[criptogus]

Summary

An administrator could pass the approval UI while the package remained a draft. The write used a service client that did not retain the administrator identity required by the publication trigger; an HTTP error response could also reach the success callback.

verified administrator
  unchanged adversarial gate for current version
  write with caller JWT + evaluated-version condition
  require returned version/status/publication/reviewer
  report success only for a confirmed saved decision

Keep RLS, roles and database triggers unchanged. Release the correction as platform0.6.5; the qualified skill archives remain0.1.4 with unchanged hashes.

Evidence

• Before: the authenticated approval dialog closed, but native readback still showed draft/unpublished and no reviewer.
  After: four actual Supabase HTTP transport regressions pass: caller JWT/version filters, trigger/RLS denial, missing row, and mismatched version/reviewer/status/publication flags.
• Project batch10/10 passed with226 Node tests, types, strict lint, audit, build and generated-artifact checks; final changelog metadata is checked again by CI.
• Jev advisory code review retained with actual model/probabilities; no authority delegated to the advisory model.

Merge Danger

Door: two-way

Blast Radius: reviews

Writes now use the existing admin-authorized RLS path and require a confirmed saved row. Approval thresholds and publication triggers are preserved. No Lovable generation calls.