Reject conflicting tag and branch names across resolution and parity paths. Preserve custom-checkout safety in parallel groups, report remote container image warnings without changing JSON or exits, and refresh the generated documentation link and release compatibility notes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Reject erased dependency edges in default, --no-fix and --no-onboard runs, not only --verify. Explicit refresh still reconstructs the graph; offline verification remains structural. Extend no-write and inspection-failure regressions across online modes and make immutable lookup budgets explicit.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fix #166 diagnostics without changing corruption recovery or the exit-code contract. Preserve validation causes and never classify an I/O failure as recoverable invalid content.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…wing

Expose --keep-sha for repositories retaining SHA-pinned YAML. Keep reachability validation and symbolic metadata intact on fresh, sticky, and shared-action paths; clarify --no-narrow already preserves SHAs as well as semver precision.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…ction

Clarify #111/#123/#138 diagnostics and the migration opt-out contract. Keep fail-closed coverage behavior rather than pretending runtime-dependent workspace code was inspected.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Run the integrated CLI against the updated CI graph; selected commit pins and dependency edges are unchanged.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Verify a repository through the API without cloning or writing anything.
Accepts -R/--repo, --ref, a positional OWNER/REPO[@ref], and tree, release
and commit URLs. Defaults to the default branch. Emits a non-blocking
repo-renamed finding when the target was renamed or transferred.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…ckfile, reusable workflow expansion, SSO fallback

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Harden the locally integrated community #180 implementation: require immutable commit responses, preserve snapshot origin/ref across redirects, reject truncated inventories and target ambiguity, inspect discovered reusable callees, and prove read-only failure behavior.

Address #179 using the reusable-workflow parsing distinction highlighted by jay23606 in #161, without claiming caller lockfile enforcement the runner does not implement. Mutable job calls fail with direct full-SHA guidance; SHA calls expose the unverified callee graph. Preserve job refs during action narrowing.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Reuse the successful checkout resolver fixture for renamed repositories so the required real-binary scenario proves both online graph inspection and the non-blocking rename warning.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Reject young or undatable direct and transitive candidates before any write, including explicit refresh and no-narrow paths. Keep approved targets sticky and use commit committer dates plus available release publication dates without selecting an alternate graph.

Add deterministic command no-write/sticky controls, timestamp boundary and cache tests, and document timestamp limitations. Fixes #132.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add --cooldown-days with explicit presence handling and reject negatives before doing work. Positive values replace the selected policy's global default while retaining its per-repo overrides; explicit zero disables all cooldowns for the run.

Document precedence and cover config/flag conflicts and disable behavior through deterministic command tests. Fixes #134.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Prove keep-sha cannot bypass either commit-age or release-age checks. Include reusable-call findings, release-cooldown failures and explicit overrides in the existing pre-publication Dependabot review boundary.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Windows WalkDir uses native separators while command fixture paths and lockfile keys use slashes. Normalize the shared snapshot helper and assert key existence so missing files cannot become empty-string comparisons. No CLI behavior change.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

State the lock metadata guarantees precisely, describe online graph checks consistently, and retire the completed remote verification plan.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Report non-blocking local-action coverage notices in locking and verification. Never inspect, rewrite, or lock workspace-relative action dependencies; keep independent remote and self-repository coverage checks. Retire checkout migration guards, their helpers, and obsolete migration fixtures.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Keep the required self-repository binary checks aligned with the non-overclaiming offline success message, including the live offline-verification scenarios.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Cover new major/minor refs, exact and prerelease aliases, absent or unrelated tags, lookup failure, recorded precision, owner context and composite declarations with and without SHA preservation. Keep previously recorded partial refs sticky and verify/no-fix read-only. No product behavior change.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Supply immutable action manifests for the newly merged parallel-step command test and register branch normalization lookup exactly once.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Block exact-tag pins on API failures in every online mode, including refreshes. Keep the inconclusive category, identify the entry, and preserve retry semantics under the Dependabot proxy.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>