[anilkreddy]

Render cleanup success, failure and warning messages in Slack and Teams with all 14 input names, authentication values always redacted, all aggregate counts, safe failure explanations and warning issues. Successful apply reports accepted deletion requests rather than physical removal; dry-run reports zero actual requests.

Cleanup-only presentation sections preserve complete input context within provider bounds. Public API origins remain visible, oversized previews show explicit truncation, repository context remains, and older cleanup events identify unreported fields. Existing webhook delivery is reused and all 32 non-cleanup golden payloads remain unchanged.

Published dependency and bundle

Notify now pins the actual GitHub Packages @commercekit-tools/notification-contract@0.0.5, with a regenerated registry lockfile and standalone bundle. The temporary candidate override has been removed; no permanent local links or fake registry versions are used.

• Authorized publication: action-kit run 43667757934, source 7cc2e8e6af46e7438064cc6205b22f4f7154eb94.
• Independently verified registry version 0.0.5, shasum dba01de9635ba79f14ac2bb477c8c828dd4d223f, integrity sha512-SMcyyWaeHdtlztt99xtWlJycSAspSTGvCaWJH7M2+u+on77JHwo8boTBOc9UUC0BQHDPo/VHmOj4gpt/XIbqmw==.
• Registry integrity matches the reviewed exact-source candidate from action-kit 3f9e418556b190bb8d55ac11a22f554e2c51a4a5; historical candidate evidence is archived in the validation report.
• Notify upgrade commit: 20abc47b1408d100b1986830b2ec8b55f02357fc.
• Bundle SHA256: 6c49cb5e49fcdd62d4c6993f4d31d67fb729825e98ee760dac9f8d2e09ffca2f, byte-identical to the reviewed candidate bundle.

Validation

PASS using Node 24.21.0 and pnpm 12.6.0 against the published registry package:

• pnpm install --no-frozen-lockfile, then pnpm install --frozen-lockfile.
• pnpm bundle and complete pnpm quality: formatting, lint, strict types, all 19 schema fixtures, 107 tests in 12 files with zero skips, bundle byte consistency, public scan and production dependency audit.
• Six actual standalone-bundle tests cover success/failure/warning through both providers using mocked fetch, without runtime package installation or registry credentials.
• Coverage: 97.94% statements, 90.18% branches, 98.07% functions, 99.34% lines. Existing thresholds and source inclusion were not weakened. New cleanup helper: 100% statements/functions/lines and 92.4% branches.
• Public scan: 90 files; audit: no known vulnerabilities; git diff --check: PASS; all 32 non-cleanup golden snapshots unchanged.

Full evidence and remaining gates.

Hosted quality run 43668192744, CodeQL run 43668192753, and the processed PR CodeQL check all passed on exact head 20abc47b1408d100b1986830b2ec8b55f02357fc. The owner-authorized green merge produced main 6331ff4a60956a3a2b546e84d737c9338ca46bda. Post-merge CI 43668309374 and CodeQL 43668309332 also passed; processed main analysis 2169549990 has empty error/warning fields and no open main CodeQL alerts. The dependency-publication blocker is resolved; Notify remains unreleased. Live provider smoke was not run for this change, and production SAP eligibility/cleanup approvals remain separate producer gates. No live webhook delivery, real SAP operation, production cleanup enablement, Action release, release tag or deployment was performed.

Companion review set: action-kit #12, cleanup #7, Notify #18. This PR was merged only after all checks passed; no protection or checks were bypassed.