[irparent]

What this changes

Three CI changes. None touches what Iris ships.

The Electron job keeps its download. "MCPB bundle in Electron's Node" installs Electron, whose install downloads the binary from GitHub's release servers on every run. On main at 35b8651d, that download answered 503 and failed the job with nothing wrong in the bundle (run 37156476684).

• The binary is now kept in an actions/cache entry per Electron version and OS, through electron_config_cache (the variable Electron's installation docs name).
• The install is tried three times, waiting 20 s and then 40 s between tries.

The keyed judge run gets 45 minutes. proof-judge.yml makes about 440 judge calls one after another, plus the citation fetches, and 20 minutes left no margin. This change sat on an unmerged branch since 2026-09-26. The branch is deleted once this merges.

The real MCP clients CI drives are current. Claude Code moves from 2.1.282 to 2.1.289 and Gemini CLI from 0.61.0 to 0.62.0. The lockfile was regenerated on Linux in node:24, so it carries every platform's optional packages. Dependabot's update of this folder on 2026-10-01 failed when GitHub refused to open its pull request ("The request contains invalid or unauthorized changes"); this does by hand what that update would have done.

Dependabot proposes only what can land.

• The dashboard ignores TypeScript 7. Its lint, typescript-eslint, admits typescript <6.1.0, so npm ci refuses 7. Without this rule Dependabot re-proposed it every week (deps(dashboard): Bump typescript from 6.0.3 to 7.0.2 in /dashboard #635).
• The root ignores better-sqlite3 13. No 13.x release publishes Windows prebuilt binaries (none through 13.0.3), so a Windows install would compile it from source (deps: Bump better-sqlite3 from 12.11.1 to 13.0.3 #308).
• The TypeScript ceiling for the root, the SDK and the LangChain handler moves from 6.0 to 6.1. typescript-eslint now admits 6.0, so Dependabot can propose that upgrade (Upgrade root TypeScript to v6 when @typescript-eslint supports it #58) through the usual checks.

Every rule carries its reason and the date it was checked.

Checks

• actionlint passes on both workflows.
• The real-client jobs passed on all three operating systems against the new versions, and the Electron job passed on macOS and Windows with the cache and retries in place (first run of this PR).
• tests/release-workflow-consistency.test.ts holds the Electron step: the exact-version install, and a new test for the cache per version and OS and the three attempts. Removing the cache fails it.
• The truthbase was captured with this change: 4,772 of 4,772 root tests pass, with nothing skipped. Every claims, schema, proof and version check exits 0.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
website	Ignored	Preview	Oct 4, 2026 8:26am UTC

[github-actions]

Iris gate — 1 of 2 tripped --fail-on detector_veto

iris-eval ingest: 3 stored, 1 tripped --fail-on detector_veto (2 of 3 evaluated in dataset "release-gate")

Trace	Verdict	Basis	Rules, classes or missing inputs	Evidence
a6708efa58a5d258c507b48edf485a76	failed	detector_veto + risk_over_loss	no_pii, pii_leak, credential_leak	no_pii: AWS Access Key (output 45–65)

Verdict basis	Traces
detector_veto	2
clean	1

Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean}

[github-actions]

Iris gate — 1 stored, nothing tripped --fail-on any

iris-eval ingest: 1 stored, 0 tripped --fail-on any

Verdict basis	Traces
clean	1

Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean}