Distillation

Date: Sep 4, 2026

• 🔴 (08:26) User directive: workspace glob keys must never escape base before filesystem access.
• 🔴 (08:26) User requires a final strict read-only adversarial audit: do not edit files, run formatters/generators, or change git state.
• 🟡 [requested-audit] (08:26) User requested inspection of complete current uncommitted diffs in both worktrees: /home/byk/Code/getsentry/craft-workspace-action-propagation and /home/byk/Code/getsentry/publish-workspace-acceptance.
• 🔴 (08:26) User’s required Action-title contract: new titles are publish: <checkout-repository>/<full-concrete-workspace-path>@<version>, preserve exact case and path spelling, and workspace and checkout path are mutually exclusive.
• 🔴 (08:26) User’s required publish-resolution contract: resolve CI revision before target checkout; perform exact-SHA checkout before reading root .craft.yml workspace list; select a workspace via exact unnormalized full-suffix match; treat all nonmatches as checkout paths; and fail closed for path behavior and discovery errors when root config is absent.
• 🔴 (08:26) User’s required input-safety contract: untrusted manual issue paths and discovered workspace names must reject empty values, ., .., __proto__, leading -, backslashes, and non-ASCII/control values before checkout, state, or publish; do not normalize.
• 🔴 (08:26) User’s required Craft remote-config contract: --config-from resolves workspace globs from the checked-out repository root; regular *, ?, character classes including [!a] and [^a], and globstar remain valid; literal/configured workspace-path safety matches concrete workspace safety.
• 🔴 (08:26) User’s required CI-event contract: publishing begins only on a fresh ci-ready label event for an open accepted issue with neither pending nor failed CI; waiting state removes stale ci-ready first.
• 🔴 (08:26) User’s required state/publish contract: state is external to target checkout and isolated by checkout repository, path, workspace, and version; Craft publish receives exact CI revision through --rev.
• 🔴 (08:26) User’s required compatibility/docs contract: new titles are intentionally path-only; no legacy JSON workspace form is required; documentation must state this accurately.
• 🔴 (08:26) User’s required final-quality contract: generated parser parity, tests, docs, intended diff scope, and no unrelated formatter churn; seven historical Craft unused-variable lint warnings are non-findings.
• 🔴 [requested-output-format] (08:26) User requested only severity-ordered findings, with exact file:line citations and explicit PASS/CONCERN/MUST-FIX label for every numbered contract; if blocked, begin with BLOCKED and exact tool/reason; do not return an empty result; end exactly MERGE or DO-NOT-MERGE; no generic praise.