ref(web): 清理基线并修复 Pages 交付

.github/workflows/ci.yml

@@ -91,20 +91,6 @@ jobs:
             echo "- Runtime contract: \`$CONTRACT_REVISION\`"
           } >> "$GITHUB_STEP_SUMMARY"
 
-  dependency-review:
-    name: Dependency review
-    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Reject new high-severity vulnerabilities
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          fail-on-severity: high
-          fail-on-scopes: development, runtime
-
   database-contract:
     name: Database contract
     needs: core-release
@@ -194,9 +180,6 @@ jobs:
       - name: Verify static, typed, and package contracts
         run: pnpm check
 
-      - name: Reject high-severity dependency vulnerabilities
-        run: pnpm audit:dependencies
-
       - name: Validate the native Twitter Module Federation snapshot
         run: >-
           node scripts/verify-native-extension-distribution.mjs inspect-local

.github/workflows/pages-deploy.yml

@@ -110,7 +110,7 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          packageManager: npm
+          packageManager: pnpm
           wranglerVersion: 4.114.0
           workingDirectory: release
           command: >-

.github/workflows/pages-preview.yml

@@ -94,7 +94,7 @@ jobs:
         uses: pdm-project/setup-pdm@973541a5febeafcfdadf8a51211435be6ecfd90f # v4.5
         with:
           python-version-file: candidate/.python-version
-          version: 2.27.0
+          version: 2.28.0
           cache: true
           cache-dependency-path: candidate/pdm.lock
 
@@ -184,11 +184,11 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          packageManager: npm
+          packageManager: pnpm
           wranglerVersion: 4.114.0
-          workingDirectory: .pages-preview
+          workingDirectory: candidate
           command: >-
-            pages deploy .
+            pages deploy ../.pages-preview
             --project-name=${{ vars.CLOUDFLARE_PAGES_PROJECT }}
             --branch=${{ needs.identity.outputs.branch }}
             --commit-hash=${{ needs.identity.outputs.head_sha }}

AGENTS.md

@@ -17,6 +17,9 @@ Reason in English. Communicate with humans in Chinese.
 ## Working Protocol
 
 - Run `svc status . --json`, then use `svc lookup --keyword` and `svc lookup --path` only for guidance required by the current pressure.
+- Follow the organization-wide [Git and GitHub Governance](https://github.com/InKCre/.github/blob/main/GOVERNANCE.md)
+  and [contribution workflow](https://github.com/InKCre/.github/blob/main/CONTRIBUTING.md) for branches, pull requests,
+  release authority, and delivery boundaries; repository-local documents own exact commands.
 - Read the active Task Packet, relevant durable owner, and nearest local `AGENTS.md` before editing.
 - Resolve one semantic owner before adding durable material. Prefer code, types, configuration, and CI for mechanically enforceable truth.
 - Before a reference-sensitive, logic-altering, or non-obviously-local durable mutation, state the target, objective `From -> To`, operation, blast radius, invariants, verification, and uncertainty.

docs/40-deployment/web-delivery.md

@@ -26,6 +26,11 @@ no check artifact: it checks out the exact source, installs the frozen workspace
 release, reverifies `main`, and deploys those same-run bytes to the Cloudflare Pages `main` branch
 in the protected `production` environment.
 
+The workspace lock owns the exact Wrangler version, and Pages production/preview execute it through
+the pinned pnpm toolchain. Preview cleanup is intentionally different: its tombstone is a standalone
+static directory, so the cleanup action may use its isolated npm installation without entering the
+pnpm workspace.
+
 The Pages project is selected by `CLOUDFLARE_PAGES_PROJECT`; deployment uses the protected
 `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`. After upload, the workflow smoke-tests both the
 Pages deployment URL and `https://app.inkcre.dev`. Production delivery has no Extension Registry

package.json

@@ -22,7 +22,6 @@
     "format:check": "oxfmt --check .",
     "lint": "oxlint .",
     "lint:type-aware": "oxlint --type-aware .",
-    "audit:dependencies": "node scripts/audit-dependencies.mjs",
     "type-check": "pnpm check:workspace && pnpm check:runtime && pnpm check:database && pnpm -r run type-check",
     "type-check:ui": "node scripts/type-check-ui.mjs",
     "type-check:ts7": "node node_modules/@typescript/native/bin/tsc --project packages/core/tsconfig.json --noEmit",
@@ -52,7 +51,8 @@
     "portless": "0.12.0",
     "semver": "7.8.5",
     "supabase": "2.112.0",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "wrangler": "4.114.0"
   },
   "devEngines": {
     "runtime": {