[rmcdaniel]

The Protocol Specs job runs npm install hooks even though its four checks only consume JavaScript, JSON and YAML. Install the locked graph with npm ci --ignore-scripts, retaining all four checks. The Docusaurus patches applied by the root postinstall hook are unnecessary for these commands.

Refs #485. Preserves Sonar report AaFA6dpNf2KKc_2IRfId (githubactions:S6505); the individual source dispositions are on central#187.

Validation: git diff --check passed. Protocol Specs run42171957511 passed at f08e1c43243504be41e5536ccc1030fe4318a7af, including the fresh Node24 install with scripts disabled and all four actual commands. All11 current-head checks passed, including Sonar, all four CodeQL analyses and the complete eight-locale documentation qualification (run42171957350).

Only this install step changes. Package/lockfile/site content, scan configuration and the existing protected Node24 Pages publisher are unchanged. PR events qualify source without deploying; a main push follows the existing automatic build/deploy path. General reconciled that unchanged automatic follower. No manual dispatch, installer, browser or new publishing path is added.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General includes the existing unchanged automatic protected Pages follower in ordinary owner integration of this exact source fix, after its actual required PR checks pass. This reconciles the preparation scope in central 187/6678128192; it does not add a manual publication path or require another General checkpoint for a green ordinary merge.

I independently read the two-line diff on f08e1c4/tree41a96081: only the Protocol Specs install step name and npm ci --ignore-scripts change. The existing deploy.yml at accepted main acaca37 is unchanged (3,241 B / SHA-256 0a2bf77ee7ef7f6e1cd6f42c9a2f3c16953329ee622a4a7d6f376435b4ee4364). Every main push already triggers its Node 24, no-lifecycle-script build and separate GitHub Pages OIDC deployment; the publishing job runs no repository/dependency code and requires the current Actions Pages source.

The Docs owner should finish normal qualification, merge through effective required checks, follow the sole automatic main build/deployment, verify representative public content/assets and the actual revision/artifact binding, then clean the exact merged branch. Attribute any legitimate generated identity changes; do not manufacture a byte-unchanged or zero-finding claim. No manual dispatch, settings/rules/credentials change, installer/browser path, retry, unrelated content update, or new release is selected. A concrete follower failure stays owned and is handled on its actual evidence.

[rmcdaniel]

Normally merged #486 as add401ee966c8359773066f410321914779190fd after all11 exact-head PR checks passed. Reviewed head f08e1c43243504be41e5536ccc1030fe4318a7af, tree 41a96081e2d81dc33aaa46da52c10f4ad8acc887, base acaca37ab5aabaa2c4c9a565accac464d10f9f3a. Merge used the required-check path and exact expected head, with no bypass/force push.

Protocol Specs run42171957511 proved the fresh Node24 install with scripts disabled and all four actual commands pass. Documentation Qualification42171957350 passed the full build; Sonar, all four CodeQL analyses, central action policy and public-boundary checks passed too.

Docs now owns the original automatic main/Pages deployment, artifact and representative live-content binding under General's reconciled unchanged-follower scope. #485 remains open until that actual-main follow-through completes; no source/PR result is being relabelled as deployment acceptance. No manual dispatch, new browser/installer/settings path or retry is selected.

[rmcdaniel]

Delivered through normal merged #486 at add401ee966c8359773066f410321914779190fd, tree 41a96081e2d81dc33aaa46da52c10f4ad8acc887. Ordered parents are accepted main acaca37ab5aabaa2c4c9a565accac464d10f9f3a and reviewed head f08e1c43243504be41e5536ccc1030fe4318a7af; the merged tree exactly matches the reviewed tree.

All11 PR checks and all12 actual-main check runs passed. The actual main Protocol Specs run42172709540 passed its fresh Node24 npm ci --ignore-scripts install and all four existing protocol checks. Documentation qualification, central action policy, all four CodeQL analyses, Sonar and public-boundary checks passed. No mirrored workflow test or scanner configuration change was needed.

The sole original automatic Pages run42172709546 / attempt1 and protected github-pages deployment 7593770151 succeeded; deployment success was recorded at2026-11-06 06:16:24Z. Artifact 13481828947 is57,925,946 bytes, SHA256 cc63a2fcaaaff42c7aa01a097b1f6959e53da7f3877bacad2863e678a984f34c, matching its provider API digest and downloaded bytes.

All 10,087 regular files /272,345,847 unpacked bytes were safely streamed and hashed without executing artifact code. The complete path/size/hash inventory is identical to the prior accepted acaca37a artifact. Fifteen anonymous HTTPS reads matched the new artifact, covering root, current installation, historical1.x installation, German home, shared status/tokens/link map/logo, stable manifest/all three installer sources, actual main/runtime JavaScript and CSS. The root remains SHA256 79f0c5ee4c7b281780011204ae00aa6e82f5c5af4f485b6cb7c3fdbbe4394a76; canonical status remains 1ec3125c8001db03207026eea55493e38c210ebbe55189bacf749c6d546b1a14. Current support floors, published-version selectors and installer pins are unchanged.

The first local read-only verifier stopped before live reads because its selected-read list omitted the link map required by its existing source-equality assertion. I corrected only that local list and completed verification using the same already-downloaded artifact; there was no publisher retry, new download or product/source change. No new browser/health test was needed for the identical site bytes; earlier live health observations remain point-in-time evidence.

Scanner result: default-branch analysis 36b3ecc6-cbf3-457d-a6c0-c622e3ebb49a, dated2026-11-06 06:10:19+00:00, binds this actual main revision. Original lifecycle report AaFA6dpNf2KKc_2IRfId / githubactions:S6505 is now automatically CLOSED/FIXED after the source correction. The same OPEN/CONFIRMED SECURITY view now contains one report: AaFA6dnkf2KKc_2IRfH_ / javascript:S4036, retained OPEN with the bounded same-user build-caller disposition. This is not a zero-report claim. No finding was manually accepted, suppressed or transitioned; no rules, profiles, exclusions, thresholds or settings changed.

The exact own merged branch ci/485-protocol-install-no-scripts was deleted locally/remotely and absence verified. The workspace is clean/detached at the accepted main; no local browser/container/build allocation was created for this fix. #485 is complete. #481/#482 and #457 retain their independent actual published-producer waits.