From 737d02090446722e172f45ce6394a63d3b080098 Mon Sep 17 00:00:00 2001
From: Omry Yadan <omry@yadan.net>
Date: Sun, 1 Nov 2026 17:38:45 +0800
Subject: [PATCH] [node-maintenance-repair/8.3] Publish the validated
 cumulative report with an exact branch lease

Publish the exact original prepared two-file candidate only after separate validation succeeds. Verify its native producer Check seal, immutable preparation artifact and cumulative history, then recheck canonical consent and push with an exact expected-head lease.

Bound the post-push reread of an exact previous PR view without retrying the push; stop immediately on unexpected PR identity, branch or content changes.

Retain original preparation locators in the native repair commit. Use only sealed cumulative package evidence for the PR report, preserve the existing LF/CRLF platform section, and bind new choices to the published head. Report uncertain pushes and push-success/body-edit-failure truthfully without retries or overwriting a changed PR.

The writer runs no project scripts, package-manager commands or fresh audit and consumes no validation artifacts. Normal-audit preservation and full live repair acceptance remain slice9; no source merge, Hydra change or service deployment is included.

Validation: 1,620 Python tests, Ruff lint/format, Pyrefly and Bash syntax passed. Real pnpm11.20.0/11.21.0 hook and separate-validation checks passed on unchanged preparation/validation paths. Fresh independent review and its reproduced report-boundary regression are clean. Complete production growth is357/600 lines without exclusions. Exact-head PR review, CI and hosted publication acceptance follow.
---
 .github/workflows/node-repair.yml   |  32 +-
 docs/node-maintenance-operator.md   |  45 ++-
 node/repair/action.yml              |  32 +-
 node/runtime/repair.py              | 293 ++++++++++++++-
 node/tests/test_selected_repairs.py | 536 +++++++++++++++++++++++++++-
 repair-app/pilot/README.md          |  47 ++-
 6 files changed, 945 insertions(+), 40 deletions(-)

diff --git a/.github/workflows/node-repair.yml b/.github/workflows/node-repair.yml
index 974a69f..76f5a37 100644
--- a/.github/workflows/node-repair.yml
+++ b/.github/workflows/node-repair.yml
@@ -19,7 +19,7 @@ name: Validate selected Node repairs
         required: true
     outputs:
       candidate-artifact-id:
-        description: Immutable preparation artifact ID in this run; validation never replaces it. No publication occurred.
+        description: Immutable preparation artifact ID in this run; validation and publication never replace it.
         value: ${{ jobs.prepare.outputs.candidate-artifact-id }}
 permissions:
   contents: read
@@ -102,3 +102,33 @@ jobs:
         set -euo pipefail
         [[ "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ && "$ARCHIVE_SHA256" =~ ^[a-f0-9]{64}$ && "$CONTENT_SHA256" =~ ^[a-f0-9]{64}$ ]]
         printf '::notice title=Node repair evidence v1::v1:%s:%s:%s\n' "$ARTIFACT_ID" "$ARCHIVE_SHA256" "$CONTENT_SHA256"
+  publish:
+    needs: [prepare, validate]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: node-dependency-proposal-${{ github.repository }}
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: read
+      checks: read
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        ref: ${{ inputs.expected-head }}
+        persist-credentials: false
+        fetch-depth: 0
+    - name: Publish the validated sealed candidate
+      env:
+        TRUSTED_WORKFLOW_SHA: ${{ job.workflow_sha }}
+      uses: $/node/repair
+      with:
+        operation: publish
+        candidate-artifact-id: ${{ needs.prepare.outputs.candidate-artifact-id }}
+        request-id: ${{ inputs.request-id }}
+        pull-request: ${{ inputs.pull-request }}
+        expected-head: ${{ inputs.expected-head }}
+        expected-base: ${{ inputs.expected-base }}
+        selections: ${{ inputs.selections }}
diff --git a/docs/node-maintenance-operator.md b/docs/node-maintenance-operator.md
index ac5d671..64b0b2e 100644
--- a/docs/node-maintenance-operator.md
+++ b/docs/node-maintenance-operator.md
@@ -173,10 +173,9 @@ The separate `node-repair-validation-<request-id>` artifact contains human
 evidence only: install/check logs, the fresh audit and a validation result.
 It never replaces the preparation artifact. Project code runs with the
 repository write maintainer as its trust principal; validation cannot attest
-intentionally dishonest tests. A later publisher must use the original
-preparation artifact and actual validation job success, never validation-local
-patches, reports or logs. Publication and normal-audit retention remain later
-slices, followed by the isolated live repair gate and general rollout.
+intentionally dishonest tests. The publisher uses the original preparation artifact and actual validation job
+success, never validation-local patches, reports or logs. Normal-audit retention
+and the full isolated live repair gate remain required before general rollout.
 
 ## Check the receiver locally
 
@@ -319,3 +318,41 @@ This checkpoint prepares cumulative evidence. It does not publish dependency
 changes or authorize merging. The later publisher must retain the validated
 repair marker and exact native `Node-Repair-*` locator trailers for another
 read-only attempt; producer job outputs alone do not persist across runs.
+
+## Publish the validated selected repair
+
+The reusable repair workflow now has a fresh publisher after successful
+preparation and validation. Only that job receives Contents/Pull requests write
+permission; its caller must grant those scopes plus Actions/Checks read. It
+downloads the original three-member preparation artifact by its exact ID and
+verifies the producer job, Check seal, immutable archive/content digests, source,
+request, project and exact candidate dependency state. Missing cumulative history
+or stale evidence stops before a branch push. Project scripts and package-manager
+commands never run on this writer.
+
+Immediately before pushing, it rechecks the canonical PR, selected batch and
+head/base. The native push uses an explicit expected-head lease. Its commit
+contains `Node-Repair: validated-selected-pins-v1` plus the original preparation
+run/job/Check/artifact IDs, archive/content digests and trusted workflow SHA.
+These trailers locate the immutable cumulative report for the next attempt;
+editable PR prose is never historical audit input.
+
+The PR body uses the sealed cumulative rows and verified candidate choices,
+adds the actual successful-validation run link and binds choices to the new
+head/base. It preserves the existing recognized platform section byte-for-byte,
+including CRLF and per-release CVE links. A missing or ambiguous platform section
+or an oversized body stops before push; inspect or replace an old proposal
+through the normal audit flow rather than dropping evidence.
+
+The push and PR-body edit are separate operations. A successful push followed
+by an edit failure leaves the repair commit published and reports the incomplete
+body update with its commit ID. After push, the writer rereads only an exact
+unchanged pre-push PR view up to four times, with waits of one, two and four
+seconds. It never repeats the push. An unexpected head or changed base, body,
+open state, branch or repository stops immediately; an old view at the limit also
+leaves an explicit partial result. The report is edited only after the expected
+published head and unchanged remaining PR state are observed.
+An uncertain push reports the attempted commit
+and requires branch inspection before another attempt. Nothing merges
+automatically. Normal-audit preservation and full live repair acceptance remain
+required before general rollout.
diff --git a/node/repair/action.yml b/node/repair/action.yml
index 7686664..73f09a8 100644
--- a/node/repair/action.yml
+++ b/node/repair/action.yml
@@ -1,8 +1,8 @@
 name: Node repair candidate
-description: Guard, prepare or validate a selected pnpm candidate without publication.
+description: Guard, prepare, validate and publish the exact selected pnpm candidate.
 inputs:
   operation:
-    description: guard, prepare or validate.
+    description: guard, prepare, validate or publish.
     required: true
   request-id:
     required: true
@@ -21,7 +21,7 @@ inputs:
     description: Canonical selected package/version triples.
   candidate-artifact-id:
     required: false
-    description: Single immutable preparation artifact ID from this run, required for validate.
+    description: Single immutable preparation artifact ID from this run, required for validate and publish.
 outputs:
   candidate-artifact-id:
     description: Immutable preparation artifact ID from this run.
@@ -41,18 +41,18 @@ runs:
       OPERATION: ${{ inputs.operation }}
     run: |
       case "$OPERATION" in
-        guard|prepare|validate) ;;
-        *) echo '::error::Expected guard, prepare or validate'; exit 1 ;;
+        guard|prepare|validate|publish) ;;
+        *) echo '::error::Expected guard, prepare, validate or publish'; exit 1 ;;
       esac
   - name: Validate the artifact ID
-    if: ${{ inputs.operation == 'validate' }}
+    if: ${{ inputs.operation == 'validate' || inputs.operation == 'publish' }}
     shell: bash
     env:
       ARTIFACT_ID: ${{ inputs.candidate-artifact-id }}
     run: |
       [[ "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]] || { echo '::error::Expected one preparation artifact ID'; exit 1; }
   - name: Download only the preparation artifact from this run
-    if: ${{ inputs.operation == 'validate' }}
+    if: ${{ inputs.operation == 'validate' || inputs.operation == 'publish' }}
     uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
     with:
       artifact-ids: ${{ inputs.candidate-artifact-id }}
@@ -76,18 +76,18 @@ runs:
       REPAIR_SELECTIONS: ${{ inputs.selections }}
     run: python "$GITHUB_ACTION_PATH/../runtime/repair.py" guard
   - name: Resolve the declared preparation toolchain
-    if: ${{ inputs.operation != 'guard' }}
+    if: ${{ inputs.operation == 'prepare' || inputs.operation == 'validate' }}
     shell: bash
     run: |
       set -euo pipefail
       python "$GITHUB_ACTION_PATH/../runtime/project.py" --github-env "$GITHUB_ENV" --resolved-config "$RUNNER_TEMP/node-repair-config.json"
   - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
-    if: ${{ inputs.operation != 'guard' }}
+    if: ${{ inputs.operation == 'prepare' || inputs.operation == 'validate' }}
     with:
       node-version: ${{ env.NODE_AUDIT_NODE_VERSION }}
       check-latest: true
   - name: Enable the declared package manager
-    if: ${{ inputs.operation != 'guard' }}
+    if: ${{ inputs.operation == 'prepare' || inputs.operation == 'validate' }}
     shell: bash
     run: corepack enable
   - name: Prepare and seal the selected candidate
@@ -137,3 +137,15 @@ runs:
       name: node-repair-validation-${{ inputs.request-id }}
       if-no-files-found: warn
       path: ${{ runner.temp }}/node-repair-validation/
+  - name: Publish only the original validated candidate
+    if: ${{ inputs.operation == 'publish' }}
+    shell: bash
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPAIR_REQUEST: ${{ inputs.request-id }}
+      REPAIR_PR: ${{ inputs.pull-request }}
+      REPAIR_HEAD: ${{ inputs.expected-head }}
+      REPAIR_BASE: ${{ inputs.expected-base }}
+      REPAIR_SELECTIONS: ${{ inputs.selections }}
+      REPAIR_ARTIFACT_ID: ${{ inputs.candidate-artifact-id }}
+    run: python "$GITHUB_ACTION_PATH/../runtime/repair.py" publish --artifact "$RUNNER_TEMP/node-repair-candidate"
diff --git a/node/runtime/repair.py b/node/runtime/repair.py
index 7e74470..4dcc28b 100644
--- a/node/runtime/repair.py
+++ b/node/runtime/repair.py
@@ -1,4 +1,4 @@
-"""Prepare a sealed pnpm candidate and validate it without publication."""
+"""Prepare, validate and publish exactly one sealed selected pnpm candidate."""
 
 import argparse
 import base64
@@ -73,8 +73,13 @@ def request():
     )
 
 
-def gh(path):
-    return json.loads(subprocess.check_output(["gh", "api", path], text=True))
+def gh(path, *, body=None):
+    arguments = ["gh", "api", path]
+    options = {}
+    if body is not None:
+        arguments += ["--method", "PATCH", "--input", "-"]
+        options["input"] = json.dumps(body)
+    return json.loads(subprocess.check_output(arguments, text=True, **options))
 
 
 def git(*args, **kwargs):
@@ -141,7 +146,7 @@ def project_path(root, name):
     return relative.as_posix()
 
 
-def project_context():
+def project_context(*, verify_runtime=True):
     root = Path.cwd().resolve()
     config_path = (
         Path(os.environ.get("RUNNER_TEMP", "/tmp")) / "node-repair-config.json"
@@ -151,7 +156,8 @@ def project_context():
     name = project_path(root, configuration["directory"])
     if root / name != directory or selected["manager"] != "pnpm":
         raise ValueError("Repair attempts require a standalone pnpm project")
-    PROJECT["verify_runtime"](directory, selected)
+    if verify_runtime:
+        PROJECT["verify_runtime"](directory, selected)
     snapshot = ENGINE["valid_snapshot"](directory)
     if snapshot is None:
         raise ValueError("Invalid project snapshot")
@@ -1129,6 +1135,271 @@ def cumulative_report(
     return report
 
 
+def publication_locator(expected):
+    """Resolve the exact original preparation notice in this workflow attempt."""
+    run, attempt, artifact = (
+        os.environ[key]
+        for key in ("GITHUB_RUN_ID", "GITHUB_RUN_ATTEMPT", "REPAIR_ARTIFACT_ID")
+    )
+    if any(
+        not re.fullmatch(r"[1-9][0-9]*", value) for value in (run, attempt, artifact)
+    ):
+        raise ValueError("Invalid preparation run, attempt or artifact ID")
+    repo = expected["repository"]
+    data = ENGINE["history_api"](repo, f"actions/runs/{run}")
+    if str(data.get("run_attempt")) != attempt:
+        raise ValueError("Preparation workflow attempt changed")
+    names = producer_names(
+        data,
+        repo,
+        "hydra-ecosystem/github-actions/.github/workflows/node-repair.yml",
+        os.environ["TRUSTED_WORKFLOW_SHA"],
+        "Node repair preparation",
+    )
+    jobs = ENGINE["history_api"](
+        repo, f"actions/runs/{run}/attempts/{attempt}/jobs?per_page=100"
+    )
+    matches = [j for j in jobs.get("jobs", []) if j.get("name") in names]
+    if jobs.get("total_count", 100) >= 100 or len(matches) != 1:
+        raise ValueError("Missing or ambiguous preparation producer")
+    job = matches[0]
+    check = job.get("check_run_url", "").removeprefix(
+        f"https://api.github.com/repos/{repo}/check-runs/"
+    )
+    if not re.fullmatch(r"[1-9][0-9]*", check):
+        raise ValueError("Invalid preparation Check URL")
+    notices = [
+        a
+        for a in ENGINE["history_api"](
+            repo, f"check-runs/{check}/annotations?per_page=100"
+        )
+        if a.get("title") == REPAIR_HISTORY_TITLE
+    ]
+    seal = (
+        re.fullmatch(
+            r"v1:([1-9][0-9]*):([a-f0-9]{64}):([a-f0-9]{64})",
+            notices[0].get("message", ""),
+        )
+        if len(notices) == 1
+        else None
+    )
+    if seal is None or seal[1] != artifact:
+        raise ValueError("Preparation notice does not bind the original artifact ID")
+    return dict(
+        run=int(run),
+        job=job["id"],
+        check=int(check),
+        artifact=int(artifact),
+        archive_sha256=seal[2],
+        content_sha256=seal[3],
+    )
+
+
+def publication_body(previous, report, expected, commit, envelope):
+    """Use sealed package evidence and retain the existing platform section."""
+    spans = list(
+        re.finditer(r"(?ms)^## Platform security\r?\n.*?(?=^## |\Z)", previous)
+    )
+    if (
+        len(spans) != 1
+        or len(re.findall(r"(?im)^##[^\r\n]*platform[^\r\n]*", previous)) != 1
+        or not re.match(r"## Package security\r?\n", previous[spans[0].end() :])
+        or "<!-- node-repair:" in spans[0].group()
+    ):
+        raise ValueError("Missing or ambiguous platform report; refusing publication")
+    platform = spans[0].group()
+    history = ENGINE["history_record"](report.encode("utf-8"))
+    validate_history(history)
+    if not isinstance(history.get("attempts"), list) or len(history["attempts"]) < 2:
+        raise ValueError("Preparation lacks complete cumulative history")
+    preparation = (
+        "Candidate preparation succeeded. Project validation has not run. "
+        "No dependency change has been published."
+    )
+    if not report.startswith("## Package security candidate\n\n" + preparation):
+        raise ValueError("Invalid sealed preparation report")
+    report = ENGINE["HISTORY_PATTERN"].sub("", report, count=1)
+    report = report.replace("## Package security candidate", "## Package security", 1)
+    report = report.replace(
+        preparation,
+        "Selected repairs passed frozen installation, configured project/local-patch "
+        "checks and a fresh audit, and were published to this PR. Human review is "
+        "still required; nothing merges automatically.",
+        1,
+    ).replace("Current attempt. ✅ Fix proposed.", "Current attempt. ✅ Upgraded.")
+    run = os.environ["GITHUB_RUN_ID"]
+    if not re.fullmatch(r"[1-9][0-9]*", run):
+        raise ValueError("Invalid workflow run ID")
+    choices = CHOICES["render"](
+        CHOICES["candidates"](envelope["candidate"]),
+        head=commit,
+        base=expected["base"],
+    )
+    marker = "" if choices else CHOICES["revision_marker"](commit, expected["base"])
+    body = (
+        platform + report.rstrip() + "\n\n"
+        f"[Validated repair run](https://github.com/{expected['repository']}/actions/runs/{run})"
+        f" · Repair commit `{commit}`\n\n" + choices + marker + "\n"
+    )
+
+    if len(body) > 65536:
+        raise ValueError("Cumulative PR report exceeds GitHub's body limit")
+    return body
+
+
+def publish(expected, artifact):
+    """Publish only the original preparation copy, without project execution."""
+    root = Path.cwd().resolve()
+    message = "No repair push was attempted."
+    try:
+        if (
+            git("rev-parse", "HEAD").strip() != expected["head"]
+            or git("status", "--porcelain", "--untracked-files=all").strip()
+        ):
+            raise ValueError("Publication requires a clean expected-head checkout")
+        if artifact.resolve() != artifact or artifact.is_relative_to(root):
+            raise ValueError("Candidate artifacts must be outside the checkout")
+        guard(expected)
+        directory, _, snapshot = project_context(verify_runtime=False)
+        envelope, candidate = apply_candidate(expected, artifact, directory, snapshot)
+        locator = publication_locator(expected)
+        workflow = os.environ["TRUSTED_WORKFLOW_SHA"]
+        record = verify_repair_history(
+            locator,
+            expected["repository"],
+            expected["head"],
+            directory.relative_to(root).as_posix(),
+            ENGINE["dependency_state"](candidate),
+            workflow,
+        )
+        if not isinstance(record.get("attempts"), list) or len(record["attempts"]) < 2:
+            raise ValueError("Preparation lacks complete cumulative history")
+        report = (artifact / "result.md").read_bytes()
+        if (
+            hashlib.sha256(report).hexdigest() != locator["content_sha256"]
+            or record["attempts"][-1]["before"] != envelope["before"]
+            or record["attempts"][-1]["after"] != envelope["candidate"]
+        ):
+            raise ValueError(
+                "Local preparation copy differs from the original sealed candidate"
+            )
+        trailers = (
+            "\n".join(
+                f"Node-Repair-{key.replace('_', '-')}: {value}"
+                for key, value in locator.items()
+            )
+            + f"\nNode-Repair-Workflow-SHA: {workflow}"
+        )
+        # Stage exact bytes without invoking Git clean filters from attributes.
+        for name in ("pnpm-workspace.yaml", "pnpm-lock.yaml"):
+            path = (directory / name).relative_to(root).as_posix()
+            blob = git("hash-object", "-w", "--no-filters", "--", path).strip()
+            git("update-index", "--cacheinfo", "100644", blob, path)
+        commit = git(
+            "-c",
+            "commit.gpgsign=false",
+            "-c",
+            "user.name=github-actions[bot]",
+            "-c",
+            "user.email=41898282+github-actions[bot]@users.noreply.github.com",
+            "commit-tree",
+            git("write-tree").strip(),
+            "-p",
+            expected["head"],
+            "-m",
+            "Repair selected dependency pins\n\nNode-Repair: validated-selected-pins-v1\n"
+            + trailers,
+        ).strip()
+        git(
+            "-c",
+            "core.hooksPath=/dev/null",
+            "update-ref",
+            "HEAD",
+            commit,
+            expected["head"],
+        )
+        current = guard(expected)
+        body = publication_body(
+            current["body"],
+            report.decode("utf-8"),
+            expected,
+            commit,
+            envelope,
+        )
+        token = base64.b64encode(
+            ("x-access-token:" + os.environ["GH_TOKEN"]).encode()
+        ).decode()
+        environment = dict(
+            os.environ,
+            GIT_CONFIG_COUNT="1",
+            GIT_CONFIG_KEY_0="http.https://github.com/.extraheader",
+            GIT_CONFIG_VALUE_0="AUTHORIZATION: basic " + token,
+            GIT_TERMINAL_PROMPT="0",
+        )
+        message = f"Repair push of commit {commit} attempted; inspect the branch before another attempt."
+        subprocess.run(
+            [
+                "git",
+                "-c",
+                "core.hooksPath=/dev/null",
+                "push",
+                f"--force-with-lease=refs/heads/maintenance/node-security:{expected['head']}",
+                "origin",
+                "HEAD:refs/heads/maintenance/node-security",
+            ],
+            env=environment,
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+        message = (
+            f"Repair commit {commit} was published. The PR report update is incomplete; "
+            "inspect the branch before another attempt."
+        )
+
+        def same_view(pr, head):
+            return (
+                pr.get("state") == "open"
+                and pr.get("head", {}).get("sha") == head
+                and pr.get("base", {}).get("sha") == expected["base"]
+                and pr.get("body") == current["body"]
+                and all(
+                    pr.get(side, {}).get("ref") == current[side]["ref"]
+                    and (pr.get(side, {}).get("repo") or {}).get("id")
+                    == current[side]["repo"]["id"]
+                    for side in ("head", "base")
+                )
+            )
+
+        # GitHub may briefly return the exact pre-push PR snapshot. Only wait
+        # on that unchanged view; a different state still stops immediately.
+        for delay in (0, 1, 2, 4):
+            if delay:
+                time.sleep(delay)
+            latest = gh(f"repos/{expected['repository']}/pulls/{expected['pr']}")
+            if not same_view(latest, expected["head"]):
+                break
+        if not same_view(latest, commit):
+            raise ValueError(
+                "PR state differs after repair push; retain the commit and inspect "
+                f"the report (head={latest.get('head', {}).get('sha')}, "
+                f"base={latest.get('base', {}).get('sha')}, "
+                f"state={latest.get('state')}, "
+                f"body_changed={latest.get('body') != current['body']})"
+            )
+        gh(
+            f"repos/{expected['repository']}/pulls/{expected['pr']}",
+            body={"body": body},
+        )
+        message = f"Repair commit {commit} and its validated report were published. No merge occurred."
+        return commit
+    finally:
+        print(message)
+        if os.environ.get("GITHUB_STEP_SUMMARY"):
+            with Path(os.environ["GITHUB_STEP_SUMMARY"]).open("a") as summary:
+                summary.write(message + "\n")
+
+
 def prepare(expected, artifact):
     with suppress_hooks():
         return prepare_candidate(expected, artifact)
@@ -1167,7 +1438,9 @@ def prepare_candidate(expected, artifact):
     }
     if not required <= fixed:
         raise ValueError("The candidate did not confirm every selected advisory fix")
-    ENGINE["describe_pnpm_fixes"](directory, after, candidate[1], [], deadline, {})
+    ENGINE["describe_pnpm_fixes"](
+        directory, after, candidate[1], [], deadline, {}, collect_proof=True
+    )
     if ENGINE["valid_snapshot"](directory) != candidate:
         raise ValueError("Audit lookup changed the candidate")
     paths = [
@@ -1216,7 +1489,9 @@ def prepare_candidate(expected, artifact):
 
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("operation", choices=("guard", "prepare", "validate"))
+    parser.add_argument(
+        "operation", choices=("guard", "prepare", "validate", "publish")
+    )
     parser.add_argument("--artifact", type=Path)
     parser.add_argument("--evidence", type=Path)
     args = parser.parse_args()
@@ -1224,11 +1499,13 @@ def main():
     if args.operation == "guard":
         guard(expected)
     elif args.artifact is None:
-        parser.error("prepare and validate require --artifact")
+        parser.error("prepare, validate and publish require --artifact")
     elif args.operation == "validate":
         if args.evidence is None:
             parser.error("validate requires --evidence")
         validate(expected, args.artifact, args.evidence)
+    elif args.operation == "publish":
+        publish(expected, args.artifact)
     else:
         prepare(expected, args.artifact)
 
diff --git a/node/tests/test_selected_repairs.py b/node/tests/test_selected_repairs.py
index 366aa29..1dfad78 100644
--- a/node/tests/test_selected_repairs.py
+++ b/node/tests/test_selected_repairs.py
@@ -1,4 +1,4 @@
-"""Selection, candidate and read-only validation contracts; no publication."""
+"""Selection, sealed candidate, validation and guarded publication contracts."""
 
 import copy
 import json
@@ -908,9 +908,10 @@ def test_repair_workflow_keeps_preparation_separate_from_read_only_validation():
         "expected-base",
         "selections",
     }
-    assert set(workflow["jobs"]) == {"guard", "prepare", "validate"}
-    for job in workflow["jobs"].values():
-        assert set(job["permissions"].values()) == {"read"}
+    assert set(workflow["jobs"]) == {"guard", "prepare", "validate", "publish"}
+    for name, job in workflow["jobs"].items():
+        if name != "publish":
+            assert set(job["permissions"].values()) == {"read"}
         assert any(step.get("uses") == "$/node/repair" for step in job["steps"])
     prepare = workflow["jobs"]["prepare"]
     assert prepare["env"] == REPAIR["HOOK_ENV"]
@@ -957,7 +958,39 @@ def test_repair_workflow_keeps_preparation_separate_from_read_only_validation():
         if step.get("name") == "Retain human validation evidence only"
     )
     assert human["with"]["path"] == "${{ runner.temp }}/node-repair-validation/"
-    assert "publish" not in workflow["jobs"]
+    publisher = workflow["jobs"]["publish"]
+    assert publisher["needs"] == ["prepare", "validate"]
+    assert publisher["permissions"] == {
+        "contents": "write",
+        "pull-requests": "write",
+        "actions": "read",
+        "checks": "read",
+    }
+    assert publisher["concurrency"] == {
+        "group": "node-dependency-proposal-${{ github.repository }}",
+        "cancel-in-progress": False,
+    }
+    # The job context is available in step env, not in job-level env.
+    assert "env" not in publisher
+    assert publisher["steps"][1]["env"] == {
+        "TRUSTED_WORKFLOW_SHA": "${{ job.workflow_sha }}"
+    }
+    assert publisher["steps"][0]["with"] == checkout["with"]
+    assert (
+        publisher["steps"][1]["with"]["candidate-artifact-id"]
+        == "${{ needs.prepare.outputs.candidate-artifact-id }}"
+    )
+    for step in action["runs"]["steps"]:
+        if (
+            "corepack" in step.get("run", "")
+            or step.get("uses", "").startswith("actions/setup-node@")
+            or step.get("name") == "Resolve the declared preparation toolchain"
+        ):
+            assert (
+                step["if"]
+                == "${{ inputs.operation == 'prepare' || inputs.operation == 'validate' }}"
+            )
+    assert "publish" in download["if"]
 
 
 @pytest.mark.parametrize(
@@ -1693,14 +1726,17 @@ def test_cumulative_table_keeps_range_pipes_inside_six_cells(
     assert audit["advisories"]["1"]["url"] in cells[5]
 
 
-def test_documented_caller_covers_reusable_workflow_read_permissions():
+def test_documented_caller_covers_reusable_workflow_permissions():
     text = (ROOT / "repair-app/pilot/README.md").read_text()
     caller = yaml.safe_load(text.split("```yaml\n", 1)[1].split("```", 1)[0])
     workflow = yaml.safe_load((ROOT / ".github/workflows/node-repair.yml").read_text())
     job = caller["jobs"]["candidate"]
     for reusable in workflow["jobs"].values():
         for scope, level in reusable["permissions"].items():
-            assert level == "read" and job["permissions"][scope] == level
+            assert (
+                job["permissions"][scope] == "write"
+                or level == job["permissions"][scope]
+            )
     assert set(job["with"]) == set(workflow["on"]["workflow_call"]["inputs"])
 
 
@@ -1887,3 +1923,489 @@ def verify(locator, **kwargs):
     monkeypatch.setitem(module["ENGINE"], "verify_history", verify)
     REPAIR["native_history"](expected, clone, snapshot)
     assert calls[0]["source"] == receipt_parent
+
+
+@pytest.fixture
+def publisher_checkout(sealed_checkout, monkeypatch, tmp_path):
+    root, artifact, before, expected = sealed_checkout
+    remote = tmp_path / "origin.git"
+    subprocess.run(["git", "init", "--bare", "-q", str(remote)], check=True)
+    git = REPAIR["git"]
+    git("remote", "add", "origin", str(remote))
+    git("push", "origin", "HEAD:refs/heads/maintenance/node-security")
+    body = (
+        "## Platform security\n\nNode upgrade evidence stays unchanged.\n\n"
+        "## Package security\n\nOld package report\n"
+        + CHOICES["render"]([ITEM], head=expected["head"], base=expected["base"])
+    ).replace("- [ ]", "- [x]")
+    state = dict(body=body, base=expected["base"], updates=[], reads=0)
+    repository = dict(id=1, full_name=expected["repository"], default_branch="main")
+
+    def remote_head():
+        return subprocess.check_output(
+            [
+                "git",
+                "--git-dir",
+                str(remote),
+                "rev-parse",
+                "refs/heads/maintenance/node-security",
+            ],
+            text=True,
+        ).strip()
+
+    def advance_remote():
+        commit = subprocess.check_output(
+            [
+                "git",
+                "-c",
+                "user.name=Maintainer",
+                "-c",
+                "user.email=m@example.invalid",
+                "commit-tree",
+                git("rev-parse", "HEAD^{tree}").strip(),
+                "-p",
+                expected["head"],
+            ],
+            input="Maintainer concurrent work\n",
+            text=True,
+        ).strip()
+        git("push", "origin", f"{commit}:refs/heads/maintenance/node-security")
+        return commit
+
+    def api(path, *, body=None):
+        if path == f"repos/{expected['repository']}":
+            return repository
+        assert path == f"repos/{expected['repository']}/pulls/{expected['pr']}"
+        if body is not None:
+            if state.get("edit_failure"):
+                raise subprocess.CalledProcessError(1, ["gh", "api"])
+            state["updates"].append(body["body"])
+            state["body"] = body["body"]
+            return {}
+        state["reads"] += 1
+        response = dict(
+            number=expected["pr"],
+            state="open",
+            user={"type": "Bot"},
+            body=state["body"],
+            head=dict(
+                ref="maintenance/node-security", sha=remote_head(), repo=repository
+            ),
+            base=dict(ref="main", sha=state["base"], repo=repository),
+        )
+        if state.get("lease_race") and state["reads"] == 2:
+            state["concurrent_commit"] = advance_remote()
+        return response
+
+    module = REPAIR["publish"].__globals__
+    monkeypatch.setitem(module, "gh", api)
+
+    def context(*, verify_runtime=True):
+        assert not verify_runtime, "Publisher must not execute a package manager"
+        return root, {}, before
+
+    monkeypatch.setitem(module, "project_context", context)
+    monkeypatch.setitem(
+        module["ENGINE"], "run", lambda *a, **k: pytest.fail("Project command executed")
+    )
+    monkeypatch.setenv("GH_TOKEN", "fixture-no-real-token")
+    monkeypatch.setenv("GITHUB_RUN_ID", "123")
+    monkeypatch.setenv("GITHUB_STEP_SUMMARY", str(tmp_path / "summary.md"))
+    candidate = repair_files(root, ITEM["to"])
+    report = REPAIR["cumulative_report"](
+        normal_history(before),
+        expected,
+        root,
+        {},
+        before,
+        candidate,
+        repair_audit(),
+        empty_audit(),
+        ENGINE["finding_ids"](repair_audit(), "pnpm"),
+    )
+    subprocess.run(["git", "checkout", "--", "."], check=True)
+    (artifact / "result.md").write_text(report)
+    import hashlib
+
+    locator = dict(
+        run=123,
+        job=20,
+        check=30,
+        artifact=40,
+        archive_sha256="a" * 64,
+        content_sha256=hashlib.sha256(report.encode()).hexdigest(),
+    )
+    record = ENGINE["history_record"](report.encode())
+    state.update(record=record, locator=locator, report=report)
+    monkeypatch.setitem(
+        module,
+        "publication_locator",
+        lambda value: locator if value == expected else pytest.fail("Request changed"),
+    )
+
+    def verified(loc, repo, source, project, hashes, workflow):
+        assert (loc, repo, source, project, hashes, workflow) == (
+            locator,
+            expected["repository"],
+            expected["head"],
+            ".",
+            record["candidate_state"],
+            "f" * 40,
+        )
+        REPAIR["validate_history"](record)
+        return record
+
+    monkeypatch.setitem(module, "verify_repair_history", verified)
+    monkeypatch.setenv("TRUSTED_WORKFLOW_SHA", "f" * 40)
+    hook = root / ".git/hooks/pre-commit"
+    marker = tmp_path / "commit-hook-executed"
+    hook.write_text(f"#!/bin/sh\ntouch {shlex.quote(str(marker))}\nexit 1\n")
+    hook.chmod(0o755)
+    return root, artifact, expected, state, remote_head, advance_remote, marker
+
+
+def test_publisher_commits_only_sealed_files_without_project_execution(
+    publisher_checkout,
+):
+    root, artifact, expected, state, remote_head, _, marker = publisher_checkout
+    sealed = {p.name: p.read_bytes() for p in artifact.iterdir()}
+    commit = REPAIR["publish"](expected, artifact)
+    assert remote_head() == commit != expected["head"]
+    assert REPAIR["git"]("rev-parse", "HEAD^").strip() == expected["head"]
+    assert set(REPAIR["git"]("diff", "--name-only", "HEAD^", "HEAD").splitlines()) == {
+        "pnpm-lock.yaml",
+        "pnpm-workspace.yaml",
+    }
+    assert "Node-Repair: validated-selected-pins-v1" in REPAIR["git"](
+        "log", "-1", "--format=%B"
+    )
+    assert "Node-Repair-run: 123" in REPAIR["git"]("log", "-1", "--format=%B")
+    assert "Node-Repair-artifact: 40" in REPAIR["git"]("log", "-1", "--format=%B")
+    assert "Node-Repair-Workflow-SHA: " + "f" * 40 in REPAIR["git"](
+        "log", "-1", "--format=%B"
+    )
+    assert not marker.exists()
+    assert not REPAIR["git"]("status", "--porcelain").strip()
+    assert len(state["updates"]) == 1
+    body = state["updates"][0]
+    assert body.startswith(
+        "## Platform security\n\nNode upgrade evidence stays unchanged.\n\n"
+    )
+    assert "✅ Upgraded." in body and "Historical evidence (attempt 1)" in body
+    assert "Project validation has not run" not in body
+    assert "actions/runs/123" in body and commit in body
+    assert CHOICES["revision_marker"](commit, expected["base"]) in body
+    assert {p.name: p.read_bytes() for p in artifact.iterdir()} == sealed
+    assert "were published" in body
+
+
+@pytest.mark.parametrize(
+    "problem", ["head", "base", "selection", "lease", "bad-report"]
+)
+def test_publisher_rejects_stale_consent_and_native_push_lease_conflicts(
+    publisher_checkout, problem
+):
+    root, artifact, expected, state, remote_head, advance_remote, marker = (
+        publisher_checkout
+    )
+    previous = expected["head"]
+    if problem == "head":
+        previous = advance_remote()
+    elif problem == "base":
+        state["base"] = "c" * 40
+    elif problem == "selection":
+        state["body"] = state["body"].replace("- [x]", "- [ ]")
+    elif problem == "lease":
+        state["lease_race"] = True
+    elif problem == "bad-report":
+        (artifact / "result.md").write_text("Unbound forged validation success")
+    with pytest.raises((ValueError, subprocess.CalledProcessError)):
+        REPAIR["publish"](expected, artifact)
+    assert remote_head() == state.get("concurrent_commit", previous)
+    assert not state["updates"] and not marker.exists()
+    summary = Path(os.environ["GITHUB_STEP_SUMMARY"]).read_text()
+    assert "No repair push was attempted" in summary or "inspect the branch" in summary
+    assert "were published" not in summary
+
+
+def test_publisher_reports_push_success_and_body_failure_as_partial(publisher_checkout):
+    root, artifact, expected, state, remote_head, _, marker = publisher_checkout
+    state["edit_failure"] = True
+    original_body = state["body"]
+    with pytest.raises(subprocess.CalledProcessError):
+        REPAIR["publish"](expected, artifact)
+    assert (
+        remote_head() == REPAIR["git"]("rev-parse", "HEAD").strip() != expected["head"]
+    )
+    assert state["body"] == original_body and not state["updates"]
+    summary = Path(os.environ["GITHUB_STEP_SUMMARY"]).read_text()
+    assert "was published" in summary and "report update is incomplete" in summary
+    assert "No repair push was attempted" not in summary and not marker.exists()
+
+
+@pytest.mark.parametrize("newline", ["\n", "\r\n"])
+def test_publication_body_preserves_platform_bytes_and_frozen_cumulative_rows(
+    cumulative_candidate, monkeypatch, newline
+):
+    _, _, _, _, _, report = cumulative_candidate
+    monkeypatch.setenv("GITHUB_RUN_ID", "123")
+    platform = (
+        "## Platform security\n\n✅ Node.js `24.21.0 → 24.22.1`.\n\n"
+        "| Security release | CVE summary |\n| --- | --- |\n"
+        "| 24.22.1 | [CVE list](https://nodejs.org/en/blog/release/v24.22.1/) |\n\n"
+    ).replace("\n", newline)
+    previous = (
+        platform + "## Package security" + newline + "FORGED OLD PACKAGE EVIDENCE"
+    )
+    body = REPAIR["publication_body"](
+        previous, report, repair_request(), "c" * 40, envelope()
+    )
+    assert body.startswith(platform)
+    assert "FORGED OLD PACKAGE EVIDENCE" not in body
+    assert "Historical evidence (attempt 1)" in body
+    assert "Not observed in the current audit" in body
+    assert "across 2 attempts" in body and "2 advisory/package pairs" in body
+    assert "GHSA-fresh-one1-test" in body
+    assert "node-audit-history:v1:" not in body
+    assert body.count("| Package |") == 1
+    assert "Selected repairs passed frozen installation" in body
+    assert CHOICES["revision_marker"]("c" * 40, repair_request()["base"]) in body
+
+
+@pytest.mark.parametrize(
+    "platform",
+    [
+        "",
+        "## PLATFORM SECURITY\nUnknown format\n",
+        "## Platform security\nfirst\n## Platform security\nsecond\n",
+    ],
+)
+def test_publisher_refuses_missing_or_ambiguous_platform_before_push(
+    publisher_checkout, platform
+):
+    _, artifact, expected, state, remote_head, _, marker = publisher_checkout
+    state["body"] = (
+        platform
+        + "## Package security\n"
+        + CHOICES["render"](
+            [ITEM], head=expected["head"], base=expected["base"]
+        ).replace("- [ ]", "- [x]")
+    )
+    with pytest.raises(ValueError, match="platform report"):
+        REPAIR["publish"](expected, artifact)
+    assert (
+        remote_head() == expected["head"]
+        and not state["updates"]
+        and not marker.exists()
+    )
+
+
+@pytest.mark.parametrize("problem", ["report-bytes", "before-proof", "missing-history"])
+def test_publisher_rejects_modified_or_incomplete_sealed_evidence(
+    publisher_checkout, problem
+):
+    _, artifact, expected, state, remote_head, _, marker = publisher_checkout
+    if problem == "report-bytes":
+        path = artifact / "result.md"
+        path.write_bytes(
+            path.read_bytes().replace(
+                b"Historical evidence", b"Forged historical evidence", 1
+            )
+        )
+    elif problem == "before-proof":
+        state["record"]["attempts"][-1]["before"]["metadata"]["forged"] = (
+            "not original proof"
+        )
+    else:
+        record = state["record"]
+        record.pop("attempts")
+    with pytest.raises((ValueError, KeyError)):
+        REPAIR["publish"](expected, artifact)
+    assert (
+        remote_head() == expected["head"]
+        and not state["updates"]
+        and not marker.exists()
+    )
+
+
+def test_ambiguous_native_push_requires_inspection_without_retry(
+    publisher_checkout, monkeypatch
+):
+    _, artifact, expected, state, remote_head, _, _ = publisher_checkout
+    actual = subprocess.run
+    pushes = []
+
+    def uncertain(command, **kwargs):
+        if command[:4] == ["git", "-c", "core.hooksPath=/dev/null", "push"]:
+            pushes.append(command)
+            actual(command, **kwargs)
+            raise subprocess.TimeoutExpired(command, 1)
+        return actual(command, **kwargs)
+
+    monkeypatch.setattr(subprocess, "run", uncertain)
+    with pytest.raises(subprocess.TimeoutExpired):
+        REPAIR["publish"](expected, artifact)
+    assert len(pushes) == 1 and remote_head() != expected["head"]
+    assert not state["updates"]
+    summary = Path(os.environ["GITHUB_STEP_SUMMARY"]).read_text()
+    assert remote_head() in summary and "inspect the branch" in summary
+    assert "No repair push was attempted" not in summary
+
+
+@pytest.mark.parametrize(
+    "problem",
+    [None, "artifact", "attempt", "duplicate", "job-url", "sibling", "missing-history"],
+)
+def test_publication_locator_requires_current_original_preparation(
+    repair_history_provider, monkeypatch, problem
+):
+    locator, repo, _, _, _, workflow, data, _ = repair_history_provider
+    monkeypatch.setenv("GITHUB_RUN_ID", "10")
+    monkeypatch.setenv("GITHUB_RUN_ATTEMPT", "1")
+    monkeypatch.setenv("REPAIR_ARTIFACT_ID", "40")
+    monkeypatch.setenv("TRUSTED_WORKFLOW_SHA", workflow)
+    if problem == "artifact":
+        monkeypatch.setenv("REPAIR_ARTIFACT_ID", "41")
+    elif problem == "attempt":
+        data["actions/runs/10"]["run_attempt"] = 2
+    elif problem == "duplicate":
+        data["check-runs/30/annotations?per_page=100"] *= 2
+    elif problem == "job-url":
+        data["actions/jobs/20"]["check_run_url"] = "https://evil.invalid/30"
+    elif problem == "sibling":
+        data["actions/jobs/20"]["name"] = "Sibling forgery"
+    elif problem == "missing-history":
+        data["check-runs/30/annotations?per_page=100"] = []
+    if problem:
+        with pytest.raises(ValueError):
+            REPAIR["publication_locator"](repair_request())
+    else:
+        assert REPAIR["publication_locator"](repair_request()) == locator
+
+
+@pytest.mark.parametrize(
+    "change",
+    ["head", "base", "body", "state", "head-ref", "base-ref", "head-repo", "base-repo"],
+)
+def test_publisher_retains_successful_push_when_pr_changes_before_body_edit(
+    publisher_checkout, monkeypatch, change
+):
+    _, artifact, expected, state, remote_head, _, _ = publisher_checkout
+    module = REPAIR["publish"].__globals__
+    original = module["gh"]
+
+    def changed(path, **kwargs):
+        value = original(path, **kwargs)
+        if (
+            path.endswith(f"/pulls/{expected['pr']}")
+            and not kwargs
+            and state["reads"] == 3
+        ):
+            value = json.loads(json.dumps(value))
+            if change == "head":
+                value["head"]["sha"] = "e" * 40
+            elif change == "base":
+                value["base"]["sha"] = "e" * 40
+            elif change == "body":
+                value["body"] += "Maintainer edit after push"
+            elif change == "state":
+                value["state"] = "closed"
+            elif change.endswith("-ref"):
+                value[change.split("-")[0]]["ref"] = "different-branch"
+            else:
+                value[change.split("-")[0]]["repo"]["id"] = 2
+        return value
+
+    monkeypatch.setitem(module, "gh", changed)
+    monkeypatch.setattr(
+        module["time"], "sleep", lambda _: pytest.fail("Waited on changed PR")
+    )
+    with pytest.raises(ValueError, match="PR state differs after repair push"):
+        REPAIR["publish"](expected, artifact)
+    assert remote_head() != expected["head"] and not state["updates"]
+    summary = Path(os.environ["GITHUB_STEP_SUMMARY"]).read_text()
+    assert remote_head() in summary and "report update is incomplete" in summary
+
+
+@pytest.mark.parametrize("stale_reads", [1, 3, 4])
+def test_publisher_waits_only_for_exact_pre_push_view_without_another_push(
+    publisher_checkout, monkeypatch, stale_reads
+):
+    _, artifact, expected, state, remote_head, _, marker = publisher_checkout
+    module = REPAIR["publish"].__globals__
+    original_api = module["gh"]
+    original_run = module["subprocess"].run
+    delays, pushes = [], []
+
+    def api(path, **kwargs):
+        value = original_api(path, **kwargs)
+        if (
+            path.endswith(f"/pulls/{expected['pr']}")
+            and not kwargs
+            and 3 <= state["reads"] <= 2 + stale_reads
+        ):
+            value["head"]["sha"] = expected["head"]
+        return value
+
+    def run(arguments, *args, **kwargs):
+        if arguments[0] == "git" and "push" in arguments:
+            pushes.append(arguments)
+        return original_run(arguments, *args, **kwargs)
+
+    monkeypatch.setitem(module, "gh", api)
+    monkeypatch.setattr(module["time"], "sleep", delays.append)
+    monkeypatch.setattr(module["subprocess"], "run", run)
+    if stale_reads < 4:
+        commit = REPAIR["publish"](expected, artifact)
+        assert remote_head() == commit and len(state["updates"]) == 1
+    else:
+        with pytest.raises(ValueError, match="PR state differs after repair push"):
+            REPAIR["publish"](expected, artifact)
+        assert not state["updates"]
+        summary = Path(os.environ["GITHUB_STEP_SUMMARY"]).read_text()
+        assert remote_head() in summary and "report update is incomplete" in summary
+    assert len(pushes) == 1 and remote_head() != expected["head"]
+    assert delays == ([1] if stale_reads == 1 else [1, 2, 4])
+    assert (
+        len(
+            REPAIR["git"](
+                "rev-list", f"{expected['head']}..{remote_head()}"
+            ).splitlines()
+        )
+        == 1
+    )
+    assert not marker.exists()
+
+
+@pytest.mark.parametrize(
+    "problem", ["demoted-headings", "controls-in-platform", "missing-package-boundary"]
+)
+def test_publisher_rejects_unrecognized_platform_boundary_before_native_push(
+    publisher_checkout, problem
+):
+    _, artifact, expected, state, remote_head, _, marker = publisher_checkout
+    body = state["body"]
+    if problem == "demoted-headings":
+        body = body.replace("## Package security\n", "### Package security\n").replace(
+            "## Choose fixes to try\n", "### Choose fixes to try\n"
+        )
+    elif problem == "missing-package-boundary":
+        body = body.replace("## Package security\n", "")
+    else:
+        platform = body.split("## Package security\n", 1)[0]
+        choices = CHOICES["render"](
+            [ITEM], head=expected["head"], base=expected["base"]
+        ).replace("- [ ]", "- [x]")
+        body = (
+            platform
+            + choices.replace("## Choose fixes to try", "### Choose fixes to try")
+            + "\n## Package security\nOld packages\n"
+        )
+    state["body"] = body
+    assert REPAIR["guard"](expected)["body"] == body
+    with pytest.raises(ValueError, match="platform report"):
+        REPAIR["publish"](expected, artifact)
+    assert remote_head() == expected["head"]
+    assert not state["updates"] and not marker.exists()
+    summary = Path(os.environ["GITHUB_STEP_SUMMARY"]).read_text()
+    assert "No repair push was attempted" in summary
diff --git a/repair-app/pilot/README.md b/repair-app/pilot/README.md
index 64bce5e..39d2dc1 100644
--- a/repair-app/pilot/README.md
+++ b/repair-app/pilot/README.md
@@ -29,10 +29,10 @@ Restore the original PR description after temporary probe selections, checking
 that no concurrent edit would be overwritten. Record actual source/deployment
 identities and distinguish local intercepted API tests from real GitHub events.
 
-## Isolated candidate preparation and validation acceptance
+## Isolated candidate preparation, validation and publication acceptance
 
-After reviewing the preparation slice, use a separately authorized isolated
-repository. Replace its existing harmless caller's job with a call to the
+After reviewing the preparation, validation and publisher slices and completing
+their required checks, use an explicitly authorized isolated repository. Replace its existing harmless caller's job with a call to the
 reviewed reusable workflow. Keep the default-branch workflow path
 `.github/workflows/dependency-repair.yml` and its five dispatch inputs unchanged.
 Do not replace Hydra's harmless caller or roll this out to other installations
@@ -45,8 +45,8 @@ experimentation, use a dedicated experimentation tag whose updates are reviewed.
 jobs:
   candidate:
     permissions:
-      contents: read
-      pull-requests: read
+      contents: write
+      pull-requests: write
       actions: read
       checks: read
     uses: hydra-ecosystem/github-actions/.github/workflows/node-repair.yml@REVIEWED_REF
@@ -62,8 +62,8 @@ Retain the exact caller and reusable-workflow revisions, the bot-authored manage
 PR's head/base, selected batch, Actions run and immutable candidate artifact ID.
 Inspect the downloaded artifact for exactly `candidate.patch`, `audit.json` and
 `result.md`. Verify request/project binding, allowed patch paths, unchanged
-unselected dependencies and a truthful preparation-only report. Also record
-that no project scripts ran and no repository dependency files were published.
+unselected dependencies and a truthful preparation-only report. Record that producer upload precedes validation and publication and that no
+project scripts run on the producer or publisher.
 Stale consent and unavailable evidence must fail without a candidate artifact.
 
 Validation runs on a separate read-only runner after preparation. Record a
@@ -78,9 +78,11 @@ its retained ID again and prove its bytes did not change. The validation
 artifact is human evidence only; its files cannot become publication inputs.
 Keep both artifact IDs and their separate contents in the acceptance record.
 
-Publication is not enabled yet. These gates do not pass G-REPAIR or upgrade the
-PR. Publication and retention are tested in their owning slices before the
-final Hydra rollout.
+These preparation/validation checks alone do not pass G-REPAIR. The current
+workflow also has a separate publisher. Grant the caller write permissions only
+for an explicitly authorized isolated publication test; the prepare and validate
+jobs still receive read-only permissions. Normal-audit retention remains its own
+acceptance gate before general rollout.
 
 ## Initial normal-audit evidence acceptance
 
@@ -122,3 +124,28 @@ and reject an identical sibling-job copy. Grant only Actions/Checks read access
 to the consumer. Preserve the existing demo PR and restore the complete fixture
 file tree after the bounded test. No Hydra mutation, dependency publication or
 source merge is included in this preparation slice.
+
+## Isolated cumulative publication acceptance
+
+After the publisher source passes full local validation, independent review,
+regular PR approval and required CI, run one bounded private-demo publication
+test using its reviewed reference. Keep the five dispatch inputs unchanged.
+Select fixes in the existing managed PR and post a new `/repair selected`
+comment. Retain the original preparation run/job/Check/artifact IDs and digests,
+old/new branch heads and report URL. Verify the publisher changes only the
+approved dependency files after actual separate validation success, uses the
+original sealed cumulative report, and preserves the platform section exactly.
+
+The publisher records the original preparation locator and trusted workflow SHA
+in its validated-repair commit trailers. The next attempt must consume that
+original artifact through native history. It does not fetch validation artifacts
+or execute project hooks, package-manager commands or a fresh audit. Native Git
+stale-consent, lease-race and push-success/body-edit-failure tests are required;
+ambiguous pushes require branch inspection rather than an automatic retry.
+
+Preserve original CVEs and cumulative historical/current rows in the PR
+conversation. Restore the isolated fixture tree and original PR head/body with
+expected-head guards after the bounded test. No source merge, stable-tag update,
+Hydra change or App/Worker/D1 deployment is included. The deployed App's historical
+harmless-pilot wording must be corrected before general actual-repair use; this
+is an isolated publisher test, not general consumer rollout.