feat: unvendor @async/witness — exact registry pin 0.9.0, vendor/ removed

T004 (npm-release-p1/T004-witness-unvendor, adjudicated accepted; unit returned
blocked solely on a defective PM verify probe reading .dependencies where the
dep lives in .devDependencies, unchanged semantics from the vendored era).

- root manifest: file:vendor/async-witness-0.8.0.tgz -> 0.9.0 (exact pin)
- provenance.ts: audited identity is now the installed package's exported
  bytes (0.8.0 and 0.9.0 dists are byte-identical: 4e249b3c/d1fd099b), plus a
  NAMED_WITNESS_RELEASES lineage pairing version+commit so sealed 0.8.0
  receipts stay valid under their own name; upstream commit recorded as the
  release's declaration (gitHead 5fde464), never as verified here
- trust SBOM: plain registry coordinate (purl pkg:npm/%40async/witness@0.9.0);
  kind:'file' shape retained in the schema for any future file: entry
- pins recomputed (root manifest cfe4d284, ambient lock d4d3a8f7/67987,
  cache-key candidates 98915cfd/655937df); superseded vendored-era lock state
  got no named acceptance — nothing published names it post-regen
- trust regenerated offline after a consented OSV cache refresh
  (trust:ingest --allow-network --consent-id witness-0.9-adoption, cache-only
  writes); trust:verify valid, composite 813e5941
- PM re-ran gates post-adjudication: suite 2853 passed / 2 skipped,
  trust:verify valid, frozen subtrees untouched

Author: thejackshelton

evidence/trust/current/dependency-graph.cdx.json

@@ -11,7 +11,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c528f14935ff1c3f847afc60bf0220603085793f003c7ad6b972e07503f0553d"
+          "content": "cfe4d2845a6139e51ab169037592a3f4045bd07090d2e8f41c0059985229b698"
         }
       ],
       "properties": [
@@ -53,7 +53,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c528f14935ff1c3f847afc60bf0220603085793f003c7ad6b972e07503f0553d"
+          "content": "cfe4d2845a6139e51ab169037592a3f4045bd07090d2e8f41c0059985229b698"
         }
       ],
       "properties": [
@@ -280,27 +280,14 @@
     },
     {
       "type": "library",
-      "bom-ref": "vendor:@async/witness@0.8.0",
+      "bom-ref": "pkg:npm/%40async/witness@0.9.0",
       "name": "@async/witness",
-      "version": "0.8.0",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "c15d44fac722e7f0eb1366301d093ce43910e914606fa25d83ea1c08a47f2201"
-        }
-      ],
+      "version": "0.9.0",
+      "purl": "pkg:npm/%40async/witness@0.9.0",
       "properties": [
         {
           "name": "versionless:source",
           "value": "pnpm-lock.yaml"
-        },
-        {
-          "name": "versionless:coordinate-kind",
-          "value": "file"
-        },
-        {
-          "name": "versionless:tarball",
-          "value": "vendor/async-witness-0.8.0.tgz"
         }
       ]
     },
@@ -2750,7 +2737,7 @@
         "workspace:packages/node-guard",
         "workspace:packages/trust",
         "pkg:npm/%40angular/compiler@22.1.0",
-        "vendor:@async/witness@0.8.0",
+        "pkg:npm/%40async/witness@0.9.0",
         "pkg:npm/%40emnapi/core@1.10.0",
         "pkg:npm/%40emnapi/runtime@1.10.0",
         "pkg:npm/%40emnapi/wasi-threads@1.2.1",
@@ -2971,7 +2958,7 @@
       "ref": "pkg:npm/%40angular/compiler@22.1.0"
     },
     {
-      "ref": "vendor:@async/witness@0.8.0"
+      "ref": "pkg:npm/%40async/witness@0.9.0"
     },
     {
       "ref": "pkg:npm/%40emnapi/core@1.10.0"

evidence/trust/current/enterprise-report.json

@@ -8,8 +8,8 @@
     "slsaLevel": "not-claimed"
   },
   "derivedFrom": {
-    "trustManifestCanonicalDigest": "052da685635abb0cc205916d554773b58326fed3202038484fcdd843e84f5a6f",
-    "deterministicCoreDigest": "edcf6c2ec22121c0e4251fd193eba373ada966da959d4a956ca0d07ca9daf692",
+    "trustManifestCanonicalDigest": "813e5941b7557f7d3b6ce030e124453aaa510b5a2f1b91830b05165f15886376",
+    "deterministicCoreDigest": "984ff7e3fb42ca510750017ca621207855f2cac067db8eba3db0caa6f639119c",
     "corpusConformanceDigest": "532eb5b705104f9f9af3e0dc8ae028c36b20e3ba4ade4c438533e3f341418965",
     "adapterFreezeComposite": "140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562",
     "adapterFreezeCommit": "ddc2870aa934be7c8bc6caaeca74095d270776d5"
@@ -394,19 +394,19 @@
       },
       {
         "path": "dependency-graph.cdx.json",
-        "sha256": "655b3e6941a42a687d8f76cc82491c0274e0fd86b2b771a032fad5fc526c0c36"
+        "sha256": "fded98c8ff9cae379bf1473c675e719b723adff25577f1f5e411eb920d9579ce"
       },
       {
         "path": "licenses.json",
-        "sha256": "b2d77ee0b44c91f04e56658d0df53a85e4ed0c1c4283b3aca67941982c98ab81"
+        "sha256": "8376c4bbaf8059ce38739afc94e5f13e93c80a38e35cd16960e270b46fbbac8c"
       },
       {
         "path": "vulnerabilities.json",
-        "sha256": "aa0b0970e2e128e30b044f6107b4b77136d759b0a2ee3af9d37c883fa6b8298d"
+        "sha256": "7a5fa5678910a34a7153abe96b404322f729877a67e4188631d66d617af31aca"
       },
       {
         "path": "provenance.json",
-        "sha256": "e99c66e028437a3dada2a3851c044111575028a2a9309554040e1b4d4c9167b2"
+        "sha256": "ae5fbbe27300db95922a0ebc105093476eff017b6f4fa37dcceed2bdbc008186"
       },
       {
         "path": "matrix.json",

evidence/trust/current/enterprise-report.md

@@ -2,8 +2,8 @@
 
 One machine artifact for an enterprise reviewer, derived entirely from canonical receipts the trust package already verified. It states what was proven, on which sources, with which tools, under which commands, and — in the same document — what is unsupported, unknown, or deliberately not claimed.
 
-- Trust manifest canonical SHA-256: `052da685635abb0cc205916d554773b58326fed3202038484fcdd843e84f5a6f`
-- Deterministic core: `edcf6c2ec22121c0e4251fd193eba373ada966da959d4a956ca0d07ca9daf692`
+- Trust manifest canonical SHA-256: `813e5941b7557f7d3b6ce030e124453aaa510b5a2f1b91830b05165f15886376`
+- Deterministic core: `984ff7e3fb42ca510750017ca621207855f2cac067db8eba3db0caa6f639119c`
 - Corpus conformance: `532eb5b705104f9f9af3e0dc8ae028c36b20e3ba4ade4c438533e3f341418965`
 - Adapter freeze: commit `ddc2870aa934be7c8bc6caaeca74095d270776d5`, composite `140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562`
 - Certification: **not-certified** — This package is evidence, not certification, legal assurance, PCI compliance, or SOC 2 attestation.
@@ -60,10 +60,10 @@ Tool: `versionless-local-trust-generator`, adapter frozen at commit `ddc2870aa93
 ## 3. Hashes
 
 - `adapter-freeze.json` — `0ffe4eb2552a07dd7db65faa0081f6f42073013d7fb05869c2b1bb798cdd8b51`
-- `dependency-graph.cdx.json` — `655b3e6941a42a687d8f76cc82491c0274e0fd86b2b771a032fad5fc526c0c36`
-- `licenses.json` — `b2d77ee0b44c91f04e56658d0df53a85e4ed0c1c4283b3aca67941982c98ab81`
-- `vulnerabilities.json` — `aa0b0970e2e128e30b044f6107b4b77136d759b0a2ee3af9d37c883fa6b8298d`
-- `provenance.json` — `e99c66e028437a3dada2a3851c044111575028a2a9309554040e1b4d4c9167b2`
+- `dependency-graph.cdx.json` — `fded98c8ff9cae379bf1473c675e719b723adff25577f1f5e411eb920d9579ce`
+- `licenses.json` — `8376c4bbaf8059ce38739afc94e5f13e93c80a38e35cd16960e270b46fbbac8c`
+- `vulnerabilities.json` — `7a5fa5678910a34a7153abe96b404322f729877a67e4188631d66d617af31aca`
+- `provenance.json` — `ae5fbbe27300db95922a0ebc105093476eff017b6f4fa37dcceed2bdbc008186`
 - `matrix.json` — `e616fd15930848b2ef5acb0e01efe55de247807e2de6bba39adf7aa58f516d6d`
 - `controls.json` — `a5e61dcace162ce814347f931b6f4e4f59934ea1312df79d9c817c19e0e9bef4`
 - `retention.json` — `f1a7f91607bca1de4cc15e2523a3d0791116acc9cfdf853c68b9b35aa2c07568`

evidence/trust/current/licenses.json

@@ -29,7 +29,7 @@
         "state": "verified",
         "value": "MIT",
         "candidateId": "package.json",
-        "manifestSha256": "c528f14935ff1c3f847afc60bf0220603085793f003c7ad6b972e07503f0553d"
+        "manifestSha256": "cfe4d2845a6139e51ab169037592a3f4045bd07090d2e8f41c0059985229b698"
       },
       "licenseText": {
         "state": "unknown",
@@ -174,10 +174,7 @@
     },
     {
       "name": "@async/witness",
-      "version": "0.8.0",
-      "kind": "file",
-      "tarball": "vendor/async-witness-0.8.0.tgz",
-      "sha256": "c15d44fac722e7f0eb1366301d093ce43910e914606fa25d83ea1c08a47f2201",
+      "version": "0.9.0",
       "source": "pnpm-lock.yaml",
       "spdxExpression": {
         "state": "unknown",

evidence/trust/current/manifest.json

@@ -1,34 +1,34 @@
 {
   "schemaVersion": "versionless.trust.v1",
-  "canonicalDigest": "052da685635abb0cc205916d554773b58326fed3202038484fcdd843e84f5a6f",
+  "canonicalDigest": "813e5941b7557f7d3b6ce030e124453aaa510b5a2f1b91830b05165f15886376",
   "integrity": {
     "algorithm": "sha256",
     "authenticity": "not-established",
     "certification": "not-claimed"
   },
   "deterministicCore": {
     "algorithm": "sha256",
-    "digest": "edcf6c2ec22121c0e4251fd193eba373ada966da959d4a956ca0d07ca9daf692",
+    "digest": "984ff7e3fb42ca510750017ca621207855f2cac067db8eba3db0caa6f639119c",
     "artifacts": [
       {
         "path": "adapter-freeze.json",
         "sha256": "0ffe4eb2552a07dd7db65faa0081f6f42073013d7fb05869c2b1bb798cdd8b51"
       },
       {
         "path": "dependency-graph.cdx.json",
-        "sha256": "655b3e6941a42a687d8f76cc82491c0274e0fd86b2b771a032fad5fc526c0c36"
+        "sha256": "fded98c8ff9cae379bf1473c675e719b723adff25577f1f5e411eb920d9579ce"
       },
       {
         "path": "licenses.json",
-        "sha256": "b2d77ee0b44c91f04e56658d0df53a85e4ed0c1c4283b3aca67941982c98ab81"
+        "sha256": "8376c4bbaf8059ce38739afc94e5f13e93c80a38e35cd16960e270b46fbbac8c"
       },
       {
         "path": "vulnerabilities.json",
-        "sha256": "aa0b0970e2e128e30b044f6107b4b77136d759b0a2ee3af9d37c883fa6b8298d"
+        "sha256": "7a5fa5678910a34a7153abe96b404322f729877a67e4188631d66d617af31aca"
       },
       {
         "path": "provenance.json",
-        "sha256": "e99c66e028437a3dada2a3851c044111575028a2a9309554040e1b4d4c9167b2"
+        "sha256": "ae5fbbe27300db95922a0ebc105093476eff017b6f4fa37dcceed2bdbc008186"
       },
       {
         "path": "matrix.json",
@@ -225,7 +225,7 @@
     }
   ],
   "observation": {
-    "generatedAt": "2026-08-22T03:16:32.445Z",
+    "generatedAt": "2026-08-22T03:34:30.079Z",
     "vulnerabilityFreshness": "verified"
   },
   "derivedReport": "report.md"

evidence/trust/current/provenance.json

@@ -288,7 +288,7 @@
         {
           "uri": "package.json",
           "digest": {
-            "sha256": "c528f14935ff1c3f847afc60bf0220603085793f003c7ad6b972e07503f0553d"
+            "sha256": "cfe4d2845a6139e51ab169037592a3f4045bd07090d2e8f41c0059985229b698"
           }
         },
         {
@@ -348,7 +348,7 @@
         {
           "uri": "pnpm-lock.yaml",
           "digest": {
-            "sha256": "a05cd6c698fd531c4dcb6c1117512a0c8ce463cc56edf2e7eccb89585b56066e"
+            "sha256": "d4d3a8f75460a122934a45551c24e129e751b9a086bdd296ab393a4d8426770f"
           }
         }
       ]

evidence/trust/current/report.md

@@ -1,8 +1,8 @@
 # Versionless project trust package
 
-- Canonical SHA-256: `052da685635abb0cc205916d554773b58326fed3202038484fcdd843e84f5a6f`
-- Deterministic core: `edcf6c2ec22121c0e4251fd193eba373ada966da959d4a956ca0d07ca9daf692`
-- Generated observation: `2026-08-22T03:16:32.445Z`
+- Canonical SHA-256: `813e5941b7557f7d3b6ce030e124453aaa510b5a2f1b91830b05165f15886376`
+- Deterministic core: `984ff7e3fb42ca510750017ca621207855f2cac067db8eba3db0caa6f639119c`
+- Generated observation: `2026-08-22T03:34:30.079Z`
 - Vulnerability input freshness: **verified** (seven-day maximum age)
 - Integrity: **hash-only; authenticity is not established**
 - Assurance: **this package is evidence, not certification, legal assurance, PCI compliance, or SOC 2 attestation**

evidence/trust/current/vulnerabilities.json

@@ -2,9 +2,9 @@
   "schemaVersion": "versionless.trust.v1",
   "freshness": {
     "state": "verified",
-    "observedAt": "2026-08-19T01:54:49.845Z",
+    "observedAt": "2026-08-22T03:34:11.117Z",
     "maximumAgeDays": 7,
-    "freshUntil": "2026-08-26T01:54:49.845Z"
+    "freshUntil": "2026-08-29T03:34:11.117Z"
   },
   "packages": [
     {
@@ -15,10 +15,7 @@
     },
     {
       "name": "@async/witness",
-      "version": "0.8.0",
-      "kind": "file",
-      "tarball": "vendor/async-witness-0.8.0.tgz",
-      "sha256": "c15d44fac722e7f0eb1366301d093ce43910e914606fa25d83ea1c08a47f2201",
+      "version": "0.9.0",
       "state": "verified",
       "vulnerabilities": []
     },
@@ -1188,7 +1185,7 @@
     }
   ],
   "cisaKev": {
-    "entries": 1670,
+    "entries": 1674,
     "source": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
   },
   "osv": {
@@ -1198,13 +1195,13 @@
   "sourceObservations": [
     {
       "kind": "osv-batch",
-      "observedAt": "2026-08-19T01:54:49.845Z",
+      "observedAt": "2026-08-22T03:34:11.117Z",
       "sha256": "b3ff824cc2b5fc956c5c584f05c79f31160c737f58d8678e4e31e227ae4a2117"
     },
     {
       "kind": "cisa-kev",
-      "observedAt": "2026-08-19T01:54:49.845Z",
-      "sha256": "a1833018cf3f6029aaec9ba12ee52915c609a3a39f03e12820771121a804ef6c"
+      "observedAt": "2026-08-22T03:34:11.117Z",
+      "sha256": "137884960e3f801665bfa47694e703fbc4dd1c738df5e0e5af12d325a5f8a9d5"
     }
   ],
   "ingest": {
@@ -1213,25 +1210,25 @@
     "consent": {
       "allowNetwork": true,
       "mode": "consented",
-      "consentId": "AGENTS-utilities-trust-refresh"
+      "consentId": "witness-0.9-adoption"
     },
     "sources": [
       {
         "kind": "osv-batch",
         "url": "https://api.osv.dev/v1/querybatch",
         "method": "POST",
-        "observedAt": "2026-08-19T01:54:49.845Z",
-        "requestSha256": "a503cb3e1b0a3eebbf565c906055ca799342a7587051a842ebba7c2e78d8f244",
+        "observedAt": "2026-08-22T03:34:11.117Z",
+        "requestSha256": "a043a3208bdd5193c110e855b8570968639c94df25eebe2b2a96bee834944c87",
         "responsePath": "osv.json",
         "sha256": "b3ff824cc2b5fc956c5c584f05c79f31160c737f58d8678e4e31e227ae4a2117"
       },
       {
         "kind": "cisa-kev",
         "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
         "method": "GET",
-        "observedAt": "2026-08-19T01:54:49.845Z",
+        "observedAt": "2026-08-22T03:34:11.117Z",
         "responsePath": "cisa-kev.json",
-        "sha256": "a1833018cf3f6029aaec9ba12ee52915c609a3a39f03e12820771121a804ef6c"
+        "sha256": "137884960e3f801665bfa47694e703fbc4dd1c738df5e0e5af12d325a5f8a9d5"
       }
     ]
   }

package.json

@@ -21,7 +21,7 @@
 	},
 	"devDependencies": {
 		"@angular/compiler": "22.1.0",
-		"@async/witness": "file:vendor/async-witness-0.8.0.tgz",
+		"@async/witness": "0.9.0",
 		"@types/node": "24.12.2",
 		"magic-regexp": "^0.11.0",
 		"pathe": "^2.0.3",

packages/cli/src/fixture/angular-fuxa-template-compiler-run.ts

@@ -32,8 +32,11 @@ const homeTemplate = `${appPrefix}home/home.component.html`;
 const expectedSandbox = 'allow-forms allow-scripts allow-modals allow-same-origin';
 // The fixture admits exactly one root-manifest state. Re-pinned from
 // 6acf2dd25ff7d909046736b8b78f0ca11f07e938b724756a57a00d51e5751d82 when the root manifest
-// vendored @async/witness (T037/T039); the pre-vendoring bytes no longer exist in the tree.
-const rootPackageSha256 = 'c528f14935ff1c3f847afc60bf0220603085793f003c7ad6b972e07503f0553d';
+// vendored @async/witness (T037/T039), and again from
+// c528f14935ff1c3f847afc60bf0220603085793f003c7ad6b972e07503f0553d when the vendored tarball
+// was dropped for the published @async/witness 0.9.0 registry pin (T004); neither superseded
+// manifest's bytes exist in the tree, and no published evidence names them.
+const rootPackageSha256 = 'cfe4d2845a6139e51ab169037592a3f4045bd07090d2e8f41c0059985229b698';
 const compilerPackageSha256 = '61514eabbcc40eef72135429ea3a5303dae6d67eb42b208fe9420b14067777db';
 const t153 = {
 	'receipt.json': '4d0dbd3961a7f0d8200ecbeb810284611927cdf90e18ff311a4ab0c6839ad19e',