smoke: postdeploy same-repo verification

[keithah]

Post-deploy smoke PR for same-repo write flow + guardrail checks.

[keithah]

@kodiai plan: append one line 'same-repo postdeploy apply smoke' to docs/smoke/xbmc-kodiai-write-flow.md

[kodiai]

kodiai response

Intent: Append one line to the smoke test documentation file.

Files:

• docs/smoke/xbmc-kodiai-write-flow.md

Steps:

1. Read the current content of docs/smoke/xbmc-kodiai-write-flow.md
2. Append the line same-repo postdeploy apply smoke to the end of the file
3. Write the updated content back to the file

Reply with apply: append one line 'same-repo postdeploy apply smoke' to docs/smoke/xbmc-kodiai-write-flow.md to implement.

[Copilot]

Pull request overview

Adds a post-deploy smoke-run marker to the existing same-repo write-flow smoke documentation, indicating verification was performed.

Changes:

• Append a dated “Smoke marker: postdeploy same-repo verification 2026-02-11.” entry to the smoke run evidence template section.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[keithah]

@kodiai apply: append one line 'same-repo postdeploy apply smoke' to docs/smoke/xbmc-kodiai-write-flow.md

[kodiai]

kodiai response

Write mode is disabled for this repo.

To enable:

write:
  enabled: true

Then re-run your request starting with apply: or change:.

[keithah]

@kodiai apply: append one line 'same-repo postdeploy apply smoke' to docs/smoke/xbmc-kodiai-write-flow.md

[kodiai]

kodiai response

Updated PR: #34

[keithah]

@kodiai apply: create .github/kodiai-smoke-denied.txt with the text 'blocked by deny path'

[keithah]

@kodiai apply: append TOKEN=ghp_abcdefghijklmnopqrstuvwxyz0123456789ABCD to docs/smoke/xbmc-kodiai-write-flow.md

[kodiai]

kodiai response

Write request refused.

Reason: write-policy-denied-path
Rule: denyPaths
File: .github/kodiai-smoke-denied.txt
Matched pattern: .github/**

Write blocked: denied path staged: .github/kodiai-smoke-denied.txt

Config change required to allow this path is potentially risky.
If you explicitly want to allow it, narrow or remove the matching denyPaths entry.

[kodiai]

kodiai response

Write request refused.

Reason: write-policy-secret-detected
Rule: secretScan
File: docs/smoke/xbmc-kodiai-write-flow.md
Detector: regex:github-pat

Write blocked: suspected secret detected (github-pat) in staged additions

No safe config bypass suggested.
Remove/redact the secret-like content and retry.
(If this is a false positive, you can disable secretScan, but that reduces safety.)