ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"Confirmed and fixed in 3a290f9. Verified the premise on a real package: `microsoft.netcore.platforms 1.1.0` downloaded from the nuget.org flat container contains a 9482-byte `.signature.p7s` (the repository signature) that a freshly packed `.nupkg` does not — so the served checksum differs from the attested bytes, and `gh attestation verify` against a nuget.org download would indeed fail.\\n\\nRather than attest post-signing bytes (which would mean push → wait for nuget.org indexing → download → attest — timing-fragile, and it would attest *after* publishing), the release now publishes the **exact attested bytes** as GitHub Release assets:\\n\\n* attestation still runs before any publication, on the locally packed `artifacts/*.nupkg` / `*.snupkg`;\\n* after the NuGet push, `gh release create \\\"v$VERSION\\\" artifacts/*.nupkg artifacts/*.snupkg --generate-notes` (with a `|| gh release upload --clobber` fallback) attaches those same bytes to the release (`gh` is preinstalled, so no new action to pin; `contents` bumped read → write);\\n* the READMEs now tell verifiers to `gh attestation verify` the **Release** asset, and to verify the nuget.org copy via its repository signature (`dotnet nuget verify`) instead.\\n\\nEnd-to-end proof needs a real tag push (OIDC + tag), so that comes on the next release run; the repository-signing mechanism itself is verified above.\\n\\n---\\n_Generated by [Claude Code](https://claude.ai/code)_\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":123}{\"type\":\"pull_request_comment\",\"body\":\"@codex Any thoughts about the fix ?\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Target workflow-dispatch release tags at the built commit**\\n\\nIn the `workflow_dispatch` path, this command creates `v$VERSION` if it does not already exist, but the `gh release create` manual says missing tags are auto-created from the latest default-branch state unless `--target` is supplied. If a manual release is run from a hotfix/release branch or selected SHA, the packages and attestations are built from `github.sha` while the GitHub Release tag/source archive points at a different commit, breaking the release provenance story; pass `--target \\\"$GITHUB_SHA\\\"` or require an existing tag with `--verify-tag`.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":160}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `3a290f9c42`\\n \\n\\n

ℹ️ About Codex in GitHub

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"Confirmed and fixed in c58d9d7. The premise checks out against the gh CLI's own help text: a missing tag is auto-created \\\"from the latest state of the default branch\\\", and `--target` points the automatic tag creation elsewhere.\\n\\nAdded `--target \\\"$GITHUB_SHA\\\"` so a dispatch-created tag lands on the exact commit this job built and attested — the release tag, source archive and attested packages now all reference the same commit even when dispatched from a hotfix branch or an older SHA. On the tag-push path the tag already exists and `--target` is ignored, so that path is unchanged.\\n\\n`--verify-tag` was considered and rejected: it would abort dispatch releases outright, and releasing without a pre-pushed tag is precisely what that path exists for.\\n\\n---\\n_Generated by [Claude Code](https://claude.ai/code)_\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":160}","text_elements",[],{"_376":562,"_357":358,"_378":364},{"_379":563,"_381":-5,"_42":-5,"_382":-5,"_383":-5,"_96":306,"_92":385},[564],{"_46":558,"_92":565},"input_text",{"_376":567,"_357":358,"_378":364},{"_379":568,"_381":-5,"_42":-5,"_382":-5,"_383":-5,"_96":306,"_92":385},[569],{"_46":570,"_92":565},"\n /workspace/first-class-errors\n bash\n 2026-07-10\n Etc/UTC\n",{"_376":572,"_357":358,"_378":364},{"_379":573,"_381":-5,"_42":-5,"_382":-5,"_383":-5,"_96":574,"_92":385},[575,576],"developer",{"_46":578,"_92":565},{"_46":577,"_92":565},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_357":358,"_87":581},{"_103":-5,"_42":364,"_365":582,"_367":368,"_369":583},[],"inProgress",{"_369":585,"_357":358},{"_586":587,"_92":588},"activeFlags",[],"active","thread/started",{"_591":592},"thread",{"_593":-5,"_594":-5,"_595":596,"_597":368,"_421":422,"_598":15,"_599":-5,"_600":-5,"_42":358,"_601":602,"_181":-5,"_603":-5,"_161":604,"_605":199,"_606":-5,"_426":607,"_369":608,"_609":-5,"_77":610,"_611":368},"agentNickname","agentRole","cliVersion","0.128.0","createdAt","ephemeral","forkedFromId","gitInfo","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/07/10/rollout-2026-07-10T16-12-55-019f4ccd-adf4-7f51-8182-a6ef6ffcbba7.jsonl","preview","recencyAt","vscode",{"_92":373},"threadSource",[],"updatedAt",[],"messages",[615],{"_42":616,"_617":618,"_619":620,"_621":620,"_379":622,"_369":623,"_381":-5,"_624":32,"_625":626,"_627":628,"_629":-5},"d38202ee-0974-4acb-96c3-a3431cc2d07d","author",{"_96":306,"_181":-5,"_625":638},"create_time",1783699974.861501,"update_time",{"_634":46,"_635":636},"finished_successfully","weight","metadata",{"_630":631},"recipient","all","channel","l1239dk1",{"_632":633},"inline_comments",[],"content_type","parts",[637],"@codex Any thoughts about the new fix ?\nRelease supply chain: build provenance + embedded SBOM\n\n## Summary\r\n\r\nAdd two verifiable supply-chain guarantees to published packages: a signed SLSA **build-provenance** attestation, and an **SPDX SBOM** embedded inside each `.nupkg`. Both reuse the OIDC identity the release already relies on for NuGet trusted publishing.\r\n\r\n## Type of change\r\n\r\n* [ ] Bug fix\r\n* [ ] New feature\r\n* [ ] Breaking change\r\n* [ ] Refactoring\r\n* [ ] Analyzer / diagnostic change\r\n* [ ] Tests\r\n* [ ] Documentation\r\n* [x] Build / CI / tooling\r\n\r\n## Changes\r\n\r\n* **SBOM** (`FirstClassErrors.csproj`, `FirstClassErrors.Testing.csproj`): reference `Microsoft.Sbom.Targets` 4.1.5 (`PrivateAssets=all`, build-time only). `release.yml`'s pack step passes `-p:GenerateSBOM=true`, so each published package embeds its SPDX 2.2 manifest at `_manifest/spdx_2.2/manifest.spdx.json`. The flag is passed only in the workflow, never hardcoded in the csproj — local packs and the floor-check job's throwaway pack stay fast and SBOM-free.\r\n* **Provenance** (`release.yml`): after pack and before push, `actions/attest-build-provenance` (SHA-pinned, v4.1.1) signs an attestation binding each artifact's SHA-256 to this repository, workflow, commit and runner via Sigstore. Adds the `attestations: write` permission (`id-token: write` was already granted). Running before the push guarantees only attested artifacts reach nuget.org.\r\n* **Docs** (`README.md` + `doc/README.fr.md`): a \"Supply chain\" section describing both guarantees, with the `gh attestation verify` command, kept in sync EN/FR.\r\n\r\n## Testing\r\n\r\n* [x] `dotnet build FirstClassErrors.sln`\r\n* [x] `dotnet test FirstClassErrors.sln`\r\n* [ ] Analyzer tests pass (`FirstClassErrors.Analyzers.UnitTests`) — run as part of the full `dotnet test` below\r\n\r\nVerified locally on the .NET 10 SDK, replaying the release sequence (`build -p:Version` then `pack --no-build -p:GenerateSBOM=true`) under the CI warning ratchet (`GITHUB_ACTIONS=true`):\r\n\r\n* both packages build and pack green with **0 warnings / 0 errors**, and each embeds an SPDX 2.2 manifest;\r\n* the core package's SBOM inventories its 9 shipped files (including the bundled analyzer at `analyzers/dotnet/cs`) and its build components (the NETStandard closure + the SBOM tool);\r\n* packing **without** the flag produces no manifest, confirming local/floor packs are unaffected;\r\n* full test suite passes — 559 tests across 4 test projects.\r\n\r\nNot verifiable locally: the provenance attestation needs the GitHub OIDC runtime, so its end-to-end proof is the next release run. Known SBOM limitation: the component detector covers package-manager components, so `Testing`'s SBOM does not list the sibling `FirstClassErrors` ProjectReference — the nuspec (which consumers resolve against) declares it authoritatively.\r\n\r\n## Documentation\r\n\r\n* [x] README / `doc/` updated\r\n* [x] French translation (`doc/README.fr.md`) updated\r\n\r\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Attest the bytes NuGet will serve**\n\nBecause this action runs before `dotnet nuget push`, it records SHA-256s for the locally packed `.nupkg`s. For packages downloaded from NuGet.org, this will not verify: NuGet.org repository-signs new submissions by modifying the uploaded package to add `.signature.p7s`, so the served `.nupkg` has a different digest and the documented `gh attestation verify ...` command fails for every published package. Move the attestation after publishing and downloading the canonical NuGet-served package, or otherwise attest those post-signing bytes.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `e779bdff60`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\nConfirmed and fixed in 3a290f9. Verified the premise on a real package: `microsoft.netcore.platforms 1.1.0` downloaded from the nuget.org flat container contains a 9482-byte `.signature.p7s` (the repository signature) that a freshly packed `.nupkg` does not — so the served checksum differs from the attested bytes, and `gh attestation verify` against a nuget.org download would indeed fail.\n\nRather than attest post-signing bytes (which would mean push → wait for nuget.org indexing → download → attest — timing-fragile, and it would attest *after* publishing), the release now publishes the **exact attested bytes** as GitHub Release assets:\n\n* attestation still runs before any publication, on the locally packed `artifacts/*.nupkg` / `*.snupkg`;\n* after the NuGet push, `gh release create \"v$VERSION\" artifacts/*.nupkg artifacts/*.snupkg --generate-notes` (with a `|| gh release upload --clobber` fallback) attaches those same bytes to the release (`gh` is preinstalled, so no new action to pin; `contents` bumped read → write);\n* the READMEs now tell verifiers to `gh attestation verify` the **Release** asset, and to verify the nuget.org copy via its repository signature (`dotnet nuget verify`) instead.\n\nEnd-to-end proof needs a real tag push (OIDC + tag), so that comes on the next release run; the repository-signing mechanism itself is verified above.\n\n---\n_Generated by [Claude Code](https://claude.ai/code)_\n@codex Any thoughts about the fix ?\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Target workflow-dispatch release tags at the built commit**\n\nIn the `workflow_dispatch` path, this command creates `v$VERSION` if it does not already exist, but the `gh release create` manual says missing tags are auto-created from the latest default-branch state unless `--target` is supplied. If a manual release is run from a hotfix/release branch or selected SHA, the packages and attestations are built from `github.sha` while the GitHub Release tag/source archive points at a different commit, breaking the release provenance story; pass `--target \"$GITHUB_SHA\"` or require an existing tag with `--verify-tag`.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `3a290f9c42`\n \n\n

ℹ️ About Codex in GitHub

\nConfirmed and fixed in c58d9d7. The premise checks out against the gh CLI's own help text: a missing tag is auto-created \"from the latest state of the default branch\", and `--target` points the automatic tag creation elsewhere.\n\nAdded `--target \"$GITHUB_SHA\"` so a dispatch-created tag lands on the exact commit this job built and attested — the release tag, source archive and attested packages now all reference the same commit even when dispatched from a hotfix branch or an older SHA. On the tag-push path the tag already exists and `--target` is ignored, so that path is unchanged.\n\n`--verify-tag` was considered and rejected: it would abort dispatch releases outright, and releasing without a pre-pushed tag is precisely what that path exists for.\n\n---\n_Generated by [Claude Code](https://claude.ai/code)_",{},"created",1783700027.071841,"Completing the task","event_type","info",{"_92":385,"_96":93,"_379":1087},{"_92":646,"_647":648},"partial_repo_snapshot","files",[649,650,651],{"_161":951,"_653":-5,"_654":952,"_656":-5},{"_161":464,"_653":-5,"_654":826,"_656":-5},{"_161":652,"_653":-5,"_654":655,"_656":-5},"doc/README.fr.md","contents","line_range_contents",[657],"missing_reason",{"_658":659,"_660":661,"_379":662,"_663":59},"line_range_start",1,"line_range_end",242,[664,199,665,666,199,667,668,669,670,671,672,199,673,199,674,199,675,199,676,199,677,199,678,679,680,681,199,682,199,683,199,684,685,686,687,688,199,689,199,690,691,692,693,199,694,199,695,199,696,199,697,199,698,699,700,701,199,702,199,703,704,199,705,199,706,199,707,199,708,709,710,711,712,199,713,199,714,715,716,199,717,199,718,199,719,720,721,722,723,199,724,199,725,199,726,199,727,728,729,199,730,199,731,199,732,199,733,734,735,736,737,738,739,740,741,199,742,199,743,199,744,199,745,746,747,748,199,749,199,750,751,752,753,199,754,199,755,199,756,757,199,758,199,759,760,199,761,199,762,199,763,199,733,764,765,199,766,767,768,769,770,771,772,773,774,199,775,776,777,778,779,780,781,782,774,199,783,784,774,785,741,199,786,199,733,787,741,199,788,199,789,199,790,199,791,792,793,794,795,199,796,199,797,199,798,199,799,199,800,199,801,199,802,199,803,804,805,199,806,199,807,199,808,199,809,199,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825],"contains_end_of_file","# FirstClassErrors","🌍 **Langues:** ","🇬🇧 [English](../README.md) | 🇫🇷 Français (ce fichier)","[![ci](https://github.com/Reefact/first-class-errors/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Reefact/first-class-errors/actions/workflows/ci.yml)","[![codeql](https://github.com/Reefact/first-class-errors/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/Reefact/first-class-errors/actions/workflows/codeql.yml)","[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=reefact_first-class-errors&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=reefact_first-class-errors)","[![Couverture](https://sonarcloud.io/api/project_badges/measure?project=reefact_first-class-errors&metric=coverage)](https://sonarcloud.io/summary/new_code?id=reefact_first-class-errors)","![.NET Standard 2.0](https://img.shields.io/badge/.NET%20Standard-2.0-512BD4)","[![Licence : Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](../LICENSE)","---","**Transformez vos erreurs en connaissance structurée et vivante sur votre système.**","![FirstClassErrors](./images/first-class-errors.png \"FirstClassErrors\")","FirstClassErrors est une bibliothèque .NET qui considère les erreurs comme des concepts de premier ordre, documentés et diagnostiquables — pas seulement comme des chaînes de caractères lancées à l’exécution.","Elle vous aide à :","* exprimer les erreurs de manière cohérente et structurée","* associer des diagnostics utiles à chaque erreur","* garder la documentation des erreurs proche du code","* générer automatiquement une documentation humaine des erreurs","## 🚨 Le problème","Dans la plupart des systèmes, les erreurs sont :","* dispersées dans le code","* décrites par des messages ad hoc","* peu ou pas documentées","* difficiles à analyser","* déconnectées du support et des opérations","Avec le temps, cela entraîne :","* des investigations répétées","* du savoir implicite (“tribal knowledge”)","* des équipes support qui devinent","* des développeurs qui réexpliquent sans cesse les mêmes erreurs","## 💡 L’idée","Et si :","> **Chaque erreur de votre système était explicitement décrite, structurée et documentée — directement dans le code — et que cette documentation pouvait être générée automatiquement ?**","FirstClassErrors introduit :","* un **modèle d’erreur enrichi**","* un **système de diagnostics structurés**","* un **DSL pour documenter les erreurs**","* un **pipeline d’extraction de documentation**","Les erreurs deviennent :","> non seulement des échecs,","> mais des **unités de connaissance documentées**.","## 🧱 Ce que fournit la bibliothèque","### 1️⃣ Un modèle d’erreur plus riche","Les erreurs portent :","* un code d’erreur stable","* un horodatage","* trois messages distincts — un résumé public court (obligatoire), un détail public optionnel et un message de diagnostic interne (obligatoire)","* des données de contexte","* des diagnostics structurés","L’exception, elle, n’expose que son `.Error`, et est conçue pour être :","* loguées de manière cohérente","* comprises par des humains","* exploitées par des outils","#### Trois messages, trois publics","Une `Error` sépare délibérément ce qui peut être montré à un appelant de ce qui est destiné aux développeurs et au support :","| Message | Obligatoire | Public | Exposition |","| --- | --- | --- | --- |","| `ShortMessage` | Oui | Utilisateurs finaux / clients d’API | Un résumé public court, exposable tel quel (par ex. le `title` d’un problem detail RFC 9457). |","| `DetailedMessage` | Non | Utilisateurs finaux / clients d’API | Un détail public maîtrisé (par ex. le `detail` d’un problem detail RFC 9457), exposé **uniquement** si l’application le décide explicitement. Ne doit contenir aucune information sensible ou interne. |","| `DiagnosticMessage` | Oui | Logs, support, développeurs | Le message de diagnostic interne. Il peut contenir des détails techniques/opérationnels (identifiants, valeurs fautives, état interne) ; il n’est **jamais** exposé aux clients externes par défaut. |","Le cœur du modèle est agnostique vis-à-vis d’HTTP : `DiagnosticMessage` n’est jamais utilisé comme corps de réponse HTTP par défaut, et `type` et `status` restent l’affaire de l’application. Lorsqu’une erreur est exposée en HTTP, son `Code` est le `type` RFC 9457 naturel : exposez-le comme un URI stable tel que `urn:problem:{service}:{code}`, où `{code}` est le code d’erreur en minuscules et en kebab-case — par exemple `urn:problem:temperature-simulator:temperature-below-absolute-zero` ou `urn:problem:banking-api:money-transfer-amount-not-positive` — afin que les clients puissent aiguiller sur le type de problème. Lorsque vous transformez une erreur en exception avec `.ToException()`, le `Exception.Message` obtenu est le `DiagnosticMessage` — le texte destiné aux développeurs et aux logs.","### 2️⃣ Des diagnostics structurés","Chaque erreur peut déclarer des **causes possibles** et des **pistes d’analyse** :","* Qu’est-ce qui a pu provoquer cette erreur ?","* Est-elle plutôt liée aux données d’entrée, au système, ou aux deux ?","* Par où commencer l’investigation ?","Les diagnostics orientent l’analyse sans figer les processus opérationnels.","### 3️⃣ Un DSL pour décrire les erreurs","Les erreurs sont documentées directement dans le code via une API fluide :","```csharp","return DescribeError.WithTitle(\"Temperature below absolute zero\")"," .WithDescription(\"This error occurs when trying to instantiate a temperature with a value that is below absolute zero.\")"," .WithRule(\"Temperature cannot go below absolute zero because absolute zero is the point where particles have minimum possible energy.\")"," .WithDiagnostics(ValueObjectDiagnostic.Diagnostic)"," .WithExamples("," () => BelowAbsoluteZero(-1, TemperatureUnit.Kelvin),"," () => BelowAbsoluteZero(-280, TemperatureUnit.Celsius));","```","Il ne s’agit pas de simples commentaires — c’est de la **documentation structurée et exécutable**.","### 4️⃣ Extraction de la documentation","La bibliothèque fournit un mécanisme pour analyser les assemblies et extraire toute la documentation d’erreurs déclarée :","* liée aux classes de factories d’erreur","* liée aux méthodes factory","* enrichie par des exemples","* prête à être rendue","Cela permet de générer :","* des catalogues d’erreurs en Markdown ou JSON (ou tout format personnalisé via un renderer)","* de la documentation orientée support","* une documentation vivante générée depuis le code","* des catalogues multilingues (optionnel) — voir [Internationalisation](Internationalisation.fr.md)","## 🔁 Exception ou pas ? À vous de choisir.","La bibliothèque supporte à la fois :","* **les erreurs levées** (flux classique par exceptions)","* **les erreurs transportées sans être levées** via `Outcome` et `Outcome`","Cela vous permet de traiter la même erreur, au choix :","> comme un signal d’exécution que vous levez","> ou comme une donnée structurée que vous transportez","selon le contexte (domaine, validation, pipelines, etc.).","## 🧩 Exemple","Extrait du projet `FirstClassErrors.Usage` :","[ProvidesErrorsFor(nameof(Temperature))]","public static class InvalidTemperatureError {"," [DocumentedBy(nameof(BelowAbsoluteZeroDocumentation))]"," internal static DomainError BelowAbsoluteZero(decimal invalidValue, TemperatureUnit invalidValueUnit) {"," return DomainError.Create("," Code.TemperatureBelowAbsoluteZero,"," diagnosticMessage: $\"Failed to instantiate temperature: the value {invalidValue} {invalidValueUnit} is below absolute zero.\")"," .WithPublicMessage("," shortMessage: \"Temperature is below absolute zero.\","," detailedMessage: \"The provided temperature is below absolute zero, which is not physically valid.\");"," }"," private static ErrorDocumentation BelowAbsoluteZeroDocumentation() {"," return DescribeError.WithTitle(\"Temperature below absolute zero\")"," .WithDescription(\"This error occurs when trying to instantiate a temperature with a value that is below absolute zero.\")"," .WithRule(\"Temperature cannot go below absolute zero because absolute zero is the point where particles have minimum possible energy.\")"," .WithDiagnostics(ValueObjectDiagnostic.Diagnostic)"," .WithExamples("," () => BelowAbsoluteZero(-1, TemperatureUnit.Kelvin),"," () => BelowAbsoluteZero(-280, TemperatureUnit.Celsius));"," private static class Code {"," public static readonly ErrorCode TemperatureBelowAbsoluteZero = ErrorCode.Create(\"TEMPERATURE_BELOW_ABSOLUTE_ZERO\");","}","La factory retourne une `Error` structurée. Lorsque vous devez la lever, vous la transformez en exception avec `.ToException()` :","throw InvalidTemperatureError.BelowAbsoluteZero(-1, TemperatureUnit.Kelvin).ToException();","Ici, l’erreur, sa signification, sa règle, ses diagnostics et des exemples de messages sont définis ensemble — dans le code.","## 🎯 Pour qui ?","FirstClassErrors est particulièrement utile si :","* vous développez des systèmes métiers complexes","* vous vous souciez de la supportabilité","* vous voulez une gestion d’erreurs cohérente","* vous souhaitez une documentation qui ne dérive pas du code","* vous concevez avec une approche orientée domaine","## 🔍 Analyseurs","FirstClassErrors est livré avec un ensemble d’analyseurs Roslyn (identifiants de règle `FCExxx`) **inclus dans le package NuGet** — référencez le package et ils s’exécutent au build, sans installation supplémentaire. Ils détectent, avant toute exécution, les erreurs que le runtime ou le pipeline de documentation ne feraient sinon apparaître que tard, voire silencieusement : codes d’erreur dupliqués, références `[DocumentedBy]` qui ne résolvent pas, erreurs documentées qui n’atteignent jamais le catalogue, et plus encore.","> **Prérequis compilateur :** les analyseurs inclus sont compilés contre Roslyn 4.8 ; ils se chargent donc dans tout hôte à partir du **SDK .NET 8 / Visual Studio 2022 17.8**. Les SDK/IDE plus anciens ne peuvent pas les charger.","Voir la [référence des règles d’analyse](analyzers/README.fr.md).","## 🔐 Chaîne d’approvisionnement","Chaque package publié est construit et poussé par [`release.yml`](../.github/workflows/release.yml) avec deux garanties vérifiables :","- **Provenance de build signée** ([SLSA](https://slsa.dev)) — chaque package est attesté au moment du build, liant son empreinte à ce dépôt, au commit exact et à l’exécution du workflow. Les octets attestés sont attachés à la [GitHub Release](https://github.com/Reefact/first-class-errors/releases) correspondante ; téléchargez-y le `.nupkg` et vérifiez avec :"," ```bash"," gh attestation verify FirstClassErrors..nupkg --repo Reefact/first-class-errors"," ```"," (nuget.org sert une copie signée par le dépôt, d’empreinte différente : vérifiez **celle-ci** plutôt avec `dotnet nuget verify`.)","- **SBOM embarqué** — chaque package contient son inventaire logiciel SPDX (*software bill of materials*) à `_manifest/spdx_2.2/manifest.spdx.json`, recensant les fichiers livrés et les composants tiers utilisés pour le construire.","## 📚 Étapes suivantes","Consultez la documentation complète :","- [Premiers pas](GettingStarted.fr.md)","- [Principes de conception](DesignPrinciples.fr.md)","- [Quand ne pas utiliser FirstClassErrors](WhenNotToUseFirstClassErrors.fr.md)","- [Concepts fondamentaux](CoreConcepts.fr.md)","- [Guide du contexte d’erreur](ErrorContext.fr.md)","- [Guide d’écriture des erreurs](WritingErrorsGuide.fr.md)","- [Cas d’usage](UsagePatterns.fr.md)","- [Bonnes pratiques](BestPractices.fr.md)","- [Guide des tests](Testing.fr.md)","- [Intégration CI/CD et exploitation](OperationalIntegration.fr.md)","- [Architecture du pipeline de documentation](ArchitectureOfTheDocumentationPipeline.fr.md)","- [Écrire son propre renderer](WritingACustomRenderer.fr.md)","- [Internationalisation](Internationalisation.fr.md)","- [Comparaison avec les librairies de gestion d’erreurs](ComparisonWithOtherLibraries.fr.md)","- [Règles d’analyse (FCExxx)](analyzers/README.fr.md)","- [FAQ](FAQ.fr.md)",[827],{"_658":659,"_660":661,"_379":828,"_663":59},[664,199,829,830,199,667,668,669,831,671,832,199,673,199,833,199,834,199,835,199,836,199,837,838,839,840,199,841,199,842,199,843,844,845,846,847,199,848,199,849,850,851,852,199,853,199,854,199,855,199,856,199,857,858,859,860,199,861,199,862,863,199,864,199,865,199,866,199,867,868,869,870,871,199,872,199,873,874,875,199,876,199,877,199,878,720,879,880,881,199,882,199,883,199,884,199,885,886,887,199,888,199,889,199,890,199,733,734,735,736,737,738,739,740,741,199,891,199,892,199,893,199,894,895,896,897,199,898,199,899,900,901,902,199,903,199,904,199,905,906,199,907,199,908,909,199,910,199,911,199,912,199,733,764,765,199,766,767,768,769,770,771,913,914,774,199,775,776,777,778,779,780,781,782,774,199,783,784,774,785,741,199,915,199,733,787,741,199,916,199,917,199,918,199,919,920,921,922,923,199,924,199,925,199,926,199,927,199,928,199,929,199,930,199,803,804,805,199,931,199,932,199,933,199,934,199,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950],"🌍 **Languages:** ","🇬🇧 English (this file) | 🇫🇷 [Français](./doc/README.fr.md)","[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=reefact_first-class-errors&metric=coverage)](https://sonarcloud.io/summary/new_code?id=reefact_first-class-errors)","[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](./LICENSE)","**Turn your errors into structured, living knowledge about your system.**","![FirstClassErrors](./doc/images/first-class-errors.png \"FirstClassErrors\")","FirstClassErrors is a .NET library that treats errors as first-class, documented, and diagnosable concepts — not just strings thrown at runtime.","It helps you:","* express errors in a consistent and structured way","* attach meaningful diagnostics to each error","* keep error documentation close to the code","* generate human-readable error documentation automatically","## 🚨 The problem","In most systems, errors are:","* scattered across the codebase","* described by ad-hoc messages","* poorly documented","* hard to troubleshoot","* disconnected from support and operations","Over time, this leads to:","* duplicated investigations","* tribal knowledge","* support teams guessing","* developers reinventing error explanations","## 💡 The idea","What if:","> **Every error in your system was explicitly described, structured, and documented — directly in code — and that documentation could be generated automatically?**","FirstClassErrors introduces:","* a **rich error model**","* a **structured diagnostic system**","* a **DSL to document errors**","* a **documentation extraction pipeline**","Errors become:","> not just failures,","> but **documented knowledge units**.","## 🧱 What this library provides","### 1️⃣ A richer error model","The `Error` carries:","* a stable error code","* a timestamp","* three distinct messages — a mandatory public short summary, an optional public detail, and a mandatory internal diagnostic message","* contextual data","* structured diagnostics","The exception itself only exposes its `.Error`, and is designed to be:","* logged consistently","* understood by humans","* used by tooling","#### Three messages, two audiences","An `Error` carries three messages but deliberately splits them across just **two audiences** — a public one (end users / API clients) and an internal one (logs, support, developers). The separation is enforced by construction, so what reaches a caller can never leak what is meant for developers and support:","| Message | Mandatory | Audience | Exposure |","| `ShortMessage` | Yes | End users / API clients | A short public summary, safe to surface as-is (e.g. the `title` of an RFC 9457 problem detail). |","| `DetailedMessage` | No | End users / API clients | A controlled public detail (e.g. the `detail` of an RFC 9457 problem detail), exposed **only** when the application explicitly chooses to. Must not carry sensitive or internal information. |","| `DiagnosticMessage` | Yes | Logs, support, developers | The internal diagnostic message. May contain technical/operational detail (identifiers, offending values, internal state); it is **never** exposed to external clients by default. |","The core model is HTTP-agnostic: `DiagnosticMessage` is never used as a default HTTP response body, and `type` and `status` remain the application's concern. When an error is exposed over HTTP, its `Code` is the natural RFC 9457 `type`: surface it as a stable URI such as `urn:problem:{service}:{code}`, where `{code}` is the error code in lowercase kebab-case — for example `urn:problem:temperature-simulator:temperature-below-absolute-zero` or `urn:problem:banking-api:money-transfer-amount-not-positive` — so clients can branch on the problem type. When you turn an error into an exception with `.ToException()`, the resulting `Exception.Message` is the `DiagnosticMessage` — the developer- and log-facing text.","### 2️⃣ Structured diagnostics","Each error can declare **possible causes** and **analysis leads**:","* What might have caused this error?","* Is it likely input-related, system-related, or both?","* Where should investigation start?","Diagnostics guide troubleshooting without hardcoding operational processes.","### 3️⃣ A DSL to describe errors","Errors are documented directly in code using a fluent API:","This is not just comments — it is **structured, executable documentation**.","### 4️⃣ Documentation extraction","The library includes a mechanism to scan assemblies and extract all declared error documentation:","* linked to error factory classes","* linked to factory methods","* enriched with examples","* ready to be rendered","This enables:","* Markdown or JSON error catalogs (or any custom format via a renderer)","* support-oriented documentation","* living documentation generated from code","* multi-language catalogs (opt-in) — see [Internationalization](doc/Internationalization.en.md)","## 🔁 Exception or not? You choose.","The library supports both:","* **throwing errors** (traditional exception flow)","* **transporting errors without throwing** via `Outcome` and `Outcome`","This lets you treat the same error either way:","> as a runtime signal you throw","> or as structured data you transport","depending on the context (domain logic, validation, pipelines, etc.).","## 🧩 Example","From the `FirstClassErrors.Usage` project:"," shortMessage: \"Temperature is invalid.\","," detailedMessage: $\"The temperature {invalidValue} {invalidValueUnit} is below absolute zero.\");","The factory returns a structured `Error`. When you need to throw it, you turn it into an exception with `.ToException()`:","Here, the error, its meaning, its rule, its diagnostics, and example messages are all defined together — in code.","## 🎯 Who is this for?","FirstClassErrors is especially useful if:","* you build complex business systems","* you care about supportability","* you want consistent error handling","* you want documentation that doesn’t drift from code","* you design with domain-driven thinking","## 🔍 Analyzers","FirstClassErrors ships with a set of Roslyn analyzers (rule ids `FCExxx`) **bundled in the NuGet package** — reference the package and they run at build time, no extra install. They catch, before you run anything, the mistakes the runtime or the documentation pipeline would otherwise surface late or silently: duplicate error codes, `[DocumentedBy]` references that don't resolve, documented errors that never reach the catalog, and more.","> **Compiler requirement:** the bundled analyzers are compiled against Roslyn 4.8, so they load in any host from **.NET 8 SDK / Visual Studio 2022 17.8** onward. Older SDKs/IDEs cannot load them.","See the [analyzer rules reference](doc/analyzers/README.md).","## 🔐 Supply chain","Every released package is built and published by [`release.yml`](.github/workflows/release.yml) with two verifiable guarantees:","- **Signed build provenance** ([SLSA](https://slsa.dev)) — each package is attested at build time, binding its checksum to this repository, the exact commit and the workflow run. The attested bytes are attached to the matching [GitHub Release](https://github.com/Reefact/first-class-errors/releases); download the `.nupkg` from there and verify with:"," (nuget.org serves a repository-signed copy with a different checksum, so verify **that** one with `dotnet nuget verify` instead.)","- **Embedded SBOM** — each package carries its SPDX software bill of materials at `_manifest/spdx_2.2/manifest.spdx.json`, inventorying the files it ships and the third-party components it was built from.","## 📚 Next steps","See the full documentation:","- [Getting Started](doc/GettingStarted.en.md)","- [Design Principles](doc/DesignPrinciples.en.md)","- [When Not to Use FirstClassErrors](doc/WhenNotToUseFirstClassErrors.en.md)","- [Core Concepts](doc/CoreConcepts.en.md)","- [Error Context Guide](doc/ErrorContext.en.md)","- [Writing Errors Guide](doc/WritingErrorsGuide.en.md)","- [Usage Patterns](doc/UsagePatterns.en.md)","- [Best Practices](doc/BestPractices.en.md)","- [Testing Guide](doc/Testing.en.md)","- [CI/CD and Operational Integration](doc/OperationalIntegration.en.md)","- [Architecture of the Documentation Pipeline](doc/ArchitectureOfTheDocumentationPipeline.en.md)","- [Writing a custom renderer](doc/WritingACustomRenderer.en.md)","- [Internationalization](doc/Internationalization.en.md)","- [Comparison with error-handling libraries](doc/ComparisonWithOtherLibraries.en.md)","- [Analyzer rules (FCExxx)](doc/analyzers/README.md)","- [FAQ](doc/FAQ.en.md)",".github/workflows/release.yml",[953],{"_658":659,"_660":954,"_379":955,"_663":59},162,[956,199,957,958,959,960,961,962,963,964,965,966,199,967,968,969,970,199,971,972,973,974,975,976,977,978,979,199,980,981,982,983,984,199,985,986,987,988,989,990,991,199,992,993,994,995,199,996,997,998,999,1000,1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1013,1021,1022,199,1023,1024,199,1025,1003,1026,1027,199,1028,1029,199,1030,1031,1032,1033,1034,1035,1036,1003,1026,1007,1037,1038,199,1039,1040,994,1041,1042,1043,1044,1045,1046,1047,199,1048,1049,1050,1051,1052,1053,1054,1055,1056,994,1057,1045,1046,199,1058,1059,1060,1061,1062,1063,1064,994,1065,199,1066,1003,1067,1007,1068,1069,1070,1071,199,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1003,1082,1026,1007,1083,1084,1085,1086],"name: release","on:"," push:"," # Publish on semantic-version tags, e.g. v1.2.3 or v1.2.3-beta.1."," tags:"," - 'v*.*.*'"," workflow_dispatch:"," inputs:"," version:"," description: 'Package version to publish, without the leading \"v\" (e.g. 1.2.3)'"," required: true","# Never publish the same ref twice concurrently.","concurrency:"," group: release-${{ github.ref }}"," cancel-in-progress: false","permissions:"," # Create the GitHub Release and upload the attested .nupkg/.snupkg as its assets (see the publish step)."," contents: write"," # Allow the job to request a GitHub OIDC token, exchanged for a short-lived NuGet API key"," # via trusted publishing (no long-lived NUGET_API_KEY secret is stored)."," id-token: write"," # Store the signed build-provenance attestations in the repository's attestation store,"," # so anyone can verify a released package with `gh attestation verify`."," attestations: write","env:"," DOTNET_NOLOGO: 'true'"," DOTNET_CLI_TELEMETRY_OPTOUT: 'true'"," DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'"," NUGET_FEED: 'https://api.nuget.org/v3/index.json'","jobs:"," pack-push:"," name: Pack & push NuGet"," runs-on: ubuntu-latest"," steps:"," - name: Checkout"," uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7"," - name: Setup .NET"," uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5"," with:"," dotnet-version: '10.0.x'"," - name: Resolve version"," id: version"," shell: bash"," # Read the (attacker-controllable) tag name and manual input via the environment rather than interpolating"," # ${{ ... }} straight into the script, and validate the result against a strict SemVer allowlist. A tag such"," # as \"v1.2.3;id\" is a valid Git ref that matches the v*.*.* trigger, so an unchecked value could inject shell"," # commands into every step that uses it."," env:"," EVENT_NAME: ${{ github.event_name }}"," INPUT_VERSION: ${{ github.event.inputs.version }}"," REF_NAME: ${{ github.ref_name }}"," run: |"," if [ \"$EVENT_NAME\" = \"workflow_dispatch\" ]; then"," VERSION=\"$INPUT_VERSION\""," else"," # REF_NAME is the tag name (e.g. v1.2.3); strip the leading \"v\"."," VERSION=\"${REF_NAME#v}\""," fi"," # Build metadata (+...) is deliberately REJECTED even though SemVer allows it: NuGet strips it"," # from the package identity, so a tag like v1.2.3+build5 packs as FirstClassErrors.1.2.3.nupkg."," # If 1.2.3 were already published, the push's --skip-duplicate would then turn this release into"," # a green no-op that publishes nothing. Better to fail loudly here than to \"succeed\" silently."," if ! printf '%s' \"$VERSION\" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then"," echo \"::error::Invalid version '$VERSION'; expected a SemVer value like 1.2.3 or 1.2.3-beta.1 (build metadata '+...' is not allowed: NuGet drops it from the package identity).\""," exit 1"," echo \"version=$VERSION\" >> \"$GITHUB_OUTPUT\""," echo \"Resolved package version: $VERSION\""," - name: Restore"," run: dotnet restore FirstClassErrors.sln"," - name: Build"," VERSION: ${{ steps.version.outputs.version }}"," run: dotnet build FirstClassErrors.sln -c Release --no-restore -p:Version=\"$VERSION\""," - name: Test"," run: dotnet test FirstClassErrors.sln -c Release --no-build --logger \"console;verbosity=normal\""," # Only the two projects that carry NuGet identity are packed. The analyzer ships"," # bundled inside the main package, and the CLI / worker / samples are not published."," # GenerateSBOM activates Microsoft.Sbom.Targets (referenced by both packable projects): each"," # package embeds its SPDX inventory at _manifest/spdx_2.2/manifest.spdx.json. Deliberately"," # passed only HERE, not hardcoded in the csproj, so local packs and the floor-check job's"," # throwaway pack stay fast and SBOM-free — only published artifacts carry one."," - name: Pack"," dotnet pack FirstClassErrors/FirstClassErrors.csproj -c Release --no-build -p:Version=\"$VERSION\" -p:GenerateSBOM=true -o artifacts"," dotnet pack FirstClassErrors.Testing/FirstClassErrors.Testing.csproj -c Release --no-build -p:Version=\"$VERSION\" -p:GenerateSBOM=true -o artifacts"," - name: Upload packages as build artifacts"," uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7"," name: nupkgs"," # Keep the symbol packages (.snupkg) alongside the .nupkg so a release run's artifacts"," # mirror exactly what is pushed to nuget.org (dotnet nuget push sends both)."," path: |"," artifacts/*.nupkg"," artifacts/*.snupkg"," if-no-files-found: error"," # SLSA build provenance: sign an attestation binding each artifact's SHA-256 to this repository,"," # workflow, commit and runner (via Sigstore + the job's OIDC identity), and store it in the repo's"," # attestation store. The attestation covers the bytes packed HERE — which are published verbatim as"," # GitHub Release assets below. It deliberately does NOT match the nuget.org copy: nuget.org repository-"," # signs every upload (adds a .signature.p7s inside the .nupkg), changing the checksum, so consumers"," # verify provenance against the Release asset and the nuget.org signature via `dotnet nuget verify`."," # Runs BEFORE both publications on purpose: only attested artifacts are ever released or pushed."," - name: Attest build provenance"," uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1"," subject-path: |"," # Trusted publishing: exchange the job's OIDC token for a short-lived, single-use NuGet API key."," # Requires a trusted publishing policy on nuget.org (owner Reefact / repo first-class-errors /"," # workflow release.yml) for each published package, and the NUGET_USER secret set to the nuget.org"," # account username (profile name, not the email address)."," - name: NuGet login (OIDC)"," id: nuget-login"," uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1"," user: ${{ secrets.NUGET_USER }}"," - name: Push to NuGet"," NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}"," dotnet nuget push \"artifacts/*.nupkg\" \\"," --api-key \"$NUGET_API_KEY\" \\"," --source \"$NUGET_FEED\" \\"," --skip-duplicate"," # Publish the exact attested artifacts as GitHub Release assets — the byte-for-byte bytes the"," # provenance attestation covers, so `gh attestation verify .nupkg` succeeds against them"," # (unlike the nuget.org copy, which is repository-signed). `gh` is preinstalled on the runner, so no"," # extra action is pinned. On a tag push the tag already exists (--target is then ignored); on"," # workflow_dispatch the tag is missing and `gh` would otherwise auto-create it from the DEFAULT"," # branch's latest state — --target \"$GITHUB_SHA\" pins it to the commit this job actually built and"," # attested, so the release tag, source archive and attested packages all point at the same commit"," # even when dispatched from a hotfix branch or an older SHA. The `|| upload --clobber` fallback"," # keeps a re-run idempotent if the release already exists."," - name: Publish GitHub Release with attested packages"," GH_TOKEN: ${{ github.token }}"," TAG=\"v$VERSION\""," gh release create \"$TAG\" artifacts/*.nupkg artifacts/*.snupkg \\"," --title \"$TAG\" --generate-notes --target \"$GITHUB_SHA\" \\"," || gh release upload \"$TAG\" artifacts/*.nupkg artifacts/*.snupkg --clobber",[1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098],{"_634":46,"_46":1111},{"_634":1100,"_161":951,"_658":1109,"_660":1110},{"_634":46,"_46":1108},{"_634":1100,"_161":951,"_658":1107,"_660":954},{"_634":46,"_46":1106},{"_634":1100,"_161":464,"_658":1103,"_660":1104},{"_634":46,"_46":1105},{"_634":1100,"_161":652,"_658":1103,"_660":1104},{"_634":46,"_46":1102},{"_634":1100,"_161":951,"_658":1101,"_660":954},{"_634":46,"_46":1099},"\n\n### One minor caveat\n\nThe release creation fallback is intentionally idempotent:\n\n```bash\ngh release create ... --target \"$GITHUB_SHA\" \\\n|| gh release upload ... --clobber\n```\n\nThat is fine for reruns where the release already exists. The only tradeoff is that *any* `gh release create` failure falls through to upload, not just “release already exists.” If the first command failed for a transient auth/API reason, the upload will likely fail too, so this is probably acceptable. I do not think it blocks the fix.\n\n### Conclusion\n\nI would be comfortable with the fix as-is. It addresses the original digest mismatch correctly, documents the verification story honestly, and the `--target \"$GITHUB_SHA\"` change closes the manual-dispatch provenance gap.\n\n**Checks performed**\n\n* ✅ `sed -n '1,230p' .github/workflows/release.yml`\n* ✅ `rg -n \"Supply chain|attestation|nuget verify|gh release|--target|attest\" README.md doc/README.fr.md .github/workflows/release.yml`\n* ✅ `nl -ba .github/workflows/release.yml | sed -n '112,164p'`\n* ✅ `nl -ba README.md | sed -n '209,221p'`\n* ✅ `nl -ba doc/README.fr.md | sed -n '209,221p'`\n* ✅ `git status --short` — no local changes made, so I did not commit or open a new PR.","repo_file_citation",148,"\n* The later `--target \"$GITHUB_SHA\"` addition is the right fix for manual `workflow_dispatch` releases. It ensures an auto-created tag points at the exact commit that produced the packages and attestations, rather than GitHub CLI’s default behavior of creating missing tags from the default branch tip. ",213,219,"\n* The French documentation was kept in sync with the same verification split. ","\n* The README guidance now matches that model: users verify the GitHub Release `.nupkg` with `gh attestation verify`, while the NuGet.org copy is verified separately with `dotnet nuget verify` because its checksum can differ after repository signing. ",145,"\n* Publishing the attested artifacts as GitHub Release assets is a good compromise: it preserves the “only attested artifacts are released” ordering while still giving users a stable downloadable artifact that should match `gh attestation verify`. ",112,124,"### Thoughts on the new fix\n\nI think the fix is directionally sound and resolves both review concerns:\n\n* The workflow now clearly distinguishes between the **attested local package bytes** and the **NuGet.org-served package bytes**, which may differ because NuGet repository-signs uploaded packages. The attestation is intentionally made against `artifacts/*.nupkg` and `artifacts/*.snupkg`, before publication, and comments explain that those exact bytes are later published as GitHub Release assets. ",{"_92":306,"_42":84,"_96":306,"_1114":1115,"_1116":1117,"_1118":1119,"_132":-5,"_119":1120},[83],"input_items",[1138,1139,1140,1141,1142,1143,1144,1145,1146],"external_post_config",{"_1121":1122,"_243":244,"_1123":286,"_255":-5,"_1124":237,"_1125":-5,"_1126":1127,"_1128":1129,"_1130":-5,"_1131":-5,"_1132":1133,"_1134":15,"_1135":59,"_1136":54,"_1137":15},"user_model_slug","slug",1783699967.796356,"installation_id",72237377,"pr_number","repo_id","review_trigger","comment_id",4937263042,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",381047789,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_92":385,"_96":306,"_379":1163},{"_293":294,"_295":296,"_1160":300,"_1161":129,"_302":-5,"_92":1162},{"_92":1147,"_295":1159,"_161":951,"_1149":1150,"_1151":1157},{"_92":1147,"_295":1158,"_161":-5,"_1149":-5,"_1151":-5},{"_92":1147,"_295":1156,"_161":951,"_1149":1150,"_1151":1157},{"_92":1147,"_295":1155,"_161":-5,"_1149":-5,"_1151":-5},{"_92":1147,"_295":1154,"_161":951,"_1149":1150,"_1151":1152},{"_92":1147,"_295":1153,"_161":-5,"_1149":-5,"_1151":-5},{"_92":1147,"_295":1148,"_161":951,"_1149":1150,"_1151":1152},"pull_request_comment","Confirmed and fixed in c58d9d7. The premise checks out against the gh CLI's own help text: a missing tag is auto-created \"from the latest state of the default branch\", and `--target` points the automatic tag creation elsewhere.\n\nAdded `--target \"$GITHUB_SHA\"` so a dispatch-created tag lands on the exact commit this job built and attested — the release tag, source archive and attested packages now all reference the same commit even when dispatched from a hotfix branch or an older SHA. On the tag-push path the tag already exists and `--target` is ignored, so that path is unchanged.\n\n`--verify-tag` was considered and rejected: it would abort dispatch releases outright, and releasing without a pre-pushed tag is precisely what that path exists for.\n\n---\n_Generated by [Claude Code](https://claude.ai/code)_","side","RIGHT","line",160,"\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `3a290f9c42`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Target workflow-dispatch release tags at the built commit**\n\nIn the `workflow_dispatch` path, this command creates `v$VERSION` if it does not already exist, but the `gh release create` manual says missing tags are auto-created from the latest default-branch state unless `--target` is supplied. If a manual release is run from a hotfix/release branch or selected SHA, the packages and attestations are built from `github.sha` while the GitHub Release tag/source archive points at a different commit, breaking the release provenance story; pass `--target \"$GITHUB_SHA\"` or require an existing tag with `--verify-tag`.\n\nUseful? React with 👍 / 👎.","@codex Any thoughts about the fix ?","Confirmed and fixed in 3a290f9. Verified the premise on a real package: `microsoft.netcore.platforms 1.1.0` downloaded from the nuget.org flat container contains a 9482-byte `.signature.p7s` (the repository signature) that a freshly packed `.nupkg` does not — so the served checksum differs from the attested bytes, and `gh attestation verify` against a nuget.org download would indeed fail.\n\nRather than attest post-signing bytes (which would mean push → wait for nuget.org indexing → download → attest — timing-fragile, and it would attest *after* publishing), the release now publishes the **exact attested bytes** as GitHub Release assets:\n\n* attestation still runs before any publication, on the locally packed `artifacts/*.nupkg` / `*.snupkg`;\n* after the NuGet push, `gh release create \"v$VERSION\" artifacts/*.nupkg artifacts/*.snupkg --generate-notes` (with a `|| gh release upload --clobber` fallback) attaches those same bytes to the release (`gh` is preinstalled, so no new action to pin; `contents` bumped read → write);\n* the READMEs now tell verifiers to `gh attestation verify` the **Release** asset, and to verify the nuget.org copy via its repository signature (`dotnet nuget verify`) instead.\n\nEnd-to-end proof needs a real tag push (OIDC + tag), so that comes on the next release run; the repository-signing mechanism itself is verified above.\n\n---\n_Generated by [Claude Code](https://claude.ai/code)_",123,"\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `e779bdff60`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Attest the bytes NuGet will serve**\n\nBecause this action runs before `dotnet nuget push`, it records SHA-256s for the locally packed `.nupkg`s. For packages downloaded from NuGet.org, this will not verify: NuGet.org repository-signs new submissions by modifying the uploaded package to add `.signature.p7s`, so the served `.nupkg` has a different digest and the documented `gh attestation verify ...` command fails for every published package. Move the attestation after publishing and downloading the canonical NuGet-served package, or otherwise attest those post-signing bytes.\n\nUseful? React with 👍 / 👎.","base_ref","head_ref","pull_request_info",[1164],{"_634":46,"_46":1165},"@codex Any thoughts about the new fix ?",[1366,1367],[],{"_639":640,"_46":641,"_642":643},{"_613":1357},{"_316":1356},{"_316":1201},{"_285":286,"_276":287,"_288":289,"_290":15,"_291":59,"_292":15,"_293":294,"_295":296,"_297":248,"_298":127,"_299":300,"_301":129,"_302":303,"_304":-5,"_305":-5,"_306":1200,"_308":309,"_310":309,"_311":312,"_313":314},{"_42":123,"_193":194,"_195":196,"_197":15,"_198":199,"_200":201,"_202":1189,"_204":-5,"_205":-5,"_206":1190,"_208":199,"_209":199,"_210":1191,"_212":1192,"_214":1193,"_216":-5,"_217":218,"_219":220,"_221":222,"_223":1194,"_55":-5,"_119":225,"_226":1195,"_228":1196,"_230":231,"_232":15,"_233":15},{"_133":1182},[1176,1177,1178,1179,1180,1181],{"_148":171,"_150":165,"_152":166,"_154":163,"_156":172,"_158":159,"_160":32,"_161":-5},{"_148":170,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":168,"_150":165,"_152":166,"_154":163,"_156":169,"_158":159,"_160":32,"_161":-5},{"_148":164,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":162,"_150":151,"_152":153,"_154":163,"_156":157,"_158":159,"_160":32,"_161":-5},{"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":32,"_161":-5},[1183,1184,1185],{"_177":1188,"_179":190},{"_177":1187,"_179":186},{"_177":1186,"_179":180},{"_181":182,"_92":183,"_119":184},{"_181":187,"_92":183,"_119":188},{"_181":191,"_92":183,"_119":192},{"_278":279,"_280":-5,"_281":-5,"_282":-5,"_283":-5,"_284":-5},[237],{"_237":1197},{},{},[],{"_236":59},{"_234":59,"_235":199},{"_42":239,"_181":240,"_241":1198,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":64,"_256":15,"_257":-5,"_258":-5,"_259":-5,"_260":-5,"_261":-5,"_262":-5,"_160":263,"_264":-5,"_55":1199},{"_270":271,"_42":272,"_92":273,"_274":275,"_276":277},{"_266":15,"_267":15,"_268":15,"_269":15},{"_270":271,"_181":271,"_315":-5,"_274":275,"_42":272},[1202,1203,1204,1205,1206,1207,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233,1234,1235,1236,1237],{"_154":589,"_355":1352},{"_154":370,"_355":1349},{"_154":579,"_355":1346},{"_154":374,"_355":1341},{"_154":374,"_355":1337},{"_154":374,"_355":1333},{"_154":389,"_355":1328},{"_154":389,"_355":1324},{"_154":374,"_355":1320},{"_154":374,"_355":1318},{"_154":389,"_355":1314},{"_154":374,"_355":1312},{"_154":374,"_355":1310},{"_154":389,"_355":1306},{"_154":374,"_355":1304},{"_154":389,"_355":1300},{"_154":374,"_355":1296},{"_154":374,"_355":1294},{"_154":389,"_355":1290},{"_154":374,"_355":1288},{"_154":389,"_355":1284},{"_154":374,"_355":1281},{"_154":374,"_355":1279},{"_154":389,"_355":1274},{"_154":374,"_355":1272},{"_154":389,"_355":1268},{"_154":374,"_355":1264},{"_154":374,"_355":1262},{"_154":389,"_355":1258},{"_154":374,"_355":1256},{"_154":389,"_355":1252},{"_154":374,"_355":1249},{"_154":389,"_355":1247},{"_154":374,"_355":1243},{"_154":370,"_355":1241},{"_154":354,"_355":1238},{"_357":358,"_87":1239},{"_360":361,"_362":363,"_103":-5,"_42":364,"_365":1240,"_367":368,"_369":113},[],{"_369":1242,"_357":358},{"_92":373},{"_376":1244,"_357":358,"_378":364},{"_379":1245,"_381":-5,"_42":-5,"_382":-5,"_383":384,"_96":93,"_92":385},[1246],{"_46":387,"_92":388},{"_376":1248,"_357":358,"_378":364},{"_42":392,"_383":384,"_46":387,"_92":393},{"_376":1250,"_357":358,"_378":364},{"_379":-5,"_396":397,"_42":-5,"_382":-5,"_398":1251,"_92":400},[],{"_376":1253,"_357":358,"_378":364},{"_379":1254,"_42":404,"_398":1255,"_92":400},[],[],{"_376":1257,"_357":358,"_378":364},{"_408":409,"_42":-5,"_382":-5,"_410":411,"_92":412},{"_376":1259,"_357":358,"_378":364},{"_415":416,"_417":418,"_419":1260,"_421":422,"_362":32,"_423":32,"_42":409,"_424":425,"_426":427,"_369":113,"_92":428},[1261],{"_417":430,"_92":431},{"_376":1263,"_357":358,"_378":364},{"_434":435,"_408":409,"_42":-5,"_382":-5,"_181":436,"_437":-5,"_92":438},{"_376":1265,"_357":358,"_378":364},{"_379":-5,"_396":441,"_42":-5,"_382":-5,"_398":1266,"_92":400},[1267],{"_46":444,"_92":445},{"_376":1269,"_357":358,"_378":364},{"_379":1270,"_42":449,"_398":1271,"_92":400},[],[444],{"_376":1273,"_357":358,"_378":364},{"_408":453,"_42":-5,"_382":-5,"_410":454,"_92":412},{"_376":1275,"_357":358,"_378":364},{"_415":457,"_417":458,"_419":1276,"_421":422,"_362":32,"_423":32,"_42":453,"_424":460,"_426":427,"_369":113,"_92":428},[1277,1278],{"_417":468,"_181":469,"_161":470,"_92":471},{"_417":463,"_161":464,"_465":466,"_92":467},{"_376":1280,"_357":358,"_378":364},{"_434":474,"_408":453,"_42":-5,"_382":-5,"_181":436,"_437":-5,"_92":438},{"_376":1282,"_357":358,"_378":364},{"_379":-5,"_396":477,"_42":-5,"_382":-5,"_398":1283,"_92":400},[],{"_376":1285,"_357":358,"_378":364},{"_379":1286,"_42":482,"_398":1287,"_92":400},[],[],{"_376":1289,"_357":358,"_378":364},{"_408":486,"_42":-5,"_382":-5,"_410":487,"_92":412},{"_376":1291,"_357":358,"_378":364},{"_415":490,"_417":491,"_419":1292,"_421":422,"_362":32,"_423":32,"_42":486,"_424":493,"_426":427,"_369":113,"_92":428},[1293],{"_417":495,"_92":431},{"_376":1295,"_357":358,"_378":364},{"_434":498,"_408":486,"_42":-5,"_382":-5,"_181":436,"_437":-5,"_92":438},{"_376":1297,"_357":358,"_378":364},{"_379":-5,"_396":501,"_42":-5,"_382":-5,"_398":1298,"_92":400},[1299],{"_46":504,"_92":445},{"_376":1301,"_357":358,"_378":364},{"_379":1302,"_42":508,"_398":1303,"_92":400},[],[504],{"_376":1305,"_357":358,"_378":364},{"_408":512,"_42":-5,"_382":-5,"_410":513,"_92":412},{"_376":1307,"_357":358,"_378":364},{"_415":516,"_417":517,"_419":1308,"_421":422,"_362":32,"_423":32,"_42":512,"_424":519,"_426":427,"_369":113,"_92":428},[1309],{"_417":521,"_92":431},{"_376":1311,"_357":358,"_378":364},{"_434":524,"_408":512,"_42":-5,"_382":-5,"_181":436,"_437":-5,"_92":438},{"_376":1313,"_357":358,"_378":364},{"_408":527,"_42":-5,"_382":-5,"_410":528,"_92":412},{"_376":1315,"_357":358,"_378":364},{"_415":531,"_417":532,"_419":1316,"_421":422,"_362":32,"_423":32,"_42":527,"_424":534,"_426":427,"_369":113,"_92":428},[1317],{"_417":536,"_92":431},{"_376":1319,"_357":358,"_378":364},{"_434":539,"_408":527,"_42":-5,"_382":-5,"_181":436,"_437":-5,"_92":438},{"_376":1321,"_357":358,"_378":364},{"_379":-5,"_396":542,"_42":-5,"_382":-5,"_398":1322,"_92":400},[1323],{"_46":545,"_92":445},{"_376":1325,"_357":358,"_378":364},{"_379":1326,"_42":549,"_398":1327,"_92":400},[],[545],{"_376":1329,"_357":358,"_378":364},{"_553":-5,"_379":1330,"_42":555,"_92":556},[1331],{"_46":558,"_559":1332,"_92":46},[],{"_376":1334,"_357":358,"_378":364},{"_379":1335,"_381":-5,"_42":-5,"_382":-5,"_383":-5,"_96":306,"_92":385},[1336],{"_46":558,"_92":565},{"_376":1338,"_357":358,"_378":364},{"_379":1339,"_381":-5,"_42":-5,"_382":-5,"_383":-5,"_96":306,"_92":385},[1340],{"_46":570,"_92":565},{"_376":1342,"_357":358,"_378":364},{"_379":1343,"_381":-5,"_42":-5,"_382":-5,"_383":-5,"_96":574,"_92":385},[1344,1345],{"_46":578,"_92":565},{"_46":577,"_92":565},{"_357":358,"_87":1347},{"_103":-5,"_42":364,"_365":1348,"_367":368,"_369":583},[],{"_369":1350,"_357":358},{"_586":1351,"_92":588},[],{"_591":1353},{"_593":-5,"_594":-5,"_595":596,"_597":368,"_421":422,"_598":15,"_599":-5,"_600":-5,"_42":358,"_601":602,"_181":-5,"_603":-5,"_161":604,"_605":199,"_606":-5,"_426":607,"_369":1354,"_609":-5,"_77":1355,"_611":368},{"_92":373},[],[],[1358],{"_42":616,"_617":1359,"_619":620,"_621":620,"_379":1360,"_369":623,"_381":-5,"_624":32,"_625":1361,"_627":628,"_629":-5},{"_96":306,"_181":-5,"_625":1365},{"_634":46,"_635":1364},{"_630":1362},{"_632":1363},[],[637],{},{"_92":385,"_96":93,"_379":1381},{"_92":646,"_647":1368},[1369,1370,1371],{"_161":951,"_653":-5,"_654":1378,"_656":-5},{"_161":464,"_653":-5,"_654":1375,"_656":-5},{"_161":652,"_653":-5,"_654":1372,"_656":-5},[1373],{"_658":659,"_660":661,"_379":1374,"_663":59},[664,199,665,666,199,667,668,669,670,671,672,199,673,199,674,199,675,199,676,199,677,199,678,679,680,681,199,682,199,683,199,684,685,686,687,688,199,689,199,690,691,692,693,199,694,199,695,199,696,199,697,199,698,699,700,701,199,702,199,703,704,199,705,199,706,199,707,199,708,709,710,711,712,199,713,199,714,715,716,199,717,199,718,199,719,720,721,722,723,199,724,199,725,199,726,199,727,728,729,199,730,199,731,199,732,199,733,734,735,736,737,738,739,740,741,199,742,199,743,199,744,199,745,746,747,748,199,749,199,750,751,752,753,199,754,199,755,199,756,757,199,758,199,759,760,199,761,199,762,199,763,199,733,764,765,199,766,767,768,769,770,771,772,773,774,199,775,776,777,778,779,780,781,782,774,199,783,784,774,785,741,199,786,199,733,787,741,199,788,199,789,199,790,199,791,792,793,794,795,199,796,199,797,199,798,199,799,199,800,199,801,199,802,199,803,804,805,199,806,199,807,199,808,199,809,199,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825],[1376],{"_658":659,"_660":661,"_379":1377,"_663":59},[664,199,829,830,199,667,668,669,831,671,832,199,673,199,833,199,834,199,835,199,836,199,837,838,839,840,199,841,199,842,199,843,844,845,846,847,199,848,199,849,850,851,852,199,853,199,854,199,855,199,856,199,857,858,859,860,199,861,199,862,863,199,864,199,865,199,866,199,867,868,869,870,871,199,872,199,873,874,875,199,876,199,877,199,878,720,879,880,881,199,882,199,883,199,884,199,885,886,887,199,888,199,889,199,890,199,733,734,735,736,737,738,739,740,741,199,891,199,892,199,893,199,894,895,896,897,199,898,199,899,900,901,902,199,903,199,904,199,905,906,199,907,199,908,909,199,910,199,911,199,912,199,733,764,765,199,766,767,768,769,770,771,913,914,774,199,775,776,777,778,779,780,781,782,774,199,783,784,774,785,741,199,915,199,733,787,741,199,916,199,917,199,918,199,919,920,921,922,923,199,924,199,925,199,926,199,927,199,928,199,929,199,930,199,803,804,805,199,931,199,932,199,933,199,934,199,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950],[1379],{"_658":659,"_660":954,"_379":1380,"_663":59},[956,199,957,958,959,960,961,962,963,964,965,966,199,967,968,969,970,199,971,972,973,974,975,976,977,978,979,199,980,981,982,983,984,199,985,986,987,988,989,990,991,199,992,993,994,995,199,996,997,998,999,1000,1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1013,1021,1022,199,1023,1024,199,1025,1003,1026,1027,199,1028,1029,199,1030,1031,1032,1033,1034,1035,1036,1003,1026,1007,1037,1038,199,1039,1040,994,1041,1042,1043,1044,1045,1046,1047,199,1048,1049,1050,1051,1052,1053,1054,1055,1056,994,1057,1045,1046,199,1058,1059,1060,1061,1062,1063,1064,994,1065,199,1066,1003,1067,1007,1068,1069,1070,1071,199,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1003,1082,1026,1007,1083,1084,1085,1086],[1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392],{"_634":46,"_46":1111},{"_634":1100,"_161":951,"_658":1109,"_660":1110},{"_634":46,"_46":1108},{"_634":1100,"_161":951,"_658":1107,"_660":954},{"_634":46,"_46":1106},{"_634":1100,"_161":464,"_658":1103,"_660":1104},{"_634":46,"_46":1105},{"_634":1100,"_161":652,"_658":1103,"_660":1104},{"_634":46,"_46":1102},{"_634":1100,"_161":951,"_658":1101,"_660":954},{"_634":46,"_46":1099},[1395,1396,1397,1398,1399,1400,1401,1402,1403],{"_1121":1122,"_243":244,"_1123":286,"_255":-5,"_1124":237,"_1125":-5,"_1126":1127,"_1128":1129,"_1130":-5,"_1131":-5,"_1132":1133,"_1134":15,"_1135":59,"_1136":54,"_1137":15},{"_92":385,"_96":306,"_379":1404},{"_293":294,"_295":296,"_1160":300,"_1161":129,"_302":-5,"_92":1162},{"_92":1147,"_295":1159,"_161":951,"_1149":1150,"_1151":1157},{"_92":1147,"_295":1158,"_161":-5,"_1149":-5,"_1151":-5},{"_92":1147,"_295":1156,"_161":951,"_1149":1150,"_1151":1157},{"_92":1147,"_295":1155,"_161":-5,"_1149":-5,"_1151":-5},{"_92":1147,"_295":1154,"_161":951,"_1149":1150,"_1151":1152},{"_92":1147,"_295":1153,"_161":-5,"_1149":-5,"_1151":-5},{"_92":1147,"_295":1148,"_161":951,"_1149":1150,"_1151":1152},[1405],{"_634":46,"_46":1165},"task_e_6a5119fe5a688320aea3cb7ae2605993",1783699966.353373,"GitHub Mention: Release supply chain: build provenance + embedded SBOM","has_generated_title","has_unread_turn","denormalized_metadata",{"_1437":32,"_1438":1439,"_1440":-5,"_1441":-5,"_1432":1442,"_1443":-5,"_1444":-5,"_1445":-5,"_1446":-5},"task_status_display",{"_1425":1426,"_1427":196,"_130":127,"_1428":-5,"_1429":1430},"creator_workspace","external_pull_requests",[1418],{"_42":1419,"_1420":83,"_1421":1422,"_1423":129},"github-1046229690-80","assistant_turn_id","pull_request",{"_285":286,"_276":287,"_288":289,"_290":15,"_291":59,"_292":15,"_293":294,"_295":296,"_297":248,"_298":127,"_299":300,"_301":129,"_302":303,"_304":-5,"_305":-5,"_306":1424,"_308":309,"_310":309,"_311":312,"_313":314},"codex_updated_sha",{"_270":271,"_181":271,"_315":-5,"_274":275,"_42":272},"latest_turn_status_display",{"_1431":83,"_112":113,"_1432":-5,"_94":1433,"_1434":-5,"_1435":-5,"_1436":1430,"_114":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_1447":-5,"_1448":-5,"_1449":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_1461":1462,"_1463":1464},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",1460],"traceId","7647623191979581477","traceTime",1783894674622]