Consolidate all open PRs: docs, CI fixes, Node.js 24, SHA pinning, training health

.github/COPILOT_SETUP_GUIDE.md

@@ -382,7 +382,7 @@ Aria includes **20+ specialized prompts** in `.github/prompts/` that guide Copil
 
 | Prompt | Purpose |
 |--------|---------|
-| `agi.prompt.md` | Chain-of-thought AGI reasoning |
+| `agi.prompt.md` | Autonomous long-running work with internal reasoning (chain-of-thought is hidden) |
 | `debug.prompt.md` | Systematic debugging protocol |
 | `reason.prompt.md` | Structured analysis & planning |
 | `review.prompt.md` | Security, performance, correctness review |
@@ -394,7 +394,7 @@ Aria includes **20+ specialized prompts** in `.github/prompts/` that guide Copil
 
 **Explicit reference**:
 ```
-Use the agi.prompt for chain-of-thought reasoning about this architecture
+Use the agi.prompt for autonomous long-running work requiring internal reasoning
 Use the debug.prompt to systematically diagnose this error
 ```
 

.github/agents/agi-reasoning.agent.md

@@ -1,6 +1,6 @@
 ---
 name: agi-reasoning
-description: "AGI reasoning and autonomous decision-making agent. Specializes in chain-of-thought reasoning, task decomposition, self-reflection, and multi-step planning using the AGI provider system.\n\nTrigger phrases include:\n- 'reason through this problem'\n- 'break this down step by step'\n- 'think through this autonomously'\n- 'use AGI reasoning'\n- 'chain of thought'\n- 'self-reflection'\n- 'autonomous planning'\n\nExamples:\n- User says 'reason through this architecture decision' → invoke for structured multi-step analysis\n- User asks 'break down this complex feature into tasks' → invoke for task decomposition\n- User says 'autonomously plan and implement this feature' → invoke for planning + execution with self-correction\n\nThis agent leverages the AGI provider's reasoning chains, task decomposition, and self-reflection capabilities."
+description: "AGI reasoning and autonomous decision-making agent. Uses internal chain-of-thought reasoning (not exposed in output) for task decomposition, self-reflection, and multi-step planning — only the final answer is delivered to the user. For visible step-by-step reasoning, use reason.prompt instead.\n\nTrigger phrases include:\n- 'reason through this problem'\n- 'break this down step by step'\n- 'think through this autonomously'\n- 'use AGI reasoning'\n- 'autonomous planning'\n- 'self-reflection'\n\nExamples:\n- User says 'reason through this architecture decision' → invoke for structured multi-step analysis\n- User asks 'break down this complex feature into tasks' → invoke for task decomposition\n- User says 'autonomously plan and implement this feature' → invoke for planning + execution with self-correction\n\nThis agent leverages the AGI provider's reasoning chains, task decomposition, and self-reflection capabilities. Chain-of-thought steps are completed internally; only the final answer is delivered."
 tools:
   - edit
   - search
@@ -55,7 +55,7 @@
 
 ### Query Analysis Framework
 
 ```
 Complexity:
   simple   → Direct answer, single-step (< 10 words, no keywords)
   moderate → Some context needed, 2-3 steps
@@ -80,7 +80,7 @@
 ### Task Decomposition Templates
 
 **Coding Tasks:**
 1. Understand requirements and constraints
 2. Explore existing code and patterns
 3. Design approach (consider alternatives)
 4. Implement with incremental validation
@@ -88,7 +88,7 @@
 6. Test and verify
 
 **Architecture Tasks:**
 1. Map current state (components, dependencies, data flow)
 2. Identify constraints and requirements
 3. Generate candidate approaches (minimum 2)
 4. Evaluate tradeoffs (complexity, performance, maintainability)

.github/prompts/agi.prompt.md

@@ -1,5 +1,5 @@
 ---
-description: "Engage autonomous AGI reasoning with multi-step analysis, task decomposition, self-correction, and iterative improvement. Use when: long-running autonomous work, plan-then-implement tasks, deep reasoning with concise summaries, extended code generation, iterative debugging, repo-wide fixes, or self-correcting execution."
+description: "Engage autonomous AGI reasoning with multi-step analysis, task decomposition, self-correction, and iterative improvement. Chain-of-thought reasoning runs internally — only the final answer is delivered to the user. For visible step-by-step reasoning, use reason.prompt instead."
 name: "AGI Reasoning"
 argument-hint: "Problem or task description (example: analyze the auth flow for race conditions + constraints)"
 agent: agi-reasoning

.github/workflows/actionlint.yml

@@ -26,7 +26,7 @@ jobs:
         timeout-minutes: 10
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Setup ShellCheck
               run: sudo apt-get update && sudo apt-get install -y shellcheck

.github/workflows/api-health-smoke.yml

@@ -25,6 +25,9 @@
     group: api-health-${{ github.ref }}
     cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+    FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true  # Opt into Node.js 24 for JS actions ahead of June 2026 forced migration
+
 jobs:
     smoke:
         name: API Smoke Validation
@@ -33,7 +36,7 @@
 
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Setup Python
               uses: ./.github/actions/setup-python-env
@@ -55,7 +58,7 @@
 
             - name: Upload smoke artifacts
               if: always()
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
               with:
                   name: api-health-smoke-${{ github.run_number }}
                   retention-days: 14
@@ -65,7 +68,7 @@
 
             - name: Summary
               if: always()
               run: |
                   echo "## API Health Smoke" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   echo "| Check | Result |" >> $GITHUB_STEP_SUMMARY

.github/workflows/artifact-lifecycle.yml

@@ -47,7 +47,7 @@
 
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Setup Python
               uses: ./.github/actions/setup-python-env
@@ -75,7 +75,7 @@
 
             - name: Upload cleanup summary
               if: always()
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
               with:
                   name: artifact-lifecycle-${{ github.run_number }}
                   retention-days: 30
@@ -84,7 +84,7 @@
 
             - name: Step summary
               if: always()
               run: |
                   echo "## Artifact Lifecycle" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   if [ "${{ github.event_name }}" = "schedule" ]; then

.github/workflows/autonomous-evolver.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: 20
 

.github/workflows/broken-links.yml

@@ -26,7 +26,7 @@
         timeout-minutes: 15
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Check links in docs and markdown
               uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411  # v2.8.0
@@ -36,7 +36,6 @@
                       --verbose
                       --no-progress
                       --max-concurrency 8
-                      --exclude-mail
                       --accept 200,204,206,301,302,307,308,401,403,429
                       '**/*.md'
                       'docs/**/*.md'
@@ -45,7 +44,7 @@
 
             - name: Summary
               if: always()
               run: |
                   echo "## Broken Links Check" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   echo "Scanned markdown and docs links using Lychee." >> $GITHUB_STEP_SUMMARY

.github/workflows/coverage-report.yml

@@ -33,7 +33,7 @@
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Setup Python
               uses: ./.github/actions/setup-python-env
@@ -42,7 +42,7 @@
 
             - name: Run tests with coverage
               id: run
               run: |
                   python -m pytest tests/ \
                     --cov=. \
                     --cov-report=xml:coverage.xml \
@@ -68,7 +68,7 @@
             # On main pushes → store as the next PR's baseline
             - name: Upload main baseline artifact
               if: github.ref == 'refs/heads/main'
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
               with:
                   name: coverage-main-baseline
                   path: coverage.xml
@@ -79,7 +79,7 @@
             # On PRs → also upload per-SHA artifact for auditability
             - name: Upload PR coverage artifact
               if: github.event_name == 'pull_request'
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
               with:
                   name: coverage-pr-${{ github.event.pull_request.number }}
                   path: coverage.xml
@@ -103,7 +103,7 @@
             - name: Parse baseline coverage
               if: github.event_name == 'pull_request'
               id: baseline
               run: |
                   BASE=$(python3 - <<'PYEOF'
                   import xml.etree.ElementTree as ET, glob, sys
                   files = glob.glob('baseline/**/*.xml', recursive=True) + glob.glob('baseline/*.xml')
@@ -122,7 +122,7 @@
 
             - name: Post PR coverage comment
               if: github.event_name == 'pull_request'
-              uses: actions/github-script@v7
+              uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
               env:
                   COV_TOTAL: ${{ steps.run.outputs.total }}
                   COV_BASE: ${{ steps.baseline.outputs.total }}
@@ -182,7 +182,7 @@
 
             - name: Write step summary
               if: always()
               run: |
                   T="${{ steps.run.outputs.total }}"
                   echo "## Coverage: ${T}%" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/dataset-integrity.yml

@@ -35,13 +35,13 @@
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
               with:
                   fetch-depth: 0
 
             - name: Resolve diff range
               id: range
               run: |
                   if [ "${{ github.event_name }}" = "pull_request" ]; then
                     echo "base=${{ github.event.pull_request.base.sha }}" >> $GITHUB_OUTPUT
                     echo "head=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
@@ -57,7 +57,7 @@
 
             - name: Detect modified or deleted dataset files
               id: check
               run: |
                   BASE="${{ steps.range.outputs.base }}"
                   HEAD="${{ steps.range.outputs.head }}"
 
@@ -85,7 +85,7 @@
 
             - name: Write immutability summary
               if: always()
               run: |
                   echo "## Dataset Immutability Gate" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   if [ -n "${{ steps.check.outputs.violations }}" ]; then
@@ -105,7 +105,7 @@
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
               with:
                   fetch-depth: 0
 
@@ -116,7 +116,7 @@
 
             - name: Resolve diff range
               id: range
               run: |
                   if [ "${{ github.event_name }}" = "pull_request" ]; then
                     echo "base=${{ github.event.pull_request.base.sha }}" >> $GITHUB_OUTPUT
                     echo "head=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
@@ -231,7 +231,7 @@
 
             - name: Write schema summary
               if: always()
               run: |
                   echo "## Dataset Schema Validation" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   echo "New files are validated against the chat message schema:" >> $GITHUB_STEP_SUMMARY

.github/workflows/dependency-review.yml

@@ -18,10 +18,10 @@ jobs:
         timeout-minutes: 10
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Dependency Review
-              uses: actions/dependency-review-action@v4
+              uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48  # v4
               with:
                   fail-on-severity: high
                   deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0

.github/workflows/devcontainer-ci.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Build and test devcontainer
         uses: devcontainers/ci@b63b30de439b47a52267f241112c5b453b673db5  # v0.3

.github/workflows/experiment-runner.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: 20
 

.github/workflows/integration-contract-gate.yml

@@ -33,14 +33,17 @@
   group: contract-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true  # Opt into Node.js 24 for JS actions ahead of June 2026 forced migration
+
 jobs:
   contract-gate:
     name: API Contract Validation
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup Python
         uses: ./.github/actions/setup-python-env
@@ -50,7 +53,7 @@
 
       - name: Determine gate mode
         id: mode
         run: |
           if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
             echo "strict=true" >> $GITHUB_OUTPUT
             echo "mode_label=strict (push to main)" >> $GITHUB_OUTPUT
@@ -84,7 +87,7 @@
 
       - name: Upload contract results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: contract-gate-results-${{ github.run_number }}
           retention-days: 14
@@ -94,7 +97,7 @@
 
       - name: Generate summary
         if: always()
         run: |
           echo "## Integration Contract Gate" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Mode:** ${{ steps.mode.outputs.mode_label }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/llm-maker-tests.yml

@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: '3.11'
 

.github/workflows/markdown-quality.yml

@@ -24,10 +24,10 @@
         timeout-minutes: 10
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Lint Markdown files
-              uses: DavidAnson/markdownlint-cli2-action@8305c0f1062bb0d184d09ef4493ecb9288447732  # v20
+              uses: DavidAnson/markdownlint-cli2-action@6b51ade7a9e4a75a7ad929842dd298a3804ebe8b  # v23
               with:
                   globs: |
                       **/*.md
@@ -36,7 +36,7 @@
 
             - name: Summary
               if: always()
               run: |
                   echo "## Markdown Quality" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   echo "Validated Markdown style and structure with markdownlint-cli2." >> $GITHUB_STEP_SUMMARY

.github/workflows/nightly-regression.yml

@@ -31,6 +31,9 @@
   group: nightly-regression
   cancel-in-progress: false  # Never cancel a nightly run mid-flight
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true  # Opt into Node.js 24 for JS actions ahead of June 2026 forced migration
+
 jobs:
   full-test-suite:
     name: Full Test Suite
@@ -44,7 +47,7 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup Python
         uses: ./.github/actions/setup-python-env
@@ -62,7 +65,7 @@
 
       - name: Resolve pytest flags
         id: flags
         run: |
           if [[ "${{ github.event.inputs.fail-fast }}" == "true" ]]; then
             echo "extra=--maxfail=1" >> $GITHUB_OUTPUT
           else
@@ -71,7 +74,7 @@
 
       - name: Run full test suite
         id: run-tests
         run: |
           set +e
           python -m pytest tests/ -q --tb=short \
             --junitxml=test-results.xml \
@@ -83,7 +86,7 @@
 
       - name: Parse results
         id: parse
         run: |
           # Extract "X passed, Y failed, Z skipped" from pytest output
           SUMMARY=$(grep -E "[0-9]+ passed" pytest-output.txt | tail -1 || echo "0 passed")
           PASSED=$(echo "$SUMMARY" | grep -oE "[0-9]+ passed" | grep -oE "[0-9]+" || echo "0")
@@ -96,7 +99,7 @@
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: nightly-test-results-${{ github.run_number }}
           retention-days: 30
@@ -108,7 +111,7 @@
 
       - name: Generate summary
         if: always()
         run: |
           echo "## Nightly Regression Baseline" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "| Result | Count |" >> $GITHUB_STEP_SUMMARY
@@ -128,7 +131,7 @@
     timeout-minutes: 5
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Download previous baseline artifact
         id: download-prev
@@ -150,7 +153,7 @@
         env:
           CURRENT_PASSED: ${{ needs.full-test-suite.outputs.passed }}
           CURRENT_FAILED: ${{ needs.full-test-suite.outputs.failed }}
         run: |
           PREV_PASSED=0
           PREV_OUTPUT_FILE=$(find . -type f -name 'pytest-output.txt' | head -1)
           if [ -n "$PREV_OUTPUT_FILE" ] && [ -f "$PREV_OUTPUT_FILE" ]; then
@@ -171,7 +174,7 @@
 
       - name: Open regression issue
         if: steps.compare.outputs.regression == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/platform-health-daily.yml

@@ -27,7 +27,7 @@
 
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
             - name: Setup Python
               uses: ./.github/actions/setup-python-env
@@ -46,7 +46,7 @@
 
             - name: Upload health artifacts
               if: always()
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
               with:
                   name: platform-health-${{ github.run_number }}
                   retention-days: 30
@@ -56,7 +56,7 @@
 
             - name: Summary
               if: always()
               run: |
                   echo "## Platform Health Daily" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   echo "| Output | Path |" >> $GITHUB_STEP_SUMMARY