[devantler]

🤖 Generated by the Agentic Engineer

Why

The first recovery attempt stopped before publication because its engine could not verify the existing GitHub App credential. The missing releases still need a safe recovery path.

What

Adopt the released permission-check repair and verify that the read-only credential is refused before requesting a writer. Keep explicit consent and the existing recovery safeguards; live recovery and the historical cause investigation remain open.

Part of #4839

[devantler]

🤖 Generated by the Agentic Engineer

Validation at 60c91a338d24e21d3985f554f63624c53b75faf9:

• The missing read-only permission control was reproduced before implementation. The shipped step now passes its controlled refusal cases and rejects unexpected authorization, rate limits, unavailable/redirected/malformed/ambiguous responses, transport failure and unsafe scope. The tests verify a single bounded request, private-file cleanup and no credential/response content in logs.
• The complete recovery boundary suite passes, including consent, repository scope, immutable source, read-before-writer ordering, required CI coverage and generated projection parity. ShellCheck, shfmt, actionlint and Prettier pass. The correctness, security and simplification self-review is complete.
• The actual shipped offline steps downloaded immutable engine 0b137510d139bbf62e479d9610b0db17c972bc2b, built it with the declared Go 1.26.9 toolchain, and verified credential refusal with no credential present. That engine's signed v14.0.2 tag and all five post-merge workflows were independently verified before adoption.
• Full native CI 40668310849 succeeds at this head. The current rollup has 39 successful and 10 intentional skips, no unresolved threads or non-thread findings, and native CLEAN state. Fresh main was integrated through a non-destructive fast-forward before the signed commit; the incoming mail work is unchanged.

The real App-backed control and both historical recoveries are intentionally still pending the protected consumer merge. Existing App grants, writer scope, permanent confirmation, publication count and latest-release safeguards are unchanged. All five original #4839 acceptance criteria, including the unknown historical cause, remain open; the shared rollout also remains open in devantler-tech/.github#787 and #603.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 26 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/recovery-capability-4839-r69
• File: .coderabbit.yaml
• Commit: 60c91a3
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0381a1b9-6e0b-4ba7-bc0e-439ee5a58cd6

Commits

Reviewing files that changed from the base of the PR and between 82fcd45 and 60c91a3.

Files selected for processing: 5

• .github/workflows/ci.yaml
• .github/workflows/publish-release-recovery.yaml
• docs/release-recovery.md
• scripts/tests/test-release-recovery.sh
• scripts/tests/test-release-writer-refusal.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 60c91a338d24e21d3985f554f63624c53b75faf9

• CodeRabbit: this PR's included-review refusal, provider event 2026-10-28 10:13:16 UTC, states 26 minutes until the next included review. Repository scope: Platform; recovery is approximately 10:39:16 UTC. Its separate command reply confirms the review did not run. The no-gate guard reports ADMIT.
• Codex: the account code-review usage refusal, provider event 2026-10-28 06:16:55 UTC, follows the authenticated devantler request and requires account credits/settings to resume. The artifact was freshly read; no newer serving evidence was found in the current health sweep. No redundant request or paid overage was used. The current-PR no-gate guard reports ADMIT.
• Cursor Bugbot: the same-repository user/team usage refusal, provider event 2026-10-28 07:49:32 UTC, requires a user or team administrator to change the usage/spend limit. The artifact was freshly read; no newer serving evidence was found. The current-PR no-gate guard reports ADMIT.

This is a separate fallback review round after the pre-submission self-review. I re-read the complete five-file diff against 82fcd45689c0207d58096c4ad05a0a716f2c48e4, checking correctness, security and the repository review guidelines. I checked the fixed public API target, bounded request/response handling, explicit refusal classification, response/credential privacy and cleanup, implicit step-failure propagation before the unchanged writer, immutable engine provenance, generated CI parity and required negative controls. No actionable correctness or security finding remains.

Direct current-PR reads show no external review artifact, unresolved thread or non-thread finding. Full native CI succeeded at this head. The real App-backed controls and historical publication outcomes remain separate rollout acceptance; this review does not claim them.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 60c91a338d24e21d3985f554f63624c53b75faf9: full native CI passes, with 39 successful and nine intentionally skipped checks. The remaining neutral CodeRabbit context is its explicitly verified quota refusal, not a finding or CI failure. There are no unresolved threads, inline findings or non-thread findings. The separate local fallback review records fresh evidence for all three unavailable providers; native readback passes local-review-verdict.sh as GREEN self@60c91a338d24e21d3985f554f63624c53b75faf9.

User evaluation exercised the shipped read-only probe's refusal and failure cases and the actual immutable-engine download, declared Go 1.26.9 build and credential-free refusal. The complete native CI run executes the updated recovery contracts. Native App-backed controls and the historical recoveries remain post-merge acceptance in #4839 and devantler-tech/.github#787/#603; they are not inferred from offline controls.

Fresh main is 7b32a6cb08a3533104f737e4532165a3a7215a84; its two incoming files do not overlap this five-file change. The normal merge queue will test and deploy the combined candidate. Current live health is OK. Every readable required gate passes; the configured code-quality rule has no separate readable verdict in the completeness helper, and normal native protections remain authoritative. No admin or auto-merge bypass is requested.