Repository navigation
Restore verified organization settings publication after the publisher transition #5265
Description
🤖 Generated by the Agentic Engineer
Problem
The organization settings publication is blocked after its caller moved to a new shared publisher in devantler-tech/.github#725. The platform's explicit publisher approvals still accept the previous transition pair, so signature verification correctly refuses the new publication. The last verified artifact remains available.
Expected outcome
Restore verified publication delivery through a narrowly reviewed publisher transition. Retain the currently applied publisher, retire the obsolete approval covered by #5240, and approve the exact new revision only after reviewing its source. Keep the existing issuer, repository and consumer boundaries.
Acceptance criteria
- Bind the current applied publication and the new publication to their exact shared workflow revisions and review the new workflow source.
- Update the canonical approval, generated acceptance rule and authorization evidence through their existing procedures, retaining the current verified publisher.
- Prove the retained and new revisions are accepted while the retired revision and unrelated issuers, repositories and revisions are rejected.
- Obtain an independent review at the tested head and deliver through the protected path.
- Read back the deployed rule, verified new publication and healthy platform status.
This live delivery failure preempts production activation of the security dashboards in #5260. The dashboards themselves were implemented in #5262.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
chore: agent-claim #5265 nonce=138009bb67097ef5c3c8cee17d47c856
devantler commentedon Oct 23, 2026
Delivered through #5266 at reviewed head
1634dddd44b423fc52ba82080b114f0efaa8e12f; the protected merge-group run 39961170965 passed and merged as9003ce4c8b1c17916d5db085a2c3bd3312296824at 14:29:23 UTC.Read-only production verification at 14:29 UTC:
0f390329…and6f1dee95…), with the legacy family unchanged and retired8d2203af…absent.v12.0.4, digestsha256:4d386cdbcad81774308ff517da208f4bea9afc0d57d817cbc660ecbf83793b3c. Ready and SourceVerified are both True at the current observed generation, 33.0f390329b590404c02565b27a263ee841fa02bce. The earlier exactv12.0.3proof binds the new publisher, and the retained/new positive and retired/unrelated negative controls passed.PLATFORM-HEALTH=OK.All five acceptance criteria are met. #5267 remains the separately tracked complete-observation refresh work; this receipt does not claim that broader task is resolved. The publication blocker on dashboard activation #5260 is cleared.