How this fits together

The runtime selectors provision Node for local development, application validation, migration smoke tests, and npm publishing; those processes consume source and dependencies and produce validated package artifacts.

flowchart TD
  A[Development and workflow selectors] --> B[Node 24.22.1]
  B --> C[Dependency HTTPS requests]
  C --> D[TLS certificate verification]
  D --> E[Reject compromised keys]
  D --> F[Allow valid chains]
  F --> G[Validation and package publication]

Technical review

Best possible solution:

Retain the four exact runtime updates and attach the existing TLS verification output before landing.

Do we have a high-confidence way to reproduce the issue?

Main explicitly selects Node 24.18.0, while the authoritative Node advisory and 24.22.1 release establish the missing incident-key protection; no target code was executed.

Is this the best way to solve the issue?

Updating the existing exact selectors is the smallest complete repair within the stated tooling boundary, preserving the Node 24 contract and existing publishing controls.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against d83339a30cc1.

Merge-risk options

Maintainer options:

1. Attach the recorded TLS results (recommended)
   Provide redacted output identifying Node 24.22.1, successful ordinary HTTPS controls, and compromised-chain rejection before application requests proceed, including the claimed explicit old-CA cases.

Provenance checked

• CI and local Node selectors keeps the original intent (a4ded5c: Standardize development and CI on Node 24 with an exact patch; the migration job later reused that runtime selection.)
• Publishing runtime keeps the original intent (04e7c9c: Configure trusted npm publishing using the project's Node 24 runtime; this PR preserves the workflow identity, triggers, permissions, and publication gates.)

Testing

Proof path: none.

Security

Needs attention: No introduced vulnerability was identified, but the changed TLS trust boundary lacks inspectable final-effect evidence.

Evidence

What I checked:

• Pinned changes and current main: The introduced diff changes three setup-node inputs and .nvmrc from 24.18.0 to 24.22.1, plus an Unreleased entry; the fetched default branch retains 24.18.0. (.github/workflows/ci.yml:26, 4fb3caf48c7f)
• Authoritative runtime security contract: The workflows execute this runtime, making its TLS contract directly relevant. The Node security advisory identifies the eMudhra remediation in 24.22.1; its release includes the SPKI blocklist implementation from the upstream change. Verification records CERT_REVOKED for blocked keys while retaining rejectUnauthorized semantics. (src/crypto/crypto_context.cc, 01acf0ee7493)
• Exact-head validation: All six checks succeeded for the reviewed head, including application validation and migration-smoke; their status establishes no incident-chain rejection trace. (.github/workflows/ci.yml:18, 4fb3caf48c7f)
• Supplied behavior evidence: The full PR body claims twelve incident chains rejected in eight TLS modes on Linux arm64 with successful HTTPS controls, but supplies no output or artifact; both discussion comments are review-status notices. The supplied body identity is ada755d505583a7d3e6b620e2ba44db14b6626af1c24661a4eeb17c20f417899. Actions log retrieval was blocked at its storage host, so those logs were not inspected. (4fb3caf48c7f)
• Policy and ownership: The complete root policy and CODEOWNERS were read; no nested ancestor policy, maintainer notes, or pr-simplify skill was found. The changelog and publishing-boundary requirements are satisfied. The repository's helper requirement was superseded by the explicit sole-reviewer instruction; no helper or second reviewer ran. (AGENTS.md:11, 4fb3caf48c7f)
• Feature history: History shows Onur Solmaz established the Node 24 selectors and trusted publishing, Vincent Koc added migration qualification, and Peter Steinberger recently maintained publishing. Scoped content-history searches encountered unavailable historical blobs; commit history, available introduction diffs, current-main blame, and GitHub commit metadata supplied the ownership evidence. (.github/workflows/publish.yml:41, d83339a30cc1)

Likely related people:

• Peter Steinberger: Raw commit 4307137 adds .github/workflows/publish.yml:37 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 4307137b6d6f; files: .github/workflows/publish.yml)

Labels

Label changes:

• add P1: Current CI and publishing select a runtime predating remediation for publicly compromised CA keys.
• add merge-risk: 🚨 security-boundary: The selected runtime changes certificate trust for network operations; the claimed final-effect rejection evidence is not supplied.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P1: Current CI and publishing select a runtime predating remediation for publicly compromised CA keys.
• merge-risk: 🚨 security-boundary: The selected runtime changes certificate trust for network operations; the claimed final-effect rejection evidence is not supplied.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach the existing Node 24.22.1 trace proving valid-chain success and compromised-chain rejection before application I/O.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.