Authenticate dependency-repair promotion provenance for source routing

[stranske]

Why

Trusted dependency-repair promotion metadata must suppress incidental issue-link routing, while forged or incomplete markers must preserve normal issue routing.

Scope

Adopt existing PR #2862 as the implementation lane.

Tasks

• Keep promotion handling consistent in the root and consumer-template source resolvers.
• Validate trusted provenance before suppressing issue routing.
• Cover trusted and forged markers in the source-context tests.
• Resolve the current template-parity review finding.

Acceptance criteria

• Trusted promotion markers suppress incidental issue links only when provenance validates.
• Forged or mismatched markers preserve the issue reference and source type.
• Root and template implementations remain synchronized and tests pass.

[stranske]

Closer verifier disposition — split verdict audited, bounded follow-up opened

verify:compare was applied to merged #2862 this round (it had been merged at 00:10:53Z with no verify:* label, so this issue had no path to a durable verifier disposition). Agents Verifier run 30676075221 returned a split verdict: openai gpt-5.6-terra CONCERNS (81%), anthropic claude-sonnet-5 PASS (82%).

I audited each concern against the merged code rather than treating the non-PASS as a blocker.

Rejected as already satisfied (implementation is correct):

• "Forged/mismatched markers may be trusted" — resolvePrSourceContext requires dependency:repair-promotion AND workflow:source-dependabot (.github/scripts/source_context.js, the trustedDependencyRepairPromotion gate), and parseDependencyRepairPromotionSource returns null unless source_pr is a positive integer and all three of source_base_sha / source_head_sha / promotion_base_sha are 40-hex. A structurally bad payload therefore cannot be trusted regardless of labels.
• "Root and consumer-template copies may have diverged" — the two files are byte-identical on main, and .github/sync-manifest.yml:355 keeps source_context.js under managed sync.

Accepted as real debt (coverage, not behavior): both providers independently flagged that no test exercised a partial label set, and the pre-existing malformed-marker test carried no labels — so the trusted-labels-plus-bad-payload path was unguarded, and nothing would catch a weakened trust gate.

Action: opened bounded follow-up #2866 (test-only) adding partial-label, mismatched-payload, and root/template behavioral-parity coverage. node --test .github/scripts/__tests__/source-context.test.js → 36 passed (baseline 33). Deliberate-break check: weakening the gate from && to || fails exactly the two new guard tests; restoring it returns 36/36.

Out of scope / owner decision: binding the marker payload to a real promotion event (source PR / branch / SHA lookup) instead of trusting the workflow-applied labels. That trust model is the documented design in docs/ops/DEPENDENCY_REPAIR_PROMOTION.md; changing it is a product decision, not verifier-debt cleanup.

This issue stays open until #2866 merges and verifies.

[stranske]

Sequencing note (closer lane): GitHub auto-closed this issue when follow-up PR #2866 merged (dbce5dd). Reopening until a durable verifier disposition exists for the follow-up.

State:

• fix(meta): suppress issue links for dependency promotions #2862 merged 2026-08-01T00:10Z, verify:compare applied, verifier run 30676075221 returned a split verdict (openai CONCERNS 81% / anthropic PASS 82%). The rejected claims were audited against merged code in the durable evidence comment above; the one accepted claim was the missing partial-label / trusted-labels-plus-bad-payload coverage.
• test(source-context): cover partial-label and mismatched promotion markers #2866 (test-only) closes that gap and merged clean at 2026-08-01T01:38Z with all required checks green; verify:compare is now applied to it.
• The one open CodeRabbit thread on test(source-context): cover partial-label and mismatched promotion markers #2866 was dispositioned as a verified false positive: the file imports node:assert/strict, where assert.deepEqual is assert.deepStrictEqual; a deliberate-break of the consumer-template trust gate (&& -> ||) drives the suite 36 -> 34 pass / 2 fail with operator: 'deepStrictEqual', and restoring returns 36/36.

This issue closes again once the #2866 verifier comment lands PASS with no remaining disposition debt.

[stranske]

Closer completion disposition\n\nFollow-up #2866 is merged with verify:compare, all review threads resolved, and a durable Provider Comparison Report shows PASS from both providers (openai 88%, anthropic 72%). Its focused coverage closes the accepted partial-label and malformed trusted-payload test gap; the earlier split-verdict claims already rejected as false positives remain documented above. No follow-up debt remains, so closing this source issue.