voidmachine 7.0.0 → 7.0.2

package/core-assets/skills/void-autopilot/SKILL.md

@@ -151,7 +151,7 @@ Act on each returned action, then ask again:
 
 | Action | What you do |
 |---|---|
-| `assign` | claim the ticket (In Progress, assigned), run `autopilot fingerprint --before <ticket>`, create or reuse its worktree, spawn its worker |
+| `assign` | claim the ticket (In Progress, assigned), run `autopilot fingerprint --before <ticket>`, create or reuse its worktree, create the controlled mission there with title and full frozen ticket via `void-orchestrate`, hand its ID to the worker |
 | `wait` | nothing; the reason says who is working |
 | `hand-back-to-worker` | give the ticket back to its worker, alive or respawned in the same worktree, with the reason and the pull request; a respawned worker resumes its mission (see Respawning) |
 | `mark-human-wait` | record it in `recent` with its `reason`, which `recent` requires and the recap repeats, put the decision's `humanWaitLabel` on the ticket, comment the reason and detail, free the slot; keep reporting its pull request and footprint, which hold its ground until that pull request merges or closes |
@@ -159,7 +159,7 @@ Act on each returned action, then ask again:
 | `update-branch` | `void-machine autopilot update-branch --pr <n> --head <headSha>`: GitHub merges the base into the branch if its head is still that one; the new head is reviewed before anything merges it |
 | `enable-auto-merge` | `void-machine autopilot arm --ticket <id> --pr <n> --head <headSha>`, on a base with a merge queue: the same guards, then it records the head, arms on exactly that head and reads GitHub back; never `gh pr merge --auto` by hand, never `--admin` |
 | `disable-auto-merge` | `void-machine autopilot disarm --pr <n>`, before the action that follows it for the same ticket; it turns its auto-merge off, then takes it out of the merge queue, and fails while GitHub still shows either; never `gh pr merge --disable-auto` alone, which leaves a queued pull request in the queue |
-| `review` | `void-machine autopilot review --ticket <id> --pr <n> --head <headSha> --round <round> --mission <canonical-id>`; on awaiting-native-review use `void-orchestrate` for the actual reviewer, record canonical receipts, then repeat to collect. The same attempt keeps its 30 minute deadline; failures retain the existing budget |
+| `review` | `void-machine autopilot review --ticket <id> --pr <n> --head <headSha> --round <round> --mission <canonical-id> --worktree <assigned-path>` from the coordinator checkout; on awaiting-native-review use `void-orchestrate` for the actual reviewer, record canonical receipts, then repeat to collect. The same attempt keeps its 30 minute deadline; failures retain the existing budget |
 | `requeue` | the same command, to put an ejected head back in the queue; the kernel bounds how often |
 | `drain` | take nothing new; keep acting on the tickets in flight |
 | `freeze` | stop acting, once the disarms before it succeeded |
@@ -201,13 +201,13 @@ the local config and the files it includes, the stash, tags, notes, remotes, the
 deploy branches, replace refs, `hooks/` and `info/` are one set for every worktree. The upstream
 (`remote`, `merge`) of every branch but the bases and the one that deploys is left out, since units
 in flight set it when they create or push their branch and drop it with a merged one; the bases'
-own settings still count. So start each worktree from
+own settings still count; only regular root `info/refs`, Git’s generated transport cache, is exempt. Start each worktree from
 `origin/<base>` and never move a local base branch while units are in flight. The baseline
 recorded at `assign` is written once: a second `--before` for the same ticket is refused, so a unit
-cannot re-record the state it left as the state it found. It is compared by the coordinator before it
-publishes, with `autopilot fingerprint --after <ticket>`, and again by the kernel before it arms a
-merge. A changed or missing baseline sends the ticket to a human, unpublished; only that person
-deletes the record.
+cannot re-record the state it left as the state it found. `autopilot fingerprint --after <ticket>`
+checks it; the coordinator publishes only through `autopilot publish --ticket <ticket> --head <sha>
+--remote <remote> --branch <branch>`, which couples that guard to the literal SHA push. Never follow
+refusal with direct Git. Human renewal retains evidence; see [publication and recovery](references/publication.md).
 
 **Disarming.** Armed means GitHub merges without anyone acting again: an auto-merge request, or,
 once the checks pass on a base with a merge queue, an entry in that queue and no request at all.
@@ -266,18 +266,19 @@ neither, so a restart loses nothing.
 
 ## Workers
 
-Given: one ticket id, its worktree, its branch, the programme's plan and spec. The worker re-fetches
+Given: one ticket id, its worktree, its branch, its canonical mission ID, the programme's plan and spec. The worker re-fetches
 the complete ticket itself; it never works from a summary.
 
-It runs `void-implement` whole in that worktree, and starts its mission with the ticket id as its
-`--title`, which is how a respawn finds it again. Before any context compaction it writes to the
+It runs `void-implement` whole and `mission dispatch` in that worktree, reusing the mission
+the coordinator created once with `--title <ticket-id> --ticket <full-frozen-ticket>`.
+A respawn retains that identity and its budgets. Before any context compaction it writes to the
 mission what it has done: each specialist result through `mission specialist-event`, each proof
 through `mission verify`, a committed candidate through `mission writer-event`. The journal accepts
 only these typed events, no free note; what is not yet one of them does not survive a respawn, and
 uncommitted edits survive only in the worktree. During development, the coordinator may create or reuse a draft pull request
 for the branch; drafts are permitted for development, never for merge admission. After the worker
-returns its commit and green proofs, the coordinator runs `autopilot fingerprint --after <ticket>`,
-pushes, and must mark the same pull request ready (create one only if absent), then move the ticket
+returns its commit and green proofs, the coordinator runs the guarded `autopilot publish` command
+and must mark the same pull request ready (create one only if absent), then move the ticket
 to In Review. The independent reviewer examines ready pull requests only; an unfinished draft waits.
 Blocking findings come back as a hand-back and are corrected as a batch, per `void-implement`.
 
@@ -338,7 +339,10 @@ its proofs and returns its commit for coordinator publication; `semantic` -- two
 sends the ticket to a human. A worker never picks a side of a semantic conflict to keep the loop
 moving.
 
-**Serial fallback.** Without a merge queue, merges run one at a time: the oldest ready pull request
+**Serial fallback.** This path requires no queue service or paid plan.
+For CI optimization, use [void-verify CI feedback](../void-verify/references/ci-feedback.md);
+add neither a second scheduler nor a mandatory duration gate.
+Without a merge queue, merges run one at a time: the oldest ready pull request
 (or the one already merging) holds the turn. The kernel reads whether the base moved past its head
 itself, since GitHub reports it only under a protection that requires it: a head behind gets
 `update-branch`, its new head is reviewed again, then merged, then the next. `merge` reads it once

package/core-assets/skills/void-autopilot/references/publication.md

@@ -0,0 +1,82 @@
+# Guarded publication and human recovery
+
+The coordinator runs from the checkout containing the ticket's original baseline.
+The local candidate branch can belong to another worktree; no checkout movement
+or evidence copy is needed. Workers remain commit-only.
+
+```sh
+void-machine autopilot publish --ticket DEV-42 --head <full-sha> --remote origin --branch fix/dev-42 --json
+```
+
+This checks the explicit local branch against the full SHA and the shared Git
+guard, then pushes that literal SHA to the named remote branch in the same
+command. A base or deploy branch is refused. It does not force push, disable
+hooks, set an upstream, grant review or merge permission, or remove a merge hold.
+Missing, invalid, unreadable and changed fingerprints launch zero pushes. A
+transport error can follow a remote success: inspect the named remote branch
+before a deliberate retry. Never automatically follow a refusal with direct Git.
+
+## Coverage
+
+Policy v4 excludes only a regular file exactly at common-Git-directory `info/refs`.
+Git documents it as generated transport information, rebuilt by
+[`git update-server-info`](https://git-scm.com/docs/git-update-server-info).
+Its creation, update and removal are harmless to this guard. This does not identify
+who created an incident file from its timestamp. `objects/info/packs` is Git's
+other generated output; it is outside the existing fingerprint. `info/packs` is
+not that output and stays guarded. Symlinks, nested `refs`, `info/exclude`,
+`info/attributes`, hooks and their checksums, config/includes, bases, stash, tags,
+notes, remotes and replace refs retain their previous coverage.
+
+Version 3 aggregates the whole info directory, including regular root `info/refs`.
+A retained v3 record is compared against a current reading using that same complete
+v3 policy at both publication checks and in `autopilot next` merge decisions. All nine digests and retained protected branches
+stay authoritative; any drift refuses. No conversion, renewal or baseline write is
+needed for an unchanged v3 state. Versions 1 and 2 remain unsupported.
+
+A v3 aggregate cannot be converted to v4 without historical file contents. Relaxing
+its policy or accepting actual drift still requires the explicit human renewal below.
+`fingerprint --record` reports the current v4 reading for that renewal inspection;
+`fingerprint --after` and publication use the retained policy for comparison.
+
+## Explicit human renewal
+
+Stop publication. Inspect the failure and the actual shared-state changes. A
+person must authorize the exact repair or policy transition and affected candidate;
+the ticket's implementation mandate alone is not that authorization.
+
+```sh
+void-machine autopilot fingerprint --record DEV-42 --json
+```
+
+Retain the output, including `recordDigest`, `currentDigest`, old fingerprint and
+current fingerprint. After the human decision, use those exact digest values:
+
+```sh
+void-machine autopilot fingerprint --renew DEV-42 --head <full-sha> --branch fix/dev-42 \
+  --previous <recordDigest> --expected <currentDigest> \
+  --cause 'Reviewed authorized repair or v3 policy transition' \
+  --decision '<reference to the explicit human decision>' --json
+```
+
+The original `fingerprints/DEV-42.json` remains byte-for-byte intact. The complete
+renewal under `fingerprints/DEV-42.renewals/` retains both fingerprints, predecessor
+digest, branch/SHA, cause and decision. Its atomic creation is the transition;
+there is no separate baseline replacement. Identical replay returns the retained
+record. Conflicting or stale replay and changed observations refuse. Preserve
+all those files: deleting history is not recovery. Renewal changes no review,
+merge hold, merge authorization or deployment permission.
+
+Publication and renewal share `fingerprints/DEV-42.lock`. A competing operation
+refuses immediately. A crashed process may leave that directory: a person must
+establish the owning process ended and inspect retained evidence before removing
+only that abandoned lock. An incomplete canonical record remains blocked and
+must be recovered from retained evidence, never ignored. Unlinked unique temporary
+files are not committed records; retain them for diagnosis after an interrupted write.
+
+The lock coordinates these supported commands in this state directory. It cannot
+serialize direct Git, hooks or other processes, nor prevent malicious edits to
+local evidence. The command rechecks immediately before its side effect and uses
+an immutable commit refspec, but does not claim an atomic snapshot of all Git state
+through network completion. See [Git push](https://git-scm.com/docs/git-push) for
+refspec and hook semantics. Direct Git is outside this guarantee.

package/core-assets/skills/void-implement/SKILL.md

@@ -55,8 +55,10 @@ materializes its runtime-neutral specialist envelopes from the current plan.
 
 1. Keep one `leadWriterId` for implementation and every correction. The implementer owns
    the worktree and code; specialists and the independent reviewer never edit.
-2. Start with `mission start --ticket <ticket>` and follow `mission dispatch --id <mission>
-   --json`. The frozen task and controller own routing, state and correction budget. Normal
+2. Reuse the mission ID the coordinator supplied. The coordinator creates it once from the
+   assigned worktree with `mission start --title <unit> --ticket <full-frozen-ticket> --json`.
+   Run `mission dispatch --id <mission> --json` from that worktree. Never start another mission
+   to repair a refusal. The frozen task and controller own routing, state and correction budget. Normal
    dispatch starts the writer without a compulsory preparation panel. The writer still obtains
    the primary domain specialist advice required by pass 5 before production edits.
    For canonical `invoke-specialists` actions, pass each envelope unchanged through

package/core-assets/skills/void-merge/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: void-merge
-description: Vider la file des PR ouvertes sans casser le dépôt. Ordre par déblocage plutôt que par date, CI verte ET à jour, artefacts générés régénérés, conflits de contenu rendus à leur auteur. Use when merging pull requests.
+description: Vider la file des PR ouvertes sans casser le dépôt. Fusions séquentielles, ordre stable et dépendances explicites, CI verte ET à jour, artefacts générés régénérés, conflits de contenu rendus à leur auteur. Use when merging pull requests.
 ---
 
 # merge — voidcorp craftsman edition
 
 `void-implement` s'arrête à la PR ouverte. `void-autopilot` laisse à une personne les PR qu'il ne peut
-pas armer. Personne ne dit comment vider la file. Ce geste a l'air trivial jusqu'au moment où il ne l'est pas.
+pas fusionner dans son mandat. Personne ne dit comment vider la file. Ce geste a l'air trivial jusqu'au moment où il ne l'est pas.
 
 **Attribution**: see `.source`.
 
@@ -36,19 +36,26 @@ Sortent de la file, sans discussion :
 
 Une file vide est un résultat, pas un échec : le dire et s'arrêter.
 
-## Étape 2 — Ordonner par déblocage, jamais par date
-
-L'ordre correct n'a aucun rapport avec le numéro ni l'ancienneté.
-
-1. **Une PR dont le contenu supprime la cause du conflit d'une autre passe avant elle.** Le cas
-   qui a motivé cette skill : la PR réparant le workflow de back-merge était en conflit
-   précisément parce que ce back-merge n'avait jamais tourné. Sans le back-merge d'abord, elle
-   restait bloquée pour toujours.
-2. À défaut de relation, **le moindre conflit d'abord** : ce qui se merge sans rien toucher, puis
-   ce qui demande une régénération.
-
-Chercher la relation explicitement : une PR en conflit avec la base, dont une autre PR ouverte (ou
-un geste manquant) explique le conflit, attend cette autre.
+## Étape 2 — Garder un ordre stable, identifier les dépendances
+
+Une seule fusion à la fois suffit, sans service de file ni abonnement particulier.
+Une file native déjà configurée reste compatible ; ses protections restent applicables.
+
+1. **Conserver le tour engagé.** Dans `void-autopilot`, le noyau choisit : une PR dont la
+   fusion est déjà armée garde son tour ; sinon, la plus ancienne PR ouverte non brouillon
+   parmi les tickets suivis passe d'abord. Utiliser ses actions, pas un script de fusion parallèle.
+2. **Hors autopilot, garder l'ordre des PR admissibles.** À défaut d'ordre explicite, partir
+   de la plus ancienne. Une PR dont la revue est acquise et dont seule la CI attendue tourne
+   conserve son tour ; une PR plus récente ne la dépasse pas simplement parce qu'elle est verte.
+3. **Un déblocage réel se traite explicitement.** Nommer la dépendance, le conflit ou le
+   blocage durable et son propriétaire. Hors autopilot, une PR préalable peut passer d'abord
+   avec cette raison. Sous autopilot, rendre ce blocage au coordinateur : ne pas contourner
+   le tour choisi par le noyau. Une PR rouge ou en conflit ne justifie pas une attente indéfinie.
+
+Remettre à jour seulement la PR dont le tour arrive, puis attendre ses preuves avant de
+fusionner. Ne pas remettre toutes les branches à jour après chaque fusion : la suivante
+ferait immédiatement vieillir ce travail. Le temps déjà dépensé ne rend jamais valide
+une preuve liée à un ancien commit ou à une ancienne base.
 
 ## Étape 3 — Trois conditions pour merger, toutes nécessaires
 

package/core-assets/skills/void-orchestrate/SKILL.md

@@ -131,8 +131,11 @@ Missing required native capability is reported with cause and next action.
 ## Publish worker observations
 
 For each mission worker or reviewer, keep one `run_<opaque-id>` for its assignment.
-Reuse the unit's open canonical mission; if it has none, create it with
-`void-machine mission start --title <unit> --json` and retain its returned ID.
+The coordinator reuses the unit's open canonical mission. If none exists for controlled
+implementation, it creates one from the assigned worktree with `void-machine mission start --title <unit>
+--ticket <full-frozen-ticket> --json` and hands the returned ID to the writer.
+The writer reuses that ID and runs `mission dispatch` from the assigned worktree.
+Title-only missions remain valid for simple work without controlled dispatch or review.
 Do not recreate a mission to evade a refusal. This publication never substitutes
 for the mission's implementation, verification or independent review receipts.
 
@@ -189,8 +192,10 @@ stays within the existing project boundary and must match its digest and invocat
 A central report marked done is never a review receipt. Preserve limitations honestly.
 
 For autopilot, `autopilot review --ticket <id> --pr <n> --head <sha> --round <1|2>
---mission <canonical-id>` checks the target ticket against the existing bounded ticket reader (filename identity
-and frozen content hash), then prepares the exact review subject/worktree and, when
+--mission <canonical-id> --worktree <assigned-path>` runs from the coordinator checkout,
+retains its programme and local verdicts there, and checks the target ticket against the existing bounded ticket reader (filename identity
+and frozen content hash) in the assigned checkout, reading the journal from its resolved
+installation root. Missing plans and mismatched subjects refuse before spending an attempt. It then prepares the exact review subject/worktree and, when
 pending, returns awaiting-native-review. ORCH performs the native invocation and
 records its real receipts, then repeats the same command to collect. Do not start a
 new mission to repair a pending attempt. Budgets, protected paths, HEAD drift checks,

package/core-assets/skills/void-verify/references/ci-admission.mjs

@@ -6,7 +6,7 @@ import { readFileSync } from 'node:fs';
 
 try {
   const name = process.env.GITHUB_EVENT_NAME;
-  if (!['pull_request', 'merge_group', 'push', 'workflow_dispatch'].includes(name)) {
+  if (!['pull_request', 'merge_group', 'push', 'workflow_dispatch', 'schedule'].includes(name)) {
     throw new Error('CI_INVALID_EVENT: unsupported or missing GitHub event.');
   }
   const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'));

package/core-assets/skills/void-verify/references/ci-feedback.md

@@ -1,7 +1,8 @@
 # Fast local feedback, real integration checks
 
 The sibling files are shipped with this skill and copied by `init` into the selected
-runtime's skill directory. Resolve them relative to the SKILL.md you actually loaded,
+runtime's skill directory. `update` refreshes owned references; adopted workflows
+remain project-owned and are never overwritten by that reference refresh. Resolve them relative to the SKILL.md you actually loaded,
 not from a developer checkout or a global installation.
 
 On an explicit CI configuration request:
@@ -14,7 +15,9 @@ On an explicit CI configuration request:
    inside an existing **required** quality job, before dependency installation, without
    `continue-on-error`, `always()` on later quality steps, or a job-level draft skip.
 3. Set up the project's actual package manager and immutable lockfile installation.
-   The example uses npm. For pnpm/Bun use their pinned setup and frozen install.
+   The example uses npm and an illustrative Node version; preserve the project's
+   supported Node version owner (for example `.node-version`). For pnpm/Bun use
+   their pinned setup and frozen install. Do not introduce another package manager.
    Define `ci:verify` in package.json to run the actual complete lint, typecheck, build,
    and test commands appropriate to the project. Do not equate `testUnit` with the
    whole integration suite; discover the project's existing CI contract. Missing
@@ -24,9 +27,11 @@ On an explicit CI configuration request:
    this template alone does not configure GitHub protection. Retain the separate
    `void-enforce` floor and independent review. This template does not replace either.
 5. Test draft, ready without another commit, new head, return to draft, merge group,
-   and manual run. `CI_DEFERRED_DRAFT` is expected non-admission during preparation,
+   and manual run. A deliberately added schedule is supported by the guard and
+   runs real checks; it does not prove a separate PR candidate. `CI_DEFERRED_DRAFT` is expected non-admission during preparation,
    not a failed test: tests have not run. Readiness runs the full suite even at the
-   same SHA. Never treat a skipped required job as successful test evidence.
+   same SHA. Continue focused local work during draft non-admission, without
+   retrying the remote refusal. Never treat a skipped required job as test evidence.
 
 Development runs configured local tests for the changed behavior and affected types.
 There is no network hook or mandatory remote wait per edit. Only obsolete PR runs are
@@ -35,17 +40,80 @@ concurrency keys: `cancel-in-progress: false` alone still replaces pending runs
 shared group. Keep integration checks before entry to the protected branch; checking
 only after merge permits broken integration.
 
-GitHub couples required PR and merge queue checks. Preserve both. Remove a redundant
-post-merge run only after checking that no release, promotion or artifact consumer
+Where a repository already uses a merge queue, preserve both its required PR and
+merge-group checks. A queue is optional; sequential merging needs no queue setup.
+Remove a redundant post-merge run only after checking that no release, promotion or artifact consumer
 needs it, and that the protected integration path proves the merged result. The
 example has no push trigger; add one where it provides distinct release evidence.
 
+For reusable enforcement, the caller must also declare `ready_for_review` and
+`converted_to_draft`, keeping its existing check names. Preserve
+`merge_group: checks_requested` where a queue is configured. Put concurrency only
+in that caller; the called workflow inherits `github.workflow` and must not cancel the same group. Its admission guard runs
+from the immutable harness checkout before Node setup and floor execution.
+GitHub-hosted runner usage belongs to the caller, even when the reusable workflow
+is public and the caller private. Compare latency and job-minutes before making
+any billing claim.
+
+Dependency audit is a separate project-owned job, without a `needs` edge that
+prevents lint/tests/build from running during an advisory-service outage. Preserve
+its actual package-manager/lockfile contract and severity policy: installing Bun
+is not an audit solution for npm or pnpm consumers. `npm ci` advisory output alone
+is not a complete audit gate. Bun consumers can adopt the packaged
+`core-assets/templates/github/void-dependency-audit.yml` and `dependency-audit.mjs`,
+plus this sibling `ci-admission.mjs`; the audit guide is `docs/DEPENDENCY-AUDIT.md`
+in a matching source checkout. Its ready-PR and merge-group runs judge their own
+revision; a weekly scheduled run catches new advisories without a lockfile change
+and is surveillance, not a substitute for a required candidate check. Unavailable
+or malformed evidence stays non-green. No workflow path filter may hide required
+checks or prevent scheduled registry refresh.
+
 Rollback: restore the prior workflow triggers and admission step together. Restoring
 full draft CI costs runner time but does not weaken the floor. Leave protection and
 review evidence unchanged. Existing missions and receipts are not migrated.
 
+## Measure feedback before changing CI
+
+On a CI optimization request, use existing run history to agree a project-specific
+feedback target, separately for ordinary changes and documentation changes. Around ten
+minutes for a complete PR and a few minutes for documentation can start the discussion;
+they are advisory targets, not timeouts, required checks or permission to omit tests.
+Report the sample size, median and p95 when the sample supports it. A missed target
+calls for diagnosis of the critical path, not a retry or another reporting service.
+
+Record separately: time waiting for execution, elapsed time until all required results
+are available, and summed job execution minutes across parallel jobs and all attempts.
+Include cancelled work and runs invalidated by branch updates. A later PR overtaking an
+older one only wastes CI when that change actually invalidates work; do not assume a
+saving from ordering alone. Use provider billing data for money: job-minutes are not
+billed minutes. Missing runner-wait timestamps mean unknown, not zero; dependency waits
+are not automatically runner waits. A run update timestamp is not its completion time.
+
+For GitHub, inspect a concrete run and repeat for earlier attempts when present:
+
+```sh
+gh run view RUN_ID --repo OWNER/REPO --attempt ATTEMPT --json attempt,event,headSha,createdAt,startedAt,jobs
+```
+
+Job start/completion times describe execution intervals; inspect the workflow dependencies
+and every required workflow before deriving the feedback delay. Another CI provider's
+native run/job view supplies the same evidence; this is no GitHub prerequisite.
+
+Investigate a full build/test cache miss on a documentation-only diff by tracing actual
+inputs and cache keys. Markdown may feed generated assets, executable skills or contract
+tests; the extension alone proves nothing. Optimize unaffected work only when dependencies
+are proven; otherwise keep the complete suite above. Preserve exact-candidate checks,
+release artifacts and integration evidence. Reuse local evidence with unchanged inputs
+instead of asking every agent to repeat the same full suite. Adopt workflow changes in
+the consumer's existing configuration; updating these references does not rewrite it.
+
 Sources read for GitHub Actions (hosted service):
 - https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
 - https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency
 - https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue
 - https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-jobs-with-conditions
+
+- https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
+
+- https://cli.github.com/manual/gh_run_view
+- https://docs.github.com/en/rest/actions/workflow-jobs

package/core-assets/templates/github/void-dependency-audit.yml

@@ -1,4 +1,4 @@
-# Manual consumer template: copy this workflow and its companion script.
+# Bun consumer template: adopt with dependency-audit.mjs and ci-admission.mjs.
 # See docs/DEPENDENCY-AUDIT.md before adopting; no consumer CI is overwritten.
 name: void-dependency-audit
 
@@ -6,17 +6,33 @@ on:
   push:
     branches: [main]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+  merge_group:
+    types: [checks_requested]
+  # New advisories can affect an unchanged lockfile. Surveillance is not PR proof.
+  schedule:
+    - cron: '17 4 * * 1'
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   dependency-audit:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Admit dependency audit
+        id: admission
+        run: node .github/scripts/ci-admission.mjs
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 24
@@ -26,7 +42,7 @@ jobs:
       - name: Classify dependency audit
         run: node .github/scripts/dependency-audit.mjs "$RUNNER_TEMP/dependency-audit"
       - name: Preserve audit report
-        if: always()
+        if: ${{ always() && steps.admission.outcome == 'success' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: dependency-audit