Distillation

Date: Sep 4, 2026

• 🔴 (12:07) User directive: Never return empty.
• 🔴 [requested-read-only-audit] (12:07) User requested a strict final READ-ONLY adversarial audit; instructed not to edit files or git state.
• 🔴 (12:07) User specified audit targets: /home/byk/Code/getsentry/craft-workspace-action-propagation and /home/byk/Code/getsentry/publish-workspace-acceptance; requested inspection of complete current uncommitted diffs in both.
• 🔴 (12:07) User stated prior claimed-fixed DO-NOT-MERGE blocker A: Publish detailsFromContext must validate repository identities and release versions before workflow target checkout, state filename construction, and craft publish.
• 🔴 (12:07) User specified repository-identity validation requirements: reject empty values, ., .., __proto__, leading-dash values, and non-token values.
• 🔴 (12:07) User specified release-version validation requirements: follow Craft-compatible complete semantic-version behavior; permit known 4.2.6+sentry1; reject option-like, incomplete, and path values.
• 🔴 (12:07) User requested verification of blocker A's parser, diagnostics, tests, and documentation.
• 🔴 (12:07) User stated prior claimed-fixed DO-NOT-MERGE blocker B: Craft glob matches must not physically escape the workspace base through symlink directories.
• 🔴 (12:07) User specified blocker B requirements: realpath containment must occur before admitting a directory; non-existent or racy matches must fail closed; regular internal paths and supported globs must remain correct.
• 🔴 (12:07) User requested verification that an external-symlink glob regression genuinely catches the old code.
• 🔴 (12:07) User requested audit of existing workspace contracts: exact full action title paths; path/workspace mutual exclusion; CI revision before checkout/discovery; exact suffix workspace matching and missing root config path fallback; all untrusted values rejected before side effects; glob/literal safety plus remote config root; fresh ci-ready gate; external scoped state and --rev; intentional path-only grammar; generated parser parity; docs; tests; and no formatter churn.
• 🔴 (12:07) User required audit output to contain only severity-ordered findings with current exact file:line citations; give PASS/CONCERN/MUST-FIX per contract; end exactly MERGE or DO-NOT-MERGE; and include no generic summary.