From 4bcec26f88a79f0d4e3490a369b998572082f232 Mon Sep 17 00:00:00 2001
From: Aolinge <153434584+aolingge@users.noreply.github.com>
Date: Wed, 13 May 2026 03:51:09 +0800
Subject: [PATCH 1/2] docs: add governance backlog

---
 BACKLOG.md | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 BACKLOG.md

diff --git a/BACKLOG.md b/BACKLOG.md
new file mode 100644
index 0000000..9f8f784
--- /dev/null
+++ b/BACKLOG.md
@@ -0,0 +1,20 @@
+# Backlog
+
+This backlog tracks public repository governance work that is safe to discuss in issues, PRs, and release planning. Do not add secrets, private logs, cookies, browser profiles, private URLs, or account-specific evidence here.
+
+## Current Governance Queue
+
+- Review Dependabot PR #6 for `@types/node` patch updates. Current required check `verify` is passing, but merging remains a maintainer action.
+- Keep issue #5 open as the public v0.1.0 feedback collection point until launch feedback has been triaged into concrete issues.
+- Keep main branch protection active with required PR review, stale review dismissal, strict status checks, and the `verify` required check.
+
+## Launch Hygiene
+
+- Before any new release, run `npm run check`, `npm run smoke`, and a secret/privacy scan over the changed files.
+- Keep README and launch materials aligned with the npm latest version and GitHub Pages documentation URL.
+- Avoid adoption, benchmark, security certification, or production-use claims unless there is current public evidence.
+
+## Later
+
+- Add a short Dependabot review checklist for patch, minor, and major dependency updates.
+- Add a release checklist that links launch copy, distribution notes, smoke output, and npm package metadata.

From 12e092bf2c9f927d63e0ae3e5fe5f33a1b91a734 Mon Sep 17 00:00:00 2001
From: Aolinge <153434584+aolingge@users.noreply.github.com>
Date: Wed, 30 Sep 2026 18:11:06 +0800
Subject: [PATCH 2/2] ci: pin workflow actions

---
 .github/workflows/ci.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77242e6..455c71b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,12 +12,11 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 20
           cache: npm
       - run: npm ci
       - run: npm run check
       - run: npm run smoke
-