[efraespada]

Setup could reject valid PATs, lose progress after a bot-account mistake, miss recent CI producers, or fail installation on issue context and moving Action tags. The web assistant now also opens a configuration panel before the complete wizard: it explains this checkout, reads effective GitHub settings, and supports reviewed changes to independent parameters.

• Show installation state, bounded workflow inputs, repository/organization Variables with precedence, and Secret names with shadowing warnings. Unknown/custom/environment-dependent values remain visibly unverified. GitHub cannot disclose existing Secret values, owners or permissions.
• Offer 14 fixed quick settings. Each change keeps the effective scope, requests only the needed Variables access, creates/removes a temporary permission-test Variable after approval, rechecks local/remote state and controller ownership, writes one value and verifies readback. Cancel/no-op paths do not write; uncertain outcomes require inspection. Complex changes hand off explicitly to the complete wizard.
• Prefill setup PAT grants, distinguish missing grants from unverifiable tests, bind bot PATs to the selected account, and allow explicit correction without restarting. Disclose PAT replacement and block repository Secrets that shadow organization targets until explicit recheck/scope correction. Preserve ordinary Variables named PAT.
• Remove nested list scrolling, improve plan/result spacing and forward-button alignment, translate management UI into four languages, and adapt the panel at 320px. Discover recent PR checks using bounded pagination rather than only the first repository-run page.
• Prepare/clean isolated bot Actions fixtures using setup authority while retaining bot dispatch/readback verification. Confirm Project cleanup before clearing recovery evidence. Install through setup ports independently of issue admission; a blank Codex API key remains valid with configured runner authentication.
• Derive initial-tag creation automatically from enabled release/hotfix workflows. Read authenticated remote semantic tags, choose the highest numeric version, skip existing versions, and create v1.0.0 only after confirmed absence. Local moving v1/v2/v3 tags are untouched and incomplete reads cannot authorize creation.
• Update organization Variables without rewriting visibility, preserve inherited access, and report value-free resource/scope/phase failures. Retain unclassified errors beside typed failures. Update SDDs, catalog, documentation and packaged bundles together.

Validation: 557 suites passed; 6,833 tests passed and 26 skipped. All coverage budgets passed. Each of the seven new management runtime modules has 100% statements, branches, functions and lines. All 612 added/changed executable source lines are covered locally, with zero partially covered changed branches. The added management cases exceed the SDD's 96-case minimum; the existing web acceptance ledger remains 308/350 passed with 42 explicitly open human/provider cases. Typecheck, lint, Svelte/Vite, specification/catalog/documentation/workflow checks, synchronized build and the 69-file package contract passed. Packaged CLI/API/web smoke uses disposable local fixtures. The final commit hook passed the full suite and lint with two Jest workers.

User-authorized live dogfooding from the installed package verified organization quick-change/readback/restoration cycles for review comment limits and PR reviewer count, cancelled previews and no-op changes. A prior complete installation succeeded with organization Secrets/Variables, SDDs, inactive issue closure, CI Check + RepoWise, Project #2, bot vypbot and omitted Codex API key. A repeated overwrite attempt correctly stopped before Apply because five existing repository AGENT_* Variables shadow organization values; the conflicting repository Variables were left intact. A preserving-variable repetition also completed successfully, including bot Actions/Project cleanup and an omitted Codex API key. The new package verified an additional comment-limit cycle 20 → 19 → 20. Read-only Finish now completes without requiring an installation mutation; a full-assistant handoff preserves prior quick changes without masking a later uncertain installer write. Prior read-only doctor results were 100 pass / 5 warn / 5 fail, including branch-rule/native-approval readiness; these are not claimed as resolved installation failures. Existing Secrets cannot be rolled back because GitHub does not reveal their old values.

Every generated dogfooding configuration file is archived outside the repository, inspected and discarded. This PR changes no files under .github or .copilot, preserving the repository's product baseline. CI and all three hosted platform smoke jobs passed on 514ed4d. Codecov confirms that all modified and coverable lines are covered on this exact head; local diff coverage also has zero partially covered changed branches. Conditional self-hosted and hosted Windows coverage-upload jobs were skipped. Codecov warns that its base coverage report is stale (1,069 commits behind), so the project coverage delta is not used as evidence of develop readiness. RepoWise local analysis found no critical refactoring findings in the three new refactored modules; repository-wide health is 9.11/10 and hotspot health 10/10, with existing legacy findings retained. The RepoWise CI health report succeeded on 514ed4d. Its optional dead-code scan timed out (exit 124), and its security/history scan failed with MemoryError (exit 1). These advisory scans are explicitly incomplete; they are not asserted as a completed dead-code or security review. The existing repository workflow is unchanged.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~411

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on 514ed4d.

Pull request · Verified commit · Workflow run

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.50%. Comparing base (274db40) to head (514ed4d).
⚠️ Report is 1069 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #411      +/-   ##
===========================================
+ Coverage    90.94%   92.50%   +1.56%     
===========================================
  Files          135      826     +691     
  Lines         6251    24987   +18736     
  Branches      1338     7086    +5748     
===========================================
+ Hits          5685    23115   +17430     
- Misses         172      786     +614     
- Partials       394     1086     +692     

Files with missing lines	Coverage Δ
...rors/setup_workflow_pat_identity_mismatch_error.ts	100.00% <100.00%> (ø)
...plication/policies/setup_configuration_defaults.ts	94.91% <100.00%> (ø)
...ion/policies/setup_configuration_storage_policy.ts	94.35% <100.00%> (ø)
...pplication/policies/setup_issue_workflow_policy.ts	100.00% <100.00%> (ø)
...on/policies/setup_management_permissions_policy.ts	100.00% <100.00%> (ø)
...rc/application/policies/setup_management_policy.ts	100.00% <100.00%> (ø)
...lication/policies/setup_pat_creation_url_policy.ts	100.00% <100.00%> (ø)
...rc/application/policies/setup_pat_intent_policy.ts	100.00% <ø> (ø)
...c/application/policies/setup_question_labels/fr.ts	100.00% <ø> (ø)
...c/application/policies/setup_question_labels/pt.ts	100.00% <ø> (ø)
... and 70 more

... and 813 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 514ed4d. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 411e286 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Preservation is disabled for any resource named PAT — src/application/policies/setup_configuration_storage_policy.ts:37

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 514ed4d. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 47fb66e was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• low: Latest runs page can hide all recent pull-request checks — src/infrastructure/github_setup_approval_check_discovery_adapter.ts:44

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 514ed4d. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit c158cbd was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Mixed variable write errors can be silently dropped — src/application/usecases/actions/setup_resource_provisioning.ts:233