Release with one approval per Ship run

[shiny-code-app]

Objective

One human approval per Context Panel release, not one per job.

Why

On 2026-10-03, Ship run 37124932609 asked Chris for the release environment approval twice: once for Validate Release Intent (ship.yml), then again for the channel jobs (release.yml "Build macOS App" and app-store-connect-upload.yml "Upload Mac App"), because GitHub requires environment approval per job and the channel jobs reach the gate only after the intent job passes. Chris: "I thought we had one click release." No earlier decision makes release a single approval; Ship is one dispatch, but the approval count grows with the channels. Seven workflows attach environment: release today.

Owner decision

Chris, 2026-10-03, typed in the direction session codex-skills-d2, recorded by it: yes, make it a single approval.

Finish Line

• The Director's required review sits on exactly one job per Ship run (the release-intent gate).
• Channel jobs that need signing or upload secrets use a separate environment with no required reviewer, restricted to the protected main branch, and run only after the approved intent job (job dependency), so the secrets stay reachable only through an approved Ship run.
• Standalone channel workflows that can be dispatched directly (TestFlight, App Store review submission, screenshots, companion upload) keep a required review, or are reachable only through Ship; say which on the PR.
• Executed tests or a dry-run proof show one approval prompt for a full Ship run.
• The release doc says how many approvals a release takes and why.

Hand step for Chris (posted by the implementing session when ready)

Creating the new environment, its branch rule and moving the channel secrets into it is an access change, so it is Chris's by hand, with exact clicks; the agent never copies or reads secret values.

Current Status

State: Complete. Source merged and Chris completed the environment-role hand setup; fresh read-only live checks and all-channel structural dry-run satisfy the finish line.
Merged: #751 at 5af6bb8, correcting merged #748 under Owner decision 5969947705.
Owner completion: #747 (comment). Existing release secrets stayed untouched; release-channels never existed. RELEASE_APPROVALS_CONFIGURED=true is owner-confirmed, not independently read by this bot.
Live evidence: Landed scripts/check-release-approval-environment.py full mode exited 0: required owner review verified. --probe exited 0: secret-store protection metadata verified. Additional GET-only metadata assertions verified release has no required reviewer and neither environment has a nonzero wait timer. release-approval requires exactly cbusillo (User), allows solo self-review, disables administrator bypass; both use protected-branches-only and the checker verified main is the sole protected branch. No secret endpoint or secret value was read.
Dry-run evidence: Landed scripts/check-release-approvals.py exited 0 at exact merge 5af6bb8. Ship has one reviewed approve job for all four channels, zero gate secret references, and release as the sole secret environment. Each of six standalone workflows has one reviewed approve gate. Docs explain that count. This is the finish line's permitted structural dry-run, not an observed release prompt.
Engineering evidence: 4/4 PR checks and exact landing CI/CodeQL green; commit gate passed with 1,203 Swift tests, focused release suite 118 passed, final approval fixtures/fast Python gate/actionlint passed. Exact 15-file PyCharm inspection GREEN, zero findings. Five independent Anthropic review dispositions recorded on #751; final approval implementation matches reviewed source. Four pre-existing Markdown MD013 findings reproduced on base.
Residuals: No live release dispatched or prompt exercised. The next separately authorized release will execute the activation-variable guard. Secret inventory is owner-confirmed. The documented optional ad-hoc signing mode remains. Historical-rerun exposure was accepted in switch-now Owner decision 5970898082; no 30-day wait remains. Computed future environment names remain separate #750; #749 and #736 were not started here. Sanitized secret scanning unavailable, not clean; no open CodeQL alerts observed during engineering closeout.
Next action: None required to complete #747. Future releases remain separately authorized; this worker must not dispatch or rerun one.
Blocked by: None.
Cleanup: Own implementation worktree/branches and task scratch removed; no transient job remains. One unowned SDK preserved. Clean primary main deliberately remains stale under no-primary-edit authority; fast-forward before future default-branch work/audits. Installed runtime, the 1.0.69 release session/run/worktree and other worktrees untouched.
Admission: direction#16 spare-capacity engineering rule recorded in claim 5970387065; claim released.
Last verified: 2026-10-03, fresh GET-only probe after Owner completion.

[shiny-code-app]

Claimed by CP-747-D1

Session: 01a101ee-2cce-7e23-b53e-a656b5c246e1
Branch: work/747-single-release-approval
Claimed at: 2026-10-03T09:23:51-04:00
Next action: Implement single Ship intent approval; admitted under direction#16: every milestone waits on people and provider capacity would otherwise go unused, per the overnight brief. Preserve the active 1.0.69 release and require another-model review before merge.

Previous Current Status:

[shiny-code-app]

SUPERSEDED — do not follow these instructions. Owner decision 5969947705 requires each secret in exactly one place. #748 had already merged; the correction landed in #751. Existing release holds all secret values; secretless release-approval carries the required review. Do not populate release-channels or enable RELEASE_CHANNELS_CONFIGURED. Follow the revised hand step, which moves environment roles without re-entering existing secrets. Chris has now confirmed completion.

Obsolete instructions retained as history

Owner question: Will you complete the release-channels setup after the active 1.0.69 Ship run and any standalone release jobs finish? Recommendation: yes. This supplies channel credentials without a second review, while release keeps your required review for Ship intent and direct dispatches. The overall direction stop boundary is:

• granting or removing anyone's access

Exact clicks in Context Panel environment settings:

1. Click New environment, enter release-channels, click Configure environment. Leave Required reviewers unchecked and Wait timer off. Leave existing release protection unchanged.
2. Under Deployment branches and tags, select Selected branches and tags. Click Add deployment branch or tag rule, select Branch, enter main, save. Do not add tags or other branches; keep main protected.
3. Under Environment secrets, click Add environment secret for each channel secret below that is used by your enabled channels. Enter the value yourself from its original private source and click Add secret. Existing GitHub secret values cannot be revealed. I will never read or copy a value. Keep matching environment secrets in release because standalone workflows still need them and intent preflight needs the ASC credentials.
4. Once both environments are populated, open Settings → Secrets and variables → Actions → Repository secrets. Remove repository-level duplicates of these channel credentials if present, using their Delete buttons and confirmation. Do not remove unrelated automation secrets or change credentials used by the active release. If an original source is unavailable, stop and tell me which name; do not rotate it to complete this step.
5. Reply here from cbusillo confirming release-channels has no reviewer/wait timer, only Branch main, the enabled-channel secret names are populated in both environments, and repository-level duplicates are removed. Share names only, never values. Do not dispatch a release for this task.

Channel secret names referenced by the current workflows (add only applicable optional signing/notarization alternatives):

• Shared: APPLE_TEAM_ID, APP_STORE_CONNECT_KEY_ID, APP_STORE_CONNECT_ISSUER_ID, APP_STORE_CONNECT_API_KEY_P8_BASE64, CONTEXT_PANEL_CLOUDKIT_SCHEMA_RECEIPT_KEY, MACOS_KEYCHAIN_PASSWORD.
• GitHub packaging/notarization: MACOS_CERTIFICATE_P12, MACOS_CERTIFICATE_PASSWORD, MACOS_APP_PROVISIONING_PROFILE_BASE64, MACOS_WIDGET_PROVISIONING_PROFILE_BASE64, MACOS_REFRESH_AGENT_PROVISIONING_PROFILE_BASE64, APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, APPLE_NOTARY_KEYCHAIN_PROFILE.
• App Store signing: MACOS_APP_STORE_DISTRIBUTION_CERTIFICATE_P12, MACOS_APP_STORE_INSTALLER_CERTIFICATE_P12, MACOS_APP_STORE_CERTIFICATE_PASSWORD, MACOS_APP_STORE_APP_PROVISIONING_PROFILE_BASE64, MACOS_APP_STORE_WIDGET_PROVISIONING_PROFILE_BASE64, MACOS_APP_STORE_REFRESH_AGENT_PROVISIONING_PROFILE_BASE64.
• Companions: COMPANION_APP_STORE_APP_PROVISIONING_PROFILE_BASE64, COMPANION_APP_STORE_WIDGET_PROVISIONING_PROFILE_BASE64, COMPANION_APP_STORE_WATCH_PROVISIONING_PROFILE_BASE64, COMPANION_APP_STORE_WATCH_WIDGET_PROVISIONING_PROFILE_BASE64, COMPANION_APP_STORE_TV_PROVISIONING_PROFILE_BASE64, COMPANION_APP_STORE_TV_TOP_SHELF_PROVISIONING_PROFILE_BASE64.

Read-only preflight verified release currently requires your review and protected branches; release-channels does not exist. Secret-name inventory APIs returned 403 for the configured bot, so existing secret placement is unverified; this list comes from workflow references, not secret reads. Creating this environment and placing credentials is your hand step, not agent work. Implementation and review can continue while it waits. Trial CP-747-D1; the 1.0.69 run/worktree remains untouched.

[shiny-code-app]

SUPERSEDED — do not follow these instructions. Owner decision 5969947705 requires each secret in exactly one place. #748 had already merged; the correction landed in #751. Existing release holds all secret values; secretless release-approval carries the required review. Do not populate release-channels or enable RELEASE_CHANNELS_CONFIGURED. Follow the revised hand step, which moves environment roles without re-entering existing secrets. Chris has now confirmed completion.

Obsolete instructions retained as history

Owner question: After completing the environment/secret setup above, will you enable the one-approval route? Recommendation: yes, once the 1.0.69 run is finished and setup is complete. The applicable stop boundary is still:

• granting or removing anyone's access

One final click sequence: Settings → Secrets and variables → Actions → Variables → New repository variable. Name: RELEASE_CHANNELS_CONFIGURED. Value: true. Click Add variable. If the variable already exists, use its edit pencil, set true, and save. Then confirm setup here from cbusillo, with names only.

Until that variable is exactly true, the implementation retains the current reviewed release environment for every channel. This allows the code to merge safely before your hand step and prevents automatic creation of an unconfigured channel environment. Removing the variable restores per-channel review without deleting credentials. No release dispatch is needed or authorized for this trial.

[shiny-code-app]

Owner decision (Chris, 2026-10-03 14:09Z, typed in the direction session codex-skills-d2, recorded by it), on the release-channels setup question: yes to redesigning so each secret lives in exactly one place. The current setup would have Chris re-enter about ten secrets into release-channels and keep duplicates in release, so every rotation happens twice. Instead: the Director's required review sits on a gate job that holds no secrets; jobs that need signing, notarization, App Store Connect or CloudKit-receipt secrets read them from a single environment, in Ship and in the standalone channel workflows alike (each standalone workflow gets its own reviewed gate job). Minimize Chris's hand step: if it can be done by moving environment roles (for example adding required reviewers to a new gate environment and removing them from release) without re-entering any secret, prefer that, and say exactly which. Post the revised hand step on this issue when PR #748 is ready. The stop boundary is unchanged: "granting or removing anyone's access"; the agent never reads or copies a secret value.

[shiny-code-app]

SUPERSEDED — do not follow these instructions. Owner decision 5969947705 requires each secret in exactly one place. #748 had already merged; the correction landed in #751. Existing release holds all secret values; secretless release-approval carries the required review. Do not populate release-channels or enable RELEASE_CHANNELS_CONFIGURED. Follow the revised hand step, which moves environment roles without re-entering existing secrets. Chris has now confirmed completion.

Obsolete instructions retained as history

Owner question: Will you complete the posted environment setup and then activate it after the 1.0.69 run finishes? Recommendation remains yes; this changes a fully configured Ship run to one approval while leaving direct dispatches reviewed. The stop boundary remains:

• granting or removing anyone's access

Clarification to step 3 of the exact clicks above: populate both release and release-channels if a needed secret currently exists only at repository level. Keep existing environment entries. Only remove repository-level copies after both environments are populated. The PR's uv run scripts/check-release-approvals.py output lists the 26 referenced names for each environment, never values; compare those names during setup. The final variable click is posted here. Do not set it early, and do not rotate or disclose any value. No release dispatch is requested.

[shiny-code-app]

Released claim 5969589108

CP-747-D1 engineering is merged in #748 at efa2f1a; PR and landing CI are green. The issue stays open/plan:waiting for Chris's exact environment/secret/activation hand step. No release or access change was performed. Existing inspection and computed-name follow-ups are recorded without starting. The worker is finishing only its own SDK-aware cleanup and will post the final disposition.

[shiny-code-app]

CP-747-D1 final handoff: engineering is merged in #748 at efa2f1a, with 4/4 PR checks and both landing CI/CodeQL green, final 12-file inspection GREEN, and three Anthropic claude-opus-5-5 reviews weighed and recorded. In flight: none. Exact next action: Chris completes the posted environment/secret/branch-rule/activation clicks and confirms here from cbusillo; until activation, channel review remains. Live single-prompt proof belongs to a later authorized release; this trial dispatched none. The overnight brief authorized bot implementation, normal merge after green CI and other-model review, and own-worktree closeout; its granting/removing-access stop boundary kept all secret placement with Chris. Claim 5969589108 is released; the task worktree and branch are removed, one unowned SDK is preserved, primary main remains clean/stale under the no-primary-edit boundary, and the 1.0.69 session/run/worktree and installed Production runtime are untouched. Unstarted follow-ups are #749/#750; #736 owns the observed watchdog race. Current Status and plan:waiting are current. Safe to exit: yes.

[shiny-code-app]

Claimed by CP-747-D1

Session: 01a101ee-2cce-7e23-b53e-a656b5c246e1
Branch: work/747-single-secret-store
Claimed at: 2026-10-03T11:04:21-04:00
Next action: Implement secretless reviewed gates and one release secret environment under Owner decision 5969947705. Admission: direction#16 allows engineering when every milestone waits on people and provider capacity would otherwise go unused. Preserve 1.0.69 release session/run/worktree; require another-provider review.

Wait resolution: Owner decision 5969947705 authorizes single-store redesign; Supervisor directs this session to revise the merged design. Prior claim 5969589108 is released and its worktree removed.

Previous Current Status:

State: Waiting for Chris's hand setup; engineering landed; this worker has completed closeout.
Trial: CP-747-D1.
Merged: PR #748, normal merge commit efa2f1a.
Checks: Current-head PR CI 4/4 passed. Landing CI and CodeQL passed. Full local commit gate passed with 1,203 Swift tests; focused release tests and structural lint ran, with the known real-time test race recorded in #736 and its isolated rerun passing. Final exact-worktree inspection GREEN for 12 new/revised files, cleanup complete. Three read-only Anthropic claude-opus-5-5 reviews are recorded on the PR; current findings were fixed, bounded residuals/dispositions recorded.
Remaining: Chris creates release-channels with no reviewer/wait timer and Branch main only, populates both environments, removes repository-level channel duplicates, and sets RELEASE_CHANNELS_CONFIGURED=true only after setup and the 1.0.69 run finish. Exact clicks and names, activation click, both-environment clarification.
Next action: Chris performs those clicks and replies here from cbusillo with names/configuration only; do not disclose secret values. Until activation, channels retain reviewed release. Live single-prompt proof belongs to a later separately authorized release; this trial dispatches none.
Security/read limits: No open CodeQL alerts observed. Sanitized secret-scanning status is unavailable for the public repository, not clean. Secret-name and activation-variable inventory APIs returned 403 to the bot; owner setup is unverified. No value was read or copied.
Follow-ups: #749 (191 existing test-file inspection warnings) and #750 (computed environment names in a future trusted-main workflow), both recorded without starting and outside a milestone. #736 already owns the watchdog race.
Preservation: Installed Production app, active 1.0.69 release session 01a0f4db, its run/worktree and all other worktrees remain untouched. The clean primary main checkout is deliberately preserved under the no-primary-edit brief; it remains at the prior docs merge, so fast-forward it before later default-branch work/audits. The remote landing is confirmed independently.
Admission: direction#16 permits engineering when every milestone waits on people and provider capacity would otherwise go unused, as recorded in the claim. No repository DIRECTION.md exists; cbusillo/direction applies.
Cleanup: Task worktree removed non-force through the SDK-aware helper. Local branch deleted; remote branch absence verified. One not_helper_owned SDK was preserved without manual SDK edits. Generated build, venv and IDE scratch was disposed with the task worktree. Primary and other worktrees remain in place. No transient job remains. A wrong-target status update to closed codex-skills PR 747 was restored and read-back verified. The default-output observation and supported JSON route are recorded on codex-skills issue 835.
Last verified: 2026-10-03.

[shiny-code-app]

The recorded Owner decision supersedes my earlier duplicate-secret instructions and activation question. Do not populate release-channels or set RELEASE_CHANNELS_CONFIGURED. #748 is already merged, so this session is implementing the authorized correction in a focused follow-up PR: a secretless reviewed gate environment, with every secret-using job reading the existing release environment. I will post the replacement role-move clicks after review. No secret value or active release has been touched.

[shiny-code-app]

Owner question: Should the reviewer-role move wait until pre-redesign release runs are outside GitHub's 30-day rerun window? Recommendation: yes, preserving their logs and validation evidence; during that wait, the new gate plus the still-reviewed release environment supports releases with extra prompts. An earlier move instead needs your recorded choice to retire old reruns after preserving evidence, or explicitly accept their bounded no-prompt exposure. The single-store redesign itself is already decided; this question is only the migration treatment raised by the independent review.

The exact overall stop boundary is:

• granting or removing anyone's access

The finding and decision surface are direction#24. Please record the choice here from cbusillo, or through an Owner decision recorded by the direction session. #751 can land with final activation unset; source work continues while this waits. I will post its reviewed replacement clicks here. I will not delete runs, change environment rules, dispatch a release, or read/copy any secret value. The 1.0.69 session/run/worktree stays untouched.