[efraespada]

Setup now creates .github/actions/copilot-verification-setup/action.yml when it is missing and exposes the existing VERIFICATION_SETUP boolean in the shared terminal/web assistant. Existing project actions and auxiliary files remain consumer-owned and are preserved through installation, workflow upgrades, deselection and batch maintenance. The packaged composite starter fails with customization instructions until the project owner replaces its placeholder.

The review shows create/preserve/blocked, requested activation and the configured trusted main branch. Apply rejects unsafe paths and stale creation plans; exclusive file creation cannot truncate a concurrent file. The upgrade guide separates CLI versions, Action refs and committed workflow updates, and explains customization, trusted-main review, activation, organization reuse/overrides and rollback. Generated files or installer PRs do not establish runtime readiness.

Validation: 707 local suites pass (11,607 tests passed; 35 existing skips), plus two supplemental platform-neutral race regressions, for 99 new VSO cases overall. The new summary policy is exhaustive; the safe file adapter and every repository coverage budget pass. Typecheck, lint, Svelte check, specification/catalog, documentation, workflow, generated-bundle and npm-package validators pass; extracted-package smoke passes. Credential-free browser review covered 1280 px and 375 px, including Spanish; SSR contracts cover all four supported locales.

Review follow-up pins directory traversal and verifies retained descriptor identities so replacing a checked parent cannot redirect creation. Controlled races assert that no transient file appears at the external target. Bundles are generated with dependencies installed inside the isolated checkout and two consecutive builds were identical.

Closes #656. Final-head GitHub checks and review findings must be clear before merging into develop. This PR does not publish a release or install changes into consumer repositories.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~657

Documentation is deployed and generated using docs.page

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 6dd79636fd53; base: 71878d476d2d; reason: protected-path.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 6dd7963. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit f21020d was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Parent replacement can redirect starter creation outside the repository — src/infrastructure/setup_verification_action.ts:46

[vypbot]

Bugbot: review complete

Current status: No active findings on 6dd7963.

Pull request · Verified commit · Workflow run

[codecov-commenter]

Codecov Report

❌ Patch coverage is 92.79279% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.12%. Comparing base (274db40) to head (6dd7963).
⚠️ Report is 1608 commits behind head on develop.

Files with missing lines	Patch %	Lines
src/infrastructure/setup_verification_action.ts	95.16%	0 Missing and 3 partials ⚠️
src/utils/setup_installation_review.ts	81.81%	0 Missing and 2 partials ⚠️
...ication/usecases/actions/initial_setup_workflow.ts	50.00%	0 Missing and 1 partial ⚠️
src/cli/commands/setup_execution.ts	50.00%	0 Missing and 1 partial ⚠️
.../infrastructure/setup_batch_github_read_adapter.ts	88.88%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #657      +/-   ##
===========================================
+ Coverage    90.94%   94.12%   +3.17%     
===========================================
  Files          135      972     +837     
  Lines         6251    31478   +25227     
  Branches      1338     9240    +7902     
===========================================
+ Hits          5685    29628   +23943     
- Misses         172      715     +543     
- Partials       394     1135     +741     

Files with missing lines	Coverage Δ
src/application/contracts/setup_documentation.ts	100.00% <ø> (ø)
...ation/policies/repository_agent_guidance_policy.ts	100.00% <ø> (ø)
src/application/policies/setup_batch_policy.ts	100.00% <100.00%> (ø)
...c/application/policies/setup_configuration_plan.ts	94.28% <100.00%> (ø)
...on/policies/setup_question_documentation_policy.ts	100.00% <100.00%> (ø)
...application/policies/setup_question_guidance_fr.ts	100.00% <ø> (ø)
...ication/policies/setup_question_guidance_policy.ts	100.00% <ø> (ø)
...application/policies/setup_question_guidance_pt.ts	100.00% <ø> (ø)
...c/application/policies/setup_question_labels/fr.ts	100.00% <ø> (ø)
...c/application/policies/setup_question_labels/pt.ts	100.00% <ø> (ø)
... and 22 more

... and 1007 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[efraespada]

/copilot sync-branch --no-agent

[vypbot]

Branch synchronized

develop was merged into feature/656-generate-verification-setup-starter-preserve-consumer-actions-and-expose-wizard-activation and pushed as 6dd79636fd5324b4df7899fa9b2bdb3a3fcf4725.

6 verification checks passed.

[efraespada]

/copilot findings