Skip to content

Commit a4defda

Browse files
feat(operator): T032-i1 — two measured defect:install rows become named refusals at one seam
refuseNamedNpmFailure/readNpmFailure lift npm's error lines VERBATIM (both spellings). install.git-dependency-policy-not-declared converted by the fifth policy --allow-git-dependencies (default OFF, gitDependencies as name@spec from the lockfile, gitDependenciesAllowed record). install.closure-registry- unreachable: policy-free refusal requiring an npm-named code (CERT_HAS_EXPIRED + named siblings) AND a non-npmjs request host — npmjs failures stay defects (host connectivity, not the closure's pin). Measured texts on disk quoted byte-exact; shim-npm end-to-end; unclassified codes still defect. Census 198, trust valid, coverage {23,11,2,5,5}, composite 140ce86e, suite 2816.
1 parent 46228f9 commit a4defda

13 files changed

Lines changed: 913 additions & 78 deletions

File tree

evidence/runs/operator-flows/refusal-census.json

Lines changed: 79 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@
1212
],
1313
"filesScanned": 85,
1414
"summary": {
15-
"sites": 196,
15+
"sites": 198,
1616
"byOrigin": {
1717
"frozen-adapter": 101,
18-
"pipeline": 95
18+
"pipeline": 97
1919
},
2020
"byClassification": {
2121
"defect": 5,
22-
"refusal": 141,
22+
"refusal": 143,
2323
"unclassified": 50
2424
},
2525
"byStage": {
@@ -31,7 +31,7 @@
3131
"build": 9,
3232
"era-cell": 9,
3333
"ingest": 17,
34-
"install": 11,
34+
"install": 13,
3535
"license-at-pin": 4,
3636
"not-reached": 69,
3737
"plan": 24,
@@ -41,7 +41,7 @@
4141
"witness": 1,
4242
"witness-synthesize": 2
4343
},
44-
"distinctCodes": 196,
44+
"distinctCodes": 198,
4545
"recordedRefusalSites": 99
4646
},
4747
"entries": [
@@ -876,7 +876,7 @@
876876
"stage": "arguments",
877877
"stageBasis": "the command surface parses and validates arguments here before any stage runs.",
878878
"file": "packages/cli/src/operator/flows.ts",
879-
"line": 399,
879+
"line": 403,
880880
"enclosing": "parseOperatorArguments"
881881
},
882882
{
@@ -894,7 +894,7 @@
894894
"stage": "arguments",
895895
"stageBasis": "the command surface parses and validates arguments here before any stage runs.",
896896
"file": "packages/cli/src/operator/flows.ts",
897-
"line": 407,
897+
"line": 411,
898898
"enclosing": "parseOperatorArguments"
899899
},
900900
{
@@ -909,7 +909,7 @@
909909
"stage": "arguments",
910910
"stageBasis": "the command surface parses and validates arguments here before any stage runs.",
911911
"file": "packages/cli/src/operator/flows.ts",
912-
"line": 421,
912+
"line": 425,
913913
"enclosing": "parseOperatorArguments"
914914
},
915915
{
@@ -927,7 +927,7 @@
927927
"stage": "arguments",
928928
"stageBasis": "the command surface parses and validates arguments here before any stage runs.",
929929
"file": "packages/cli/src/operator/flows.ts",
930-
"line": 434,
930+
"line": 438,
931931
"enclosing": "parseOperatorArguments"
932932
},
933933
{
@@ -944,7 +944,7 @@
944944
"stage": "arguments",
945945
"stageBasis": "the command surface parses and validates arguments here before any stage runs.",
946946
"file": "packages/cli/src/operator/flows.ts",
947-
"line": 441,
947+
"line": 445,
948948
"enclosing": "parseOperatorArguments"
949949
},
950950
{
@@ -961,7 +961,7 @@
961961
"stage": "arguments",
962962
"stageBasis": "the command surface parses and validates arguments here before any stage runs.",
963963
"file": "packages/cli/src/operator/flows.ts",
964-
"line": 448,
964+
"line": 452,
965965
"enclosing": "parseOperatorArguments"
966966
},
967967
{
@@ -978,7 +978,7 @@
978978
"stage": "arguments",
979979
"stageBasis": "the command surface parses and validates arguments here before any stage runs.",
980980
"file": "packages/cli/src/operator/flows.ts",
981-
"line": 456,
981+
"line": 460,
982982
"enclosing": "parseOperatorArguments"
983983
},
984984
{
@@ -1312,7 +1312,7 @@
13121312
"stage": "install",
13131313
"stageBasis": "the install stage resolves the lane closure through this module.",
13141314
"file": "packages/cli/src/operator/install.ts",
1315-
"line": 271,
1315+
"line": 403,
13161316
"enclosing": "planLaneInstall"
13171317
},
13181318
{
@@ -1329,7 +1329,7 @@
13291329
"stage": "install",
13301330
"stageBasis": "the install stage resolves the lane closure through this module.",
13311331
"file": "packages/cli/src/operator/install.ts",
1332-
"line": 279,
1332+
"line": 411,
13331333
"enclosing": "planLaneInstall"
13341334
},
13351335
{
@@ -1348,7 +1348,7 @@
13481348
"stage": "install",
13491349
"stageBasis": "the install stage resolves the lane closure through this module.",
13501350
"file": "packages/cli/src/operator/install.ts",
1351-
"line": 305,
1351+
"line": 437,
13521352
"enclosing": "planLaneInstall"
13531353
},
13541354
{
@@ -1368,7 +1368,7 @@
13681368
"stage": "install",
13691369
"stageBasis": "the install stage resolves the lane closure through this module.",
13701370
"file": "packages/cli/src/operator/install.ts",
1371-
"line": 332,
1371+
"line": 464,
13721372
"enclosing": "planLaneInstall"
13731373
},
13741374
{
@@ -1386,7 +1386,7 @@
13861386
"stage": "install",
13871387
"stageBasis": "the install stage resolves the lane closure through this module.",
13881388
"file": "packages/cli/src/operator/install.ts",
1389-
"line": 340,
1389+
"line": 472,
13901390
"enclosing": "planLaneInstall"
13911391
},
13921392
{
@@ -1404,7 +1404,7 @@
14041404
"stage": "install",
14051405
"stageBasis": "the install stage resolves the lane closure through this module.",
14061406
"file": "packages/cli/src/operator/install.ts",
1407-
"line": 357,
1407+
"line": 489,
14081408
"enclosing": "planLaneInstall"
14091409
},
14101410
{
@@ -1424,7 +1424,7 @@
14241424
"stage": "install",
14251425
"stageBasis": "the install stage resolves the lane closure through this module.",
14261426
"file": "packages/cli/src/operator/install.ts",
1427-
"line": 365,
1427+
"line": 497,
14281428
"enclosing": "planLaneInstall"
14291429
},
14301430
{
@@ -1443,45 +1443,86 @@
14431443
"stage": "install",
14441444
"stageBasis": "the install stage resolves the lane closure through this module.",
14451445
"file": "packages/cli/src/operator/install.ts",
1446-
"line": 376,
1446+
"line": 508,
14471447
"enclosing": "planLaneInstall"
14481448
},
14491449
{
1450-
"code": "install.script-wrote-outside-lane",
1451-
"message": "Install: the closure's install scripts wrote outside the lane. ${String(writes.length)} watched path(s) under ${path.resolve(boundaryRoot)} moved while `${plan.command.join(' ')}` ran: ${writes.join('; ')}. The install ran with the install-script allowance, which permits a package's own build to run inside the lane; it does not permit it to write into the checkout that acquired it. The child was given a lane-owned HOME and a lane cwd, so this write reached the checkout by naming it rather than by inheriting it. The lane is not accepted as installed and the paths above are left as they are, so an operator can read what was attempted.",
1450+
"code": "install.peer-resolution-policy-not-declared",
1451+
"message": "Install: npm refused the lane closure with ERESOLVE — a peer dependency conflict between the application's own era pins and the build toolchain the lane now declares. Declare --allow-peer-conflicts to install through it, which is a decision about what the lane's closure may be, or change what the lane declares. This flow does not take that decision on an operator's behalf.",
1452+
"messageForm": "static",
1453+
"staticSegments": [
1454+
"Install: npm refused the lane closure with ERESOLVE — a peer dependency conflict between the application's own era pins and the build toolchain the lane now declares. Declare --allow-peer-conflicts to install through it, which is a decision about what the lane's closure may be, or change what the lane declares. This flow does not take that decision on an operator's behalf."
1455+
],
1456+
"classification": "refusal",
1457+
"condition": "detail.includes('ERESOLVE') && !policy.allowPeerConflicts",
1458+
"conditionForm": "if-consequent",
1459+
"origin": "pipeline",
1460+
"stage": "install",
1461+
"stageBasis": "the install stage resolves the lane closure through this module.",
1462+
"file": "packages/cli/src/operator/install.ts",
1463+
"line": 1191,
1464+
"enclosing": "refuseNamedNpmFailure"
1465+
},
1466+
{
1467+
"code": "install.git-dependency-policy-not-declared",
1468+
"message": "Install: npm refused the lane closure with EALLOWGIT — the closure resolves ${String(reading.refusedSpecs.length)} dependency(ies) from a git reference${reading.refusedSpecs.length === 0 ? '' : `, first ${reading.refusedSpecs[0] ?? ''}`}, and npm fetches none of those by default. Declare --${GIT_DEPENDENCY_POLICY} to carry that policy, which is a decision about what the lane's closure may be: a git dependency is fetched by running git against a remote repository rather than by resolving a registry version, so the registry's version pin, integrity hash and provenance do not apply to it. This flow does not take that decision on an operator's behalf. ${verbatim(reading)}",
14521469
"messageForm": "composed",
14531470
"staticSegments": [
1454-
"Install: the closure's install scripts wrote outside the lane.",
1455-
"watched path(s) under",
1456-
"moved while `",
1457-
"` ran:",
1458-
". The install ran with the install-script allowance, which permits a package's own build to run inside the lane; it does not permit it to write into the checkout that acquired it. The child was given a lane-owned HOME and a lane cwd, so this write reached the checkout by naming it rather than by inheriting it. The lane is not accepted as installed and the paths above are left as they are, so an operator can read what was attempted."
1471+
"Install: npm refused the lane closure with EALLOWGIT — the closure resolves",
1472+
"dependency(ies) from a git reference",
1473+
", and npm fetches none of those by default. Declare --",
1474+
"to carry that policy, which is a decision about what the lane's closure may be: a git dependency is fetched by running git against a remote repository rather than by resolving a registry version, so the registry's version pin, integrity hash and provenance do not apply to it. This flow does not take that decision on an operator's behalf."
14591475
],
14601476
"classification": "refusal",
1461-
"condition": "writes.length > 0",
1477+
"condition": "reading.code === 'EALLOWGIT' && !policy.allowGitDependencies",
14621478
"conditionForm": "if-consequent",
14631479
"origin": "pipeline",
14641480
"stage": "install",
14651481
"stageBasis": "the install stage resolves the lane closure through this module.",
14661482
"file": "packages/cli/src/operator/install.ts",
1467-
"line": 983,
1468-
"enclosing": "runLaneInstall"
1483+
"line": 1205,
1484+
"enclosing": "refuseNamedNpmFailure"
14691485
},
14701486
{
1471-
"code": "install.peer-resolution-policy-not-declared",
1472-
"message": "Install: npm refused the lane closure with ERESOLVE — a peer dependency conflict between the application's own era pins and the build toolchain the lane now declares. Declare --allow-peer-conflicts to install through it, which is a decision about what the lane's closure may be, or change what the lane declares. This flow does not take that decision on an operator's behalf.",
1473-
"messageForm": "static",
1487+
"code": "install.closure-registry-unreachable",
1488+
"message": "Install: this closure pins ${reading.request.host}, and npm could not reach it — ${reading.code}, requesting ${reading.request.url}. There is no policy to declare here and this flow offers none: no allowance makes an unreachable registry answer, and a closure that resolves through a registry that is gone cannot be installed as recorded. What this establishes is that this run did not reach ${reading.request.host}; whether that host is retired or momentarily unreachable is not established here, and neither is what it would have served. The remedy is re-pinning the closure onto a registry that answers, which changes what the application declares and is therefore a migration decision rather than an install policy. ${verbatim(reading)}",
1489+
"messageForm": "composed",
14741490
"staticSegments": [
1475-
"Install: npm refused the lane closure with ERESOLVE — a peer dependency conflict between the application's own era pins and the build toolchain the lane now declares. Declare --allow-peer-conflicts to install through it, which is a decision about what the lane's closure may be, or change what the lane declares. This flow does not take that decision on an operator's behalf."
1491+
"Install: this closure pins",
1492+
", and npm could not reach it —",
1493+
", requesting",
1494+
". There is no policy to declare here and this flow offers none: no allowance makes an unreachable registry answer, and a closure that resolves through a registry that is gone cannot be installed as recorded. What this establishes is that this run did not reach",
1495+
"; whether that host is retired or momentarily unreachable is not established here, and neither is what it would have served. The remedy is re-pinning the closure onto a registry that answers, which changes what the application declares and is therefore a migration decision rather than an install policy."
14761496
],
14771497
"classification": "refusal",
1478-
"condition": "detail.includes('ERESOLVE') && !policy.allowPeerConflicts",
1498+
"condition": "reading.code !== null && REGISTRY_UNREACHABLE_CODES.includes(reading.code) && reading.request !== null && reading.request.host !== DEFAULT_REGISTRY_HOST",
1499+
"conditionForm": "if-consequent",
1500+
"origin": "pipeline",
1501+
"stage": "install",
1502+
"stageBasis": "the install stage resolves the lane closure through this module.",
1503+
"file": "packages/cli/src/operator/install.ts",
1504+
"line": 1230,
1505+
"enclosing": "refuseNamedNpmFailure"
1506+
},
1507+
{
1508+
"code": "install.script-wrote-outside-lane",
1509+
"message": "Install: the closure's install scripts wrote outside the lane. ${String(writes.length)} watched path(s) under ${path.resolve(boundaryRoot)} moved while `${plan.command.join(' ')}` ran: ${writes.join('; ')}. The install ran with the install-script allowance, which permits a package's own build to run inside the lane; it does not permit it to write into the checkout that acquired it. The child was given a lane-owned HOME and a lane cwd, so this write reached the checkout by naming it rather than by inheriting it. The lane is not accepted as installed and the paths above are left as they are, so an operator can read what was attempted.",
1510+
"messageForm": "composed",
1511+
"staticSegments": [
1512+
"Install: the closure's install scripts wrote outside the lane.",
1513+
"watched path(s) under",
1514+
"moved while `",
1515+
"` ran:",
1516+
". The install ran with the install-script allowance, which permits a package's own build to run inside the lane; it does not permit it to write into the checkout that acquired it. The child was given a lane-owned HOME and a lane cwd, so this write reached the checkout by naming it rather than by inheriting it. The lane is not accepted as installed and the paths above are left as they are, so an operator can read what was attempted."
1517+
],
1518+
"classification": "refusal",
1519+
"condition": "writes.length > 0",
14791520
"conditionForm": "if-consequent",
14801521
"origin": "pipeline",
14811522
"stage": "install",
14821523
"stageBasis": "the install stage resolves the lane closure through this module.",
14831524
"file": "packages/cli/src/operator/install.ts",
1484-
"line": 1000,
1525+
"line": 1287,
14851526
"enclosing": "runLaneInstall"
14861527
},
14871528
{
@@ -1499,7 +1540,7 @@
14991540
"stage": "install",
15001541
"stageBasis": "the install stage resolves the lane closure through this module.",
15011542
"file": "packages/cli/src/operator/install.ts",
1502-
"line": 1027,
1543+
"line": 1323,
15031544
"enclosing": "runLaneInstall"
15041545
},
15051546
{
@@ -1785,7 +1826,7 @@
17851826
"stage": "arguments",
17861827
"stageBasis": "the run flow composes every stage in order here; what it raises of its own is about the chaining, before any stage decides anything.",
17871828
"file": "packages/cli/src/operator/run.ts",
1788-
"line": 542,
1829+
"line": 543,
17891830
"enclosing": "applied"
17901831
},
17911832
{

evidence/trust/current/coverage-report.json

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -296,14 +296,14 @@
296296
"source": "evidence/runs/operator-flows/refusal-census.json",
297297
"adapterFreezeComposite": "140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562",
298298
"totals": {
299-
"sites": 196,
299+
"sites": 198,
300300
"byOrigin": {
301301
"frozen-adapter": 101,
302-
"pipeline": 95
302+
"pipeline": 97
303303
},
304304
"byClassification": {
305305
"defect": 5,
306-
"refusal": 141,
306+
"refusal": 143,
307307
"unclassified": 50
308308
},
309309
"byStage": {
@@ -315,7 +315,7 @@
315315
"build": 9,
316316
"era-cell": 9,
317317
"ingest": 17,
318-
"install": 11,
318+
"install": 13,
319319
"license-at-pin": 4,
320320
"not-reached": 69,
321321
"plan": 24,
@@ -325,7 +325,7 @@
325325
"witness": 1,
326326
"witness-synthesize": 2
327327
},
328-
"distinctCodes": 196,
328+
"distinctCodes": 198,
329329
"recordedRefusalSites": 99
330330
},
331331
"byCode": {
@@ -405,8 +405,10 @@
405405
"install.lockfile-unreadable": 1,
406406
"install.remote-tarball-policy-not-declared": 1,
407407
"install.install-script-policy-not-declared": 1,
408-
"install.script-wrote-outside-lane": 1,
409408
"install.peer-resolution-policy-not-declared": 1,
409+
"install.git-dependency-policy-not-declared": 1,
410+
"install.closure-registry-unreachable": 1,
411+
"install.script-wrote-outside-lane": 1,
410412
"pipeline.install.install": 1,
411413
"license-at-pin.licence-file-absent": 1,
412414
"license-at-pin.root-licence-files-state-different-identifiers": 1,
@@ -542,7 +544,7 @@
542544
],
543545
"integrity": {
544546
"algorithm": "sha256",
545-
"canonicalDigest": "7255ac03d2e7916569827a633850323cb551dbd542dadd726b359c559f183f2d",
547+
"canonicalDigest": "794a68737d4a0ee07ddfefd6298ce1632006f4d32e930eec261879a01b3edfa2",
546548
"authenticity": "not-established",
547549
"certification": "not-claimed"
548550
}

evidence/trust/current/coverage-report.md

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ What the fleet pipeline proved, per application, against the sealed baseline it
44

55
- Schema: `versionless.coverage-report.v1`
66
- Certification state: **not-certified**
7-
- Canonical SHA-256: `7255ac03d2e7916569827a633850323cb551dbd542dadd726b359c559f183f2d`
7+
- Canonical SHA-256: `794a68737d4a0ee07ddfefd6298ce1632006f4d32e930eec261879a01b3edfa2`
88
- Integrity: hash-only; authenticity is not established
99

1010
Every green cell below is filtered out of the Judge counting ledger the corpus derived and cross-checked against that corpus numerator and denominator. No cell is listed by hand, and a cell edited into this record fails re-derivation.
@@ -81,12 +81,12 @@ An application admitted through `versionless run` is recorded proven only if its
8181

8282
Source: `evidence/runs/operator-flows/refusal-census.json`, taken under adapter freeze composite `140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562`.
8383

84-
- `byClassification`: {"defect":5,"refusal":141,"unclassified":50}
85-
- `byOrigin`: {"frozen-adapter":101,"pipeline":95}
86-
- `byStage`: {"acquire":14,"analyze":2,"apply":5,"arguments":8,"batch":6,"build":9,"era-cell":9,"ingest":17,"install":11,"license-at-pin":4,"not-reached":69,"plan":24,"plan-or-build":13,"refusal-census":1,"supported-matrix":1,"witness":1,"witness-synthesize":2}
87-
- `distinctCodes`: 196
84+
- `byClassification`: {"defect":5,"refusal":143,"unclassified":50}
85+
- `byOrigin`: {"frozen-adapter":101,"pipeline":97}
86+
- `byStage`: {"acquire":14,"analyze":2,"apply":5,"arguments":8,"batch":6,"build":9,"era-cell":9,"ingest":17,"install":13,"license-at-pin":4,"not-reached":69,"plan":24,"plan-or-build":13,"refusal-census":1,"supported-matrix":1,"witness":1,"witness-synthesize":2}
87+
- `distinctCodes`: 198
8888
- `recordedRefusalSites`: 99
89-
- `sites`: 196
89+
- `sites`: 198
9090

9191
### Sites per code
9292

@@ -254,6 +254,8 @@ Source: `evidence/runs/operator-flows/refusal-census.json`, taken under adapter
254254
- `ingest.lockfile-closure-unreadable`: 1
255255
- `ingest.revision-not-determined`: 1
256256
- `ingest.source-root-not-a-directory`: 1
257+
- `install.closure-registry-unreachable`: 1
258+
- `install.git-dependency-policy-not-declared`: 1
257259
- `install.install-script-policy-conflicts`: 1
258260
- `install.install-script-policy-not-declared`: 1
259261
- `install.lockfile-absent`: 1

evidence/trust/current/enterprise-report.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"slsaLevel": "not-claimed"
99
},
1010
"derivedFrom": {
11-
"trustManifestCanonicalDigest": "65ea22f50d2bf724ae8e6da35f568eb1cce7712cd23134b8a6b5942fa7f21e12",
11+
"trustManifestCanonicalDigest": "d1232e1fb4d75d96e323d7c921f5e7301c498eeeb97fafda5b1dd8eaf6931a9f",
1212
"deterministicCoreDigest": "c4c65feb38c59e70d4a96040a0bcf5dabe4bc2e6f52b6c0b6fb63bacff29a45e",
1313
"corpusConformanceDigest": "101412703cc116969dd562a6ea46dde3d05424ad5194e535aca9750e373bc482",
1414
"adapterFreezeComposite": "140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562",

evidence/trust/current/enterprise-report.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
One machine artifact for an enterprise reviewer, derived entirely from canonical receipts the trust package already verified. It states what was proven, on which sources, with which tools, under which commands, and — in the same document — what is unsupported, unknown, or deliberately not claimed.
44

5-
- Trust manifest canonical SHA-256: `65ea22f50d2bf724ae8e6da35f568eb1cce7712cd23134b8a6b5942fa7f21e12`
5+
- Trust manifest canonical SHA-256: `d1232e1fb4d75d96e323d7c921f5e7301c498eeeb97fafda5b1dd8eaf6931a9f`
66
- Deterministic core: `c4c65feb38c59e70d4a96040a0bcf5dabe4bc2e6f52b6c0b6fb63bacff29a45e`
77
- Corpus conformance: `101412703cc116969dd562a6ea46dde3d05424ad5194e535aca9750e373bc482`
88
- Adapter freeze: commit `ddc2870aa934be7c8bc6caaeca74095d270776d5`, composite `140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562`

0 commit comments

Comments
 (0)