[steph4n-gh]

Scope

• Add root npm Renovate configuration using config:recommended, at most two ordinary PRs per hour/concurrently, ordinary major Dashboard approval, and no automerge. Security alerts can bypass Dashboard approval but still require human merge.
• Document the gardener step for Three.js updates: run npm ci and npm run vendor:refresh, review and commit the module, core, and license under dist/vendor/, then rerun Checks and trusted Tau-Gate. Existing vendor parity and browser CI intentionally fail stale-runtime proposals.

Validation

• Renovate 44.181.5 strict validator: passed.
• npm ci, npm run check, and npm run check:browser: passed locally, including WebGL render smoke. git diff --check: passed.
• Final head 4c57bcd: Checks and trusted npm evidence review passed. Independent patch review found no remaining material issue.

Limits

• Hosted Renovate does not run the vendor refresh; a bot PR remains a proposal requiring gardener completion and human merge. The browser smoke is bounded. No dependency version was changed here. Renovate app access to this repository was not changed or verified, so live bot behavior is not yet established.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T00:56:29.727779Z	4c57bcd	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.