Adopt coordinated Node maintenance and dependency push validation

[omry]

Security and routine upgrade requests now use separate proposals, so either can refresh without replacing the other. Dependency-lockfile and maintenance-configuration pushes validate committed dependencies and refresh existing proposals.

This replaces the existing caller with the released @v1 coordinated workflow. Weekly security and quarterly upgrade schedules, project configuration, and App references are preserved. Pending requests queue instead of canceling each other.

Validation: parsed YAML and preserved inputs; project/package metadata and engines verified; production fleet caller validation passed against the live @v1 contract. The shared implementation also passed all seven live lifecycle scenarios before release.

Any legacy combined proposal will be closed as superseded during adoption, with its description preserved. A fresh security audit will generate the current proposal on the new security channel.

The consumer reference-policy test adds only the exact coordinator@v1 allowlist entry and checks rejection of other refs, repositories, and caller filenames. Seventeen local supply-chain policy tests and Black formatting pass.

Update the maintainer instructions to name the installed Actions entry, Node dependency maintenance. The caller behavior and trigger changes are unchanged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-20T18:09:29.731399Z	—	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · The coordinated workflow now runs on dependency/configuration pushes and can write PRs and issues, so trigger or validation errors could create unintended proposals.

Replaces the existing caller with the released @v1 coordinated workflow, splitting security and routine upgrade requests into separate proposals and queuing pending requests instead of canceling them. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}