Issue #3650 ยท release announce rail

Fail before the live release post

The release announce rail now sends an authenticated platform dry-run before a live POST. It catches a missing, retired, or unreachable credential without creating drafts or publishing content.

Try a credential state

Select a simulated result. This page has no token and makes no network request.

What the preflight does

  • Uses the same release facts and bearer credential as the live request.
  • Sets dry_run: true, so the platform composes but does not create drafts.
  • Uses a 10 second abort signal for both preflight and live POSTs.

What it does not do

  • It does not rotate a credential.
  • It does not reveal a token in the workflow or this page.
  • It does not bypass the platform's human approval flow.

Operator recovery path

For a rejected token, rotate the canonical 1Password item through the estate chokepoint, validate the result, then update only the GitHub repository secret.

HQ_API_TOKEN="$(~/.claude/hooks/op-read.sh --cache 3600 \
  op://Platform/API-Static-Token/credential)"
op_read_status=$?
if [[ "$op_read_status" -ne 0 || -z "$HQ_API_TOKEN" ]]; then exit 1; fi
printf '%s' "$HQ_API_TOKEN" | gh secret set HQ_API_TOKEN --repo yonatangross/orchestkit
unset HQ_API_TOKEN

The real rail reports the exact reference when the secret is missing or the platform returns 401. A manual dispatch with dry_run: true remains local and skips the preflight.