[pithead-developer]

Closes #542

Update shfmt to 3.14.1 with its verified upstream Linux checksum, diff-cover to 10.6.0, and zizmor to 1.30.1. These are the current upstream stable releases, checked through GitHub releases and PyPI. Correct the contributor guidance and stale actionlint version in setup output. Scanner commands, online advisory lookup, permissions, checksum enforcement and coverage thresholds are preserved. Apply shfmt 3.14.1’s required subshell spacing in the existing suite.

Ponytail review: Lean already. Ship. Pins, matching guidance and required formatter-only test changes; existing CI exercises the installed tools.

Validation so far:

• FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh — pass.
• make lint-yaml (yamllint 1.38.0), make lint-actions, make lint-md, make lint-topology, git diff --check — pass.
• zizmor .github/workflows/ with 1.30.1 and online advisory lookup enabled — pass, no findings; 11 existing suppressions unchanged.
• Downloaded shfmt Linux binary SHA-256 matches the upstream release asset digest and the new workflow checksum.
• Security run 36673018798 at 64f265a4cd2a96302437c1e6ab302a40f18c55f8 — both gitleaks and zizmor pass.
• Initial CI run 36673018957: YAML/Markdown lint and Docker e2e passed; upgraded shfmt rejected ten existing nested-subshell spacing instances. Corrected with the upgraded formatter, without changing assertions. Superseded by final-head CI.

Watchers still cover XMRig release/tag resolution plus build verification, GitHub Actions and pre-commit hooks (Dependabot), and the nine existing tool-watch classes. #414 stays open as the recurring report. No extra stale runtime/build pin found among XMRig, jq or the kcov image; shellcheck, actionlint, gitleaks, lychee, yamllint and pre-commit-hooks are current. Additional stale CI tool: markdownlint-cli2 0.22.1 versus npm 0.23.3; its missing watcher coverage is tracked separately in #544.

No hardware job: these CI-only changes do not alter the worker-to-coordinator contract. No local Docker or whole host-dependent test suite was run; GitHub owns tiers 1–3.

The latest scheduled XMRig and link watcher runs (2026-09-28) both succeeded; this confirms scheduled liveness in addition to inspecting dependency class coverage. Security review: no findings.

Final head

feef108b34b9818efbcdd0d574f895e103bb41ac

• shellcheck --severity=warning tests/run.sh, shfmt -i 4 -d tests/run.sh (3.14.1), FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh, and git diff --check — pass after the formatter changes.
• Verifier re-review and security re-review of the final diff — no findings.
• Final Security run 36673266384 — both checks pass.
• Final CI run 36673266388 — all six CI jobs passed at the final head: YAML/action lint, Markdown lint, shell lint, test suite, Docker e2e and coverage. Both final Security jobs also passed; all eight checks are green.

No added runtime behavior; the existing suite and formatter gate verify the compatibility edits. Independent reviewer recorded adversarial-review PASS at the final head. The runner merged PR #543 into develop as a509635 on 2026-09-30. This resumed session verified completed checks and refreshed the evidence record.

[pithead-developer]

Ready for review

The requested three tool upgrades and verified shfmt checksum are in place, with matching contributor guidance and the ten formatter-required test spacing changes. The final diff passed both adversarial and security re-review; local checks pass and the final-head GitHub Security, YAML and Markdown checks are green. XMRig/Dependabot watcher coverage and scheduled liveness were checked, and the additional stale Markdown tool is filed as #544; #414 remains open.

The remaining final-head GitHub gates are still running, so this is an author handoff, not a claim that those checks passed. The runner must require green shell lint, suite, Docker e2e and coverage before merge. No hardware test was needed because these changes affect CI tools rather than the worker-to-coordinator contract. The PR stays draft for independent review.

[pithead-reviewer]

adversarial-review: PASS at feef108, round 1, by the pithead-reviewer reviewer (a fresh session that did not produce this head; gpt-6.1-sol).

PASS at feef108: the three CI tools are current stable releases, the shfmt checksum matches upstream, matching guidance is corrected, and security gates remain intact. Watcher coverage and scheduled liveness hold, additional dependency staleness is reported in #544, #414 remains open, and the milestone matches #542. All eight head checks pass; independent checks found no blocking correctness, security, topology, scope, or complexity issue.

Evidence

• pwd; git status --short; git rev-parse HEAD; git remote -v — correct review checkout, clean tree, head feef108, expected repository.
• Read graphify, ponytail and ponytail-review SKILL.md instructions — applied graph reconnaissance and the required complexity pass.
• gh pr view 543 --repo p2pool-starter-stack/rigforge --json … — read body, commits, comments and reviews; base develop; latest Ready for review comment is from pithead-developer; no previous return recorded.
• gh issue view 542 --repo p2pool-starter-stack/rigforge --json … — acceptance requires current tool pins, matching checksum/guidance, preserved security gates, required checks, watcher verification and additional dependency reporting.
• gh api repos/p2pool-starter-stack/rigforge — confirmed repository identity; third-party comments were not used as project authority.
• cat AGENTS.md CONTRIBUTING.md — checked repository rules, verification targets, singular file-budget gate and merge constraints.
• gh issue view 414 --repo p2pool-starter-stack/rigforge --json … — read linked recurring report; remains OPEN. Its claims were independently checked.
• gh issue view 544 --repo p2pool-starter-stack/rigforge --json … — read linked follow-up reporting stale markdownlint-cli2 and missing watcher coverage; remains OPEN.
• gh api repos/chore(ci): update stale tool pins before 2.0.0 #543 — milestone v2 - appliance.
• gh api repos/Update stale CI tool dependencies before 2.0.0 #542 — issue OPEN; same v2 - appliance milestone.
• gh pr checks 543 --repo p2pool-starter-stack/rigforge — run twice; all eight checks pass, none skipped or pending.
• git diff --stat origin/develop...HEAD; git diff origin/develop...HEAD; git diff --numstat; git log --oneline origin/develop..HEAD — five files, 18 insertions and 17 deletions, two commits. CI pins, corrected guidance/setup output and ten formatter spacing edits only; no tier-4-required production path changed.
• Read ci.yml, security.yml, xmrig-bump.yml, tool-bump.yml, dependabot.yml, Makefile, pre-commit configuration and coverage runner — traced installation, checksum enforcement, lint, coverage, security and watcher flows. No relaxed assertions, swallowed errors, stub returns, deferred logic or silently narrowed scope.
• rg over tool versions, callers and gate references — updated pins and contributor guidance agree; no obsolete copies of the three changed pins found.
• detect-topology.py --help — failed because this detector accepts filenames, not --help; read its implementation and subsequently used its supported interface.
• Python snapshot harness invoking gh api and detect-topology.py — PR body and issue comments, Update stale CI tool dependencies before 2.0.0 #542 body/comments, and linked CI tool pin currency (weekly report) #414/Track and refresh the unwatched markdownlint-cli2 pin #544 bodies/comments all returned clean.
• gh api pulls/543/comments; gh api pulls/543/reviews; detect-topology.py — zero inline comments and zero reviews; both snapshots clean.
• git worktree add --detach /head HEAD — created an isolated head checkout; source branch untouched.
• graphify --help; graphify extract /head --code-only … — extraction succeeded with 712 nodes and 1,457 edges. Documentation and unsupported fixtures were excluded; changed workflows were inspected directly.
• graphify query 'Which test and lint entry points cover CI tool upgrades?' … — succeeded; identified lint, coverage and test entry points.
• gh run view 36673018798 --repo p2pool-starter-stack/rigforge --json … — success at earlier commit 64f265a.
• gh run view 36673018798 --repo p2pool-starter-stack/rigforge --log — read 438 lines; zizmor 1.30.1, no findings, 11 suppressions; gitleaks found no leaks.
• gh run view 36673018957 --repo p2pool-starter-stack/rigforge --json … — failure at earlier commit; shell formatting failed, other five CI jobs succeeded, matching the body's historical account.
• gh run view 36673018957 --repo p2pool-starter-stack/rigforge --log — read 6,430 lines; upgraded shfmt caused the stated spacing failure. Superseded by green head validation.
• gh run view 36673266384 --repo p2pool-starter-stack/rigforge --json … — success at current head; both Security jobs succeeded.

Findings

• [note] PR chore(ci): update stale tool pins before 2.0.0 #543 body:28: Refresh final CI validation: run 36673266388 has completed successfully at the current head; the body still describes several gates as running.