[efraespada]

Setup permission probes started normal Commit and Branch Sync runs on disposable refs, consuming self-hosted runner capacity. Both source and distributed push workflows now exclude the reserved copilot-permission-test-* namespace before jobs start.

What changed

• Preserve ordinary branches, bot pushes and Branch Sync observation of installer branches.
• Apply the same reviewed source-workflow upgrade during inventory, comparison and copy. Preserve native jobs, back up changed files and retain a no-op replay, including jobs without a root-local Action step.
• Enforce exclusion ordering in the workflow contract, add 22 regression cases, and update setup/authentication documentation, SDDs and catalog evidence.

Validation

• Native source migration suite: 39 tests passed, including explicit LF/CRLF fixtures and backup/no-op replay checks.
• Workflow, documentation and specification contracts pass.
• Full coverage budgets pass (97.69% lines and 94.08% branches in the original bugfix coverage run). Every changed renderer statement and all 40 changed decision branches are covered.
• Full contributor hooks pass (build, 673 suites / 10,685 tests, lint; 35 existing skips); typecheck and synchronized bundles pass.
• Isolated replay of the exact chore: configure Copilot #568 plan with 🐛🧑‍💻 - bugfix setup generated runner groups fail source workflow validation #570: grouped route retained, all 34 workflows validate, second render produces zero changes. No PAT/network used.

Review notes

Existing repositories need the updated workflow files merged before their next probe. A CLI upgrade cannot retroactively suppress old workflows or queued runs. User-owned CI and PR automation remain configured and may still produce runs or audit history; this fix does not cancel arbitrary runs.

Closes #569.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~572

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on 52b446a.

Pull request · Verified commit · Workflow run

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.96%. Comparing base (274db40) to head (52b446a).
⚠️ Report is 1483 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #572      +/-   ##
===========================================
+ Coverage    90.94%   93.96%   +3.01%     
===========================================
  Files          135      936     +801     
  Lines         6251    30068   +23817     
  Branches      1338     8804    +7466     
===========================================
+ Hits          5685    28253   +22568     
- Misses         172      717     +545     
- Partials       394     1098     +704     

Files with missing lines	Coverage Δ
...rc/infrastructure/setup_batch_workspace_adapter.ts	100.00% <100.00%> (ø)
src/utils/setup_files.ts	85.05% <100.00%> (-11.85%)	⬇️
src/utils/setup_installation_review.ts	100.00% <100.00%> (ø)
src/utils/setup_workflow_upgrade.ts	100.00% <100.00%> (ø)

... and 999 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 52b446a6e46f; base: 7ad88e6f0053; reason: protected-path.

[efraespada]

Native dogfooding passed on merged develop commit 41705056436cd58087cadbaa021e30a6fa2f4b8c after both fixes were merged with exact-head CI, Codecov and RepoWise green.

• A disposable copilot-permission-test-<32 hex> ref used that reviewed commit. Four GitHub run inventories over 60 seconds and a post-cleanup read showed zero push runs, including Commit and Branch Sync.
• Production setup journal/cleanup primitives removed the exact ref, confirmed 404 and left zero pending journals. This tested native admission of the reviewed code; it did not apply a default-branch installation.
• Fresh real planning for copilot and platform found the selected vypdev route ready, 14 visible runner candidates per target, zero access grants and zero repository Variable writes. All six Secret/Variable inventory digests matched before and after planning.
• The temporary setup PAT stopped authenticating (401) before this ref test and its local copy was removed. The bounded ref test used the existing repository session.

Master is still v3.5.6. Full published-version Apply validation requires normal release promotion and a fresh reviewed installation operation; the existing immutable #568 and vypdev/platform#180 receipts were preserved.