Distillation

Date: Sep 9, 2026

• 🔴 (23:16) User stated: “Always allow workflow_dispatch for manual recovery.” This invariant is documented in .github/workflows/ci-poller.yml.
• 🔴 (23:16) User stated: “Always run trusted code.” The CI poller accounts for workflow_dispatch being able to target any ref.
• 🔴 (23:16) User stated: “Never move a release to ci-ready after it changes.” The CI poller revalidates the accepted event before inspecting CI.
• 🔴 (23:16) User stated that a renamed or re-approved issue “never reaches ci-ready.”
• 🟡 (23:16) .github/workflows/auto-approve.yml changes included adding issues: write, setting environment: production, pinning actions/checkout to 11d5960a326750d5838078e36cf38b85af677262, pinning actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1, and adding a Record automated approval attestation step.
• 🟡 (23:16) CI poller input validation accepts ATTEMPT only when it matches ^(0|[1-5][0-9])$, and increments it using base-10 arithmetic: attempt=$((10#$ATTEMPT + 1)).
• 🟡 (23:16) CI poller changes invoke node src/publish/current-accepted-event.js to bind processing to the current accepted-label event.
• 🟡 (23:16) CI poller remediation includes removing the ci-pending label and warning ::warning::Approval for issue #${number} changed before ci-ready. Removing accepted. when approval changes before transition to ci-ready.
• 🟡 (23:16) Approval revalidation passes APPROVAL_ISSUE_TITLE="$title" and EXPECTED_ACCEPTED_EVENT_ID="$accepted_event_id" to enforce immutable issue-title and accepted-event identity checks.
• 🟡 (23:16) Workflow changes include a Reject revoked approval step and at least one cleanup/remediation step configured with continue-on-error: true.