[robgruen]

Summary

Close the loop after the eyes acknowledgment for owner /typechat draft and /typechat reply requests. This is the separately approved receipt milestone, not the implementation pilot in #504.

• Add a completion-only workflow_run controller with fixed, authenticated outcome comments and separate Issue/Discussion write permissions. No model invocation, App credentials, repository setting changes, or extra start comments.
• Bind the source run to trusted event/target/comment identifiers; revalidate the owner request, source attempt, controls, sealed artifact, discussion snapshot, and referenced PRs before reporting an actionable draft.
• Reuse an actual public reply as completion. Update one existing receipt when appropriate; durable write intents, monotonic outcomes, and conservative uncertain-write handling prevent blind duplicate writes.
• Exclude only canonical, same-target Actions-bot receipts from frozen evidence. Preserve the existing evidence/model limits while bounding additional operational-receipt collection separately.
• Document outcomes, recovery, rollout boundaries, and the already verified Issue acceptance milestone.

Validation

• 183 selected offline helper/workflow regression tests passed on Node 24.22.1, including actual new controller scripts, count/byte boundaries, retry safety, source-attempt binding, and the preserved sole-noop seal guard.
• Six pre-existing publisher-script integration cases were not selected locally because their source is policy-restricted. Normal repository CI remains a separate validation result.
• Pinned gh-aw v0.93.5 strict compilation: both existing agentic workflows succeeded, zero warnings, no repeat-compilation drift.
• 98 local documentation links/anchors and staged whitespace checks passed.

Rollout and boundaries

• Human review/merge and fresh live verification remain required; no new live command was triggered.
• Old run-title formats do not receive retroactive receipts. Use fresh requests after rollout.
• Existing manual publish/accept behavior is unchanged; their public outcome comments already indicate completion. This PR does not add failure notifications to that separate publisher.
• GOALS, App credentials/configuration, dependency/runtime/model/budget pins, and the policy-restricted publisher/Dependabot workflow sources are unchanged.
• No acceptance, coding-run authorization, scope expansion, or merge authority is conveyed by a receipt.

[Copilot]

🟡 Changes recommended

Update intents are scoped per attempt rather than across the owner command, allowing new writes while earlier outcomes remain unresolved and risking a late earlier write overwriting the newer receipt.

1 open issue

• Block mutations while earlier update outcomes remain unresolved · New

What changed in this PR

Adds completion receipts to TypeChat’s owner-requested discussion automation without publishing draft text, accepting work, or authorizing implementation.

Changes:

• Adds a completion-only controller with separate Issue and Discussion permissions.
• Validates source requests and outcomes, manages receipt writes, and excludes canonical receipts from frozen evidence.
• Adds regression coverage and documents rollout, recovery, and verified Issue acceptance.

File	Description
tools/​tests/​discussion-status.test.mjs	Tests controller permissions, event guards, and write sequencing.
tools/​tests/​discussion-draft.test.mjs	Tests receipt outcomes, authentication, retries, and evidence limits.
tools/​discussion-draft.mjs	Implements receipt validation, planning, publication, and evidence filtering.
README.md	Updates automation milestones and receipt rollout status.
OWNER-CHEATSHEET.md	Adds owner-facing receipt guidance and recovery steps.
AUTOMATION.md	Documents receipt safeguards, limits, and live-verification requirements.
.github/​workflows/​discussion-status.yml	Adds the completion-triggered receipt controller.
.github/​workflows/​discussion-draft.md	Binds run titles to event, target, and comment identifiers.
.github/​workflows/​discussion-draft.lock.yml	Updates the compiled workflow’s run title and metadata.
.github/​copilot-instructions.md	Documents receipt evidence and safety requirements.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The privileged workflow_run controller’s comment writes and durable retry state require owner review and live Issue/Discussion verification of token permissions and retry recovery beyond offline fixtures.

No open issues 🎉

1 resolved since last review

• Block mutations while earlier update outcomes remain unresolved

_{Review effort: Balanced}

[robgruen]

Review follow-up: the code finding about cross-attempt receipt updates is fixed and its thread is resolved. The owner has now merged this PR as 6abfd86. The remaining review note is a rollout requirement, not an unresolved code thread: live Issue and Discussion verification of comment permissions, retry recovery, and failure/cancellation outcomes still needs a separately authorized check. The completion-receipt checklist is in AUTOMATION.md. No live command or model run was triggered as part of this review follow-up, and offline fixtures/CI are not being presented as live verification.