From 850c3a1196e34e5fc646674ebd76f9f9e05ba977 Mon Sep 17 00:00:00 2001
From: reprewindai-dev <reprewindai@gmail.com>
Date: Fri, 28 Aug 2026 22:13:54 -0400
Subject: [PATCH 1/5] ci(security): add lint and dependency audit gates

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f811a5..405d0a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,5 +15,7 @@ jobs:
           node-version: 20
           cache: npm
       - run: npm ci
+      - run: npm run lint
       - run: npm test
+      - run: npm audit --audit-level=high
       - run: npm run build

From 5db03fc93a0d134c1bfb3cce3932884111396068 Mon Sep 17 00:00:00 2001
From: reprewindai-dev <reprewindai@gmail.com>
Date: Sat, 29 Aug 2026 00:12:57 -0400
Subject: [PATCH 2/5] fix(ci): use direct ESLint CLI on Next 16

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a627665..78bbed0 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint .",
     "test": "vitest run"
   },
   "dependencies": {

From 71ba4b1b37d57ede230c90485eb9f6ff32d73a99 Mon Sep 17 00:00:00 2001
From: reprewindai-dev <reprewindai@gmail.com>
Date: Sat, 29 Aug 2026 00:13:02 -0400
Subject: [PATCH 3/5] fix(ci): add Next 16 flat ESLint config

---
 eslint.config.mjs | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 eslint.config.mjs

diff --git a/eslint.config.mjs b/eslint.config.mjs
new file mode 100644
index 0000000..b97117b
--- /dev/null
+++ b/eslint.config.mjs
@@ -0,0 +1,7 @@
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+
+export default defineConfig([
+  ...nextVitals,
+  globalIgnores([".next/**", "out/**", "build/**", "next-env.d.ts"]),
+]);

From 1d7b0d403060d8f8c1d84b910093b68a55944c5c Mon Sep 17 00:00:00 2001
From: reprewindai-dev <reprewindai@gmail.com>
Date: Sat, 29 Aug 2026 00:13:51 -0400
Subject: [PATCH 4/5] ci: run cAPI verification gates independently

---
 .github/workflows/ci.yml | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 405d0a2..3f58f4c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
 
 jobs:
-  verify:
+  lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -16,6 +16,36 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run lint
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
       - run: npm test
+
+  dependency-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
       - run: npm audit --audit-level=high
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
       - run: npm run build

From 2f4a3194f74d0eb426bec061a6d6ca65ee680ec3 Mon Sep 17 00:00:00 2001
From: reprewindai-dev <reprewindai@gmail.com>
Date: Sat, 29 Aug 2026 16:16:13 -0400
Subject: [PATCH 5/5] ci: preserve protected verify gate

---
 .github/workflows/ci.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3f58f4c..12c7a5c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,3 +49,15 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
+
+  verify:
+    if: ${{ always() }}
+    needs: [lint, test, dependency-audit, build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all cAPI CI gates
+        run: |
+          test "${{ needs.lint.result }}" = "success"
+          test "${{ needs.test.result }}" = "success"
+          test "${{ needs.dependency-audit.result }}" = "success"
+          test "${{ needs.build.result }}" = "success"