[knoxgraeme]

Consolidates the Dependabot PRs that are ready into one staging PR against current main.

Included

PR	Change
#58	actions/setup-node v4 → v7
#59	actions/upload-artifact v4 → v7
#60	actions/checkout v4 → v7

Each Dependabot branch is merged as-is. The only manual edit resolves one conflict in .github/workflows/contract.yml (parser-package job), where the adjacent checkout and setup-node lines collided. Both now read @v7. The net diff against main is 18 version-string swaps across contract.yml, guardrail.yml, publish.yml and quality.yml, with no changes to with: inputs, job structure, triggers or permissions.

Protected surface

.github/workflows/ is a protected control-plane surface. This change does not touch checks, required jobs, test scope or trust boundaries: the trusted-base checkout in guardrail.yml/quality.yml keeps the same ref, path and fetch-depth. It also clears the runner warning that actions/checkout@v4 and actions/setup-node@v4 target the deprecated Node 20 action runtime. Code Owner review is still required.

Not included (not ready)

• build(deps-dev): bump the development-dependencies group across 1 directory with 3 updates #62 (TypeScript 5 → 7, @types/node 22 → 26): quality fails typecheck (TS2769 string | undefined overload errors in benchmarks/tests). This needs code changes and touches compiler configuration, which is a protected surface.
• build(deps): bump the production-dependencies group across 1 directory with 7 updates #74 (zod 3 → 4, express 4 → 5, commander 14 → 15, web-tree-sitter 0.26.12 → 0.27.0): these are major bumps. Typecheck fails across src/tools/schemas/* because zod 4 z.record needs explicit key and value schemas, and test-manifest.ts "rejects malformed nested content" fails. The parser package, release budget and integration jobs also fail. Each bump needs its own migration.

Validation (run locally on this branch)

• npm ci: ok
• npm run check (typecheck, build, unit tests, test:guardrails, test:tieline, npm pack --dry-run): exit 0
• git diff --no-renames --unified=0 origin/main HEAD | node guardrail-evals/run.mjs --stdin ...: {"pass": true, "violations": []}
• Not run: npm run test:integration (needs a guarded disposable DB; CI's relational integration job covers it). publish.yml only runs on release, so setup-node@v7 with registry-url gets its first real exercise at the next publish.

Once this merges, Dependabot should close #58, #59 and #60 on its own.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LQNKQY9gEaSDVPZqo514Hn

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.