Pin mutable direct dependencies and correct build-time placement

[seonghobae]

Problem

At PolicyWeave PR #11 exact head b8171c9019dfbbd92c5d6ad71a0160bd8bfb11ee, both package.json and the root package entry in package-lock.json declare 15 direct dependencies as latest. The current lock makes npm ci reproducible for this one tree, but the manifest leaves future lock regeneration open to unreviewed major-version and license/provenance changes.

The manifest also places @vitejs/plugin-react, typescript, and vite in runtime dependencies, even though they are build/toolchain responsibilities for this static browser product.

Current locked resolutions for the mutable declarations are:

• runtime: @vitejs/plugin-react@6.1.1, lucide-react@1.38.0, react@19.2.8, react-dom@19.2.8, vite@8.2.2
• development: @eslint/js@10.0.1, @testing-library/jest-dom@7.0.1, @testing-library/react@16.3.3, @types/react@19.2.18, @types/react-dom@19.2.5, eslint@10.9.1, eslint-plugin-react-hooks@7.1.1, eslint-plugin-react-refresh@0.5.5, globals@17.11.0, jsdom@30.0.1, vitest@4.1.11

The repository-level MIT grant does not relicense npm dependencies. The lock already contains other license families such as BlueOak-1.0.0, so the release provenance/attribution inventory must stay dependency-specific.

Canonical repair contract

Repair this on the existing PR #1–#10 product writer stack; do not create a competing main-based product tree or retire #11.

1. Add a RED manifest contract that rejects latest and rejects build-only packages in runtime dependencies.
2. Replace each mutable declaration with an explicit reviewed version/range, using the current locked versions as the starting evidence rather than silently upgrading.
3. Move @vitejs/plugin-react, typescript, and vite to devDependencies; verify whether any other direct package is build-only before changing it.
4. Regenerate package-lock.json from the corrected manifest and prove npm ci, lint, unit tests, PostgreSQL contracts, production build, and browser E2E at the same exact head.
5. Produce/reconcile exact-head SBOM and license/provenance evidence. Fail closed on GPL/LGPL/AGPL, noncommercial, research-only, unknown, or incompatible inbound components; do not replace license review with a root MIT label.
6. Update README, CHANGELOG, architecture/TRD, and docs/product-technical-gap-baseline.md only where the verified package and release boundary changes.

Exit evidence

The issue is complete only after the owner-side repair is integrated through ordinary protection with exact-head checks, independent review, zero unresolved threads, immutable dependency/provenance evidence, and a consumer/release statement that distinguishes application code from third-party obligations.

Current exact-head evidence

PR #13 exact head eff7ec19f511cc5850f4fd1254f0a20d9c47fc9e pins and classifies the direct declarations, and CI 34251045288 is terminal GREEN with separate browser and CycloneDX artifacts.

The exact package-lock.json contains 267 installed package entries. Its declared-license inventory is MIT 200, Apache-2.0 21, MPL-2.0 14, ISC 13, BSD-2-Clause 8, BlueOak-1.0.0 4, BSD-3-Clause 3, MIT-0 2, CC-BY-4.0 1, and CC0-1.0 1. String-level screening found no GPL, LGPL, AGPL, SSPL, BUSL, Commons Clause, noncommercial, or CC-BY-NC declaration.

This is inventory evidence, not a compatibility approval. All MPL-2.0 entries and the CC-BY-4.0 caniuse-lite@1.0.30001810 entry are development-toolchain transitive packages in this lock; distribution/NOTICE/attribution obligations and the contents of shipped artifacts still require review before this issue can be completed. PR #13 remains Draft and stacked on #11; protected integration, independent review, and organization checks are outstanding.

[seonghobae]

Implemented as stacked PR #13 at exact head 71fe2751feb6dc4359093386f8cd30333e2f8795.

Test-first evidence:

• RED CI 34244619215: 73 predecessor tests passed; only pin and build-tool placement contracts failed.
• RED CI 34245711353: 75 tests passed; only the missing CycloneDX publication contract failed.
• RED CI 34246822467: 75 tests passed; only the SBOM/browser-artifact isolation contract failed.
• GREEN CI 34247624732: 76/76 Vitest, production build, PostgreSQL migration/concurrency/restart/restore, Playwright/axe 23 passed + 10 scoped skips.

Exact-head artifacts:

• browser evidence 10064709512, sha256:51af5a016c05b32563433b46cbb9a165f51d9eb7c60644649289dd830a7fbd35
• CycloneDX SBOM 10064710360, sha256:69bb27d0fdaea7d318a380a18e165abfc87e747e932273d39aaad91f63684ce2

PR #13 is Ready/open/mergeable with zero unresolved threads at this checkpoint. This issue remains open until independent review and organization-required exact-head gates complete; no license-approval or vulnerability-clearance claim is inferred from inventory generation.

[seonghobae]

Review repair update: PR #13 advanced by fast-forward to eff7ec19f511cc5850f4fd1254f0a20d9c47fc9e.

CodeRabbit's three findings were verified and repaired:

• TRD now lists react, react-dom, and lucide-react as the runtime set.
• Runtime and development dependency entries are checked independently, so overlapping names cannot overwrite a scope before lock comparison.
• The workflow contract independently binds browser evidence to test-results and the CycloneDX artifact to dependency-evidence.

Exact-head CI 34251045288 is terminal GREEN: 76/76 Vitest, production build, PostgreSQL migration/concurrency/restart/restore, and Playwright/axe 23 passed + 10 scoped skips.

Artifacts:

• browser 10066049041, sha256:f83f93f56d92aa18aba7cb262b9594b1658bd0793c47c0118dde217a16665545
• SBOM 10066049491, sha256:cd653257e2a23056f6cc811896cc17ff1d7ba23e931b1cc37db862c93c298b55

All three original threads are resolved. PR #13 is Ready/open/mergeable; Issue #12 remains open pending independent approval and organization-required exact-head gates.

[seonghobae]

Status 2026-09-09 (develop @ 632a08e): canonical repair items 1-4 are in develop via PRs #10/#11/#18/#19 - RED manifest contract (src/dependency-manifest-contract.test.ts), zero latest declarations, build packages in devDependencies, regenerated lock, CycloneDX SBOM in CI verify (all GREEN on exact heads). Remaining: PR #1 exact-head dependency-review still FAILs on the pinned tip and both CodeQL compatibility analyses still FAIL; central-workflow logs live in the org central repo (leaf API 404), so routing through the central owner path. Keeping open until the release gate clears.