[efraespada]

Closes #770.

Bugbot can reject valid GitHub.com $/path bootstrap actions and suggest weakening an independent remote version-tag policy. Review and benchmark now share host/version-aware resolution guidance, exact prefix and validator-scope checks, and line counting. Verified suffix, missing-checkout and unsupported-host defects remain reportable; Action reference/step fixes use prose suggestions to avoid unsafe YAML replacements.

Adds seven paired corpus controls (90 total), 17 distinct deterministic regressions, updated SDD/catalog and detection/recovery/quality documentation, and regenerated bundles. Prior 83 inputs/verdicts, default quality gates, coverage budgets and the original 15,000-character prompt limit are unchanged.

Actual product-runtime evidence is retained in quality/bugbot/evidence/issue-770.json: four failed intermediate observations and a final seven-case openai/gpt-6-luna medium sample passing every default threshold, with zero false positives/negatives and exact location/severity/category. The final sample uses an empty Git workspace; earlier samples ran from the development repository, so these observations do not establish statistical improvement or isolate prompt effects. Consumer source and a matching successful job were inspected, not rerun.

Validation: 140 focused tests, reference evaluator, typecheck/lint, specification/documentation/workflow checks, build consistency, package validation and smoke tests pass. Full coverage: 773 suites, 14,219 passed, 35 skipped; lines 98.03%, statements 97.24%, functions 97.92%, branches 94.93%; every module budget passes. Changed prompt module: 100% lines/statements/functions/branches. Extension: 267 tests and 100% coverage. Mandatory commit hooks passed build, all 773 suites / 14,219 tests, and lint. Merge requires exact-head CI/platform success and complete review with zero unresolved findings.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~781

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on 12811a3.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 12811a392639; base: 42c66f148e05; reason: protected-path.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.80%. Comparing base (5b3664f) to head (12811a3).
⚠️ Report is 57 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #781      +/-   ##
===========================================
+ Coverage    94.50%   94.80%   +0.30%     
===========================================
  Files         1035     1078      +43     
  Lines        33299    34865    +1566     
  Branches      9824    10357     +533     
===========================================
+ Hits         31468    33054    +1586     
+ Misses         699      682      -17     
+ Partials      1132     1129       -3     

Files with missing lines	Coverage Δ
src/prompts/bugbot.ts	100.00% <100.00%> (ø)

... and 54 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.