[mrbobbytables]

Summary

Address the two P1 regression-testing gaps identified in the recent issue/PR
review:

• Compile the MDX security corpus through Docusaurus's actual compileToJSX
  pipeline, using the normalized site Markdown configuration and the docs
  plugin's defaults/configured options. Inspect the resulting JavaScript AST
  independently with the existing SWC dependency; never evaluate rejected MDX.
• Import the default Stryker configuration in fresh Node processes for local,
  pull_request, merge_group, schedule, and workflow_dispatch contexts.
  Assert the effective exported threshold, not merely the helper's return value.
• Declare the already-locked Docusaurus compiler and docs plugin as direct test
  dependencies at 3.10.2, and remove the obsolete knip exemption for the now-used
  docs plugin. The lockfile changes only in the two root dependency entries.
• Add a dated clarification to ADR 0007: integration boundaries outside the
  configured mutation run may use reproducible or historical regression evidence,
  while mutation-covered assertion gaps still require surviving-mutant evidence.

Production behavior protected

Without these tests, the publish gate could regress to scanning raw source while
Docusaurus turns mismatched fences, encoded URLs, or apparent GFM code into live
links/images. The corpus demonstrates those effects in the real compiler and
asserts rejection by scripts/lib/mdx-active-content.mjs. Positive cases preserve
valid links, admonitions, inline code, and fenced YAML.

The current site's future.v4 settings disable legacy heading/admonition
compatibility rewrites. The legacy composed-bypass case explicitly enables that
compatibility profile; this PR does not claim legacy title syntax is an active
bypass under the current configuration or change that configuration.

The Actions cases protect stryker.config.mjs from incorrect event-to-threshold
wiring that pure breakThreshold() tests would miss. Related prior fixes:
#1741 and #1744.

No production logic, workflows, thresholds, or browser fixtures are changed.

ADR clarification

The addendum preserves ADR 0007's original decision and browser restrictions.
Findings using integration-boundary evidence must name the production failure,
explain why the mutation run does not exercise it, and test the actual consumer
or exported configuration. It does not permit test-tree guards, data-shape browser
fixtures, or coverage-floor changes.

Validation

• 83 focused cases pass, including 14 new regressions, with ambient
  GITHUB_EVENT_NAME=merge_group.
• Temporary negative controls produced three expected failures each for incorrect
  event wiring and a raw-source-only security scan. Both production files were
  fully restored before validation.
• npm run test:unit:coverage:check: 3,010 tests pass; source lines/regions remain
  100%/100%, and the harness coverage gate passes.
• All six lint gates, npm run check:audit, and npm run build:production pass.
• Local validation used Node 26.11.1; CI retains the repository's Node 22 runtime.
• The follow-up ADR addendum passes targeted Prettier, Markdownlint, and CSpell
  checks; it changes no executable code.

Prepared with the maintainer's approval of the focused regression-only design
and the dated ADR clarification. Leave unmerged pending maintainer review.

[hivecommons-hive]

9b75f5e

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head 9b75f5e26e46) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[netlify]

✅ Deploy Preview for endusers ready!

Name	Link
🔨 Latest commit	980631f
🔍 Latest deploy log	https://app.netlify.com/projects/endusers/deploys/6ad8e9c99ae397b3b48dd427
😎 Deploy Preview	https://deploy-preview-1753--endusers.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

Read the tree at the PR head, not just the diff. This looks correct to me.

Verified:

• stryker.config.mjs:71 sets thresholds.break: breakThreshold(process.env.GITHUB_EVENT_NAME), so the new subprocess tests in tests/stryker-config.test.mjs genuinely exercise the env→exported-config wiring that the existing pure breakThreshold() tests (lines 40–53) cannot — the exact gap #1741/#1744 were about. Expected values (83 for local/pull_request, null otherwise) match breakThreshold at stryker.config.mjs:41-43.
• The compiler-integration reasons asserted by the new corpus exist in the gate: disallowed URL scheme at scripts/lib/mdx-active-content.mjs:248 and disallowed element <…> at :265. Rejected MDX is compiled via compileToJSX and inspected with SWC's parseSync only — never evaluated.
• Site config claims hold: the classic preset with docs options is at docusaurus.config.js:356-365, and future flags at :161 back the body's statement that the legacy-compat case opts in explicitly rather than claiming it is live today.
• Dependency changes are consistent: @docusaurus/mdx-loader and @docusaurus/plugin-content-docs pinned at 3.10.2 (already the locked transitive version), and the now-direct dependency makes removing the knip exemption in knip.config.js correct rather than cosmetic.

No production logic changes; diff matches the body's description. The author asks that it be left unmerged pending maintainer review, so flagging for a maintainer to make the landing call — nothing here blocks it from my read.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

980631f

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head 980631f3faf2) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.