bioinfornatics · Nov 10, 2026 · Nov 10, 2026
diff --git a/.github/workflows/development-ci.yml b/.github/workflows/development-ci.yml
@@ -19,13 +19,14 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Install checksum-pinned Goose
         shell: bash
         run: |
@@ -45,7 +46,7 @@ jobs:
         run: node scripts/ci-step.mjs quick node scripts/ci-tests.mjs quick
       - name: Upload detailed verification logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: production-ci-quick
           path: .artifacts/ci-logs
@@ -62,13 +63,14 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Install checksum-pinned Goose
         shell: bash
         run: |
@@ -89,7 +91,7 @@ jobs:
         run: node scripts/ci-step.mjs skill-${{ matrix.shard }} node scripts/ci-tests.mjs skill ${{ matrix.shard }}
       - name: Upload detailed verification logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: production-ci-skill-${{ matrix.shard }}
           path: .artifacts/ci-logs
@@ -101,13 +103,14 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Install checksum-pinned Goose
         shell: bash
         run: |
@@ -127,7 +130,7 @@ jobs:
         run: node scripts/ci-step.mjs production-tests node scripts/ci-tests.mjs remaining
       - name: Upload detailed verification logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: production-ci-remaining
           path: .artifacts/ci-logs
@@ -146,13 +149,14 @@ jobs:
           SKILL: ${{ needs.skill.result }}
           REMAINING: ${{ needs.remaining.result }}
         run: test "$QUICK" = success && test "$SKILL" = success && test "$REMAINING" = success
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Install checksum-pinned Goose
         shell: bash
         run: |
@@ -178,15 +182,16 @@ jobs:
         run: node scripts/candidate-transfer.mjs pack .artifacts/candidate .artifacts/candidate.json
       - name: Upload canonical frozen candidate
         if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: evaluation-candidate-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
+          archive: true # Promotion verifies and extracts the API ZIP archive
           path: .artifacts/candidate.json
           retention-days: 14
           if-no-files-found: error
       - name: Upload detailed verification logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: production-ci-projection
           path: .artifacts/ci-logs

diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
@@ -16,15 +16,16 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - run: pip install --require-hashes -r docs/requirements.txt
       - run: bash scripts/build-documentation.sh
       - run: python3 scripts/test-documentation-integrity.py
@@ -35,12 +36,12 @@ jobs:
           echo "PLAYWRIGHT_MODULE=$PWD/.artifacts/documentation/browser/node_modules/playwright-core/index.mjs" >> "$GITHUB_ENV"
           echo "CHROMIUM_PATH=/usr/bin/google-chrome" >> "$GITHUB_ENV"
       - run: node scripts/test-documentation-browser.mjs
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: documentation-site
           path: .artifacts/documentation/site
           include-hidden-files: true
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: documentation-screenshots
@@ -55,14 +56,14 @@ jobs:
       pages: write
     environment: github-pages
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Configure publication identity
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: documentation-site
           path: .artifacts/documentation/site

diff --git a/.github/workflows/promote-production.yml b/.github/workflows/promote-production.yml
@@ -35,13 +35,14 @@ jobs:
     outputs:
       source_sha: ${{ steps.request.outputs.source_sha }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - id: request
         env:
           GH_TOKEN: ${{ github.token }}
@@ -69,13 +70,14 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.resolve.outputs.source_sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Await canonical exact-SHA develop verification (no duplicate suite)
         id: proof
         env:
@@ -91,7 +93,7 @@ jobs:
       actions: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.resolve.outputs.source_sha }}
           fetch-depth: 0
@@ -104,9 +106,10 @@ jobs:
           test "$(git rev-parse HEAD)" = "$VERIFIED_SHA"
           case "$SOURCE_BRANCH" in develop) ;; *) exit 1 ;; esac
           git switch -c "$SOURCE_BRANCH"
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Install checksum-pinned Goose
         run: |
           curl --fail --location --retry 3 https://github.com/aaif-goose/goose/releases/download/v1.57.0/goose-x86_64-unknown-linux-gnu.tar.bz2 -o /tmp/goose.tar.bz2

diff --git a/.github/workflows/promotion-pr.yml b/.github/workflows/promotion-pr.yml
@@ -16,13 +16,14 @@ jobs:
       pull-requests: read
       actions: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Verify request with trusted base-tree code only
         env:
           GH_TOKEN: ${{ github.token }}

diff --git a/.github/workflows/reproducibility.yml b/.github/workflows/reproducibility.yml
@@ -23,13 +23,14 @@ jobs:
           source_sha=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/branches?per_page=100" | jq -r 'add | map(select(.name == "develop")) | .[0].commit.sha // empty')
           [[ "$source_sha" =~ ^[a-f0-9]{40}$ ]]
           echo "sha=$source_sha" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.source.outputs.sha }}
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.22.2'
+          node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10)
+          package-manager-cache: false
       - name: Install checksum-pinned Goose
         run: |
           curl --fail --location --retry 3 https://github.com/aaif-goose/goose/releases/download/v1.57.0/goose-x86_64-unknown-linux-gnu.tar.bz2 -o /tmp/goose.tar.bz2
@@ -47,7 +48,7 @@ jobs:
         run: node scripts/ci-step.mjs exhaustive node scripts/test.mjs --profile=full
       - name: Upload detailed verification logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: exhaustive-ci-logs
           path: .artifacts/ci-logs

diff --git a/AGENTS.md b/AGENTS.md
@@ -153,6 +153,21 @@ permission; action-specific current authorization remains mandatory.
 | Documentation | `bash scripts/build-documentation.sh`; `python3 scripts/test-documentation-integrity.py`; `node scripts/test-documentation-browser.mjs` (configured Python/Zensical/Chromium) |
 References: [contribution/build setup](CONTRIBUTING.md), [promotion/rollback](docs/branch-migration.md), [documentation setup/publication](docs/documentation.md).
 
+## Current CI toolchain
+
+- CI pins Node.js **26.13.0 LTS** (official release index inspected 2026-11-10),
+  separately from the unchanged supported runtime minimum **22.22.2**.
+- All five `.github/workflows` use full-SHA action pins with release comments;
+  action internals use Node24, not the Node version installed for build/test commands.
+- Keep `package-manager-cache: false` on setup-node: offline reconstruction and
+  privileged promotion must not silently acquire automatic npm caching.
+- Canonical candidate upload explicitly uses `archive: true`: promotion authenticates
+  the API ZIP digest and streams its unique `candidate.json` member. Do not change to
+  raw upload without adapting that transport contract. Documentation keeps hidden files.
+- `tests/test_ci_verification.test.ts` checks current pins, exact CI Node identity,
+  cache policy, ZIP transport and existing trust boundaries. Local checks do not prove
+  GitHub runner/action execution or the live artifact-service round trip.
+
 ## Test design and execution pitfalls
 
 - Each test documents a distinct product guarantee and identifies the wrong observable result it detects. Delete mock-echo, copied-algorithm and duplicate cases; assert exact outcomes and relevant boundaries. Green mocks and test count are not acceptance.

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -54,7 +54,7 @@ Creating a branch does not authorize an automated agent to commit or push. Follo
 
 ## Development prerequisites
 
-- **Node.js 22+** for the contained runtimes and Node-based tooling. Routine CI uses Node.js 22.22.2.
+- **Node.js 22+** for the contained runtimes and Node-based tooling. Routine CI pins Node.js 26.13.0 LTS.
 - **Git**; **Beads (`bd`)** for task tracking. **Make** is optional.
 - Full verification also needs the verified **Goose 1.57.0** executable and a supported browser for integration/accessibility checks. See [.github/workflows/development-ci.yml](.github/workflows/development-ci.yml) for CI prerequisites.
 

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 [![Servier Powered](https://raw.githubusercontent.com/servierhub/.github/main/badges/powered.svg)](https://servier.com/en/)
 
-> **Current distribution 0.8.2.** The contained agent-plugin CLI supplies evaluation,
+> **Current distribution 0.8.3.** The contained agent-plugin CLI supplies evaluation,
 > history/inspect, grading and export; the separate helper renders exported HTML.
 > Legacy creator CLIs/native archives and historical import remain retired.
 > Active host guidance targets current stable releases; versioned compatibility
@@ -28,7 +28,7 @@ Four creators cover authoring and validation; a fifth Skill helps package execut
 
 | Status | Value |
 |---|---|
-| Distribution | `0.8.2` |
+| Distribution | `0.8.3` |
 | Portable plugin target | Agent Plugins `1.0.0` |
 | Verified host integration | Goose `1.47.0` |
 | Git installation requirement | Node.js 22+; creator code and dependencies included |

diff --git a/RELEASES.md b/RELEASES.md
@@ -9,6 +9,23 @@ and local staged installer have been retired and removed from current tooling.
 No native compatibility or newly published release is claimed by this cleanup.
 Historical compatibility evidence and third-party/vendor sources remain retained.
 
+## 0.8.3 — current CI actions and Node LTS
+
+PATCH release: updates CI infrastructure without changing CLI behavior or the
+supported Node.js runtime minimum (22.22.2). CI pins Node.js 26.13.0 LTS;
+GitHub Actions use their declared Node24 runtime independently.
+
+- Latest stable full-SHA action pins: checkout 7.0.1, setup-node 7.1.0,
+  setup-python 7.1.0, upload-artifact 7.0.2 and download-artifact 8.0.2.
+- Disable automatic npm caching and preserve the authenticated canonical ZIP
+  artifact transport, checkout refs, permissions and approval/provenance gates.
+- Official release manifests and Node release index inspected 2026-11-10.
+  Local Node26 build/tests/typecheck/lint and CI contracts verified; GitHub action
+  execution and artifact-service round trip require exact-source CI evidence.
+- No Goose update or new host-support commitment is introduced. See the
+  [versioned compatibility evidence](skills/plugin-creator/references/compatibility-matrix.md#083--ci-toolchain-update-2026-11-11).
+
+
 ## 0.6.1 — report overview and judge diagnostics
 
 - Explicit source Skill/Plugin identity and complete frozen campaign overview, with

diff --git a/docs/production-README.md b/docs/production-README.md
@@ -4,7 +4,7 @@
 
 Reusable authoring instructions and comparative Skill/Plugin evaluation.
 
-**0.8.2 — Git distribution.** Installations receive the generated `main` tree.
+**0.8.3 — Git distribution.** Installations receive the generated `main` tree.
 Local source changes do not update remote installations until verified promotion.
 Goose is the verified reference host for plugin installation; other hosts and native
 model/profile compatibility require separate evidence.

diff --git a/docs/site/en/reference.md b/docs/site/en/reference.md
@@ -12,7 +12,7 @@ Use this page to look up recorded versions, paths, command boundaries, and sourc
 | Verified host integration | Goose 1.47.0, not a claim about latest Goose |
 | Git-installed creator runtime | Node.js 22+; compiled code and production dependencies included |
 | Native release runtime | Platform-specific Bun executable; no Node.js requirement |
-| Contributor tooling | Node.js 22+ and pinned Bun 1.3.12; routine CI uses Node.js 22.22.2 |
+| Contributor tooling | Node.js 22+ and pinned Bun 1.3.12; routine CI pins Node.js 26.13.0 LTS |
 | License | [CeCILL-C](https://github.com/bioinfornatics/agent-plugins/blob/develop/LICENSE) |
 
 Verification of Goose does not establish compatibility with another host. See the [recorded Goose plugin reference](https://github.com/bioinfornatics/agent-plugins/blob/develop/skills/plugin-creator/references/goose-plugin-format.md) for revision-specific details.