[efraespada]

Fixes #844.

A branch sync could commit its merge, receive GitHub's workflow-write rejection, then attempt git merge --abort after the merge had already ended. The reply hid the credential problem behind a retryable error and could also claim that nothing was published after a lost push response.

The trusted Git adapter now captures a bounded stderr suffix and reports only a closed workflow-write denial. Once commit finishes, recovery preserves the workspace and observes the existing remote branch once. An exact candidate confirms completion without a second push; an original, different or unavailable head produces accurate nonretryable recovery facts. An unverifiable candidate is never pushed. Facts are bound to the prepared original child before reconciliation.

English/Spanish recovery, the owning SDD, a dedicated publication-recovery companion, catalog and operator documentation cover temporary runner storage and credential-specific recovery. Workflow paths alone do not prove missing capability. Existing verification, branch ownership and credential isolation remain in force; the fix introduces no permission grants, force push or user-worktree reset.

Local validation: 878 Jest suites / 17,071 tests pass (35 existing skips), including 105 distinct new cases; 267 extension tests retain 100% in every metric. Full-suite LCOV covers 114/114 modified lines with zero misses or partials against c1d593d. The four new pure modules measure 100% lines, statements, functions and branches, enforced by an exhaustive budget. Types, lint, SDD/catalog/docs/workflow contracts pass. A versioned controlled before/after proof uses actual SDK source and real local Git. Its server hook models the denial message shape; it does not claim real GitHub credential validation or consumer execution. Four executable real-Git cases cover denial, unrelated rejection, lost acknowledgement and unavailable observation while preserving a separate dirty user checkout.

Remote acceptance for 771dc505ee24d5ea37883749ae298c27f1d6b337 against c1d593dc72637e31e3dba0785e846b5548b9a4b0: CI, Commit, Branch Sync and Linux/macOS/Windows pass. The complete review covers 2/2 partitions, all 27 assigned files and 4/4 issue comments, with zero omissions, findings or open threads. Official Codecov confirms 114/114 modified lines (100%), zero misses and partials. All native jobs executed the exact parent/head tree b56829f9980c61996e9460c43b847415c74a98b4 and verified deferred cleanup.

The opened-PR lifecycle needed one bounded retry after a retryable provider failure at issue linkage, before Bugbot began. The successful run verifies native linkage to #844 and the complete finding-free review; no source, permission, coverage or protection control was weakened.

Build, package validation (96 files), CLI/typed API/isolated setup-web smoke and Graphify pass. Normal commit hooks reran build, all 878 suites / 17,071 tests and lint successfully; all 34 prepared input hashes remain unchanged.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~871

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on 771dc50.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 771dc505ee24; base: c1d593dc7263; reason: protected-path.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.39%. Comparing base (c1d593d) to head (771dc50).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #871      +/-   ##
===========================================
+ Coverage    95.38%   95.39%   +0.01%     
===========================================
  Files         1142     1146       +4     
  Lines        37803    37904     +101     
  Branches     11261    11297      +36     
===========================================
+ Hits         36057    36158     +101     
  Misses         672      672              
  Partials      1074     1074              

Files with missing lines	Coverage Δ
...tion/policies/application_error_message_catalog.ts	100.00% <100.00%> (ø)
.../policies/application_error_presentation_policy.ts	100.00% <100.00%> (ø)
...ation/policies/branch_sync_publication_messages.ts	100.00% <100.00%> (ø)
...ecases/branch_sync/branch_sync_execution_policy.ts	100.00% <100.00%> (ø)
...ation/usecases/branch_sync/sync_branch_use_case.ts	100.00% <100.00%> (ø)
src/data/model/application_error.ts	100.00% <100.00%> (ø)
src/domain/branch_sync_publication.ts	100.00% <100.00%> (ø)
src/domain/git_push_failure.ts	100.00% <100.00%> (ø)
...rc/infrastructure/branch_sync_workspace_adapter.ts	97.25% <100.00%> (+0.37%)	⬆️
src/infrastructure/git_commit_adapter.ts	94.73% <100.00%> (+0.85%)	⬆️
... and 1 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.