3 people 5bbe538bdc v1.91.213.0 fix(ci): Node.js 22.23.4 in the CI image and Ubicloud free-suite VMs, SHA-256 verified (port #3355, fixes #3354) (#3400) ...

* fix(ci): bump Node.js to 22.23.4 for CVE-2026-111497

* fix(ci): pin Node.js 22.23.4 in the Ubicloud free-suite bootstrap too, and verify both archives by SHA-256

#3355 bumped Dockerfile.ci only; scripts/ubicloud/setup-free-suite.sh still
installed 22.20.0. Both now pin the same version and the linux-x64 SHA-256
from the release's signed SHASUMS256.txt, check the archive before unpacking,
and test/ci-image-cli-pin.test.ts keeps the two pins equal (#3354).

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

Co-authored-by: Michael Sumner <75835774+michael-sumner@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* docs(changelog): Node.js 22.23.4 CI pin (#3354)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(ci-image): name Dockerfile.ci in a form pregate resolves; assert the image hash in the parity case

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: Michael Sumner <75835774+michael-sumner@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

2026-10-25 15:57:06 +00:00

..

app

feat: GStack Browser — double-click AI browser with anti-bot stealth (#695)

2026-04-04 10:17:05 -07:00

lib

v1.91.183.0 fix(evals): a rejected API key is INFRA, never 131 assertion reds and reruns (#3361)

2026-10-23 18:05:39 +00:00

resolvers

v1.91.203.0 feat(router): verified cause → fix, bounded triage for unknown causes (#3157, #3158) (#3395)

2026-10-25 10:09:02 +00:00

ubicloud

v1.91.213.0 fix(ci): Node.js 22.23.4 in the CI image and Ubicloud free-suite VMs, SHA-256 verified (port #3355, fixes #3354) (#3400)

2026-10-25 15:57:06 +00:00

analytics.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

archetypes.ts

feat: gstack v1 — simpler prompts + real LOC receipts (v1.0.0.0) (#1039)

2026-04-18 15:05:42 +08:00

brain-cache-spec.ts

v1.91.8.0 test: smaller suite, derived paid selection, retired never-green evals (#2994)

2026-09-29 08:58:49 -07:00

build-app.sh

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

build-cso-windows.ps1

v1.91.19.0 fix: severe fix wave (truthful gates, no lost memory, every host finds gstack) (#3025)

2026-10-04 07:58:41 -07:00

build-cso.sh

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

build.sh

v1.91.65.0 fix(install): skills only for the agents you installed, every runtime-root file their skills read (#3080)

2026-10-08 16:17:18 +00:00

bump-harness-version.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

capture-baseline.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

census-arms.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

compare-pr-version.ts

v1.91.165.0 fix(version-gate): accept an unstamped READY head under merge trains (GSTA-49 S1) (#3323)

2026-10-20 15:01:46 +00:00

cso-attestation-evidence.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-eval-output-redaction.ts

v1.91.75.0 fix(cso-eval): fail producer receipts only on credential-class output, naming the rules (#3120)

2026-10-11 01:18:11 +00:00

cso-eval-producer.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-eval-protocol.ts

v1.91.124.0 feat(cso): helper run clock (remainingSeconds), /cso time discipline, content-free producer tool timeline (#3242)

2026-10-17 17:19:52 +00:00

cso-eval.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-image-matrix.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-native-evidence.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-public-ghcr.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-requalification.ts

v1.91.176.0 cso: ignore the compiled helpers' leading #! line in the release contract's preparationSha256 (both sides) (#3333)

2026-10-21 19:22:49 +00:00

cso-runtime-promotion.ts

v1.91.176.0 cso: ignore the compiled helpers' leading #! line in the release contract's preparationSha256 (both sides) (#3333)

2026-10-21 19:22:49 +00:00

cso-sbom-packages-check.jq

v1.91.27.0 fix(cso): runtime staging can finish and a qualified scanner catalog can ship (#3041)

2026-10-05 10:00:47 -07:00

cso-sbom-packages.jq

v1.91.27.0 fix(cso): runtime staging can finish and a qualified scanner catalog can ship (#3041)

2026-10-05 10:00:47 -07:00

cso-scanner-catalog.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-scanner-matrix.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-staging-run.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

cso-verify-runtime-base.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

declared-annotation.ts

v1.91.11.0 refactor: one state-root rule, browse route table, shared shard engine, PTY harness split, MECE review resolvers (#3002)

2026-10-01 11:57:48 -07:00

detect-bump.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

dev-skill.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

discover-skills.ts

v1.87.6.0 fix: make checks reliable and everyday validation faster (#2898)

2026-09-22 14:57:52 -04:00

e2e-shard-reuse.ts

v1.91.149.0 feat(evals): Codex host for gate cases, sol weekly and Fable/Astra monthly census arms (GSTA-49 TM2) (#3292)

2026-10-19 18:26:20 +00:00

eval-bg.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-compare.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-flake-rank.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-input-cache.ts

v1.91.12.0 v1.91.12.0: audit fix wave, ~11-minute paid eval lanes, eval reliability policy (#2999)

2026-10-01 13:55:16 -07:00

eval-list.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-readiness.ts

v1.91.162.0 feat(evals): merge-train workflow side, inert behind the train policy block (GSTA-49 T1b) (#3279)

2026-10-20 02:13:39 +00:00

eval-select.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-summary.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

eval-trial-series.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

exercised-map.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

external-skill-names.ts

v1.91.2.0 fix: consolidate gstack reliability wave (#2959)

2026-09-26 18:57:53 -04:00

free-test-durations-windows.json

v1.91.147.0 test(seed): refresh the free-suite duration seeds (#3289)

2026-10-19 15:17:57 +00:00

free-test-durations.json

v1.91.147.0 test(seed): refresh the free-suite duration seeds (#3289)

2026-10-19 15:17:57 +00:00

free-test-seed-allowlist.json

v1.91.147.0 test(seed): refresh the free-suite duration seeds (#3289)

2026-10-19 15:17:57 +00:00

garry-output-comparison.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gate-cost-replay.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gate-diff-calibrate.ts

feat: honest work and gate integrity — gate-edit detector, review/ship gate pass, zero-run green, claims-need-evidence kernel (#3114)

2026-10-10 22:33:01 +00:00

gate-reuse.ts

v1.91.163.0 feat(evals): the gate reruns failed cases once and reports a flaky green (GSTA-49 F1) (#3315)

2026-10-20 04:47:11 +00:00

gen-agents-digest.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gen-doctor-components.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gen-llms-txt.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gen-ship-goldens.ts

v1.91.77.0 feat(ship): two-stage gstack-pregate, gstack-regen generated-file registry, intent-based issue links (multi-agent wave C-pregate) (#3121)

2026-10-11 01:57:16 +00:00

gen-skill-docs.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

gstack-schema-pack.ts

v1.52.1.0 feat: brain-aware planning — 5 skills read structured gbrain context before asking (#1742)

2026-05-29 08:35:00 -07:00

harness-version.json

v1.91.201.0 fix(confidence): one severity scale, CRITICAL/INFORMATIONAL, for /ship's review army and /plan-eng-review (#3349) (#3402)

2026-10-25 07:15:55 +00:00

host-config-export.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

host-config.ts

v1.91.16.0 fix: safe installs and upgrades, skills start everywhere, truthful completion (parallel wave) (#3014)

2026-10-03 07:54:09 -07:00

jargon-list.json

feat: gstack v1 — simpler prompts + real LOC receipts (v1.0.0.0) (#1039)

2026-04-18 15:05:42 +08:00

judge-calibration-configs.ts

v1.91.144.0 feat(evals): Opus 5.5 is the paid gate's model under test; judge stays Fable (GSTA-49 TM1) (#3275)

2026-10-19 07:26:49 +00:00

judge-calibration.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

judge-controls.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

measure-journal-read.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

model-policy-freshness.ts

v1.91.45.0 feat: configurable model tiers and advisory freshness (#3073)

2026-10-08 08:00:08 +00:00

models.ts

v1.91.144.0 feat(evals): Opus 5.5 is the paid gate's model under test; judge stays Fable (GSTA-49 TM1) (#3275)

2026-10-19 07:26:49 +00:00

one-way-doors.ts

v1.61.0.0 fix wave: guards failing open / silent failures (9 fixes, 4 community PRs absorbed) (#2472)

2026-08-08 09:28:45 -07:00

paid-test-durations.json

v1.91.30.0 fix: honest eval failure reports, Bun floor with safe auto-update, make-pdf and /review on Codex (#3033)

2026-10-06 18:07:50 +00:00

pr-dependencies.ts

v1.91.172.0 feat(capy): approvals per thread, Captain plan briefs and before/after PR images (#3328)

2026-10-20 23:55:41 +00:00

preflight-agent-sdk.ts

v1.91.24.0 test: audit wave — PR evals keep finished work, honest ceilings, EVAL_POLICY v2, faster free suite (#3031)

2026-10-05 01:29:54 +00:00

preflight-codex-overlap.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

prompt-audit-manifest.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

psychographic-signals.ts

v1.91.12.0 v1.91.12.0: audit fix wave, ~11-minute paid eval lanes, eval reliability policy (#2999)

2026-10-01 13:55:16 -07:00

question-registry.ts

v1.91.151.0 fix: contributor ports — plan-eng-review structure id, context checkpoint gaps, first-deploy how-to (#3299)

2026-10-19 19:44:10 +00:00

recover-receipts.ts

v1.91.162.0 feat(evals): merge-train workflow side, inert behind the train policy block (GSTA-49 T1b) (#3279)

2026-10-20 02:13:39 +00:00

replay-pr-selection.ts

v1.91.129.0 fix(pr-selection): scan shebang and .ts imports, fail closed on scan errors, report cost per run (#3257)

2026-10-18 01:22:15 +00:00

resolve-codex-generation-model.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

retired-command.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

sandbox-doctor.sh

v1.75.0.0 feat: ponytail import wave — simplification review lens, arm benchmark, reuse ladder, instruction-tier digest (#2722)

2026-08-29 10:10:35 -07:00

setup-scc.sh

feat: gstack v1 — simpler prompts + real LOC receipts (v1.0.0.0) (#1039)

2026-04-18 15:05:42 +08:00

ship-measure-sweep.ts

v1.91.33.0 feat(ship): measurement bar with explained-red and pooled decisions, weekly flaky-test sweep on main (#3059)

2026-10-07 14:00:06 +00:00

ship-measure.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

skill-check.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

slop-diff.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

test-free-shards.ts

v1.91.175.0 fix(test-free): a flaky pass keeps the failing assertion in the epilogue and the flake ledger (#3331)

2026-10-21 18:26:03 +00:00

test-health-report.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

test-paid-shards.ts

v1.91.183.0 fix(evals): a rejected API key is INFRA, never 131 assertion reds and reruns (#3361)

2026-10-23 18:05:39 +00:00

test-pr-profile.ts

v1.91.162.0 feat(evals): merge-train workflow side, inert behind the train policy block (GSTA-49 T1b) (#3279)

2026-10-20 02:13:39 +00:00

test-strict-output.ts

v1.91.11.0 refactor: one state-root rule, browse route table, shared shard engine, PTY harness split, MECE review resolvers (#3002)

2026-10-01 11:57:48 -07:00

train-backstop.ts

v1.91.162.0 feat(evals): merge-train workflow side, inert behind the train policy block (GSTA-49 T1b) (#3279)

2026-10-20 02:13:39 +00:00

train-gate.ts

v1.91.163.0 feat(evals): the gate reruns failed cases once and reports a flaky green (GSTA-49 F1) (#3315)

2026-10-20 04:47:11 +00:00

typecheck-test-baseline.json

v1.91.144.0 feat(evals): Opus 5.5 is the paid gate's model under test; judge stays Fable (GSTA-49 TM1) (#3275)

2026-10-19 07:26:49 +00:00

typecheck-test.ts

v1.91.159.0 security: gstack's Bun entry points ignore the audited repo's .env and bunfig.toml (S1) (#3312)

2026-10-20 00:24:28 +00:00

write-version-files.sh

v1.42.0.0 Daegu wave: 23 community-filed bugs + PTY classifier enforcement (24 bisect commits) (#1594)

2026-05-20 07:35:01 -07:00