[sfmskywalker]

Server hosts omitted the Dashboard API module, Dashboard clients omitted the configured authentication handler, and standalone Studio referenced the wrong scoped stylesheet. Enable the existing API, pass the backend configuration to each Dashboard client, fix the stylesheet references, and require authenticated Dashboard JSON plus CSS/JS assets in the image smoke gate.

Add an explicit correction path for defects discovered after publication. A full dispatch from main can name the prior successful publication run; the publisher verifies its exact receipt archive and all eight live version tags before replacing only the recorded old manifests with verified candidates. Unknown or missing tags block all writes, retries accept already-corrected manifests, and the new receipt preserves the previous run and digest evidence. Prior publications from main, the matching version tag, and GitHub release events retain their verified event/ref provenance. Normal publication still rejects conflicting version tags; latest and Elsa 4 tags are excluded.

Validation: 44 Python tests pass normally and under -O; actionlint and diff checks pass. Actual local Docker hosts pass protected API smoke with both 3.8.4 and 3.9.0 packages. Real browser login/dashboard checks pass for hosted WebAssembly on both versions and standalone WebAssembly on 3.9.0, including bearer authentication and stylesheet requests. The correction loader verified the actual prior 3.9.0 run and GitHub receipt ZIP without registry writes.

[sfmskywalker]

@greptileai

[sfmskywalker]

Independent review: APPROVE + HIGH @ 7dc734d. Reviewed the integrated host/authentication/CSS fixes, strict smoke evidence and audited correction path. All 40 focused tests pass. Actual local Docker/browser checks independently pass for 3.8.4 and 3.9.0 hosted WebAssembly and 3.9.0 standalone WebAssembly; authenticated Dashboard requests carry the bearer header and return JSON. No blocking findings.

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds dashboard API integration and container image correction workflow.

No unresolved blocking findings remain; the reviewed changes are safe to merge.

What we checked:

• Wrong prior source is rejected: The receipt must match the prior run's commit, accepted ref, and event. A matching branch name alone cannot make a branch receipt pass as a tag receipt.

Summary

This PR repairs Dashboard API registration, passes backend settings to Dashboard clients, fixes Studio stylesheet links, and adds a guarded path to correct published container images.

• The latest changes accept prior successful release events and matching-version tag dispatches while keeping the correction itself restricted to main.
• Prior receipts retain their actual event and ref, with checks against the publication run and artifact metadata.
• Added tests cover supported prior publications and mismatched tags, receipts, and artifact metadata.
• The previous recovery-path finding is fixed: the loader and receipt checks now accept the supported publication sources and their corresponding receipt inputs.
• No new actionable issues were found. No unresolved blocking findings remain.

_{Reviews (2) · Last reviewed commit: "Accept tagged container publication corr..." · Reviewed by Greptile}

[sfmskywalker]

@greptileai

[sfmskywalker]

Independent review: APPROVE + HIGH @ b3cfeb5. Reviewed the recovery delta from 7dc734d: release-event receipt inputs match the actual producer, prior exact-tag dispatches accept complete image selections, and artifact metadata matches the live GitHub API contract. Corrections remain main-only; canonical provenance, ancestry, archive integrity and destination checks remain intact. All 44 tests pass normally and under -O; actionlint passes. No blocking findings.