[mishrasanjeev]

Summary

• Integrate the open dependency and workflow updates while preserving their original commit ancestry.
• Keep the OpenTelemetry peer family compatible, align React and React DOM, and repair the LangChain dependency override.
• Configure example verification through the existing SDK, bind audit evidence to the verified principal, and exercise actual denied tool invocations.
• Remove redundant test-fixture work and repeated full-DOM queries without relaxing assertions, test deadlines, or security controls.
• Return generic malformed-request errors from the shared loopback example fixture, with a bounded negative response check and all original issuer/audit/tool-denial assertions retained.

Local Docker Validation

• Auth service: 3,921 tests across 260 files, with real Postgres and Redis integration; TypeScript SDK: 1,552 tests across 57 files.

• Developer portal: 1,011 tests across 98 files, typecheck, production build and repository policy checks.

• Combined affected adapters/examples: 341 adapter tests, five starter tests, typechecks/builds and synthetic local smokes.

• Final shared-fixture repair: all three affected synthetic consumer smokes and three malformed-request refusals passed in offline Docker; no provider calls or deadline increases.

• Python SDK/integration: 47 tests, strict type checking and real local verification/enforcement smoke; MCP browser coverage: nine Chromium desktop/mobile tests.

• All 40 npm lockfile audits and repository dependency, documentation, licensing and supply-chain checks passed.

• Actual rebuilt auth runtime: Node 26.12.1, native Undici 8.12.2, non-root execution, three native-fetch regressions passed and no HIGH/CRITICAL findings under the unchanged container-scan policy.

• Final combined auth browser coverage: all 19 tests passed. The immutable auth image also passed strict production-mode startup with synthetic local credentials, safe HTTP/Chromium checks, and repeated startup against the populated local database.

• Unauthenticated passive ZAP baselines completed with zero FAIL/WARN/alerts under the unchanged rules. The protected-root spider limitation is retained; these scans do not claim authenticated/full-API coverage.

Exact-head combined CI and normal branch-protection checks remain mandatory before merge. Local acceptance is not a production deployment claim.

Deployment Boundary

No feature flags, budgets, secret references, IAM policy, signing keys or production controls are changed here. No live provider, model or payment transaction was used for validation. The existing portal deployment-permission issue is separate from its passing application tests and build; it is not bypassed by this change.

Integrates #1862, #1853, #1848, #1846, #1845, #1844, #1843, #1842, #1841, #1840, #1839, #1838, #1837, #1835, #1834, #1832, #1831, #1828, #1826, #1824 and #1816.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T17:51:52.911743Z	e5e56a0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
actions/github/codeql-action/upload-sarif	9b3254085494b55a0f7c4c2b3d2d52cc712ce370	Unknown	Unknown
npm/@oxc-project/types	0.155.0	Unknown	Unknown
npm/@rolldown/binding-android-arm-eabi	1.2.15	Unknown	Unknown
npm/@rolldown/binding-android-arm64	1.2.15	Unknown	Unknown
npm/@rolldown/binding-darwin-arm64	1.2.15	Unknown	Unknown
npm/@rolldown/binding-darwin-x64	1.2.15	Unknown	Unknown
npm/@rolldown/binding-freebsd-x64	1.2.15	Unknown	Unknown
npm/@rolldown/binding-linux-arm-gnueabihf	1.2.15	Unknown	Unknown
npm/@rolldown/binding-linux-arm64-gnu	1.2.15	Unknown	Unknown
npm/@rolldown/binding-linux-arm64-musl	1.2.15	Unknown	Unknown
npm/@rolldown/binding-linux-ppc64-gnu	1.2.15	Unknown	Unknown
npm/@rolldown/binding-linux-s390x-gnu	1.2.15	Unknown	Unknown
npm/@rolldown/binding-linux-x64-gnu	1.2.15	Unknown	Unknown
npm/@rolldown/binding-linux-x64-musl	1.2.15	Unknown	Unknown
npm/@rolldown/binding-openharmony-arm64	1.2.15	Unknown	Unknown
npm/@rolldown/binding-win32-arm64-msvc	1.2.15	Unknown	Unknown
npm/@rolldown/binding-win32-x64-msvc	1.2.15	Unknown	Unknown
npm/@vitest/coverage-v8	5.0.5	Unknown	Unknown
npm/@vitest/mocker	5.0.5	Unknown	Unknown
npm/@vitest/spy	5.0.5	Unknown	Unknown
npm/dotenv	18.0.9	🟢 4.7	Details Check Score Reason Code-Review 🟢 3 Found 8/21 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 9 security policy file detected Maintained 🟢 10 30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/jose	6.2.13	🟢 7.5	Details Check Score Reason Code-Review ⚠️ 0 Found 0/26 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 4 3 out of the last 5 releases have a total of 3 signed artifacts. SAST 🟢 10 SAST tool is run on all commits
npm/playwright	1.64.1	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10 Code-Review 🟢 9 GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9 CII-Best-Practices ⚠️ 0 no badge detected Vulnerabilities 🟢 10 no vulnerabilities detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 no published package detected Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Binary-Artifacts 🟢 6 binaries present in source code Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches
npm/playwright-core	1.64.1	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10 Code-Review 🟢 9 GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9 CII-Best-Practices ⚠️ 0 no badge detected Vulnerabilities 🟢 10 no vulnerabilities detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 no published package detected Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Binary-Artifacts 🟢 6 binaries present in source code Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches
npm/postcss	8.5.31	🟢 7.4	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 2 Found 7/30 approved changesets -- score normalized to 2 Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 1 SAST tool is not run on all commits -- score normalized to 1
npm/rolldown	1.2.15	Unknown	Unknown
npm/viem	2.57.7	Unknown	Unknown
npm/vite	8.3.5	🟢 6.6	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 6 Found 16/24 approved changesets -- score normalized to 6 Token-Permissions 🟢 7 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts ⚠️ 1 binaries present in source code Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits
npm/vitest	5.0.5	Unknown	Unknown
npm/@opentelemetry/api	~1.9.1	Unknown	Unknown
npm/@asamuzakjp/dom-selector	10.0.4	Unknown	Unknown
npm/@vitest/coverage-v8	5.0.5	Unknown	Unknown
npm/@vitest/mocker	5.0.5	Unknown	Unknown
npm/@vitest/spy	5.0.5	Unknown	Unknown
npm/jsdom	30.1.3	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 Found 10/30 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/postcss	8.5.31	🟢 7.4	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 2 Found 7/30 approved changesets -- score normalized to 2 Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 1 SAST tool is not run on all commits -- score normalized to 1
npm/react	19.3.1	Unknown	Unknown
npm/react-dom	19.3.1	Unknown	Unknown
npm/vitest	5.0.5	Unknown	Unknown
npm/@anthropic-ai/sdk	0.135.0	Unknown	Unknown
npm/@opentelemetry/api	1.9.1	🟢 7.3	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 1 9 existing vulnerabilities detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations
npm/@langchain/core	1.2.20	Unknown	Unknown
npm/langsmith	0.11.0	Unknown	Unknown
npm/@langchain/core	^1.2.20	Unknown	Unknown
npm/react	19.3.1	Unknown	Unknown
npm/react-dom	19.3.1	Unknown	Unknown
npm/@ai-sdk/gateway	4.0.120	Unknown	Unknown
npm/@ai-sdk/openai	4.0.98	Unknown	Unknown
npm/@ai-sdk/provider	4.0.31	Unknown	Unknown
npm/@ai-sdk/provider-utils	5.0.64	Unknown	Unknown
npm/ai	7.0.147	Unknown	Unknown
npm/jose	6.2.13	🟢 7.5	Details Check Score Reason Code-Review ⚠️ 0 Found 0/26 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 4 3 out of the last 5 releases have a total of 3 signed artifacts. SAST 🟢 10 SAST tool is run on all commits
npm/@anthropic-ai/sdk	0.136.0	Unknown	Unknown
npm/@opentelemetry/api	1.10.0	🟢 7.3	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 1 9 existing vulnerabilities detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations
npm/@langchain/core	1.2.20	Unknown	Unknown
npm/langsmith	0.11.1	Unknown	Unknown
npm/@axe-core/playwright	4.14.0	🟢 6.6	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST ⚠️ -1 internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/axe-core	4.14.0	🟢 7.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches SAST ⚠️ -1 internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
npm/playwright	1.64.1	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10 Code-Review 🟢 9 GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9 CII-Best-Practices ⚠️ 0 no badge detected Vulnerabilities 🟢 10 no vulnerabilities detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 no published package detected Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Binary-Artifacts 🟢 6 binaries present in source code Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches
npm/playwright-core	1.64.1	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) out of 30 and 6 issue activity out of 30 found in the last 90 days -- score normalized to 10 Code-Review 🟢 9 GitHub code reviews found for 29 commits out of the last 30 -- score normalized to 9 CII-Best-Practices ⚠️ 0 no badge detected Vulnerabilities 🟢 10 no vulnerabilities detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 no published package detected Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Binary-Artifacts 🟢 6 binaries present in source code Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches
pip/grantex	>= 0.7.2,< 1	Unknown	Unknown
pip/strands-agents	>= 1.61.1	Unknown	Unknown
npm/@modelcontextprotocol/ext-tasks	0.2.2	Unknown	Unknown
npm/@strands-agents/sdk	1.21.0	Unknown	Unknown
npm/@ai-sdk/gateway	4.0.120	Unknown	Unknown
npm/@ai-sdk/provider	4.0.31	Unknown	Unknown
npm/@ai-sdk/provider-utils	5.0.64	Unknown	Unknown
npm/ai	7.0.147	Unknown	Unknown
npm/jose	6.2.13	🟢 7.5	Details Check Score Reason Code-Review ⚠️ 0 Found 0/26 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases 🟢 4 3 out of the last 5 releases have a total of 3 signed artifacts. SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/vvaharness.yml
• apps/auth-service/package-lock.json
• apps/auth-service/package.json
• apps/portal/package-lock.json
• examples/anthropic-tool-use/package-lock.json
• examples/langchain-agent/package-lock.json
• examples/langchain-agent/package.json
• examples/nextjs-starter/package-lock.json
• examples/vercel-ai-chatbot/package-lock.json
• examples/x402-agent-demo/package-lock.json
• packages/anthropic/package-lock.json
• packages/langchain/package-lock.json
• packages/mcp-auth/package-lock.json
• packages/strands-py/pyproject.toml
• packages/strands/package-lock.json
• packages/vercel-ai/package-lock.json
• packages/x402/package-lock.json

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5e56a0489

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate the examples' verification changes behind a default-off flag

Both existing examples now unconditionally derive their verification trust anchor from GRANTEX_URL and verify the exchanged token before proceeding; previously their tools used the adapter's default JWKS endpoint. This changes existing execution paths without an opt-in flag. AGENTS.md explicitly requires every behavior change on an existing path to ship behind a default-off flag, or a deliberate default flip to have a breaking-change changelog entry and explicit opt-out. Gate the new verification behavior consistently in both examples, or document the default flip with the required opt-out; the current “Fixed” entries provide neither.

AGENTS.md reference: AGENTS.md:L64-L66

Useful? React with 👍 / 👎.