release(3.10.0): promote to master

.copilot/AGENT_GUIDE.md

@@ -51,4 +51,6 @@ The setup runner profile selects placement; it does not install the project's la
 
 Declare reviewed version prefixes in `.copilot/verification-prerequisites.json` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use `actions/setup-java`; `JAVA_HOME` and `PATH` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites).
 
+The optional repository-owned composite action prepares each candidate before verification. Setup creates .github/actions/copilot-verification-setup/action.yml only if missing and preserves an existing consumer action and its assets. The shared terminal/web assistant offers explicit activation, disabled by default. Customize the generated failing placeholder before enabling; setup generation and installer PRs do not prove runtime readiness. Review `.github/actions/copilot-verification-setup/action.yml` and its assets onto trusted main, update generated workflows, then enable `VERIFICATION_SETUP=true` (Action input `verification-setup`, disabled by default). GitHub Actions executes the trusted snapshot before each command with a fresh private HOME; candidate changes cannot replace it. Native post steps finish before profile cleanup. Setup failure blocks verification and commit/push. The local CLI cannot execute composite actions and fails closed when opted in. Read [repository-owned setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-owned-setup).
+
 For the full contributor flow, read [repository collaboration](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-collaboration.mdx). For drift and recovery, read [guidance troubleshooting](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-guidance-troubleshooting.mdx).

.copilot/setup-manifest.json

@@ -12,7 +12,7 @@
     },
     ".copilot/AGENT_GUIDE.md": {
       "role": "guide",
-      "sha256": "07ef187d584f4da868a6cebe6b6d7c7654b057af703e0d10ede11f768ba64674"
+      "sha256": "c3bd0df4bfdcbba2a007b1596a93480a3bb3145a6285e0a91809f3a93c3fbcd0"
     },
     ".copilot/repository-profile.json": {
       "role": "profile",

.github/actions/copilot-native-cleanup-check/action.yml

@@ -0,0 +1,6 @@
+name: Verify native setup cleanup
+runs:
+  using: node24
+  main: main.cjs
+  post: post.cjs
+  post-if: always()

.github/actions/copilot-native-cleanup-check/main.cjs

@@ -0,0 +1,2 @@
+const fs = require('node:fs');
+fs.appendFileSync(process.env.GITHUB_STATE, `workspace=${fs.realpathSync(process.cwd())}\n`);

.github/actions/copilot-native-cleanup-check/post.cjs

@@ -0,0 +1,10 @@
+const fs = require('node:fs');
+const path = require('node:path');
+const workspace = process.env.STATE_workspace;
+// Keep the poisoned candidate bundle through every deferred post step, then remove
+// only this job's ignored generated fixture output so subsequent runs start clean.
+fs.rmSync(path.join(workspace, '.github/actions/copilot-native-fixture/dist'), { recursive: true, force: true });
+for (const file of [path.join(workspace, '.git/copilot-verification-setup'), path.join(path.dirname(workspace), '.copilot-native-fixture-runtime')]) {
+  if (fs.existsSync(file)) throw new Error('Native acceptance left owned staging or runtime snapshots after post cleanup.');
+}
+console.log('Native acceptance cleanup passed after all deferred post steps.');

.github/actions/copilot-native-fixture/action.yml

@@ -0,0 +1,10 @@
+name: Copilot native verification acceptance
+inputs:
+  verification-setup:
+    default: 'true'
+    description: Exercise the native verification bridge
+runs:
+  using: node24
+  main: dist/index.js
+  post: dist/index.js
+  post-if: always() && env.COPILOT_NATIVE_PHASE != ''

.github/workflows/copilot_commit.yml

@@ -51,6 +51,7 @@ jobs:
           issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           issue-managed-branches: true
           pre-branch-sdd: true
+          verification-setup: ${{ vars.VERIFICATION_SETUP || 'false' }}
           debug: ${{ vars.DEBUG }}
           bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
           bugbot-comment-limit: ${{ vars.BUGBOT_COMMENT_LIMIT || '20' }}

.github/workflows/copilot_issue.yml

@@ -26,6 +26,7 @@ jobs:
           issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           issue-managed-branches: true
           pre-branch-sdd: true
+          verification-setup: ${{ vars.VERIFICATION_SETUP || 'false' }}
           ai-ignore-files: build/*,specs/CATALOG.md
           bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
           bugbot-effort: ${{ vars.BUGBOT_EFFORT || 'smart' }}

.github/workflows/copilot_issue_comment.yml

@@ -1,111 +1,32 @@
+# Generated by scripts/generate-native-verification-workflows.cjs
+# Project runtimes: .copilot/verification-prerequisites.json
+# Dependencies: .github/actions/copilot-verification-setup/action.yml
+# https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites
 name: Copilot - Issue Comment
-
-on:
+'on':
   issue_comment:
-    types: [created, edited]
-
+    types:
+      - created
+      - edited
 jobs:
   copilot-issues:
     if: ${{ vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN }}
-    name: Copilot - Issue Comment
-    runs-on: [self-hosted, codex, Linux]
-    timeout-minutes: 120
+    uses: $/.github/workflows/copilot_comment_runtime.yml
     permissions:
       checks: write
       contents: read
-    env:
-      # Preparation covers parser whitespace and mentions; authorization stays in the Action.
-      COPILOT_PREPARE_VERIFICATION: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS != '' && ((contains(github.event.comment.body, '/copilot') && ((contains(github.event.comment.body, 'sync-branch') && !contains(github.event.comment.body, '--dry-run')) || contains(github.event.comment.body, 'implement') || contains(github.event.comment.body, 'fix') || contains(github.event.comment.body, 'remember'))) || (vars.COPILOT_BOT_LOGIN != '' && contains(github.event.comment.body, format('@{0}', vars.COPILOT_BOT_LOGIN)) && !contains(github.event.comment.body, '--dry-run'))) }}
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-
-      - name: Prepare repository pnpm
-        if: env.COPILOT_PREPARE_VERIFICATION == 'true'
-        uses: pnpm/action-setup@v5
-        with:
-          version: 10.12.4
-          standalone: false
-          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
-
-      - name: Prepare repository Node
-        if: env.COPILOT_PREPARE_VERIFICATION == 'true'
-        uses: actions/setup-node@v7
-        with:
-          node-version: '24.x'
-
-      - name: Install repository verification dependencies
-        if: env.COPILOT_PREPARE_VERIFICATION == 'true'
-        shell: bash
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - uses: ./
-        with:
-          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
-          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
-          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
-          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
-          issue-managed-branches: true
-          pre-branch-sdd: true
-          ai-ignore-files: build/*,specs/CATALOG.md
-          debug: ${{ vars.DEBUG }}
-          agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
-          agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
-          agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
-          findings-provider: ${{ vars.FINDINGS_PROVIDER }}
-          findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
-          findings-model: ${{ vars.FINDINGS_MODEL }}
-          findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
-          fixer-provider: ${{ vars.FIXER_PROVIDER }}
-          fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
-          fixer-model: ${{ vars.FIXER_MODEL }}
-          fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
-          planner-provider: ${{ vars.PLANNER_PROVIDER }}
-          planner-model-provider: ${{ vars.PLANNER_MODEL_PROVIDER }}
-          planner-model: ${{ vars.PLANNER_MODEL }}
-          planner-effort: ${{ vars.PLANNER_EFFORT }}
-          planner-executable: ${{ vars.PLANNER_EXECUTABLE }}
-          reviewer-provider: ${{ vars.REVIEWER_PROVIDER }}
-          reviewer-model-provider: ${{ vars.REVIEWER_MODEL_PROVIDER }}
-          reviewer-model: ${{ vars.REVIEWER_MODEL }}
-          reviewer-effort: ${{ vars.REVIEWER_EFFORT }}
-          reviewer-executable: ${{ vars.REVIEWER_EXECUTABLE }}
-          tester-provider: ${{ vars.TESTER_PROVIDER }}
-          tester-model-provider: ${{ vars.TESTER_MODEL_PROVIDER }}
-          tester-model: ${{ vars.TESTER_MODEL }}
-          tester-effort: ${{ vars.TESTER_EFFORT }}
-          tester-executable: ${{ vars.TESTER_EXECUTABLE }}
-          project-ids: ${{ vars.PROJECT_IDS }}
-          token: ${{ secrets.PAT }}
-          bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
-          bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
-          bugbot-effort: ${{ vars.BUGBOT_EFFORT || 'smart' }}
-          bugbot-review-drafts: ${{ vars.BUGBOT_REVIEW_DRAFTS || 'false' }}
-          bugbot-trace-rules: ${{ vars.BUGBOT_TRACE_RULES || 'false' }}
-          bugbot-suggested-changes: ${{ vars.BUGBOT_SUGGESTED_CHANGES || 'true' }}
-          bugbot-telemetry: ${{ vars.BUGBOT_TELEMETRY || 'true' }}
-          bugbot-fail-on-unresolved: ${{ vars.BUGBOT_FAIL_ON_UNRESOLVED || 'false' }}
-          bugbot-organization-rules: ${{ vars.BUGBOT_ORGANIZATION_RULES }}
-        env:
-          AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'codex' }}
-          AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          AGENT_MODEL: ${{ vars.AGENT_MODEL }}
-          AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
-          AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
-          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
-          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
-          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
-          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
-          COPILOT_EVIDENCE_TOKEN: ${{ github.token }}
+    with:
+      runs-on: '["self-hosted","codex","Linux"]'
+      issue-managed-branches: 'true'
+      pre-branch-sdd: 'true'
+      ai-ignore-files: build/*,specs/CATALOG.md
+      prepare-source-verification: true
+    secrets:
+      PAT: ${{ secrets.PAT }}
+      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+      CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}

.github/workflows/copilot_pull_request.yml

@@ -48,6 +48,7 @@ jobs:
           issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           issue-managed-branches: true
           pre-branch-sdd: true
+          verification-setup: ${{ vars.VERIFICATION_SETUP || 'false' }}
           ai-ignore-files: build/*,specs/CATALOG.md
           bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
           bugbot-comment-limit: ${{ vars.BUGBOT_COMMENT_LIMIT || '20' }}

.github/workflows/copilot_pull_request_comment.yml

@@ -1,111 +1,32 @@
+# Generated by scripts/generate-native-verification-workflows.cjs
+# Project runtimes: .copilot/verification-prerequisites.json
+# Dependencies: .github/actions/copilot-verification-setup/action.yml
+# https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites
 name: Copilot - Pull Request Comment
-
-on:
+'on':
   pull_request_review_comment:
-    types: [created, edited]
-
+    types:
+      - created
+      - edited
 jobs:
   copilot-pull-requests:
     if: ${{ (vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN) && github.event.pull_request.head.repo.full_name == github.repository }}
-    name: Copilot - Pull Request Comment
-    runs-on: [self-hosted, codex, Linux]
-    timeout-minutes: 120
+    uses: $/.github/workflows/copilot_comment_runtime.yml
     permissions:
       checks: write
       contents: read
-    env:
-      # Preparation covers parser whitespace and mentions; authorization stays in the Action.
-      COPILOT_PREPARE_VERIFICATION: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS != '' && ((contains(github.event.comment.body, '/copilot') && ((contains(github.event.comment.body, 'sync-branch') && !contains(github.event.comment.body, '--dry-run')) || contains(github.event.comment.body, 'implement') || contains(github.event.comment.body, 'fix') || contains(github.event.comment.body, 'remember'))) || (vars.COPILOT_BOT_LOGIN != '' && contains(github.event.comment.body, format('@{0}', vars.COPILOT_BOT_LOGIN)) && !contains(github.event.comment.body, '--dry-run'))) }}
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-
-      - name: Prepare repository pnpm
-        if: env.COPILOT_PREPARE_VERIFICATION == 'true'
-        uses: pnpm/action-setup@v5
-        with:
-          version: 10.12.4
-          standalone: false
-          dest: ${{ runner.temp }}/setup-pnpm-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
-
-      - name: Prepare repository Node
-        if: env.COPILOT_PREPARE_VERIFICATION == 'true'
-        uses: actions/setup-node@v7
-        with:
-          node-version: '24.x'
-
-      - name: Install repository verification dependencies
-        if: env.COPILOT_PREPARE_VERIFICATION == 'true'
-        shell: bash
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - uses: ./
-        with:
-          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
-          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
-          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
-          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
-          issue-managed-branches: true
-          pre-branch-sdd: true
-          ai-ignore-files: build/*,specs/CATALOG.md
-          debug: ${{ vars.DEBUG }}
-          agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
-          agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
-          agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
-          findings-provider: ${{ vars.FINDINGS_PROVIDER }}
-          findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
-          findings-model: ${{ vars.FINDINGS_MODEL }}
-          findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
-          fixer-provider: ${{ vars.FIXER_PROVIDER }}
-          fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
-          fixer-model: ${{ vars.FIXER_MODEL }}
-          fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
-          reviewer-provider: ${{ vars.REVIEWER_PROVIDER }}
-          reviewer-model-provider: ${{ vars.REVIEWER_MODEL_PROVIDER }}
-          reviewer-model: ${{ vars.REVIEWER_MODEL }}
-          reviewer-effort: ${{ vars.REVIEWER_EFFORT }}
-          reviewer-executable: ${{ vars.REVIEWER_EXECUTABLE }}
-          planner-provider: ${{ vars.PLANNER_PROVIDER }}
-          planner-model-provider: ${{ vars.PLANNER_MODEL_PROVIDER }}
-          planner-model: ${{ vars.PLANNER_MODEL }}
-          planner-effort: ${{ vars.PLANNER_EFFORT }}
-          planner-executable: ${{ vars.PLANNER_EXECUTABLE }}
-          tester-provider: ${{ vars.TESTER_PROVIDER }}
-          tester-model-provider: ${{ vars.TESTER_MODEL_PROVIDER }}
-          tester-model: ${{ vars.TESTER_MODEL }}
-          tester-effort: ${{ vars.TESTER_EFFORT }}
-          tester-executable: ${{ vars.TESTER_EXECUTABLE }}
-          project-ids: ${{ vars.PROJECT_IDS }}
-          token: ${{ secrets.PAT }}
-          bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
-          bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
-          bugbot-effort: ${{ vars.BUGBOT_EFFORT || 'smart' }}
-          bugbot-review-drafts: ${{ vars.BUGBOT_REVIEW_DRAFTS || 'false' }}
-          bugbot-trace-rules: ${{ vars.BUGBOT_TRACE_RULES || 'false' }}
-          bugbot-suggested-changes: ${{ vars.BUGBOT_SUGGESTED_CHANGES || 'true' }}
-          bugbot-telemetry: ${{ vars.BUGBOT_TELEMETRY || 'true' }}
-          bugbot-fail-on-unresolved: ${{ vars.BUGBOT_FAIL_ON_UNRESOLVED || 'false' }}
-          bugbot-organization-rules: ${{ vars.BUGBOT_ORGANIZATION_RULES }}
-        env:
-          AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'codex' }}
-          AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          AGENT_MODEL: ${{ vars.AGENT_MODEL }}
-          AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
-          AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
-          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
-          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
-          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
-          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
-          COPILOT_EVIDENCE_TOKEN: ${{ github.token }}
+    with:
+      runs-on: '["self-hosted","codex","Linux"]'
+      issue-managed-branches: 'true'
+      pre-branch-sdd: 'true'
+      ai-ignore-files: build/*,specs/CATALOG.md
+      prepare-source-verification: true
+    secrets:
+      PAT: ${{ secrets.PAT }}
+      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+      CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}

.github/workflows/copilot_pull_request_review_state.yml

@@ -33,6 +33,7 @@ jobs:
           issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           issue-managed-branches: true
           pre-branch-sdd: true
+          verification-setup: ${{ vars.VERIFICATION_SETUP || 'false' }}
           ai-ignore-files: build/*,specs/CATALOG.md
           bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
           bugbot-comment-limit: ${{ vars.BUGBOT_COMMENT_LIMIT || '20' }}