Hardening pass: install path, RCE, slides verifier, CI, security, and architecture#1

Merged

theclaymethod merged 38 commits into

mainfrom

advisor/integration

Jul 7, 2026

Commits on Jul 7, 2026

Align version to 0.7.0 across package.json and CHANGELOG
theclaymethod
committed
Fix marketplace manifest attribution and repository routing
theclaymethod
committed
Reword machine-specific notes in verify spec/contract as design intent
theclaymethod
committed
Add contributor scaffolding: CONTRIBUTING, SECURITY, issue/PR templates
theclaymethod
committed
integrity: replace Function()-eval with a safe literal parser

theclaymethod
and
claude
committed
Patch vite advisory via npm audit fix
theclaymethod
committed
SKILL: make the installed skill self-locating for the export pipeline
theclaymethod
committed
verify: make Chromium fallback path portable across platforms
theclaymethod
committed
integrity: add malicious-literal regression fixtures with a canary

theclaymethod
and
claude
committed
plan 009 step 1: re-route MDX flows off legacy-html.md

theclaymethod
and
claude
committed
matrix: strip OPENROUTER_API_KEY from all spawned child processes

theclaymethod
and
claude
committed
plan 009 step 2: add scope statement to legacy-html.md

theclaymethod
and
claude
committed
export/matrix: clean up temp dirs on every exit path

theclaymethod
and
claude
committed
plan 009 step 3: de-duplicate mono-industrial spec

theclaymethod
and
claude
committed
ve:check: exercise export-static.mjs and assert rendered content is non-trivial
theclaymethod
committed
evals: assert catalog/fixture parity for deterministic checks
theclaymethod
committed
scripts: add manifest version/repository consistency check
theclaymethod
committed
package: declare Node >=22 engines requirement, add .nvmrc
theclaymethod
committed
plan 009 step 4: template status ledger

theclaymethod
and
claude
committed
ci: add GitHub Actions workflow (static + evals jobs)
theclaymethod
committed
evals: add clean-rich-page fixture (DiagramCanvas+DiffBlock+JsonTree+DecisionMatrix+Quiz)
theclaymethod
committed
Merge branch 'advisor/002-safe-literal-parse' into worktree-agent-af44933798381cedd
theclaymethod
committed
plan 007 step 1-2: design note — execution-path map + stub-judge recommendation

theclaymethod
and
claude
committed
security: network-isolate verifier/PDF-exporter Chromium and harden gallery escaping

theclaymethod
and
claude
committed
plan 007 step 3: rubric fixture runner for the first 6-check slice

theclaymethod
and
claude
committed
plan 007 step 5: track the remaining 24 uncovered llm-pass/transcript checks

theclaymethod
and
claude
committed
Extract diagram layout engine into diagram-layout.ts

theclaymethod
and
claude
committed
Add node:test unit tests for the extracted diagram layout engine

theclaymethod
and
claude
committed
ve:check: assert the 17-component roster stays in sync across sources

theclaymethod
and
claude
committed
verify: gate split-bleed check on authoring markup, not raw bundle text
theclaymethod
committed
slides: implement a real autofit floor and reconcile the check with reality
theclaymethod
committed
slides: fix light/accent-tone contrast at the token layer
theclaymethod
committed
evals: land clean-rich-slides fixture proving the slides path verifies clean
theclaymethod
committed
verify: reconcile split-bleed applies_when text with the fixed gate
theclaymethod
committed
Merge branch 'advisor/005-network-isolation' into advisor/integration
theclaymethod
committed
Merge branch 'advisor/007-rubric-fixtures' into advisor/integration
theclaymethod
committed
Merge branch 'advisor/009-legacy-quarantine' into advisor/integration
theclaymethod
committed
integration: allowlist the pinned Mermaid runtime in network isolation

theclaymethod
and
claude
committed