Repository navigation
Reuse release admission without changing the read-only inspector #600
Description
🤖 Generated by the Agentic Engineer
Problem
The release-recovery inspector now proves the original failed run, immutable tag/source and supported release configuration. A maintained publisher needs the same admission checks; copying them would let the two safety boundaries drift.
Design
Move the existing implementation and unchanged HTTP regression cases into a repository-local internal Go package. Keep the current command, arguments, output, fixed API, timeouts and GET-only behavior unchanged. This is an internal module boundary, not a new public library or product. A separate follow-up will introduce the publisher; this increment adds no mutation capability.
Acceptance criteria
- Existing native HTTP admission/refusal cases pass with unchanged assertions.
- The shipped command still builds from the same directory and preserves its successful and refused invocation behavior.
- Existing workflow and credential-boundary controls pass; no workflow permissions change.
- Exact-head CI, independent review and post-merge inspection of both recorded incidents confirm the refactor.
Refinement
Priority: High. Effort: Low including CI, review and hosted readback. Service class: Risk reduction. This directly unlocks the bounded publication increment in #587 and prevents divergent safety checks. No dependencies beyond merged #599. The maintainer explicitly waived WIP limits for this run.
Part of #587
Activity
chore: agent-claim #600 nonce=4a45331d6fdf7fa755f90af9086d60a8
devantler commentedon Oct 15, 2026
Implementation started 2026-10-15; PR #601 carries the behavior-preserving extraction. All existing HTTP assertions are byte-for-byte unchanged apart from the package declaration; the admission implementation differs only in package/import and the production entry wrapper. The original command build and refusal exit/stdout/stderr were exercised. The workflow guard, race tests, vet and all 14 repository baseline checks passed.
Native Priority/Effort bindings remain QUERY-UNKNOWN for writes: REST exposes the expected issue_field_id links, but the required complete GraphQL classifier input cannot be obtained while the authenticated GraphQL identity is quota-limited. No same-named fallback planning field was written; the refined High/Low rationale remains in this issue.
devantler commentedon Oct 15, 2026
PR #601 merged as
24a32fa15c261a768a8ebbb97984692ec478498afrom reviewed head2d957ed154fac0e43d803f9a006a8df42f01838d. The complete merge tree equals the reviewed tree. Full CI and the current-head CodeRabbit review passed before normal protected merge.Post-merge native verification built that exact immutable source and obtained one-repository read-only App authority:
Both enabled diagnoses remain
missing-github-release,authorization:none,publication_success:false, with channel metadata and draft inventory explicitly not inspected. This completes the extraction's acceptance, not publication recovery; #602/#603/#587 remain open.