[dormouse-bot]

Regenerates the nine .github/workflows/tend-*.yaml files at tend 0.2.13 (from 0.2.11), and fixes a version claim in docs/specs/security-ci.rationale.md that the regen falsifies.

Three things change in the generated files: the max-sixty/tend/claude@ action pin, the generator header comment, and — in tend-mention.yaml and tend-notifications.yaml only — the astral-sh/setup-uv version: input, 0.12.13 → 0.12.17. That third one is worth naming because docs/specs/security-ci.md → "Automated Maintainer (tend)" singles out setup-uv as a second publisher whose uv interprets a run: step holding TEND_BOT_TOKEN; the setup-uv action ref itself (@v10.1.0) is unchanged, only the uv version it installs. No job, trigger, permission, or if: condition changes. .config/tend.yaml is untouched and pins no model, so nothing there needed revisiting.

The docs commit is separate and touches nothing in the workflow-audit.yaml window, so the regen commit stays a clean byte-for-byte reproduction for the nightly classifier. The rationale line had asserted "the checked-in workflows use 0.2.11"; it now states the 0.1.19 security floor and points at each workflow's own generated header for the version actually pinned, with 0.2.13 kept as a dated inspection datapoint — so the sentence stops rotting on every nightly bump.

What the upgrade changes for this repo, synthesized from the 0.2.11…0.2.13 comparison:

• A cancelled gating check no longer reads as green. The CI poll the bot runs after every push now reports a cancelled required check as unverified instead of passing (fix(poll): report a cancelled gating check as unverified, not green max-sixty/tend#1323), so a session can no longer close out a fix on a check that never actually ran.
• Fewer runs lost to sandbox startup. The sandbox retries its launch past a transient bridge-socket failure (fix(sandbox): retry the SRT launch past a transient bridge-socket failure max-sixty/tend#1327), and /tmp is writable inside it (Make /tmp writable inside the sandbox max-sixty/tend#1324).
• The bot's claude.ai account is kept out of CI sessions (fix(claude): keep the bot's claude.ai account out of CI sessions max-sixty/tend#1328).
• Three skill corrections that affect how the bot reasons here: run-tend's list of restored instruction paths and the events that restore them (fix(skills): correct run-tend's list of restored instruction paths and events max-sixty/tend#1311), ground-claims reading a past run's code at that run's commit rather than at HEAD (skills(ground-claims): read a past run's code at that run's commit max-sixty/tend#1319), and review-runs recognising a workflow wedged behind a run parked in waiting (skills(review-runs): find a workflow wedged behind a run parked in waiting max-sixty/tend#1320).

What is in the range but not in this bump

max-sixty/tend#1333 and max-sixty/tend#1334 ran the agent in the job's own checkout and home through a copy-on-write view; both were reverted in max-sixty/tend#1339 before 0.2.13, so the execution model is unchanged from 0.2.11. The rest of the range is release mechanics, regeneration commits, the pinned claude-code bump, tend.example.yaml documentation, and tend's own site config — none of it reaches a consumer's workflows. The uv pin is the one tool bump that does, and it is described above.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	47145e5
Status:	✅  Deploy successful!
Preview URL:	https://fc5771bc.mouseterm.pages.dev
Branch Preview URL:	https://tend-update-workflows.mouseterm.pages.dev

View logs