Generate CHECKS.md

.codacy.yaml

@@ -8,7 +8,7 @@
 #   the same reason). Workflows + composite actions are already linted by actionlint, zizmor, action-validator, the
 #   ast-grep gha rules, and the gha* conftest policies; since Codacy cannot disable an individual pattern in-repo,
 #   excluding these trees is the only way to silence its pin rule globally.
-# - CLAUDE.md: Codacy's prose rules (undefined-acronym, absolute-rule-without-escape-hatch) fight this
+# - AGENTS.md: Codacy's prose rules (undefined-acronym, absolute-rule-without-escape-hatch) fight this
 #   agent-instructions doc, which is imperative and full of deliberate absolutes ("NEVER ...", "ALWAYS ...") by
 #   design; dprint + typos + editorconfig already lint it, so Codacy adds only false positives here.
 # - services/ws-web-runner/mingw-shim/msvc_crt_alloc.c: MISRA-21.3-unavoidable heap-allocation code Codacy cannot
@@ -42,7 +42,7 @@
 exclude_paths:
   - ".github/actions/**"
   - ".github/workflows/**"
-  - "CLAUDE.md"
+  - "AGENTS.md"
   - "config/semgrep/**"
   - "services/ws-modules/dotnet-data1/Program.cs"
   - "libs/wasi-guest/src/coverage.rs"

.dockerignore

@@ -59,6 +59,8 @@ services/ws-server/storage/
 # whatever the machine that ran it happened to resolve. One rule here rather than a `.gitignore` generated into
 # each scenario, so a scenario added later is covered without anything having to be written into it.
 verification/**/*.lock
+# The npm dependency graphs `mise lock` records beside that lockfile, a by-product for the same reason.
+verification/**/.mise/locks/
 # No rule for the per-scenario credential file, deliberately.
 # Under verification/ it is committed like every other generated artifact: the password is derived from an
 # input this repository already carries, so the file reproduces from public material rather than keeping a

.github/actions/free-disk-space/action.yaml

@@ -18,8 +18,8 @@ runs:
     # is killed outright on exhaustion, reporting a shutdown signal rather than any build error. Root has the room:
     # it shows 119G free on the arm runner once the step above has run.
     - name: Add swap
-      uses: ./.github/actions/add-swap
+      uses: $/.github/actions/add-swap
 
     - name: Free disk space on Windows
       if: runner.os == 'Windows'
-      uses: ./.github/actions/free-disk-space-windows
+      uses: $/.github/actions/free-disk-space-windows

.github/actions/install-mise-tools/action.yaml

@@ -41,7 +41,7 @@ runs:
   steps:
     # Reclaim runner disk before anything is installed into it.
     - name: Free disk space
-      uses: ./.github/actions/free-disk-space
+      uses: $/.github/actions/free-disk-space
 
     # No cargo: tool installs on the Windows lane right now -- cargo-binstall fails to execute there (os error 193).
     # open-o2's opener isn't needed in CI, so skip cargo:open rather than let the install fail.
@@ -51,7 +51,7 @@ runs:
       run: echo "MISE_DISABLE_TOOLS=cargo:open" >> "$GITHUB_ENV"
 
     - name: Install mise binary
-      uses: ./.github/actions/install-mise
+      uses: $/.github/actions/install-mise
       with:
         install-action-tools: ${{ inputs.install-action-tools }}
 
@@ -121,7 +121,7 @@ runs:
     # died on a frippery.org (http:busybox) connect timeout.
     - name: Remove mise shim before the retry
       if: steps.install-mise-tools.outcome == 'failure'
-      uses: ./.github/actions/remove-mise-shim
+      uses: $/.github/actions/remove-mise-shim
 
     - name: Install mise tools (retry)
       if: steps.install-mise-tools.outcome == 'failure'
@@ -133,4 +133,4 @@ runs:
         mise install
 
     - name: Remove mise shim
-      uses: ./.github/actions/remove-mise-shim
+      uses: $/.github/actions/remove-mise-shim

.github/actions/install-mise/action.yaml

@@ -22,7 +22,7 @@ runs:
     - name: Install mise
       uses: taiki-e/install-action@v2
       with:
-        tool: cargo-binstall,mise@2026.9.0
+        tool: cargo-binstall,mise@2026.9.17
 
     - name: Install extra tools via install-action
       if: inputs.install-action-tools != ''

.github/workflows/check.yaml

@@ -35,7 +35,7 @@ jobs:
           - os: ubuntu-latest
             timeout: 40
           - os: macos-latest
-            timeout: 45
+            timeout: 75
           - os: windows-latest
             timeout: 120
     # Windows runs the checkers under busybox-w32 ash, same as test.yaml's Windows lane.
@@ -59,7 +59,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise + tools
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: 60
 
       - name: Prefetch Rust dependencies

.github/workflows/codeql.yaml

@@ -73,7 +73,7 @@ jobs:
 
       - name: Install mise + tools
         if: matrix.language == 'rust'
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: 60
 
       - name: Prefetch Rust dependencies

.github/workflows/coverage.yaml

@@ -65,10 +65,10 @@ jobs:
 
       - name: Install Mesa Vulkan drivers (lavapipe)
         if: runner.os == 'Linux'
-        uses: ./.github/actions/install-lavapipe
+        uses: $/.github/actions/install-lavapipe
 
       - name: Install mise + coverage tools
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: 20
         with:
           install-action-tools: cargo-llvm-cov,deepsource

.github/workflows/dependencies.yaml

@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise + dependency-scan tools
-        uses: ./.github/actions/install-mise
+        uses: $/.github/actions/install-mise
         with:
           install-action-tools: cargo-deny,cargo-unmaintained,coreutils,jaq,osv-scanner,ripgrep
 

.github/workflows/docker-windows.yaml

@@ -50,7 +50,7 @@ jobs:
       # The classic Windows builder on windows-2022 can't substitute build-args into the Dockerfile's RUN, and
       # mise's prebuilt "latest" zip is stale (2026.3.0, too old for the config). 2026.7.1 is required: the config
       # templates use Tera v2 syntax, which mise switched to in 2026.7.1 (older mise fails to parse them).
-      MISE_VERSION: "2026.9.0"
+      MISE_VERSION: "2026.9.17"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -75,7 +75,7 @@ jobs:
       # does -- it only runs `docker build` and `docker run`. check.yaml and test.yaml share this action and
       # leave both off, because test.yaml's `override (msvc)` lane does link natively against them.
       - name: Free disk space on Windows runner
-        uses: ./.github/actions/free-disk-space-windows
+        uses: $/.github/actions/free-disk-space-windows
         with:
           keep-image: mcr.microsoft.com/windows/${{ matrix.base }}:${{ matrix.windows_version }}
           visual-studio: "true"

.github/workflows/k3s.yaml

@@ -74,7 +74,7 @@ jobs:
         run: echo "MISE_ENV=$MISE_ENV"
 
       - name: Install mise + tools
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: 60
         with:
           github-token: ${{ github.token }}
@@ -142,7 +142,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise + tools
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: 60
         with:
           github-token: ${{ github.token }}
@@ -181,7 +181,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise + tools
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: 60
         with:
           github-token: ${{ github.token }}

.github/workflows/test.yaml

@@ -120,7 +120,7 @@ jobs:
 
       - name: Install Mesa Vulkan drivers (lavapipe)
         if: runner.os == 'Linux'
-        uses: ./.github/actions/install-lavapipe
+        uses: $/.github/actions/install-lavapipe
 
       # Windows tools source-build under mise 2026.7.1, so this step runs long (bumped from 20).
       # The per-tool msvc `install_env` override no longer reaches cargo-binstall there, so cargo tools like
@@ -137,7 +137,7 @@ jobs:
       # on commit https://github.com/edge-toolkit/core/commit/5d7dfaa10c0d10e980aa7a4a785476be059699fb at
       # https://github.com/edge-toolkit/core/actions/runs/36812561314/job/110210608554.
       - name: Install mise + tools
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: ${{ matrix.install_timeout || 60 }}
         env:
           ET_LINK_WITH_MOLD: "false"
@@ -216,7 +216,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise + tools
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         timeout-minutes: 60
 
       - name: Prefetch dependencies
@@ -299,7 +299,7 @@ jobs:
       # reason for one) -- busybox-w32 is an x64 exe, and this job's single task chain is far too short for the
       # Git Bash cygheap pathology that override exists to dodge.
       - name: Install mise
-        uses: ./.github/actions/install-mise
+        uses: $/.github/actions/install-mise
 
       # Both toolchains the Windows [[tools.rust]] entries name, resolved at the arm64 host triple.
       # python is here because a workspace build reaches et-ws-pyo3-runner, whose pyo3-ffi build script runs
@@ -347,7 +347,7 @@ jobs:
 
       # install-mise-tools ends with this, but this job deliberately does not use it, so it clears its own.
       - name: Remove mise shim
-        uses: ./.github/actions/remove-mise-shim
+        uses: $/.github/actions/remove-mise-shim
 
       # A build, not a check: codegen and linking are where a new host triple actually fails.
       # The ceiling allows for the macos-26-intel runners' pace, which swings by more than two to one between

.github/workflows/upstream-cache.yaml

@@ -153,7 +153,7 @@ jobs:
         if: |-
           steps.rp_check.outputs.work == 'yes'
           && github.event.pull_request.head.repo.fork != true
-        uses: ./.github/actions/install-mise-tools
+        uses: $/.github/actions/install-mise-tools
         with:
           github-token: ${{ github.token }}
 

.gitignore

@@ -55,6 +55,8 @@ services/ws-server/storage/
 # whatever the machine that ran it happened to resolve. One rule here rather than a `.gitignore` generated into
 # each scenario, so a scenario added later is covered without anything having to be written into it.
 verification/**/*.lock
+# The npm dependency graphs `mise lock` records beside that lockfile, a by-product for the same reason.
+verification/**/.mise/locks/
 # No rule for the per-scenario credential file, deliberately.
 # Under verification/ it is committed like every other generated artifact: the password is derived from an
 # input this repository already carries, so the file reproduces from public material rather than keeping a

.mise/config.coverage.toml

@@ -397,12 +397,12 @@ description = "Combined Python coverage (pytest + web-runner Pyodide runs) -> Co
 # schema that records each test's file, which Codecov's test analytics reads.
 run = """
 pycov=target/pycov
-mkdir -p "$pycov"
+coreutils mkdir -p "$pycov"
 for module in pyface1 pydemo1 pyeye1 pyspeech1; do
   dir="services/ws-modules/$module"
   junit="$PWD/$pycov/junit-$module.xml"
   uv run --directory "$dir" pytest --cov="$module" --cov-report= --junitxml="$junit" -o junit_family=legacy
-  cp "$dir/.coverage" "$pycov/.coverage.${module}_pytest"
+  coreutils cp "$dir/.coverage" "$pycov/.coverage.${module}_pytest"
 done
 pyface=services/ws-modules/pyface1
 uv run --project "$pyface" coverage combine "$pycov"

.mise/config.dart.toml

@@ -26,7 +26,8 @@ version_expr = '''
 fromJSON(body).prefixes
 | filter({ # matches "^channels/stable/release/(\\d+\\.\\d+\\.\\d+)/$" })
 | map({split(#, "/")[3]})
-| sortVersions()'''
+| sortVersions()
+'''
 version_list_url = "{{ vars.dart_bucket }}?prefix=channels/stable/release/&delimiter=/"
 
 [tasks.dart-pub-get]
@@ -102,7 +103,7 @@ shell = "{{ vars.task_shell }}"
 depends = ["gen:ws-spec"]
 description = "Emit the Dart sealed-class WS client via dart-typegen (consumes generated/specs/ws.kdl from gen:ws-spec)"
 run = """
-mkdir -p generated/dart-ws/lib
+coreutils mkdir -p generated/dart-ws/lib
 dart-typegen generate -i generated/specs/ws.kdl -o generated/dart-ws/lib/ws_messages.dart
 dart format generated/dart-ws/lib/ws_messages.dart
 """
@@ -130,7 +131,7 @@ dart pub get
 coreutils rm -rf lib
 dart run swagger_parser
 s=../../target/scratch
-mkdir -p "$s"
+coreutils mkdir -p "$s"
 goawk 'BEGIN { q = sprintf("%c", 39) }
 /^import / && /dart:io/ { print "import " q "dart:typed_data" q ";"; io++; next }
 /^  Future<void> getFile\\(\\{$/ {

.mise/config.dotnet.toml

@@ -48,7 +48,7 @@ fi
 dotnet publish -c Release $$publish_args
 
 PUBLISH=bin/Release/net10.0/publish/wwwroot/_framework
-cp "$$PUBLISH"/*.js "$$PUBLISH"/*.wasm "$$PUBLISH"/*.dat pkg/
+coreutils cp "$$PUBLISH"/*.js "$$PUBLISH"/*.wasm "$$PUBLISH"/*.dat pkg/
 '''
 
 [tasks.dotnet-fmt]

.mise/config.java.toml

@@ -36,7 +36,8 @@ java_home = '''{% if os() == "windows" and env?.MISE_INSTALLS_DIR -%}
 {%- else -%}
 {{- env?.MISE_DATA_DIR or (env.HOME ~ "/.local/share/mise") -}}
 /installs/java/26.0.1
-{%- endif %}'''
+{%- endif -%}
+'''
 
 [env]
 # JAVA_HOME must be set in the env because mvn.cmd requires it.
@@ -65,7 +66,8 @@ MVN = '''{% if os() == "windows" -%}
 {{- vars.maven_bin -}}\mvn.cmd
 {%- else -%}
 mvn
-{%- endif %}'''
+{%- endif -%}
+'''
 
 [tasks.build-ws-java-data1-module]
 description = "Build the java-data1 workflow module"

.mise/config.js.toml

@@ -26,7 +26,7 @@
 # release assets, distributing per-platform binaries via `@oxlint-tsgolint/<triple>` optional deps, so every OS
 # is covered without os-scoping.
 "npm:oxlint-tsgolint" = "0.24.0"
-"npm:pnpm" = { version = "latest", os = ["macos/x64"] }
+"npm:pnpm" = { version = "11", os = ["macos/x64"] }
 
 # oxlint + oxfmt are the Rust-native JS/TS linter + formatter from the oxc-project.
 # They are pulled directly from the shared `apps_v<tag>` GitHub release. Aqua's registry entry trips mise's
@@ -50,24 +50,25 @@ url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/ox
 url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxlint-x86_64-pc-windows-msvc.zip"
 
 # oxfmt is pinned independently of oxlint.
-# Both ship from per-version `apps_v` tags but track separate semver. oxfmt stays on apps_v1.69.0 / 0.54.0: its
-# output is tuned against dprint (config/oxfmtrc.jsonc + config/dprint.jsonc) at that version, and a bump risks
-# reformatting churn that fights dprint. oxlint above rode ahead to 1.73.0 for the `--type-aware` engine. Re-pin
-# oxfmt here only after re-validating the oxfmt <-> dprint agreement at the new version.
+# Both ship from per-version `apps_v` tags but track separate semver, and `version` names the tag, as mise holds
+# it to the version in the URL. oxfmt stays on apps_v1.69.0, which ships oxfmt 0.54.0: its output is tuned against
+# dprint (config/oxfmtrc.jsonc + config/dprint.jsonc) at that version, and a bump risks reformatting churn that
+# fights dprint. oxlint above rode ahead to 1.73.0 for the `--type-aware` engine. Re-pin oxfmt here only after
+# re-validating the oxfmt <-> dprint agreement at the new version.
 [tools."http:oxfmt"]
 bin = "oxfmt"
 rename_exe = "oxfmt"
-version = "0.54.0"
+version = "1.69.0"
 [tools."http:oxfmt".platforms.linux-arm64]
-url = "https://github.com/oxc-project/oxc/releases/download/apps_v1.69.0/oxfmt-aarch64-unknown-linux-gnu.tar.gz"
+url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxfmt-aarch64-unknown-linux-gnu.tar.gz"
 [tools."http:oxfmt".platforms.linux-x64]
-url = "https://github.com/oxc-project/oxc/releases/download/apps_v1.69.0/oxfmt-x86_64-unknown-linux-gnu.tar.gz"
+url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxfmt-x86_64-unknown-linux-gnu.tar.gz"
 [tools."http:oxfmt".platforms.macos-arm64]
-url = "https://github.com/oxc-project/oxc/releases/download/apps_v1.69.0/oxfmt-aarch64-apple-darwin.tar.gz"
+url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxfmt-aarch64-apple-darwin.tar.gz"
 [tools."http:oxfmt".platforms.macos-x64]
-url = "https://github.com/oxc-project/oxc/releases/download/apps_v1.69.0/oxfmt-x86_64-apple-darwin.tar.gz"
+url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxfmt-x86_64-apple-darwin.tar.gz"
 [tools."http:oxfmt".platforms.windows-x64]
-url = "https://github.com/oxc-project/oxc/releases/download/apps_v1.69.0/oxfmt-x86_64-pc-windows-msvc.zip"
+url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxfmt-x86_64-pc-windows-msvc.zip"
 
 [tasks.build-ws-har1-module]
 depends = ["build-et-cli", "build-wasm-cov-wrapper"]

.mise/config.kotlin.toml

@@ -23,7 +23,8 @@ GRADLE = '''{% if os() == "windows" -%}
 {{- vars.gradle_bin -}}\gradle.bat
 {%- else -%}
 gradle
-{%- endif %}'''
+{%- endif -%}
+'''
 
 [tasks.build-ws-kotlin-data1-module]
 description = "Build the kotlin-data1 workflow module (Kotlin/Wasm -> WasmGC)"

.mise/config.linux.toml

@@ -8,7 +8,7 @@
 # has libclang-cpp (the C++ API), not the C one.
 "conda:clangxx" = "latest"
 # gpg for mise's gpg_verify signature checks; _setup_all installs it up front.
-"conda:gnupg" = "latest"
+"conda:gnupg" = { version = "latest", os = ["linux"] }
 # mold, the linker a Linux lane that sets ET_LINK_WITH_MOLD links Rust with.
 "aqua:rui314/mold" = "latest"
 
@@ -56,7 +56,7 @@
 # mise can't render. a_conda_arch: conda's target-triple dir (x86_64/aarch64 vs mise's x64/arm64).
 a_conda_arch = "{% if arch() == 'arm64' %}aarch64{% else %}x86_64{% endif %}"
 a_conda_clangxx = "{{ env.HOME }}/.local/share/mise/installs/conda-clangxx/latest"
-b_clang_resource = "{{ vars.a_conda_clangxx }}/lib/clang/22"
+b_clang_resource = "{{ vars.a_conda_clangxx }}/lib/clang/23"
 b_clang_sysroot = "{{ vars.a_conda_clangxx }}/{{ vars.a_conda_arch }}-conda-linux-gnu/sysroot"
 # Link through mold rather than the system linker, for a lane that sets ET_LINK_WITH_MOLD=true.
 # On aarch64 the system linker is GNU ld -- rustc only defaults to its bundled lld on x86_64 -- and linking the
@@ -108,7 +108,7 @@ description = "Preinstall: shared base + verify system build prerequisites"
 run = """
 # Some third-party install scripts hard-code bare `awk`.
 # dotnet-install.sh notably, invoked by the `dotnet` mise tool below, does this. Repo policy is goawk-only
-# (CLAUDE.md "Don't depend on host tools"); fedora/ubuntu/debian base images happen to ship awk pre-installed
+# (AGENTS.md "Don't depend on host tools"); fedora/ubuntu/debian base images happen to ship awk pre-installed
 # so this is a no-op there, but Azure Linux's base/core is more minimal and ships without awk. Provide one as
 # a symlink to mise's goawk so policy holds (the only awk binary on the system IS goawk) and the third-party
 # script finds something on PATH. goawk is installed in `_setup_all` (config.toml) before this task body

.mise/config.macos.toml

@@ -4,7 +4,7 @@
 
 [tools]
 # gpg for mise's gpg_verify signature checks; _setup_all installs it up front.
-"conda:gnupg" = "latest"
+"conda:gnupg" = { version = "latest", os = ["macos"] }
 
 [vars]
 # Xcode's libclang (the lib dir beside `xcrun`'s clang).