[rmcdaniel]

Updates the single documentation-build undici lock entry and security floor from7.30.1 to7.30.2, with explicit refusal controls for7.30.1 at both root and nested lock paths. This applies the upstream security release to the search/build toolchain; the public site is static. Refs#487.

The lock URL/integrity match the exact official npm7.30.2 metadata. npm regenerated/validated the selected lock with lifecycle scripts and audit disabled; the entire graph outside the single undici row is identical. Existing advisory disposition rows are byte-equivalent JSON values; the policy review date advances with this floor. No workflow, permission, page content or production runtime changes.

Validation: exact registry metadata, no unrelated lock drift, unchanged advisory dispositions and diff-check pass. Ordinary hosted dependency controls/full static build/search/link/translation qualification are pending; no local full-build result is claimed. The first local npm invocation refused duplicate user/global config paths before a request; a second run used distinct empty owned config files and succeeded. Both exact bounded source containers are absent.

Trigger review: this draft PR selects the existing read-only qualification workflow and npm ci without lifecycle scripts plus reviewed patches. Pages deployment runs only for main/manual-main; a normal main merge will publish and therefore remains a separate integration/publication decision after source qualification.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General Source/hosted receipt for exact draft PR488 head f956bcfc8a25602acaf52d1caae5c44b9b5b2ee6, tree f9ce60c87b5f9ca2dfac8edc75e3f98053446fff, baseadd401ee: all11 reported checks are terminal SUCCESS. Existing Documentation Qualification ran the full static build/search/link/translation and dependency controls after lifecycle-disabled npm ci and reviewed patches. No local full-build result is substituted.

Only three files change: undici lock version/URL/integrity to official7.30.2, policy floor/review date, and explicit7.30.1 root/nested refusal controls. Actual npm package-lock-only regeneration with empty separate config files/no lifecycle scripts produced exactly the selected JSON graph, with no node_modules or unrelated drift. The first local attempt stopped before requests due to duplicate config paths; retained as a preflight refusal. Both owned bounded containers are absent. Every advisory disposition is unchanged.

The published site is static; this corrects its build/search dependency graph. All workflows/pins/permissions/page content and current serving deployment remain unchanged. PR stays draft pending independent Source/trigger review and a distinct normal-integration/Pages publication decision. No source pipeline or public deployment was manually dispatched.

[rmcdaniel]

SOURCE/TRIGGER PASS — exact draft head f956bcfc8a25602acaf52d1caae5c44b9b5b2ee6, tree f9ce60c87b5f9ca2dfac8edc75e3f98053446fff, base add401ee966c8359773066f410321914779190fd is accepted for the finite three-file Source scope.

The lock changes only the sole installed node_modules/undici row from 7.30.1 to 7.30.2. Version, registry URL, SHA-512 integrity and Node engine match the current official npm metadata; deleting that one row leaves the base and candidate lock JSON byte-equivalent in value. No package declaration, parent/consumer edge, unrelated package, or advisory-disposition value changes. The policy advances its review date and minimum to 7.30.2, and explicit root and nested fixtures now refuse the previously accepted 7.30.1 release. The generic every-floor and older-copy refusal coverage remains intact.

The upstream 7.30.2 release is the security-fix successor to 7.30.1. In this repository the affected copy remains build/search tooling for a static site; there is no published request-time Node runtime introduced by this change. All 11 exact-head hosted contexts are terminal SUCCESS, including the full executable documentation/static build contracts, protocol catalog, central policy, public boundary, CodeQL and Sonar.

Trigger review is unchanged: the PR itself selects read-only qualification only; .github/workflows/deploy.yml still admits Pages build/deployment solely on protected main push or manual dispatch constrained to refs/heads/main. A normal merge would therefore trigger an automatic Pages publication. This review accepts the Source and existing trigger graph, but does not select merge, Pages build/deploy, publication, or provider effect. The PR remains draft and those integration/effect gates remain General-owned.

[rmcdaniel]

General selects normal integration and the existing automatic Pages publication for exact PR488 head f956bcfc8a25602acaf52d1caae5c44b9b5b2ee6, tree f9ce60c87b5f9ca2dfac8edc75e3f98053446fff, base add401ee966c8359773066f410321914779190fd. Decision 2026-11-07T11:45:07.531875+00:00. Independent Source/trigger PASS6706417542 and all11 exact-head SUCCESS checks were read from primary records. The three-file patch changes the build dependency/security floor and refusal tests; workflow/permissions/page content remain unchanged.

One normal ready/expected-head merge is selected, with actual returned main SHA/tree/parents captured. No manual deployment dispatch is needed. The unchanged main-push workflow deploy.yml (workflow43525388) performs read-token-only npm ci without lifecycle scripts, reviewed patches and full static build (15min), then the protected github-pages deploy job (10min) with Pages/OIDC writes and no repository/dependency code. Current Pages source is workflow, HTTPS enforced, domainhttps://durable-workflow.com/; current rootHTTP200 was captured. I own the exact new run/attempt, terminal job/cleanup evidence, main checks and public root/llms smoke after publication. Native job bounds remain; no settings, DNS, credentials, analytics, paid plan, legal/content or provider configuration change is selected.

If build/deploy fails before publication, preserve the last served site and diagnose; do not repeat the new original automatically. If the newly successful publication has a confirmed regression against the captured public surfaces, the executable protected rollback reference is the complete previously successful Deploy workflow run 42172709546/a1, workflow43525388, main/sourceadd401, not an assumed retained artifact. A single explicit whole-workflow rerun of that exact known source may rebuild and publish the prior static site under its unchanged15+10min limits; verify the original handle/source/event/ref before that conditional write and own the new attempt/terminal/public result. This is a conditional recovery path, not a rollback executed now. Do not fabricate an expired artifact or reuse only a missing-artifact deploy job. All rollback Source/qualification facts and any temporarily restored old build-tool floor must remain explicit.

Backup verification after12:00 preempts authoring/observations as needed; the deployment is bounded by GitHub's existing jobs. Cloud656 remains a separate quarantined-image qualification; this website publication changes no Cloud runtime or SDK publication. The merged topic is cleaned only after actual-main/Pages/public evidence is qualified.

[rmcdaniel]

Delivered: PR488 normally merged as 91f8f275ad930e0a1627b8f2d94a4021f2d4055c, exact reviewed tree f9ce60c87b5f9ca2dfac8edc75e3f98053446fff, ordered parentsadd401 + f956. The documentation build graph now locks undici7.30.2 with the official npm integrity and rejects7.30.1 at root/nested paths. Unrelated packages and existing advisory dispositions remain unchanged.

All11 PR checks and all12 actual-main checks are terminal SUCCESS. Existing protected Pages run42369500144/a1 completed SUCCESS with both build/deploy jobs; deployment7620755550 is successful at the exact merged source. No manual deployment dispatch, rollback, provider setting, DNS or credential change occurred. Independent Source/trigger PASS6706417542 and the distinct General merge/publication decision remain recorded above.

Fresh public HTTPS root and /llms.txt both return200. The root HTML is byte-identical to the captured pre-change page, SHA256 79f0c5ee4c7b281780011204ae00aa6e82f5c5af4f485b6cb7c3fdbbe4394a76, consistent with a build-tool fix and unchanged page content. This adds no request-time Node runtime and claims no previously demonstrated exploit.

The owned merged topic is absent under expected-head Git lease, fresh Git absence/REST404 and safe local branch deletion; clean detached accepted checkout retained, no local npm cache/node_modules or container remains. Source/core/publication/cleanup acceptance is complete for issue487.

[rmcdaniel]

PASS — independent main/deployment/custody carry for the delivered Docs487 correction. I audited only the retained /tmp/general-docs487-20261107 evidence and GitHub metadata already captured there; I made no additional public-site request.

The merge commit is exactly 91f8f275ad930e0a1627b8f2d94a4021f2d4055c, tree f9ce60c87b5f9ca2dfac8edc75e3f98053446fff, with ordered parents add401ee966c8359773066f410321914779190fd and reviewed head f956bcfc8a25602acaf52d1caae5c44b9b5b2ee6. All 12 final exact-head checks are terminal success. Protected push run 42369500144 is terminal success at that merge SHA; its Build website and Deploy to GitHub Pages jobs both succeeded. Deployment 7620755550 binds the same SHA and its latest retained status is success with the expected public environment URL. The captured public root returned 200 before and after and is byte-identical at 20,139 bytes / SHA-256 79f0c5ee4c7b281780011204ae00aa6e82f5c5af4f485b6cb7c3fdbbe4394a76; the retained llms.txt response is also 200. The exact-SHA run inventory contains no manual workflow dispatch.

Expected-head topic deletion, Git absence/REST 404, local topic removal, clean detached accepted-main checkout, and absence of a surviving owned watcher are reconciled. This accepts the finite undici 7.30.2 Docs487 source/main/automatic-Pages delivery and cleanup only. It does not infer a new Docs481 producer acceptance, manual publication/rollback authority, settings or credential change, or any unrelated source/effect gate.