UAN-007 Astro static integration evidence

Fixture and before-state

The tracked pre-integration site at examples/e01-album-catalog/site-before is an Astro 7.3.5 static project with home, albums, and about pages; shared site layout and navigation; public album data; CSS; and SVG mark. baseline-manifest.json contains SHA-256 hashes for its project config, pages, data, and assets. The E01 check rebuilds that fixture before packaging and confirms the integrated project retained byte-identical layout, home/about pages, data, CSS, and SVG. The album page adds the human search form and browser capability bootstrap.

Verification

Run npm run example:e01 from the package root. It builds the baseline static project from a temporary copy, builds/packs the package, installs the package into the standalone fixture, executes the example tests, then builds and verifies the integrated static output. The checks cover:

• Static index.html, albums/index.html, and about/index.html, preserved navigation, public album content, CSS, and SVG.
• Astro static output diagnostics and rejection of server output; no adapter is installed.
• Shared album lookup through local execution, the browser registry, and the page fixture.
• Astro ClientRouter page-load resync, before-swap revocation, repeat-install deduplication, unsupported-WebMCP human search, Window pagehide, and back-forward cache pageshow re-entry.
• Browser bundle exclusion checks for the HTTP and official MCP server adapters.

The WebMCP API and Astro lifecycle are simulated in Node tests. Astro's production static build is real. No graphical browser, real WebMCP implementation, agent host, deployment provider, or lilgohan.com site was tested or changed. This fixture makes no production-hosting assumption.

Dependency audit limit

The fixture pins astro@7.3.5, which resolves http-cache-semantics@4.2.0. On 2026-10-02, npm audit reports GHSA-ch52-4w7c-c8xp as high severity for that transitive package. The root development tree reports two high findings (Astro and the transitive cache package); the standalone Astro fixture reports three because Agent Native's optional Astro peer is also associated with the same Astro finding. npm audit --omit=dev on the package root reports zero vulnerabilities, and the package tarball does not bundle Astro. However, Astro consumers install Astro as their own dependency and may encounter the affected transitive package.

The registry has no patched http-cache-semantics release above 4.2.0 at this check; npm's suggested Astro 2.10.9 downgrade is a breaking major rollback and was not applied. No override was added without a patched version to target. Release remains gated on resolving the upstream advisory or an explicit risk decision.