[joshavant]

Build and CI tooling selected Node and native pnpm releases that trusted the compromised certificate authority keys. Preserve the Node24 lane while selecting24.22.1, and select qualified native pnpm12.15.0 with its normal regenerated lock.

Validation: full pnpm check passed on Node24.22.1/nativepnpm12.15.0:31tests, TypeScript, lint, docs build, formatting. Browser sample video was skipped because the WASM bundle was not present; no FFmpeg/WASM rebuild or browser E2E is claimed. Changed YAML parsed and fresh full-context review found no P0–P2 findings. Actual Linuxarm64 Node and nativepnpm incident-host rejection proofs are retained in the campaign.

The release-check workflow’s inline npm node24.16.0 wrapper remains an explicit package-channel wait:24.22.1 is not published through that channel. Existing published artifacts, Actions’ embedded runtime, and Cloudflare-hosted runtime remain separate owners’ updates. No deployment or release was performed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR pins CI and Pages to Node 24.22.1 and updates native pnpm and its lockfile records to 12.15.0.

Example: GitHub Actions installs the build toolchain.

• Before: CI and Pages select Node 24 and pnpm 12.9.1.
• After: Both select Node 24.22.1 and pnpm 12.15.0.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The patch is focused and CI passes, but its central certificate-rejection claim lacks inspectable binary-level evidence.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Build tooling can trust server certificate chains containing compromised intermediate keys.
Reason: The maintainer-authored direction addresses a documented upstream security defect and explicitly records the narrower release-channel exception.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep this PR open: it provides useful security updates absent from main, and inspection found no introduced code defect.

Priority: P1
Reviewed head: 67c929d6b56ba86ab4c361a4e77bd4b88b9d5837

Before merge

• Add real behavior proof - Authority-chain proof required: the body claims Linux arm64 Node 24.22.1 and native pnpm 12.15.0 rejection results but links no traces or artifacts. Show legitimate HTTPS success and compromised-intermediate rejection through each actual binary before protected HTTP requests or package contents are accepted, with runtime identity and fresh/existing-checkout installation results; redact credentials and non-public endpoints. Passing build and browser CI does not exercise this trust decision. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security review attention item - No introduced security defect was identified, but the changed TLS trust decisions require accessible qualification evidence.
• Resolve merge risk - Qualify the selected Node and native pnpm binaries against both legitimate servers and compromised-intermediate chains before relying on their changed trust boundary.

Findings

None.

Tests

• Missing end-to-end proof: Attach redacted traces for legitimate and compromised-certificate HTTPS through the selected binaries, plus fresh and existing-checkout frozen installs; current CI demonstrates build compatibility only.

Agent review details

How this fits together

GitHub Actions and the release-check script install development tools, consume locked dependencies, and produce verified WASM builds and the Pages site.

flowchart TD
  A[Repository pins] --> B[CI and Pages setup]
  A --> C[Release check]
  B --> D[Node and pnpm]
  C --> D
  D --> E[Dependency installation]
  E --> F[Build and verification]

Loading

Technical review

Best possible solution:

Land the focused toolchain update after certificate-rejection qualification, preserving the explicitly recorded release-channel exception.

Do we have a high-confidence way to reproduce the issue?

Main's older pnpm selection is directly visible, and upstream Node documents the compromised-intermediate vulnerability; no incident-host reproduction was executed.

Is this the best way to solve the issue?

Consistent runtime and package-manager pins are a focused solution, with matching registry integrity values and successful exact-head CI.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against c8e93bed4a24.

Merge-risk options

Maintainer options:

1. Attach binary qualification evidence (recommended)
   Provide the retained Node and native pnpm traces showing legitimate HTTPS succeeds and compromised-intermediate certificates are rejected before protected HTTP requests or package contents are accepted.

Provenance checked

• CI, Pages, and package-manager pins changes intended behavior with a stated reason (bcc2c1e: The previous refresh aligned build tool versions while preserving Node 24+, disabled dependency build scripts, and the release-age policy; the earliest CI Node selection remains introduction-unknown at the local history boundary.)
• Release verification script keeps the original intent (6242c7c: ci: automate signed source releases #22 added reproducible source-release verification through pinned tools.)

Testing

Proof path: shipped entry point.

Security

Needs attention: No introduced security defect was identified, but the changed TLS trust decisions require accessible qualification evidence.

Evidence

What I checked:

• Verified introduced change: The pinned diff contains only toolchain version selections and pnpm package-manager lock records; main still selects pnpm 12.9.1. (.github/workflows/ci.yml:29, 67c929d6b56b)
• Recorded release-channel exception: The maintainer-authored PR explicitly retains the release check's npm-distributed Node 24.16.0 pending publication of 24.22.1; the npm registry lookup for node/24.22.1 returned HTTP 404. (scripts/release-check.sh:13, 67c929d6b56b)
• Exact-head validation: Quality, WASM verification, and CodeQL checks succeeded for the reviewed head; this supports compatibility but does not demonstrate compromised-certificate rejection. (.github/workflows/ci.yml:37, 67c929d6b56b)
• Proof source inspected: The full body says Linux arm64 rejection proofs are retained in a campaign, but provides no artifact or link; discussion contains only bot status comments and no review evidence. (67c929d6b56b)
• Upstream security contract: Node 24.22.1 release notes include blocked-public-key rejection; tls: reject chains containing blocked public keys nodejs/node#66871 explains rejection of compromised eMudhra/emSign intermediates. The target directly installs this runtime, making that TLS contract relevant.
• Lockfile supply-chain inspection: All 15 updated pnpm and platform-executable integrity values match npm registry metadata; application dependency records, disabled build scripts, and the workspace release-age setting remain unchanged. (pnpm-lock.yaml:15, 67c929d6b56b)

Labels

Label changes:

• add P1: The update addresses compromised certificate-authority trust in build tooling, supported by the upstream Node security release.
• add merge-risk: 🚨 security-boundary: The selected runtimes change TLS trust decisions, while their claimed binary-level rejection evidence is not linked.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P1: The update addresses compromised certificate-authority trust in build tooling, supported by the upstream Node security release.
• merge-risk: 🚨 security-boundary: The selected runtimes change TLS trust decisions, while their claimed binary-level rejection evidence is not linked.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Link the retained Node and native pnpm qualification traces, including allowed and compromised-certificate final-effect results.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 6:43 PM ET / 22:43 UTC.