Distillation

Date: Aug 29, 2026

• 🔴 [requested-review] (13:07) User requested a read-only, substantive correctness review of the current working tree’s release approval gate; explicitly instructed not to edit.
• 🟡 (13:07) User asked review to focus on .github/workflows/publish.yml, .github/workflows/ci-poller.yml, src/modules/approval-attestation.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-ci-ready-attestation.js, src/publish/validate-approval-attestation.js, and their tests.
• 🟡 (13:07) User asked verification of five release-gate invariants: (1) only target-repo write/maintain/admin users or exactly allowlisted getsantry bots can proceed from approval; (2) the title and original accepted-label event stay bound from poll start through ci-ready, including across a quick re-approval; (3) ci-ready triggers cannot be manually forged; (4) workflow_dispatch remains allowed; and (5) failures clean up accepted state and do not publish.
• 🔴 [requested-evidence] (13:07) User required a substantive report with file:line evidence, each finding classified PASS, CONCERN, or MUST-FIX.
• 🔴 [requested-output-format] (13:07) User required the review response to be non-empty and to end exactly MERGE or DO-NOT-MERGE.