Distillation

Date: Sep 4, 2026

• 🔴 (20:08) User directive: never return empty.
• 🔴 [requested-read-only-audit] (20:08) User requested a strict final READ-ONLY adversarial audit of the complete CURRENT uncommitted diff and relevant source in both worktrees: /home/byk/Code/getsentry/craft-workspace-action-propagation and /home/byk/Code/getsentry/publish-workspace-acceptance.
• 🔴 (20:08) User required the audit not edit files, format, generate, run mutating commands, or change git state.
• 🔴 (20:08) User stated getsentry/craft:latest in Publish is intentional and REQUIRED; it must remain floating so the controller uses the latest released Craft workspace behavior. The CI-approved revision supplied to checkout and craft publish --rev binds all repository operations. User instructed not to report latest as a concern or recommend pinning it.
• 🔴 (20:08) User required exact current file:line citations and severity-ranked findings only for every audited invariant; each numbered invariant must be labeled PASS, CONCERN, or MUST-FIX.
• 🔴 (20:08) User required the audit to verify invariant 1: CI poller validates repository, Craft-compatible version, and canonical title path before getReleaseRevision or any API-oriented work; root is allowed; traversal, dot, prototype, and option-like segments are rejected.
• 🔴 (20:08) User required the audit to verify invariant 2: Craft getPublishStateFilename and Publish workflow Set targets use identical, lossless state-version encoding; safe lowercase existing names remain unchanged; altered valid versions encode raw bytes base64url; case/punctuation variants cannot collide.
• 🔴 (20:08) User required the audit to verify invariant 3: Craft safe brace workspace globs such as packages/{cli,mcp} expand; unsafe brace alternatives—relative traversal, absolute path, malformed syntax—fail before globSync; safe character/negated classes, globstar, concrete literals, POSIX / paths, overlap failure, physical symlink containment, and equivalence or safe layering of schema/runtime checks are verified.
• 🔴 (20:08) User required the audit to verify invariant 4: Action validates untrusted path/workspace before all side effects, clears ambient CRAFT_WORKSPACE, preserves full exact workspace titles, and preserves mutual exclusion.
• 🔴 (20:08) User required the audit to verify invariant 5: Publish checks out the CI-approved SHA before discovery; uses exact case-sensitive full-path matching; defaults a missing root .craft.yml to checkout-path behavior; validates discovery output; gates only on fresh accepted ci-ready; isolates external state; and passes --rev.
• 🔴 (20:08) User required the audit to verify invariant 6: parser, generated output, docs, and focused/full tests match the path-only title model, including unrelated-churn hygiene.
• 🔴 (20:08) User required the audit response to end exactly MERGE or DO-NOT-MERGE; if blocked, it must begin BLOCKED with the exact tool/error.