[hivecommons-hive]

Summary: The Dakota download button on the website could keep pointing at the previous installer for up to a day after someone updated it. This moves the installer list into the site's own code, so an update goes live with the next deploy and yesterday's saved data can no longer override it.

---

Fix

Deploys restore public/dakota-versions.json from the live-data Actions cache over the checkout and only reconcile public/experiences/catalogue.json afterwards, so a committed isos change (like the Alpha 6 bump in #830) shipped the old filename until the next daily refresh. Restoring the whole file from git in deploy would instead ship stale version chips, so the ISO list moves out of the cached file.

Files / functions touched:

• src/data/dakota-isos.ts (new): DAKOTA_ISOS, the single committed ISO list.
• src/components/dakota/DakotaVersionCard.vue: download entries come from DAKOTA_ISOS only; FALLBACK_ISOS and the versions.isos read are gone. Version chips still come from the fetched JSON.
• src/composables.ts: drop isos from DakotaVersions.
• scripts/lib/dakota-version-projection.js projectDakotaVersions and scripts/update-image-versions.js updateImageVersions: stop carrying isos forward, so a stale cached copy self-heals on the next daily run.
• public/dakota-versions.json: drop isos.
• docs/skills/content-maintenance/SKILL.md: ISO releases now edit one place.
• Tests: src/tests/dakotaVersionCard.test.ts (adds a case proving a stale cached isos field is ignored), scripts/tests/dakota-version-projection.test.ts, scripts/tests/update-image-versions-orchestrator.test.ts.

No workflow change is needed. The existing git checkout HEAD -- public/dakota-versions.json step in update-content.yml stays harmless.

Validation: npm run test:gate (no new failures), vue-tsc --noEmit, eslint on touched files (only pre-existing JSDoc warnings).

Closes #959

---

Filed by scanner agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=scanner backend=copilot model=claude-opus-5.5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "scanner" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

hive/awaiting-ci: held for human review. Green CI will not merge this on its own; it merges after a maintainer reviews it and removes hold.

---

🐝 Hive Agent: scanner | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-opus-5.5 copilot=1.0.88

[hivecommons-hive]

Summary: This change moves the Dakota installer download list out of a data file that the deploy job can overwrite with yesterday's copy, and into the site's own source, so a new installer link goes live on the next deploy. The code change is correct and the tests cover it. One piece of operator-facing text still describes the old behavior and should be updated so the next person maintaining the deploy pipeline is not misled.

What I need from you: Update the stale comment, then this is ready.

---

docs-currency

• .github/workflows/update-content.yml:50-56 — comment still says dakota-versions.json "has ISO downloads and hardware baseline committed in git" and that cache restore "overwrites ... ISO updates (like alpha6) ... causing update:image-versions to carry forward old ISOs". After this PR (scripts/lib/dakota-version-projection.js:45-48,81-85, src/data/dakota-isos.ts:14-16) ISO data no longer passes through that file or that script. The git checkout HEAD -- public/dakota-versions.json step at line 58 is still needed for packages.baseline, but the stated reason is now wrong. Suggested: reword to name the baseline only and point at src/data/dakota-isos.ts for ISO downloads (same wording the PR already added to docs/skills/content-maintenance/SKILL.md:361-365).

style (advisory, non-blocking)

• scripts/lib/image-version-audit.js:11 — 'isos' in NON_SBOM_FIELDS is now a dead entry: nothing emits it (dakota-version-projection.js:81-85) and the guard is only fed previousDakota?.packages (scripts/update-image-versions.js:133). Harmless; drop when convenient.

No findings from: correctness, security, intent-alignment.

Confidence: 3/5 (needs attention) — 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[Danathar]

Reviewed at b1bc796: the change does what its issue asks, the tests exercise the real code, and the only failing checks are pre-existing on main. Releasing the ACMM hold.