[devantler]

🤖 Generated by the Agentic Engineer

Why

The publication refresh stops when the data product selects its current publisher, delaying verified source updates for other applications.

What

Approves the reviewed publisher for the data product while preserving the running publication and keeping every other application’s approval unchanged. The complete observation refresh follows protected deployment.

Part of #5377

[devantler]

🤖 Generated by the Agentic Engineer

Publisher review and validation at b35f57e7aa86ca97af515e9c3ba8b7d45e028d44:

• The current public KHoist caller selects immutable publisher 2df24600b1113e291b87e300b91e59c160446134 (v13.2.13). Against prior approval 467f07582436a26b62cf4aa756423512f85ba0c0, the reusable publication workflow changes only the pinned harden-runner action. Of the three helpers copied from that immutable checkout, only the prebuilt WebApp helper changed.
• The helper adds bounded, credential-free recovery for public CI rate limits, retaining the complete source, run, attempt, signature and provenance checks. KHoist's ordinary image build leaves prebuilt mode disabled; no new publication mode is activated here.
• Reviewed the v13.2.13 notes, complete publisher-range comparison, and harden-runner v2.22.2 notes plus its source diff. The action changes platform-specific agent versions/checksums; the public Ubuntu non-TLS agent remains unchanged. No caller adaptation, new permission, feature activation or workaround removal is needed for this approval.
• Rotated only this consumer's two canonical approvals: retain the prior reviewed publisher, admit the exact current publisher, and retire the older unused canonical revision. The currently applied legacy publication remains accepted. The maintained writer changed exactly one matcher; the observation ledgers remain untouched.
• The real approval entrypoint reproduced the original refusal before the change and now admits the current tuple. Wrong repository/workflow, mutable and unapproved revisions, and the same revision for an unrelated consumer still refuse. Committed matcher regressions also cover wrong issuer, the retired revision, altered/short identities and unrelated-consumer isolation.
• Guard, writer, canonical approval, canonical publisher regeneration and focused generator/source regressions pass. Both KSail overlay validations exited successfully and the changed source was independently rendered from the production apps layer. Local Helm rendering was incomplete because the configured credential helper is unavailable; hosted validation remains required. The final bootstrap-output regression also passed after being rerun separately when the aggregate local command reached its deadline.

Correctness and simplification self-review found no remaining issue in the three-file diff. This remains a draft pending hosted CI and substantive review. After protected deployment, run the unchanged complete observation refresh and verify input stability; #5377 remains open until that evidence is collected.

[devantler]

🤖 Generated by the Agentic Engineer

CI diagnosis at b35f57e7aa86ca97af515e9c3ba8b7d45e028d44: the changed KHoist documentation signer matcher also changes its rendered authorization fingerprint, but this draft does not update the corresponding approved surface. The committed ledger still records 621428fc…; both failed jobs render 8e51e7f7… and reject the two-line difference. This is a source/approval mismatch, not a reason to rerun unchanged CI.

Use the maintained authorization approval generator to record only that reviewed source change, verify the complete ledger diff remains limited to it, and rerun the authorization regressions plus required CI. The current three-file diff remains incomplete until those checks pass. Evidence: Validate Complete Go Regressions and Validate Production Authorization.

The separate observation-refresh PR #5378 changes publication receipts and does not change this approval ledger, so its merge alone will not repair this failure. This is a diagnosis of the current draft; no branch or approval record was changed.

[devantler]

🤖 Generated by the Agentic Engineer

Closing this draft as superseded. KHoist #500 restored the already approved publisher at fa5a13e772dc2cc26db784170a31aa3624620235, and #5378 delivered the complete observation refresh. Issue #5377 is now closed as not planned; the parallel approval proposal #5381 was also withdrawn.

I re-read this draft at b35f57e7aa86ca97af515e9c3ba8b7d45e028d44, its two prior validation records, and the upstream recovery. Its matcher/approval changes and transition tests are no longer needed. The recorded authorization-ledger failure remains valid for this unmerged proposal; no check or approval is bypassed. Closing preserves the existing deployed approval set and removes an obsolete permission change from the delivery queue.