Distillation

Date: Aug 28, 2026

• 🟡 (20:21) Inspected src/modules/__tests__/approval-attestation.js (90 lines). Existing Vitest tests import createApprovalAttestation, currentAcceptedEvent, hasApprovalAttestation, and parseApprovalAttestation from ../approval-attestation.js; verify latest accepted event selection (id: "200" over "100"), numeric GitHub event ID normalization (29503999078 → "29503999078"), trusted-comment author matching, rejection of stale/mismatched attestations, and malformed <!-- publish-approval not-base64 --> parsing to null.
• 🟡 (20:23) Updated src/modules/approval-attestation.js; exact code changes were not shown in this segment.
• 🟡 (20:23) Assistant stated the authorization/approval attestation alone is insufficient; chose to add an independent CI-pass attestation tied to the exact approval event and issue title, so publication rejects manually applied ci-ready labels and approval changes during CI handoff.
• 🟡 (20:25) Updated src/modules/__tests__/approval-attestation.js; exact test changes were not shown in this segment.
• 🟡 (20:26) Added src/publish/record-ci-ready-attestation.js.
• 🟡 (20:26) Updated src/publish/validate-approval-attestation.js; exact code changes were not shown in this segment.
• 🔴 (20:28) User directed that workflow_dispatch must always be allowed for manual recovery.
• 🟡 (20:28) Inspected .github/workflows/ci-poller.yml lines 1–70. CI Status Poller runs every 5 minutes (cron: "*/5 * * * *") and supports workflow_dispatch with optional attempt input defaulting to "0"; check-ci runs on ubuntu-latest in production when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch', with concurrency group ci-status-poller and cancel-in-progress: false. It checks out with actions/checkout@v6 and persist-credentials: false; creates sentry-internal-app and release-bot credentials using actions/create-github-app-token@v3; uses GH_TOKEN for publish-repo label changes and RELEASE_TOKEN for cross-repository API calls. The release-bot token is created with owner: getsentry because sentry-internal-app is not installed on some private repositories including sentry-xbox, sentry-playstation, sentry-switch, and service-registry.
• 🟡 (20:28) Assistant stated the intended handoff ordering: the CI poller will post the CI-pass proof only after final approval validation and before adding ci-ready; the publisher will require this proof in addition to the approval attestation.