Verify legacy tag in fresh-clone gate

tools/milestone5_fresh_clone.py

@@ -22,6 +22,10 @@ EXPECTED_ORIGINS = {
 }
 COMMIT_PATTERN = re.compile(r"^[0-9a-f]{40}$")
 COMMAND_TIMEOUT_SECONDS = 30 * 60
+LEGACY_MIGRATION_TAG = "v1.0.0"
+LEGACY_MIGRATION_TAG_REF = f"refs/tags/{LEGACY_MIGRATION_TAG}"
+EXPECTED_LEGACY_TAG_OBJECT = "2d7d306a37da89f1c860c7f0be161c45386acf61"
+EXPECTED_LEGACY_TAG_COMMIT = "593c173b453236a6872d0a4e88e7a51a67a21cde"
 
 
 class FreshCloneError(RuntimeError):
@@ -77,6 +81,50 @@ def _digest(value: str) -> str:
     return hashlib.sha256(value.encode("utf-8")).hexdigest()
 
 
+def validate_legacy_tag(*, object_type: str, tag_object: str, tag_commit: str) -> None:
+    if object_type != "tag":
+        raise FreshCloneError(f"{LEGACY_MIGRATION_TAG} is not an annotated tag")
+    if tag_object != EXPECTED_LEGACY_TAG_OBJECT:
+        raise FreshCloneError(
+            f"{LEGACY_MIGRATION_TAG} tag object does not match the frozen release"
+        )
+    if tag_commit != EXPECTED_LEGACY_TAG_COMMIT:
+        raise FreshCloneError(f"{LEGACY_MIGRATION_TAG} commit does not match the frozen release")
+
+
+def obtain_legacy_tag(
+    clone: Path,
+) -> tuple[subprocess.CompletedProcess[str], str, str]:
+    fetch = _run(
+        [
+            "git",
+            "fetch",
+            "--no-tags",
+            "origin",
+            f"{LEGACY_MIGRATION_TAG_REF}:{LEGACY_MIGRATION_TAG_REF}",
+        ],
+        cwd=clone,
+    )
+    object_type = _run(
+        ["git", "cat-file", "-t", LEGACY_MIGRATION_TAG_REF],
+        cwd=clone,
+    ).stdout.strip()
+    tag_object = _run(
+        ["git", "rev-parse", LEGACY_MIGRATION_TAG_REF],
+        cwd=clone,
+    ).stdout.strip()
+    tag_commit = _run(
+        ["git", "rev-parse", f"{LEGACY_MIGRATION_TAG_REF}^{{commit}}"],
+        cwd=clone,
+    ).stdout.strip()
+    validate_legacy_tag(
+        object_type=object_type,
+        tag_object=tag_object,
+        tag_commit=tag_commit,
+    )
+    return fetch, tag_object, tag_commit
+
+
 def run_fresh_clone_gate(commit: str) -> dict[str, object]:
     """Clone the public successor anonymously and run its complete release gate."""
 
@@ -95,6 +143,7 @@ def run_fresh_clone_gate(commit: str) -> dict[str, object]:
         checked_out = _run(["git", "rev-parse", "HEAD"], cwd=clone).stdout.strip()
         if checked_out != commit:
             raise FreshCloneError("Anonymous clone did not check out the requested commit")
+        tag_fetch, tag_object, tag_commit = obtain_legacy_tag(clone)
         fsck = _run(["git", "fsck", "--full"], cwd=clone)
         environment = dict(os.environ)
         environment["UV_LINK_MODE"] = "copy"
@@ -111,15 +160,21 @@ def run_fresh_clone_gate(commit: str) -> dict[str, object]:
         ).stdout.strip()
     elapsed_ms = round((time.perf_counter_ns() - started) / 1_000_000, 3)
     return {
-        "schema_version": 1,
+        "schema_version": 2,
         "repository": PUBLIC_REPOSITORY,
         "authentication": "anonymous_https",
         "commit": commit,
+        "legacy_migration_tag": {
+            "name": LEGACY_MIGRATION_TAG,
+            "annotated_tag_object": tag_object,
+            "commit": tag_commit,
+        },
         "clean_after_gate": True,
         "version_surface": version,
         "elapsed_ms": elapsed_ms,
         "logs": {
             "clone_sha256": _digest(clone_result.stdout + clone_result.stderr),
+            "legacy_tag_fetch_sha256": _digest(tag_fetch.stdout + tag_fetch.stderr),
             "fsck_sha256": _digest(fsck.stdout + fsck.stderr),
             "sync_sha256": _digest(sync.stdout + sync.stderr),
             "npm_sha256": _digest(npm.stdout + npm.stderr),