[dinakarjs]

Correct five stale src/cmcp_gateway/ references in CONTRIBUTING.md to src/cmcp_runtime/: the local mypy command, three security-critical paths, and the type-annotation convention. Existing security review requirements remain intact.

Synchronized with main c51fba5, including the merged dependency-audit repairs, at 203f5d0. Published tree 73e0e8f48b8b0ade6d4afb2fe33823eea47cf38f matches the locally tested tree. The effective PR diff remains the five path corrections in one document.

Linux/Python 3.12.14, hash-locked development environment and no-deps editable checkout: 2,601 unit tests passed, 8 skipped. Ruff, mypy (64 source files), configured Bandit, pip check and whitespace checks passed. Runtime/test/dependency bytes match current main, so these results validate the synchronized baseline without extending the documentation change's scope. No hardware execution or publication.

Current-head hosted checks and independent maintainer review remain required. Prepared with OpenAI Codex; DCO-signed.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Hosted CI follow-through: the Ubuntu 3.11 job fails during pip-audit on the inherited certifi 2026.7.22 / PYSEC-2026-4320 lock, before the later checks; sibling matrix jobs cancel. Existing PR #795 supplies the separately reviewed lock repair. After that is accepted, this documentation PR needs the updated base and a CI rerun. The maintainer approval gate also remains pending. Source-path validation is complete; full hosted CI is not green.

[carloshvp]

Reviewed exact head e2fb237dd55418948ec35b9f92d5d72347f4a5d5 in an isolated checkout.

Approving the five contributor-path corrections. Each replacement directory exists under src/cmcp_runtime, and the documented mypy target matches the actual CI command. The two-maintainer requirement and descriptions of the audit, TEE and policy boundaries are preserved.

Validation: inspected the complete documentation-only diff, checked all replacement directories and CI usage, and ran git diff --check. Runtime suites were not rerun for these path corrections. The failed hosted Ubuntu job stops at the inherited certifi audit finding; #795 addresses that dependency separately, and the cancelled matrix jobs still need a successful run. The commit carries DCO sign-off.

Reviewed with OpenAI Codex.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

Refreshed onto main c51fba5 at signed head 203f5d0. The effective diff remains only five CONTRIBUTING.md path corrections. Published tree equals the tested local tree. Local Linux/Python 3.12.14: 2,601 unit tests pass, 8 skip; configured Ruff, mypy, Bandit, pip check and PR-delta whitespace pass.

All returned current-head applicable hosted checks now succeed, including the six Linux/Windows Python matrix jobs, security/lint/type steps, governance, Docker confinement, CodeQL and maintainer gate. CI: https://github.com/agentrust-io/cmcp/actions/runs/40930131928. This clears the old audit-related failed/cancelled matrix; independent current-head review and the maintainer merge decision remain separate. No release, deployment or hardware validation was performed. Prepared with OpenAI Codex.