feat: add deterministic read-only runtime doctor

[efraespada]

/copilot doctor reports seven independent groups of bounded, non-secret configuration and GitHub evidence through typed read-only ports. It separates proven blocked prerequisites from unavailable reads, preserves successful independent facts, and publishes one English/Spanish correlated reply without model, repair, approval or repository mutation authority.

Workflow evidence is pinned to one verified default-branch revision and regular tracked blobs. Explicitly missing files are blocked; malformed or incomplete provider samples remain unavailable, preserving independent successful facts. Conservative literal matrices must have at most 256 jobs; unsupported dynamic evidence remains unavailable. Jobs with directly skipped needs cannot establish eligibility; other dependent runtime outcomes stay unavailable. Unique enabled help issues have no branch/SDD obligation even when their form is incomplete; disabled/conflicting kinds retain their admission block. Approval policy comes from the existing authoritative Variables reader and strict parser, with declared producer health kept separate from verified health.

Validation on 3247da7: 300 distinct Doctor cases; full 603 suites / 8,552 passing tests, 35 existing skips; all global/module budgets, pure matrix 100%, build, TypeScript, lint, documentation/specification and normal commit hooks passed. Six matrix/help regressions and eight policy/catalog regressions failed before correction; the alleged single-at ref defect was disproved and explicitly dismissed through the native command, with quiet replay verified. The Action previously resolved 18 parent conflicts, passed all six checks, regenerated bundles before trusted staging and published aa57311; current-head native checks/review and post-promotion live acceptance remain required.

Closes #461.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~466

Documentation is deployed and generated using docs.page

[vypbot]

Current status: Overall coverage is partial; this snapshot does not prove that all of its findings are resolved.
Last reconciled on 3247da7. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 2595000 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Treat ambiguous content 404s as unavailable — src/data/repository/github/runtime_doctor_repository.ts:42

[vypbot]

Bugbot: review incomplete

Current status: The review of 3247da7 has partial coverage and cannot declare the whole pull request clean.

Action: Do not treat this review as complete. Review the sources under Incomplete coverage and manually inspect omitted items; rerun only after reducing the relevant scope or restoring provider access.

Incomplete coverage

• selection: complete; retained=1
• issue-comments: complete; retained=45
• pull-request-comments: complete; retained=31
• review-threads: complete; retained=23
• diff: complete; retained=45
• previous-findings: complete; retained=1
• human-conversation: partial; retained=28, truncated=2
• rules: complete; retained=1

Pull request · Verified commit · Workflow run

[codecov-commenter]

Codecov Report

❌ Patch coverage is 94.74886% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.09%. Comparing base (b4c70c2) to head (3247da7).

Files with missing lines	Patch %	Lines
...ation/policies/doctor_workflow_condition_policy.ts	85.71%	0 Missing and 5 partials ⚠️
...icies/github_runtime_doctor_presentation_policy.ts	89.36%	2 Missing and 3 partials ⚠️
...plication/usecases/read_copilot_doctor_workflow.ts	94.02%	0 Missing and 4 partials ⚠️
...ata/repository/github/runtime_doctor_repository.ts	95.00%	0 Missing and 4 partials ⚠️
...plication/policies/github_runtime_doctor_policy.ts	99.04%	0 Missing and 1 partial ⚠️
...application/usecases/comment_automation_context.ts	88.88%	0 Missing and 1 partial ⚠️
src/application/usecases/issue_comment_use_case.ts	80.00%	0 Missing and 1 partial ⚠️
src/domain/github_runtime_doctor.ts	96.42%	0 Missing and 1 partial ⚠️
...position/github_runtime_doctor_composition_root.ts	90.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #466      +/-   ##
===========================================
+ Coverage    93.06%   93.09%   +0.03%     
===========================================
  Files          860      869       +9     
  Lines        26574    26997     +423     
  Branches      7660     7810     +150     
===========================================
+ Hits         24730    25132     +402     
- Misses         744      746       +2     
- Partials      1100     1119      +19     

Files with missing lines	Coverage Δ
src/application/policies/agent_activity_policy.ts	100.00% <100.00%> (ø)
...application/policies/copilot_interaction_policy.ts	100.00% <ø> (ø)
...lication/policies/doctor_workflow_matrix_policy.ts	100.00% <100.00%> (ø)
...pplication/policies/publication_message_catalog.ts	100.00% <ø> (ø)
...ion/policies/semantic_result_publication_policy.ts	97.10% <100.00%> (+0.04%)	⬆️
...c/application/ports/github_runtime_doctor_ports.ts	100.00% <100.00%> (ø)
...on/usecases/comment_automation_command_workflow.ts	90.00% <100.00%> (+0.25%)	⬆️
...pplication/usecases/comment_automation_use_case.ts	91.66% <ø> (ø)
...n/usecases/pull_request_review_comment_use_case.ts	97.56% <100.00%> (+0.06%)	⬆️
...y/pull_request/pull_request_approval_repository.ts	91.97% <100.00%> (+0.45%)	⬆️
... and 11 more

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[efraespada]

/copilot fix "runtime_doctor_repository.ts:42:ambiguous-content-404"

[vypbot]

Request could not be completed

Impact: The admitted agent did not produce a usable result.

Action: Inspect the sanitized agent status and retry if appropriate.

Retained state: Existing persisted state and completed external effects were preserved.

Error code: agent.failed

Retryable: Yes

Reference: 9b7dc294-d5ab-4735-8eeb-7a0bea5d175b

[efraespada]

/copilot diagnose El flujo fix del comentario 6112079942 recuperó el head correcto y terminó sin cambios. Investiga el acceso al repositorio desde el sandbox de Windows. Distingue observaciones de hipótesis, indica qué operación de lectura falla y su código de error si puedes reproducirlo. No leas credenciales, perfiles privados ni variables de entorno; no cambies permisos, configuración o archivos.

[vypbot]

The repository read attempt failed before PowerShell or rg ran. The blocked operation was exec_command launching PowerShell with Get-Location and rg --files; the tool returned CreateProcess: Rejected("... rejected: blocked by policy"). No numeric error code was provided.

Verified: This sandbox blocked process creation for the read command, so I could not inspect repository files or reproduce a file-access error.

Hypothesis: The failure is an execution-policy restriction on launching the shell, rather than evidence of a missing repository or denied access to a particular file. The exact restriction and any underlying file-read behavior remain unverified.

Next step: Retry the same read through an approved repository browsing or shell execution path. No credentials, profiles, environment variables, permissions, configuration, or files were accessed or changed.

Request interpreted from Spanish

Interpreted request

The fix flow for the comment 6112079942 recovered the correct head and finished without changes. Investigate repository access from the Windows sandbox. Distinguish observations from hypotheses, and indicate which read operation fails and its error code if you can reproduce it. Do not read credentials, private profiles, or environment variables; do not change permissions, configuration, or files.

Original request

​/copilot diagnose El flujo fix del comentario 6112079942 recuperó el head correcto y terminó sin cambios. Investiga el acceso al repositorio desde el sandbox de Windows. Distingue observaciones de hipótesis, indica qué operación de lectura falla y su código de error si puedes reproducirlo. No leas credenciales, perfiles privados ni variables de entorno; no cambies permisos, configuración o archivos.

[efraespada]

/copilot diagnose Aísla el rechazo previo del shell: al invocar exec_command indica explícitamente login=false, porque este runtime deshabilita los shells de login. Haz únicamente una lectura de existencia del archivo src/data/repository/github/runtime_doctor_repository.ts mediante .NET en PowerShell, sin perfiles, sin credenciales ni variables de entorno y sin modificar nada. Indica si el proceso llega a arrancar y si el archivo existe; distingue el resultado observado de una hipótesis.

[vypbot]

The PowerShell process did not start: the command was rejected by policy before execution. Therefore, the file’s existence was not checked and remains unknown. The rejection alone does not establish that login-shell handling caused the failure.

Request interpreted from Spanish

Interpreted request

Isolate the previous shell rejection: when invoking exec_command, explicitly specify login=false because this runtime disables login shells. Perform only an existence read of the file src/data/repository/github/runtime_doctor_repository.ts using .NET in PowerShell, without profiles, credentials, or environment variables, and without modifying anything. State whether the process starts and whether the file exists; distinguish the observed result from a hypothesis.

Original request

​/copilot diagnose Aísla el rechazo previo del shell: al invocar exec_command indica explícitamente login=false, porque este runtime deshabilita los shells de login. Haz únicamente una lectura de existencia del archivo src/data/repository/github/runtime_doctor_repository.ts mediante .NET en PowerShell, sin perfiles, sin credenciales ni variables de entorno y sin modificar nada. Indica si el proceso llega a arrancar y si el archivo existe; distingue el resultado observado de una hipótesis.

[vypbot]

Current status: Overall coverage is partial; this snapshot does not prove that all of its findings are resolved.
Last reconciled on 3247da7. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 2f496c5 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Workflow check can pass when the Copilot action is unrelated to the trigger — src/application/policies/github_runtime_doctor_policy.ts:47

[vypbot]

Request could not be completed

Impact: The workflow could not complete the requested operation.

Action: Inspect the current state and retry the failed step.

Retained state: Existing persisted state and completed external effects were preserved.

Error code: workflow.failed

Retryable: Yes

Reference: ff3be0d3-19c3-44fa-bfd7-2373fbf40f5f

[efraespada]

/copilot sync-branch

[vypbot]

Request could not be completed

Impact: The workflow could not complete the requested operation.

Action: Inspect the current state and retry the failed step.

Retained state: Existing persisted state and completed external effects were preserved.

Error code: workflow.failed

Retryable: Yes

Reference: 51a32cb2-fe18-464f-93c3-2737f9a543e8

[efraespada]

/copilot sync-branch

[vypbot]

Request could not be completed

Impact: Branch synchronization stopped because workspace validation rejected the resolution (unstaged-changes).

Action: Inspect this validation code in the workflow logs and correct the resolution before retrying /copilot sync-branch.

Retained state: No synchronization commit was pushed; remote branches were preserved.

Error code: workflow.failed

Retryable: Yes

Reference: 7933912a-a9b5-4f2a-847a-af58184a3e51

[efraespada]

/copilot sync-branch

[vypbot]

Branch synchronized

develop was merged into feature/461-dogfooding-add-deterministic-read-only-doctor-command-in-github and pushed as aa573118ca5f8d9020a49e406539fb3bd9b42db6.

The fixer resolved 18 conflicted files.

6 verification checks passed.

[efraespada]

/copilot recheck

[vypbot]

Current status: Overall coverage is partial; this snapshot does not prove that all of its findings are resolved.
Last reconciled on 3247da7. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 2 potential problems when commit aa57311 was analyzed. This snapshot is historical; use the status block above for current state. 2 findings are linked to changed code.

Findings

• low: Large static matrices can be reported as runnable — src/application/policies/doctor_workflow_matrix_policy.ts:11
• low: Help issues can be incorrectly reported as blocked — src/application/usecases/read_copilot_doctor_workflow.ts:44

[efraespada]

/copilot recheck

[vypbot]

Current status: Overall coverage is partial; this snapshot does not prove that all of its findings are resolved.
Last reconciled on 3247da7. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 2 potential problems when commit b205cec was analyzed. This snapshot is historical; use the status block above for current state. 2 findings are linked to changed code.

Findings

• low: Reject the invalid single-@ branch ref — src/domain/github_runtime_doctor.ts:105
• low: Catalog check can pass with unregistered specifications — src/application/policies/github_runtime_doctor_policy.ts:39

[vypbot]

Current status: Overall coverage is partial; this snapshot does not prove that all of its findings are resolved.
Last reconciled on 3247da7. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit b205cec was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: An empty trusted policy read is treated as verified absence — src/domain/github_runtime_doctor.ts:68

[efraespada]

/copilot dismiss "src/domain/github_runtime_doctor.ts:105:accepts-invalid-at-ref"

[vypbot]

1 finding was dismissed.

[efraespada]

/copilot recheck

[vypbot]

Current status: Overall coverage is partial; this snapshot does not prove that all of its findings are resolved.
Last reconciled on 3247da7. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 07689fb was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: A dependent job can be reported as eligible when its prerequisite is skipped — src/application/policies/github_runtime_doctor_policy.ts:87

[efraespada]

/copilot recheck

[efraespada]

/copilot history

[vypbot]

Current status: Overall coverage is partial; this snapshot does not prove that all of its findings are resolved.
Last reconciled on 3247da7. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit d5b5f74 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• low: Treat incomplete repository samples as unavailable — src/application/policies/github_runtime_doctor_policy.ts:22

[vypbot]

Operation history

General conversation comments

Showing 10 supported requests

Operation	Outcome	Evidence
dismiss	Applied	Request · Receipt
sync-branch	Applied	Request · Receipt
sync-branch	Outcome unavailable	Request · Receipt
sync-branch	Outcome unavailable	Request · Receipt
sync-branch	Outcome unavailable	Request · Receipt
sync-branch	Outcome unavailable	Request · Receipt
sync-branch	Outcome unavailable	Request
sync-branch	Outcome unavailable	Request · Receipt
sync-branch	Outcome unavailable	Request · Receipt
sync-branch	Outcome unavailable	Request · Receipt

[efraespada]

/copilot recheck

[efraespada]

Maintainer audit of 3247da7: the native review completed all five diff partitions, reported no new candidates, and reconciled the current finding inventory to open=0, unknown=0, fixed=17, obsolete=4, dismissed=1. Its partial-coverage result is retained: two human SDD answers exceeded the bounded model sample. I read both complete Q1–Q7 answers separately and checked the no-model/no-write, independent evidence, exact-target, absence-versus-unavailable and reply-freshness contracts against the implementation and regression evidence. The full local suite and normal hooks passed 603 suites / 8,552 tests with 35 existing skips and all coverage budgets. Current-head platform and RepoWise checks remain a separate merge gate; this comment is not producer attestation or bot approval.