[botantler-1]

🤖 Generated by the Agentic Engineer

Why

The cluster only trusts releases signed by publishing-workflow revisions it
has approved. A consumer's deployed release or workflow pin has moved,
so the approved list is out of date.

What

Refresh the approved list and each consumer's matcher from what is deployed
and what each consumer currently pins. Every consumer resolved on both halves,
and each matcher accepts exactly its approved revisions.

No issue: trivial fix.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T01:09:21.248871Z	9c510cd	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 9c510cd657

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Exact-head evaluation: 9c510cd657302dfc9aaca4868d7f1ab0c565f23f.

The native regeneration run 39523414940 succeeded on the merged implementation. This PR changes only the observed .github publication version, digest and observation date; the approved signer identities and all other consumers remain unchanged. The observed digest was independently matched to the Ready live source.

Native PR CI 39523516815 completed successfully at this exact head. Codex completed its exact-head review with no findings; all review and comment surfaces were read with complete pagination and no unresolved threads. The programmed-updater exemption does not apply, so this is ordinary protected review, not an exemption. No code from this bot-authored branch was executed locally.

Correctness, simplification and security review found no additional changes needed: this is an observation update, not a publisher-approval change. The independent code-quality ruleset is not readable through the API; it remains enforced by GitHub's protected merge decision.

[devantler]

🤖 Generated by the Agentic Engineer

Merged through the normal protected queue as a78f471c044a85276edc7380f797e58e506d35f4. The exact merge-group CI/Prod run 39538993849 succeeded.

Independent live readback confirms the maintained catalogue artifact at 7.23.0 with the expected immutable digest, current observed generation, Ready and SourceVerified true. This closes the generated observation update; it does not assert that every remaining legacy consumer has been migrated or that retirement is already cleared.