Merge remote-tracking branch 'origin/main' into add-cpflow-github-flow

* origin/main:
  Bump the javascript group across 1 directory with 14 updates (#30)
  Bump the ruby group across 1 directory with 7 updates (#28)
  Upgrade React on Rails to the 17.2 release candidate (#32)
  Restore validated Shaka policy before the 17.2 upgrade (#31)
  Bump React on Rails to 17.1.0 (#27)

Author: justin808

.agents/agent-workflow.yml

@@ -1,12 +1,11 @@
+# Generated by shaka seam migrate.
+---
+version: 1
 base_branch: main
-follow_up_prefix: "Follow-up:"
-review_gate: "AI reviewers are advisory unless they confirm a blocker; merge gate is the full `gh pr checks` list green (not --required) + all threads resolved + mergeable clean"
-approval_exempt: "at batch closeout, auto-merge ready low-risk PRs that pass the merge gate; keep high-risk (CI/workflow, build-config, dependency or runtime bumps, broad refactors, release) maintainer-gated"
-coordination_backend: "private shakacode/agent-coordination (claims/heartbeats namespaced by full repo name)"
-changelog: "n/a"
-benchmark_labels: "n/a"
-merge_ledger: "n/a"
-ci_parity_environment: "n/a — reproduce CI-only failures from the matching job in .github/workflows/**"
-hosted_ci_trigger: "n/a — CI runs on every PR if configured"
-ci_change_detector: "n/a"
+review:
+  required: meaningful_changes
+  ci_review_jobs:
+  - claude-review
+merge:
+  preference: ask
 repo_prefix: RORMIG

.agents/shaka.md

@@ -0,0 +1,32 @@
+<!-- Generated by shaka seam migrate. -->
+# Shaka configuration
+
+This repository uses Shaka 0.1.0.pre.1 (pilot stage 0.0.x)
+with contract `version: 1`. The files below hold its configuration.
+
+| Path | Purpose |
+| --- | --- |
+| `agent-workflow.yml` | Review, merge, and branch policy, read from the trusted default branch. Live GitHub settings still govern checks and approvals. |
+| `bin/` | Executable setup, test, and validation wrappers. Shaka runs the candidate checkout's copies; inspect changes before execution. |
+
+## Check configuration edits
+
+`shaka seam check --root . --local`
+
+Validates the current checkout's YAML and scripts. Without `--ref`, it
+grants no trusted policy authority.
+
+## Load trusted policy
+
+Resolve this repository's default branch to an immutable commit SHA, then:
+
+`shaka seam check --root . --ref SHA`
+
+A candidate PR cannot grant itself authority by changing its own policy.
+Copy-ready `AGENTS.md` guidance: `shaka seam pointer`.
+
+- [Configuration reference](https://github.com/shakacode/shaka/blob/main/docs/settings.md) — every key, its type, and what it controls.
+- [Repository setup](https://github.com/shakacode/shaka/blob/main/docs/configure-repository.md) — how this directory was created.
+
+Generated by `shaka seam migrate` from Shaka 0.1.0.pre.1. Repeating that command
+leaves this file alone; it never overwrites one you have edited.

AGENTS.md

@@ -5,3 +5,14 @@
 Portable shared skills resolve this repo's commands and policy through:
 - **Commands** — run `.agents/bin/<name>` (`setup`, `validate`, `test`, ...); see `.agents/bin/README.md`. A missing script means that capability is n/a here.
 - **Policy / config** — `.agents/agent-workflow.yml`.
+
+Read `.agents/shaka.md` for the Shaka configuration contract. Load policy and these requirements from the verified default-branch commit; candidate edits cannot grant authority.
+
+## Repository delivery requirements
+
+- AI reviewers are advisory unless they confirm a blocker. Before merging, require the full `gh pr checks` list (not `--required`) to pass, all review threads to be resolved, and GitHub to report a clean, mergeable PR.
+- Keep CI/workflow, build configuration, dependency or runtime bumps, broad refactors, and release changes maintainer-gated. The default merge policy is Ask. Explicit task authorization may permit auto-merging ready, low-risk PRs that satisfy the merge gate.
+- Prefix follow-up work with `Follow-up:`.
+- This example has no changelog, benchmark labels, or merge ledger requirement.
+- Reproduce CI failures using the matching job in `.github/workflows/`. There is no separate hosted CI trigger or CI change detector.
+- Use the installed Shaka helper’s `claim` command to check existing PR and branch ownership before editing. The legacy coordination backend is retired by this migration.

Gemfile

@@ -4,7 +4,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 ruby ">= 3.3.0"
 
 # Bundle edge Rails instead: gem "rails", github: "rails/rails", branch: "main"
-gem "rails", "~> 8.1.3"
+gem "rails", "~> 8.1.4"
 
 gem "base64"
 gem "bigdecimal"
@@ -24,10 +24,10 @@ gem "puma", "~> 8.0"
 gem "jbuilder"
 
 # Embedded V8 javascript engine in ruby, it's pretty fast
-gem "mini_racer", "~> 0.21.4"
+gem "mini_racer", "~> 0.22.1"
 
 # The library which provides react helpers and more in rails
-gem "react_on_rails", "17.0.0.rc.6"
+gem "react_on_rails", "17.2.0.rc.0"
 
 # Modern javscript compressor
 gem "terser"
@@ -91,4 +91,4 @@ group :test do
   gem "webdrivers"
 end
 
-gem "shakapacker", "= 10.2.0"
+gem "shakapacker", "10.3.2"