[Atom-oh]

The application, infrastructure tooling and workload images used older dependency and runtime releases. Refresh their manifests, lockfiles and runtime configuration, and adapt the web and documentation builds to the supported framework APIs.

• Update Next.js to 16.4.5, React to 19.3.1, Node containers to 26.13.0, JavaScript AWS SDK clients to 3.1161.0, and the web test toolchain. Migrate middleware to proxy.ts, preserve its request-body limits, and retain strict application typing with the Webpack production build.
• Update Terraform to 1.17.1 and signed provider locks to AWS 6.71.0, archive 2.8.1 and random 3.9.1. Move 31 Lambda functions and two layers to Python 3.14, refresh the arm64 agent/worker images and inventory Python distribution, and align CI/runtime documentation.
• Update Strands, AgentCore and Python AWS SDK dependencies with a shared agent runtime requirements file and refreshed hash-locked provisioner/layer dependencies. Disable the real MCP SDK redirect loop while preserving pinned Host/SNI, attested tool ceilings, gateway identities and AWS_IAM authentication.
• Update Docusaurus/Faster to 3.10.2 and Mermaid to 12.3.0, resolve TypeScript/MDX compatibility across four locales, and remediate the documentation dependency graph's critical/high audit findings.

Read-only posture, frozen/default-off controls, arm64, worker CMD, web runtime HOSTNAME, IAM scope, release provenance and migration ordering are preserved. ECS retains LATEST (current Linux platform 1.4.0). CDK remains decommissioned.

Validation on the integrated dev tree:

• Web production build and 5,510 tests passed; 279 existing optional skips.
• Documentation type check, four locale builds, presentation provenance, and actual Chromium rendering of 48 Mermaid diagrams across 12 pages.
• Python 3.14 agent: 1,194 tests and 430 subtests passed; 18 existing skips. Workers: 1,706 passed; 106 existing skips. Inventory: 256 passed; provisioner/assets: 124 tests and 67 subtests passed.
• Required Node CI fixtures: 333 passed. Required disposable PostgreSQL suites: 73 passed, no skips.
• Both Terraform roots validated; formatting and 45 isolated provider mock plans passed. Release/image/read/deploy/workflow contracts: 125 tests and 369 subtests passed.
• Real SDK transport/streaming contracts, dependency closure and hash checks, generated context checksums, and independent code/IaC review passed. No actionable review findings.

Web and scripts/v2 npm audits report zero vulnerabilities. Documentation has zero critical/high findings; 18 moderate and three low package entries propagate from two remaining advisories, minimatch and deepmerge. A minimatch 11 override breaks serve-handler's callable export contract; deepmerge 4.3.1 is the latest release and is declared but unused by the installed SVG plugin. Both remain disclosed.

Compatibility holds for TypeScript 6, Tailwind 3, MCP 1 and the frozen ClickHouse connector are documented with the verification evidence in the refresh plan.

Scope is source, lockfiles, runtime configuration and local verification. No AWS deployment, Terraform apply, live readiness claim, or full workload image build/publication was performed.

[github-actions]

🤖 AI Code Review (two independent reviewers)

Reviewer responses: none

Status: BLOCKED — input coverage incomplete; models were not called

Review input incomplete: diff exceeds 128 KiB; split the change or implement complete bounded review batches. No models were called; no code verdict is available.

---

Triggered by commit 63cf803083d06a5d90289fb9238b9fb55d5b0abe · workflow: .github/workflows/pr-review.yml

[Atom-oh]

Replaced by four smaller PRs, in merge order:

• feat: six-pillar discovery diagnosis and trace instance observations #227
• chore: refresh Python dependencies and Lambda runtimes #228
• chore: refresh Terraform CLI and provider locks #229
• chore: refresh documentation site and runtime references #230

The final stacked Git tree exactly matches this PR head (63cf8030); no changes were dropped. Each replacement PR exposes only its own stage. Retarget each downstream PR to dev after its predecessor merges. The original branch is retained.