[dinakarjs]

Install the existing runtime lock alongside the docs lock in both documentation workflows, run pip check after the no-deps editable installation, and watch both consumed lockfiles. The documentation environment avoids the incompatible dev-toolchain markdown-it-py pin. Dependency pins, workflow permissions and publishing grants are unchanged by this PR.

Synchronized with main c51fba5 at 9aa53cf. Published tree 2d400f998ac814b4f2144ca8c359ce1c558a59f8 equals the locally tested tree. The effective PR diff remains two documentation workflows.

Fresh Linux/Python 3.12.14 validation using the exact sequential workflow setup: hash-required docs install, hash-required runtime install, no-deps editable checkout and pip check all pass. Strict MkDocs build passes; check_docs_quickstart.py passes deny, allow, two-call summary, independently pinned software verification and consumer rejection controls with inherited proxy variables cleared for loopback traffic. Both workflow consumers/path filters and PR-delta whitespace checked.

The synchronized main's identical runtime/test/dependency bytes were also exercised during companion #796 validation: 2,601 unit tests passed, 8 skipped; configured Ruff, mypy, Bandit and pip check passed. These are local results; current-head hosted workflows and independent maintainer review remain required. No deployment, publication or hardware validation performed. Prepared with OpenAI Codex; DCO-signed.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Both changed documentation jobs pass on this head: docs-check and published-quickstart. The fresh local docs+runtime environment passes dependency consistency, strict MkDocs and the executable tutorial; reproducing the original docs-then-dev install separately fails pip check on mdformat's markdown-it-py<4 requirement versus 4.2.0.

The unrelated general CI failure occurs earlier at pip-audit: existing certifi 2026.7.22 is flagged as PYSEC-2026-4320. I am preparing its lock-only update separately; the workflow fix remains scoped to documentation environments. No audit exception or skipped test is being added.

[dinakarjs]

The separate dependency fix is submitted as #795. It changes only certifi version/hash entries in four locks; a fresh environment passes pip-audit and dependency consistency, all 2,539 unit tests, Ruff, mypy and Bandit. After normal independent acceptance/base update, #794 should rerun its complete matrix. Its own docs-check and published-quickstart already pass.

[carloshvp]

Reviewed exact head 019f37a582b479144e2763f978708825d08dbaf5 in an isolated checkout.

Approving the documentation environment correction. Both workflows install the existing docs and runtime locks, run pip check after the no-deps editable installation, and watch both consumed lockfiles. The deployment workflow also watches its own definition. The diff leaves dependency pins, permissions and deployment grants unchanged.

Independent fresh-environment validation: hash-locked docs plus runtime installation, editable installation, pip check, the strict MkDocs build and the executable docs quickstart all pass. Both YAML consumers and path lists were inspected; whitespace checks pass. The quickstart was run with proxy variables cleared for loopback traffic.

The separate general CI failure is the inherited certifi audit finding, confirmed from its job log; sibling cancellations are not passing tests. #795 supplies that dependency repair. No Pages deployment was performed. The commit carries DCO sign-off.

Reviewed with OpenAI Codex.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

Refreshed onto main c51fba5 at signed head 9aa53cf. The effective diff remains the two documentation workflows; published tree equals the tested local tree. Fresh sequential hash-locked docs/runtime installation, editable checkout, pip check, strict MkDocs build and documented quickstart acceptance/refusal controls pass locally.

All returned current-head applicable hosted checks now succeed, including docs-check, published-quickstart, actionlint, all six Linux/Windows Python matrix jobs, governance, Docker confinement, CodeQL and maintainer gate. CI: https://github.com/agentrust-io/cmcp/actions/runs/40930345038. The old dependency-audit failed/cancelled matrix is cleared. Independent current-head review and the maintainer merge decision remain separate. No Pages deployment, package publication or hardware validation was performed. Prepared with OpenAI Codex.