Distillation

Date: Sep 10, 2026

• 🟡 [requested-tests] (02:37) Fail-first regressions were added to src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, and src/publish/__tests__/ci-poller-workflow.js.
• 🟡 (02:37) Fail-first command executed: yarn vitest run src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace using Vitest v4.1.0.
• 🟡 (02:37) Fail-first results: 3 test files failed with exactly 1 failure each. src/publish/__tests__/ci-poller-workflow.js had 4 tests with 1 failure; src/publish/__tests__/record-ci-ready-attestation.js had 4 tests with 1 failure; src/publish/__tests__/validate-approval-attestation.js had 10 tests with 1 failure.
• 🟡 (02:37) src/publish/__tests__/ci-poller-workflow.js test binds every poller approval fence to the listed request snapshot failed because .github/workflows/ci-poller.yml did not contain request_digest=$(echo "$publish_input..., confirming the workflow carried no canonical snapshot digest.
• 🟡 (02:37) Both src/publish/__tests__/record-ci-ready-attestation.js and src/publish/__tests__/validate-approval-attestation.js failed the new test rejects a valid live approval for a different poller snapshot, confirming live validation and CI-ready attestation creation accepted an approval for a snapshot different from the poller-listed snapshot.
• 🔴 (02:37) User directive: “Always run trusted code.”
• 🔴 (02:37) User directive: “Never move a release to ci-ready after it changes.”
• 🔴 (02:37) User requires that a renamed or re-approved issue “never reaches ci-ready.”
• 🟡 (02:37) Assistant identified three demonstrated gaps: live validation accepts a different listed snapshot; CI-ready proof creation accepts a different listed snapshot; and the workflow does not carry a snapshot digest.
• 🟡 (02:37) Implementation contract chosen: the canonical poller resolver will digest its exact title, body, and labels, including the dry-run choice, and every live approval fence plus CI-ready proof call will require that same digest.