build(reproducibility): restack deterministic npm toolchain - #91

Merged

seonghobae merged 38 commits into

mainfrom

build/deterministic-npm-toolchain-on-main

Aug 12, 2026

Commits on Aug 10, 2026

build(reproducibility): add lockfile change-control CI gates
seonghobae
committed
8fc0461
build(reproducibility): pin npm identity and install-script policy
seonghobae
committed
5e4cc21
build(reproducibility): fail closed on unreviewed install scripts
seonghobae
committed
92bc24a
docs(reproducibility): add package-manager evidence contract
seonghobae
committed
51a469f
feat(reproducibility): add lockfile change-control evaluator
seonghobae
committed
8b48575
test(reproducibility): cover lockfile change-control semantics
seonghobae
committed
a22f7dc
test(reproducibility): cover bounded lockfile evidence boundaries
seonghobae
committed
e5b4f1f
test(reproducibility): preserve array order in evidence hashing
seonghobae
committed
681664b
test(reproducibility): reject duplicate decoded JSON keys
seonghobae
committed
a96ce3a
test(reproducibility): reject unenforced policy fields
seonghobae
committed
9c2bb4d
test(reproducibility): cover lockfile read race boundaries
seonghobae
committed
8bbb695
test(reproducibility): enforce package-manager doctoring
seonghobae
committed
db9854a
test(reproducibility): preserve nanoid predecessor contract
seonghobae
committed
a41e72d
test(reproducibility): prove npm identity and strict install policy
seonghobae
committed
450700d
test(reproducibility): accept exact Node 24 patch pins
seonghobae
committed
16a5db0
test(reproducibility): include lockfile control in coverage gate
seonghobae
committed
2fc6e8d
docs(changelog): record deterministic npm toolchain
seonghobae
committed
ebde372

Commits on Aug 11, 2026

Merge branch 'main' into build/deterministic-npm-toolchain-on-main
opencode-agent[bot]
authored
da48a97

Commits on Aug 12, 2026