[rodchalski]

Objective

Recover customer deployments from temporary PP errors without weakening the human approval gate. Prepare deploy-gate v2.4.0.

Changes

• Verify through bounded non-redeeming reads before any redemption; retry transport, gateway, rate-limit and temporary GitHub policy-read failures.
• Deploy mode waits for approval or eligible human renewal by default and resumes automatically. PR mode still returns missing approvals immediately.
• Stop on auth, scope, policy and signing refusals. Never replay a final redemption or trust a partial transfer.
• Approval timeouts cannot trigger non-production fail-open. Ambiguous redemption returns PP_REDEMPTION_UNCERTAIN.

Permission Protocol impact

Improves client deployment reliability while preserving receipt scope and single-use authorization (INV-10, INV-16). No approval bypass, automatic signing or TTL extension. App/server and internal release recovery: https://github.com/permission-protocol/app/pull/792.

Tests run

• bash test/run-tests.sh: 140 assertions passed, zero failures; gh/curl/date/sleep stubbed, no external calls.
• git diff --check: passed.
• Build: not applicable; this is a Bash composite action with no package/build step.

Risk

Deploy mode now waits up to 30 minutes for a signature; wait-for-approval: false keeps immediate missing/expired responses. Persistent outages time out closed. An ambiguous final redemption requires inspection. Publishing v2.4.0 and updating v2 requires this exact change to pass the required approval gate first.

Review focus

Read-only retry loop, exact PR/head/environment/capability scope, permanent refusals, human renewal and single-attempt redemption. Existing PRs #47 and #48 also edit action.yml but address separate behavior; no changes from those PRs are included.

[github-actions]

✅ Permission Protocol: Approved
View receipt →

[permission-protocol]

🔒 Permission Protocol

Approval request cancelled. This PR no longer has an active approval request.

Request: cmvli1ji900nv2tfco3c23xdw

Reason: This PR was merged before Permission Protocol approval completed.

No approval is possible or required for this closed PR.

_{🔒 Permission Protocol · Decision: approval request cancelled because the PR closed}