Fix Node 24 macOS test flake and harden CI

[konard]

Fixes #65

Summary

• avoid the Node 24 macOS test-runner IPC deserialization failure by disabling child-process test isolation on supported runtimes, while preserving the Node 20 fallback
• replace workflow-wide cancellation with bounded job-scoped concurrency, including a shared non-cancellable group for release/deployment writers
• eliminate checkout/npm warnings, unsafe PR expression interpolation, and the unsupported Codecov v6 file input
• pin mypy below 2.0 while Python 3.9 remains supported, and format the README examples required by current Ruff
• expand the CI policy checker and regression tests so timeouts, cancellation semantics, warning-free installs, Codecov inputs, and untrusted shell expressions remain enforced

Root cause and reproduction

The failing main-branch run (30708515947) failed only on macOS arm64 under Node 24.18.0. Node's test runner attempted to deserialize a child-process test result and raised:

Error: Unable to deserialize cloned data due to invalid or unsupported version.

The regression test asserts that Node 24 receives --test-isolation=none and that the package's Node 20 minimum retains its compatible argument set. The full Node 24 unit suite passed 10 consecutive runs after the fix.

The repository-wide workflow audit also reproduced 50 policy violations before hardening, plus two semantic errors detected by actionlint: direct interpolation of github.head_ref into shell and Codecov v6's removed singular file input.

Validation

• npm run check
• npm test — 488 passing
• npm run test:coverage
• Node 24.18.0 full unit suite — 10 consecutive passing runs
• ruff check . and ruff format --check .
• mypy src
• pytest tests/ -v --cov=src — 251 passing, 53.51% coverage
• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features
• cargo test --all-features --verbose and cargo test --doc --verbose
• cargo build --release --verbose and cargo package --list
• JavaScript and Rust documentation generation
• CI policy checker, changeset validation, YAML parsing, and actionlint 1.7.12

Template audit

Compared the repository trees and workflow implementations with the current JavaScript, Python, and Rust AI-driven development pipeline templates and reviewed the CI/CD best-practices guide. The Python template has the same unbounded mypy dependency while targeting Python 3.9; reported upstream as link-foundation/python-ai-driven-development-pipeline-template#44.

This is CI/tooling-only work, so no visual before/after screenshots apply.

[konard]

Working session summary

Implemented and finalized PR #67, now ready for review.

Key fixes:

• Resolved the Node 24 macOS test-runner deserialization failure.
• Added regression coverage and verified 10 consecutive Node 24 runs.
• Hardened CI concurrency, timeouts, cancellation, installs, Codecov configuration, and shell-expression safety.
• Kept Python 3.9 type checking warning-free with a compatible mypy constraint.
• Expanded automated CI policy enforcement.

Validation passed:

• JavaScript: 488 tests
• Python: 251 tests, 53.51% coverage
• Rust: formatting, Clippy, tests, docs, release build, and packaging
• All five fresh GitHub Actions workflows passed for final SHA bf9dd0a
• Working tree is clean and synchronized

The matching Python template issue was reported upstream as template issue #44.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $15.673980

📊 Context and tokens usage:

• 403.0K / 200K (202%) input tokens, 35.0K / 128K (27%) output tokens

Total: (403.0K + 10.1M cached) input tokens, 35.0K output tokens, $15.673980 cost

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $15.673980

📊 Context and tokens usage:

• 403.0K / 200K (202%) input tokens, 35.0K / 128K (27%) output tokens

Total: (403.0K + 10.1M cached) input tokens, 35.0K output tokens, $15.673980 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: medium (~15999 tokens)
• Model: GPT 5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (4713KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag