[ootakazuhiko]

概要

Refs #259 / portal itdojp/it-engineer-knowledge-architecture#297。#257 / PR258のroot依存修正・actualmain確認完了後、同repo直列の独立pin-only PR。

• base/main 21d9ce24ae81224cde2176bbb8a28d6a3b751ddf
• exact head c7dc7ab60c34cbc8383bc3f4af9d40bbfd8a6980
• .github/workflows/book-qa.yml のref 1行のみ
• old cff9fcf8bae31140f07b358d314fc64173cb7013 → audited c4dcd01e8450112f95002a454657d409cb3fa2f1

本文/docs/assets/consumer依存/Node/npm/allowScripts/build/Pages/QA閾値は不変。formatterの共有assetsを配布するPRではなくQAチェックの固定SHA更新です。

検証

• candidate exact clean checkout。fresh root/isolated install/audit全severity0、QA5suite68tests。
• formatter actualmain c4d、Quality38045023930 / Publication38045024058 success。PR185 reviewedmerge証跡は継承、本日full932/EPUBを再実行したとはしない。
• consumer old/new 5QA reports同等、old cffH3M3を記録。新pinによるaudit抑制なし。
• one-line diff / actionlint / consumer npm12.0.1 fulltest:light（audit0含む）/ Jekyll / canonical drift0 / diffcheck。
• 直前mainで29routes5assets build・31HTTP200・8browserDOM4visible検索を確認。本文とassetsは本差分でも不変。
• exact-head PR CI: BookQA38702750430 / Docs38702750419
• exact-head Codex manual + Copilot5529979217 COMMENTED0、external SHA検証制限は一次API/実install/CIで補足、全review0/0/0
• Ready自動review安定: summary6187443977 exacthead Completed2026-10-15T08:08:23Z、2回安定、全review0/0/0
• 通常matched-head merge後actualmain CI/fresh install/audit/tests/Pages API/deploy/HTTP/browser
• ci: adopt audited formatter SHA after root dependency recovery #259/portalへ証跡反映・owned taskcleanup（完了コメント参照）

境界

既存layoutwarning2・mobile検索hidden/書名clipは同じです。pin-onlyで表示改善や全a11y対応を主張しません。root依存と限定YAML契約は前PR258でreview済み・本PRへ混在しません。no mutable main/tag, bypass, force/rebase/main push/settings/auto-merge。別担当white-hat/private内容は対象外。

完了証跡 — 独立QA pin更新

• PR ci: adopt audited book-formatter SHA #260: 通常matched-head squash merge。
• reviewed head c7dc7ab60c34cbc8383bc3f4af9d40bbfd8a6980 → actual main e6b9f2c95ecab838a796c9e0933e23e6fec5de3c、reviewed/main tree一致、single parent。
• 変更はBook QA ref1行 cff9fcf8bae31140f07b358d314fc64173cb7013 → c4dcd01e8450112f95002a454657d409cb3fa2f1。root依存・限定YAML契約は先行deps: restore root audit gate before formatter rollout #257 / PR258で別処理。
• no admin/bypass/force/rebase/main push/auto-merge/settings変更。

Review / CI

• Codex manual6187438120 → summary6187443977/no-major6187467648、Readyauto同head Completed2026-10-15T08:08:23Z、2回安定。
• Copilot5529979217 COMMENTED0。外部SHA存在/監査の検証制限はGitHub commit/API/PR185 merge一致、fresh audits、実CI checkoutで補足。人間APPROVEDの主張なし。
• wholePR本文1/inline0/thread0、postmergeも unresolved/mismatch/missing 0/0/0。pendingreview0 / Open PR0（本repoのみ）。
• PR BookQA 38702750430 / Docs 38702750419 SUCCESS。
• actualmain BookQA 38703792641 / Docs 38703792532 / Pages 38703791357 SUCCESS。
• Pages API built exactmain / deployment 7087373751 success。

Actualmain / 公開検証

• fresh npm12.0.1 install/audit全severity0、fulltest:light、Jekyll、canonical drift0、built29routes/5assets、diffcheck成功。
• candidate c4 clean root/isolated fresh audit全0 / 68QA tests、old/new5QA reports同等。formatter full932/EPUBは過去PR185証跡を継承、今回再実行したとはしない。
• 公開29routes+2assets=31HTTP200、root/ch08/searchJS/mainCSS rawbytes不変。
• Chrome149 local/public root/ch08×1280/393:8DOM/4visible検索操作成功。mobilepixel差分0、desktopは検索input枠のみ差分、本文/nav配置差なし。全pixel/全a11yの保証ではない。
• 既存layoutwarning2 / mobile書名clip・searchhiddenは未変更。共有runtimeassetsを更新するPRではありません。

Cleanup / 全体

• owned consumer clone・formatter2worktree・task remotebranches・不要node_modules/build/cacheをcleanup。ログ/JSON/配布SRI/HTML/画像/再現scriptsはworkspace内保持。
• 保護対象27consumer checkoutと既存3formatterのHEAD/status不変。別担当white-hat/private本文・settingsは未変更。
• catalog published42 / livepublic40 / activeQA33再監査: newc4 10 / oldcff 19 / oldcf3 4、未分類0、d29参照0。残23のためportal#297はOPEN継続。

[ootakazuhiko]

@codex review

Exact head c7dc7ab60c34cbc8383bc3f4af9d40bbfd8a6980。本PRの最小差分と本文の一次情報/実caller/old-new互換検証をご確認ください。exact CI全成功。依存とformatter pinは別PR、本文/assets/build/Node契約は変更しません。レビューはこのheadへの手動1回のみ。

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T08:08:23.962954Z	c7dc7ab	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🔵 Needs a closer look

Correctness hinges on the external book-formatter commit's existence and audited state, which cannot be verified from this repository and warrants human confirmation.

0 open findings

What changed in this PR

This PR updates the pinned commit SHA used to check out the itdojp/book-formatter repository within the Book QA GitHub Actions workflow. It moves the pin from the previous audited commit (cff9fcf8...) to a newer audited commit (c4dcd01e..., corresponding to book-formatter PR #185), as part of the dependency-recovery work tracked in #259/#257. The change is intentionally minimal (a single line) and does not touch book content, docs/, runtime assets, consumer dependencies, Node/npm versions, or QA thresholds.

Changes:

• Updated the ref: pin for the book-formatter checkout step in book-qa.yml to the audited SHA c4dcd01e8450112f95002a454657d409cb3fa2f1.

File	Description
.github/​workflows/​book-qa.yml	Bumps the pinned book-formatter checkout ref to the newer audited SHA; single-line change with correct YAML indentation.

Verification notes: the old SHA no longer appears anywhere in the repository, the new SHA appears only in the expected location, and book-qa.yml is the only workflow that pins book-formatter by ref — so there are no stale references left to update. I could not independently confirm that the target SHA exists on the external book-formatter repo or that its audit status is as described, since that is outside this repository.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: c7dc7ab60c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ootakazuhiko]

外部SHA / audit検証の補足とReady移行

Copilot5529979217はCOMMENTED0 findingsですが、external SHA/監査を当該repo内から確認できないという制限を記載しています。人間APPROVEDと同一視せず、別途一次情報と実行結果を確認しました。

• GitHub commit c4d をAPI取得し、通常merged PR185 のmergeCommitと完全一致。
• clean detached c4dでfresh root/isolated install＋audit 全severity0、5QA suite68tests成功。
• candidate main Quality38045023930 / Publication38045024058 success。過去full932/EPUBは今日再実行したとはしません。
• consumer old/new5QA reports同等、one-line diff/actionlint/fulltest成功。
• exact c7dc7ab60c34cbc8383bc3f4af9d40bbfd8a6980 PR BookQA 38702750430 / Docs 38702750419 success、実CIが対象fullSHAをcheckoutして全QAを通過。
• Codex manual6187438120/summary6187443977/no-major6187467648 exacthead Completed。レビュー本文/inline/suggestions/threads全件確認で 0/0/0、pending0。

Ready自動reviewを確認してから通常matched-head merge/main検証へ進めます。人間承認の捏造・bypass・保護設定変更はしません。