# Workflow authorization and sensitive release artifacts

## When to use
Use this note when a release changes GitHub Actions files or when diagnostics contain real financial, medical, or other private record-level data.

## Workflow-permission preflight
1. Inspect `.github/workflows/*` before freezing the candidate. Look for hard-pinned test counts/names and update them only after the final suite count is known. Prefer semantic test success over count greps when repository policy allows it.
2. Ordinary repository `push`/`admin` metadata does not prove permission to modify workflows.
3. An empty `X-OAuth-Scopes` header is inconclusive for fine-grained tokens.
4. A normal `git push --dry-run` is content-blind and may succeed even though the real push will reject workflow changes.
5. The only reliable preflight is an authorized workflow-file write attempt against the exact repository. Perform it before an exactly-one-commit release is finalized.
6. If GitHub returns `refusing to allow a Personal Access Token to create or update workflow ... without workflow scope`, preserve the local branch/commit and stop. Do not delete the workflow gate, drop regression tests, or rewrite history merely to make publication possible.
7. For resumability, create an owner-only `git bundle`, hash it, and keep both bundle and checksum at mode `0600` outside the repository.

## Test-gate sequencing
- Stabilize with focused tests first.
- Run full backend and frontend suites only after product/test changes are expected to stop.
- Run aggregate repeat gates such as `make verify` alone. Concurrent CPU-heavy scans can cause misleading JavaScript worker/hook timeouts even when the same gate passes in isolation.
- If a final review identifies a narrow defect, add a regression that reproduces the exact dimension (for example provider symbol/currency/exchange identity or authoritative cutoff propagation), rerun affected tests, then rerun broad suites when the fix crosses shared contracts.

## Sensitive evidence split
- Store record-/instrument-level matrices only in an owner-only runtime location (`0600`).
- Keep Git-tracked evidence aggregate: reason classes, safety contracts, acceptance totals, and sanitized implementation notes.
- Scan the staged candidate, including untracked files after staging, for credentials and identifier patterns.
- Never commit provider payloads, account inventory, holdings, real identifiers, private screenshots, or restored database copies.

## Release truthfulness
- A workflow-scope rejection is a real external blocker; report the exact rejected path and required permission without printing the token.
- Production remains untouched until PR CI, merge identity, backup/restore/integrity gates, and exact-main deployment are all proven.