[steph4n-gh]

Scope

• Add npm run vendor:refresh to copy locked Three.js module, core, and MIT license into committed browser vendor files; npm run check:vendor enforces byte parity.
• Import the app's scene module and render a small Three.js WebGL 2 frame in bounded headless Chrome. Keep the existing numerical/network checks.
• Stage Tau-Gate v4.2.1 trusted-base npm PR review with read-only pull_request_target, base-sourced helpers/approvals, pinned checker archive verification, and no fetched-head execution. No dependencies or scientific artifacts change.

Validation

• Locked Three.js 0.186.0 and all three committed vendor files matched byte for byte. npm run vendor:refresh made no tracked change; npm run check:vendor passed.
• Local npm run check, npm run check:browser, actionlint, and git diff --check passed.
• Exact-head CI passed at 1911d70: npm ci, all existing complete-graph/decision/dynamics/sensory checks, vendor parity, and Chrome WebGL 2 render (SMOKE_OK 237,83,52,255). The first CI attempt timed out initializing the full scene in software rendering; the final bounded smoke passed.
• Tau-Gate v4.2.1 release archive matched published SHA256 and a verified GitHub release-workflow attestation. Original locked Three.js archive evidence was complete with no automatic install lifecycle candidate.
• Offline Git-object review on the final head allowed unchanged evidence (exit 0). Negative controls returned incomplete for a missing head lock (exit 2) and blocked a head-edited approval file (exit 1). Independent review of the final patch found no remaining material issue.

Bootstrap and limits

• This draft's Tau-Gate workflow is not active from the current base. After trusted files reach main, repository administrators must set the documented checker URL/hash variables, verify the Actions policy permits this exact pull_request_target workflow, run live negative controls, then separately decide whether to require the check with up-to-date status. No settings or app access were changed here.
• The browser smoke tests an app-module import and one small rendered frame, not full scene construction, the 91 MB graph load, or flight reliability. Tau-Gate evidence does not prove package safety or host install selection. No merge, deployment, or dependency update is included.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T23:24:34.371015Z	1911d70	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.