[efraespada]

Approval observers now read head and verified-merge Check Run evidence with the job-local GitHub Actions token when available, avoiding 403 failures from fine-grained bot PATs that cannot access the Checks API. Bot identity, policy reads, PR data, and review writes retain their existing credential, and denied evidence remains non-authorizing.

What changed

• Use the job-local Checks client for head and verified-merge check pagination, while preserving the PAT for identity, policy, PR data, and review writes.
• Keep failed, malformed, and oversized Checks reads fail-closed without retrying with the PAT; existing pagination and evidence provenance checks remain in place.
• Update the approval specification, catalog, and operator guide to document the credential split and fine-grained PAT limitation.
• Regenerate the GitHub Action and CLI bundles.

Validation

• Five SDK regression cases failed against the previous client selection and passed with the fix; all 137 repository-adapter cases pass.
• Full coverage: 710 suites, 11,890 tests passed, and 35 existing skips; global coverage and specialized budgets pass, with 90.82% branch coverage in the changed adapter.
• Typecheck, lint, specification/catalog, documentation/workflow/agent contracts, npm package validation, and package smoke pass; Graphify was updated with AST analysis.

Review notes

• Live acceptance remains pending: publish the corrected Action and recheck the private Platform observer. Local SDK fixtures verify client selection and fail-closed behavior, not production recovery.

Closes #670

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~671

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on 4b6db3d.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 4b6db3d685db; base: 3aa18a92b0c8; reason: protected-path.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.13%. Comparing base (274db40) to head (4b6db3d).
⚠️ Report is 1629 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #671      +/-   ##
===========================================
+ Coverage    90.94%   94.13%   +3.19%     
===========================================
  Files          135      974     +839     
  Lines         6251    31637   +25386     
  Branches      1338     9290    +7952     
===========================================
+ Hits          5685    29782   +24097     
- Misses         172      715     +543     
- Partials       394     1140     +746     

Files with missing lines	Coverage Δ
...y/pull_request/pull_request_approval_repository.ts	90.00% <100.00%> (ø)

... and 1040 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.