[joshavant]

What Problem This Solves

Managed CI, hydration and release jobs can select cached Node versions that trust the compromised eMudhra keys.

User Impact

Pin Node 22.23.4, 24.22.1 and 26.12.1 within the existing release lines. Installed products and the Actions runner require separate updates.

Why This Change Was Made

Exact fixed patches prevent old cache entries from satisfying setup-node, including its fallback after manifest-resolution failure.

Evidence

pnpm run check passed on Linux arm64: format, types, lint, builds, 3,075 test passes (15 skipped), and the 220-test coverage target. Independent review and git diff --check passed. Official Linux arm64 release binaries rejected all 12 incident chains in eight trust modes, with ordinary HTTPS controls passing. Other platform executions remain hosted CI proof.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR pins managed workflow runtimes to Node 22.23.4, 24.22.1, and 26.12.1.

Example: A hydration runner has Node 24.22.0 cached.

• Before: The Node 24 selector can accept the cached version.
• After: The exact 24.22.1 selector requires the security release.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A minimal, source-verified security update with successful exact-head validation and no actionable findings; the ordinary proof gate is exempt under the supplied maintainer classification.
Proof confidence	🌊 off-meta tidepool	Not applicable: The host's explicit maintainer-authored classification exempts this PR from the ordinary contributor-proof gate. Source verifies version selection and official releases; successful exact-head workflow checks support compatibility. The body reports Linux arm64 incident-chain rejection, but supplies no inspectable output, and hosted raw logs were blocked by the review environment; neither claim is treated as independently observed TLS proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Managed automation can run cached Node patches that still accept certificate chains through compromised intermediate keys.
Reason: The host explicitly identifies this PR as maintainer-authored, establishing direction; the nine selector replacements address the stated managed-job boundary without changing installed-product runtime requirements.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: current main still permits older cached Node patches, and this focused security update addresses that path without an identified introduced defect.

Priority: P2
Reviewed head: 9c029a8545e327b48f0f8183bf10127f0dc129f1

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub Actions passes workflow version selectors to setup-node, which selects a cached or downloaded runtime for validation, hydration, documentation builds, and publishing.

flowchart LR
  A[Workflow configuration] --> B[setup-node]
  B --> C[Runtime cache]
  B --> D[Official Node downloads]
  C --> E[Selected Node runtime]
  D --> E
  E --> F[Build and release commands]

Loading

Technical review

Best possible solution:

Retain the exact security-release pins within the existing Node release lines.

Do we have a high-confidence way to reproduce the issue?

Source establishes the failure path: hydration and Pages can accept an older cached major-line runtime directly, while check-latest workflows can do so after manifest-resolution failure; no runtime reproduction was executed during this read-only review.

Is this the best way to solve the issue?

Exact patches are the smallest complete workflow repair because they constrain both cache lookup and download resolution without replacing setup-node or changing supported Node lines.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e63ba30779d5.

Provenance checked

• CI runtime lines and coverage placement keeps the original intent (chore: refresh dependencies and streamline CI validation #569: Validate supported source-build Node lines while retaining Node 22 coverage; fix(ci): run coverage lane on Node 22 #89 explains the coverage-accounting reason for that lane.)
• Mutation lane keeps the original intent (c26e99c: Add and enforce the repository's Slophammer mutation and quality gates.)
• Hydration runtime keeps the original intent (chore: add constrained Crabbox setup #342: Provide constrained hydration on trusted runner labels; this PR preserves that boundary.)
• Nightly conformance runtime keeps the original intent (feat(conformance): add data-driven ACP core v1 suite with CI/nightly coverage #130: Provide deterministic protocol conformance coverage with optional real-adapter smoke runs.)
• Pages runtime keeps the original intent (9fedaec: Build and deploy the GitHub Pages documentation site.)
• Release Node line keeps the original intent (66155ee: Use Node 24 for npm trusted publishing support; the PR retains that major line and all existing publishing gates.)
• Floating patch selection changes intended behavior with a stated reason (d8ea5a4: The CI restructuring used a major-only selector; the PR explains replacing floating selection to exclude vulnerable cached patches.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Exact introduced change and current-main behavior: The pinned base-to-head diff changes nine version values across five workflows and adds no commands, permissions, dependencies, or workflow nodes. Main retains major-only selectors. The reviewed head has successful checks, including all three Node test lanes. Full body and discussion were read; comments contain review-status messages rather than additional proof. Raw Actions logs redirect to a host blocked by the review environment. Feature history establishes substantial current ownership before reaching an unavailable older object at the creation boundary. (.github/workflows/ci.yml:98, 9c029a8545e3)
• Verified cache-fallback contract: The workflows execute this exact setup-node revision. OfficialBuilds catches manifest-resolution failures and then searches the tool cache using the remaining version specification; BaseDistribution passes that specification to tool-cache.find. Exact patches therefore exclude older cached versions even when check-latest cannot resolve the manifest. (src/distributions/official_builds/official_builds.ts, 949feb2413d6)
• Official security releases and underlying repair: Official release records confirm all three versions exist and include certificate-chain public-key rejection. The merged upstream repair explains rejection through the TLS verification callback. See the Node release records and upstream repair. This dependency contract applies because the workflows install and execute these runtimes. (d9a3f3d150f7)

Likely related people:

• Peter Steinberger: Raw commit 3007739 adds .github/workflows/ci.yml:118 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3007739e55e6; files: .github/workflows/ci.yml)
• Vincent Koc: Raw commit e0e1a3c adds .github/workflows/crabbox-hydrate.yml:52 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: e0e1a3c2afde; files: .github/workflows/crabbox-hydrate.yml)

Review metrics

Metric	Value	Why it matters
Patch scope	5 workflow files; +9/-9 lines	Every changed line replaces an existing runtime selector; no additional production machinery or test scaffolding is introduced.

Labels

Label changes:

• add P2: A concrete security-runtime improvement for managed automation, with no established current outage or broken user workflow.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: A concrete security-runtime improvement for managed automation, with no established current outage or broken user workflow.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 5:47 PM ET / 21:47 UTC.