[robgruen]

Summary

Add the owner-requested command feedback without changing acceptance authority or starting implementation automatically.

• Add a thumbs-up to an Issue or Discussion /typechat accept command only after the exact canonical accepted-work record is confirmed.
• Preserve duplicate-free acceptance, including existing-record and final-recheck paths. A failed reaction is reported explicitly; a still-valid retry can restore it without reposting or editing accepted work.
• Add the native rocket reaction for eligible /typechat build startup. It does not indicate successful validation or completion.
• Confine reaction-write permissions to trusted activation. The coding agent, detector, and generated checks retain read-only repository access; App credential boundaries are unchanged.
• Update the operator documentation and distinguish the live pilot's successful test gating from still-unverified automated PR publication.

Validation

• 279 focused offline protocol/workflow tests pass on Node 24.22.1.
• New regressions cover confirmed-only reactions, Issue and Discussion targets, valid retries, reaction errors, invalid responses, rejected approvals, uncertain publication, and the final-write race.
• Pinned gh-aw v0.93.5 compilation succeeds with zero warnings and identical output on a repeat compilation.
• Compiled-workflow tests verify the rocket binding and the exact trusted-activation permission exception.
• Whitespace checks pass. No dependency or runtime-version changes.
• All 14 current-head CI checks pass, including aggregate CodeQL and the real isolated-container smoke test. Copilot reports no open issues, while requesting closer owner review of the activation permission boundary and controlled live reaction validation before rollout.

Operational state

The coding activation flag remains unset. These reactions are not yet live-verified; deployment requires human review and merge. This PR does not authorize another coding run, alter accepted scope, merge a PR, or close an issue.

[Copilot]

🔵 Needs a closer look

Trusted activation gains repository-write permissions, leaving the permission boundary and unverified Issue/Discussion reaction paths requiring owner review and controlled live validation before rollout.

No open issues 🎉

What changed in this PR

Adds feedback for owner acceptance and build commands without changing acceptance authority or automatically starting implementation.

Changes:

• Adds thumbs-up reactions after confirmed acceptance, with retry handling that avoids duplicate acceptance records.
• Enables rocket reactions for eligible build startup, confining reaction-write permissions to trusted activation.
• Adds regression coverage and updates operator guidance to distinguish startup, acceptance, and verified publication.

File	Description
tools/​tests/​implementation-workflow.test.mjs	Checks rocket configuration and activation-only write permissions.
tools/​tests/​discussion-draft.test.mjs	Covers acceptance reactions, retries, failures, and publication races.
tools/​discussion-draft.mjs	Acknowledges confirmed acceptance and reports reaction failures.
OWNER-CHEATSHEET.md	Explains reaction meanings and safe acceptance retries.
AUTOMATION.md	Documents acknowledgment behavior, permission boundaries, and live-pilot status.
.github/​workflows/​issue-implementation.md	Enables the native rocket startup reaction.
.github/​workflows/​issue-implementation.lock.yml	Adds the compiled reaction step and activation permissions.

_{Review effort: Balanced}