chore: repair CI and refresh dependencies

[steipete]

Summary

• realign the maintainer-orchestrator policy guard with the bounded orchestration contract introduced by cbdf582, while continuing to enforce single-item routing, serial repository ownership, read-only support subagents, local-work preservation, serialized public actions, and exact-run monitoring
• update puppeteer-core from 25.3.0 to 25.5.0 and youtube-transcript-plus from 2.0.0 to 2.0.1, including both lockfiles
• move CI from Node 22 to the current LTS line, Node 24; Bun 1.3.14 and the GitHub Actions majors were already current

Root cause

The default-branch CI failure was deterministic, not flaky. The orchestrator skill was intentionally rewritten from an always-on portfolio policy to a bounded activation model, but its exact-string guard still required 34 sentences removed by that refactor. The replacement assertions cover the new contract rather than weakening or skipping the check.

Proof

• scripts/test-maintainer-orchestrator-policy
• scripts/validate-skills
• the complete CI smoke sequence with frozen Bun/npm installs and compiled Browser Tools binary
• Browser Tools, huge-context, fleet-maintenance, npm-auth, mac-release, and skill-cleaner test suites
• bun audit and nested npm audit (zero vulnerabilities)
• compiled Browser Tools live proof: isolated Chrome 151 on port 19222 loaded and extracted https://example.com through Puppeteer 25.5.0; the exact-port processes were then terminated and verified gone
• transcript live proof: the updated downloader fetched a non-empty 19,988-byte transcript from a real YouTube video
• two clean Codex autoreviews with no accepted/actionable findings

No changelog entry: the changes are CI/test/dependency maintenance and do not change the user-facing contract.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 10, 2026, 2:29 AM ET / 06:29 UTC.

ClawSweeper review

What this changes

Updates the orchestration-policy guard for the current bounded-workflow contract, upgrades Puppeteer and transcript dependencies, and moves CI from Node 22 to Node 24.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open for normal maintainer landing: this owner-authored PR is cleanly mergeable, exact-head CI is green, and review found no actionable patch defect.

Priority: P3
Reviewed head: 4fd089aaa7efb9f22b2207483ae53568f923ed17

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, coherent maintenance patch with green CI and no actionable review findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This owner-authored maintenance PR is exempt from the external-contributor proof gate; its body also records live dependency checks and green CI.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored maintenance PR is exempt from the external-contributor proof gate; its body also records live dependency checks and green CI.
Evidence reviewed	5 items	Bounded policy guard: The PR replaces legacy always-on orchestration assertions with checks for direct single-item work, bounded activation, serialized public mutation, and exact-head landing gates. Policy source matches assertions: The PR-head skill defines direct handling for single items, bounded orchestration activation, serial same-repository work, and explicit persistent monitoring. Dependency consistency: Both manifests and their lockfiles resolve Puppeteer to 25.5.0 and youtube-transcript-plus to 2.0.1; the nested package requires Node 20 or newer, so Node 24 satisfies its declared engine.
Findings	None	None.
Security	None	None.

How this fits together

CI installs the repository’s Bun and nested npm dependencies, then runs skill-policy and smoke checks. The changed guard keeps the maintainer orchestration skill aligned with its documented operating contract before the workflow reports success.

flowchart LR
  A[Pull request changes] --> B[CI workflow]
  B --> C[Node and Bun setup]
  C --> D[Dependency installation]
  D --> E[Policy and skill checks]
  E --> F[Smoke checks pass]

Loading

Before merge

• Complete next step (P2) - This owner-authored, green PR needs normal landing review rather than an automated repair lane.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	6 files changed; 40 added, 49 removed	The maintenance work remains narrowly bounded to one CI setting, two dependency pairs with lockfiles, and one policy guard.

Technical review

Best possible solution:

Land the focused maintenance update through the normal maintainer workflow, retaining the current lockfile-backed dependency versions and bounded-policy assertions.

Do we have a high-confidence way to reproduce the issue?

Not applicable: the PR addresses a deterministic policy-check mismatch and dependency maintenance; the supplied exact-head smoke check is green.

Is this the best way to solve the issue?

Yes: updating the guard to test the current bounded orchestration contract, while keeping manifests and lockfiles synchronized, is the narrow maintainable repair.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 096a5feee908.

Labels

Label changes:

• add P3: This is focused CI and dependency maintenance with green exact-head checks, not a user-facing incident.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored maintenance PR is exempt from the external-contributor proof gate; its body also records live dependency checks and green CI.

Label justifications:

• P3: This is focused CI and dependency maintenance with green exact-head checks, not a user-facing incident.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored maintenance PR is exempt from the external-contributor proof gate; its body also records live dependency checks and green CI.

Evidence

What I checked:

• Bounded policy guard: The PR replaces legacy always-on orchestration assertions with checks for direct single-item work, bounded activation, serialized public mutation, and exact-head landing gates. (scripts/test-maintainer-orchestrator-policy:8, b882042361e8)
• Policy source matches assertions: The PR-head skill defines direct handling for single items, bounded orchestration activation, serial same-repository work, and explicit persistent monitoring. (skills/maintainer-orchestrator/SKILL.md:12, 096a5feee908)
• Dependency consistency: Both manifests and their lockfiles resolve Puppeteer to 25.5.0 and youtube-transcript-plus to 2.0.1; the nested package requires Node 20 or newer, so Node 24 satisfies its declared engine. (bun.lock:40, 4fd089aaa7ef)
• CI and diff checks: The supplied exact-head smoke check succeeded; local diff whitespace validation reported no errors. (.github/workflows/ci.yml:17, 4fd089aaa7ef)
• Area provenance: The CI workflow lines were introduced by Peter Steinberger in the current main history, establishing a direct ownership trail for this maintenance surface. (.github/workflows/ci.yml:17, affd1a5b3b40)

Likely related people:

• Peter Steinberger: Git blame attributes the workflow setup to this author, and the submitted commits cover the same CI, dependency, and orchestration-policy surfaces. (role: original CI workflow contributor and recent area contributor; confidence: high; commits: affd1a5b3b40, b882042361e8, 4fd089aaa7ef; files: .github/workflows/ci.yml, scripts/test-maintainer-orchestrator-policy, package.json)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.