fix(release): classify App-token 404s when creating nightly tags - #128

🤖 I have created a release *beep* *boop*
---


## [0.1.1](v0.1.0...v0.1.1)
(2026-09-13)


### Bug Fixes

* **continue_guard:** keep long multi-agent sessions auto-continuing
([#118](#118))
([1a39847](1a39847))
* **models:** honor WebUI disable for colliding cross-provider slugs
([#117](#117))
([7f149d4](7f149d4))
* **provider:** identify OpenCode Go sessions
([#121](#121))
([d81deaa](d81deaa))
* **release:** classify App-token 404s when creating nightly tags
([#128](#128))
([478d974](478d974))
* **release:** include maintenance notes without triggering releases
([#125](#125))
([e837600](e837600))
* **security:** confine docs checker path.resolve to the repo base
([#120](#120))
([12de5b1](12de5b1))
* **security:** harden documentation path confinement
([#115](#115))
([26431ce](26431ce))


### Documentation

* document live releases and commit title templates
([#114](#114))
([9a0794c](9a0794c))


### Build System

* **deps:** Bump crate-ci/typos from 1.49.0 to 1.50.1
([#124](#124))
([fdef744](fdef744))
* **deps:** Bump reqwest from 0.13.4 to 0.13.5
([#126](#126))
([1ca3cdb](1ca3cdb))
* **deps:** Bump taiki-e/install-action from 2.86.8 to 2.87.4
([#123](#123))
([010133c](010133c))
* **deps:** Bump taiki-e/install-action from 2.87.4 to 2.87.9
([#127](#127))
([653a113](653a113))
* **deps:** Bump toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0
([#122](#122))
([f539391](f539391))


### Continuous Integration

* stop scanners treating the GitHub App action pin as a secret
([#119](#119))
([783bbda](783bbda))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: codex-warp-release-bot[bot] <323806225+codex-warp-release-bot[bot]@users.noreply.github.com>

…131)

## Summary

Scheduled Nightly kept failing on the leftover tag
`nightly-20260913-653a113ca227`, not on a new candidate each night.
Origin run https://github.com/jatmn/Codex-warp/actions/runs/34762668596
posted that immutable tag, then the App-token post-create peel 404ed
before `nightly-tag-creation-receipt` was retained. Prepare is
fail-closed while any `nightly-*` tag lacks exactly one published
prerelease, so later schedules (including
https://github.com/jatmn/Codex-warp/actions/runs/34985811180) stopped at
the outstanding-transaction gate. Merged #128/#129 added recovery
classification but did not mutate live tag/release state; Nightly
Recovery had never been dispatched.

This branch peels the new tag with `${{ github.token }}` after
classified App-token 404 retries, writes the receipt only when that peel
SHA equals the selected source SHA, and names the prepare orphan error
with the tag, peeled SHA, `release_id=absent`, and confirmation. The
leftover transaction was completed with Nightly Recovery
https://github.com/jatmn/Codex-warp/actions/runs/34990949453 (prerelease
https://github.com/jatmn/Codex-warp/releases/tag/nightly-20260913-653a113ca227).
Final reviewed SHA: `a38a732ec2f83610ad665ecb7838ce817f6a9033`.

No GitHub issue number. Does not auto-dispatch recovery or rewrite later
App-token tag GETs.

## Contribution checklist

- [x] I checked for duplicate or overlapping existing pull requests.
- [x] This PR does not introduce a new implementation language.
- [x] This PR does not add Python for any reason.
- [x] I can respond to review feedback within one week.
- [x] My PR title follows the Conventional Commit templates in
AGENTS.md.

## Validation

- [x] `bash scripts/ci-preflight.sh` (use `--base origin/<base-branch>`
for a non-`main` base)
- [x] Durable preflight hooks are installed with `bash
scripts/install-git-hooks.sh`

## Maintainer checklist

- [ ] This PR is ready for review by @jatmn.
- [ ] Security-sensitive changes are called out in the summary.
- [ ] The PR should only be merged by @jatmn.

## Summary by Sourcery

Make nightly tag creation resilient to transient App-token visibility
failures while preserving fail-closed receipt and orphan-recovery
guarantees.

Bug Fixes:
- Allow nightly tag creation to recover from classified post-create
App-token 404s by peeling with the workflow job token and only retain
receipts when the peeled SHA matches the selected source.
- Improve prepare failures for orphan nightly tags by reporting the tag,
peeled SHA, absent release ID, and recovery confirmation requirements.

Enhancements:
- Clarify release automation and maintainer guidance for token-scoped
tag reads and orphan transaction recovery.
- Extend nightly tag and prepare harnesses and workflow policy
validation to cover fallback peels, persistent failures, SHA mismatches,
and orphan diagnostics.

Documentation:
- Document the job-token fallback for post-create peels and the required
recovery procedure for orphan nightly tags.

Tests:
- Add coverage for successful job-token fallback, fail-closed behavior
when fallback is unavailable, SHA mismatches, and detailed orphan
diagnostics.