npm retired the `security/audits/quick` endpoint, which now 400s for this
package tree. `npm audit` exits 1 for that exactly as it does for a real
critical finding, so every PR in the repo went red on 2026-07-26 with
"Invalid package tree" — a failure no branch can fix.
The exit code alone cannot gate a merge: treating every non-zero as
vulnerable blocks the repo on an npm outage, and ignoring it retires the
gate. The payload separates them — a real audit always carries
metadata.vulnerabilities, a transport failure carries the request error.
Classify on that: a finding still fails, an unreachable endpoint warns and
passes, and anything unrecognised fails closed so a payload-shape change
gets a human rather than a silently disabled gate.
Co-authored-by: wenshao <wenshao@example.com>
