fix(coverage): validate nested npm metadata through canonical pins - #807

Open

seonghobae wants to merge 55 commits into

mainfrom

fix/npm-nested-metadata-lock-validation

Commits on Aug 20, 2026

test(coverage): specify nested npm metadata lock validation

seonghobae
authored and
pr-auto-rebase[bot]
committed
2d88d19
ci: add nested npm materializer trigger

seonghobae
authored and
pr-auto-rebase[bot]
committed
fe9b9ac
ci: trigger nested npm metadata materializer

seonghobae
authored and
pr-auto-rebase[bot]
committed
5818e1d
ci: add PR 807 materializer blank-line repair

seonghobae
authored and
pr-auto-rebase[bot]
committed
252ee50
ci: trigger PR 807 materializer repair

seonghobae
authored and
pr-auto-rebase[bot]
committed
f6d882d
chore(coverage): remove npm metadata materializer trigger

seonghobae
authored and
pr-auto-rebase[bot]
committed
58be8a5
chore(coverage): remove PR 807 repair trigger

seonghobae
authored and
pr-auto-rebase[bot]
committed
acbd31d
chore(coverage): remove npm metadata materializer workflow

seonghobae
authored and
pr-auto-rebase[bot]
committed
cad3701
chore(coverage): remove PR 807 repair workflow

seonghobae
authored and
pr-auto-rebase[bot]
committed
e08ec3c
chore(coverage): remove npm metadata trigger workflow

seonghobae
authored and
pr-auto-rebase[bot]
committed
bf03df1
test(coverage): define canonical-pin contract for nested npm metadata

seonghobae
authored and
pr-auto-rebase[bot]
committed
b0b1bad
ci(coverage): add permanent nested npm metadata quality gate

seonghobae
authored and
pr-auto-rebase[bot]
committed
d530b96
chore(coverage): implement nested npm metadata pins once

seonghobae
authored and
pr-auto-rebase[bot]
committed
6f3b265
chore(coverage): remove PR 807 implementation writer

seonghobae
authored and
pr-auto-rebase[bot]
committed
ceec6d7
chore(coverage): stage reviewed nested metadata implementation

seonghobae
authored and
pr-auto-rebase[bot]
committed
59edad3
chore(coverage): apply reviewed nested metadata implementation

seonghobae
authored and
pr-auto-rebase[bot]
committed
27abdd8
ci(coverage): run bounded nested-metadata finalizer

seonghobae
authored and
pr-auto-rebase[bot]
committed
53ba3a9
chore(coverage): remove PR-controlled npm metadata writer

seonghobae
authored and
pr-auto-rebase[bot]
committed
4f5bd6b
chore(coverage): remove PR-controlled npm metadata patcher

seonghobae
authored and
pr-auto-rebase[bot]
committed
f12600f
fix(coverage): resolve nested npm metadata through canonical pins

seonghobae
authored and
pr-auto-rebase[bot]
committed
2e228b6
docs(coverage): define canonical npm metadata pin inheritance

seonghobae
authored and
pr-auto-rebase[bot]
committed
c7e55b5
chore(changelog): record canonical npm metadata pin validation

seonghobae
authored and
pr-auto-rebase[bot]
committed
1cffd3f
fix(coverage): preserve legacy npm diagnostics before version gate

seonghobae
authored and
pr-auto-rebase[bot]
committed
37c134c
test(coverage): complete npm validator branch evidence

seonghobae
authored and
pr-auto-rebase[bot]
committed
ebfe966
docs(coverage): align npm explicit-port policy

seonghobae
authored and
pr-auto-rebase[bot]
committed
b4ada29
test(security): reject symlinked materialization parents

seonghobae
authored and
pr-auto-rebase[bot]
committed
d046966
fix(security): reject symlinked materialization paths

seonghobae
authored and
pr-auto-rebase[bot]
committed
f36c686
fix(security): preserve symlink rejection contract

seonghobae
authored and
pr-auto-rebase[bot]
committed
c556945
test(coverage): exercise non-directory output component rejection

seonghobae
authored and
pr-auto-rebase[bot]
committed
0ca2653
chore(npm): stage descriptor-safe output part 00

seonghobae
authored and
pr-auto-rebase[bot]
committed
1ba1a01
chore(npm): stage descriptor-safe output part 01

seonghobae
authored and
pr-auto-rebase[bot]
committed
583f864
chore(npm): stage descriptor-safe output part 02

seonghobae
authored and
pr-auto-rebase[bot]
committed
c7b3adc
chore(npm): stage descriptor-safe output part 03

seonghobae
authored and
pr-auto-rebase[bot]
committed
0bf64ad
chore(npm): stage descriptor-safe output part 04

seonghobae
authored and
pr-auto-rebase[bot]
committed
4c745d1
test(coverage): reproduce JavaScript materializer output races

seonghobae
authored and
pr-auto-rebase[bot]
committed
2d36a26
test(coverage): run JavaScript output-race regressions

seonghobae
authored and
pr-auto-rebase[bot]
committed
30acf12
fix(coverage): pin JavaScript materializer output descriptors

seonghobae
authored and
pr-auto-rebase[bot]
committed
b7ce2bf
test(coverage): close JavaScript materializer security branches

seonghobae
authored and
pr-auto-rebase[bot]
committed
7865258
test(security): prove descriptor ancestry and cleanup races

seonghobae
authored and
pr-auto-rebase[bot]
committed
9247a9c
ci(security): execute descriptor ancestry regressions

seonghobae
authored and
pr-auto-rebase[bot]
committed
899500d
fix(coverage): harden JavaScript materializer descriptor ancestry

seonghobae
authored and
pr-auto-rebase[bot]
committed
e951b01
test(coverage): preserve dir-fd capability under race instrumentation

seonghobae
authored and
pr-auto-rebase[bot]
committed
4c9fcd1
test(coverage): preserve bounded descriptor-open failure

seonghobae
authored and
pr-auto-rebase[bot]
committed
5fef3cb
test(coverage): cover descriptor cleanup edge branches

seonghobae
authored and
pr-auto-rebase[bot]
committed
f65f345
test(coverage): execute descriptor edge regressions

seonghobae
authored and
pr-auto-rebase[bot]
committed
813edc9
test(security): prove ancestor creation and complete rollback

seonghobae
authored and
pr-auto-rebase[bot]
committed
44608d7
test(coverage): exercise existing relative directory

seonghobae
authored and
pr-auto-rebase[bot]
committed
6b94070
test(coverage): execute existing-directory regression

seonghobae
authored and
pr-auto-rebase[bot]
committed
42961d0
test(security): remove capability-masking fixture

seonghobae
authored and
pr-auto-rebase[bot]
committed
562bdda
fix(security): separate dir-fd capability identity from instrumentation

seonghobae
authored and
pr-auto-rebase[bot]
committed
9d8a57f
fix(materializer): pin output creation and rollback

seonghobae
authored and
pr-auto-rebase[bot]
committed
e63b307
docs(coverage): cite RFC 3986 for npm registry origin pins

seonghobae
authored and
pr-auto-rebase[bot]
committed
8d25ba0
fix(coverage): accept only bounded relative requirement includes

seonghobae
authored and
pr-auto-rebase[bot]
committed
cb4596c
fix: harden Python lock materialization writes
seonghobae
committed
362479d
Merge branch 'main' into fix/npm-nested-metadata-lock-validation
opencode-agent[bot]
authored
cf4abba