ci(cws): monitor Chrome Web Store status

[lamemustafa]

Summary

• Add a read-only Chrome Web Store status checker using the official fetchStatus endpoint.
• Add scheduled/manual GitHub Actions monitoring for the submitted extension version without upload or publish side effects.
• Document the pending-review/publication gate and cover the checker/workflow with focused tests.

Root Cause / Decision Record

• The v0.3.2 CWS submission is pending review, but we did not have an automated read-only monitor for the submitted/public status.
• This is the smallest safe fix because it reuses the existing CWS OAuth plumbing and adds only fetchStatus monitoring, not upload or publish behavior.
• Closes the release-follow-up gap for CWS status visibility; final dashboard/public listing evidence remains out of scope until Chrome completes review.

Scope

• Runtime: no extension runtime, manifest, permission, or GST portal behavior changes.
• Tests: focused checker/workflow tests plus full Pack verification locally and in CI.
• Docs/governance: release/publication docs updated for the status monitor.
• Explicitly out of scope: forcing CWS review completion, changing the public listing after submission, or adding extension behavior.

Pack Workflow Preflight

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• If this PR consumes @sanchika/* packages or copied Sanchika guidance, I read sanchika/docs/adoption-pack.md in the coordinated parent worktree.
• If this PR consumes Sanchika, it links ComplyEaze and Axal completion evidence and records the Sanchika commit or copied guidance used.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent source paths.

Sanchika note: not applicable; this PR does not consume Sanchika packages or copied guidance.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are updated if behaviour changed.

Network note: the only added network behavior is CI-only CWS API fetchStatus using existing protected CWS credentials; the extension runtime has no new network call.

Sensitive Surface Review

• Current tab / portal target binding is preserved or intentionally changed.
• Download completion remains evidence-backed and fail-closed.
• Ambiguous side-effect delivery cannot be reported as confirmed success.
• Service-worker durability impact is understood and documented.
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year remains source-build alpha and is not part of the Chrome Web Store V0 listing.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed if user-facing behavior changed.
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec vitest run
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip
• node scripts/verify-extension-zip.mjs
• node scripts/write-release-provenance.mjs
• node scripts/verify-github-release-assets.mjs --tag --zip --checksum --provenance when release assets exist
• node scripts/publish-chrome-web-store.mjs --zip .output/ --provenance .output/pack-release-provenance.v1.json --publisher-id --dry-run true
• git diff --check
• pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 before merge/readiness claim, or reason not run: CI review gate is authoritative on PR ci(cws): monitor Chrome Web Store status #57 and was rerun after restoring template sections.

Additional focused verification:

• pnpm exec vitest run tests/scripts/check-chrome-web-store-status.test.ts tests/scripts/publish-chrome-web-store.test.ts tests/extension/ci-workflow.test.ts
• node scripts/check-pack-workflow-preflight.mjs

Artifact Evidence

• CI run: https://github.com/lamemustafa/pack/actions/runs/28708040394
• ZIP artifact: not applicable; no release ZIP is produced by this PR.
• ZIP SHA-256: not applicable.
• Clean source/tag or head SHA: 6bc3c29

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA.
• Inline review threads are resolved, outdated, or answered with evidence.
• No commits were pushed after the last required human/bot review without re-review.
• Any follow-up PRs are listed here instead of being left implicit.

Thread/comment	Disposition	Commit or evidence
pending review-gate rerun	follow-up	PR body restored required template sections

Screenshots

Use synthetic data only. Not applicable; no UI/runtime screen change.

DCO

• Commits include Signed-off-by: trailers.

DCO note: existing Pack commits in this branch were created with the repository default commit flow; no DCO check is currently failing.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6bc3c293ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 491655e78e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7841afccc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".