chore(main): release 1.287.5

[coreplane-infra]

🤖 I have created a release beep boop

1.287.5 (2026-10-06)

Bug fixes

• authz: grant code access without repo memory ownership (#2802) (27c1c8f)
• authz: keep credentials within their agent and repo grants (#2799) (08b791e)
• sandbox: keep backups from releasing private workspaces (#2800) (ccb3fde)
• ship: recover original published work after a lost checkpoint (#2794) (3766041)
• ship: retain ownership admission diagnostics (#2793) (ee30ea8)

---

This PR was generated with Release Please. See documentation.

Polylane reviews this pull request when you ask:

[github-actions]

What merging this release deploys

Deploy targets for 7ec6412: 4 of 4 Workers — memory, bot, resident, sandbox

Worker	Decision	Judged against	Why
memory	deploy	live 9dbcc7d	deploy/cloudflare-memory/worker.ts src/core/authz/grantSets.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/authz/grants.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/authz/types.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/coordinator/contract.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/coordinator/historicalNativeAudit.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/coordinator/instanceStore.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/coordinator/pullOwnership.ts (imported by deploy/cloudflare-memory/worker.ts) … +2 more
bot	deploy	live 9dbcc7d	src/channels/adminCoordinator.ts src/config.ts src/core/authz/authorize.ts src/core/authz/grantSets.ts src/core/authz/grants.ts src/core/authz/policy.ts src/core/authz/predicate.ts src/core/authz/types.ts … +15 more
resident	deploy	live 395d201	deploy/cloudflare-resident/rootOutcome.ts deploy/cloudflare-resident/worker.ts src/core/authz/grantSets.ts (imported by deploy/cloudflare-resident/worker.ts) src/core/authz/grants.ts (imported by deploy/cloudflare-resident/worker.ts) src/core/authz/types.ts (imported by deploy/cloudflare-resident/worker.ts) src/core/branchIdentityBaseline.ts (imported by deploy/cloudflare-resident/worker.ts) src/core/branchStartState.ts (imported by deploy/cloudflare-resident/worker.ts) src/core/coordinator/contract.ts (imported by deploy/cloudflare-resident/worker.ts) … +9 more
sandbox	deploy	live 395d201	deploy/cloudflare-sandbox/worker.ts src/core/trace/attrs.ts (imported by deploy/cloudflare-sandbox/worker.ts) src/execution/sandboxCheckpoint.ts (imported by deploy/cloudflare-sandbox/worker.ts)

Unclassified paths: none.

Judged per Worker against the commit it is serving right now. Re-rendered by the release-please workflow on every merge to main; merging this PR runs deploy all --affected and deploys exactly the Workers marked deploy.

[coreplane-infra]

🤖 Created releases:

• v1.287.5

🌻