fix(coverage): validate nested npm metadata through canonical pins - #807
fix(coverage): validate nested npm metadata through canonical pins#807seonghobae wants to merge 52 commits into
Conversation
|
Warning Review limit reached
Next review available in: 6 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
📝 WalkthroughWalkthroughnpm lockfile v2/v3의 중첩 metadata-only 위치에 대한 canonical pin 검증을 추가했습니다. 관련 회귀 테스트, 정책 문서, 변경 이력과 품질 CI도 추가했습니다. Changesnpm 중첩 메타데이터 검증
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions as GitHub Actions
participant Tests as npm lock validation tests
participant Materializer as materialize_base_javascript_packages.py
participant Lockfile as npm lockfile
GitHubActions->>Tests: 대상 테스트와 커버리지 실행
Tests->>Materializer: lockfile materialization 호출
Materializer->>Lockfile: package metadata 읽기
Materializer-->>Tests: pin 검증 결과 반환
Tests-->>GitHubActions: 테스트 및 커버리지 결과 보고
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Implement the bounded GREEN slice on exact current head Apply the permanent tests and minimal production changes already specified by the branch contract:
Keep Draft and do not approve, merge, release, or change reviewer credentials. |
|
Release blocker: current branch contains only a trigger and branch-materialization workflows ( @opencode-agent address Remove every trigger, self-removing materializer, encoded patch, and branch-writing helper from the final tree. Preserve the test-first intent, but publish the four permanent implementation/test/doctoring/changelog files through ordinary reviewed commits. The final production rule may accept a metadata-only nested npm v2/v3 location only when one canonical root package with the same normalized identity and exact version has a valid public npm-registry tarball and SHA-512 SRI. Continue to reject missing canonical metadata, version mismatch, partial pins, malformed scoped identities, non-registry origins, userinfo/query/fragment/port abuse, invalid SRI, conflicting complete pins, unsafe paths, and links. Consume the lock unchanged; do not repair or synthesize metadata. Require exact-head Python 3.10/3.14 tests, 100% production statement/branch/docstring evidence, compilation, all security/supply-chain checks, current-head review, and independent approval before Ready. |
|
@jules Replace the trigger/materializer-only scope on exact live head Delete Implement the narrow npm v2/v3 rule directly: a metadata-only nested Add the BandScope-shaped positive case and every stated negative case. Run Python 3.10/3.14, focused and complete central tests, 100% production statement/branch/public-docstring coverage, Ruff, compileall, workflow contract, security and supply-chain checks, and |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
/oc Fix the current exact-head failure directly in permanent source; do not rely on, add, or retain a one-shot/branch-writer workflow. The Python 3.14 quality run proves 12 focused failures because
Add the APA 7 doctoring and CHANGELOG entry, remove |
|
@opencode-agent address The branch has been restored to a reviewable TDD state at exact head Implement the permanent change directly in
Keep |
|
@opencode-agent address Implement the permanent production change on exact current Draft head Apply the minimal two-pass validator:
Add Run: python -m coverage erase
python -m coverage run --branch -m pytest -q \
tests/test_materialize_base_javascript_packages.py \
tests/test_npm_nested_metadata_lock_validation.py
python -m coverage report \
--include=scripts/ci/materialize_base_javascript_packages.py \
--show-missing --fail-under=100
python -m interrogate scripts/ci
python -m compileall -q scripts/ci tests
pytest -qThen rerun exact-head CodeQL, Python Security, SAST, Security Scan, Secret Scan, OSV, Scorecard, SBOM, CodeRabbit/OpenCode/Noema, and keep Draft until all evidence is current and a qualifying independent approval exists. |
|
@opencode-agent address Exact head Implement the minimum permanent production correction directly in
Add the permanent production tests to the authoritative existing module, complete public docstrings, APA 7 doctoring and |
|
@opencode-agent address Implement the permanent GREEN production change for exact head Update
Then add authoritative npm v11 package-lock doctoring with APA 7 primary-source references and |
|
/oc Refetch PR #807 and repair only its live Draft head; abort if another writer moved it. Use the three failing full-suite regressions as RED evidence. Implement descriptor-relative ancestor creation and complete identity-bound rollback in |
|
@coderabbitai Please fix the three exact-head full-suite regressions directly on branch Current head
Run these failing tests first:
Then run the focused 100% coverage/docstring checks, complete central suite, Python 3.10 compatibility, compilation, and |
|
/oc Fix the exact-head The focused 101-test materializer suite and 100% production statement/branch/docstring gates pass, but the complete central suite exposes three real creation/rollback security gaps:
Add Run the focused suite with all seven materializer test files, complete central tests, 100% production statement/branch coverage and docstrings, Python 3.10/3.14 compilation, security/supply-chain workflows, and |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
expected_head='f3ef0af11863255aee1ad8b875676d656ab99a68'
printf '%s\n' '== PR head =='
git rev-parse HEAD
gh pr view 807 --repo "$repo" --json headRefOid,isDraft,state,url \
--jq '{headRefOid,isDraft,state,url}'
printf '%s\n' '== Production structure =='
ast-grep outline scripts/ci/materialize_base_javascript_packages.py --items all --view expanded
rg -n -A260 -B30 \
'def _require_descriptor_relative_capabilities\b|def _open_output_directory\b|class SecureOutputTree\b|def materialize\b|def _cleanup|def _write|def _open|def validate_head_npm_lock\b|def _validate_npm_registry_pin\b' \
scripts/ci/materialize_base_javascript_packages.py
printf '%s\n' '== Relevant test structure and assertions =='
fd -t f 'test_javascript_materializer_(creation_cleanup_security|output_security|descriptor_ancestry|output_edge_coverage)\.py' tests -x ast-grep outline {} --items all --view expanded
rg -n -A35 -B15 \
'test_materializer_rejects_missing_follow_symlink_capability_before_mutation|test_missing_ancestor_swap_never_creates_output_through_attacker_symlink|test_late_write_failure_rolls_back_every_owned_file_and_directory|supports_follow_symlinks|supports_dir_fd|rollback|cleanup|attacker_root|operator-note|project-000' \
tests
printf '%s\n' '== Workflow scope =='
sed -n '1,300p' .github/workflows/npm-nested-metadata-validation-quality-ci.ymlLength of output: 159615
The three failures are valid.
Permanent repair scope
No temporary workflow, alternate writer, stacked PR, approval, merge, or Ready-state change is included. Failed to handle agent chat message. Please try again. You are interacting with an AI system. |
|
/oc Refetch the live head and continue only if it is |
|
/oc Refetch exact live head and abort unless it is
Preserve no-follow descriptor-relative writes, identity checks, exact base/head lock validation, operator-data preservation and redacted fail-closed errors. Run the three failures first, then all 1025+ tests, require 100% statement/branch coverage, 100% public docstrings, compileall and clean diff. Commit normally to this existing branch only after GREEN; no force push, no placeholder replacement, no branch writer. |
|
@opencode-agent review Re-read the exact current head after the explicit-port doctoring correction. Confirm the final tree contains only permanent product/quality files, all nested npm metadata tests retain 100% statement/branch coverage and public docstrings, the canonical identity/version/HTTPS registry/SHA-512 boundary remains fail closed, and every direct exact-head security and supply-chain Check is successful. Submit a formal current-head verdict only; do not mutate, approve stale evidence, or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='807'
echo '== Live PR state =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,url \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,url}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf 'local_head=%s\n' "$(git rev-parse HEAD)"
printf 'head=%s\nbase=%s\n' "$head" "$base"
test "$(git rev-parse HEAD)" = "$head"
echo '== Diff scope and whitespace =='
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
echo '== Final-tree temporary artifact scan =='
fd -HI '.*(trigger|apply.*807|patch|materialize).*' .github scripts/ci docs tests 2>/dev/null || true
rg -n -i -C2 \
'workflow_dispatch|git[[:space:]]+push|gh[[:space:]]+pr|apply_pr807|npm-nested-metadata\.trigger|materialize-npm-nested-metadata|trigger-npm-nested-metadata' \
.github scripts/ci docs tests 2>/dev/null || true
echo '== Production maps and relevant implementations =='
ast-grep outline scripts/ci/materialize_base_javascript_packages.py --items all --view expanded
rg -n -A240 -B25 \
'def _require_descriptor_relative_capabilities\b|def _open_output_directory\b|def _npm_package_identity\b|def _validate_npm_registry_pin\b|def validate_head_npm_lock\b|def materialize\b|def _write_relative_file\b|def _cleanup' \
scripts/ci/materialize_base_javascript_packages.py
echo '== Relevant test definitions =='
fd -t f 'test_(npm_nested_metadata_lock_validation|javascript_materializer_.*)\.py' tests -x ast-grep outline {} --items all --view expanded
echo '== Quality workflow =='
sed -n '1,320p' .github/workflows/npm-nested-metadata-validation-quality-ci.yml
echo '== Documentation and changelog evidence =='
rg -n -A18 -B8 \
'canonical|nested|registry|SHA-512|descriptor|openat|CWE-59|CWE-367|port' \
docs/doctoring/npm-nested-metadata-canonical-pins.md CHANGELOG.md
echo '== Required checks on exact live head =='
gh pr checks "$pr" --repo "$repo" --required || true
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,status,conclusion,headSha,event,url,createdAt,updatedAt \
--jq '.[] | select(.headSha == "'"$head"'")'
echo '== Unresolved current review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body commit { oid } }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] |
select((.isResolved | not) and (.isOutdated | not)) |
{path, line, comments: [.comments.nodes[] | {author: .author.login, commit: .commit.oid, body}]}'Length of output: 111787
I reviewed only Draft head The PR diff contains ten permanent implementation, test, documentation, changelog, and quality-workflow files. The canonical npm validator remains fail closed. It derives the final The direct current-head security and supply-chain checks shown in the evidence succeeded. This includes CodeQL, dependency review, OSV, Scorecard, Strix, Trivy, Secret Scan, Semgrep, Python Security, and SBOM. However, the required quality result is not green.
I cannot confirm an all-green current-head verdict or approve this head. You are interacting with an AI system. |
|
@coderabbitai review Re-evaluate the current exact head after the documentation-only port-policy alignment. Treat the validator behavior and previous green checks as unchanged only if the head diff confirms that. Submit the verdict without branch mutation or merge. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='807'
prior_head='f3ef0af11863255aee1ad8b875676d656ab99a68'
echo '== Current PR state =='
gh pr view "$pr" --repo "$repo" \
--json number,url,state,isDraft,headRefName,headRefOid,baseRefOid,mergeStateStatus,reviewDecision \
--jq '{number,url,state,isDraft,headRefName,headRefOid,baseRefOid,mergeStateStatus,reviewDecision}'
current_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
base_head="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'local_head=%s\nprior_head=%s\ncurrent_head=%s\nbase_head=%s\n' \
"$(git rev-parse HEAD)" "$prior_head" "$current_head" "$base_head"
test "$(git rev-parse HEAD)" = "$current_head"
echo '== Commits and file delta since prior reviewed head =='
git log --oneline "${prior_head}..${current_head}"
git diff --name-status "${prior_head}" "${current_head}"
git diff --check "${prior_head}" "${current_head}"
git diff --unified=60 "${prior_head}" "${current_head}" -- \
CHANGELOG.md docs/doctoring/npm-nested-metadata-canonical-pins.md
echo '== Current PR diff scope =='
git diff --check "${base_head}" "${current_head}"
git diff --name-status "${base_head}" "${current_head}"
echo '== Production and workflow deltas since prior reviewed head =='
git diff --name-only "${prior_head}" "${current_head}" -- \
scripts/ci/materialize_base_javascript_packages.py \
tests \
.github/workflows
echo '== Exact-head checks and runs =='
gh pr checks "$pr" --repo "$repo" --required || true
gh run list --repo "$repo" --commit "$current_head" --limit 100 \
--json databaseId,name,status,conclusion,event,url,createdAt,updatedAt \
--jq '.[] | {databaseId,name,status,conclusion,event,url,createdAt,updatedAt}'
echo '== Temporary artifact scan in current tree =='
fd -HI '.*(trigger|apply.*807|patch|materialize).*' .github scripts/ci docs tests 2>/dev/null || true
rg -n -i -C2 \
'workflow_dispatch|git[[:space:]]+push|gh[[:space:]]+pr|apply_pr807|npm-nested-metadata\.trigger|materialize-npm-nested-metadata|trigger-npm-nested-metadata' \
.github scripts/ci docs tests 2>/dev/null || trueLength of output: 59554
PR The current head is identical to the prior reviewed head. There are no commits or file changes after that review. The claimed documentation-only port-policy alignment is not present in the live PR delta. Therefore, the validator behavior is unchanged. The prior quality evidence is also unchanged.
The prior blocking findings remain unresolved:
I cannot issue a green verdict or approve this head. No branch mutation, merge, or approval was performed.
|
|
@cwl-noema-review A qualifying formal GitHub review is required for protected merge. Review exact current head only and submit |
|
Submit a formal current-head GitHub review after the current checks settle. Approve only if all exact-head checks succeed and no actionable finding remains; otherwise post the concrete blocker. Do not mutate or merge. |
|
Please submit the formal current-head review conclusion after the latest exact-head checks complete. Do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='807'
echo '== PR state =='
gh pr view "$pr" --repo "$repo" \
--json number,url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision \
--jq '{number,url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'local_head=%s\nhead=%s\nbase=%s\n' "$(git rev-parse HEAD)" "$head" "$base"
test "$(git rev-parse HEAD)" = "$head"
echo '== Required checks =='
gh pr checks "$pr" --repo "$repo" --required || true
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,status,conclusion,event,url,createdAt,updatedAt \
--jq '.[] | {databaseId,name,status,conclusion,event,url,createdAt,updatedAt}'
echo '== Current relevant source =='
ast-grep outline scripts/ci/materialize_base_javascript_packages.py \
--items all --view expanded
rg -n -A130 -B20 \
'def _require_descriptor_relative_capabilities\b|def _open_output_directory\b|def _write_relative_file\b|def materialize\b|def _remove_owned_empty_directory\b|supports_follow_symlinks|Path\.mkdir' \
scripts/ci/materialize_base_javascript_packages.py
echo '== Current quality workflow references =='
rg -n -C3 \
'test_javascript_materializer_creation_cleanup_security|test_javascript_materializer|compileall|coverage|paths:' \
.github/workflows/npm-nested-metadata-validation-quality-ci.yml
echo '== Unresolved current review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body commit { oid } }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] |
select((.isResolved | not) and (.isOutdated | not)) |
{path, line, comments: [.comments.nodes[] | {author: .author.login, commit: .commit.oid, body}]}'Length of output: 32883
I reviewed Draft PR The required checks are successful. The exact-head The following blockers remain:
I did not mutate the branch, approve the PR, or merge the PR. You are interacting with an AI system. |
|
@opencode-agent review Use the newest exact head only. If every required check is green and there is no actionable finding, submit formal approval; otherwise state the blocker. Do not mutate or merge. |
|
@cwl-noema-review review Use exact-current-head evidence only. Approve formally only when required checks are green and no actionable finding remains; otherwise identify the blocker. Do not mutate or merge. |
|
@opencode-agent review Do not post another top-level acknowledgement. Submit the formal exact-head review verdict through the GitHub review API when current-head checks are complete; approve only if no blocker remains. Do not mutate or merge. |
|
@coderabbitai full review Use the exact current head only and submit the review verdict through the formal GitHub review surface; do not post another summary comment, mutate, or merge. |
Rate Limit Exceeded
|
|
@cwl-noema-review Please use the GitHub review API rather than another comment for the final exact-head verdict. Do not mutate or merge. |
|
Final action expected: use the GitHub review API for the exact current head. Approve only if current required checks are successful and no actionable finding remains; otherwise post one concrete blocking review. Do not mutate or merge. |
|
@cwl-noema-review Submit one formal exact-current-head review through GitHub's review API. Do not add another discussion comment, mutate, or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
@cwl-noema-review Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='807'
echo '== PR state =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,url \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,url}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
echo '== Required checks =='
gh pr checks "$pr" --repo "$repo" --required || true
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,status,conclusion,headSha,event,url,createdAt,updatedAt \
--jq '.[] | select(.headSha == "'"$head"'") | {databaseId,name,status,conclusion,event,url,createdAt,updatedAt}'
echo '== Unresolved current review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body commit { oid } }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] |
select((.isResolved | not) and (.isOutdated | not)) |
{path, line, comments: [.comments.nodes[] | {author: .author.login, commit: .commit.oid, body}]}'Length of output: 7852
PR The required checks pass. However, exact-head run 31163640520, This failed quality check blocks approval. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai No further discussion comments are needed. Complete the formal exact-current-head review through the review API only; do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='807'
echo '== PR state =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,url \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,url}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
echo '== Required checks =='
gh pr checks "$pr" --repo "$repo" --required || true
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,status,conclusion,headSha,event,url,createdAt,updatedAt \
--jq '.[] | select(.headSha == "'"$head"'") |
{databaseId,name,status,conclusion,event,url,createdAt,updatedAt}'
echo '== Unresolved current review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body commit { oid } }
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads.nodes[] |
select((.isResolved | not) and (.isOutdated | not)) |
{path, line, comments: [.comments.nodes[] |
{author: .author.login, commit: .commit.oid, body}]}'Length of output: 7884
PR Required checks are successful. However, exact-head workflow This failure blocks approval. No branch mutation or merge was performed. You are interacting with an AI system. |
|
@opencode-agent address Implement the remaining bounded GREEN repair on exact current Draft head Exact-head evidence is narrow: focused JavaScript materializer quality is already GREEN (101 passed;
Keep the existing canonical npm-pin contract unchanged. Make the permanent tests authoritative rather than weakening them. Rerun the focused suite, complete central suite, 100% production statement/branch/docstring checks, Python 3.10/3.14 compilation, clean-diff check, and every exact-head security/supply-chain gate. Keep Draft until all exact-head gates are terminal GREEN, automated review is current, zero actionable threads remain, and a qualifying independent non-author approval exists. |
|
@opencode-agent address Reconcile and finish the nested npm canonical-pin materializer repair on a clean current-base lease. Exact PR head is Use a trusted checkout and normally merge exact protected main into this existing branch without rewriting history. Preserve all newer protected-main behavior and the already-green canonical nested npm metadata contract. Then fix only the three production defects proven by exact-head run
Keep the existing package identity rules, exact canonical root pin/version/SHA-512 checks, hostile-origin/port/query/fragment rejection, authenticated-lock immutability, regular-blob workspace manifest requirement, and all current-main coverage/security behavior unchanged. Do not force-push, use After the resulting commit, run the creation/cleanup security regressions first, then the full focused JavaScript materializer suite with exact 100% production statement/branch/docstring coverage, complete central suite and Strix quick gate, Python 3.10/3.14 compilation, plus all exact-head Security Scan, SAST, CodeQL, Python Security, Secret Scan, OSV, Scorecard, and SBOM gates. Keep Draft until current-head automated and qualifying independent review are clean; do not merge or synthesize approval. |
2 participants
Problem
Central changed-head npm-lock validation historically required every non-link
node_moduleslocation to repeat its own registry tarball and SHA-512 integrity. npm v2/v3 can serialize workspace or peer locations with version/classification metadata while one canonical location carries the artifact pin, so valid BandScope-style entries were blocked despite an exact canonical root pin.Exact current state
f3ef0af11863255aee1ad8b875676d656ab99a68;e71fdab2ab088001f218765ecb5e3b7fabfee11a;Canonical npm metadata implementation
node_modules.node_modules/<same exact identity>in the same authenticated lock is a non-link canonical entry with identical exact version, a publicregistry.npmjs.orgHTTPS tarball, and one canonical SHA-512 SRI value.:443, query/fragment data, hostile origins, non-tarball URLs, and invalid SRI.Current exact-head evidence
At
f3ef0af11863255aee1ad8b875676d656ab99a68:scripts/ci/materialize_base_javascript_packages.pyreports 439/439 statements and 178/178 branches covered;31163640520, job92831568748, reports 3 failed, 1022 passed.The three remaining production defects are:
os.stat(..., follow_symlinks=False)support is unavailable;_open_output_directorystill creates missing path components through mutable absolute-path re-resolution rather than a descriptor-relativemkdirat/openatwalk;project-NNNdirectory does not yet remove every object created by that attempt through an inode-bound descriptor-relative cleanup while preserving pre-existing operator files.Required GREEN repair
Fix those three descriptor-publication regressions test-first without weakening the canonical npm pin contract. Cleanup and creation must remain descriptor-relative, no-follow, inode-bound, and fail closed. Do not add temporary, one-shot, self-modifying, encoded-patch, or branch-writer workflows; do not use path-based recursive deletion or follow symlinks.
Standards and merge gate
docs/doctoring/npm-nested-metadata-canonical-pins.mdrecords the trust boundary, explicit-port policy, failure and rollback behavior, and APA 7 references to npm package-lock format and Subresource Integrity. Keep Draft until the three regressions, focused suite, complete central suite, 100% production statement/branch/docstring evidence, compilation, current-head security/supply-chain checks, automated review, qualifying independent non-author approval, zero actionable threads, and branch protection all succeed without bypass.Refs ContextualWisdomLab/bandscope#751 and #748.