ci: harden automation and refresh verification evidence

.github/dependabot.yml

@@ -6,8 +6,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-      day: "monday"
-      time: "09:00"
+      day: "thursday"
+      time: "10:40"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     versioning-strategy: increase
@@ -42,8 +42,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-      day: "monday"
-      time: "09:00"
+      day: "friday"
+      time: "10:40"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     groups:
@@ -68,7 +68,7 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
-      time: "09:00"
+      time: "10:50"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     groups:
@@ -93,8 +93,8 @@ updates:
     directory: "/infra/terraform"
     schedule:
       interval: "weekly"
-      day: "monday"
-      time: "09:00"
+      day: "tuesday"
+      time: "10:50"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     groups:

.github/workflows/secret-scan.yml

@@ -5,7 +5,7 @@ on:
   push:
     branches: [main]
   schedule:
-    - cron: "17 3 * * 1"
+    - cron: "23 6 * * 6"
   workflow_dispatch:
 
 permissions:
@@ -32,8 +32,8 @@ jobs:
           base_url="https://github.com/gitleaks/gitleaks/releases/download/v${version}"
           archive="gitleaks_${version}_linux_x64.tar.gz"
           curl -sSfL "${base_url}/${archive}" -o "${archive}"
-          curl -sSfL "${base_url}/gitleaks_${version}_checksums.txt" -o checksums.txt
-          grep " ${archive}$" checksums.txt | sha256sum -c -
+          expected_sha256="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+          printf '%s  %s\n' "${expected_sha256}" "${archive}" | sha256sum -c -
           tar -xzf "${archive}" gitleaks
           sudo install -m 0755 gitleaks /usr/local/bin/gitleaks
           gitleaks version

site/verification.html

@@ -91,7 +91,7 @@ <h2>Checked-in evidence inventory</h2>
       <h3>Verification commands</h3>
       <ul><li><code>npm run verify</code></li><li><code>npm run test</code></li><li><code>npm run lint</code></li><li><code>npm run typecheck</code></li><li><code>npm run build</code></li></ul>
       <h3>Test files</h3>
-      <ul><li><code>src/__tests__/core/prompts/hermes-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/morph-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/qwen3coder-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/assistant-tool-calls-to-text.serialization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-result-normalizer.normalization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-role-to-user-message.conversion.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/yaml-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/protocols/protocol.factory-guards.test.ts</code></li><li><code>src/__tests__/core/utils/dynamic-tool-schema.unit.test.ts</code></li><li><code>src/__tests__/core/utils/generated-text-json-recovery.unit.test.ts</code></li><li><code>src/__tests__/core/utils/get-potential-start-index.unit.test.ts</code></li><li><code>src/__tests__/core/utils/id.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-error.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-event.unit.test.ts</code></li><li><code>src/__tests__/core/utils/streamed-tool-input-delta.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tool-call-coercion.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tool-choice.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tool-input-streaming.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tools.unit.test.ts</code></li><li><code>src/__tests__/core/utils/type-guards.unit.test.ts</code></li></ul>
+      <ul><li><code>experiments/claude-cli-prompt-bfcl-ralph/test_run_claude_cli_prompt_bfcl_ralph.py</code></li><li><code>experiments/gemini-cli-prompt-bfcl-ralph/test_run_gemini_cli_prompt_bfcl_ralph.py</code></li><li><code>experiments/grok-prompt-bfcl-ralph/test_run_grok_prompt_bfcl_ralph.py</code></li><li><code>experiments/kiro-cli-prompt-bfcl-ralph/test_run_kiro_cli_prompt_bfcl_ralph.py</code></li><li><code>experiments/openai-compatible-prompt-bfcl-ralph/test_run_openai_compatible_prompt_bfcl_ralph.py</code></li><li><code>experiments/prompt-bfcl-ralph-matrix/test_run_prompt_bfcl_ralph_matrix.py</code></li><li><code>src/__tests__/core/prompts/hermes-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/morph-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/qwen3coder-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/assistant-tool-calls-to-text.serialization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-result-normalizer.normalization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-role-to-user-message.conversion.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/yaml-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/protocols/protocol.factory-guards.test.ts</code></li><li><code>src/__tests__/core/utils/dynamic-tool-schema.unit.test.ts</code></li><li><code>src/__tests__/core/utils/generated-text-json-recovery.unit.test.ts</code></li><li><code>src/__tests__/core/utils/get-potential-start-index.unit.test.ts</code></li><li><code>src/__tests__/core/utils/id.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-error.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-event.unit.test.ts</code></li></ul>
       <h3>Continuous integration workflows</h3>
       <ul><li><code>.github/workflows/architecture-blueprint.yml</code></li><li><code>.github/workflows/ci.yml</code></li><li><code>.github/workflows/code-quality.yml</code></li><li><code>.github/workflows/dependency-review.yml</code></li><li><code>.github/workflows/pages-auto-deploy.yml</code></li><li><code>.github/workflows/repository-health.yml</code></li><li><code>.github/workflows/repository-surface.yml</code></li><li><code>.github/workflows/secret-scan.yml</code></li></ul>
       <h2>How to interpret the result</h2>