[devantler]

🤖 Generated by the Agentic Engineer

Why

The latest configuration release cannot be accepted, so organization updates have stopped reconciling. An unchanged publisher still needs separate approval when its signing identity changes.

What

Restore the previously approved publisher and prevent the same incompatibility from recurring. Keep signature verification and publication safeguards enforced.

Fixes #729

[github-code-quality]

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main 602159b	codex/restore-config... 91b344d	+/-
50%	50%	0%

C# / code-coverage/dotnet

main 602159b	codex/restore-config... 91b344d	+/-
100%	100%	0%

Go / code-coverage/go

main 602159b	codex/restore-config... 91b344d	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 23, 2026 13:41 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

Validation at 91b344dbcf01e1f4a00dbf38185a7daccf2519b2:

• RED: the new byte-identical/unapproved-revision fixture fails on the preceding guard with accepted unapproved signer with unchanged publisher contents.
• GREEN: the same fixture passes with independent signer approval. Explicit approval of a fetched revision still works; changed workflow/helper bytes, file modes, unsafe references and publication inputs remain rejected.
• The existing manifests promotion, signed recovery, caller-pin and immutable-version suites pass, including their deliberate failure controls. Both script files pass ShellCheck and formatting; the changed workflow passes actionlint; instruction-layout controls and all fifteen repository maintenance commands pass.
• Self-review found no remaining correctness, simplification or credential-boundary issue in the four-file change. No consumer verifier, credential, workflow trigger or permission was changed. Hosted CI and independent current-head review are still pending.

Recovery is not complete until protected merge, normal tagged publication, independent artifact verification and live acceptance/application are observed. The earlier artifact remains refused; no alias rewrite or verification bypass is proposed.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T13:52:55.683962Z	91b344d	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 91b344dbcf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 91b344dbcf01e1f4a00dbf38185a7daccf2519b2 against 602159b7e3dd6d96a3aa463ceac4f33c10f5e3f3: all hosted checks are green (213 passing, 58 intentional skips); the required aggregate and reviewed-base product admission executed successfully. GitHub verifies the commit signature. Codex completed a finding-free review of this exact head (receipt); the complete thread list is empty and no review-body finding remains. The published body passes the canonical template contract.

The new guard requires both the consumer-approved signer revision and the reviewed source contents. Live verification remains enforced. Promotion is not recovery: normal tagged publication, independent digest/source/signature verification and live acceptance/application remain required after protected merge.

[devantler]

🤖 Generated by the Agentic Engineer

Protected merge 7bf35c4fb0c2ccd8d1c08585e6ec5979a819d18e has a verified commit signature. The normal release and CD succeeded for v12.0.4.

Independent anonymous verification passed for ghcr.io/devantler-tech/github-config/manifests@sha256:4d386cdbcad81774308ff517da208f4bea9afc0d57d817cbc660ecbf83793b3c, binding the approved publisher identity, exact merged source, version, tag, publication run and attempt. Live readback then confirmed that exact version/digest was verified, accepted and applied. The complete verifier object matches the incident capture unchanged; no verification bypass, alias rewrite or imperative reconciliation was used.

The signature fault is recovered. Post-merge main CI is still running, so final delivery bookkeeping remains pending its result.