docs: close the legitimate doc gaps from the v3.5.41 audit#244
Merged
Conversation
A critical re-review of the v3.5.41 audit confirmed its "HOLD" verdict was unsound — its central "failing unit suite" blocker only reproduces on Node 26, while the repo pins Node 22 via .nvmrc (CI green, 581/581 unit + 32 e2e). No code-side release blocker stands. These are the audit's real (P3) items: - README documented activation around Skilljar only, but manifest.json injects on claude.com/resources/tutorials/* too (privacy policy already lists it). Add that surface to the activation description. - docs/privacy.html said "30+ languages" while PRIVACY_POLICY.md says 32 — align to the precise count (the file is hand-maintained, not generated). - RELEASE_CHECKLIST.md embedded a per-publisher CWS devconsole group id in a public-repo doc. Not a credential, but no reason to ship the identifier — replace with the generic console link. Left as-is (flagged for owner): the Node-26-only background.test.js failure is a jest + new-Function-realm/fake-timer incompatibility, not a code defect — the repo's Node 22 pin is the right boundary. Account-requirement wording (README vs TESTING.md) and manifest author identity are owner messaging decisions.
heznpc
enabled auto-merge (squash)
June 25, 2026 04:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A critical re-review of the v3.5.41 audit found its "HOLD" verdict unsound: the central "failing unit suite" blocker reproduces only on Node 26, but the repo pins Node 22 via
.nvmrc(CI green — 581/581 unit, 32 e2e). No code-side release blocker stands. This PR applies the audit's genuinely-real P3 items.Changes
manifest.json:27also injects onclaude.com/resources/tutorials/*(the privacy policy already lists it). Added that surface to the activation line.PRIVACY_POLICY.mdsays 32; aligned to the precise count (hand-maintained file, not generated bygenerate-docs.js).Investigated, left as-is (flagged for owner)
background.test.jsfailure — a jest +new Function-realm / fake-timer incompatibility, not a code defect. Verified across 4 injection strategies: all green on Node 22, all fail on Node 26 (the dedup-TTL test'suseFakeTimers()/useRealTimers()cycle leaves the isolated Function realm's timer globals unresolvable on Node 26). The repo's Node 22 pin is the correct boundary; enforcing it via apackage.jsonenginesfield is an owner policy call.TESTING.md) — owner messaging decision."SkillBridge Contributors"(generic, not a wrong identity) — owner choice.Validation
lint · format clean; README
LANG_COUNTmarkers intact; no value regressions.