Index Clueside, poidh Ultra, and the Concentrate.ai plugin

[devin-ai-integration]

Summary

Audited every public repository under arcacomputer, arcabotai, and felirami against the index. Three licensed, non-fork, Arca-owned projects were missing: arcacomputer/clueside (MIT), arcacomputer/poidhultra (MIT), and arcacomputer/openclaw-concentrateai (MIT). They are now in ownedProjects (lib/data.ts), projects (public/oss.json), and the license assertions in scripts/check-public-claims.mjs, taking the site from 10 to 13 licensed projects.

Because collectReleases() in scripts/update-public-activity.mjs walks oss.json projects, indexing them also pulls their public releases into the activity feed. public/activity.json is regenerated here (89 -> 103 events): 10 Clueside releases (v1.0.5 through v1.4.0) and 4 Concentrate.ai plugin releases. The scheduled refresh would have produced the same feed within six hours; committing it keeps the reviewed snapshot in sync with the project list.

Statuses stay conservative and match what each repo actually claims: poidh Ultra is pre-launch preview (production launch is still gated in its runbook), and the plugin is published on ClawHub · compatibility testing with no npm release claimed. refresh:ledger produced no diff. elizaOS merged counts rechecked: still 15 (@felirami) + 1 (@arcabotai).

Second commit is a lockfile-only dependency bump (npm audit fix, no package.json change) clearing 6 advisories that already existed on main and were failing verify: astro RCE via AVIF optimization (critical, >=7.2.8), sharp/libheif, svgo removeScripts bypasses, js-yaml merge-key CPU, browserslist OOM/prototype write, baseline-browser-mapping DoS. npm audit now reports 0 vulnerabilities. Note: the fixing versions were published 2026-09-24, i.e. under the usual 7-day soak — accepted here because deploy audits at --audit-level=low, so the site cannot ship without them.

Verification (Node 22.12): npm run check (typecheck + activity tests), npm run check:claims (13 licensed repositories, 103 activity events), npm run build with the built-site contract passing, npm audit clean.

Not indexed: arcacomputer/open-hardware-lab has no LICENSE file, so the licensedOnly policy excludes it. Adding a license would make it eligible.

Link to Devin session: https://app.devin.ai/sessions/f52ee25850c5460da3250a22c50a4cd8
Open in Devin Desktop: https://app.devin.ai/desktop/session/f52ee25850c5460da3250a22c50a4cd8?variant=devin

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring