[hivecommons-hive]

Test Improvement

tests/audit-gate.test.mjs held scripts/audit-gate.mjs's ALLOWLISTED_ADVISORIES
and SECURITY.md's "Known unpatched dependency advisories" table together with a
whole-file securityMd.includes(id). That left two holes, both reproduced by
mutation before the fix:

1. A prose mention satisfies it. SECURITY.md names GHSA-ch52-4w7c-c8xp at
   lines 54 and 63 — in the paragraph recording that the entry was removed
   after upstream published http-cache-semantics 4.3.0. Adding that id back to
   ALLOWLISTED_ADVISORIES left the parity test passing.
2. The reverse direction was unchecked. unusedAllowlistEntries() forces the
   allowlist side of a removal; nothing forced the table side, so an orphaned row
   could tell a reader the gate accepts an advisory it would in fact block.
   Adding a table row for a non-allowlisted id left the suite green at 30/30.

This PR adds documentedAdvisoryIds(), which reads the GHSA ids that have a row
inside that ## section, and three tests over it:

• every allowlisted id has a table row (catches hole 1)
• every table-row id is allowlisted (catches hole 2)
• the parser cannot pass vacuously — a reformatted table that the row matcher
  stops recognising fails instead of iterating over an empty set, the same
  silent-pass failure mode audit-gate.mjs already refuses for an unreadable
  npm audit report

The existing includes() test is kept: it still catches an allowlisted id absent
from the file entirely, with a simpler message. Tests only — scripts/audit-gate.mjs
and SECURITY.md are unchanged.

Verification

Run at fb75c1a (this branch's base), node v26.10.0:

• TZ=UTC node --test tests/audit-gate.test.mjs — 30 pass / 0 fail
• npm run test:unit:coverage:check — exit 0; src files 100.00% lines /
  100.00% regions, harness files 99.63% regions (unchanged). tests/audit-gate.test.mjs
  region coverage goes 85.71% → 86.96%; its one uncovered region is pre-existing
  (reported at lines 316-318 before, 398-400 after the insertion).
• npx prettier --check tests/audit-gate.test.mjs — clean
• Mutation checks, each caught by the intended new test and by nothing else:
  deleted table row → 3 fail; prose-only id re-allowlisted → caught by the new
  table-row test while the old includes() test still passed; orphaned table row
  → 29 pass / 1 fail, the new reverse check alone.

Related Issue

Closes #1344

Overlap

Touches only tests/audit-gate.test.mjs, covering the scripts/audit-gate.mjs
↔ SECURITY.md allowlist cluster. Disjoint from the open hold-gated PRs
(#1334 mdx-active-content, #1339 devcontainer Features, #1330 DirectoryFreshness,
#1332 ci.yml trace upload, #1337 docs-contract.test.mjs broken-link policy,
#1341 e2e coverage Node major, #1343 check:links gate placement) — none of them
touch this file, scripts/audit-gate.mjs, or SECURITY.md.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.