[ShutenOishi]

Issue #75 — Deploy already-protected central build PR #234 Grype Critical/High/Unknown fail-closed risk classification and PR #235 read-only next Windows tag proposal as ONE atomic version update of existing shared signed-candidate read-only workflow. Central required CI and real main/push validated: build/main 304cd5d473b5b48e56d7988b55630e46d767f6d0. This is an immutable SHA-only caller change (plpgsql_check also updates exactly matching SHA regression). Original previous 17/17 #233 caller Windows postmerge accepted and NOT rerun. Existing policies and signing attestations unchanged. No automatic Publisher authorization, Tag or Release, no new App/Secret/GUI; PUBLISH_DENY and GO B/G4/G5 NO_GO preserved. Require App15368 real PG14–18 5/5, resolver, Windows required summary and normal protected merge + real postmerge.

[ShutenOishi]

Status checkpoint: blocked operation is NOT GitHub CI (2026-10-23 JST)

I verified original PR #46 remains OPEN, current HEAD 8028bc9eb5dc4caa091a9e1f1fada61a2b7b1e98; its original PR Run39910351159 is pull_request completed/success with GitHub Actions App15368 exact-head PG14–18 Windows 5/5, resolver and required summary success. GitHub reports mergeable, but an earlier actual merge action was rejected by the external assistant/tool safety check. There is no visible PR comment/review giving the specific external denial reason. No second merge attempt, alternative identity/route, branch-protection relaxation, or equivalent replacement was made. This original read-only signed-verifier SHA pin remains unmerged and NOT ACCEPTED.

Independent, separate-file formal Publisher guard PR #47 DID legitimately protected merge. Exact original main/push Run39929642056 + App15368 PG14–18/resolver/summary completed/success, main SHA ad3b897a9e4a6b1e9e0aa8d8cbba1f8b29b108b9. This completes 17/17 formal Publisher guard, but does not include or resolve the original #46 update-watch.yml change.

To resolve this PR, first establish a legitimately permitted operation under the original safety restriction and unchanged branch protection (the precise previous tool denial reason is currently unavailable), then recheck exact-head required CI and perform only an authorized normal protected merge followed by original event=push postmerge acceptance. Do not label as merged or closed on the basis of #47 or static SHA similarity. See centralized Issue #75 checkpoint.

[ShutenOishi]

Superseded without retrying this formerly safety-rejected stale one-line merge. The separate current-main two-file policy/caller cutover was subject to its own original App15368 PG14–18/required CI and protected merge as #58, main c157b24855ee7451feb20f6721cdfe130015e665. Preserving #46 as historical evidence; closing it to prevent accidental stale-caller merging. This does not assert or override a reason for the former external safety rejection.