fix(release): verify root consumers from packed tarball

[seonghobae]

Closes #291.

Current authoritative boundary

Protected shipped truth is exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. This Draft remains the canonical single writer for tests/package/verify-package.mjs plus src/packedRootConsumerIsolation.test.ts. Current exact head is 147f317ca07d8fccf6b69ff220aba0bf971837ce on fix/packed-root-consumer-isolation-291. Earlier body claims naming bfdd218caf41575cf750dcb03172a6896c4ee567, e0da9e3fa6a3f8dca13fa929532ba4dd6afa1ffa, older protected main, or their workflow generations as current are predecessor evidence.

This is release-evidence integrity only. It adds no registry install, workspace link, lifecycle-script execution, network, credential, database, model/provider, transport, persistence, authorization, tenancy, deployment or durable-audit authority.

Test-first lineage

• First test-only 1e6705ed39b18161cf874bffec5e0d3bd88710c9 failed in test setup and is rejected as product evidence.
• Corrected RED 065346eb01a7ee4740ce4086c6cc15e8d91a7114, CI 31653280023, proved the verifier used npm pack --dry-run plus repository self-reference instead of an extracted package.
• First implementation e9cf52a92ec14acd1f9330de04503fbd3d4f9dd3, CI 31654244618, exposed a second real defect: a temporary consumer nested under the repository package scope still resolved the package name back to the checkout.
• The repair creates one real npm pack --json --ignore-scripts --pack-destination tarball, validates inventory from that exact archive, extracts those bytes beneath an isolated consumer node_modules, gives the consumer a distinct nearest package scope, and proves ESM/CommonJS/subpath/strict-TypeScript consumers resolve from the extracted package rather than the checkout.
• A later exact-current inspection exposed a validation-to-use gap: the verifier proved a resolved module entry was contained by the packed package and then executed a fresh package-name resolution. The current test-first contract requires ESM/CommonJS execution to use only the exact canonical module entries that passed containment validation; current implementation imports/requires those validated canonical paths directly.

Exact-current-head evidence

For exact head 147f317ca07d8fccf6b69ff220aba0bf971837ce against live protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e, at the latest fresh refetch:

• CI 32445567032: completed / success; build/test checked out the exact head, the packed-entry contract passed, 145 files / 834 tests passed at 100% aggregate statement/branch/function/line coverage, and verify:package executed the changed verifier successfully;
• SAST Semgrep 32445566914: completed / success;
• Security Scan 32445566963: completed / success;
• qualifying independent approving reviews: absent;
• unresolved inline review threads: 0;
• GitHub reports the Draft mergeable.

All observed repository-owned exact-head workflows are terminal success. Repository exact-head technical success is not qualifying independent approval and does not replace separately applicable central workflows or protected integration. No predecessor evidence transfers; absent review remains non-passing.

Integration boundary

Keep Draft/unmerged while #118 owns the exact protected v0.6.0 release/publication boundary. Before any lifecycle transition refetch exact head/live base, rules/permissions, reviews/threads and all applicable repository/central workflows. Do not self-approve, weaken gates, transfer predecessor evidence, move protected main or represent this active-PR verifier as shipped release evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Protected-main synchronization completed without force push.

Exact head: fab480bde51dcd1c4c87fd01d9b73e3d626876d9
Protected main merged: a40b9489665bed7d95af619a6079b9c51cab299a

Local exact-head evidence:

• packed-root isolation tests: 1 file / 5 tests passed
• root suite: 157 files / 886 tests passed; statements, branches, functions, and lines 100%
• Office suite: 173 tests passed; total coverage 100%
• TypeScript typecheck passed
• production build passed
• real npm tarball extraction plus isolated ESM, CommonJS, subpath, and strict-TypeScript consumer verification passed
• git diff --check passed

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.