Harden Public Preview pre-visibility gates

[tensornull]

Summary

• scan the current tracked state and complete reachable Git history for credential patterns, including blobs, commit/tag messages, and historical paths without printing matched values
• validate every reachable historical content tree and materialize an exact raw HEAD tree for isolated verification, failing closed on replacement objects, export exclusions, smudge filters, and filesystem-equivalent paths
• require substantive rendered Public Preview documentation through CommonMark parsing and preserve the mocked live-smoke contract for every terminal stream state
• run the full-history gates in the blocking Node.js 22/24 CI job and document the evidence boundaries

Why

The Public Preview pre-visibility closeout required stronger evidence than a current-working-tree scan. The prior gates could miss deleted historical content, Git metadata, export-ignored files, checkout transformations, and documentation hidden in non-rendered Markdown.

This changes repository validation only. It does not expand the supported SDK API surface and does not perform a live CometAPI request.

Validation

Exact local candidate: 86c4aadc3334c4833cbd468209bde9ac20e44a55

• npm ci
• npm run build
• npm test (11 files, 176 tests)
• npm run typecheck
• npm run lint
• npm run format:check
• npm run test:secrets
• npm run test:package
• npm run test:live-contract
• npm run test:fixtures
• npm run test:compat (OpenAI 6.47.0 minimum/locked and 6.48.0 latest)
• npm run check:standalone-content
• npm run check:self-contained
• npm run check:public-preview
• npm run actionlint (1.7.12)
• npm run verify

Independent adversarial review reproduced and then verified fixes for smudge-filter byte changes, case/Unicode path collisions, secret-bearing Git metadata, Markdown comment/code bypasses, and quoted YAML control keys.

Dependency update disposition

• build(deps): bump openai from 6.47.0 to 6.48.0 in the production-dependencies group #6 was closed because changing the declared minimum to openai:^6.48.0 conflicts with the repository contract requiring openai:^6.47.0.
• build(deps-dev): bump the development-dependencies group with 5 updates #7 was closed because TypeScript 7.0.2 conflicts with the current typescript-eslint peer range.

Authorization boundary

This PR is limited to the private repository and credential-free CI. It does not change repository visibility, rules, environments, secrets, Private Vulnerability Reporting, live API state, tags, releases, Trusted Publishing, or npm registry state. Remote PR and default-branch CI evidence will be recorded after execution.

[tensornull]

Final private pre-visibility evidence - 2026-07-22

Scope: Public Preview pre-visibility closeout only. This evidence was collected while the repository remained private. No public-only configuration, live CometAPI request, release, or registry action was authorized or performed.

Exact final state

• Merged private PR: Harden Public Preview pre-visibility gates #13
• PR head: 550eee2219e49099bac322c6a7157e086de75c95
• Final private main: 631ba7b2a413a890fe9eb17eb91560034bd2aeb4
• Local main and origin/main matched that commit with a clean tracked worktree.

Local verification on exact final main

Environment: Node.js v24.15.0, npm 11.12.1, macOS 27.0.

All required commands passed: npm ci, npm run build, npm test, npm run typecheck, npm run lint, npm run format:check, npm run test:secrets, npm run check:standalone-content, npm run check:public-preview, npm run test:live-contract, npm run test:package, npm run test:fixtures, npm run test:compat, npm run actionlint, npm run check:self-contained, and npm run verify.

• Vitest: 11 files, 177 tests passed.
• Secret scan passed without printing candidate values; standalone content passed for every reachable Git tree.
• Public Preview content/identity gate and mocked live-smoke semantic contract passed.
• Package validation passed publint and Are the Types Wrong; the inspected 0.1.0-alpha.1 tarball contained the expected ESM, CommonJS, and declaration exports.
• Clean packed-artifact fixtures passed for ESM, CommonJS, and a compatible OpenAI host with one effective OpenAI installation and preserved error identity.
• Compatibility passed OpenAI 6.47.0 minimum, 6.47.0 locked, and 6.48.0 latest-within-major.
• actionlint 1.7.12 validated all four workflows.
• The exact raw HEAD tree passed isolated npm ci, offline verification, package/fixture checks, and actionlint in an empty temporary parent.
• Aggregate npm run verify exited 0.
• Non-gating audit note: npm audit --omit=dev reported zero production vulnerabilities. The full development audit reported one low-severity transitive esbuild Windows development-server advisory (GHSA-g7r4-m6w7-qqqr); no unrelated dependency update was made in this closeout.

Credential-free GitHub Actions evidence

• PR run: https://github.com/cometapi-dev/cometapi-node/actions/runs/29910295814
• PR Node.js 22: https://github.com/cometapi-dev/cometapi-node/actions/runs/29910295814/job/88891362554
• PR Node.js 24: https://github.com/cometapi-dev/cometapi-node/actions/runs/29910295814/job/88891362628
• Final main run: https://github.com/cometapi-dev/cometapi-node/actions/runs/29910724437
• Final main Node.js 22: https://github.com/cometapi-dev/cometapi-node/actions/runs/29910724437/job/88892730456
• Final main Node.js 24: https://github.com/cometapi-dev/cometapi-node/actions/runs/29910724437/job/88892730535

Both runs passed static workflow validation, blocking Node.js 22 and 24, minimum OpenAI, Node.js 26 advisory, and standalone-repository jobs. The latest-OpenAI canary was correctly skipped for these non-Dependabot runs; local compatibility separately verified the latest compatible 6.x version.

Dependency-update dispositions

• PR build(deps): bump openai from 6.47.0 to 6.48.0 in the production-dependencies group #6 was closed unmerged because it raised the supported OpenAI lower-bound contract from ^6.47.0 to ^6.48.0; the branch-specific failures and disposition are recorded at build(deps): bump openai from 6.47.0 to 6.48.0 in the production-dependencies group #6 (comment).
• PR build(deps-dev): bump the development-dependencies group with 5 updates #7 was closed unmerged because TypeScript 7 conflicted with the current typescript-eslint peer range and the grouped Node 26/tooling majors require separate compatibility review; the branch-specific failures and disposition are recorded at build(deps-dev): bump the development-dependencies group with 5 updates #7 (comment).
• No open failing dependency-update PR remained at audit time. PRs chore(deps): bump googleapis/release-please-action from 4.3.0 to 5.0.0 #1-chore(deps): bump actions/checkout from 6.0.3 to 7.0.1 #5 were open, mergeable/clean, and had green check rollups. Checks for chore(deps): bump googleapis/release-please-action from 4.3.0 to 5.0.0 #1, chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 #3, and chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 #4 predate the final main; chore(deps): bump actions/setup-node from 6.5.0 to 7.0.0 #2 and chore(deps): bump actions/checkout from 6.0.3 to 7.0.1 #5 refreshed successfully after the merge.

Read-only remote audit

• Repository: PRIVATE; default branch main at 631ba7b2a413a890fe9eb17eb91560034bd2aeb4.
• Topics include typescript, nodejs, sdk, openai, openai-compatible, cometapi, and ai.
• main reports protected:false; GraphQL reports zero branch-protection rules and zero repository rulesets.
• Repository environments: 0. Repository Actions secrets: 0. Repository Actions variables: 0. Repository Dependabot secrets: 0.
• Immutable releases: enabled:false, enforced_by_owner:false.
• Tags: 0. GitHub releases: 0. Publish workflow runs: 0.
• Live smoke has only two retained scheduled runs, both skipped with no steps. Release Please has only skipped runs, including the final-main push, because its enable condition was false/missing.
• Public npm registry lookup for cometapi and its dist-tags returned 404; there is no observable public package or dist-tag evidence.

Skipped, unknown, and unchanged boundaries

• Protected live smoke was not authorized, configured, or run. No COMETAPI_KEY was used and no live CometAPI request was made.
• npm-side Trusted Publisher configuration is not publicly enumerable and remains unknown; workflow OIDC wiring alone is not evidence of registration.
• Organization-level inherited Actions/Dependabot secrets and variables remain unknown because the authenticated GitHub token lacks admin:org; repository-level lists are empty. The Dependabot variables endpoint returned 404 and is also treated as unknown.
• Private Vulnerability Reporting returned 404. This records no enabled/readable evidence, not a definitive disabled-state claim.
• Retained API state cannot rule out deleted historical tags, releases, or workflow runs without organization audit-log access.
• No repository visibility, branch/tag rule, environment, secret, live API, tag, release, npm publication, dist-tag, provenance, or registry state was changed. Only the authorized private PR, its credential-free CI, and its merge into still-private main were performed.

Pre-visibility work is complete at this evidence boundary. Stop before repository visibility changes or any public-only, protected-live, release, or registry action pending explicit maintainer authorization.