Skip to content

chore(deps)(deps): bump the all-npm-minor group with 4 updates - #172

Merged
ariffazil merged 1 commit into
mainfrom
dependabot/npm_and_yarn/all-npm-minor-ce3a43b6cd
Aug 24, 2026
Merged

chore(deps)(deps): bump the all-npm-minor group with 4 updates#172
ariffazil merged 1 commit into
mainfrom
dependabot/npm_and_yarn/all-npm-minor-ce3a43b6cd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-npm-minor group with 4 updates: @hookform/resolvers, input-otp, lucide-react and @vitejs/plugin-react.

Updates @hookform/resolvers from 5.8.0 to 5.9.1

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

  • isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

Commits
  • f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
  • c8159ae feat: update joi to v18 (#873)
  • See full diff in compare view

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

  • fix(input): reserve the password manager badge gutter only where it fits
  • fix(input): disable spellcheck by default
  • fix(input): feature-detect ResizeObserver before observing
  • fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
  • fix(input): clear pending synchronization timeouts on unmount
  • feat(input): add a nonce prop for Content-Security-Policy support
  • fix(input): guard the input reference used by the selectionchange listener
  • fix(input): opt the container out of browser translation
  • fix(input): report cosmetic CSS rule failures as warnings instead of errors
  • docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

  • revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
  • revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
  • docs: align the mobile and edge-case documentation with the stable candidate
  • test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

  • fix(input): reserve the password manager badge gutter only where it fits
    • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
  • fix(input): disable spellcheck by default
    • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
  • fix(input): feature-detect ResizeObserver before observing
    • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
  • fix(input): fall back to 16px font-size until --root-height resolves
    • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
  • fix(input): clear pending sync timeouts on unmount
    • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
  • feat(input): add nonce prop
    • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
  • fix(input): use the guarded input reference inside the selectionchange listener
    • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
  • fix(input): opt the container out of browser translation
    • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
  • fix(input): log CSS rule insertion failures as warnings, not errors
    • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
  • chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

  • fix(input): reserve the password manager badge gutter only where it fits
  • fix(input): disable spellcheck by default
  • fix(input): feature-detect ResizeObserver before observing
  • fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
  • fix(input): clear pending synchronization timeouts on unmount
  • feat(input): add a nonce prop for Content-Security-Policy support
  • fix(input): guard the input reference used by the selectionchange listener
  • fix(input): opt the container out of browser translation
  • fix(input): report cosmetic CSS rule failures as warnings instead of errors
  • docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

  • revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
  • revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
  • docs: align the mobile and edge-case documentation with the stable candidate
  • test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

  • fix(input): reserve the password manager badge gutter only where it fits
    • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
  • fix(input): disable spellcheck by default
    • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
  • fix(input): feature-detect ResizeObserver before observing
    • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
  • fix(input): fall back to 16px font-size until --root-height resolves
    • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
  • fix(input): clear pending sync timeouts on unmount
    • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
  • feat(input): add nonce prop
    • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
  • fix(input): use the guarded input reference inside the selectionchange listener
    • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
  • fix(input): opt the container out of browser translation
    • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.


Updates lucide-react from 1.31.0 to 1.33.0

Release notes

Sourced from lucide-react's releases.

Version 1.33.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

Version 1.32.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.31.0...1.32.0

Commits

Updates @vitejs/plugin-react from 6.0.5 to 6.1.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the all-npm-minor group with 4 updates
cdf25fc 
Bumps the all-npm-minor group with 4 updates: [@hookform/resolvers](https://github.com/react-hook-form/resolvers), [input-otp](https://github.com/guilhermerodz/input-otp/tree/HEAD/packages/input-otp), [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react).


Updates `@hookform/resolvers` from 5.8.0 to 5.9.1
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.8.0...v5.9.1)

Updates `input-otp` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/guilhermerodz/input-otp/releases)
- [Changelog](https://github.com/guilhermerodz/input-otp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/guilhermerodz/input-otp/commits/v1.5.0/packages/input-otp)

Updates `lucide-react` from 1.31.0 to 1.33.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: input-otp
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: lucide-react
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, deps. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions github-actions Bot added the safe-automerge Dependabot patch/minor — safe for auto-merge label Aug 24, 2026
@ariffazil
ariffazil merged commit b467b85 into main Aug 24, 2026
28 of 29 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/all-npm-minor-ce3a43b6cd branch August 24, 2026 17:32
ariffazil pushed a commit that referenced this pull request Aug 25, 2026
kimi-code/FI-008
merge: origin/main — DISPLAY_ONLY docs + dep bumps PR#171/#172 (kimi …
a44ef4c 
…converge, zero conflict)
ariffazil added a commit that referenced this pull request Aug 27, 2026
@ariffazil @dependabot
kimi-code/FI-008 333-AGI
Update dependencies and enhance documentation for governance (#174)
6e52cd7 
* chore(deps): merge safe-automerge PR #171

Bumps the all-npm-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.2` | `2.112.3` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.2` | `4.12.3` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.4` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.9` | `4.23.12` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |


Updates `@supabase/supabase-js` from 2.112.2 to 2.112.3
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.112.3/packages/core/supabase-js)

Updates `react-resizable-panels` from 4.12.2 to 4.12.3
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.12.2...4.12.3)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `eslint` from 10.8.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.4
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.3...v0.5.4)

Updates `tsx` from 4.23.9 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.9...v4.23.12)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.112.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: react-resizable-panels
  dependency-version: 4.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): merge safe-automerge PR #172

Bumps the all-npm-minor group with 4 updates: [@hookform/resolvers](https://github.com/react-hook-form/resolvers), [input-otp](https://github.com/guilhermerodz/input-otp/tree/HEAD/packages/input-otp), [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react).


Updates `@hookform/resolvers` from 5.8.0 to 5.9.1
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.8.0...v5.9.1)

Updates `input-otp` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/guilhermerodz/input-otp/releases)
- [Changelog](https://github.com/guilhermerodz/input-otp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/guilhermerodz/input-otp/commits/v1.5.0/packages/input-otp)

Updates `lucide-react` from 1.31.0 to 1.33.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: input-otp
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: lucide-react
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs(readme): DISPLAY_ONLY ceiling in first fold

AAA shows state and queues A2A. It never judges. It never
executes. Matches live cockpit, llms.txt, and Observatory.

* docs(llms): organ table matches live Holy 8 and DISPLAY_ONLY

Stop advertising 13 canonical kernel tools and 9 AAA MCP tools.
AAA is A2A, not an MCP organ. Door is /mcp.

* feat(cockpit): amanah board state + supply-chain pin gate (E-2) + manifest/skill truth-sync

- boards/amanah.{jsonl,py}: runtime work-order state
- instructions/gate-promotion.md + registries/supply_chain_pins.json + scripts/supply_chain_gate.py: E-2 pin gate, fail-closed, 7 configs watched, 11 pins
- security/skill-manifest.json: truth-sync -1144/+438 (stop advertising retired skills)
- README.md + public/llms.txt: DISPLAY_ONLY first fold (converged with origin/main 67cab47/f46d784a)
- index.html/llms.json/manifest.json/public/*: regen sync
- QWEN_INIT_PROMPT.md, skills/pgvector-sovereign-rag/SKILL.md, src/webmcp.ts: sync fixes
- README_SKELETON.md: ZEN README draft (untracked->tracked, F13-approved design)

F13 GO 2026-08-25 ('ok go and execute all') — zero-velocity session, automated

* docs(readme): ZEN first-fold — DISPLAY_ONLY institution hero; manifest re-stamped live

- Hero: 'Display state. Never judge. Never execute.' + four-noun card link
- Old full README preserved verbatim: docs/README-FULL.md
- [VERIFY] slots closed with live witnesses: amanah board has no execute verb (boards/amanah.py read); :3001 degraded = operator sensor data, not machine
- SOT-MANIFEST re-stamped v2026.08.25, live_commit c0b3b98

F13 GO 2026-08-25 ('ok go and execute all')

* boards(amanah): queue DID session-key rotation risk (AMH item) — extractive margin from zen-audit

F13 GO 2026-08-25 ('audit and zen all')

* boards(amanah): queue HERMES Tier-2 hardening + dual-home unification (F13 gates)

* chore(wrap): ZEN README fold 2026-08-25

F8 GENIUS, F11 AUDIT, F4 CLARITY.

- README.md: ZEN first-fold compression
  Removed stale SOT-MANIFEST fields (qwen_code/glm_shadow live-resolved)
  Full technical reference preserved at docs/README-FULL.md

Note: audio/ + knowledge-graph/voice-sample/ untracked.
i-arif V9 voice artifacts are F13 SOVEREIGN BOUND — DO NOT commit.
Present to F13 for sovereign disposition.

Receipt: kimi-code/FI-008 autonomous T1 wrap
No F13 sovereign action.

* refactor(memory): streamline canonical carry_forward, modular intelligence and archive theatre

* seal(carry_forward): update sealed state with cron live receipt and clean federation

* seal(final): ratify sealed carry_forward state (delta_s <= 0)

* feat: MODEL_SHADOWS.md — behavioral shadow ledger for federation model governance

Hypothesis-ledger (not truth-ledger) tracking how models fail under pressure.
Two-class taxonomy: operational (streaming, token budget, format) vs cognitive
(scope diffusion, execution gravity, caution attractor).

Entries: MiniMax-M3 (CONFIRMED), MiMo (PRIOR_ONLY), GLM-5.3 (CONFIRMED),
Gemini (CONFIRMED), DeepSeek (CONFIRMED), Claude (CONFIRMED), Kimi K3 (HYPOTHESIS).

Falsifiable: remove supervision → apply pressure → observe trajectory.

* feat(federation): FRAME boundary alignment — Sprint 1 declaration

Doctrine (SEAL 2026-08-26, F13 ratification pending):
  Substrate lives in state plane, not as peer sovereign surface.
  Identity ≠ location. Consolidate code without erasing identity.

Sprint 1 deliverables (declaration phase, T1 AUTO-DO):
  1. federation/organs.yaml: FRAME block updated
     - repo: arifOS (embedded organ) -> ariffazil/AAA
     - source_path: /root/FRAME -> /root/AAA/federation/frame/
     - added identity_preserved block (F1 AMANAH architectural pattern)
     - added migration_doc pointer

  2. federation/frame/.gitkeep: placeholder created for relocated code

  3. federation/AAA_FEDERATION_FRAME_BOUNDARY_ALIGNMENT.md: full migration plan
     - doctrine, identity inventory, 4 sprints, reversibility protocol
     - operational risks + mitigations
     - F1 AMANAH reversibility at every step

Verifications:
  - YAML parse: VALID
  - FQ: OPTIMAL (execute=4 verify=9 quotient=2.25)
  - All changes reversible (T1 AUTO-DO, no code/runtime/systemd touch)

Next: Sprint 2 (code relocation, T1) pending F13 ratification.
SEAL-976fbde5d93a4119

* feat(federation): FRAME code relocation — Sprint 2

Consolidate arifOS substrate organ into AAA state plane.

Sprint 2 deliverables (T1 AUTO-DO, all reversible):
  - Code copy from /root/FRAME/ to /root/AAA/federation/frame/
  - 26 files migrated: src/, tests/, doctrine/, data/, scripts/, .github/
  - Systemd unit (frame-organ.service)
  - LICENSE (AGPL-3.0), Makefile, pyproject.toml
  - README.md, doctrine/FI_DRIFT_GOVERNANCE.md

Verifications:
  - python3 import: 'import frame_organ' OK from new location
  - external imports: 0 — package is self-contained, no import rewrites needed
  - identity preserved: service_unit, python_package, public_port unchanged
  - /root/FRAME/ untouched — full rollback safety net

Identity-preserving relocation:
  - frame-organ.service: name unchanged
  - :18085 endpoint: unchanged
  - frame_organ Python import: unchanged
  - org.yaml identity_preserved block declares all preservation invariants

Doctrine ref: federation/AAA_FEDERATION_FRAME_BOUNDARY_ALIGNMENT.md

Sprint 3 (systemd ExecStart swap) PENDING — requires 10s announce + F13 ratification.
Sprint 4 (GitHub archive of ariffazil/FRAME) PENDING.

SEAL-976fbde5d93a4119

* chore: remove codegraph.db from tracking — generated artifact (74MB)

graph/codegraph.db is a generated SQLite database built by graph/indexer.py.
Added to .gitignore. File remains on disk; rebuildable via indexer.

* feat(federation): FRAME runtime swap — Sprint 3

Symlink bridge approach (cleaner than ExecStart path change):

  - /opt/frame/app/frame_organ → /root/AAA/federation/frame/src/frame_organ
  - systemd unit unchanged (WorkingDirectory + ExecStart)
  - service unit name unchanged: frame-organ.service
  - port unchanged: :18085
  - frame_organ Python import: unchanged

Systemd unit edits (minimal):
  - ProtectHome=yes → ProtectHome=read-only
    (yes bind-mounts /root to /dev/null; ReadOnlyPaths can't grant access
     to non-existent paths; read-only preserves /root access while keeping
     the security intent)
  - ReadOnlyPaths extended to include /root/AAA/federation/frame

Verifications (all green):
  - systemctl status: active
  - /health: 200, all 6 chambers live
  - /frame/baseline: 10 organs with health/latency
  - /frame/probe: 10 healthy, 0 degraded
  - /frame/drift: STABLE verdict
  - frame_organ import: loaded from AAA canonical path

Identity preservation (verified):
  - service_unit: frame-organ.service  unchanged
  - python_package: frame_organ         unchanged
  - public_port: 18085                  unchanged
  - license: AGPL-3.0                   preserved
  - doctrine docs: preserved

Rollback safety net (preserved):
  - /opt/frame/app/frame_organ.bak.SPRINT3redux  (original code)
  - /root/AAA/federation/frame/frame-organ.service.bak.pre-Sprint3  (original unit)

Eureka captured: 'ProtectHome=yes bind-mounts /root to /dev/null; ReadOnlyPaths
cannot grant access to non-existent paths. Use ProtectHome=read-only for
surgical read access to /root while preserving the security intent.'

Doctrine ref: federation/AAA_FEDERATION_FRAME_BOUNDARY_ALIGNMENT.md updated

Sprint 4 (GitHub archive of arifazil/FRAME) PENDING — requires F13 + web UI.

SEAL-976fbde5d93a4119

* docs(federation): Sprint 4 complete — FRAME archived, deprecation registered

Sprint 4 status: SEAL · EXECUTED 2026-08-26

Actions completed:
  - FRAME README: ARCHIVED notice added (commit f9e9bdb on FRAME repo)
  - FRAME pushed to origin (2bef2ce..f9e9bdb master)
  - gh repo archive ariffazil/FRAME --yes → isArchived: true
  - DEPRECATION_REGISTRY.yaml: ariffazil/FRAME entry added (status: ARCHIVED)
  - Boundary alignment doc: status table updated (SEAL)

Final state of FRAME boundary alignment (4 sprints):
  Sprint 1 - Declaration:        SEAL · committed 0b388b6 · pushed
  Sprint 2 - Code relocation:    SEAL · committed 7b8afbe · pushed
  Sprint 3 - Runtime swap:       SEAL · committed 500ba27 · pushed
  Sprint 4 - Retire old repo:    SEAL · committed f9e9bdb · archived

Doctrine: substrate belongs in state plane, not as peer sovereign.
Identity preserved end-to-end: systemd unit name, port, Python import, license.

SEAL-976fbde5d93a4119

* feat(multimodal): register Gemini 3.7 & multimodal ecosystem, sync router & scars

* feat(mcp): seal FastMCP gemini-media deployment, live verifications & path drift scar

* chore(skill-consolidation): orphan skill cleanup

[F2 evidence]
- 283 deleted files in skills/ — orphan skills consolidated to federated mesh
- Per-file rationale: /root/forge_work/2026-08-26-zen-mu/per_file_rationale.jsonl
- Musyawarah: 2026-08-26-zen-mu (ARCHITECT 333-AGI + AUDITOR 555-ASI)
- F13 GO received for T2 cluster

[F1 AMANAH] Backup: carry_forward.json.bak-20260825T215449Z-pre-mu-zen-seal
[F11 AUDIT] Sovereign lanes EXCLUDED (HERMES/lanes/private/* not in dirty state)
[F2 TRUTH] Live git sweep verified 828 dirty total across 7 repos (this commit: AAA only)

* chore(governance-doc): GRAMMAR_DOCTRINE + skill-retired archive + domain organization

[F2 evidence]
- governance/GRAMMAR_DOCTRINE.md (new) — grammar doctrine reference
- skills-retired-20260826/ — retired skill archive (hundreds of files preserved)
- skills/domains/ — domain-organized skill structure (apex/capital/forge/geo)
- Musyawarah: 2026-08-26-zen-mu
- F13 GO received

[F1 AMANAH] Backup verified before commit
[F11 AUDIT] Per-file rationale: /root/forge_work/2026-08-26-zen-mu/per_file_rationale.jsonl

* chore(session-artifact): evidence-gate-v2 session + engineering + governance skills

[F2 evidence]
- canon/SESSION-2026-08-26-evidence-gate-v2.md — session record for evidence gate v2
- skills/engineering/ — engineering domain skills
- skills/governance/ — governance domain skills
- Musyawarah: 2026-08-26-zen-mu
- F13 GO received

* feat(sign-agent-card): regenerate Loop F script (air-gap Ed25519 signer)

[F2 evidence]
- scripts/sign-agent-card.sh — NEW (5569+ bytes, was MISSING ON DISK per carry_forward Loop F)
- Signs agent-card.json with Ed25519 (canonical JSON, atomic write)
- Updates proofValue + proofValue_note timestamp
- Reference: sovereign_signer.py + sovereign_verify.py patterns

[F2 TRUTH] Generated from documented patterns, no functional test (requires air-gapped Ed25519 key)
[F13 SOVEREIGN] Loop F still awaits Arif physical air-gap signing per OFFLINE_CHECKLIST.md
[F1 AMANAH] Script never holds the sovereign key — reads from /mnt/usb/sovereign.pem

Musyawawah: 2026-08-26-zen-mu
F13 GO received

* feat(meta-mesa): add Claude & Qwen meta-mesa and zen router skills

* feat(skills): qwencloud full suite + mmx-cli + AAA-shadow-mode + fi-mesh-check

14 new Qwen Cloud skills (audio-tts, deploy, image-generation,
model-selector, ops-auth, text, update-check, usage, video-generation,
vision, etc.) — sovereign capability surface for Qwen Token Plan
integration.

+ skills/mmx-cli/ — mmx CLI bridge for media generation
+ skills/AAA-shadow-mode/ — sovereign GPU compute doctrine
  (F13-aware, privacy-isolated, A100/Hostinger/RunPod routing)

modified:
- extensions/fi003-federation/commands/mesh-check.md
- extensions/fi003-federation/skills/fi-mesh-check/SKILL.md
- scripts/fed_router.py
- skills/fi-mesh-check/SKILL.md

Reversible T1. F2 evidence: live mesh-check probe.

NOTE: AAA-shadow-mode is sovereign-territory (F13 floor scope).
Skill body is doctrinal reference only — actual deployment
requires F13 sovereign ratification per Loop F scar.

Signed-off-by: F13 ARIF <arif@arifos.arif>

* docs(cards): agent card tree drift report 2026-08-27 — F10 ghost ref (legacy README points to empty a2a README), canonical tree incomplete (missing i-ARIF/skills.json/777-forge), schema divergence. Awaiting F13 Option A/B/C.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: F13 ARIF <arif@arifos.arif>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kimi-code/FI-008 <kimi-code@arifos.local>
Co-authored-by: 333-AGI <333-AGI@arifos.local>
@ariffazil ariffazil mentioned this pull request Aug 27, 2026
Merged
ariffazil added a commit that referenced this pull request Aug 27, 2026
@ariffazil @dependabot
kimi-code/FI-008 333-AGI
Update dependencies and enhance documentation for governance (#174) (#…
87edbb5 
…175)

* chore(deps): merge safe-automerge PR #171

Bumps the all-npm-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.2` | `2.112.3` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.2` | `4.12.3` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.4` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.9` | `4.23.12` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |


Updates `@supabase/supabase-js` from 2.112.2 to 2.112.3
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.112.3/packages/core/supabase-js)

Updates `react-resizable-panels` from 4.12.2 to 4.12.3
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.12.2...4.12.3)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `eslint` from 10.8.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.4
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.3...v0.5.4)

Updates `tsx` from 4.23.9 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.9...v4.23.12)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.112.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: react-resizable-panels
  dependency-version: 4.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-npm-patch
...




* chore(deps): merge safe-automerge PR #172

Bumps the all-npm-minor group with 4 updates: [@hookform/resolvers](https://github.com/react-hook-form/resolvers), [input-otp](https://github.com/guilhermerodz/input-otp/tree/HEAD/packages/input-otp), [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react).


Updates `@hookform/resolvers` from 5.8.0 to 5.9.1
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.8.0...v5.9.1)

Updates `input-otp` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/guilhermerodz/input-otp/releases)
- [Changelog](https://github.com/guilhermerodz/input-otp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/guilhermerodz/input-otp/commits/v1.5.0/packages/input-otp)

Updates `lucide-react` from 1.31.0 to 1.33.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: input-otp
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: lucide-react
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-npm-minor
...




* docs(readme): DISPLAY_ONLY ceiling in first fold

AAA shows state and queues A2A. It never judges. It never
executes. Matches live cockpit, llms.txt, and Observatory.

* docs(llms): organ table matches live Holy 8 and DISPLAY_ONLY

Stop advertising 13 canonical kernel tools and 9 AAA MCP tools.
AAA is A2A, not an MCP organ. Door is /mcp.

* feat(cockpit): amanah board state + supply-chain pin gate (E-2) + manifest/skill truth-sync

- boards/amanah.{jsonl,py}: runtime work-order state
- instructions/gate-promotion.md + registries/supply_chain_pins.json + scripts/supply_chain_gate.py: E-2 pin gate, fail-closed, 7 configs watched, 11 pins
- security/skill-manifest.json: truth-sync -1144/+438 (stop advertising retired skills)
- README.md + public/llms.txt: DISPLAY_ONLY first fold (converged with origin/main 67cab47/f46d784a)
- index.html/llms.json/manifest.json/public/*: regen sync
- QWEN_INIT_PROMPT.md, skills/pgvector-sovereign-rag/SKILL.md, src/webmcp.ts: sync fixes
- README_SKELETON.md: ZEN README draft (untracked->tracked, F13-approved design)

F13 GO 2026-08-25 ('ok go and execute all') — zero-velocity session, automated

* docs(readme): ZEN first-fold — DISPLAY_ONLY institution hero; manifest re-stamped live

- Hero: 'Display state. Never judge. Never execute.' + four-noun card link
- Old full README preserved verbatim: docs/README-FULL.md
- [VERIFY] slots closed with live witnesses: amanah board has no execute verb (boards/amanah.py read); :3001 degraded = operator sensor data, not machine
- SOT-MANIFEST re-stamped v2026.08.25, live_commit c0b3b98

F13 GO 2026-08-25 ('ok go and execute all')

* boards(amanah): queue DID session-key rotation risk (AMH item) — extractive margin from zen-audit

F13 GO 2026-08-25 ('audit and zen all')

* boards(amanah): queue HERMES Tier-2 hardening + dual-home unification (F13 gates)

* chore(wrap): ZEN README fold 2026-08-25

F8 GENIUS, F11 AUDIT, F4 CLARITY.

- README.md: ZEN first-fold compression
  Removed stale SOT-MANIFEST fields (qwen_code/glm_shadow live-resolved)
  Full technical reference preserved at docs/README-FULL.md

Note: audio/ + knowledge-graph/voice-sample/ untracked.
i-arif V9 voice artifacts are F13 SOVEREIGN BOUND — DO NOT commit.
Present to F13 for sovereign disposition.

Receipt: kimi-code/FI-008 autonomous T1 wrap
No F13 sovereign action.

* refactor(memory): streamline canonical carry_forward, modular intelligence and archive theatre

* seal(carry_forward): update sealed state with cron live receipt and clean federation

* seal(final): ratify sealed carry_forward state (delta_s <= 0)

* feat: MODEL_SHADOWS.md — behavioral shadow ledger for federation model governance

Hypothesis-ledger (not truth-ledger) tracking how models fail under pressure.
Two-class taxonomy: operational (streaming, token budget, format) vs cognitive
(scope diffusion, execution gravity, caution attractor).

Entries: MiniMax-M3 (CONFIRMED), MiMo (PRIOR_ONLY), GLM-5.3 (CONFIRMED),
Gemini (CONFIRMED), DeepSeek (CONFIRMED), Claude (CONFIRMED), Kimi K3 (HYPOTHESIS).

Falsifiable: remove supervision → apply pressure → observe trajectory.

* feat(federation): FRAME boundary alignment — Sprint 1 declaration

Doctrine (SEAL 2026-08-26, F13 ratification pending):
  Substrate lives in state plane, not as peer sovereign surface.
  Identity ≠ location. Consolidate code without erasing identity.

Sprint 1 deliverables (declaration phase, T1 AUTO-DO):
  1. federation/organs.yaml: FRAME block updated
     - repo: arifOS (embedded organ) -> ariffazil/AAA
     - source_path: /root/FRAME -> /root/AAA/federation/frame/
     - added identity_preserved block (F1 AMANAH architectural pattern)
     - added migration_doc pointer

  2. federation/frame/.gitkeep: placeholder created for relocated code

  3. federation/AAA_FEDERATION_FRAME_BOUNDARY_ALIGNMENT.md: full migration plan
     - doctrine, identity inventory, 4 sprints, reversibility protocol
     - operational risks + mitigations
     - F1 AMANAH reversibility at every step

Verifications:
  - YAML parse: VALID
  - FQ: OPTIMAL (execute=4 verify=9 quotient=2.25)
  - All changes reversible (T1 AUTO-DO, no code/runtime/systemd touch)

Next: Sprint 2 (code relocation, T1) pending F13 ratification.
SEAL-976fbde5d93a4119

* feat(federation): FRAME code relocation — Sprint 2

Consolidate arifOS substrate organ into AAA state plane.

Sprint 2 deliverables (T1 AUTO-DO, all reversible):
  - Code copy from /root/FRAME/ to /root/AAA/federation/frame/
  - 26 files migrated: src/, tests/, doctrine/, data/, scripts/, .github/
  - Systemd unit (frame-organ.service)
  - LICENSE (AGPL-3.0), Makefile, pyproject.toml
  - README.md, doctrine/FI_DRIFT_GOVERNANCE.md

Verifications:
  - python3 import: 'import frame_organ' OK from new location
  - external imports: 0 — package is self-contained, no import rewrites needed
  - identity preserved: service_unit, python_package, public_port unchanged
  - /root/FRAME/ untouched — full rollback safety net

Identity-preserving relocation:
  - frame-organ.service: name unchanged
  - :18085 endpoint: unchanged
  - frame_organ Python import: unchanged
  - org.yaml identity_preserved block declares all preservation invariants

Doctrine ref: federation/AAA_FEDERATION_FRAME_BOUNDARY_ALIGNMENT.md

Sprint 3 (systemd ExecStart swap) PENDING — requires 10s announce + F13 ratification.
Sprint 4 (GitHub archive of ariffazil/FRAME) PENDING.

SEAL-976fbde5d93a4119

* chore: remove codegraph.db from tracking — generated artifact (74MB)

graph/codegraph.db is a generated SQLite database built by graph/indexer.py.
Added to .gitignore. File remains on disk; rebuildable via indexer.

* feat(federation): FRAME runtime swap — Sprint 3

Symlink bridge approach (cleaner than ExecStart path change):

  - /opt/frame/app/frame_organ → /root/AAA/federation/frame/src/frame_organ
  - systemd unit unchanged (WorkingDirectory + ExecStart)
  - service unit name unchanged: frame-organ.service
  - port unchanged: :18085
  - frame_organ Python import: unchanged

Systemd unit edits (minimal):
  - ProtectHome=yes → ProtectHome=read-only
    (yes bind-mounts /root to /dev/null; ReadOnlyPaths can't grant access
     to non-existent paths; read-only preserves /root access while keeping
     the security intent)
  - ReadOnlyPaths extended to include /root/AAA/federation/frame

Verifications (all green):
  - systemctl status: active
  - /health: 200, all 6 chambers live
  - /frame/baseline: 10 organs with health/latency
  - /frame/probe: 10 healthy, 0 degraded
  - /frame/drift: STABLE verdict
  - frame_organ import: loaded from AAA canonical path

Identity preservation (verified):
  - service_unit: frame-organ.service  unchanged
  - python_package: frame_organ         unchanged
  - public_port: 18085                  unchanged
  - license: AGPL-3.0                   preserved
  - doctrine docs: preserved

Rollback safety net (preserved):
  - /opt/frame/app/frame_organ.bak.SPRINT3redux  (original code)
  - /root/AAA/federation/frame/frame-organ.service.bak.pre-Sprint3  (original unit)

Eureka captured: 'ProtectHome=yes bind-mounts /root to /dev/null; ReadOnlyPaths
cannot grant access to non-existent paths. Use ProtectHome=read-only for
surgical read access to /root while preserving the security intent.'

Doctrine ref: federation/AAA_FEDERATION_FRAME_BOUNDARY_ALIGNMENT.md updated

Sprint 4 (GitHub archive of arifazil/FRAME) PENDING — requires F13 + web UI.

SEAL-976fbde5d93a4119

* docs(federation): Sprint 4 complete — FRAME archived, deprecation registered

Sprint 4 status: SEAL · EXECUTED 2026-08-26

Actions completed:
  - FRAME README: ARCHIVED notice added (commit f9e9bdb on FRAME repo)
  - FRAME pushed to origin (2bef2ce..f9e9bdb master)
  - gh repo archive ariffazil/FRAME --yes → isArchived: true
  - DEPRECATION_REGISTRY.yaml: ariffazil/FRAME entry added (status: ARCHIVED)
  - Boundary alignment doc: status table updated (SEAL)

Final state of FRAME boundary alignment (4 sprints):
  Sprint 1 - Declaration:        SEAL · committed 0b388b6 · pushed
  Sprint 2 - Code relocation:    SEAL · committed 7b8afbe · pushed
  Sprint 3 - Runtime swap:       SEAL · committed 500ba27 · pushed
  Sprint 4 - Retire old repo:    SEAL · committed f9e9bdb · archived

Doctrine: substrate belongs in state plane, not as peer sovereign.
Identity preserved end-to-end: systemd unit name, port, Python import, license.

SEAL-976fbde5d93a4119

* feat(multimodal): register Gemini 3.7 & multimodal ecosystem, sync router & scars

* feat(mcp): seal FastMCP gemini-media deployment, live verifications & path drift scar

* chore(skill-consolidation): orphan skill cleanup

[F2 evidence]
- 283 deleted files in skills/ — orphan skills consolidated to federated mesh
- Per-file rationale: /root/forge_work/2026-08-26-zen-mu/per_file_rationale.jsonl
- Musyawarah: 2026-08-26-zen-mu (ARCHITECT 333-AGI + AUDITOR 555-ASI)
- F13 GO received for T2 cluster

[F1 AMANAH] Backup: carry_forward.json.bak-20260825T215449Z-pre-mu-zen-seal
[F11 AUDIT] Sovereign lanes EXCLUDED (HERMES/lanes/private/* not in dirty state)
[F2 TRUTH] Live git sweep verified 828 dirty total across 7 repos (this commit: AAA only)

* chore(governance-doc): GRAMMAR_DOCTRINE + skill-retired archive + domain organization

[F2 evidence]
- governance/GRAMMAR_DOCTRINE.md (new) — grammar doctrine reference
- skills-retired-20260826/ — retired skill archive (hundreds of files preserved)
- skills/domains/ — domain-organized skill structure (apex/capital/forge/geo)
- Musyawarah: 2026-08-26-zen-mu
- F13 GO received

[F1 AMANAH] Backup verified before commit
[F11 AUDIT] Per-file rationale: /root/forge_work/2026-08-26-zen-mu/per_file_rationale.jsonl

* chore(session-artifact): evidence-gate-v2 session + engineering + governance skills

[F2 evidence]
- canon/SESSION-2026-08-26-evidence-gate-v2.md — session record for evidence gate v2
- skills/engineering/ — engineering domain skills
- skills/governance/ — governance domain skills
- Musyawarah: 2026-08-26-zen-mu
- F13 GO received

* feat(sign-agent-card): regenerate Loop F script (air-gap Ed25519 signer)

[F2 evidence]
- scripts/sign-agent-card.sh — NEW (5569+ bytes, was MISSING ON DISK per carry_forward Loop F)
- Signs agent-card.json with Ed25519 (canonical JSON, atomic write)
- Updates proofValue + proofValue_note timestamp
- Reference: sovereign_signer.py + sovereign_verify.py patterns

[F2 TRUTH] Generated from documented patterns, no functional test (requires air-gapped Ed25519 key)
[F13 SOVEREIGN] Loop F still awaits Arif physical air-gap signing per OFFLINE_CHECKLIST.md
[F1 AMANAH] Script never holds the sovereign key — reads from /mnt/usb/sovereign.pem

Musyawawah: 2026-08-26-zen-mu
F13 GO received

* feat(meta-mesa): add Claude & Qwen meta-mesa and zen router skills

* feat(skills): qwencloud full suite + mmx-cli + AAA-shadow-mode + fi-mesh-check

14 new Qwen Cloud skills (audio-tts, deploy, image-generation,
model-selector, ops-auth, text, update-check, usage, video-generation,
vision, etc.) — sovereign capability surface for Qwen Token Plan
integration.

+ skills/mmx-cli/ — mmx CLI bridge for media generation
+ skills/AAA-shadow-mode/ — sovereign GPU compute doctrine
  (F13-aware, privacy-isolated, A100/Hostinger/RunPod routing)

modified:
- extensions/fi003-federation/commands/mesh-check.md
- extensions/fi003-federation/skills/fi-mesh-check/SKILL.md
- scripts/fed_router.py
- skills/fi-mesh-check/SKILL.md

Reversible T1. F2 evidence: live mesh-check probe.

NOTE: AAA-shadow-mode is sovereign-territory (F13 floor scope).
Skill body is doctrinal reference only — actual deployment
requires F13 sovereign ratification per Loop F scar.



* docs(cards): agent card tree drift report 2026-08-27 — F10 ghost ref (legacy README points to empty a2a README), canonical tree incomplete (missing i-ARIF/skills.json/777-forge), schema divergence. Awaiting F13 Option A/B/C.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: F13 ARIF <arif@arifos.arif>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kimi-code/FI-008 <kimi-code@arifos.local>
Co-authored-by: 333-AGI <333-AGI@arifos.local>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

safe-automerge Dependabot patch/minor — safe for auto-merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ariffazil