v0.2.25

fix(control): validate activation PR author identity (#103)

## Correction

Normal activation PR #102 failed before the merge API call because the active runtime compares head.user (the source repository owner) to the Server App. Validate the top-level PR author ID/login/type and retain exact head, canonical branch, repository identities and protected base. The regression uses the observed GitHub shape and rejects 13 identity/state substitutions plus the swapped-author impostor. No workflow, token or policy exceptions.

## Evidence

Signed source ae9bd8990e7d11e77e054da0674a2de6710308b6; parent cf98fd0d399b5951f8f8c4a6e06a48842d8b098f. Formatting, 302 Rust execution tests, documentation-test stage (zero tests), Clippy and diff checks passed. Two existing tests remain ignored. Independent source and prose reviews completed. Required CI remains the next gate. Active generation-one descriptor unchanged.

## Promotion limits

The immutable v0.2.23 runtime cannot acquire this correction from main. Source merge, exact-main scratch prepare/verify and normal v0.2.25 publication/proposal can use the normal controller. Activation needs a separately reviewed fixed recovery authority with new explicit approval; bootstrap remains retired. No distribution until activation and the full scratch caller migration succeed.

v0.2.24

fix(control): review caller migrations and bind scratch to active run…

v0.2.23

Recover the fixed Rust bootstrap authority (PR #98) (#99)

Exact replacement for PR #98; no recovery executor enters main.

Target: 2b37d2808a322abd04fdeee6febbe4a3779c0695
Tree: e0f159acbefc30ab4b8294901a12e3dc5564e551
Expected main: 51eba48c73fce56b1c7dcc7acd53bc58da6cc099
One-time executor: e7e8cb4d9293a40fe5d9b9c3841c7eaac2b3d726

---------

Co-authored-by: Takahiro Nakayama <civitaspo@gmail.com>

v0.2.20

refactor: share attested runtime loading and guard version reuse (#93)

## Summary

- Share the runtime loader between the reusable workflow and the client action.
- Keep native GitHub attestation verification before extraction, then use the attested Rust CLI to validate the source manifest, canonical tag/release, and archive digest and size.
- Remove duplicated shell TOML/SemVer parsing and keep runtime validation in Rust.
- Reject PRs whose package version does not increase over the base or already has a tag/release. Bump Cargo.toml and the package lock entry to `0.2.20`.
- Document the loader ownership and its bounded 1,000-release lookup window.

## Validation

Reviewed head: `c8283154855770df3ffac48af263d02010d03400`, based on protected main `4c5dc66e855b03715a161b5166f5a132addb3084` (verified GitHub signatures).

- Rust 1.99.0 format check, locked full tests (232 passed; 2 ignored), clippy with warnings denied, pinned actionlint, and diff check passed for the assembled change.
- [Current-head independent automated review: PASS+NOTES](https://github.com/civitaspo/securefix-server/pull/93#issuecomment-6209932648). All 12 remote blobs match the reviewed tree; exact-base patch ID `53523d64d4dc1a247a15ac104d75d497eb2025da`. Same-model independent review.
- [Current-head Actions CI](https://github.com/civitaspo/securefix-server/actions/runs/38864052937) passed, including the runtime version gate and required status-check.
- The prior candidate prepare failed: local candidate actions eagerly resolved nested `$/` against the producer revision, and rebasing the old owner fixture left duplicate `/approve` comments. The shared native bootstrap is now one `load.sh` called through each action's own `github.action_path`; the client runs the sibling script only for published-runtime mode. Loader success/rejection and workflow wiring tests pass. A fresh fixture avoids duplicate commands.

## Promotion status

PR #92 was merged at `4c5dc66` after explicit owner authorization for a temporary owner-only ruleset exception. Both original rulesets were restored and read back; default-branch protections were unchanged. The resulting protected main declares `0.2.19`, removes Nagi, and retains the API retry change. [Main CI passed](https://github.com/civitaspo/securefix-server/actions/runs/38861140153).

Normal [Publish Runtime for 0.2.19](https://github.com/civitaspo/securefix-server/actions/runs/38861429045) and [all nine actual caller distribution jobs](https://github.com/civitaspo/securefix-server/actions/runs/38861576545) passed. The canonical lightweight tag and release target match protected main; archive identity and digest match publication evidence.

Candidate head `740de55` completed prepare (including real client Action) successfully. Verify exercised all scenarios successfully, including native auto-merge, then failed cleanup because GitHub had already auto-deleted the merged branch (DELETE 422, exact ref GET 404). The shared Rust cleanup helper now accepts 422 only after confirming that exact ref is absent, and only reserved integration-fixture cleanup paths reuse it; release-branch cleanup is unchanged from the base. Three focused tests cover success, absent refs, conflicts, permissions and invalid names.

The existing main workflow completed [candidate prepare](https://github.com/civitaspo/securefix-server/actions/runs/38864168162) and [verify](https://github.com/civitaspo/securefix-server/actions/runs/38864541393) successfully for exact head `c828315`. Verified paths include real client artifact/label dispatch, current-head approval, native auto-merge waiting for policy and then merging, stale-head/replay rejection, actual pinact/status checks for generated workflows, repair/tag idempotence, feedback lifecycle, and fixture cleanup.

Four scratch event handlers were restored to their original active states after verification. The preexisting disabled release-pr-sync and PR105 were preserved. All run-owned fixtures and branches were cleaned, including owner approval fixture PR150. Intermediate failed/cancelled runs remain documented above and were not used as promotion evidence.

Normal owner `/approve` was captured at [run38864937980](https://github.com/civitaspo/securefix-server/actions/runs/38864937980) and applied at [run38864987002](https://github.com/civitaspo/securefix-server/actions/runs/38864987002). Current-head bot review and the App-bound policy check succeeded. Normal `/merge` was posted after rechecking exact head/base, review, and required checks; the ordinary merge workflow is processing it. No protection exception is used for PR93.

Final `0.2.20` publication, all-nine caller distribution, and the post-publication published-client rehearsal remain pending. The locator caps pages and projected IDs; full release-page response memory is not capped (reviewer's low-severity availability note).

v0.2.19

chore: remove deleted nagi repository from policy (#92)

## Summary

- Remove the deleted `civitaspo/nagi` repository from deployment policy
and fixtures.
- Update the caller inventory to eight and use the configured
`herdr-linear-agent` repository in distribution tests.
- Apply Rust formatting and reserve fresh runtime version `0.2.19`
consistently in Cargo.toml and the lockfile package entry.

## Validation

Reviewed signed head: `8a9a498aed9f9716cb57874b912c5d7f32939568`.

- Format check, locked full Rust tests (224 passed; 2 ignored), and
clippy passed with Rust 1.99.0.
- [Exact-head Actions CI and required status-check
passed](https://github.com/civitaspo/securefix-server/actions/runs/38857572644).
- Independent automated [PASS+NOTES
review](https://github.com/civitaspo/securefix-server/pull/92#issuecomment-6209018193):
registry/policy tests and actual CLI policy validation passed.
Same-model independent review.
- Stable patch ID: `1d143b8463798b15be9afe953c56333ac5aeb3a4` against
base `9b8d70a`.

## Recovery status

Not merged or published. Approve Request and Policy Check cannot load
the exact-main runtime: current main declares `0.2.18`, but the
immutable `v0.2.18` release belongs to a previous SHA. The fresh version
at this PR's head cannot repair that base loader.

A recovery proposal used only for PR92 is awaiting explicit owner
authorization: temporarily add only the owner User's PR-merge bypass to
the two blocking rulesets, merge this reviewed exact head, and
immediately remove the added actor with a concurrent-change check.
GitHub scopes this bypass to the actor and rulesets, not the PR number;
no other merge is allowed during that window. Default-branch protections
remain intact. No protection mutation has occurred. Normal
protected-main publication of `0.2.19` would follow, restoring the
ordinary approval/merge flow for maintenance PR #93 (`0.2.20`).
Publication and all eight caller distribution jobs remain unverified.

v0.2.18

fix: render policy filenames and commands as inline code (#90)

Render matching filenames and standalone /approve and /merge commands as inline code in policy failure comments. Decode the existing JSON-quoted filename lines before escaping them, so file quotes disappear while HTML, mentions and unusual characters remain safe. Preserve the wrapping layout, original metadata, size bound, publication and hide-on-success behavior.

Extend the existing escaped report regression and existing scratch feedback probe; no new test suite or authorization changes. Runtime version 0.2.18. The reported herdr-linear-agent #157 comment was updated in place.

Validation:
- Existing escaped report regression and local all-target Clippy passed; independent review passed HTML/mention escaping, exact command token matching and unchanged lifecycle.
- [Required CI](https://github.com/civitaspo/securefix-server/actions/runs/38685477194) passed standard checks for `ebc172f3ae651dbf000457548f9c3564c97effdd`.
- [Candidate scratch prepare](https://github.com/civitaspo/securefix-server/actions/runs/38685499616/job/116259825457) passed actual inline filename/command comment publication, supersession and minimize-on-success in testing-securefix-server. Client smoke also passed. Fixtures cleaned up. Unrelated merge/release scenarios were not rerun.
- The reported comment was updated in place and GitHub-rendered HTML verified for inline filenames and /approve, retaining CI/commit metadata.

v0.2.17

fix: wrap policy failure comments into readable paragraphs (#89)

Policy failure comments rendered the whole rejection in a single preformatted line, making detailed owner-authorization failures horizontally scroll. Render escaped text as wrapping paragraphs with explicit line breaks, and separate sensitive-path reasons, next steps and one matching filename per line. Preserve the original error cause, HTML/mention escaping, length bound, CI/commit metadata and comment lifecycle.

Extend the existing report regression and reuse the shared scratch policy feedback probe during prepare, including multiline publication, superseding failure and hiding on success. No authorization changes. Runtime version 0.2.17. The reported herdr-linear-agent #157 comment was also reformatted in place without changing its decision or metadata.

Validation:
- Two focused existing regressions passed (escaped failure report and rename-sensitive owner explanation); local Clippy and independent review passed.
- [Required CI](https://github.com/civitaspo/securefix-server/actions/runs/38680922934) passed standard tests, formatting, Clippy and workflow checks for `f630be61e66bf647a2218e33d81c3da40430ec65`.
- [Candidate prepare](https://github.com/civitaspo/securefix-server/actions/runs/38680932124/job/116245624903) passed in testing-securefix-server, including actual multiline paragraph/line-break comment publication, failure supersession and minimize-on-success. Candidate client smoke also passed. Fixtures were cleaned up. Unrelated merge/release scenarios were not rerun.
- The original herdr-linear-agent #157 comment was reformatted in place; GitHub body_html confirms ordinary paragraphs and line breaks with no preformatted block, retaining CI/commit links.

v0.2.16

fix: synchronize existing release PR title and summary (#88)

Existing release PR updates changed the signed branch contents but reused the PR without updating its title or body. Because Release PR Sync is now manual-only, the displayed version remained stale (herdr-linear-agent #102 prepared v0.8.0 but still advertised v0.7.2).

Synchronize title and body from validated artifact options when the normal apply path reuses the verified Server App-owned release PR, including idempotent recovery. Preserve ownership, branch/base checks and commit binding; do not change draft state. Extend the existing scratch native apply retry probe to deliberately stale the metadata and assert restoration without an extra commit. Prepare runtime 0.2.16.

Validation:
- 14 relevant securefix_gate tests and local all-target Clippy passed; independent focused security review passed.
- [Required CI](https://github.com/civitaspo/securefix-server/actions/runs/38644778440) passed standard tests, formatting, Clippy and workflow checks for candidate `84ed03b8491e73a494b9c215620df6b02415d657`.
- [Candidate scratch prepare](https://github.com/civitaspo/securefix-server/actions/runs/38644795923/job/116129850450) passed actual existing-PR title/body synchronization and same-commit idempotent retry, plus affected authorization checks. Client artifact smoke test also passed. Scratch fixtures were cleaned up. Unrelated merge/publication scenarios were not rerun.

v0.2.15

fix: explain sensitive-path owner authorization requirements (#87)

Sensitive-path policy failures previously said only that current-head owner authorization was missing. Explain why authorization is required, list up to ten matching changed paths (including rename sources), and tell the owner to post /approve for the current head after rebases or force-pushes. Authorization and exemption decisions are unchanged; matching paths reuse one compiled glob set.

Extend the existing rename regression and scratch authorization probe to check the explanation. Prepare runtime version 0.2.15. Validation evidence will be added after candidate testing.

Validation:
- 25 focused request tests passed; extended the existing rename regression (one live API test remains opt-in).
- Independent review passed, including unchanged short-circuit marker lookup and safe bounded path reporting.
- [Required CI](https://github.com/civitaspo/securefix-server/actions/runs/38530544763) passed formatting, tests, Clippy and workflow checks for `f79be5a1a28424bf98bba6ccfe5695564d32b371`.
- [Candidate prepare](https://github.com/civitaspo/securefix-server/actions/runs/38530562181) passed in testing-securefix-server, including actual sensitive-path rejection with the new reason and /approve instruction, exemption acceptance, client artifact smoke test and fixture creation. Scratch PRs #122–#124 were closed and their branches removed after collecting evidence. Unrelated verify-phase merge/release scenarios were not rerun for this message-only change.
- Initial CI found clippy::collapsible_if; the nested condition was converted to an equivalent short-circuit let-chain before final verification.

v0.2.14

fix: migrate Renovate-updated client token action pins (#86)

Automatic v0.2.13 rollout stopped on eight callers after Renovate updated their client token action to the official v3.3.0 SHA. The migrator only recognized v3.2.0.

Accept the audited v3.2.0 and v3.3.0 pins and generate v3.3.0. Preserve strict action repository, token inputs, step shape, repository scope, and unknown-revision rejection. Document the supported versions and add one regression covering both recognized pins and rejected tag/unknown/other-owner references.

Validation: official v3.3.0 resolves to 64ab729a6294000f5aa4a4bc0b73d1f32bc45510; all six client migration tests pass. CI and candidate scratch generation checks are pending. Package version advances to 0.2.14 for the source-bound publication.

Final candidate: ffeab567da104df201004ad58dfb994a92c63450. Previous-generation validation normalizes only the audited old token pin before comparing canonical workflow content; other field validation is unchanged. The final six related tests pass, including both old/new generations and unknown-action rejection.

Read-only preflight migrated current workflow snapshots from all eight failed callers successfully. Candidate prepare/client-smoke passed in run 38511437925. Scratch PR #117's actual pinact/native-client/status-check jobs passed (runs 38511657487 and 38511657520). Its intentionally unauthorized sensitive change also exercised the normal published v0.2.13 Policy Check: run 38511694306 succeeded while publishing a failure check plus the explanatory PR comment (6160923101), proving the original HTTP 403 fix in the real repository-scoped write-token path. Full candidate CI and exact-head approval passed.