v0.9.0 — Prerequisites: declared once, verified before trusted

Prerequisites become a first-class object

A fresh clone is not a broken repository — but npm test without an install exits 127, and a claim used to read broken, blaming the repo for the checkout. v0.9.0 makes the install a prerequisite: declared once, deduplicated by (command, evidence content), and verified before it is trusted.

Highlights

• Prerequisites can depend on each other. build: { run: make build, requires: [node], cache: ["dist"] } — a claim listing [build, node] in the wrong order still installs before it builds. Cycles are load errors; manual setup --plan prints the deduped, ordered sequence and exits 1 while anything is unsatisfied (a CI preflight).
• A satisfied prerequisite is verified, not merely remembered. verify: re-checks a cached install: a command, or { builtin: lockfile }, which stats the tree against package-lock.json — 64 ms against 10.9 s for npm ls --depth=0 on a 403-package express tree. That 170× gap is why the cheap answer was never being run.
• share: true lets another checkout borrow a verified install. The store records where an install was verified (not a copy), re-verified at the moment of borrowing. A second express clone went from 43.0 s (install for itself) to 16.3 s end-to-end.

The honest findings

• Express ships .npmrc with package-lock=false, so "nothing to compare against" had been answered as "no" — reinstalling on every verify of a perfectly fine repo. A verifier now answers yes / no / cannot-tell, and the gap is reported where the person who can act on it is looking.
• A normalized spec re-derived its builtin from a marker string, so the verifier ran as bash -c 'builtin:lockfile' — exit 127 — and every verify distrusted its cache. Found on a real repo, not by the suite.

Verified on: a fresh expressjs/express clone (403 packages, 1261 tests) — damaged trees caught and repaired, borrowing proven across clones.

Full details: CHANGELOG · field notes