fix: two rc.6 refresh-cycle robustness gaps found in downstream review

[crypticpy]

Fixes the two real findings Codex raised on the BCHC rc.6 update PR (bchc#30):

1. The "something changed" guidance named a literal verified: field. A catalog that renames its confirmation field via entry.verified_key would follow the instruction, stamp a field the sweep never reads, and the entry would stay stale with its reminder open. The refresh script now exposes the resolved key as a step output and the guidance uses it.

2. The sweep copied up to 200 issue bodies into a single environment entry. Linux caps one env entry near 128 KiB; past it the runner cannot launch the github-script step, and the monthly job opens, refreshes, and closes nothing. The bodies now travel through $SWEEP_ISSUES_FILE under runner.temp; count/slugs/max_new remain step outputs.

Three new tests pin both contracts (subprocess test for the file channel, workflow-text assertions for both). Full Node suite 799 pass, eslint clean.

Hold: do not merge before the stable v1.9.0 cut. The accepted candidate is v1.9.0-rc.6, and the candidate-to-stable diff must contain no behaviour change (docs/polish-and-publish-plan.md §5) — merging this first would force an rc.7. Neither bug affects the BCHC deployment today (default key, 13 entries). This PR is the head of the next release line.

🤖 Generated with Claude Code

https://claude.ai/code/session_014sAVayAT2tkQ7p9U2o9CsD

Summary by Sourcery

Harden refresh-cycle automation against renamed verification fields and oversized issue payloads.

Bug Fixes:

• Use each catalog’s configured verification key in refresh guidance so maintainers update the field monitored by the verification sweep.
• Transfer verification-sweep issue bodies through a temporary file instead of an environment entry, preventing large runs from exceeding runner limits.

Tests:

• Add workflow and subprocess coverage for file-based issue transport and configured verification-key guidance.

[sourcery-ai]

Sorry @crypticpy, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 4 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

Hardens the rc.6 refresh cycle by making maintainer guidance honor custom verification keys and transporting potentially large sweep issue bodies through a shared temporary file instead of a step-output environment entry. Tests pin both workflow contracts and the file-based subprocess behavior.

Sequence diagram for file-based verification sweep transport

sequenceDiagram
    participant Sweep as verification_sweep.mjs
    participant Temp as runner.temp file
    participant Workflow as GitHub Actions workflow
    participant GitHub as GitHub Issues API

    Sweep->>Temp: writeFileSync(JSON.stringify(issues))
    Sweep-->>Workflow: setOutput(count, slugs, max_new)
    Workflow->>Temp: readFileSync(SWEEP_ISSUES_FILE)
    Workflow->>GitHub: create or refresh issues using wanted bodies
    Workflow->>GitHub: close stale refresh issues

Loading

Sequence diagram for custom verification-key guidance

sequenceDiagram
    participant Refresh as refresh_entry_from_issue.mjs
    participant Workflow as refresh-entry workflow
    participant GitHub as GitHub Issues API

    Refresh-->>Workflow: setOutput(verified_key, verifiedKey)
    Workflow->>Workflow: read ENTRY_VERIFIED_KEY
    Workflow->>GitHub: createComment with resolved verification key

Loading

File-Level Changes

Change	Details	Files
Propagate the catalog’s resolved verification-field name into refresh guidance.	Emit verified_key from the refresh script. Pass the output into the workflow and interpolate it in the maintainer comment, retaining a default for compatibility. Add workflow assertions covering configured and non-literal keys.	scripts/refresh_entry_from_issue.mjs .github/workflows/refresh-entry.yml test/scripts/release_workflows.test.mjs
Move sweep issue bodies from step outputs to a temporary file to avoid environment-size failures.	Write serialized issue bodies to $SWEEP_ISSUES_FILE while keeping count, slugs, and max-new as outputs. Read the shared runner-temp file in the GitHub Script step, with an empty-list fallback when absent. Add subprocess and workflow-text tests verifying file transport and the absence of the old issues output.	scripts/verification_sweep.mjs .github/workflows/verification-sweep.yml test/scripts/verification_sweep.test.mjs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.