[robgruen]

Follow-up to #493, which was merged while these fixes were being prepared. Addresses the two remaining Copilot review-summary concerns without changing the pilot's approval boundaries.

Changes

• Scan the exact candidate before sealing. A trusted read-only native no-op ensures file-only model responses trigger the compiled detection guard. Download the attempt-specific immutable candidate into the pinned detector, preserving native safe outputs. Require successful scan execution, a successful final verdict, and a same-run/attempt scan-binding artifact whose SHA-256 matches the candidate bytes. Skipped scans, warnings, failures, missing evidence, and changed candidates cannot authorize sealing.
• Bound publication-history requests. Name intents by the sealed draft artifact ID and use GitHub's exact-name repository-artifact filter. Each check reads at most two matches in one request, preserving protection across runs and reruns. Missing or malformed history fails closed; existing exact bot comments still make retries no-ops.
• Update the automation documentation and regression coverage. Drafting remains read-only, inference budgets and runtime pins are unchanged, and the backlog workflow is unchanged.

Verification

• All 124 automation tests passed with Node 24.22.1 (npm test from tools). Includes mocked workflow-script execution for Issues and Discussions, file-only candidates, scan failures/provenance, byte-level tampering, retry protection, and bounded request counts.
• Reproduced 2,022 history requests before the fix; the fixed publication cycle uses two history requests even with more than 1,000 unrelated artifacts/runs.
• Both workflows strictly compile with gh-aw v0.93.5, with zero warnings; repeat compilation has no generated-file drift.
• Whitespace checks pass; the backlog's generated workflow, compiler pins, and .gitattributes are unchanged.
• The file-only regression executes the generated Bash detection guard with no model-emitted safe outputs or patch; it failed before the guard fix and now passes.

No live drafting run or bot publication was performed. Human review and the documented live-verification checklist remain required.

Review references: candidate scanning, publication-history cost.

[Copilot]

🟡 Changes recommended

The compiled detection guard excludes file-only candidates with no native outputs or patch, preventing download and scanning and causing the seal condition to skip the draft.

1 open issue

• File-only candidates skip detection when native outputs and patch are empty · New

What changed in this PR

This follow-up to #493 strengthens the discussion-drafting pilot’s scan requirements and bounds publication-history lookups without changing owner approval boundaries.

Changes:

• Stages exact candidate bytes for detection and requires a successful scan, verdict, and matching run-specific binding before sealing.
• Replaces workflow-history enumeration with draft-keyed artifact lookups capped at two matches per request.
• Updates automation documentation and regression coverage for scan provenance, tampering, and publication retries.

File	Description
tools/​tests/​discussion-workflows.test.mjs	Checks detector wiring, scan artifacts, and sealing conditions.
tools/​tests/​discussion-draft.test.mjs	Covers candidate integrity, scan provenance, retries, and bounded history requests.
tools/​discussion-draft.mjs	Adds scan-binding validation and exact-name publication-intent lookups.
AUTOMATION.md	Documents scan requirements and bounded publication-history checks.
.github/​workflows/​discussion-draft.md	Adds candidate staging, scan-binding uploads, and stricter sealing gates.
.github/​workflows/​discussion-draft.lock.yml	Regenerates the executable workflow with the detection and sealing changes.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

SAML-blocked access to the pinned gh-aw runtime leaves it unverified whether staged input survives setup and reaches the live scan, a boundary mocked tests cannot establish and human verification must confirm.

No open issues 🎉

1 resolved since last review

• File-only candidates skip detection when native outputs and patch are empty

_{Review effort: Balanced}