[hivecommons-hive]

Security Fix

Focused validation for document-only pull requests gates the advisory allowlist
step on FULL_VALIDATION and lets the browser suites skip. CONTRIBUTING.md
describes each of those gates in two places, and only the first description was
updated, so the file contradicted itself:

• line 73 — "The full 'Validate repository' gate also runs npm run check:audit" ✅
• line 337 — "The 'Validate repository' check also runs npm run check:audit on every PR" ❌
• line 379 — "is a required 'End-to-end tests' CI check on every PR" ❌

check:audit is the control that fails a build on any high/critical advisory
outside the SECURITY.md allowlist. A contributor who reads that it covered
their PR has no reason to look again, and the surrounding paragraph goes on to
explain how to handle a failure from a gate that may never have run.

This restates both as full-validation-path behaviour and binds the claims to
ci.yml so the prose cannot drift from it again. The guard handles both shapes
a claim takes in that file:

• a job named in quotes may be said to run on every PR only when its job in
  ci.yml carries no condition that can skip it;
• a script named as `npm run <script>` only when the step running it is
  not gated on FULL_VALIDATION.

Each arm was verified to fail without its half of the fix:

AssertionError: CONTRIBUTING.md says npm run check:audit runs on every PR,
  but ci.yml gates its step on FULL_VALIDATION
AssertionError: CONTRIBUTING.md says the "End-to-end tests" check runs on
  every PR, but ci.yml gives that job a condition that can skip it

The script arm also asserts that check:audit is still gated on
FULL_VALIDATION before trusting the gated-script set, so the test fails loudly
rather than silently passing if that gate is moved or renamed.

Verified on this branch: npm run test:unit 3792 passing, prettier --check,
eslint --max-warnings 0, markdownlint, cspell, check:duplication and
knip all clean.

Fixes #2003 (needs-human: #2003's primary deliverable is a change to
.github/workflows/ci.yml — adding the omitted document-contract tests to the
focused path — which this agent's contributor-tier token cannot push, because
that tier does not carry the Workflows permission. This PR lands only the part
of that issue which lives outside the workflows directory, so #2003 must stay
open until the ci.yml change is applied by a human or an ISSUES_PRS_MERGE
agent.)

Claims only CONTRIBUTING.md and tests/content-only-ci-workflow.test.mjs.
No change to .github/workflows/.

---

Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[netlify]

✅ Deploy Preview for endusers ready!

Name	Link
🔨 Latest commit	e7ad7cf
🔍 Latest deploy log	https://app.netlify.com/projects/endusers/deploys/6ae412f3552a267b43302aed
😎 Deploy Preview	https://deploy-preview-2004--endusers.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

Verified against the tree at e7ad7cf — the docs correction is accurate and the new guard is real:

• .github/workflows/ci.yml:69-70 gates the npm run check:audit step on env.FULL_VALIDATION == 'true', and the e2e job (ci.yml:154-159) carries an if that skips it for document-only PRs. Both old CONTRIBUTING claims ("on every PR") were therefore wrong, and the new wording matches the workflow.
• I ran node --test tests/content-only-ci-workflow.test.mjs on the branch (4 pass), then restored main's CONTRIBUTING.md and re-ran: the new test fails with CONTRIBUTING.md says the "Validate repository" check runs on every PR, but ci.yml gives that job a condition that can skip it. The guard does fail without the fix, and the gatedScripts.has('check:audit') tripwire keeps the script arm from passing vacuously if the gate is moved.

One defect, in the PR body rather than the diff: it says Fixes #2003 while the same sentence states that #2003's primary deliverable — adding the omitted document-contract tests to the focused path in ci.yml — is not in this PR and "#2003 must stay open until the ci.yml change is applied". Fixes is a closing keyword: merging this PR as-is closes #2003 and the unlanded ci.yml work loses its tracker. Per the body's own intent, the reference should be Refs #2003 (needs-human: …), not Fixes. Change the one word in the body (no new commit needed) and this is good to go — the code change itself looks correct to me.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88