[CamSoper]

Proposed changes

#22287's pre-merge review errored after a clean model pass. The publish job's pinned-comment.sh refused the author card: 110,327 bytes against the 60,000-byte budget.

Root cause: that branch was cut on 2026-10-12, a day before the card budget landed in #22269. The initial review lane runs build-evidence.py from the PR head, so the head's old copy built the card and never measured it. The publish job uses the default branch's pinned-comment.sh, which enforces the budget, but it never re-fit the card. (The update lane already runs default-branch tooling, so it doesn't have this gap.) This is the same "workflow from master, scripts from the PR head" problem the workflow already works around for --pr-diff, --approval-scope, and ack-request.sh.

Changes:

• build-evidence.py gets a --fit AUTHOR BRIEF mode. It fits two finished cards in place with the existing fit_author_card / fit_brief_card and exits. A card that already fits comes back byte-identical.
• The publish job runs it from its default-branch checkout right before pinned-comment.sh. It's best-effort: if the fit itself fails, the size check is still the backstop, so a publish that would have worked before still works.
• New regression test in test_card_budget.py: it builds an unfitted card the way an older head would, runs the CLI on it, checks the card fits, keeps every row, and passes validate-pinned.py, and checks the no-op case. The test fails against the current build-evidence.py (unrecognized arguments: --fit).
• README section and the pinned-comment.sh error hint now mention the publish-time fit.

Replayed against #22287's real handoff artifact: the card went from 110,267 to 35,262 bytes (❓ links and ❓ Do-this blocks shed). All 4 🚨 and 114 ❓ rows are kept, and the fitted card passes validate-pinned.py. Nothing is lost: the old head's build() already copied every Do-this block into evidence detail, and the evidence page shows them.

make test-review-pipeline passes. make lint doesn't cover these files (.github/ and *.md are prettier-ignored, and the markdown lint only checks content/).

Note for #22287 itself: its review will still run its own stale composer until the branch merges master. With this change the card publishes anyway, but merging master into that branch would also pick up the current card wording (the old card still tells authors to use the retired @claude … #update-review form).

Related issues (optional)

• Document Pulumi Agents and reorganize Infrastructure AI docs #22287 (the failing review)
• Keep oversized review cards publishable and ask about private-source claims once #22269 (introduced the card budget)

---

Generated by Claude Code

[github-actions]

Sentinel — merge gate status

2 of 5 gates need attention before this can merge.

	Gate	What it needs
🔴	G1 review-ran	No current review for 0bee4d8de — comment /update-review <what changed> to refresh it, or /new-review for a fresh one.
➖	G2 findings-answered	Doesn't apply to this PR: no review present — see G1.
🔴	G3 right-approver	Needs an approval from anyone with write access to this repo — no qualifying human approval at this head (bot approvals count only on the automated lanes bot_approvers lists).
➖	G4 infra-evidence	Doesn't apply to this PR: no changed path affects the deploy.
➖	G5 oversized-ack	Doesn't apply to this PR: not oversized.

Break glass: a member of a routing team (.github/review-routing.yml teams:) can apply review:waived, which is logged.

_{Evaluated at head 0bee4d8de.}

---

Need help, or think a gate got it wrong? Ask in #docs on Slack.

[pulumi-bot]

Your site preview for commit 0bee4d8 is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-22386-0bee4d8d.s3-website.us-west-2.amazonaws.com