fix(rep60): adopt protected current-revision controller

[litroc]

Human-authored protected rollout replacing automation PR #215. Preserves exact automation head b34770e; pipeline review only, with no local AI review.

[Copilot]

Pull request overview

This PR replaces the prior automation-derived review gate with a protected “current revision” controller, shifting local evidence generation to deterministic (non-AI) checks while adding protected workflows/scripts to bind and re-evaluate exact-head review evidence.

Changes:

• Adds a protected materializer script to re-create and verify bounded exact-revision review inputs from live GitHub state.
• Disables local Copilot/Codex execution in lit-push-ready (no local AI egress), while preserving deterministic workspace safety checks and evidence output.
• Updates the protected Copilot review gate and related workflows to a “current revision” model, including a protected rerun helper and refresh behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/materialize-exact-revision-review.py	New script to materialize and re-verify bounded exact-revision review input (diff + metadata + protected asset bindings).
scripts/lit-push-ready.py	Removes local AI agent execution paths; enforces agents disabled and records deterministic-only evidence.
.lit/push-ready.json	Aligns push-ready policy with remote-only current-revision gate and disables local agents.
.github/workflows/release-bot-exact-head-review.yml	Renames/aligns the protected exact-head review output to “Current revision review” and tightens check-run selection by app identity.
.github/workflows/current-revision-rerun.yml	New protected workflow to re-run the single protected verifier attempt after a neutral PASS exists.
.github/workflows/copilot-review.yml	Reworks the canonical gate to pull_request_target, adds policy verification + bound neutral check publication, and dispatches protected re-evaluation.
.github/workflows/copilot-review-refresh.yml	Updates refresh logic to rerun the protected gate based on review/review-comment events and actor validation.

Suppressed comments (2)

.github/workflows/copilot-review.yml:190

• The reviewer-request POST is no longer race-safe: if another concurrent run requests the Copilot reviewer between the reviewer_is_requested check and the POST, GitHub returns 422 and this step will fail, potentially blocking the PR even though the reviewer is already requested.

          if [ "${marker_exists}" = true ]; then
            echo "Recorded request no longer has a pending or completed exact-head review; requesting again."
          fi
          gh api --method POST "${requested_reviewers_url}" -f "reviewers[]=${reviewer}"
          if [ "${marker_exists}" = false ]; then

.github/workflows/copilot-review.yml:42

• The request-current-revision-review job is restricted to PRs authored and actioned by litroc, but the downstream verification job still requires a successful Copilot review for all non-trusted, non-release-bot PRs. For PRs from any other author, this can lead to a 10-minute polling loop and eventual failure unless a maintainer manually requests the Copilot review.

    if: >-
      github.event_name == 'pull_request_target' &&
      (github.event.action == 'opened' ||
        github.event.action == 'ready_for_review') &&
      github.event.pull_request.draft == false &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      github.event.pull_request.user.login == 'litroc' &&
      github.actor == 'litroc' &&
      github.triggering_actor == 'litroc'

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.