[efraespada]

Approval observers now retain a sanitized operation, cause and access category when evidence reads fail. Permanent authorization/resource/schema errors and transient provider failures keep their retryability and correlation through the Job Summary and final Action error, while missing evidence continues to block approval.

What changed

• Identify failing PR/ref, inventory, rule, job and coverage-artifact reads without exposing provider text, credentials or policy values.
• Preserve independent evidence and block submission when initial or final evidence verification fails, including policy rereads; retain causal post-submit readback failures without repeating review POSTs.
• Update recovery documentation, specification/catalog evidence and generated bundles.

Validation

• Full coverage: 684 suites, 11,114 passed, 35 configured skips; all coverage budgets passed.
• Types, lint, documentation/workflow/specification validators, generated bundle/package validation and Graphify passed.
• Normal commit hooks passed build, the full test suite and lint.

The original consumer endpoint cause still needs a fresh observer run after promotion; this change makes that cause observable without changing approval policy or token permissions.

Closes #619

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~628

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on 74f6765.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot unverified.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 732f12d07804; base: 7be4226d6579; reason: protected-path.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 92.43697% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.08%. Comparing base (274db40) to head (732f12d).
⚠️ Report is 1545 commits behind head on develop.

Files with missing lines	Patch %	Lines
...y/pull_request/pull_request_approval_repository.ts	86.27%	2 Missing and 5 partials ⚠️
...approval/observe_pull_request_approval_use_case.ts	95.23%	0 Missing and 1 partial ⚠️
.../repository/pull_request/approval_evidence_read.ts	93.75%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #628      +/-   ##
===========================================
+ Coverage    90.94%   94.08%   +3.13%     
===========================================
  Files          135      945     +810     
  Lines         6251    30443   +24192     
  Branches      1338     8946    +7608     
===========================================
+ Hits          5685    28642   +22957     
- Misses         172      704     +532     
- Partials       394     1097     +703     

Files with missing lines	Coverage Δ
src/actions/pull_request_approval_action.ts	87.77% <100.00%> (ø)
src/application/errors/approval_evidence_error.ts	100.00% <100.00%> (ø)
...tion/policies/application_error_message_catalog.ts	100.00% <ø> (ø)
src/data/model/application_error.ts	100.00% <100.00%> (ø)
...sitory/pull_request/current_base_revision_query.ts	100.00% <100.00%> (ø)
src/domain/approval_evidence_diagnostic.ts	100.00% <100.00%> (ø)
src/domain/pull_request_approval.ts	97.93% <ø> (ø)
...approval/observe_pull_request_approval_use_case.ts	89.85% <95.23%> (ø)
.../repository/pull_request/approval_evidence_read.ts	93.75% <93.75%> (ø)
...y/pull_request/pull_request_approval_repository.ts	89.90% <86.27%> (ø)

... and 1002 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[efraespada]

/copilot sync-branch

[vypbot]

Branch synchronized

develop was merged into bugfix/619-approval-observer-hides-evidence-read-failures-behind-evidence-unavailable-without-actionable-diagnostics and pushed as 732f12d078041b5f83f78ecd6fe3df23010440c6.

6 verification checks passed.