docs: record upstream release limits

[tonyketcham]

Document the unresolved audit chains in Proof and resolver-svimg. The main Flatbread install remains clean.

Depends-On: #239

[tonyketcham]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	release: prepare Flatbread 1.0	#236
2	fix: remove stale release dependencies	#237
3	fix: harden stable package payloads	#238
4	fix: make core declarations portable	#239
5	docs: record upstream release limits	#240	👈
6	chore: move proof to its own repository	#241
7	fix: retarget Cursor agents at external Proof	#242
8	feat: brand agent memory as Proof and the runner as Oven	#244

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #235. Mergify cannot evaluate rules on this PR. Once #235 is merged or closed, Mergify will resume processing this PR. ⚠️

[tonyketcham]

Revision history

#	Type	Changes	Reason	Date
1	initial	b7164a8		2026-08-12 18:16 UTC
2	rebase	b7164a8 → 571166f (rebase only)		2026-08-12 18:16 UTC

[cursor]

Stale comment

Review verdict

REQUEST_CHANGES — Consensus HIGH (and two independent HIGHs) that @flatbread/resolver-svimg is wrongly credited with four high npm audit entries instead of three, which would mislead consumers reconciling the seven-entry aggregate.

Chunk-bound feedback

CHANGELOG.md:72-75 (HIGH)

Bullet claims four high entries from svimg; a clean audit on the resolver + svimg@3 chain reports three high (@flatbread/resolver-svimg, svimg, sharp). The fourth high in the release’s seven-entry total is undici on the proof/@cursor/sdk chain. Change “four high entries” to “three high entries”.

CHANGELOG.md:68-71 (MED)

“three moderate and high entries” is ambiguous. Prefer an explicit split such as “three moderate and one high” / “four entries: three moderate, one high”.

CHANGELOG.md:64-66 (MED)

“nine-package set” collides with the earlier “Nine were already on npm as alphas” list (a different nine). Rename to something explicit such as “flatbread’s nine @flatbread/* runtime dependencies.”

CHANGELOG.md:64-66 (LOW)

“A clean install of all twelve packages” underspecifies repro (peer svimg required for the sharp chain). Add a short qualifier.

Coverage plan

none — CHANGELOG-only docs PR; no tests required.

Consensus

1. resolver-svimg high count is wrong (HIGH) — all three perspectives
2. proof severity wording unclear (MED) — all three
3. “nine-package set” ambiguous (MED) — docs + release
4. twelve-package install repro underspecified (LOW) — docs + release

Reviewer scoreboard

• docs-and-positioning: COMMENT — strong clarity; caught nine-collision and count mismatch
• release-discipline: REQUEST_CHANGES — correctly HIGH on four→three
• dependency-runtime-surface: REQUEST_CHANGES — strong audit math; chain reconciliation

Perspectives: docs-and-positioning, release-discipline, dependency-runtime-surface → judge. Models: grok-4.5 (high) / composer-2.5.

  

_{Sent by Cursor Automation: Flatbread PR Review}

[cursor]

HIGH (consensus) — This bullet says @flatbread/resolver-svimg inherits four high npm audit entries from svimg→sharp. A clean audit on the resolver + svimg@3 chain reports three high (@flatbread/resolver-svimg, svimg, sharp). The fourth high in the release’s seven-entry total is undici on the proof/@cursor/sdk chain, so this over-attributes and will not match a naïve audit rerun.

Minimal fix: Change “four high entries” to “three high entries” (optionally note they are three of the release’s four highs).

[cursor]

MED (consensus) — “three moderate and high entries” is grammatically ambiguous and does not match a clear severity split readers will see in npm audit for @flatbread/proof.

Minimal fix: Rewrite to an explicit split — prefer “three moderate and one high” / “four entries: three moderate, one high” (including the @flatbread/proof rollup), unless you intentionally exclude the package mirror.

[cursor]

MED (consensus) — “nine-package set” collides with the earlier “Nine were already on npm as alphas” list (a different nine that includes resolver-svimg and excludes effort-graph / explorer). Readers may think the alpha cohort is the clean flatbread install path.

LOW — “A clean install of all twelve packages” also underspecifies how to reproduce the seven-entry audit (peer svimg is required for the sharp chain).

Minimal fix: Rename to something explicit such as “flatbread’s nine @flatbread/* runtime dependencies,” and add a short repro qualifier (install all twelve 1.0.0 packages with svimg@3, then npm audit).

[cursor]

Review verdict

REQUEST_CHANGES — Consensus HIGH that @flatbread/resolver-svimg “four high” and the “nine-package set” wording mislead readers (two+ independent HIGHs / consensus HIGH rule).

Chunk-bound feedback

CHANGELOG.md:72-75 — severity: HIGH — “inherits four high entries” overstates packed npm audit (resolver + svimg@3.x → three high). Keep the svimg@4 / sharp / import-API rationale; change the count to three.

CHANGELOG.md:64-66 — severity: HIGH — “its nine-package set” collides with the earlier alpha-nine list (which includes @flatbread/resolver-svimg). Rename to “flatbread’s nine direct @flatbread/* dependencies” (or enumerate them). Also note the twelve-package audit includes optional proof + resolver-svimg with the svimg peer.

CHANGELOG.md:68-71 — severity: MED — “three moderate and high” is ambiguous; proof packs to four entries (three moderate, one high). Spell that out so 4+3=7 stays auditable.

Coverage plan

none — docs-only CHANGELOG addition.

Reviewer scoreboard

• dependency-runtime-surface: signal MED — chains verified; over-weighted peer-only installs vs packed tarballs (2-vs-3 dispute).
• release-discipline: signal HIGH — packed-tarball 7=4+3; nine-package collision caught.
• docs-and-positioning: signal HIGH — same count fixes; out-of-chunk note that docs/positioning.md still leads with Proof vs Docs bullet claim.

Perspectives: dependency-runtime-surface, release-discipline, docs-and-positioning → judge. Models: grok-4.5 (high) / composer-2.5.

  

_{Sent by Cursor Automation: Flatbread PR Review}

[cursor]

HIGH — “inherits four high entries” does not match a packed install of @flatbread/resolver-svimg + peer svimg@3.x, which reports three high (@flatbread/resolver-svimg, svimg, sharp).

Minimal fix: change “four” → “three”. Keep the svimg@4 / sharp-below-0.35 / import-API rationale (that part checks out).

[cursor]

HIGH — “its nine-package set” can be read as the nine alpha packages listed earlier in this file (lines 14–19), which includes @flatbread/resolver-svimg. That invites a false clean-audit reading for resolver consumers.

Minimal fix: say “flatbread’s nine direct @flatbread/* dependencies” (or enumerate codegen/config/core/effort-graph/explorer/source-filesystem/transformer-markdown/transformer-yaml/utils). Also clarify that the twelve-package / seven-entry figure assumes optional @flatbread/proof and @flatbread/resolver-svimg (with svimg) are present.

[cursor]

MED — “inherits three moderate and high entries” reads as three total and undercounts a proof-only packed install (four entries: three moderate, one high — proof / @cursor/sdk / @connectrpc/connect-node / undici).

Minimal fix: spell out “three moderate and one high” (or “four entries: three moderate, one high”) so the 4+3=7 split stays auditable.

[cursor]

CI Root Cause

Status: third-party-failure

Failing checks:

• integration-nextjs (22.x, ubuntu-latest): pnpm install --frozen-lockfile failed while downloading sharp libvips (socket hang up)

Evidence:

• Job 94215230131 on SHA 571166f never left install. Log: sharp@0.31.3 downloading https://github.com/lovell/sharp-libvips/releases/download/v8.13.3/libvips-8.13.3-linux-x64.tar.br then Installation error: socket hang up.
• Sibling jobs on the same SHA passed, including integration-nextjs on 20.x/ubuntu, 20.x/windows, 20.x/macos, 22.x/windows, and 22.x/macos, plus lint/build/test and sveltekit matrix cells.
• This PR commit only adds CHANGELOG docs (docs: record upstream release limits); it does not change install config or sharp usage.

Resolution steps:

1. Re-run the failed integration-nextjs (22.x, ubuntu-latest) job (or the Pipeline workflow) on SHA 571166f.
2. If install keeps failing on libvips downloads across many jobs, check GitHub Releases / runner egress health; no branch code change is required for this signature.

No code changes were made because this failure is not caused by the branch.

  

_{Sent by Cursor Automation: Flatbread - Fix CI}