     runs-on: ubuntu-latest
-    needs: [e2e-tests, e2e-windows]
-    if: ${{ always() && (needs.e2e-tests.result == 'failure' || needs.e2e-windows.result == 'failure') && github.event_name == 'push' }}
+    needs: [e2e-tests, e2e-windows, e2e-git-refs]
+    if: ${{ always() && (needs.e2e-tests.result == 'failure' || needs.e2e-windows.result == 'failure' || needs.e2e-git-refs.result == 'failure') && github.event_name == 'push' }}
     steps:
       # Classify the failed jobs into two severities:
       #   RED    — a "reliable" agent (or Windows) failed. These pass on every

e2e/testutil/repo.go

@@ -169,9 +169,29 @@ func SetupRepo(t *testing.T, agent agents.Agent) *RepoState {
 		}
 	})
 
+	// Under the git-refs backend, checkpoints live in per-checkpoint refs and
+	// nothing should ever create the entire/checkpoints/v1 metadata branch. A v1
+	// branch appearing means some flow seeded it despite git-refs being primary
+	// (the enable-time regression this guards against). Registered last so it
+	// runs before the repo dir is removed (cleanups are LIFO).
+	if UsingGitRefs() {
+		t.Cleanup(func() { assertNoCheckpointV1Branch(t, dir) })
+	}
+
 	return state
 }
 
+// assertNoCheckpointV1Branch fails the test if a local entire/checkpoints/v1
+// branch exists in dir. Only meaningful under the git-refs backend; git-branch
+// legitimately creates v1.
+func assertNoCheckpointV1Branch(t *testing.T, dir string) {
+	t.Helper()
+	hash := strings.TrimSpace(gitOutputSafe(dir, "rev-parse", "--verify", "--quiet", "refs/heads/"+checkpointRefV1))
+	if hash != "" {
+		t.Errorf("git-refs backend: unexpected %s branch was created (%s); no flow should seed v1 under git-refs", checkpointRefV1, hash)
+	}
+}
+
 func checkpointReadRef() string {
 	return checkpointRefV1
 }