chore(deps): lock undici 8.11.2 to clear production audit

[HomenShum]

What changes

package-lock.json only (6 lines, 2 entries; package.json untouched because undici ^8.10.0 already admits 8.11.2):

• top-level undici 8.10.0 -> 8.11.2 (advisory range 8.0.0-8.10.1)
• nested @ai-sdk/provider-utils undici 6.28.1 -> 6.29.0

Produced with npm update undici --package-lock-only --ignore-scripts.

Why

verify runs npm audit --omit=dev --audit-level=moderate first and fails on main today (e.g. banner PR #258, run https://github.com/HomenShum/NodeRoom/actions/runs/37674945194). Same remedy as the closed #257 (#257), without the package.json range bump.

Evidence (local, Node 22.22.2)

command	before (main 6f1af0f)	after
npm ci --ignore-scripts && npm audit --omit=dev --audit-level=moderate	exit 1	exit 0 (11 low remain, below gate)

Known blocker, not fixed here (why this is a draft)

After the audit step, npm run proofs:staleness fails: docs/eval/noderoom-fresh-user-vertical-proof.json is 40.8 days old (window 30d). No npm script regenerates it. Its own doc (docs/eval/NODEROOM_FRESH_USER_VERTICAL_PROOF.md) records a live run on https://noderoom.live through GitHub OAuth, a production Convex room, and a NodeAgent run on a free OpenRouter route, so a refresh needs a signed-in human session on prod. It was not hand-edited and no window, threshold or registry entry was touched. Resolving it means re-running that live proof or pulling the claim.

Gate check

Codex read-only review (codex exec -s read-only): VERDICT: APPROVED - "no gate, threshold, audit level, skip list, or expected test value was weakened"; only six lockfile fields changed (version/resolved/integrity of the two undici entries).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
noderoom	Ready	Preview	Oct 9, 2026 6:11pm UTC

[github-actions]

Scaffold Handoff — For Your Coding Agent

Your coding agent (Codex, Claude Code, etc.) should apply the accepted
scaffold proposals below. Do NOT touch any immutable files.

Immutability Check

Mode: advisory

✅ No immutable files were modified in this branch.

Changed Files

• docs/eval/OFFICIAL_BENCHMARK_READINESS.md
• docs/eval/OFFICIAL_BENCHMARK_TASK_COVERAGE.md
• docs/eval/OPENROUTER_CONVEX_BENCHMARK.md
• docs/eval/agent-improvement-loop.md
• docs/eval/agent-improvement-loop.svg
• docs/eval/agent-improvement-loop/20261009T181103Z.json
• docs/eval/agent-improvement-loop/latest.json
• docs/eval/agent-workspace-sandbox-smoke.json
• docs/eval/algorithm-artifact-smoke.json
• docs/eval/bankertoolbench-official-contract.json
• docs/eval/docker-sandbox-probe.json
• docs/eval/eval-runs.jsonl
• docs/eval/halo-convex-context-telemetry.json
• docs/eval/halo-self-improvement-smoke.json
• docs/eval/halo-variant-selection.json
• docs/eval/official-benchmark-readiness.json
• docs/eval/official-benchmark-task-coverage.json
• docs/eval/openrouter-convex-benchmark.json
• docs/eval/professional-catalog-proofs.json
• docs/eval/professional-proof-ledger.json
• docs/eval/spreadsheetbench-chart-visual-probe.json
• docs/eval/traces/credit/20261009T181112762Z-efbc73b4_dirty.83def14ff9f5ca7d/cascade-healthy.json
• docs/eval/traces/credit/20261009T181112762Z-efbc73b4_dirty.83def14ff9f5ca7d/delta-incomplete.json
• docs/eval/traces/credit/20261009T181112762Z-efbc73b4_dirty.83def14ff9f5ca7d/mapping-correct.json
• docs/eval/traces/credit/20261009T181112762Z-efbc73b4_dirty.83def14ff9f5ca7d/mapping-misbind.json
• docs/eval/traces/credit/20261009T181112762Z-efbc73b4_dirty.83def14ff9f5ca7d/summit-stressed.json
• docs/eval/traces/ladder/20261009T181112294Z-efbc73b4_dirty.b051f7df56870f38/ladder_L1_read_scripted.json
• docs/eval/traces/ladder/20261009T181112294Z-efbc73b4_dirty.b051f7df56870f38/ladder_L2_edit_scripted.json
• docs/eval/traces/ladder/20261009T181112294Z-efbc73b4_dirty.b051f7df56870f38/ladder_L3_conflict_scripted.json
• docs/eval/traces/ladder/20261009T181112294Z-efbc73b4_dirty.b051f7df56870f38/ladder_L4_blocked_scripted.json
• docs/eval/traces/ladder/20261009T181112294Z-efbc73b4_dirty.b051f7df56870f38/ladder_L5_large_range_scripted.json
• docs/eval/traces/ladder/20261009T181112294Z-efbc73b4_dirty.b051f7df56870f38/ladder_L6_long_horizon_scripted.json
• docs/eval/traces/ladder/20261009T181112294Z-efbc73b4_dirty.b051f7df56870f38/ladder_L7_resume_scripted.json
• package-lock.json

Needs Adversarial Review — Do NOT Apply Yet

These proposals passed the reject check but have not been approved by
an adversarial reviewer. A human or frozen LLM judge must approve them first.

• scaf-001 (AGENTS.md): Add explicit instruction for step spreadsheetbench-runner-fixture: Step spreadsheetbench-runner-fixture failed — scaffold may need explicit instruction or evidence assertion.
• scaf-002 (AGENTS.md): Add explicit instruction for step convex-boundaries: Step convex-boundaries failed — scaffold may need explicit instruction or evidence assertion.

Safety Boundary

Agent may improve the scaffold.
Agent may NOT weaken the proof gate.

Immutable files (never modify):

• scripts/proofloop.mjs
• scripts/agent-improvement-loop.ts
• tests/harnessChangeEval.test.ts
• .github/workflows/
• src/eval/evalTrustPolicy.ts
• src/eval/architectureBudget.ts
• evals/evalStore.ts

Scaffold files (safe to modify):

• AGENTS.md
• CLAUDE.md
• proofloop/scenarios/*.yaml
• proofloop/rubrics/*.yaml
• proofloop/subagents/*.md
• proofloop/adapters/*.js
• .proofloop/memory.jsonl
• src/nodeagent/models/prompts/systemPrompt.ts

[HomenShum]

Closing as a duplicate of #256 (Codex), which carries the same top-level undici change: ^8.10.0 to ^8.11.2 in package.json and node_modules/undici 8.10.0 to 8.11.2 in package-lock.json. Keeping one PR for that fix avoids two lockfile edits racing each other.

One difference, stated so it is not lost: this PR also moved the nested @ai-sdk/provider-utils/node_modules/undici from 6.28.1 to 6.29.0. The failing audit step on #258 (npm audit --omit=dev --audit-level=moderate, run 37674945194) flags only node_modules/undici at 8.0.0 - 8.10.1, so that nested bump is not needed to clear the gate. The branch claude/undici-audit is kept, so the nested bump can be proposed separately if wanted.

Shared blocker after #256 merges: npm run proofs:staleness, because docs/eval/noderoom-fresh-user-vertical-proof.json is more than 30 days old. Refreshing it needs a signed-in production proof run on https://noderoom.live by Homen. Neither this PR nor #256 can clear that.