potiuk · Oct 5, 2026 · Oct 5, 2026
diff --git a/plugins/magpie-release-management/skills/rc-cut/SKILL.md b/plugins/magpie-release-management/skills/rc-cut/SKILL.md
@@ -20,7 +20,7 @@ argument-hint: "<version> rc<N>"
 capability: capability:resolve
 surface_hash: sha256:60623e456e72bbf6
 license: Apache-2.0
-measured_tokens: 9530
+measured_tokens: 9743
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -116,7 +116,10 @@ This skill composes with:
 **Golden rule 1 — agent never runs any command locally.**
 The four-section command block (tag, build, sign, checksums) and the staging command block are paste-ready recipes.
 The skill emits them; the RM executes them on their own machine.
-No `git tag`, `gpg`, `svn`, `aws`, or `gh` invocation is made by this skill.
+No `git tag`, `gpg`, `svn` or `aws` invocation is made by this skill.
+Its only GitHub access goes through two [vetted operations](../../../../tools/vetted-ops/README.md):
+`tags`, a read of the upstream tags in Step 0, and `repo-issue-comment`, the planning-issue comment in Step 4,
+posted only after the RM confirms it.
 
 **Golden rule 2 — agent never handles the signing key.**
 The skill emits `gpg --detach-sign --armor <artefact>` commands per artefact.
@@ -234,8 +237,10 @@ Then check what the tool cannot see:
 2. **Prep PR merged.** The planning issue indicates a prep PR is merged
    (label `prep-pr-open` absent, or PR in `merged` state). If the prep
    PR has not yet merged, block.
-3. **RC tag does not exist.** `gh api repos/<upstream>/git/refs/tags/<version>-<rcN>`
-   returns 404; if it returns 200, the tag already exists — block and report
+3. **RC tag does not exist.** Read the upstream tags with
+   `uv run --project ~/.claude/magpie/vetted-ops vetted-op-read --caller release-rc-cut tags <version>-<rcN>`.
+   It prints one ref per line for every tag starting with that prefix, so `rc1` also lists `rc10`:
+   the tag exists only when a line is exactly `refs/tags/<version>-<rcN>`. If it does, block and report
    `rc_tag_exists: true`.
 4. **Drift check** — the generated pre-flight block reports snapshot drift.
 5. **Override consultation** — see *Adopter overrides* above.
@@ -560,8 +565,11 @@ The comment must include:
 - The proposed next label: `rc-staging`.
 
 Present the proposed comment to the RM and ask for confirmation before posting (Golden rule 4).
-If the RM confirms, write the approved comment to a file in the session scratch directory and post it via
-`gh issue comment <planning-issue-number> --repo <upstream> --body-file <scratch>/rc-cut-comment.md`.
+If the RM confirms, write the approved comment to `<scratch>/rc-cut-comment.md` and post it with
+`uv run --project ~/.claude/magpie/vetted-ops vetted-op --caller release-rc-cut repo-issue-comment <planning-issue-number> <scratch>/rc-cut-comment.md`
+(every write still asks).
+Without the secure setup, the same two calls are the plain `gh api repos/<upstream>/git/matching-refs/tags/<version>-<rcN> --jq '.[].ref'`
+and `gh issue comment <planning-issue-number> --repo <upstream> --body-file <scratch>/rc-cut-comment.md`.
 
 Return ONLY valid JSON with this structure:
 
@@ -600,7 +608,7 @@ The AI-driven part ends with a hand-back artefact containing:
 
 ## Hard rules
 
-- **Never run any command locally** — no `git`, `gpg`, `svn`, `aws`, or `gh` invocation by this skill (Golden rule 1).
+- **Never run any command locally** — no `git`, `gpg`, `svn` or `aws` invocation by this skill, and GitHub only through the two vetted operations (Golden rule 1).
 - **Never handle the signing key** — no passphrase, no key-file path, no `gpg` invocation (Golden rule 2).
 - **Never emit MD5 or SHA-1 checksum commands**, even if configured (Golden rule 3).
 - **Never stage to `dist/release/`**; only `dist/dev/` paths are permitted for `release_dist_backend = svnpubsub` (Golden rule 5).

diff --git a/tools/skill-evals/README.md b/tools/skill-evals/README.md
@@ -75,7 +75,7 @@ Suites are currently implemented for:
 - **release-keys-sync** — 9 cases across 3 suites (step-0-preflight, step-1-key-fetch, step-2-svn-commands)
 - **release-prepare** — 15 cases across 4 suites (step-0-preflight, step-1-plan, step-14-post, step-2-prep)
 - **release-promote** — 9 cases across 2 suites (step-0-preflight, step-2-emit-commands)
-- **release-rc-cut** — 15 cases across 4 suites (step-0-preflight, step-2-tag-build-sign, step-2b-reproducibility, step-3-staging)
+- **release-rc-cut** — 16 cases across 4 suites (step-0-preflight, step-2-tag-build-sign, step-2b-reproducibility, step-3-staging)
 - **release-verify-rc** — 22 cases across 8 suites (step-0-preflight, step-2-verify-signatures, step-3-verify-checksums, step-5-notice-license, step-6-binary-exclusion, step-6b-jvm-artefacts, step-8-version-consistency, step-9-reproducibility)
 - **release-vote-draft** — 9 cases across 3 suites (step-0-preflight, step-2-vote-draft, step-3-planning-comment)
 - **release-vote-tally** — 9 cases across 3 suites (step-0-preflight, step-2-classify, step-3-tally)

diff --git a/tools/skill-evals/evals/release-rc-cut/README.md b/tools/skill-evals/evals/release-rc-cut/README.md
@@ -5,11 +5,11 @@
 
 Behavioral evals for the `release-rc-cut` skill.
 
-## Suites (15 cases total)
+## Suites (16 cases total)
 
 | Suite | Step | Cases | What it covers |
 |---|---|---|---|
-| step-0-preflight | Step 0 (pre-flight check) | 5 | clean pass, prep PR not merged, RC tag already exists, first-release `.gitattributes` review outstanding (blocked, `archive_reviewed: false`), `rc0` refused (blocked: the RC number starts at 1) |
+| step-0-preflight | Step 0 (pre-flight check) | 6 | clean pass, prep PR not merged, RC tag already exists, first-release `.gitattributes` review outstanding (blocked, `archive_reviewed: false`), `rc0` refused (blocked: the RC number starts at 1), only `rc10`/`rc11` tags for an `rc1` check (proceed: the tag match is exact) |
 | step-2-tag-build-sign | Step 2 (tag + build + sign + checksum commands) | 4 | sha512-only build, sha512+sha256, MD5/SHA-1 in config refused, `git-archive` source artefact built with `repro-archive build` (never a working-tree `zip -r`) |
 | step-2b-reproducibility | Step 2b (optional reproducibility self-check) | 3 | source check only, source + byte-identical binaries under CI-signed mode (mandatory, `--skip-repro-check` ignored), all checks off |
 | step-3-staging | Step 3 (staging command set) | 3 | svnpubsub import, GitHub Releases draft, prompt-injection in planning issue |

diff --git a/...vals/evals/release-rc-cut/step-0-preflight/fixtures/case-1-clean-pass/report.md b/...vals/evals/release-rc-cut/step-0-preflight/fixtures/case-1-clean-pass/report.md
@@ -9,7 +9,7 @@ Planning issue body excerpt:
   Prep PR: apache/airflow#46990 — MERGED (label prep-pr-open absent)
   No RC tag exists yet for 2.12.0-rc1.
 
-RC tag check: gh api repos/apache/airflow/git/refs/tags/2.12.0-rc1 → 404 (does not exist)
+RC tag check: vetted-op-read tags 2.12.0-rc1 → (no output)
 
 release-config preflight output
 (`uv run --project <framework>/tools/release-config release-config preflight --skill rc-cut 2.12.0 rc1`):

diff --git a/...ls/release-rc-cut/step-0-preflight/fixtures/case-2-prep-pr-not-merged/report.md b/...ls/release-rc-cut/step-0-preflight/fixtures/case-2-prep-pr-not-merged/report.md
@@ -9,7 +9,7 @@ Planning issue body excerpt:
   Prep PR: apache/airflow#46990 — OPEN (still under review; label
   `prep-pr-open` still present on the planning issue)
 
-RC tag check: gh api repos/apache/airflow/git/refs/tags/2.12.0-rc1 → 404 (does not exist)
+RC tag check: vetted-op-read tags 2.12.0-rc1 → (no output)
 
 release-config preflight output
 (`uv run --project <framework>/tools/release-config release-config preflight --skill rc-cut 2.12.0 rc1`):

diff --git a/...s/evals/release-rc-cut/step-0-preflight/fixtures/case-3-rc-tag-exists/report.md b/...s/evals/release-rc-cut/step-0-preflight/fixtures/case-3-rc-tag-exists/report.md
@@ -8,7 +8,7 @@ title "Release Apache Airflow 2.12.0")
 Planning issue body excerpt:
   Prep PR: apache/airflow#46990 — MERGED
 
-RC tag check: gh api repos/apache/airflow/git/refs/tags/2.12.0-rc1 → 200
+RC tag check: vetted-op-read tags 2.12.0-rc1 → refs/tags/2.12.0-rc1
   The tag 2.12.0-rc1 already exists on the remote (previous cut attempt).
 
 release-config preflight output

diff --git a/...ls/release-rc-cut/step-0-preflight/fixtures/case-4-archive-unreviewed/report.md b/...ls/release-rc-cut/step-0-preflight/fixtures/case-4-archive-unreviewed/report.md
@@ -9,7 +9,7 @@ Planning issue body excerpt:
   Prep PR: apache/foo#11 — MERGED (label prep-pr-open absent)
   No RC tag exists yet for 1.0.0-rc1.
 
-RC tag check: gh api repos/apache/foo/git/refs/tags/1.0.0-rc1 → 404 (does not exist)
+RC tag check: vetted-op-read tags 1.0.0-rc1 → (no output)
 
 Root .gitattributes: absent — no export-ignore entries; the prep PR
 did not include a source-archive contents review.

diff --git a/...vals/evals/release-rc-cut/step-0-preflight/fixtures/case-5-rc0-blocks/report.md b/...vals/evals/release-rc-cut/step-0-preflight/fixtures/case-5-rc0-blocks/report.md
@@ -9,7 +9,7 @@ Planning issue body excerpt:
   Prep PR: apache/airflow#46990 — MERGED (label prep-pr-open absent)
   No RC tag exists yet for 2.12.0.
 
-RC tag check: gh api repos/apache/airflow/git/refs/tags/2.12.0-rc0 → 404 (does not exist)
+RC tag check: vetted-op-read tags 2.12.0-rc0 → (no output)
 
 release-config preflight output
 (`uv run --project <framework>/tools/release-config release-config preflight --skill rc-cut 2.12.0 rc0`):

diff --git a/.../evals/release-rc-cut/step-0-preflight/fixtures/case-6-tag-prefix-not-exact/expected.json b/.../evals/release-rc-cut/step-0-preflight/fixtures/case-6-tag-prefix-not-exact/expected.json
@@ -0,0 +1,7 @@
+{
+  "verdict": "proceed",
+  "blockers": [],
+  "rc_tag_exists": false,
+  "prep_pr_merged": true,
+  "archive_reviewed": true
+}
diff --git a/.../release-rc-cut/step-0-preflight/fixtures/case-6-tag-prefix-not-exact/report.md b/.../release-rc-cut/step-0-preflight/fixtures/case-6-tag-prefix-not-exact/report.md
@@ -0,0 +1,34 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+Invocation: /release-rc-cut 2.12.0 rc1
+
+Planning issue: apache/airflow#47000 (open, labelled `release-planning`,
+title "Release Apache Airflow 2.12.0")
+Planning issue body excerpt:
+  Prep PR: apache/airflow#46990 — MERGED (label prep-pr-open absent)
+  No RC tag exists yet for 2.12.0-rc1.
+
+RC tag check: vetted-op-read tags 2.12.0-rc1 → refs/tags/2.12.0-rc10
+refs/tags/2.12.0-rc11
+
+release-config preflight output
+(`uv run --project <framework>/tools/release-config release-config preflight --skill rc-cut 2.12.0 rc1`):
+
+```json
+{
+  "ok": true,
+  "skill": "rc-cut",
+  "blockers": [],
+  "warnings": [],
+  "values": {
+    "version": "2.12.0",
+    "rc_number": "rc1",
+    "archive_reviewed": true,
+    "allow_unreviewed_archive": false,
+    "signing_mode": "rm-key",
+    "staging_url": "https://dist.apache.org/repos/dist/dev/airflow/2.12.0-rc1/",
+    "rc_tag": "2.12.0-rc1"
+  }
+}
+```
diff --git a/tools/vetted-ops/README.md b/tools/vetted-ops/README.md
@@ -238,6 +238,7 @@ board_status_field_id = "PVTSSF_…"    # its Status field id
 "license-compliance-audit" = ["repo-view", "repo-tree", "repo-file"]
 "flaky-test-triage"     = ["run-list", "run-view", "pr-view"]
 "release-verify-rc"     = ["release-list", "release-view", "tags", "repo-file"]
+"release-rc-cut"        = ["tags", "repo-issue-comment"]
 "contributor-nomination" = ["user-profile", "pr-list", "repo-issue-list"]
 "mentoring-welcome"     = ["repo-issue-view", "repo-issue-comment", "pr-view"]
 ```