Repository navigation
Approve KHoist's current immutable application publisher #5377
Description
🤖 Generated by the Agentic Engineer
Outcome
Restore the complete approved-publication observation refresh by reviewing and accepting only KHoist's current immutable application publisher. This unblocks recording the actually verified business-site source upgrade without omitting another consumer.
Evidence
The unchanged main regeneration run 40339634497 at Platform 4718a63d0128fc81a47df2772911f3ca40235e12 refused data-product-controller's unapproved current caller revision and wrote no partial set. The current public KHoist caller selects devantler-tech/.github/.github/workflows/publish-app.yaml@2df24600b1113e291b87e300b91e59c160446134 (v13.2.13). This is a new immutable input relative to #5267's earlier recovery; its authorization is not inherited from that recovery.
The publisher workflow differs from the already approved 467f07582436a26b62cf4aa756423512f85ba0c0 only in the harden-runner v2.22.2 pin. Its checked-out prebuilt-image helper also adds bounded public-CI rate-limit recovery and needs review with the unchanged ordinary image-build path and caller scope. No private source content is needed for that review.
Acceptance
- Bind the real current caller, complete executable publisher/helper changes and immutable third-party action change; record the review's limits.
- Add only the exact consumer/workflow/repository/revision approval while preserving revisions still needed by current publications. No wildcard, mutable reference, global consumer approval or runtime activation.
- Use maintained generation for observations and matchers; retain every consumer. Prove exact acceptance and unrelated-consumer, wrong issuer/repository/workflow, mutable-ref and unapproved-revision refusal controls.
- Complete applicable validation, real operator evaluation, substantive current-head review and protected merge/deployment.
- Run the unchanged genuine complete observation refresh, verify unchanged-input stability, and record the accepted business-site source only after its actual Ready/SourceVerified proof.
Part of #5267. Unblocks the observation follow-through of #5361. Feature, High priority, Medium effort, Standard. No new service, paid review or production application activation.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Start date
Target date
Effort
Projects
- Status
Activity
chore: agent-claim #5377 nonce=8ed22775bf25b2c92a167cb47325a7f3
chore: agent-claim #5377 nonce=32eb89573a38d453b0a7f5f3c9cf97e7
chore: agent-claim #5377 nonce=44ec28dfb5bf7e70c6f7ed58d4a37e00
devantler commentedon Oct 26, 2026
Refinement binds KHoist's current public caller to
2df24600b1113e291b87e300b91e59c160446134. Against approved467f07582436a26b62cf4aa756423512f85ba0c0, the complete publisher workflow changes only harden-runner from its immutable v2.22.1 pin to the v2.22.2 pin already used by current Platform main. All other action pins, publisher permissions, ordinary image-build logic, signing/attestation steps and caller options are unchanged.The workflow checks out its own immutable workflow revision and copies three maintained helpers. Two are unchanged. The prebuilt-image helper adds only bounded credential-free public-CI read recovery: three attempts, at most 120 seconds total, fixed HTTPS API evidence, duplicate-header refusal and unchanged complete CI identity validation. It neither adds an artifact authority nor relaxes the original signature/source joins. The third-party action change updates the agent version and corresponding checksum values; its selected egress setting remains audit.
Implementation must cover the existing source, image-admission and node-pull acceptance surfaces, not only append an approval row. Preserve the existing bounded caller/repository rules, every other consumer's explicit approvals, and revisions still required by actual publications. Exercise the maintained generation/guard and rejection controls before review. The complete generator remains fail-closed until this independently reviewed transition is delivered; no partial consumer list or activation workaround is proposed.
Priority High / Effort Medium / Standard are now read back from their native/project fields. WIP capacity is explicitly waived by the maintainer for this session; ownership, review, validation, protected deployment and observed-record gates remain unchanged.
devantler commentedon Oct 26, 2026
The input that required a new approval has been withdrawn upstream: KHoist #500 restored the already approved publisher and Platform #5378 merged the complete observation refresh at
ef018aa140a64f7cf3e0c112b591bd9933536108. The recorded business-site source matches its actual Ready/SourceVerified digest. Closing this issue as not planned/superseded, with its unmerged PR #5381 withdrawn. No additional publisher permission has been delivered or is needed to complete #5361's observation follow-through.