feat(tooling): attach visual evidence to pull requests

[koala73]

Why

Reviewers can now get the curated E2E screenshot gallery directly in a pull request comment. This uses GitHub CLI 2.99 media attachments and keeps the existing Actions artifacts for traces and videos.

Scope

• Add npm run --silent agent:attach-pr-evidence -- --pr <number> --run-id <run-id> for an authenticated maintainer checkout.
• Verify the live workflow, run, job, artifact, pull request, repository, and tested head before any write.
• Accept only the exact PNG gallery contract, with bounded counts and sizes, explicit alt text, and symlink-safe file reads.
• Use an author-scoped tested-head marker so retries do not create duplicate evidence comments.
• Make the workflow contract test prove that each raw artifact upload follows its source Playwright run and has a distinct name.

Tradeoffs

The publisher is a trusted local command. A normal Actions GITHUB_TOKEN uses a token type that the GitHub CLI attachment client does not accept, so this change adds no long-lived secret or broader workflow permission.

The command rejects fork pull requests, stale heads, failed gallery jobs, expired artifacts, and ambiguous artifact sets. A maintainer must choose the pull request and successful run explicitly.

Blast radius

This change affects local agent tooling and test contracts only. It does not change the browser app, the E2E workflow, the existing object-storage publisher, or production behavior.

Verification

• node --test tests/publish-pr-media-evidence.test.mjs tests/e2e-visual-workflow.test.mjs passed 22 tests.
• Biome passed on all four changed files, and git diff --check origin/main...HEAD passed.
• The installed GitHub CLI 2.99.0 passed the version gate.
• A read-only probe used E2E Visual run 33708959267, downloaded its seven PNGs, validated the live provenance twice, and intercepted the final comment write locally.
• The repository pre-push gate passed, including TypeScript, boundary, changed-test, edge, generated-code, and version checks.

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
worldmonitor	Ignored	Preview	Sep 3, 2026 6:20am UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T06:04:50.762666Z	e1fff5a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.