@ai-ecoverse/slicc-cdp 1.29.1 → 1.29.3

package/README.md

@@ -391,7 +391,7 @@ A complete record emits `certified-candidate @ai-ecoverse/slicc-cdp@<v> sha256=<
 
 ## PR certification tooling
 
-The `scripts/cert/pr-*` tools prepare an initially non-required PR certification lane. They are not yet wired to a production workflow or a required check. Main-owned tools must land before that workflow uses them. Test-only changes and all package manifest changes, including scripts-only `postinstall` changes, take the full review. The planned merge-group pass-through is exact-head, ancestry-bound and code-only, consuming immutable trusted PR records and a fresh shared self-guard receipt.
+The `scripts/cert/pr-*` tools run in `.github/workflows/cert-review-pr.yml`, initially non-required. Every control checkout uses the main base SHA; candidate code runs only in hosted, read-only, secrets-free jobs with credentials disabled. Signing never executes input binaries. The Bedrock credential is confined to the data-only model step, which has no tools; code validates its head-bound structured verdict and execution receipt. Test-only changes and all package manifest changes, including scripts-only `postinstall` changes, take the full review. The merge-group pass-through is exact-head, ancestry-bound and code-only, consuming immutable trusted PR records and a fresh shared self-guard receipt. The always-running aggregate records missing or skipped ancestors as `INCOMPLETE`, never PASS. Release verification remains `verified` until the separately approved required-check rollout. Signed PR binaries and the collected signed assets expire after one day; digest and verification records remain for 90 days. The selected Bedrock model id is recorded in `review.json`, with the pinned default `global.anthropic.claude-opus-5-5`. Source-object fetches are credential-free for this public repository; a future trusted private-fork route would need an explicit read token, not candidate access to signing or review credentials.
 
 The model reviewer uses the kernel lane's pinned `claude-code-action/base-action`, but keeps `--tools ""` and does not request `--json-schema`: that combination returned no `structured_output` in the live bootstrap proof. Unlike the kernel's filesystem-writing reviewer, this model cannot read or write files or execute commands. Main-owned `pr-review.mjs` parses only the execution receipt's successful final result: one complete JSON object or one fenced `json` block with nothing else. It validates the exact schema and head/commit binding, hashes the execution receipt, and requires exactly one `system/init` receipt with empty `tools` and `mcp_servers` arrays. Any advertised tool or MCP server is `INCOMPLETE` with `review model had tools`; absent or malformed capability receipts are also `INCOMPLETE`. The invocation flag alone is not proof of tool isolation; malformed output, free-text keywords and missing execution are never a substitute verdict.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.29.1",
+  "version": "1.29.3",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -68,11 +68,11 @@
     "chrome": "156.0.8078.4"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-kernel": "1.123.0",
+    "@ai-ecoverse/slicc-kernel": "1.124.0",
     "@ai-ecoverse/slicc-shared-web": "1.23.2",
     "@biomejs/biome": "2.5.15",
     "lefthook": "2.2.1",
     "semantic-release": "25.0.9",
-    "@ai-ecoverse/slicc-browsers": "1.7.9"
+    "@ai-ecoverse/slicc-browsers": "1.7.12"
   }
 }