fix(github-config): accept the reviewed replacement publisher

[devantler]

🤖 Generated by the Agentic Engineer

Why

The pending publisher upgrade would stop configuration releases because Platform does not yet accept its signing identity.

What

Prepare the documented transition so releases signed by the current or reviewed replacement publisher can be verified. Retain the current signer until the replacement has published successfully.

Part of #5092

⚠️ Merge order: deploy this before the publisher caller update, or configuration publication will fail.

[devantler]

🤖 Generated by the Agentic Engineer

Prepared at signed head 85188abf7dd1ca59f91f7021686d39eadc42872d, based on reviewed main 77e6916022ecc65de1ec094c9af6dedc1271f5fc.

The published v7.16.2 workflow is byte-identical to the currently approved publisher (SHA-256 2858f387b7b7587d871940af0ac26ff88e6a73c6242e39e38f8e9919b601ca1e). The complete 16-commit source comparison changes neither immutable publication helper. I reviewed the actual workflow, including SHA-pinned caller admission, signing, verification of publication claims, late-version refusal and digest-based promotion. The new immutable revision remains a distinct certificate identity despite that source parity.

The documented matcher writer changed only the configuration consumer. Sixteen checks against the actual before/after subjects prove the current signer remains accepted, the replacement changes from refused to accepted, both legacy compatibility signers remain accepted, and unknown revisions, mutable refs, other repositories/workflows, extra prefixes/suffixes and wrong issuers remain refused. Other consumers' matchers are unchanged.

Using checksum-verified kubectl v1.36.2 with Kustomize v5.8.1, the production authorization validator first refused exactly one changed entry: OCIRepository github-config/github-config. Its approved digest changed from 4f6bdc88a1f7996fbbb8bd141db306ff0875c4e4818f0bf34e6a18cbd322ddc6 to d26055f2d4b80751c249d58fa2a1062d5d504842b3ac1afd4feb9d5812ef1a9b; no other ledger entry changed. The validator and its Go tests then passed. The initial host-renderer refusal was corrected by selecting the approved renderer, without changing validation policy.

Both local and production ksail workload validate commands passed and explicitly included the changed configuration consumer. Canonical-approval, writer, guard, regeneration, revision-generator and discovery-conservation regressions passed, as did whitespace validation. All 11 selected validation commands passed. Correctness, security and simplification self-review found no further change needed.

Hosted CI and semantic review remain pending. This receipt proves preparation and offline matcher behavior, not deployed acceptance or a new signed publication. Keep #5092 open; deploy and read back both exact identities before devantler-tech/.github#649 merges, then retain the current approval through the first verified publication under the replacement.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T14:16:45.990436Z	9237f6b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85188abf7d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 9237f6b59d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 9237f6b59d2c7e9bd005aeb2f28b8714918666ff:

• Exact-head CI completed successfully with all 22 native jobs accounted for. Selected manifest, Go, repository-guard, authorization, matcher, policy and Flux checks succeeded; intentionally unselected jobs are not claimed as exercised.
• Fresh Codex review is clean at this head. The earlier audit-history finding is repaired and its thread resolved; no current-head thread or non-thread finding remains.
• User evaluation: the hosted matcher-efficacy job verified the actual existing artifact through the candidate matcher, and current-head approval-generator/guard/regeneration and production-authorization checks passed. I independently read those native results and confirmed the old and replacement publisher revisions contain the same immutable workflow blob. This establishes preparation and retained-current-signer behavior, not deployed acceptance or successful replacement publication.
• The complete readable required gate set passes and GitHub reports CLEAN. The configured native code-quality rule has no separate readable verdict (UNVERIFIED in the diagnostic helper); I have not relabelled that observation PASS or waived the rule. Native merge admission remains authoritative.
• Ownership is clear: no live local holder, no in-flight current-head review, and the preceding author's last push is outside the two-hour activity window. The effective PR template check passed.

Promoting and entering the normal protected production queue. Keep #5092 open and keep devantler-tech/.github#649 blocked until deployed acceptance of both exact publisher identities is independently read back. No admin bypass or safety-gate change.