Distillation

Date: Aug 28, 2026

• 🟡 (12:03) Independent Craft compact-contract review identified a DO-NOT-MERGE high-severity issue: workspace-key grammar in src/schemas/project_config.ts:236-249 allowed __proto__, but Zod silently dropped it from record output; workspaces: { __proto__: {} } validated while getWorkspaceNames() returned [], selection reported no workspaces, and the root github.projectPath guard in src/config.ts:215-225,381-385 was bypassed because Object.keys() saw an empty object. Existing prototype-name coverage at src/__tests__/config.test.ts:373-381 did not configure a prototype-named key.
• 🟡 (12:03) Independent Craft compact-contract review identified a DO-NOT-MERGE medium-severity issue: action.yml:84-90 used Bash regex ^[A-Za-z0-9_.-]+$, whose range matching is locale-dependent; under en_US.utf8, Bash accepted é while src/schemas/project_config.ts:236-238 rejected it. The Unicode-control check did not reject ordinary non-ASCII letters, allowing invalid workspace values to reach later gh/git side effects at action.yml:93-103 and 179-191; existing tests covered ASCII and / but not alternate locales in src/__tests__/action.test.ts:193-220.
• 🟡 (12:03) Assistant stated it would tighten both Craft workspace validations and add regressions exercising the actual YAML and action paths.
• 🟢 (12:09) Task status: “Fix reviewed workspace-key and locale validation blockers” was in progress; “Add focused regressions for YAML prototype keys and non-ASCII action input,” “Rerun Craft verification and adversarial review,” “Implement Publish compact-title checkout resolution,” and “Verify, push, and monitor linked PRs” were pending, all high priority.
• 🟡 (12:18) Available locales were C, C.utf8, en_US.utf8, and POSIX.
• 🟡 (12:25) Assistant chose to reject the special __proto__ workspace key at schema entry rather than allow Zod to drop it, and to replace Bash’s locale-sensitive matcher with Node’s ASCII regex.
• 🟡 (12:27) Updated Craft files: ../craft-workspace-action-propagation/src/schemas/project_config.ts, ../craft-workspace-action-propagation/action.yml, ../craft-workspace-action-propagation/src/__tests__/config.test.ts, and ../craft-workspace-action-propagation/src/__tests__/action.test.ts.
• 🟡 (12:30) Updated ../craft-workspace-action-propagation/src/__tests__/config.test.ts again.
• 🟡 (12:34) Focused Craft verification passed after formatting: Vitest v4.1.8 reported 3 test files passed and 57 tests passed; action.yml, src/__tests__/config.test.ts, and src/__tests__/action.test.ts were unchanged by formatting, while src/schemas/project_config.ts was formatted.
• 🟡 (12:34) Assistant reported regressions now cover rejection of YAML __proto__ and rejection of non-ASCII action workspace input under en_US.utf8; focused suite (57 tests) and typecheck passed.
• 🟢 (12:36) Task status: workspace-key/locale blockers and their focused regressions were completed; “Rerun Craft verification and adversarial review” was in progress; Publish compact-title checkout resolution and linked-PR verification/push/monitoring remained pending.
• 🔴 (12:39) User stated they never used @typescript-eslint/no-unused-vars.
• 🟡 (12:39) Full Craft source verification passed: Vitest v4.1.8 reported 61 test files passed, 1,150 tests passed, and 1 skipped (1,151 total), duration 29.31s; ESLint reported 0 errors and 7 warnings; Prettier formatting passed; node build.mjs completed with SENTRY_AUTH_TOKEN absent, skipping source-map upload.
• 🟡 (12:39) Full Craft lint warnings were all @typescript-eslint/no-unused-vars: src/commands/publish.ts had _abortError at lines 482, 499, and 527, _statusError at 515, and _diffError at 521; src/utils/git.ts had _err at lines 241 and 249.
• 🟡 (12:39) Full Craft test/build diagnostics included GitHub target cleanup/release-state scenarios, failed floating-tag update warning, release-body truncation warnings for 180000 > 125000 characters and 125001 > 125000 characters, local-ref fallback after failed remote fetch/list-branches, and Vite SSR warnings that assignments to imported checkExecutableIsPresent in src/targets/__tests__/symbolCollector.test.ts would throw.
• 🟡 (12:39) Craft docs build failed because astro was not found; pnpm reported that docs/package.json existed but docs/node_modules was missing.
• 🟡 (12:40) Assistant diagnosed the failed docs build as missing docs/node_modules, stated it would install locked docs dependencies with pnpm, then rerun the docs build and final Craft review.