PR-Review #448: computer-use gate hashes 154 test files as "UI sources", and an unannounced CLAUDE.md policy rewrite rides along #449

PR: #448 · Author: @Sev7eNup · Status: merged (2026-09-28)

The desktop download fix, the Custom-Node globals fix and their tests look sound — will-download is origin-gated and covered by the new table-driven security.test.ts cases, and CustomActivityExecutor.FindUnavailableGlobals plus the new GlobalVariableResolutionTests theory cover template, input default, missing, undecryptable and unreachable. Two things around the edges are worth triaging.

• mittel — scripts/release-lab/computer-use/gate.py (inventory(), uiSourceHash). The hash is computed over ui.rglob('*.tsx'), which is every .tsx under src/nodepilot-ui/src — currently 374 files, of which 154 live in src/__tests__/. A test-only change therefore invalidates coverage-review.json and blocks gate.py catalog (and with it verify), although nothing a human operates has changed. This PR itself touched src/__tests__/pages/BackupPage.test.tsx. The effect is recurring manual churn on the review note and, worse, it trains whoever refreshes the hash to do it without looking — which is exactly what the fail-closed guard is meant to prevent. Suggestion: exclude __tests__/ (and *.test.tsx) from the hashed set, so the review note tracks shippable UI only. The explicit inventories (routes, activities, settings, themes) already catch real catalog drift and are unaffected.
• mittel — no CI runs the gate, so its baseline goes stale silently. .github/workflows/ci.yml has no Python job, so gate.py catalog / test_gate.py never run before a release. test_gate.py::test_catalog_is_complete_and_drift_checked hard-asserts both the case count (164) and, through gate.py catalog, the uiSourceHash; combined with the point above it is expected to be red on the first .tsx change after merge, with nobody noticing until the release lab. Suggestion: either wire a small Python step into the existing backend/changes matrix, or state in computer-use/README.md that the baseline is refreshed at release time only.
• mittel — undisclosed scope: commit 2e61481 ("Soften the commit and language rules in CLAUDE.md") rewrites the contributor/attribution policy. The PR title and description cover desktop downloads, Custom-Node globals and the release gate; they do not mention CLAUDE.md. The commit replaces the "Contributor- & Attribution-Policy" section with "Commits & Sprache" and drops several binding statements ("für ALLE Commits ab v1.0.0", "Der GitHub-Contributor-Graph zeigt ausschließlich sev7enup", "Ein Trailer darf den Autor nie ersetzen"). Governance rules changing inside a download fix are easy to approve unseen, and CLAUDE.md § Scope asks for a minimal root-cause fix. Suggestion: land policy edits in their own PR, or at minimum name them in the description.

Not blocking, recorded here only: scripts/release-lab/README.md says "33 Activity types" where the repo's guarded count (DocumentationCountsTests) is 27 activities + 6 triggers; the figure matches catalog.ACTIVITIES but reads as a contradiction next to README.md. None of the four numbers in that file (164 cases, 33, 22, 11) are covered by DocumentationCountsTests.

This is an automated review finding from the nightly PR-review pass and needs triage before anything is acted on.