[pithead-developer]

What's the problem

Closes #544

The Markdown linter was pinned to 0.22.1 and absent from the weekly tool watcher, so npm releases could go unnoticed.

How I fixed it

Pin markdownlint-cli2 to 0.23.3 and supply Node 22 in CI. Extend the existing watcher to compare the Makefile pin with npm, strictly validate the complete version and count failed lookups as unchecked. Register offline regressions and correct contributor/testing guidance. Incorporate develop and follow the current edited-hunk comment policy.

Correct the returned lint failure by formatting tests/run.sh:3729 and nine equivalent subshell closures with CI's pinned shfmt 3.14.1. The previous local check used 3.13.1 and incorrectly removed required spaces. The correction is whitespace-only; git diff -w before committing was empty.

Here is the proof

Head: e37632506476c3432981591cd358e8ed5cc99e82.

• Reviewer finding confirmed: failed lint job on 3d884f389de1dffb33d45cb0b94889610d83992f shows shfmt 3.14.1 rejecting ten subshell closures in tests/run.sh, starting at line 3729. With a checksum-verified shfmt 3.14.1, shfmt -i 4 -d tests/run.sh returned exit 1 before correction. After shfmt -i 4 -w tests/run.sh, shfmt -i 4 -d tests/run.sh tests/test-tool-pin-watch.sh returned exit 0. This supersedes the earlier unversioned formatter claim.
• With shfmt 3.14.1 first on PATH, make lint SHELL_FILES="tests/run.sh tests/test-tool-pin-watch.sh" — PASS: changed-file ShellCheck and formatting, plus topology and file-budget gates and their self-tests. FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh and git diff --check — PASS.
• /bin/bash tests/test-tool-pin-watch.sh — PASS, nine cases covering current/stale pins, failed/malformed/missing/multiline/prefixed/injected responses and a changed Makefile pin. Negative control with the origin/develop watcher returns exit 1, FAIL: npm current response, because the npm row is absent.
• make lint-md — PASS with markdownlint-cli2 0.23.3, zero issues. uv run --no-project --with yamllint==1.38.0 make lint-yaml and make lint-actions — PASS before the whitespace-only correction.
• Verifier and security follow-up reviews — clean. Ponytail review: reuse the existing watcher; correction restores the pinned formatter's output without changing behavior.
• Required proof row: workflows, documentation and scripts that never run on a box; GitHub tiers 1–3. Fresh current-head GitHub validation is pending; earlier-head results are not current-head passes. No local Docker or full host-dependent suite was run. No worker-to-coordinator contract changed, so no tier-4 job is required.

This draft closes only #544. Independent runner review and fresh formal owner approval on the final head remain required before merge.

[pithead-reviewer]

PASS

What I investigated

Reviewed all six changed files against #544: refresh markdownlint, validate it with the lint gate, and add npm currency monitoring with failure reporting. The current head satisfies that scope; GitHub checks and independently reproduced regression evidence pass.

• Read the runbooks, repository instructions, contributing guide, and ponytail review skill.

• gh pr view 592 and gh issue view 544, 542, 549, 556: verified the claim, trusted authors, and separately scoped issues; no earlier review findings.

• git diff origin/develop...HEAD plus connected workflow, Makefile and test reads: reviewed six files; no blocking correctness, security, comment-discipline or unnecessary-code findings.

• gh pr checks 592 --json name,state,bucket,workflow,link: all eight checks SUCCESS.

• gh run view 39265847005: CI concluded success on e1e9793.

• gh run view 39265846789: security concluded success on the same head.

• gh run view 39265847005 --log, followed by raw log reads: confirmed the registered watcher regression ran and its nine cases passed.

• /bin/bash tests/test-tool-pin-watch.sh: exit 0; nine cases passed.

• Restored the pre-fix watcher in a detached scratch worktree and reran the same module: exit 1, FAIL: npm current response; npm row absent.

• make lint-md: exit 0; markdownlint-cli2 0.23.3, zero issues.

• uv run --no-project --with yamllint==1.38.0 make lint-yaml: passed.

• make lint-actions: passed.

• shellcheck --severity=warning tests/test-tool-pin-watch.sh: passed.

• shfmt -i 4 -d tests/test-tool-pin-watch.sh: passed.

• FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh: passed.

• make lint-topology: self-tests and repository scan passed.

• git diff origin/develop...HEAD --check: passed.

• Runner detect-topology.py over PR body, PR comments and issue comments: clean. Inline review-comment API returned zero comments.

• git status --short and final gh pr view: checkout unchanged; head remains e1e9793, targeting develop.

• No bench evidence was quoted or required by these paths. Docker and the full host-dependent suite were not run locally; their GitHub checks passed.

• Topology scan of the public review draft: clean.

• gh pr comment 592 --body-file: exit 3, gh: refused: reviewer sessions are GitHub read-only. The runner must publish this verdict and evidence.

• PR ci: fix #544 — track and refresh markdownlint #592 body, proof paragraph: Refresh the statement that test-suite and coverage checks are still running. Both now succeeded on the reviewed head.

Reviewed head: e1e9793c9927fa954aad3a40746cf3195cb55cf6.

[pithead-reviewer]

PASS

What I investigated

Reviewed PR #592 at head e376325 against #544 (refresh the markdownlint-cli2 pin and validate it with the lint gate; add currency monitoring for the npm pin that treats a failed lookup as unchecked). All three are delivered; the eight GitHub checks are green at the head; the new regression runs the watcher's real code, and it goes red with the fix reverted and under two targeted mutations.

• gh pr view 592 / gh issue view 544 / gh issue view 542: PR closes only Track and refresh the unwatched markdownlint-cli2 pin #544; Update stale CI tool dependencies before 2.0.0 #542 (separate tool bumps) is closed; claim and comments come from the runner's own Apps and the owner; the base is develop

• gh pr checks 592 --json: all 8 checks SUCCESS (CI: shellcheck+shfmt, yamllint, markdownlint, Test suite, Coverage, End-to-end; Security: gitleaks, zizmor)

• gh run view 39721591103 and 39721590886 --json headSha,conclusion: both success on e376325

• git merge-base --is-ancestor origin/develop HEAD: up to date with develop b3c8d23

• gh run view 39721591103 --job 119636049296 --log: 'bash tests/test-tool-pin-watch.sh' then 9 PASS lines; suite reports 2461 passed, 0 failed

• gh run view 39721591103 --job 119636049137 --log: setup-node node-version 22; 'markdownlint-cli2 v0.23.3 ... Summary: 0 issues in 0 files' over 25 files

• gh api repos/actions/setup-node/git/matching-refs/tags/v: SHA 949feb24... is refs/tags/v7 and v7.1.0, the latest release

• npm view markdownlint-cli2@0.23.3 engines: node >=22 (0.22.1: >=20), so the setup-node step is required

• /bin/bash tests/test-tool-pin-watch.sh on head: exit 0, 9 PASS

• scratch worktree, tool-bump.yml restored from origin/develop: exit 1, 'FAIL: npm current response' (npm row absent)

• mutation: [[ =~ ]] reverted to printf|grep -qE: multiline case fails (version '0.23.3\ninvalid' reported as stale)

• mutation: prefix default ${4-v} -> ${4:-v}: exit 1, 'FAIL: npm prefixed response'

• FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh: exit 0

• make lint-topology: exit 0

• make lint-md: exit 0, markdownlint-cli2 v0.23.3, 0 issues

• git diff origin/develop...HEAD --check: exit 0; shellcheck --severity=warning tests/test-tool-pin-watch.sh: exit 0

• shfmt -i 4 -d with the local shfmt 3.13.1: exit 1, which is the formatter-version gap the PR describes; not evidence; CI's pinned 3.14.1 Lint (shellcheck + shfmt) job passed at the head

• detect-topology.py over PR body+comments, inline review comments, reviews, and issue 544 body+comments: clean, exit 0 on all four

• git diff origin/develop...HEAD: no added source comments; the zizmor pragma is kept; tests/run.sh net change is comment-only deletions (verified in the 3d884f3 history)

• ponytail-review pass over the diff: no lean findings; the change reuses the existing check() function and adds no dependency

• No bench-ci job quoted or required: the diff touches workflows, docs, tests and the Makefile; no rigforge.sh or worker-coordinator contract change

• Docker and full local make test not run on this Mac; relied on the GitHub checks at the head

• Makefile:8: npm now reports markdownlint-cli2 0.24.0 as latest (npm view markdownlint-cli2 version), so the 0.23.3 pin will show as stale in the next weekly report. That is the watcher working as designed; bump the pin in a later change, not this PR.

• tests/run.sh:4643: tests/run.sh changes are five comment-only deletions unrelated to Track and refresh the unwatched markdownlint-cli2 pin #544. They were left behind when the shfmt reformat was undone (commit 3d884f3). Harmless and consistent with the 2026-10-21 no-comments ruling.

• PR ci: fix #544 — track and refresh markdownlint #592 body, 'Here is the proof': The body says current-head GitHub validation is pending. All eight checks have now passed on e376325; refresh the body.

• gh api repos/p2pool-starter-stack/rigforge/pulls/592/reviews: The owner's APPROVED review is on e1e9793, not the current head. The architect's ruling on Track and refresh the unwatched markdownlint-cli2 pin #544 requires fresh owner approval on the final head before merge; that is the runner's and operator's step.

Reviewed head: e37632506476c3432981591cd358e8ed5cc99e82.

[pithead-reviewer]

Owner brief for e37632506476

What it does. Markdown checks use version 0.23.3 with Node 22 in CI. The weekly watcher now reports newer npm versions and flags failed or malformed lookups as unchecked.

Why. Closes #544 in the maintenance & gates milestone. The Markdown linter was pinned to 0.22.1 and had no configured watcher to flag newer releases.

Risk. Limited to development checks and weekly dependency reports: the newer linter could reject Markdown previously accepted. No worker behavior changes or irreversible effects.

Proof. CI: 9 success. Reviewer: PASS at e376325 by pithead-reviewer reviewer, round 2 (recorded 2026-10-22T04:29:48Z). Bench: no job cited in the PR body.

What to check.

• Makefile:8: the selected version is 0.23.3; the reviewer notes 0.24.0 is already available for a later update.
• .github/workflows/tool-bump.yml:42: npm lookup failures and invalid versions remain unchecked rather than appearing current.
• tests/test-tool-pin-watch.sh:47: cases cover current, stale and invalid responses, plus reading a changed Makefile version.

Verdict. merge after Fresh owner approval on the final head is required; the existing approval covers an earlier commit