[dodeja]

Summary

npm test recursively selected the root package and ran both policy suites twice. Select the declared workspace directories explicitly so every policy and workspace test runs once.

Add a separate Node 26.12.1 compatibility job while preserving the existing required CI checks and production Node 24 configuration.

 npm test
   policy suites
-  recursive tests: root and workspaces
+  workspace tests: packages and SDKs

Evidence

• Full npm run agent-verify passes after rebasing onto current main.
• Measured full-suite median wall time fell from 58.947 s to 38.463 s on the recorded source snapshot. Benchmark report includes trial ranges, test counts, runtime comparisons, and scope limits.
• Existing CI jobs, permissions, runtime pins, and the dependency lockfile are unchanged. The new Node 26 job will run with this PR.

Merge Danger

Door: Two-way.

Blast Radius: CI.

Changes cover test selection, additional runtime compatibility coverage, and benchmark evidence. Production application code, dependencies, and runtime configuration remain unchanged. No Bun migration is included.

GitHub reports an existing high-severity development dependency advisory for @faker-js/faker (GHSA-qxc2-j82w-r537). Dependency remediation is outside this PR.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Removes duplicate policy runs from npm test and adds a separate Node 26 compatibility job.

• The test command runs policy suites once and then tests each workspace.
• CI checks the workspaces and MCP protocols on Node 26.

No actionable issues found.

_{Reviews (1) · Last reviewed commit: "docs(benchmarks): record runtime compari..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api	Ready	Preview	Oct 23, 2026 3:50am UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T03:52:07.716349Z	804b4d8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Shadow risk calibration

Signal	Result	Authority
Path classifier	risk:high	Deterministic advisory policy
heuristic fallback	risk-shadow:high	Shadow only

Calibration result: agreement.

Shadow risk never blocks or enables merge. Keep it in observation mode until roughly 50 pull requests have human-reviewed labels, then calibrate before considering any policy use.