[hivecommons-hive]

Summary

The website shows a Bluefin growth chart that a daily job downloads from another project. The download script only accepts a file from one fixed upstream snapshot whose fingerprint matches a known value, so nothing unexpected gets published. This PR adds tests that actually run those checks, so CI will catch any change that weakens them. No production code changes.

Test Improvement

Adds one file: scripts/tests/update-growth-chart-main.test.ts (claims scripts/update-growth-chart.js main() only; existing update-growth-chart.test.ts is unchanged).

The test runs the real CLI entry point (node scripts/update-growth-chart.js, as update-content.yml does) from a scratch copy of the script, so its output path resolves into a temp directory and the committed src/assets/svg/growth_bluefins.svg is never touched. fetch is replaced by a node --import preload stub, so no network is used. It asserts:

• the request URL is pinned to a 40-hex ublue-os/countme commit, not a branch
• a 503 response exits 1 with growth chart fetch failed: 503 Service Unavailable and the previous chart is unchanged
• a checksum mismatch exits 1, names the expected and actual SHA-256, and the previous chart is unchanged
• a valid-looking SVG with onload= is still refused (checksum first) and never written

Validation:

• npx vitest run scripts/tests/update-growth-chart → 9 passed
• Mutation checks: disabling the checksum comparison (2 failures), unpinning the URL to main (1 failure), ignoring res.ok (1 failure)
• npx eslint on the new file, npx vue-tsc --noEmit, npm run check:docs all clean

Note: like check-docs.test.ts, this drives the script in a child process, so v8 coverage in the vitest report does not attribute these lines. The success path (lines 68-70) needs the exact pinned upstream bytes and remains covered only by the scheduled job.

Related Issue

Fixes #952

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5.5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

Reviewed — no findings from correctness, security, intent-alignment, style, docs-currency.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[Danathar]

Reviewed at 1aec065: the change does what its issue asks, the tests exercise the real code, and the only failing checks are pre-existing on main. Releasing the ACMM hold.