- 'pnpm audit signatures' is an npm-only feature; pnpm ignored the
word and ran a plain full audit. Replace with an explicit
'pnpm audit --prod --audit-level=critical' (documented rationale)
- socket-cli is a 0.0.1 stub on npm; use the real 'socket' CLI and
fail loudly instead of silently passing
- mutation-nightly's issue-opening step was gated on if: failure(),
unreachable under continue-on-error — gate on steps.mutate.outcome
- wire the ADR-023 renovate major-bump gate
(scripts/library-decisions/check.mjs --renovate-pr) on PRs; verified
it no-ops on non-renovate branches
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Danijel Martinek
c0dbadf1c2