[Patrick-Erichsen]

Summary

Adopt the reviewed ClawScan source with bounded JavaScript value ownership and the composed CSV, Bash, preparation-cache and packing repairs. Diagnostic lock validation now binds each reviewed source to its own exact dependency digest, preserving the original incident baselines and rejecting cross-source substitutions.

-scanner: ff67692a1b58882a398449a1a5cdba620c88ad57
+scanner: c0731bff55f735957dda18d3fc29e54d7b9f3b13
 diagnostic install
-  require original incident lock
+  require reviewed source → exact lock binding

Evidence

• Before: PDFGate 1.0.0's unchanged five-file original has 4/5 statically inspected files. After: the reviewed source inspects 5/5, preserving both raw finding payloads except generated IDs. Other incomplete originals remain incomplete; this is scanner qualification, not production recovery.
• ClawScan #122, exact source CI, and native runtime publication pass. Immutable runtime index: sha256:7124516eefc920ad65c0849bb44c24ceb407636cc688770b8b00a32a1f6e693a.
• New dependency lock f4bfc4c3d226c4be309e01b7c5043ca34c53a40975a1ba39cae4c0463c98fb7f adds only tree-sitter 0.25.2/tree-sitter-javascript 0.25.0. Existing SDK versions, model/reasoning/tier, security findings and resource bounds remain fixed.
• Independent cumulative P0–P3 integration review is scoped-clean. Focused controls: 29 pass. Required static, TypeScript/build and package gates pass. Full serial coverage: 8,268 passed / 3 skipped (629 files / one skipped); 87.77% statements, 81% branches, 88.8% functions, 90.41% lines. Earlier parallel fixture-startup deadline failures are retained; no assertions or deadlines changed.
• Exact-main hosted opposite controls, Test, production activation and unchanged-original retry/public bytes are separate operator gates. This PR does not claim a recovered publication.

Merge Danger

Door: two-way

The source pin and diagnostic bindings can be reverted; normal publication gates continue to decide whether an upload is publishable.

Blast Radius: scanning

New workers consume the selected source. Activation must preserve compatible live workers and coordinate event dispatch while exact-main qualification runs.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 28, 2026 6:39am UTC

[Patrick-Erichsen]

Production activation verified at 8c5e1fe49c6bddb6df784e25473bec04a3246018, with scanner source c0731bff55f735957dda18d3fc29e54d7b9f3b13.

• Exact-main CI, Test, and backend production passed; live deployment SHA and timestamp (2026-10-28T06:55:24Z) match.
• Hosted opposite controls attest the exact clean binary/source, Ubuntu22.04, Go1.27.3, Node24.22.1, Python3.12.16, Codex0.164.0 and unchanged model/reasoning/tier. Benign→benign and malicious→malicious; all primary scanners/judge complete, zero judge operational failures.
• Four staged native publication identities and seven historical original ZIP hashes match before/after. Dispatch1, both workflows active, external rollout modes restored; rollout receipt is complete_live_verified / mustRestore=false. Existing live workers were preserved.

PDFGate's unchanged five-file original is statically complete under this source, with its two findings preserved. Original-worker recovery and exact public/install byte verification are still required; this activation does not claim that upload is published or that other incomplete JS/Markdown/TypeScript originals are recovered. No finding override, original edit or speculative retry.