[mrbobbytables]

Remit: a document-only PR can currently merge with an ADR missing from adr/README.md, a broken relative link in README.md, malformed blog front matter, or a docs page referencing a missing static asset, because the ADR 0011 focused path ran only three unit suites.

What changed

• .github/workflows/ci.yml: the "Check content contracts" step now runs every unit suite that reads an authored document (docs/, blog/, adr/ or a root document): the original three plus adr-contract, architectures-sidebar-contract, blog-frontmatter, community-people-data, content-security-contract, contributing-e2e-setup, contributing-just-build-parity, dev-environment, docs-threshold-parity, e2e-docs-threshold-parity, enduser-directory-copy, governance-hygiene-parity, root-docs-links, sitemap-exclusions and static-assets. The 18 suites run in about half a second locally (159 tests).
• tests/content-only-ci-workflow.test.mjs: pins the step so the core suites cannot drop out and every listed path exists.

Deliberate exclusions

• tests/audit-gate.test.mjs reads SECURITY.md but spends ~40s driving npm audit subprocesses; it stays on the full path (noted in a workflow comment).
• tests/skills-manifest.test.mjs reads .agents/skills/, which the classifier never treats as document-only, so it is not applicable to the focused path.
• tests/events-page.test.mjs reads docs/events/index.md, which is a data-backed document excluded from the focused path.

Validation

• Focused step command: 159 tests, 0 failures.
• node --test tests/content-only-ci-workflow.test.mjs tests/ci-*.test.mjs tests/workflow-scripts.test.mjs tests/workflow-loader.test.mjs: 185 pass.
• npm run check:format, npm run check:duplication (YAML clones unchanged at 37/37), ESLint and cspell on the touched files: clean.

Note: this will need a trivial import-line rebase against #2004, whichever lands second.

Fixes #2002
Refs #2003 (the workflow half; #2004 carries the CONTRIBUTING half)

[netlify]

✅ Deploy Preview for endusers ready!

Name	Link
🔨 Latest commit	8305903
🔍 Latest deploy log	https://app.netlify.com/projects/endusers/deploys/6ae4af2fa2d3deae658a5b65
😎 Deploy Preview	https://deploy-preview-2010--endusers.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

1bc247c

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head 1bc247c62dd2) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

9039a56

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head 9039a56e25c6) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Confirmed the merge conflict against current main: it is exactly one hunk in tests/content-only-ci-workflow.test.mjs. Your branch adds existsSync to the node:fs import while main (via #2004, which landed second) added readFileSync on the same line:

<<<<<<< HEAD
import { existsSync } from 'node:fs';
=======
import { readFileSync } from 'node:fs';
>>>>>>> main

Both names are used in the merged file, so the resolution is the union:

import { existsSync, readFileSync } from 'node:fs';

One observation while checking: no Actions workflows have run on the current head (9039a56) — only the Netlify and DCO commit checks — so the rebase will also produce the first real CI signal for this branch.

---

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88

[hivecommons-hive]

Read the workflow step and the pinning test against the tree at head 9039a56, and ran the change locally: the 18-suite focused command passes (159 tests, 0 failures) and tests/content-only-ci-workflow.test.mjs passes, including the existsSync check over every listed path — all 15 added suite files exist. The token parsing in the test (replaceAll('\\\n', ' ') then slice(2)) correctly strips the line continuations and the node --test prefix of the run: | block, so the existence check sees clean paths. Looks correct to me.

One mechanical item before this can merge: the branch now conflicts with main because #2004 landed first, exactly as the PR body predicted. The conflict is a single import line in tests/content-only-ci-workflow.test.mjs:2 — main has import { readFileSync } from 'node:fs';, this branch has import { existsSync } from 'node:fs';. The resolution is to keep both: import { existsSync, readFileSync } from 'node:fs';. I verified via git merge-tree that this is the only conflicted hunk.

@mrbobbytables — a rebase with that one-line merge is all this needs.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[github-actions]

No description provided.

[hivecommons-hive]

8305903

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head 8305903970d6) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.