🐛🧑‍💻 - Release issue closes and reaches 100 at production promotion before publication and reconciliation #792

Is there an existing issue for this?

• I have searched the existing issues.

Searches included release closed publishing, "100%" "promotion", "promotion_pr_pending" "closed", "publicationVerified" "100%", and release premature, across open and closed issues.

#520 contains an earlier related UX observation that a release launcher closed on promotion before reconciliation. Its main defect and acceptance concerned reconciliation retry. #735 requests a typed staged-rollout lifecycle for ordinary operational work. This report isolates premature completion of an already typed, native release orchestration with publication and reconciliation explicitly pending. #740 concerns tag-push issue resolution and is a different, fixed defect. Please consolidate if a dedicated completion bug already exists while retaining this fresh native reproduction.

Which actions are affected?

Issue, Pull Request

Which platforms are affected?

Linux

Description

A native Copilot release issue is closed as completed and receives 100% immediately after the production promotion merges, while its durable operation is still publishing, publicationVerified=false, and no development reconciliation exists. In this case zero of ten packages were published and the publisher was still waiting for the normal protected pub.dev review.

The release dashboard correctly shows publication, reconciliation and final cleanup unchecked, but the native issue state and completion label imply the entire release is finished. This can mislead a maintainer following the issue list, notifications or project state. It is a completion-state defect; publication itself has not failed, and its successful continuation is not proof that the premature completion was correct.

Consumer: vypdev/zstandard issue #185, release 1.5.5, promotion PR #186.

Durable operation 3038f8c6-5823-4dd1-8f37-ef7ac1963e9f:

• kind=release, version=1.5.5, strategy production-lineage.
• prMode=auto, backmergeMode=auto, cleanup=all, issueCompletion=close.
• Origin develop@689fc7441e0265c7573a9768dc91f6bd7e7c317a.
• Candidate release/1.5.5@9a0d2df97d68aa0cdb81759b61b1c8ba0e4cf506.
• Candidate/accepted tree c8235a446578e703c1c5a0789c66945469b43723.
• Accepted production/tag SHA f2b106d828d5ac7c2f15ff4bf708cf48d4fc1413.
• Observed persisted revision 5: phase=publishing, publicationVerified=false, reconciliationTargets=[], lastFailure=null.

Expected: for native release/hotfix orchestration, production acceptance is an intermediate milestone. Keep the issue's native open/closed state, progress label and project/status projection consistent with the operation until verified publication, all required reconciliation and cleanup complete. issueCompletion=close should take effect at the actual configured completion boundary. Preserve ordinary completed-issue closure, protected checks, environment review, operation identity and immutable publication receipts.

Reproducing the issue

This was observed during an explicitly authorized real release; do not create another tag or upload packages merely to reproduce it.

1. Admit a Release issue using the installed form; a maintainer starts it and uses the normal deploy launcher. No consumer-created remote branch or manual version bump is involved.
2. Run full deployment preparation and candidate gates. Preparation 40904824050 succeeds at attempt 1, generates all distributable outputs, and uploads the exact candidate receipt. Artifact 12912889105, release-candidate-1.5.5, records issue185, run40904824050/attempt1, source9a0d2df and treec8235a4. Its downloaded ZIP SHA256 is 0b5ceb3c9a3889d2df30282dd7356b50ae88b8f5b2ce51612ff3b317f16cdd1a.
3. Copilot opens PR186 targeting master, with its native deployment operation marker and GitHub auto-merge enabled by vypbot, method merge. The displayed body has no Closes #185 text; it has the release control-center link. Read-only GraphQL nevertheless returns issue185 in closingIssuesReferences.
4. At 2026-10-29 16:33:48 UTC, PR186 merges as vypbot to productionf2b106d.
5. At 16:33:50 UTC, issue event 34609201846 records closed, actor vypbot, commit_id=null. No maintainer manually closed the issue.
6. Copilot pull_request:closed run40912816485, job123585033047, was created at 16:33:52 UTC and succeeds. The initial closure therefore predates this handler; this report does not claim that its later close routine caused the first close. The exact closure producer/root cause still needs upstream investigation.
7. At 16:34:24 UTC, event 34609254477 adds 100%, actor vypbot. The observed labels are release, branched, deploy, priority: medium, 100%, state:working.
8. The release dashboard comment6502239175, updated16:34:39, states publishing artifacts; package publication, development reconciliation and cleanup remain unchecked.
9. The normal publication continuation40912953679 creates/verifies the accepted new tag. Tag publisher40913044268, created16:35:15, validates the immutable tag and then waits for the protected pub.dev environment. No checks or environment protection were bypassed.
10. At 16:38:26 UTC, independent REST reads still show issue185 closed/100%, while the publisher is waiting, normal environment approval is pending, durable publication is unverified and reconciliation is empty. Public API requests for each of these exact1.5.5 versions return404: zstandard_platform_interface, zstandard_native, zstandard_android, zstandard_ios, zstandard_linux, zstandard_macos, zstandard_web, zstandard_windows, zstandard_cli, zstandard.

The snapshot is point-in-time evidence. We will continue the separately authorized release through its supported workflow, so the URLs may subsequently show successful publication/completion. That later success does not erase the earlier closed/100% interval while the registry and environment evidence proved publication had not started.

copilot Version

Consumer config uses vypdev/copilot@v3. The actual closed-PR job downloads Action revision f5e5a4cf9a80248994469cd88ad55eecab5b95ca; runner2.338.0, Linux self-hosted. The source SHA identifies executed diagnostics only: no SHA-pinned Action reference was added to the consumer.

Relevant Log Output

2026-10-29T16:33:57.2217269Z Download action repository 'vypdev/copilot@v3' (SHA:f5e5a4cf9a80248994469cd88ad55eecab5b95ca)
2026-10-29T16:34:04.5391124Z   reconciliation-issue-completion: close

Read-only provider evidence at16:38:26UTC:

{
  "issue": 185,
  "state": "closed",
  "closed_at": "2026-10-29T16:33:50Z",
  "completion_label": "100%",
  "operation_phase": "publishing",
  "publicationVerified": false,
  "reconciliationTargets": [],
  "publisher_run": 40913044268,
  "publisher_status": "waiting",
  "pending_environment": "pub.dev",
  "published_target_versions": "0/10; all ten exact-version endpoints return HTTP404"
}

These are state observations, not fabricated failure logs. Native jobs currently report success and the release continues normally.

Additional context and comments

The human maintainer explicitly requested detailed upstream reports for every genuine Copilot anomaly, leaving implementation to this repository's maintainers. We have not modified the consumer's Copilot engine, generated workflows/profile, verification setup, credentials, PR_APPROVAL_POLICY or durable operation state; manually reopened or relabeled its closed release issue; created a replacement managed branch; or fabricated publication/reconciliation success. The separate minor1.6.0 remains stopped and all previous immutable tags remain untouched.

Suggested regression coverage: actual automatic production promotion and its closing-issue relationship; closure occurring before the pull_request:closed handler starts; queued protected publication; a failed/retryable publication; verified publication with pending reconciliation; successful final completion; duplicate/concurrent merged/closed/label events; and ordinary non-deployment issue closure. Verify native issue state, labels, project/status and dashboard together. A text-rendering-only test will not catch an earlier GitHub/provider close.