ci: separate deterministic checks from live drift

[SanjithSambath]

Summary

• make pnpm test check the committed runtime manifest before any command can regenerate it
• keep test as the single deterministic always-on CI gate
• move production dependency auditing into a dependency-scoped weekly/manual workflow
• update fast-uri to the patched 3.1.4 release and fail the audit on high/critical findings
• move Python distribution smoke tests into a Python-package-scoped workflow
• keep local stale-reference checks on every pull request while moving flaky live network probes to strict weekly/manual runs
• report public-surface timeouts as audit findings instead of tracebacks

Why

This preserves every meaningful detector while separating deterministic code checks from network drift monitoring. It also closes a real ordering bug where tests regenerated mcp-manifest.json before checking it, allowing a stale committed contract to pass CI.

The remaining moderate @hono/node-server advisory affects its Windows static-file helper. This bridge does not use that helper, and the available 2.x fix requires Node 20 while the published bridge supports Node 18, so this PR reports it without adding a risky transitive major override.

Validation

• pnpm install --frozen-lockfile
• pnpm test
• pnpm audit --prod --audit-level high
• uv run --with build python/stdio-bridge/scripts/smoke-artifacts.sh
• stale-reference and public-surface self-tests
• parsed every workflow as YAML

Draft only; do not merge automatically.

[mcp-use]

Deployment #83 deployed successfully

Status	Logs	URL	Updated
	Build Logs | Runtime Logs	🔗 MCP URL	Jul 22 2026 6:29 pm

View deployment details

---

Deployed on Manufact.com