Revert self-merged dependency bumps (#142, #144, #145)

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: 22
 
@@ -278,7 +278,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: 22
 

.github/workflows/modonome-auto.yml

@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e   # v6.4.0
         with:
           node-version: '20'
       - name: Guard against same model for both roles
@@ -102,7 +102,7 @@ jobs:
         with:
           ref: ${{ needs.maker.outputs.branch }}
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e   # v6.4.0
         with:
           node-version: '20'
       - name: Deterministic gates (run by the checker, who did not author the diff)

.github/workflows/modonome-review.yml

@@ -24,12 +24,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the PR head with history
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: "20"
 

.github/workflows/modonome-schedule.yml

@@ -26,7 +26,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e   # v6.4.0
         with:
           node-version: '20'
       - name: Install Claude Code CLI
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e   # v6.4.0
         with:
           node-version: '20'
       - name: Install Claude Code CLI
@@ -80,7 +80,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e   # v6.4.0
         with:
           node-version: '20'
       - name: Install Claude Code CLI

.github/workflows/publish-edge.yml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js Environment
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org

.github/workflows/publish.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           registry-url: https://registry.npmjs.org
@@ -62,7 +62,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           registry-url: https://registry.npmjs.org

.github/workflows/scorecard.yml

@@ -29,7 +29,7 @@ jobs:
       # ossf/scorecard-action and the actions below are tracked by Dependabot
       # (see .github/dependabot.yml) and may be pinned to a SHA later.
       - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.4
+        uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/self-govern.yml

@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020   # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e   # v6.4.0
         with:
           node-version: '20'
       - name: Install Claude Code CLI

.github/workflows/sync-site-data.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 20
       - name: Install dependencies

.modonome/snapshot/map.md

@@ -2,7 +2,7 @@
 
 Modonome snapshot. Read this before reading the repo. Tier 0 (signature.json) is the fingerprint: if merkle_root matches your last read, nothing changed. Tier 1 (map.json / map.md) lists modules, public API signatures, import edges, and attention ranking. Cite anchors (F: for files, S: for symbols); each resolves to a path and line so you can act without re-reading the whole repo.
 
-Merkle root: sha256:8cb03603d62c5a947ab39431513e7f3e5e97e2d1419c5cf22890c6cf4835eb39
+Merkle root: sha256:7ebaf86aed01285f11b8e2fc5653f63fc1d9a706ff453959b01e689e7784bb25
 Files: 1094  Bytes: 3971943  Map tokens: 139595/120000
 
 ## Modules

.modonome/snapshot/signature.json

@@ -1 +1 @@
-{"commands":{"build":"","lint":"","test":"npm test"},"entrypoints":["bin/modonome.mjs"],"generated_at":"2026-07-28T07:19:31.765Z","generated_for":"modonome","governance":{"armed":false,"autonomy_enabled":false,"dry_run":true},"instructions":["AGENTS.md","CLAUDE.md","CODEX.md","CONTRIBUTING.md","README.md"],"language_mix":{"(none)":12,"cff":1,"css":50,"diff":66,"html":9,"js":19,"json":146,"jsonl":8,"md":146,"mjs":359,"patch":40,"png":5,"py":4,"sh":1,"svg":2,"tf":4,"toml":2,"ts":61,"tsx":98,"txt":18,"webmanifest":1,"webp":1,"woff2":9,"xml":1,"yaml":9,"yml":22},"merkle_root":"sha256:8cb03603d62c5a947ab39431513e7f3e5e97e2d1419c5cf22890c6cf4835eb39","preamble":"Modonome snapshot. Read this before reading the repo. Tier 0 (signature.json) is the fingerprint: if merkle_root matches your last read, nothing changed. Tier 1 (map.json / map.md) lists modules, public API signatures, import edges, and attention ranking. Cite anchors (F: for files, S: for symbols); each resolves to a path and line so you can act without re-reading the whole repo.","protected_paths":[".github",".github/CODEOWNERS","package-lock.json"],"schema_version":1,"size":{"bytes":3971943,"files":1094},"snapshot_version":2,"stack":{"name":"Node or TypeScript","pm":"npm"},"tier_hashes":{"map":"sha256:3fe8f4b998dd2168461ef640608683eddc8b76adfb06d247dbb660e301d3a91a","map_md":"sha256:40288917d7d04f56e7893de877a9bff48bb140e6c93fd261cb3dfd5953f95d53"}}
+{"commands":{"build":"","lint":"","test":"npm test"},"entrypoints":["bin/modonome.mjs"],"generated_at":"2026-07-28T15:59:43.129Z","generated_for":"modonome","governance":{"armed":false,"autonomy_enabled":false,"dry_run":true},"instructions":["AGENTS.md","CLAUDE.md","CODEX.md","CONTRIBUTING.md","README.md"],"language_mix":{"(none)":12,"cff":1,"css":50,"diff":66,"html":9,"js":19,"json":146,"jsonl":8,"md":146,"mjs":359,"patch":40,"png":5,"py":4,"sh":1,"svg":2,"tf":4,"toml":2,"ts":61,"tsx":98,"txt":18,"webmanifest":1,"webp":1,"woff2":9,"xml":1,"yaml":9,"yml":22},"merkle_root":"sha256:7ebaf86aed01285f11b8e2fc5653f63fc1d9a706ff453959b01e689e7784bb25","preamble":"Modonome snapshot. Read this before reading the repo. Tier 0 (signature.json) is the fingerprint: if merkle_root matches your last read, nothing changed. Tier 1 (map.json / map.md) lists modules, public API signatures, import edges, and attention ranking. Cite anchors (F: for files, S: for symbols); each resolves to a path and line so you can act without re-reading the whole repo.","protected_paths":[".github",".github/CODEOWNERS","package-lock.json"],"schema_version":1,"size":{"bytes":3971943,"files":1094},"snapshot_version":1,"stack":{"name":"Node or TypeScript","pm":"npm"},"tier_hashes":{"map":"sha256:143d37b91abc6292bbe8077da2d22630775e7e0d4ba696200ab3fcc7ecf3efee","map_md":"sha256:0ad0b7416f2cff46e2b1db7cdbf6e2933265965f69821772e5fcfbf6dbe7b38a"}}

action.yml

@@ -43,7 +43,7 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@v4
       with:
         node-version: '20'
 
@@ -101,7 +101,7 @@ runs:
 
     - name: Upload SARIF to code scanning
       if: ${{ always() && inputs.upload-sarif == 'true' }}
-      uses: github/codeql-action/upload-sarif@v4
+      uses: github/codeql-action/upload-sarif@v3
       with:
         sarif_file: ${{ inputs.sarif-file }}
         category: modonome-gate-integrity
@@ -129,7 +129,7 @@ runs:
 
     - name: Sign the receipt
       if: ${{ always() && inputs.receipt == 'true' }}
-      uses: actions/attest@v4
+      uses: actions/attest@v2
       with:
         subject-name: gate-integrity
         predicate-type: 'https://modonome.com/attestation/gate-integrity/v1'
@@ -153,7 +153,7 @@ runs:
 
     - name: Sign the AgentProof attestation
       if: ${{ always() && inputs.agentproof == 'true' }}
-      uses: actions/attest@v4
+      uses: actions/attest@v2
       with:
         subject-name: agentproof-conformance
         predicate-type: 'https://modonome.com/attestation/agentproof-conformance/v1'

scripts/agent/triggers.mjs

@@ -39,7 +39,7 @@ const RESERVED_ROLES = new Set([...CORE_ROLE_SEQUENCE, "self-govern"]);
 // Pinned action refs, identical to modonome-auto.yml and self-govern.yml, so the
 // generated workflow keeps the same supply-chain posture and its output is stable.
 const CHECKOUT_REF = "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"; // v7.0.0
-const SETUP_NODE_REF = "actions/setup-node@820762786026740c76f36085b0efc47a31fe5020"; // v7.0.0
+const SETUP_NODE_REF = "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"; // v6.4.0
 
 const WORKFLOW_PATH = ".github/workflows/modonome-schedule.yml";
 const GENERATED_BANNER =
@@ -143,7 +143,7 @@ function renderRoleJob(role, crons) {
     `      - uses: ${CHECKOUT_REF}   # v7.0.0`,
     `        with:`,
     `          fetch-depth: 0`,
-    `      - uses: ${SETUP_NODE_REF}   # v7.0.0`,
+    `      - uses: ${SETUP_NODE_REF}   # v6.4.0`,
     `        with:`,
     `          node-version: '20'`,
     `      - name: Install Claude Code CLI`,