[devantler]

🤖 Generated by the Agentic Engineer

Why

Release recovery stops before publication even after the existing GitHub App issues its scoped credential, leaving older releases missing.

What

Verify the credential’s actual authority before inspecting drafts or publishing, while preserving consent, one publication attempt and independent readback. Consumer rollout and the real recoveries remain required before closing the issue.

Part of #787

[github-code-quality]

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main 3c142ab	codex/recovery-write... 149d0bf	+/-
50%	50%	0%

C# / code-coverage/dotnet

main 3c142ab	codex/recovery-write... 149d0bf	+/-
100%	100%	0%

Go / code-coverage/go

main 3c142ab	codex/recovery-write... 149d0bf	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 28, 2026 09:01 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

Validation at 149d0bf4e6b874f5e7959d6d73ec5ad5545be340:

• Reproduced both regressions before the repair: a valid installation-shaped writer was refused, while role metadata could send a read-only token as far as a publication attempt. The repaired stateful HTTP controls now pass both cases.
• The full Go module passes with the race detector and go vet. Controls cover denied, unavailable, redirected, oversized and malformed permission responses; changed repository identity; discarded preview content; complete draft inventories; source re-admission; one publication request; unchanged latest release; and unknown-outcome/no-op reconciliation.
• The complete publisher and GET-only inspector boundary suites pass, including offline execution and consent/scope mutations. Instruction-layout validation also passes. The correctness, security and simplification self-review is complete.
• Native CI 40660632643 passes at this head. GitHub initially recorded the unchanged security upload as Unknown Error while its scanner job reported success. One bounded scanner replay produced a complete error-free native analysis; the latest checks are settled and the native merge state is clean. No scanner configuration, finding threshold or permission changed.

The actual App-backed consumer rollout and both historical recoveries remain unverified and are still required by #787. This source fix alone does not complete them or establish the historical Git-ref rejection cause.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: devantler-tech/.github
• Branch: codex/recovery-writer-787-r69
• File: .coderabbit.yaml
• Commit: 149d0bf
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ae7d04f6-49b6-4585-9c42-2effa7017e27

Commits

Reviewing files that changed from the base of the PR and between 3c142ab and 149d0bf.

Files selected for processing: 4

• .github/agent-guides/catalogue.md
• .github/scripts/inspect-release-recovery/internal/publication/publication.go
• .github/scripts/inspect-release-recovery/internal/publication/publication_test.go
• README.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 1

• GitHub Check: CodeRabbit

Additional context used

Code guidelines: 3

.github/agent-guides/catalogue.md — auto-discovered
.github/agent-guides/workflows.md — auto-discovered
CONTRIBUTING.md — auto-discovered

Path-based instructions: 4

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) | Guide | Read before | |---|---| | [Catalogue layout and references](.github/agent-guides/catalogue.md) | Adding or moving componen...

CodeRabbit inference engine (.github/agent-guides/catalogue.md)

Files:

• README.md

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) | Guide | Read before | |---|---| | [Workflow and CI contracts](.github/agent-guides/workflows.md) | Any catalogue implementation, t...

CodeRabbit inference engine (.github/agent-guides/workflows.md)

Files:

• README.md

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) Three things share one repo: **The org's public profile** — `profile/README.md` (rendered on the org page), plus the org-wide commun...

CodeRabbit inference engine (CONTRIBUTING.md)

Files:

• README.md

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) Three things share one repo: **The org's public profile** — `profile/README.md` (rendered on the org page), plus the org-wide community health files i...

CodeRabbit inference engine (CONTRIBUTING.md)

Files:

• .github/agent-guides/catalogue.md
• .github/scripts/inspect-release-recovery/internal/publication/publication.go
• .github/scripts/inspect-release-recovery/internal/publication/publication_test.go

Additional comments: 2

.github/agent-guides/catalogue.md: 1

42-46: LGTM!

Also applies to: 57-59

README.md: 1

1179-1180: LGTM!

Also applies to: 1190-1197, 1230-1230

Walkthrough

The release recovery publisher now revalidates repository identity and status, then uses a non-persisting release-notes preview to verify writer capability. It stops before draft inventory and publication if the preview is denied, unavailable, or malformed. The preview content is discarded; the publisher uses a deterministic recovery receipt as the published body. Tests cover capability checks and refusal cases. Documentation describes the workflow’s scope and adoption requirements.

Possibly related issues

• Issue 787 in devantler-tech/.github: The change implements writer-capability proof before draft inventory and publication.
• Issue 587 in devantler-tech/.github: The change strengthens the shared recovery publisher before draft inspection and its bounded publication attempt.
• Issue 603 in devantler-tech/.github: The change provides the shared capability-proof repair, while protected rollout and publication evidence remain separate requirements.

Priority: Normal

Merge Risk: Minimal · up to 149d0

No merge-blocking issue was identified. The App-backed rollout and historical recoveries still require validation.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly summarizes the main change: proving release recovery writer capability through GitHub before publication.
Description check		The description directly explains why the credential authority check is needed and what the change does, including the preserved recovery safeguards and remaining rollout work.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 2 files. (2 skipped: 2 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 149d0bf4e6b874f5e7959d6d73ec5ad5545be340, base 3c142ab5811b6a6ca2374664c3f5a2b548d407db: 193 successful and 53 intentionally skipped native checks, zero unresolved threads, zero non-thread findings, no conflict, and a finding-free CodeRabbit review completed after the authenticated request for this head. The verdict helper reports GREEN. Every readable required gate passes; the configured code-quality rule has no independently readable verdict in the completeness helper, and GitHub reports CLEAN under its normal protections.

User evaluation exercised the real publisher against the stateful HTTP service: valid installation-shaped writers proceed through one verified publication, read-only credentials stop before draft inventory or release creation, malformed/changed observations fail, the recovery receipt remains deterministic, and a later matching publication is a no-op. The full native CI run executes the recovery module and shipped offline/boundary controls. Local race tests, vet and both recovery suites pass.

This evaluates the engine correction behind the existing default-off recovery workflow. Actual App-backed Platform adoption and historical publication are separate, still-open acceptance gates in #787 and #603. They are not claimed by these local/native offline controls; no activation or issue closure is included in this merge.