Context: follow-up from PR #18 and its final dual-review triage.
The session-start integration test should preserve the end-to-end property that it executes the exact npx rfc2119@<version> hook … command installed for users, while ensuring command resolution cannot silently fetch or execute a published package instead of the artifact under test.
This was deferred from PR #18 because replacing the installed command with a direct local CLI invocation would weaken the production-command evidence. A solution should provide a controlled local package/tarball or registry fixture, execute the emitted command unchanged, assert the resolved package identity, and fail loudly if resolution escapes that controlled artifact.
Context: follow-up from PR #18 and its final dual-review triage.
The session-start integration test should preserve the end-to-end property that it executes the exact
npx rfc2119@<version> hook …command installed for users, while ensuring command resolution cannot silently fetch or execute a published package instead of the artifact under test.This was deferred from PR #18 because replacing the installed command with a direct local CLI invocation would weaken the production-command evidence. A solution should provide a controlled local package/tarball or registry fixture, execute the emitted command unchanged, assert the resolved package identity, and fail loudly if resolution escapes that controlled artifact.