diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 7d69f03a53..eca95b6356 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -76,26 +76,37 @@ This will install all the required dependencies and build output files to `dist/
## Modifying/Adding code
-Most of the SDK is generated code. Modifications to code will be persisted between generations, but may
-result in merge conflicts between manual patches and changes from the generator. The generator will never
+Most of the SDK is generated code. Never edit generated files by hand; change
+the authoritative generation inputs or compiler and regenerate instead. The generator will never
modify the contents of the `src/lib/` and `examples/` directories.
-## Custom-code budget
+
-The custom-code budget counts additions plus deletions in the remaining patch
-against verified generated output. `.castiron-ratchet.json` defines this repository's
-ceiling. CI uses the checker and budget on main, not the PR's proposed versions.
+## Generated-file ownership
-Budget changes must be in a separate PR modifying **only `.castiron-ratchet.json`**.
-Justify the current usage, proposed ceiling, and why fixing generation is not
-appropriate in the PR description. Increases require a **human approving review**
-and must merge before an SDK change relies on them. Agents may draft proposals,
-but must not approve increases or bypass the gate. Keep default CODEOWNERS.
-Lower the ceiling after cleanup while retaining headroom; decreases must still
-fit the measured usage.
+Do not edit generated SDK files by hand. Fix the API schema, generation
+configuration, or compiler and regenerate instead. Put SDK-specific behavior in
+separately owned handwritten helpers and extension points.
-See [custom-code technical details](../scripts/castiron/CUSTOM_CODE.md) for accounting,
-local checks, trusted CI, and activation instructions.
+Regeneration replaces generated files and removes retired generated paths.
+Handwritten edits to generated output are overwritten, not carried forward.
+Separately owned handwritten files are preserved. Resolve ownership conflicts
+explicitly before regeneration. Follow the ownership rules in `AGENTS.md`
+and review generated output and inventory changes together. Generated-file
+ownership currently relies on contributor guidance and code review, without a
+dedicated generated-file edit check or required gate. Fix violations in the
+generation inputs/compiler and regenerate; do not edit inventory hashes to
+accept a handwritten patch.
+
+### Transition on `next`
+
+This guidance is a prerequisite for regeneration, not the tooling-removal change.
+This `next` revision still contains the legacy budget/reporting workflows and
+`scripts/castiron/CUSTOM_CODE.md`, which documents their existing protocol.
+Canonical regeneration will remove them. Until then, preserve their security
+checks and inspect the repository's actual workflow settings and results; do not
+assume this documentation disables them or bypass a required check. Do not start
+new budget changes or add handwritten edits to generated output.
## Security requirements
@@ -318,19 +329,23 @@ requires GitHub Actions OIDC trusted publishing; local token-based publishing is
The table describes workflow execution and npm publication dependencies for changes targeting `main`
in `openai/openai-node`.
+It describes main after the tooling retirement. On this `next` revision, the
+legacy Castiron PR/merge-group and privileged publication workflow definitions
+also remain until canonical regeneration removes them; their hosted activation
+is controlled separately in repository settings.
Required merge checks are configured in repository rules. The `test matrix` check requires the Node.js
tests, benchmarks, credential-free ecosystem job, and Windows build to succeed.
-| Checks | PR | Merge queue | Push to `main` | Release PR | npm publication |
-| ------------------------------------------------------------------- | -------------- | ------------- | ----------------- | -------------- | ------------------------------------------- |
-| CI lint, build, Node.js tests, packed-package tests, benchmarks | Runs¹ | Runs | Runs | Runs¹ | CI gate |
-| Windows contributor bootstrap and SDK build | Runs¹ | Runs | Runs | Runs¹ | CI gate |
-| Credential-free ecosystem startup/import and compatibility checks | Runs | Runs | Runs | Runs | CI gate |
-| Live examples and live ecosystem tests | Skipped | Skipped | Runs² | Skipped | CI gate² |
-| CodeQL merge protection, breaking-change detection, Castiron checks | Runs | Runs | Not triggered | Runs | Merge protection; no separate release gate |
-| Standalone Node.js support policy workflow | Not triggered | Not triggered | Runs | Not triggered | No separate gate; assertions also run in CI |
-| Release PR title/version validation | Not applicable | Not triggered | Not applicable | Runs | Checked before release creation |
-| Release state, native-browser compatibility, release-package build | Not applicable | Not triggered | Release workflow³ | Not applicable | Required |
+| Checks | PR | Merge queue | Push to `main` | Release PR | npm publication |
+| ------------------------------------------------------------------ | -------------- | ------------- | ----------------- | -------------- | ------------------------------------------- |
+| CI lint, build, Node.js tests, packed-package tests, benchmarks | Runs¹ | Runs | Runs | Runs¹ | CI gate |
+| Windows contributor bootstrap and SDK build | Runs¹ | Runs | Runs | Runs¹ | CI gate |
+| Credential-free ecosystem startup/import and compatibility checks | Runs | Runs | Runs | Runs | CI gate |
+| Live examples and live ecosystem tests | Skipped | Skipped | Runs² | Skipped | CI gate² |
+| CodeQL merge protection, breaking-change detection | Runs | Runs | Not triggered | Runs | Merge protection; no separate release gate |
+| Standalone Node.js support policy workflow | Not triggered | Not triggered | Runs | Not triggered | No separate gate; assertions also run in CI |
+| Release PR title/version validation | Not applicable | Not triggered | Not applicable | Runs | Checked before release creation |
+| Release state, native-browser compatibility, release-package build | Not applicable | Not triggered | Release workflow³ | Not applicable | Required |
¹ Same-repository PRs run these checks through branch pushes; duplicate PR-event jobs may be skipped.
Fork PRs and `ready_for_review` events run them directly. Release PRs receive the same CI coverage.
diff --git a/AGENTS.md b/AGENTS.md
index db8fbd9984..00baa28764 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -73,15 +73,23 @@ explicitly requires it.
when the public contract changes. Preserve existing documentation URLs and import
paths, and make examples runnable with the documented environment and dependencies.
-## Custom-code budget
-
-Follow [the custom-code guidance](scripts/castiron/CUSTOM_CODE.md). Budget changes
-belong in a separate PR containing only `.castiron-ratchet.json`, with an explicit justification
-in the PR description. Increases require a **human approving review** before merging.
-Agents may investigate and draft proposals, but must not approve budget increases
-(including through a human's credentials) or bypass the gate. Do not weaken
-counting, broaden exclusions, or alter generation metadata to make a change pass.
-The checker and effective budget come from main, not the PR. Keep default CODEOWNERS.
+
+
+## Generated-file ownership
+
+Never hand-edit generated SDK files, including generated tests, documentation,
+workflows, or the generated-file inventory. Change the authoritative API schema,
+configuration, or compiler, then regenerate. Put SDK-specific behavior in
+separately owned handwritten helpers and extension points.
+
+Regeneration replaces generator-owned files and deletes retired generated paths.
+Handwritten edits to generated files are overwritten; they are never replayed or
+merged into new output. Preserve separately owned handwritten files and resolve
+ownership collisions explicitly. Follow this AGENTS.md rule and review generated output and inventory changes
+together. Generated-file ownership currently relies on contributor guidance and
+code review; there is no dedicated generated-file edit check or required gate.
+Fix violations in the inputs/compiler and regenerate; never update inventory
+hashes to accept a handwritten patch.
## Security and lifecycle correctness
diff --git a/docs/architecture/security-model.md b/docs/architecture/security-model.md
index 1b2aefff53..2e353278c7 100644
--- a/docs/architecture/security-model.md
+++ b/docs/architecture/security-model.md
@@ -1,5 +1,22 @@
# Security Model
+Generated files are updated through authoritative inputs or the compiler and
+regeneration; handwritten edits to them are forbidden. Code review enforces this
+ownership rule. The customization-budget system is being retired, but this
+`next` revision still contains its workflow and publisher implementations.
+Their removal is a separate canonical regeneration; this documentation change
+does not remove or disable executable workflows.
+
+Until those files are removed, include them in security review. The legacy
+`.github/workflows/castiron-custom-code.yml` accepts PR/merge-group input, and
+`.github/workflows/castiron-custom-code-comment.yml` can publish statuses and
+comments. Preserve its trusted-code, event/repository/revision identity,
+artifact-validation, freshness, and least-privilege boundaries. Do not infer
+that repository settings eliminate these code paths from a scan of this tree.
+See `scripts/castiron/CUSTOM_CODE.md` for the remaining implementation's historical
+protocol; it does not authorize new handwritten edits to generated files or a
+replacement budget system.
+
The repository's canonical security policy is `.github/SECURITY.md`; this is
the canonical detailed threat model that policy references for the `openai`
JavaScript and TypeScript SDK repository. Codex Security scans should load this
@@ -8,6 +25,11 @@ in external scan configuration. It records reusable architecture and
trust-boundary context; the scenarios below are hypotheses and calibration
examples, not findings.
+Generated-file ownership currently relies on `AGENTS.md`, contributor guidance,
+and ordinary SDK code review. There is no dedicated generated-file edit check or
+required gate. Review generated output and inventory changes together; fix
+violations in the inputs/compiler and regenerate.
+
## 1. Overview
The published `openai` package is an outbound API client library, not an
@@ -27,20 +49,20 @@ SDK verifier before parsing (`src/client.ts:505-612`,
`src/client.ts:878-898`, `src/client.ts:1147-1235`,
`src/internal/parse.ts:17-93`, `src/resources/webhooks/webhooks.ts:7-79`).
-| Component or workflow | Role | Evidence |
-| ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `src/client.ts` and generated `src/resources/` | Public REST clients, request construction, header normalization, authentication, dispatch, retries, and resource methods | `src/index.ts:1-27`, `src/client.ts:505-612`, `src/client.ts:1147-1235`, `src/client.ts:1524-1587`, `src/internal/headers.ts:29-94` |
-| `src/azure.ts`, `src/bedrock.ts`, and `src/auth/` | Provider-specific credential selection, origin controls, metadata token providers, and workload token exchange | `src/azure.ts:86-214`, `src/bedrock.ts:144-265`, `src/auth/workload-identity-auth.ts:136-283`, `src/auth/subject-token-providers.ts:181-220`, `src/auth/subject-token-providers.ts:237-347`, `src/auth/subject-token-providers.ts:363-430` |
-| `src/providers/bedrock.ts` and `src/providers/bedrock/aws.ts` | Public Bedrock provider entrypoints for bearer credentials and AWS SigV4 signing | `src/providers/bedrock.ts:14-50`, `src/providers/bedrock/aws.ts:26-64`, `src/providers/bedrock/aws.ts:161-249`, `src/providers/bedrock/aws.ts:252-289` |
-| `src/internal/data-residency.ts` | Public regional-destination selection and client-clone inheritance for OpenAI REST authority | `src/internal/data-residency.ts:6-44`, `src/client.ts:505-571`, `src/client.ts:648-727`, `src/azure.ts:86-100`, `src/bedrock.ts:144-158` |
-| `src/auth/x509-transport.ts` and `src/internal/auth/x509-*` | Public X.509 credential/transport entrypoint, token exchange, guarded dispatch, cache, retry, and request isolation | `package.json:85-127`, `src/auth/x509-transport.ts:34-55`, `src/auth/x509-transport.ts:156-358`, `src/internal/auth/x509-transport-capability.ts:52-226`, `src/internal/auth/x509-token-exchange.ts:38-310`, `src/internal/auth/x509-workload-identity-auth.ts:203-280`, `src/internal/auth/x509-workload-identity-auth.ts:497-577`, `src/internal/auth/x509-workload-identity-auth.ts:633-967`, `src/internal/auth/x509-transport-registry.ts:47-127` |
-| `src/internal/parse.ts` and `src/core/streaming.ts` | Decode API JSON, text, binary, SSE, and NDJSON responses with shared stream lifecycle cleanup | `src/internal/parse.ts:17-93`, `src/core/streaming.ts:88-456` |
-| `src/realtime/` and `src/beta/realtime/` | Stable and beta native/`ws` WebSocket handshakes and server-event parsing for Realtime APIs | `src/realtime/websocket.ts:112-249`, `src/realtime/internal-base.ts:155-166`, `src/realtime/internal-base.ts:252-306`, `src/realtime/ws.ts:63-105`, `src/beta/realtime/websocket.ts:132-263`, `src/beta/realtime/ws.ts:18-146` |
-| `src/resources/{,beta/}responses/ws*.ts` | Public stable and beta Responses WebSocket handshakes, reconnect queues, iterator cleanup, and event dispatch | `package.json:85-127`, `src/resources/responses/ws.ts:13-42`, `src/resources/responses/ws-base.ts:63-611`, `src/resources/beta/responses/ws.ts:13-42`, `src/resources/beta/responses/ws-base.ts:63-615`, `src/internal/ws.ts:151-185` |
-| `src/lib/` and `src/helpers/` | Structured-output parsing, schema validation, chat runners, embeddings decoding, and caller-supplied tool callbacks | `src/lib/parser.ts:162-184`, `src/helpers/standard-schema.ts:703-805`, `src/lib/AbstractChatCompletionRunner.ts:446-499`, `src/lib/embeddings.ts:17-65`, `src/internal/utils/base64.ts:45-61` |
-| `src/core/{api-promise,pagination}.ts` | Root-exported raw/parsed response promises and response-driven auto-pagination request loops | `src/index.ts:4-6`, `src/core/api-promise.ts:15-98`, `src/client.ts:970-992`, `src/core/pagination.ts:29-61`, `src/core/pagination.ts:73-111`, `src/core/pagination.ts:155-328` |
-| `src/internal/{to-file,uploads,multipart-encoding}.ts` | Public file materialization plus buffered and streaming multipart encoding for caller-supplied files, filenames, blobs, responses, and streams | `src/internal/to-file.ts:93-208`, `src/internal/uploads.ts:50-103`, `src/internal/uploads.ts:143-225`, `src/internal/uploads.ts:234-640`, `src/internal/multipart-encoding.ts:7-53` |
-| GitHub Actions | Unprivileged PR/push checks, main-only live examples, trusted Castiron reporting, monthly Codex review, protected release and publication workflows | `.github/workflows/ci.yml:18-154`, `.github/workflows/ci.yml:260-313`, `.github/workflows/castiron-custom-code-comment.yml:4-24`, `.github/workflows/castiron-custom-code-comment.yml:116-200`, `.github/workflows/node-version-review.yml:17-111`, `.github/workflows/create-releases.yml:41-80`, `.github/workflows/create-releases.yml:288-346` |
+| Component or workflow | Role | Evidence |
+| ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `src/client.ts` and generated `src/resources/` | Public REST clients, request construction, header normalization, authentication, dispatch, retries, and resource methods | `src/index.ts:1-27`, `src/client.ts:505-612`, `src/client.ts:1147-1235`, `src/client.ts:1524-1587`, `src/internal/headers.ts:29-94` |
+| `src/azure.ts`, `src/bedrock.ts`, and `src/auth/` | Provider-specific credential selection, origin controls, metadata token providers, and workload token exchange | `src/azure.ts:86-214`, `src/bedrock.ts:144-265`, `src/auth/workload-identity-auth.ts:136-283`, `src/auth/subject-token-providers.ts:181-220`, `src/auth/subject-token-providers.ts:237-347`, `src/auth/subject-token-providers.ts:363-430` |
+| `src/providers/bedrock.ts` and `src/providers/bedrock/aws.ts` | Public Bedrock provider entrypoints for bearer credentials and AWS SigV4 signing | `src/providers/bedrock.ts:14-50`, `src/providers/bedrock/aws.ts:26-64`, `src/providers/bedrock/aws.ts:161-249`, `src/providers/bedrock/aws.ts:252-289` |
+| `src/internal/data-residency.ts` | Public regional-destination selection and client-clone inheritance for OpenAI REST authority | `src/internal/data-residency.ts:6-44`, `src/client.ts:505-571`, `src/client.ts:648-727`, `src/azure.ts:86-100`, `src/bedrock.ts:144-158` |
+| `src/auth/x509-transport.ts` and `src/internal/auth/x509-*` | Public X.509 credential/transport entrypoint, token exchange, guarded dispatch, cache, retry, and request isolation | `package.json:85-127`, `src/auth/x509-transport.ts:34-55`, `src/auth/x509-transport.ts:156-358`, `src/internal/auth/x509-transport-capability.ts:52-226`, `src/internal/auth/x509-token-exchange.ts:38-310`, `src/internal/auth/x509-workload-identity-auth.ts:203-280`, `src/internal/auth/x509-workload-identity-auth.ts:497-577`, `src/internal/auth/x509-workload-identity-auth.ts:633-967`, `src/internal/auth/x509-transport-registry.ts:47-127` |
+| `src/internal/parse.ts` and `src/core/streaming.ts` | Decode API JSON, text, binary, SSE, and NDJSON responses with shared stream lifecycle cleanup | `src/internal/parse.ts:17-93`, `src/core/streaming.ts:88-456` |
+| `src/realtime/` and `src/beta/realtime/` | Stable and beta native/`ws` WebSocket handshakes and server-event parsing for Realtime APIs | `src/realtime/websocket.ts:112-249`, `src/realtime/internal-base.ts:155-166`, `src/realtime/internal-base.ts:252-306`, `src/realtime/ws.ts:63-105`, `src/beta/realtime/websocket.ts:132-263`, `src/beta/realtime/ws.ts:18-146` |
+| `src/resources/{,beta/}responses/ws*.ts` | Public stable and beta Responses WebSocket handshakes, reconnect queues, iterator cleanup, and event dispatch | `package.json:85-127`, `src/resources/responses/ws.ts:13-42`, `src/resources/responses/ws-base.ts:63-611`, `src/resources/beta/responses/ws.ts:13-42`, `src/resources/beta/responses/ws-base.ts:63-615`, `src/internal/ws.ts:151-185` |
+| `src/lib/` and `src/helpers/` | Structured-output parsing, schema validation, chat runners, embeddings decoding, and caller-supplied tool callbacks | `src/lib/parser.ts:162-184`, `src/helpers/standard-schema.ts:703-805`, `src/lib/AbstractChatCompletionRunner.ts:446-499`, `src/lib/embeddings.ts:17-65`, `src/internal/utils/base64.ts:45-61` |
+| `src/core/{api-promise,pagination}.ts` | Root-exported raw/parsed response promises and response-driven auto-pagination request loops | `src/index.ts:4-6`, `src/core/api-promise.ts:15-98`, `src/client.ts:970-992`, `src/core/pagination.ts:29-61`, `src/core/pagination.ts:73-111`, `src/core/pagination.ts:155-328` |
+| `src/internal/{to-file,uploads,multipart-encoding}.ts` | Public file materialization plus buffered and streaming multipart encoding for caller-supplied files, filenames, blobs, responses, and streams | `src/internal/to-file.ts:93-208`, `src/internal/uploads.ts:50-103`, `src/internal/uploads.ts:143-225`, `src/internal/uploads.ts:234-640`, `src/internal/multipart-encoding.ts:7-53` |
+| GitHub Actions | Unprivileged PR/push checks, main-only live examples, monthly Codex review, protected release and publication workflows | `.github/workflows/ci.yml:18-154`, `.github/workflows/ci.yml:260-313`, `.github/workflows/node-version-review.yml:17-111`, `.github/workflows/create-releases.yml:41-80`, `.github/workflows/create-releases.yml:288-346` |
| Deployment or workflow | Resource or capability | Configuration and precedence | Safe effective value or location | Readers, writers, or recipients | Enforcing control | Evidence or unknowns |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -60,7 +82,6 @@ SDK verifier before parsing (`src/client.ts:505-612`,
| npm publication | Immutable release artifact and OIDC publication authority | Release SHA is verified, package artifact is built separately, publisher comes from trusted workflow commit | Downloaded `dist/` artifact; `id-token: write` only in publish job | npm trusted publishing | Immutable release checks, artifact digest mismatch failure, lifecycle-disabled publisher path | `.github/workflows/create-releases.yml:106-164`, `.github/workflows/create-releases.yml:240-286`, `.github/workflows/create-releases.yml:288-346` |
| Bedrock providers | Dependency-free bearer provider or AWS access key, secret key, session token, profile, or credential-provider chain | Explicit provider options select one bearer or AWS credential mode and a Bedrock endpoint/region | Normalized configured or region-derived Bedrock endpoint | Bedrock authority receives bearer or SigV4-signed request | Provider-owned Authorization, endpoint/region checks, replayable-body requirement, and manual redirects | `src/providers/bedrock.ts:14-50`, `src/providers/bedrock/aws.ts:26-64`, `src/providers/bedrock/aws.ts:161-249`, `src/providers/bedrock/aws.ts:252-289` |
| Stable and beta Realtime | API key, ephemeral key, or Azure credential in a WebSocket handshake; untrusted server frames | Stable defaults derive from the client but trusted `buildRealtimeURL` may supply any `wss:` URL; beta requires the configured origin | Stable trusted `wss:` URL or beta matching configured `wss:` origin | Configured or explicitly trusted Realtime authority; parsed events to application listeners | Stable requires `wss:`; legacy Bedrock clients additionally require the configured origin; beta requires `wss:` plus configured-origin equality; both `ws` transports protect credential redirects and both surfaces validate own string `type` | `src/realtime/internal-base.ts:155-166`, `src/realtime/internal-base.ts:276-281`, `src/realtime/websocket.ts:204-230`, `src/internal/bedrock.ts:247-263`, `src/realtime/ws.ts:63-105`, `src/beta/realtime/websocket.ts:132-143`, `src/beta/realtime/websocket.ts:210-258`, `src/beta/realtime/ws.ts:18-28`, `src/beta/realtime/ws.ts:68-117` |
-| Trusted Castiron reporting | Lower-trust `workflow_run` metadata, trusted main reporter, status and PR-comment writes | Completed upstream custom-code workflow is checked against event, path, repository, head SHA, and current PR identity | Main checkout plus recomputed Git-object report | Commit statuses and one PR comment | Trusted main code recomputes reports; freshness and identity checks gate writes; candidate artifacts are not trusted inputs | `.github/workflows/castiron-custom-code-comment.yml:4-24`, `.github/workflows/castiron-custom-code-comment.yml:34-98`, `.github/workflows/castiron-custom-code-comment.yml:116-200` |
| Monthly Node version review | OpenAI API key in the proposal job; repository and pull-request write authority only in the publisher | Scheduled or manual main-only workflow; isolated proposal, validation, and publication jobs | Same immutable JSON artifact and workflow commit in fresh validation and publisher checkouts | Codex action, read-only validation, and GitHub draft-PR publisher | Pinned actions, strict policy-file allowlist, engines.node-only package reconstruction, independent verification before dependency execution and publication, fixed validated base, and draft PR; human review and branch protection are external assumptions | `.github/workflows/node-version-review.yml:16-117`, `.github/workflows/node-version-review.yml:152-213`, `scripts/node-version-review.py` |
## 2. Threat Model, Trust Boundaries, and Assumptions
@@ -328,8 +349,7 @@ read-only token permissions remain in place (`.github/workflows/ci.yml`).
`.github/workflows/create-releases.yml:41-80`,
`.github/workflows/create-releases.yml:288-346`).
- **Workflow metadata or automation prompts to privileged writes:** the
- trusted Castiron comment workflow consumes lower-trust `workflow_run` state
- before writing statuses and PR comments. The monthly Node review isolates
+ monthly Node review isolates
Codex with read-only repository access and an API key. Fresh validation and
publisher jobs independently verify the same JSON proposal against the
workflow commit, allowing only policy files and `package.json#engines.node`.
@@ -337,9 +357,7 @@ read-only token permissions remain in place (`.github/workflows/ci.yml`).
and applies verified data without installing dependencies or executing
proposed code. Its local base remains at the validated commit. Required human
review and branch protection are external assumptions
- (`.github/workflows/castiron-custom-code-comment.yml:4-24`,
- `.github/workflows/castiron-custom-code-comment.yml:116-200`,
- `.github/workflows/node-version-review.yml:16-117`,
+ (`.github/workflows/node-version-review.yml:16-117`,
`.github/workflows/node-version-review.yml:152-213`,
`scripts/node-version-review.py`).
- **Dependencies to build execution:** frozen lockfiles and workspace dependency
@@ -357,7 +375,7 @@ read-only token permissions remain in place (`.github/workflows/ci.yml`).
| Medium | Malformed or very large legitimate response, stream, upload, WebSocket, pagination, or embedding data causes disproportionate CPU, memory, retention, or cancellation failure. | Lower-trust runtime data reaches a parser, accumulator, decoder, polling loop, pagination loop, or base64 expansion used by a long-lived process. | Worker availability degradation without credential compromise. | Ordinary HTTP retry hints are bounded; shared streams own cancellation cleanup; uploads support incremental encoding and typed-multipart cleanup; polling and pagination expose caller cancellation but commonly lack overall deadlines. | Prefer incremental, amortized-linear processing and timely cleanup; callers impose service-level budgets where needed. Do not add arbitrary limits that reject supported large API payloads. | `src/internal/parse.ts:17-93`, `src/core/streaming.ts:88-456`, `src/client.ts:1549-1667`, `src/lib/polling.ts:94-144`, `src/core/pagination.ts:29-61`, `src/core/pagination.ts:155-328`, `src/lib/embeddings.ts:17-65`, `src/internal/utils/base64.ts:45-61`, `src/helpers/audio.ts:35-73`, `src/helpers/audio.ts:119-281`, `src/internal/to-file.ts:93-208`, `src/internal/uploads.ts:203-640`, `src/internal/multipart-encoding.ts:7-53` |
| High | An external PR or mutable artifact reaches main-only API keys, release GitHub App credentials, or npm OIDC publication authority. | Protected branch/environment or immutable artifact binding is bypassed; ordinary read-only PR CI is insufficient. | Credential theft or publication of attacker-controlled official packages. | PR jobs use read-only contents; releases are main-only; release SHA and artifacts are verified; publisher script is preserved from trusted workflow code. | Keep privileged workflows bound to protected, immutable revisions and maintain least-privilege permissions. | `.github/workflows/ci.yml:18-154`, `.github/workflows/ci.yml:260-313`, `.github/workflows/create-releases.yml:41-80`, `.github/workflows/create-releases.yml:106-164`, `.github/workflows/create-releases.yml:288-346` |
| Not a boundary by itself | A contributor changes a tracked test, fixture, example, build script, or workflow-invoked helper and that repository code executes during its normal build or test workflow. | The same actor already controls the tracked executable code being run. | No new capability solely from execution of code already entrusted with repository-code authority. | Code review and the workflow's existing permission boundary. | Re-evaluate only if independently mutable input or a protected credential transition is present. | `.github/workflows/ci.yml:18-154`, `scripts/test:43-172`, `.github/CONTRIBUTING.md:122-136` |
-| High | Lower-trust workflow metadata, candidate artifacts, or automation output controls a privileged status, PR-comment, repository-write, or draft-PR action. | A trusted workflow fails to bind its write to validated event, repository, revision, identity, or allowed paths. | Attacker-controlled statuses, comments, or repository changes. | Castiron recomputes with trusted main code and checks freshness; monthly Node review is main-only and constrained to draft PR paths; required human review and branch protection are external assumptions. | Preserve immutable trusted-code, event identity, freshness, path, and externally enforced review gates. | `.github/workflows/castiron-custom-code-comment.yml:4-24`, `.github/workflows/castiron-custom-code-comment.yml:116-200`, `.github/workflows/node-version-review.yml:17-55`, `.github/workflows/node-version-review.yml:90-111` |
+| High | Lower-trust workflow metadata, candidate artifacts, or automation output controls a privileged status, PR-comment, repository-write, or draft-PR action. | A trusted workflow fails to bind its write to validated event, repository, revision, identity, or allowed paths. | Attacker-controlled statuses, comments, or repository changes. | Monthly Node review is main-only and constrained to draft PR paths; required human review and branch protection are external assumptions. | Preserve immutable trusted-code, event identity, freshness, path, and externally enforced review gates. | `.github/workflows/node-version-review.yml:17-55`, `.github/workflows/node-version-review.yml:90-111` |
## 4. Severity Calibration