[jmservera]

External-facing changes

• If this PR ships copy or graphics that will appear OUTSIDE this repo (social posts, launch blog, announcements, press), I tagged @squad:nibbler for an RAI sign-off before merge.

Not applicable: reliability code, workflow gates, tests, and operational runbooks only.

Summary

• Bound existing-PR head propagation to 120 seconds for the recorded predecessor, corroborated by the independent pushed branch ref. Stale checks never count; genuine replacement fails closed.
• Require submitted Copilot review on the exact latest head, no pending re-request, and zero unresolved threads before each generated-sync merge attempt. Preserve all required checks and exact-head merge matching.
• Preflight the configured status URL before automatic/manual generation; preserve podcast_publication_status_v1, exact identity/auth, and configured unlisted YouTube policy. This is configuration validation, not a deployed-adapter health assertion.
• Replace the incorrect 58-minute evidence window with 130 minutes evidence plus 2 minutes cleanup. The 135-minute job covers deployed 30-minute synthesis + 90-minute video limits and bounded startup/setup.

Verification

• Final full Python suite: 2052 passed, 1 existing skip, 2 existing cover-image warnings.
• Final focused dispatch/handoff/workflow tests: 187 passed, 1 existing skip.
• Ruff lint and repository-wide format check clean.
• Checkov 3.2.533: 1109 passed, 0 failed, 7 existing justified skips.
• Pinned Zizmor 1.27.0: no blocking findings. Bandit clean.
• Live read-only evidence: deployed ACA synthesis 1800s/video 5400s/recorder 900s and 30s scale polling; actual GraphQL Copilot bot identity, submitted review state, commit oid, and thread representation verified on sync: publish data → main #831.
• Regressions: stale-green predecessor → expected pending → expected green, persistent mismatch, real replacement, post-acknowledgement regression; pending/missing/old-head/re-requested review, new threads/resolution, movement; W41 80m16s trace, W42 processed unlisted YouTube + published Spotify contract, delayed approval, real deadline exhaustion, and cleanup reserve.
• Independent coordinator review, including URL/Hermes workflow/security ownership.
• Deployed Podcaster adapter and protected environment status-endpoint configuration, followed by existing-identity readback.

Rollout and boundaries

No Podcaster source changes or production generation dispatched; W42 is already published and must not be duplicated. Preserve protected production approval, secrets, exact canonical identity, and all quality/security gates. Podcaster adapter deployment and PODCASTER_STATUS_ENDPOINT configuration are coordinated separately with Basher and the parent; static preflight alone is not rollout proof.

Do not merge until independent parent review and latest-head required checks, completed Copilot review, and thread-resolution gates are eligible.

Operational details: docs/deployment/podcast-terminal-monitor.md and docs/deployment/publish-sync-github-app.md.

Related issues: None; bounded follow-up to the W42 readiness findings.

[Copilot]

🔵 Needs a closer look

Production workflow and merge-gate changes require independent URL pipeline and Hermes security review.

0 open findings

What changed in this PR

Hardens generated-content synchronization and podcast publication monitoring.

Changes:

• Enforces exact-head checks, Copilot review completion, and resolved review threads before merging sync PRs.
• Validates podcast status endpoints before generation.
• Extends terminal monitoring to the deployed 130-minute processing window.

File	Description
scripts/​wait_for_required_checks.py	Adds propagation and review gates.
scripts/​podcast_dispatch_state.py	Validates endpoints and extends monitoring.
.github/​workflows/​sync-publish-to-main.yml	Applies hardened merge gates.
.github/​workflows/​auto-podcast-dispatch.yml	Adds preflight and timeout changes.
.github/​workflows/​trigger-podcast.yml	Adds manual-generation preflight.
tests/​test_wait_for_required_checks.py	Tests propagation and review gating.
tests/​test_sync_publish_workflow.py	Tests workflow merge safeguards.
tests/​test_podcast_dispatch_state.py	Tests validation and monitoring deadlines.
tests/​test_pipeline.py	Updates workflow contract assertions.
docs/​deployment/​publish-sync-github-app.md	Documents synchronization safeguards.
docs/​deployment/​podcast-terminal-monitor.md	Documents monitoring operations.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Production workflow, protected merge, and external podcast contract changes require the repository-mandated independent pipeline and security review.

0 open findings

🧠 Review effort: Balanced

[jmservera]

READY FOR INDEPENDENT REVIEW: head 9287337. Final full suite: 2052 passed, 1 existing skip; focused suite: 187 passed, 1 existing skip. Repository Ruff clean; blocking Checkov 3.2.533 (1109 passed, 0 failed, 7 existing justified skips), Zizmor 1.27.0, and Bandit clean. All 12 ruleset-required checks passed; latest-head Copilot reviews completed at 21:26:13Z and 21:29:09Z, no comments/unresolved threads. Exact-head merge remains withheld for independent coordinator review. No Podcaster source changes, production dispatch, approval changes, visibility changes, or duplicate W42 generation. Status adapter deployment and protected PODCASTER_STATUS_ENDPOINT configuration must be verified separately before next-week approval. Tooling note: pinned repository Zizmor 1.27.0 was reported yanked for GHSA-f42p-wjw5-97qh when restored locally; security-tool version follow-up is outside this bounded PR, and its existing CI gate remains intact.