feat: global emit-cli refresh script with link-drift guard (D082 update)#525
Merged
Conversation
D082 update note records the 2026-07-14 hook-signing outage: a June global npm link into the checkout reintroduced the coupling D082 removed, and a partial workspace install broke every hook fire for roughly eighteen hours. The registry install is restored; the new script is the D128-class updater and guard (reinstall, symlink-drift gates on the package and scope dirs, signed smoke envelope gate).
creatornader
enabled auto-merge (squash)
July 15, 2026 19:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fallout hardening from the 2026-07-14/15 hook-signing outage.
Research showed the outage was the third incident of one class: machine-wide hook signing resolving through the development checkout. D082 already decided the supported path (
npm install -g @atrib/emit); a June global npm link into the checkout was undocumented drift from it and reintroduced exactly the coupling D082 removed.scripts/refresh-global-emit-cli.mjs(pnpm refresh:global-emit-cli): D128-class updater and guard. Reinstalls from the registry (--checkskips the install;--versionpins), hard-fails when the global package or its@atribscope dir is a symlink, requiresdist/cli.js, and gates on a smoke envelope signing cleanly (parseable JSON,signed: true, well-formed hash, zero warnings) through the same node+cli.js invocation the hook helper uses. Smoke records use a fixed maintenance context_id so they chain together. All three negative gates tested against scratch prefixes (linked package, linked scope dir, missing cli.js all exit 1); positive path verified against the live prefix (log_index 78850).ATRIB_EMIT_CLI_BINoverride as the sanctioned latest-from-checkout path.Gates: pnpm doc-sync (14 checks), typos.