Post-merge review: the #149 commits merged before CodeRabbit's final review (12601d6..7b61575)

Closed
UN
7d ago
+156-41

Review-only PR. It is never merged.

#149 was merged by an orchestration gate that mistook CodeRabbit's in-thread replies for a finished review. The last review-round commits (12601d6..7b61575: release-PR selection restricted to same-repo, bot-authored, date-shaped branches; selected PR edited by number; receipt docs) reached main without a full CodeRabbit review. This PR shows exactly that delta against a branch pinned at the last reviewed commit. Any finding is fixed in a follow-up PR to main, then this PR is closed and both review branches deleted.

Summary by Sourcery

Harden the daily release workflow against unsafe pull-request reuse and branch overwrites while recording comprehensive validation evidence.

Bug Fixes:

  • Harden daily release PR reuse and branch updates by accepting only same-repository, workflow-authored, date-shaped release PRs and refusing to overwrite unverified existing branches.

Enhancements:

  • Pass the selected release PR number through planning and update the existing PR deterministically while preserving guarded branch cleanup and publication behavior.

Documentation:

  • Document release candidate safety rules, review-round validation, and release-check receipts.

Tests:

  • Expand daily release coverage for trusted and untrusted PR selection, workflow safeguards, lookup failures, and branch overwrite protection.

Chores:

  • Update project-management feature and history records with the review-round changes and validation receipts.

Summary by cubic

Review-only PR, never merged, showing the delta between the commits merged to main before CodeRabbit's final review and the last reviewed commit. It restricts daily release refresh to verified workflow PRs and records real-data import-fidelity receipts.

Bug Fixes

  • The release planner reuses only same-repository PRs authored by app/github-actions with date-shaped release branches; the selected PR number is now carried into editing.
  • The workflow refuses to force-push or clean up an existing release branch without a selected verified workflow PR.
  • Tests and docs cover independent regressions for each safety predicate and a real-public-data import-fidelity proof.