@qijenchen/design-system 0.1.0-beta.105 → 0.1.0-beta.106

package/dist/patterns/element-anatomy/item-anatomy.js

@@ -1,7 +1,7 @@
 import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import { cva } from "class-variance-authority";
-import { lineClampClass, cn } from "../../lib/utils.js";
+import { cn, lineClampClass } from "../../lib/utils.js";
 import { Avatar } from "../../components/Avatar/avatar.js";
 import { Tooltip, TooltipTrigger, TooltipContent } from "../../components/Tooltip/tooltip.js";
 import { useTruncated } from "../../hooks/use-truncated.js";

package/ds-canonical/fork/consumer/lock.json

@@ -3,8 +3,8 @@
   "schemaVersion": 1,
   "role": "template-consumer",
   "release": {
-    "designSystem": "0.1.0-beta.105",
-    "storybookConfig": "0.1.0-beta.105"
+    "designSystem": "0.1.0-beta.106",
+    "storybookConfig": "0.1.0-beta.106"
   },
   "upgradeTrust": {
     "schemaVersion": 1,
@@ -42,10 +42,10 @@
     "implementationSha256": "98b74118fb5b410b77ad2994aa9105fa7609c7353822f8c5213cce54d94f0af4"
   },
   "payload": {
-    "forkCorpusLockSha256": "0d2489d8bb989a6cd7c039f2c7262deb6fcd0be26e67a21ede951003da953455",
+    "forkCorpusLockSha256": "f192cdd2cdfcd7e887ac1caeb2ee57410f7419487237fb2702c44b2a1797d671",
     "discoveryPolicySha256": "fba289aeeb5a3f11139b9589f7ab08b5e8c8799c7bdf8f0ea57ebfeb8e7c9da6",
     "providerMaterializersSha256": "732e85b01a12e7dd19469e26e4427f0e0cfe5117a78fc9f69c2f0f89702f463a",
-    "providerLifecycleSha256": "43c6b2abb99a2b185eb143e5a5be12db0a3e096475cba58b1bde3a29dfb64940",
+    "providerLifecycleSha256": "6adab7f6bfa9a6a185cfef41bcb2a596d00ef81b439a1052940ec8e0f02616f3",
     "providerInventorySha256": "00adf1c4f6b3367055a9cc3fdfe658660771b4c9931f696e12761a95076ad92c",
     "executionRuntimeSha256": "3fca4ba4094e855412a22308e13f2b5f91dcfeb009512eb8318b3bd1bace8d9a",
     "commonInstructionSha256": "3d40f4b5d3ea78f6c9ca5bd18daa531dc758d77df21a5e7ef35a3336cd71f906",
@@ -91,7 +91,6 @@
       ".devcontainer/onboard-banner.sh": "fd87b372e48ff079afb0b257c5e5c28fcf58637b2589a508987460a66c2b8b75",
       ".devcontainer/post-create.mjs": "6bc05d2597a54e8f6a5a087901e92ccc89acc3d5873d96ad20814f8f539a146b",
       ".github/workflows/audit.yml": "3cb259c8d83d8d378a6d282b0cde0a8884d96c51cf49e655405c3e416e646726",
-      ".github/workflows/governance-anchor.yml": "3e280e67fd72886b0686a6d296947ee3270b4899e9914c1e3a9c61c951dcc2ee",
       ".npmrc": "79eff2d98653857c11ab6a0354fa62685a72ec214545e7fdfabc450e91b7ba63",
       "governance/consumer-governance.md": "bc58561386e0df62306a5d7246e51647847732efa3de84426bada9978ff6da5c",
       "governance/provider-cli-toolchain.json": "6bc607cb6ac299b332d35ca871c838b54e367d96775ad0e759c827a0e3ca10cc",
@@ -104,7 +103,6 @@
       "scripts/audit-consumer-a11y.mjs": "a2ca30c164ef55277cc783a79450eb1bff203b936acbfad3bc94a8c644cfd173",
       "scripts/check-plugin-installed.mjs": "f2a673cc011743fe51f87746b9aebbd3332378cd2732088eda621e16a3c74386",
       "scripts/consumer-source-harness.mjs": "725072155d0b15b373bf6befb333cd2085dc8a38fff8538b4f4c8ea56f9c5308",
-      "scripts/governance-anchor-preflight.mjs": "3f87bcdcf95f85c73351646a5f818b088d6528cc6bd3c811054087fd58b4fdfa",
       "scripts/lib/a11y-static-server.mjs": "3ae8ca74a66ca5f155d1a1d0c97280d41f07556274c8c077705a489ebe6a7018",
       "scripts/lib/canonical-path-containment.mjs": "0244e31dc3be5015bed3efd65a5a77086a2e4676e9ac79cd0801c8cde6a74fcd",
       "scripts/lib/closed-tool-execution.mjs": "131255a302f1b403fe95dd6251e180d7f3ce920faf6cbfe90496b52d192d93c3",

package/ds-canonical/fork/governance.lock

@@ -396,14 +396,6 @@
       "classification": null,
       "destination": "scripts/product-template-scaffold-lock.mjs"
     },
-    {
-      "schemaVersion": 1,
-      "file": "consumer/managed-files/6929a3c8bb4d69c507720b4754aeb339c6cbb8ff655e0a381d76606d64695e38.blob",
-      "sha256": "3f87bcdcf95f85c73351646a5f818b088d6528cc6bd3c811054087fd58b4fdfa",
-      "source": "scripts/governance-anchor-preflight.mjs",
-      "classification": null,
-      "destination": "scripts/governance-anchor-preflight.mjs"
-    },
     {
       "schemaVersion": 1,
       "file": "consumer/managed-files/6b746628ac11fcccbe277ef6fea94cc2a7b90ea2822e83536eae80d5ee4b3fa5.blob",
@@ -564,14 +556,6 @@
       "classification": null,
       "destination": ".devcontainer/onboard-banner.sh"
     },
-    {
-      "schemaVersion": 1,
-      "file": "consumer/managed-files/e1b11160d6c4043002d2cbff6d9a4ae551698a96137773c4244dadfac152fcb0.blob",
-      "sha256": "3e280e67fd72886b0686a6d296947ee3270b4899e9914c1e3a9c61c951dcc2ee",
-      "source": "template/ds-product-template/.github/workflows/governance-anchor.yml",
-      "classification": null,
-      "destination": ".github/workflows/governance-anchor.yml"
-    },
     {
       "schemaVersion": 1,
       "file": "consumer/managed-files/e26057408661597aac4a57cdf7e30e2f9d0afb1b9a2dbbb692c3805cd9028ca5.blob",
@@ -919,7 +903,7 @@
     {
       "schemaVersion": 1,
       "file": "manifest.json",
-      "sha256": "e557147218676744b583998593d5075decf2c7660bf53fe9d50396f380d46e4f",
+      "sha256": "d92cc77eb725aadb92add11e63cc3e366886949f0535825a97e60d1571998a66",
       "source": null,
       "classification": null,
       "destination": null

package/ds-canonical/fork/manifest.json

@@ -104,20 +104,20 @@
   },
   "providerLifecycle": {
     "schemaVersion": 4,
-    "releaseVersion": "0.1.0-beta.105",
+    "releaseVersion": "0.1.0-beta.106",
     "immutableHead": {
       "providerInventorySha256": "86e9d0668cb54ad1bf05c36e78b4aa80417d5f468c929dd3ddcf69c1afbf32e4",
-      "releaseVersion": "0.1.0-beta.104",
-      "snapshotSha256": "3d9d69c770e9f8bfb9b99e795598178ba324af8d89ca809e09aef4569cfeef31"
+      "releaseVersion": "0.1.0-beta.105",
+      "snapshotSha256": "e0a8c02e4faeb126f3612eb1559e6bce02b408ffabcd8f0101b9c005ea1344a1"
     },
-    "ledgerSha256": "3af26d7634fd5e462b835a1fd1e222aaf87f10b9d33d2f950467a6112887c026",
-    "previousSnapshotSha256": "3d9d69c770e9f8bfb9b99e795598178ba324af8d89ca809e09aef4569cfeef31",
-    "currentSnapshotSha256": "e0a8c02e4faeb126f3612eb1559e6bce02b408ffabcd8f0101b9c005ea1344a1",
+    "ledgerSha256": "7096ad8e6d068b37dca410a01bf0af73cc577a98a6cbdc97135477cd0c24ade7",
+    "previousSnapshotSha256": "e0a8c02e4faeb126f3612eb1559e6bce02b408ffabcd8f0101b9c005ea1344a1",
+    "currentSnapshotSha256": "6ba66c4b02e1985cc2175f94a481eb02cf1be57281d9c6b08ce39d6a7c8243c1",
     "currentProviderInventorySha256": "86e9d0668cb54ad1bf05c36e78b4aa80417d5f468c929dd3ddcf69c1afbf32e4",
     "retiredProviders": [],
     "currentSnapshot": {
-      "releaseVersion": "0.1.0-beta.105",
-      "previousSnapshotSha256": "3d9d69c770e9f8bfb9b99e795598178ba324af8d89ca809e09aef4569cfeef31",
+      "releaseVersion": "0.1.0-beta.106",
+      "previousSnapshotSha256": "e0a8c02e4faeb126f3612eb1559e6bce02b408ffabcd8f0101b9c005ea1344a1",
       "providers": [
         {
           "id": "claude",
@@ -193,8 +193,8 @@
       "retiredProviders": []
     },
     "immutableHeadSnapshot": {
-      "releaseVersion": "0.1.0-beta.104",
-      "previousSnapshotSha256": "233b7d5514434b891f6969c0803651bc3d60751d86394713b9d4c38c762b5266",
+      "releaseVersion": "0.1.0-beta.105",
+      "previousSnapshotSha256": "3d9d69c770e9f8bfb9b99e795598178ba324af8d89ca809e09aef4569cfeef31",
       "providers": [
         {
           "id": "claude",
@@ -1848,7 +1848,6 @@
       ".devcontainer/onboard-banner.sh": "consumer/managed-files/da2ad2737315d25a5300905ddefd62f1695056a8a1af155c5b34170ad9923bce.blob",
       ".devcontainer/post-create.mjs": "consumer/managed-files/3ddedc67b464bdfe3dde9803a2d917920c96d633678b802eee638a44cd47366a.blob",
       ".github/workflows/audit.yml": "consumer/managed-files/93a89f16f6717d1e4e4e27ec20ef916e3355c7aa890ca74cd9b12db30d8a899f.blob",
-      ".github/workflows/governance-anchor.yml": "consumer/managed-files/e1b11160d6c4043002d2cbff6d9a4ae551698a96137773c4244dadfac152fcb0.blob",
       ".npmrc": "consumer/managed-files/e813096d69c49812e40e00be9ac8fa14d77f0ec1f97ab4c45cb096b3bedd35de.blob",
       "governance/consumer-governance.md": "consumer/managed-files/884721550b56308812b20917adac7a12f36fdb4ecda6b02460a7f5a219c0c966.blob",
       "governance/provider-cli-toolchain.json": "consumer/managed-files/189e551431181e4a88783c02130d2787b801ef731c86e35bcde89a7313aa020e.blob",
@@ -1861,7 +1860,6 @@
       "scripts/audit-consumer-a11y.mjs": "consumer/managed-files/e71c65f45c6af7ce12b6b3c0d8028f185da5b719e2050c9b2a6b243d41ae4878.blob",
       "scripts/check-plugin-installed.mjs": "consumer/managed-files/ea94e914d5c8acb84ad7660e5bda0f01b6ccc8cf96b0f6b1ce048f8938d0f5b5.blob",
       "scripts/consumer-source-harness.mjs": "consumer/managed-files/423729840acdd43c812f17c245b871716c6b60f76e4d3e94864d0e34a815bf8d.blob",
-      "scripts/governance-anchor-preflight.mjs": "consumer/managed-files/6929a3c8bb4d69c507720b4754aeb339c6cbb8ff655e0a381d76606d64695e38.blob",
       "scripts/lib/a11y-static-server.mjs": "consumer/managed-files/92e4828cdcb96ff0d01daa16f6885f24045a8e72820665650f2a1890dc3a446c.blob",
       "scripts/lib/canonical-path-containment.mjs": "consumer/managed-files/faa128c26102415dc5345e68698efbbd28a395c35ee278dceae044cf430692b2.blob",
       "scripts/lib/closed-tool-execution.mjs": "consumer/managed-files/2d1ef5617a5ce3c39ad9aae1c42af7d199f9270c0a0ccb490b63d62dbc6913db.blob",
@@ -1896,7 +1894,6 @@
         ".devcontainer/onboard-banner.sh",
         ".devcontainer/post-create.mjs",
         ".github/workflows/audit.yml",
-        ".github/workflows/governance-anchor.yml",
         ".npmrc",
         "AGENTS.md",
         "CLAUDE.md",
@@ -1927,7 +1924,6 @@
         "scripts/audit-consumer-a11y.mjs",
         "scripts/check-plugin-installed.mjs",
         "scripts/consumer-source-harness.mjs",
-        "scripts/governance-anchor-preflight.mjs",
         "scripts/governance-check.mjs",
         "scripts/lib/a11y-static-server.mjs",
         "scripts/lib/canonical-path-containment.mjs",

package/ds-canonical/hooks/check_audit_post_report_validator.sh

@@ -33,7 +33,7 @@ source "$HOOK_DIR/lib/_provider_paths.sh" 2>/dev/null || {
 set -uo pipefail
 
 governance_hook_load_input
-governance_hook_require_commands grep node sort wc tr awk
+governance_hook_require_commands grep jq node sort wc tr awk
 TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // ""') \
   || governance_hook_integrity_fail 'audit validator tool name could not be decoded'
 FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // ""') \
@@ -92,6 +92,27 @@ else
   REVIEW_MODE=unspecified
 fi
 
+# Report prose is a receipt, never waiver authority. The only valid waiver is
+# the exact one-run selection frozen in the current immutable manifest. Reusing
+# the canonical verifier also closes pointer digest, current HEAD/tree/index,
+# provider binding, evidence-tree, and one-provider coverage in one readback.
+if [ "$REVIEW_MODE" = waived ]; then
+  WAIVER_PROOF=""
+  if [ -f "$PROJECT_DIR/scripts/verify-deep-audit-coverage.mjs" ]; then
+    WAIVER_PROOF=$(node "$PROJECT_DIR/scripts/verify-deep-audit-coverage.mjs" \
+      --repo-root "$PROJECT_DIR" --json 2>/dev/null || true)
+  fi
+  if ! printf '%s' "$WAIVER_PROOF" | jq -e '
+    .evidenceKind == "deep-audit-coverage-verification"
+    and .secondOpinion == "waived-by-user"
+    and (.providers.self | type == "string" and length > 0)
+    and .providers.peer == null
+  ' >/dev/null 2>&1; then
+    WARNINGS="${WARNINGS}\n  🔴 [R] Report 文字不是 second-opinion waiver authority：目前 active immutable run 無可驗證的 exact user waiver／current binding／single-provider coverage。"
+    CRITICAL_FAIL=1
+  fi
+fi
+
 if [ "$REVIEW_MODE" = required ]; then
   if ! printf '%s' "$PEER_PROVIDER" | grep -qE '^[a-z][a-z0-9-]*$'; then
     WARNINGS="${WARNINGS}\n  🔴 [R] Independent review 已被 report 要求／使用，但無 registry-resolved peer provider context。補齊可驗證的 peer 執行與回執，或記錄 user 明確豁免。"

package/ds-canonical/hooks/stop_self_audit.sh

@@ -64,20 +64,31 @@ PEER_DISCOVERY_MARKERS_JSON="${GOVERNANCE_PEER_DISCOVERY_MARKERS_JSON:-[]}"
 INSTRUCTION_ENTRY="${GOVERNANCE_INSTRUCTION_ENTRY:-AGENTS.md}"
 SHARED_INSTRUCTION_ENTRY="${GOVERNANCE_SHARED_INSTRUCTION_ENTRY:-AGENTS.md}"
 
-if ! printf '%s' "$SELF_PROVIDER" | grep -qE '^[a-z][a-z0-9-]*$' \
-  || ! printf '%s' "$PEER_PROVIDER" | grep -qE '^[a-z][a-z0-9-]*$' \
-  || ! printf '%s' "$PEER_CLI" | grep -qE '^[a-z][a-z0-9-]*$' \
-  || ! printf '%s' "$PEER_REPLY_PREFIX" | grep -qE '^[a-z][a-z0-9-]*-reply$'; then
-  governance_hook_integrity_fail 'self-audit registry-resolved self/peer runtime context is missing or invalid'
+if ! printf '%s' "$SELF_PROVIDER" | grep -qE '^[a-z][a-z0-9-]*$'; then
+  governance_hook_integrity_fail 'self-audit registry-resolved self runtime context is missing or invalid'
+fi
+
+PEER_CONTEXT_PRESENT=0
+if [ -n "$PEER_PROVIDER$PEER_CLI$PEER_LOCAL_EXECUTABLE$PEER_REPLY_PREFIX" ] \
+  || [ "$PEER_DISCOVERY_MARKERS_JSON" != '[]' ]; then
+  PEER_CONTEXT_PRESENT=1
+  if ! printf '%s' "$PEER_PROVIDER" | grep -qE '^[a-z][a-z0-9-]*$' \
+    || ! printf '%s' "$PEER_CLI" | grep -qE '^[a-z][a-z0-9-]*$' \
+    || ! printf '%s' "$PEER_REPLY_PREFIX" | grep -qE '^[a-z][a-z0-9-]*-reply$'; then
+    governance_hook_integrity_fail 'self-audit registry-resolved peer runtime context is partial or invalid'
+  fi
 fi
 
 json_array_to_ere() {
   node -- "$HOOK_DIR/lib/provider-marker-regex.mjs" discovery "$1" 2>/dev/null
 }
 
-PEER_DISCOVERY_RE=$(json_array_to_ere "$PEER_DISCOVERY_MARKERS_JSON") || {
-  governance_hook_integrity_fail 'self-audit registry-resolved peer discovery metadata is missing or invalid'
-}
+PEER_DISCOVERY_RE=""
+if [ "$PEER_CONTEXT_PRESENT" = "1" ]; then
+  PEER_DISCOVERY_RE=$(json_array_to_ere "$PEER_DISCOVERY_MARKERS_JSON") || {
+    governance_hook_integrity_fail 'self-audit registry-resolved peer discovery metadata is missing or invalid'
+  }
+fi
 
 WARNINGS=""
 
@@ -188,8 +199,7 @@ fi
 #   verify-deep-audit-coverage.mjs = 機械閘;宣告完成 + ledger 有缺口 → BLOCK。
 run_deep_audit_coverage_verify() {
   node scripts/verify-deep-audit-coverage.mjs \
-    --self-provider "$SELF_PROVIDER" \
-    --peer-provider "$PEER_PROVIDER"
+    --self-provider "$SELF_PROVIDER"
 }
 if [ -n "$LAST_ASSISTANT" ] && [ -f scripts/verify-deep-audit-coverage.mjs ]; then
   DEEPAUDIT_CLAIM_RE='(deep.?audit.{0,10}(完成|完整|done)|稽核.{0,8}(完整完美|全部完成|都.?跑完)|91.{0,6}dim.{0,8}(都|全).{0,4}(跑|過|完|有證據)|Phase A.{0,6}完成)'
@@ -197,6 +207,7 @@ if [ -n "$LAST_ASSISTANT" ] && [ -f scripts/verify-deep-audit-coverage.mjs ]; th
   if grep -qE "$DEEPAUDIT_CLAIM_RE" <<< "$LAST_ASSISTANT" \
     && ! grep -qE "$DEEPAUDIT_NEG_RE" <<< "$LAST_ASSISTANT"; then
     if ! run_deep_audit_coverage_verify >/dev/null 2>&1; then
+      WARNINGS="${WARNINGS}\n  • Deep-audit completion claim rejected:the active immutable run's provider set, 91 dimensions, or component evidence is incomplete."
       CRITICAL_DEEPAUDIT_COVERAGE=1
     fi
   fi
@@ -254,7 +265,7 @@ done
 #   (c) Read against peer-cited code path(`packages/design-system/src/...`)
 #   (d) Explicit retract phrase(撤回 / 未採納 / 不採用 / skip peer)
 # 任一 missing → CRITICAL 通知;同 Mechanism 1 升 BLOCKER 阻 turn 結束。
-if [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ] && [ "$LAST_USER_LINE" -gt 0 ]; then
+if [ "$PEER_CONTEXT_PRESENT" = "1" ] && [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ] && [ "$LAST_USER_LINE" -gt 0 ]; then
   THIS_TURN_FULL=$(tail -n +$((LAST_USER_LINE+1)) "$TRANSCRIPT_PATH" 2>/dev/null)
   PEER_REPLY_READ=$(grep -cE "${PEER_REPLY_PREFIX}-[a-zA-Z0-9_-]+\\.md" <<< "$THIS_TURN_FULL" 2>/dev/null)
   PEER_REPLY_READ=${PEER_REPLY_READ:-0}
@@ -451,7 +462,7 @@ fi
 # ── Mechanism 5: Peer transport discovery gap(2026-05-17 user-authorized)──
 # Registry 宣告 peer 的 local/global discovery markers。本 mechanism 偵測:本 turn 含 active peer
 # collaboration 意圖 AND 無任一 discovery marker trace AND 無撤回 → BLOCKER。
-if [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ] && [ "${LAST_USER_LINE:-0}" -gt 0 ]; then
+if [ "$PEER_CONTEXT_PRESENT" = "1" ] && [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ] && [ "${LAST_USER_LINE:-0}" -gt 0 ]; then
   THIS_TURN_RAW=$(tail -n +$((LAST_USER_LINE+1)) "$TRANSCRIPT_PATH" 2>/dev/null)
   # Scope to assistant prose so commit messages, tool inputs, and historical citations do not
   # trigger the gate. Active intent requires an action verb adjacent to the resolved peer id.
@@ -679,7 +690,7 @@ if [ "${CRITICAL_DEEPAUDIT_COVERAGE:-0}" = "1" ] && [ -n "$LAST_ASSISTANT" ]; th
     COVERAGE_OUTPUT=$(run_deep_audit_coverage_verify 2>/dev/null || true)
     GAPLINE=$(awk '/個 dim-證據缺口/ && !found { print; found=1 }' <<< "$COVERAGE_OUTPUT")
     REASON=$(printf '%s' \
-      "🚨 DEEP-AUDIT-COVERAGE BLOCKER(M7c,2026-07-12 user-authorized「不抽樣不偷懶…現在和未來可以確保嗎」):你宣告 deep audit 完成,但 neutral evidence verifier 未通過 — ${GAPLINE:-91 dim × ${SELF_PROVIDER}+${PEER_PROVIDER} 雙軌未全有證據}。禁宣稱 done。跑 node scripts/verify-deep-audit-coverage.mjs --self-provider ${SELF_PROVIDER} --peer-provider ${PEER_PROVIDER} 看缺哪些；填完 Git-owned governance-runtime/evidence/deep-audit 內的 judgment / deterministic / hook-residue / ci-enforced / component-a1b 證據才可宣稱；OR 明寫『核心做完,dim 覆蓋待補』。否則 turn 不結束。" \
+      "🚨 DEEP-AUDIT-COVERAGE BLOCKER(M7c,2026-07-12 user-authorized「不抽樣不偷懶…現在和未來可以確保嗎」):你宣告 deep audit 完成,但 neutral evidence verifier 未通過 — ${GAPLINE:-immutable run 的 91 dim / component 證據未閉合}。禁宣稱 done。跑 node scripts/verify-deep-audit-coverage.mjs --self-provider ${SELF_PROVIDER} 看缺哪些；provider set 與本次 second-opinion disposition 只由 active immutable manifest 決定。填完 Git-owned governance-runtime/evidence/deep-audit 內的 judgment / deterministic / hook-residue / ci-enforced / component-a1b 證據才可宣稱；OR 明寫『核心做完,dim 覆蓋待補』。否則 turn 不結束。" \
       "本機制起因:本 session AI 漏跑 91 dim 裡 deterministic 24 + judgment 26 + hook 39 + CI 2 四層,只做 claim-vs-code + 反應式補,user 憤怒。觸發器 = 宣告 deep audit 完成本身。")
     emit_governance_block "$REASON"
   fi

package/ds-canonical/hooks/tests/test_check_audit_post_report_validator.sh

@@ -21,7 +21,34 @@ TMPDIR_TEST=$(mktemp -d)
 trap 'rm -rf "$TMPDIR_TEST"' EXIT
 mkdir -p "$TMPDIR_TEST/.claude/logs"
 mkdir -p "$TMPDIR_TEST/corpus/packages/governance/canonical" \
-  "$TMPDIR_TEST/corpus/canonical/skills/design-system-audit/references"
+  "$TMPDIR_TEST/corpus/canonical/skills/design-system-audit/references" \
+  "$TMPDIR_TEST/scripts"
+cat > "$TMPDIR_TEST/scripts/verify-deep-audit-coverage.mjs" <<'EOF'
+import { existsSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const rootIndex = process.argv.indexOf('--repo-root')
+const root = rootIndex >= 0 ? process.argv[rootIndex + 1] : process.cwd()
+const modePath = resolve(root, '.fixture-review-mode')
+const mode = existsSync(modePath) ? readFileSync(modePath, 'utf8').trim() : 'missing'
+if (mode === 'waived') {
+  process.stdout.write(JSON.stringify({
+    evidenceKind: 'deep-audit-coverage-verification',
+    secondOpinion: 'waived-by-user',
+    providers: { self: 'alpha', peer: null },
+  }))
+  process.exit(0)
+}
+if (mode === 'selected') {
+  process.stdout.write(JSON.stringify({
+    evidenceKind: 'deep-audit-coverage-verification',
+    secondOpinion: 'completed',
+    providers: { self: 'alpha', peer: 'beta' },
+  }))
+  process.exit(0)
+}
+process.exit(2)
+EOF
 cat > "$TMPDIR_TEST/corpus/packages/governance/canonical/providers.json" <<'EOF'
 {
   "canonical": {"roots": {"skills": "canonical/skills"}},
@@ -264,8 +291,8 @@ else
   FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - 8. future peer verdict"
 fi
 
-# 9. A user waiver removes only the peer-verdict requirement; the other decision
-#    quality evidence remains mandatory.
+# 9. Report prose alone cannot authorize a waiver. The same receipt passes only
+#    when the current immutable run verifier proves the exact one-run waiver.
 unset GOVERNANCE_PEER_PROVIDER GOVERNANCE_PEER_DISPLAY_NAME
 cat > "$TMPDIR_TEST/.claude/logs/deep-audit-test/C1-final-report.md" <<'EOF'
 # Deep Audit 報告
@@ -280,7 +307,34 @@ second opinion: waived by user
    - 設計語言 fit:符合 density canonical
 EOF
 run_hook "$TMPDIR_TEST/.claude/logs/deep-audit-test/C1-final-report.md" "Write"
-expect_silent "9. user-waived decision → no peer context required"
+expect_block_stderr "9. text-only user waiver → block" "Report 文字不是 second-opinion waiver authority"
+
+printf 'waived\n' > "$TMPDIR_TEST/.fixture-review-mode"
+run_hook "$TMPDIR_TEST/.claude/logs/deep-audit-test/C1-final-report.md" "Write"
+expect_silent "9b. immutable user-waived run → no peer context required"
+
+printf 'selected\n' > "$TMPDIR_TEST/.fixture-review-mode"
+run_hook "$TMPDIR_TEST/.claude/logs/deep-audit-test/C1-final-report.md" "Write"
+expect_block_stderr "9c. selected run cannot be waived by report prose" "Report 文字不是 second-opinion waiver authority"
+
+printf 'tampered\n' > "$TMPDIR_TEST/.fixture-review-mode"
+run_hook "$TMPDIR_TEST/.claude/logs/deep-audit-test/C1-final-report.md" "Write"
+expect_block_stderr "9d. tampered/missing active waiver proof → block" "Report 文字不是 second-opinion waiver authority"
+
+printf 'waived\n' > "$TMPDIR_TEST/.fixture-review-mode"
+cat > "$TMPDIR_TEST/.claude/logs/deep-audit-test/C1-final-report.md" <<'EOF'
+# Deep Audit 報告
+Dim 1: pass
+
+### 待你拍板
+1. 決策一:Popover 內距是否改 12px
+   - SSOT 理由:改跨元件 canonical 視覺結構
+   - SSOT-check:grep spec + memory,無既有拍板
+   - 世界級:Polaris https://polaris.shopify.com/tokens/space / Material / Ant(3 家)
+   - 設計語言 fit:符合 density canonical
+EOF
+run_hook "$TMPDIR_TEST/.claude/logs/deep-audit-test/C1-final-report.md" "Write"
+expect_block_stderr "9e. active waiver still requires explicit report receipt" "registry-resolved peer provider"
 
 # 10. A general report with no decision and an explicit task-level receipt also
 #     has no peer dependency.

package/ds-canonical/hooks/tests/test_stop_self_audit.sh

@@ -27,19 +27,21 @@ EVIDENCE_ROOT="$GIT_DIR/governance-runtime/evidence"
 cp "$REPO_ROOT/scripts/lib/governance-runtime-evidence.mjs" "$PROJECT_DIR/scripts/lib/governance-runtime-evidence.mjs"
 cp "$REPO_ROOT/packages/governance/src/closed-tool-execution.mjs" "$PROJECT_DIR/scripts/lib/closed-tool-execution.mjs"
 cat > "$PROJECT_DIR/scripts/verify-deep-audit-coverage.mjs" <<'VERIFY_FIXTURE'
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 
 const selfIndex = process.argv.indexOf('--self-provider')
 const peerIndex = process.argv.indexOf('--peer-provider')
-const providerPairIsExact = selfIndex >= 0 && peerIndex >= 0
-  && process.argv[selfIndex + 1] === 'alpha'
-  && process.argv[peerIndex + 1] === 'beta'
+const selfIsExact = selfIndex >= 0 && process.argv[selfIndex + 1] === 'alpha'
 const stateRoot = process.env.GOVERNANCE_STATE_DIR
 const neutralReceipt = stateRoot
   ? resolve(stateRoot, '..', 'evidence/deep-audit/fixture-complete.json')
   : null
-process.exit(providerPairIsExact && neutralReceipt && existsSync(neutralReceipt) ? 0 : 1)
+let receipt = null
+try { receipt = neutralReceipt && existsSync(neutralReceipt) ? JSON.parse(readFileSync(neutralReceipt, 'utf8')) : null } catch {}
+const immutableProviderClosure = receipt?.secondOpinion === 'waived-by-user'
+  || (receipt?.secondOpinion === 'completed' && receipt?.peerEvidence === true)
+process.exit(selfIsExact && peerIndex === -1 && immutableProviderClosure ? 0 : 1)
 VERIFY_FIXTURE
 {
   echo 'const DIMS = {'
@@ -71,25 +73,34 @@ export GOVERNANCE_SHARED_INSTRUCTION_ENTRY=AGENTS.md
 
 PASS=0; FAIL=0
 run_test() {
-  local name="$1"; local expect_block="$2"; local transcript_content="$3"
+  local name="$1"; local expect_block="$2"; local transcript_content="$3"; local direct_message="${4:-}"
   local transcript="$TMPDIR/transcript-$$.jsonl"
   printf '%s\n' "$transcript_content" > "$transcript"
   local input
-  input=$(printf '{"transcript_path":"%s","session_id":"test"}' "$transcript")
-  local stdout; stdout=$(echo "$input" | bash "$HOOK" 2>/dev/null)
+  input=$(jq -nc --arg path "$transcript" --arg message "$direct_message" \
+    '{transcript_path:$path,session_id:"test",last_assistant_message:$message}')
+  local stdout stderr_file exit_code
+  stderr_file=$(mktemp)
+  set +e
+  stdout=$(echo "$input" | bash "$HOOK" 2>"$stderr_file")
+  exit_code=$?
+  set -e
   if [ "$expect_block" = "1" ]; then
-    if echo "$stdout" | grep -q '"governanceDecision":"block"'; then
+    if [ "$exit_code" = "0" ] && echo "$stdout" | grep -q '"governanceDecision":"block"'; then
       echo "  PASS  $name (blocked as expected)"; PASS=$((PASS+1))
     else
-      echo "  FAIL  $name (expected block, got: ${stdout:0:120})"; FAIL=$((FAIL+1))
+      echo "  FAIL  $name (expected block, exit=$exit_code, got: ${stdout:0:120}, stderr: $(head -c 160 "$stderr_file"))"; FAIL=$((FAIL+1))
     fi
   else
-    if echo "$stdout" | grep -q '"governanceDecision":"block"'; then
+    if [ "$exit_code" != "0" ]; then
+      echo "  FAIL  $name (unexpected exit=$exit_code, stderr: $(head -c 160 "$stderr_file"))"; FAIL=$((FAIL+1))
+    elif echo "$stdout" | grep -q '"governanceDecision":"block"'; then
       echo "  FAIL  $name (unexpected block: ${stdout:0:120})"; FAIL=$((FAIL+1))
     else
       echo "  PASS  $name (no block)"; PASS=$((PASS+1))
     fi
   fi
+  rm -f "$stderr_file"
 }
 
 run_exact_io_test() {
@@ -232,19 +243,46 @@ cp "$PROJECT_DIR/.claude/logs/dim-audit/dim-2.json" "$PROJECT_DIR/.claude/logs/c
 printf '%s\n' '{"dim":3,"hook":"poison","residueCount":0,"findings":[]}' > "$PROJECT_DIR/.claude/logs/hook-residue/dim-3.json"
 printf '%s\n' '{"component":"Button","claimsVerified":1,"falseClaims":[]}' > "$PROJECT_DIR/.claude/logs/claude-a1b-deep/Button.json"
 cp "$PROJECT_DIR/.claude/logs/claude-a1b-deep/Button.json" "$PROJECT_DIR/.claude/logs/codex-phaseB/Button.json"
+set +e
+(cd "$PROJECT_DIR" && node scripts/verify-deep-audit-coverage.mjs --self-provider alpha >/dev/null 2>&1)
+VERIFY_FIXTURE_EXIT=$?
+set -e
+[ "$VERIFY_FIXTURE_EXIT" = "1" ] || { echo "FATAL: incomplete verifier fixture must exit 1, got $VERIFY_FIXTURE_EXIT"; exit 1; }
 T10="$USER_MSG
 "'{"message":{"role":"assistant","content":[{"type":"text","text":"deep audit 完成"}]}}'
-run_test "Test 10: poisoned .claude deep-audit ledger → block" 1 "$T10"
+run_test "Test 10: poisoned .claude deep-audit ledger → block" 1 "" "deep audit 完成"
 
-# Test 11: the hook accepts the provider-neutral verifier result after `.claude` deletion.
+# Test 11: the hook accepts a manifest-authorized one-run waiver after `.claude` deletion,
+# and never forwards adapter-injected ambient peer metadata as a verifier assertion.
 # Full immutable run/envelope closure belongs to scripts/test-verify-deep-audit-coverage.mjs;
 # this focused fixture proves argument wiring and that provider-home poison is never authority.
 mkdir -p "$EVIDENCE_ROOT/deep-audit"
-printf '%s\n' '{"complete":true}' > "$EVIDENCE_ROOT/deep-audit/fixture-complete.json"
+printf '%s\n' '{"secondOpinion":"waived-by-user"}' > "$EVIDENCE_ROOT/deep-audit/fixture-complete.json"
 rm -rf "$PROJECT_DIR/.claude"
-run_test "Test 11: neutral deep-audit ledger + deleted .claude → no block" 0 "$T10"
+run_test "Test 11: waived immutable run + ambient peer + deleted .claude → no block" 0 "" "deep audit 完成"
 [ ! -e "$PROJECT_DIR/infra/governance/runtime" ] || { echo "  FAIL  deep-audit evidence mutated workspace runtime"; FAIL=$((FAIL+1)); }
 
+# A waived run remains valid when the adapter has no peer runtime at all.
+unset GOVERNANCE_PEER_PROVIDER GOVERNANCE_PEER_DISPLAY_NAME GOVERNANCE_PEER_CLI \
+  GOVERNANCE_PEER_LOCAL_EXECUTABLE GOVERNANCE_PEER_REPLY_ARTIFACT_PREFIX \
+  GOVERNANCE_PEER_DISCOVERY_MARKERS_JSON
+run_test "Test 11b: waived immutable run + no peer runtime → no block" 0 "" "deep audit 完成"
+
+# Merely switching prose/context to no peer cannot waive a selected run: the
+# immutable verifier still requires the selected peer's complete evidence.
+printf '%s\n' '{"secondOpinion":"completed","peerEvidence":false}' > "$EVIDENCE_ROOT/deep-audit/fixture-complete.json"
+run_test "Test 11c: selected run without peer evidence → block" 1 "" "稽核全部完成"
+printf '%s\n' '{"secondOpinion":"completed","peerEvidence":true}' > "$EVIDENCE_ROOT/deep-audit/fixture-complete.json"
+run_test "Test 11d: selected run with complete peer evidence → no block" 0 "" "deep audit 完成"
+
+# Restore the normal registry-resolved peer context for the peer-specific hook tests below.
+export GOVERNANCE_PEER_PROVIDER=beta
+export GOVERNANCE_PEER_DISPLAY_NAME="Beta"
+export GOVERNANCE_PEER_CLI=beta
+export GOVERNANCE_PEER_LOCAL_EXECUTABLE=node_modules/.bin/beta
+export GOVERNANCE_PEER_REPLY_ARTIFACT_PREFIX=beta-reply
+export GOVERNANCE_PEER_DISCOVERY_MARKERS_JSON='["node_modules/.bin/beta","command -v beta"]'
+
 # Tests 12-14: inputs larger than a pipe buffer must preserve exact policy and I/O contracts.
 # Put each positive marker at the beginning so a producer→`grep -q` implementation would close
 # the pipe early and reproduce the historical Bash `echo: write error: Broken pipe` failure.

package/ds-canonical/skills/codify-principle/SKILL.md

@@ -107,7 +107,7 @@ Per layer 一個 commit:
 Scope / type / affected homes 是工程 mapping，由 agent 依 canonical 自行決定。只有原則文字本身對產品／UI／UX語意有多種合理解讀且會改 SSOT，才請 user 釐清。
 
 ### Gate 2 — Phase 2 benchmark
-< 3 家世界級對照 → 繼續 primary-source research 或標 `REVIEW-BLOCKED`；只有 OG-only 是否成為產品／UI／UX原則的選擇交給 user，工程治理原則由 evidence + security/hard gates 決定。
+< 3 家世界級對照 → 繼續 primary-source research，證據仍不足就不 codify 並明列 benchmark gap；只有 task／deliverable 明確要求 independent review 且 peer 證據不可得時才標 `REVIEW-BLOCKED`。只有 OG-only 是否成為產品／UI／UX原則的選擇交給 user，工程治理原則由 evidence + security/hard gates 決定。
 
 ### Gate 3 — Phase 3 per-layer
 每 layer 都過 tests／rollback check；task／deliverable 明確要求時才把 independent review 列為 required。工程 canonical substantive 直接執行，只有產品／UI／UX SSOT 真取捨停下。

package/ds-canonical/skills/design-system-audit/SKILL.md

@@ -361,6 +361,7 @@ Phase 1-3 覆蓋 D1+D2;D3-D6 chain 專門 skill。**模式**:高效(default)scop
 **Deep mode**(`--deep`):在**同一 run、final report 前**直接執行 `/knowledge-prune` full Phase 0–5；P0/P1/P2E auto-fix，只有 P2H 等 user。不得只排到 next turn、只寫 trigger、或以 report-only 冒充已跑。接著逐 row 讀 `packages/design-system/ds-canonical/references/governance-audit-coverage.md`，把每個 registered governance home／artifact 類型對到本次 deterministic 或 judgment evidence；未掛載外部 repo／缺 telemetry 必標 `UNOBSERVED`，不可寫 PASS。Trigger 條件(2026-05-17 加 4 條,共 9 條):registry-declared instruction budget 超標 / MEMORY > 20 / 動 Meta-Pattern / hook-fires 6 月 0 fire / corrections > 10 / **audit-prompts.md coverage < 100%** / **`@benchmark-unverified-blanket` count > 0** / **new audit dim added 本次** / **hooks count >= canonical soft threshold**。
 
 Deep final report 的收斂回執使用固定、可機械驗證的字串:`knowledge-prune: same-run complete`、`governance-coverage: same-run reconciled`（並列出各 `UNOBSERVED`），以及 `second opinion: waived by user`／`second opinion: not required by task`／可驗證的 required peer review 其一。回執缺席時 final report 必須 fail closed，不得把 recovery trigger 當作已完成證據。
+若 user 明確只豁免本次 second opinion，formal run 準備必顯式帶 `--second-opinion-waiver user`，把 exact one-run authority 固定進 immutable manifest；報告文字不能反向替未授權 run 補造 waiver，也不得和任何 peer selection 參數並用。
 
 Deep mode 的 full D10 同時依 [runtime evidence retention canonical](../../references/runtime-evidence-retention.md) 枚舉各 observed worktree 的 runtime evidence、保留 live/genuine/unexpired closure，並自主回收可安全判定的 unreferenced blocked/failed/stale whole run；禁止 partial CAS pruning 或新增 user approval ceremony。
 

package/ds-canonical/skills/design-system-audit/references/audit-prompts.md

@@ -1297,13 +1297,13 @@ Report file:line gaps。End:`N onboarding 環節 checked, M gaps`。Don't fix.
 
 ## 66. Immutable cross-repo promotion + visual parity(CI-ENFORCED,2026-07-25 升級)
 
-**Type**: Absolute / **Canonical**: `release.yml` stage + `release-finalize.yml` + `mirror-to-published-template.yml` + `consumerctl plan/check/apply-fanout` + `template/sync-design-system.yml` + `governance-anchor.yml` + `composition-fidelity.yml` + `dogfood-prepublish-verify.mjs` + `scripts/visual-assertions.json` + `ci-evidence-plan.json` / **Home**: scenario-definition.md mirror chain
+**Type**: Absolute / **Canonical**: protected-main `release.yml` exact-tag build-once + npm Trusted Publishing + GitHub/npm readback + `mirror-to-published-template.yml` + `consumerctl plan/check/apply-fanout` + consumer native `audit.yml / Verify consumer` + `composition-fidelity.yml` + `dogfood-prepublish-verify.mjs` + `scripts/visual-assertions.json` + `ci-evidence-plan.json` + `infra/governance/desired/github.json` / **Home**: scenario-definition.md mirror chain
 
 ```
 Your job(NO-SAMPLE):驗 protected DS PR merge → attested npm publish → template/fleet exact-version PR → consumer required CI/visual parity 整鏈無斷；任何 direct-main、PAT fallback、mutable tag dependency 都是失敗。
-**成立條件**:必須讀回受保護主分支的 ruleset、可信 GitHub App required check、精確 candidate commit、immutable release/BOM、template/fleet exact-version PR 與 consumer required visual checks，並由封閉 schema 的 CI evidence receipt 綁定同一 frozen deep-audit run。只讀 workflow 原始碼、模型判斷或手寫 JSON 不構成通過證據；遠端尚未啟用時必標 pending/fail-closed。
-Enumerate + Read:release stage/finalizer → mirror workflow → consumerctl plan/check/apply-fanout →
-sync-design-system.yml(fork 端只收 exact `governance-release` / manual API path)→ governance-anchor required verdict /
+**成立條件**:必須讀回受保護主分支的 ruleset、GitHub native `Verify consumer` required check、精確 candidate commit、immutable release/BOM、template/fleet exact-version PR 與 consumer required visual checks，並由封閉 schema 的 CI evidence receipt 綁定同一 frozen deep-audit run。consumer profile 必為零 App environment／零 App verdict producer；只讀 workflow 原始碼、模型判斷或手寫 JSON 不構成通過證據；遠端尚未啟用時必標 pending/fail-closed。
+Enumerate + Read:protected-main `release.yml` exact-tag build-once/publish/readback → mirror workflow → consumerctl plan/check/apply-fanout →
+template exact-version PR 的 `audit.yml / Verify consumer` → product-consumer exact-version PR 的同名 native required verdict /
 composition-fidelity visual-diff scenarios(全 N scenario)/ dogfood-prepublish / CI evidence plan。對每環節驗 trigger
 event allowlist、exact version/BOM/candidate/PR/check readback 綁定、無 PAT scope 漏或 direct-main fallback、visual
 parity scenario 覆蓋 stakeholder flow。Report file:line。End:`N 環節, M gaps`。Don't fix.

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "git+https://github.com/ajenchen/design-system.git"
   },
-  "version": "0.1.0-beta.105",
+  "version": "0.1.0-beta.106",
   "private": false,
   "description": "World-class design system — components, patterns, tokens, hooks (single source of truth for team distribution).",
   "type": "module",

package/ds-canonical/fork/consumer/managed-files/6929a3c8bb4d69c507720b4754aeb339c6cbb8ff655e0a381d76606d64695e38.blob

@@ -1,393 +0,0 @@
-#!/usr/bin/env node
-// Base-trusted preflight for pull_request_target. The candidate tree is data:
-// no candidate script or dependency is executed here.
-
-import { createHash } from 'node:crypto'
-import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, writeFileSync } from 'node:fs'
-import { resolve, join, relative } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import {
-  validateUpgradeTrustPolicy,
-  verifyUpgradeProvenance,
-} from './verify-upgrade-provenance.mjs'
-import { assertNoRootNpmShrinkwrap } from './lib/governance-dependency-bootstrap.mjs'
-import { compareUtf8Bytes } from './lib/provider-lifecycle.mjs'
-
-const EXACT = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/
-const PACKAGES = ['@qijenchen/design-system', '@qijenchen/storybook-config']
-const PRODUCT_WORKSPACES = ['apps/*']
-const PRODUCT_WORKSPACE_LINK = /^node_modules\/@product\/[A-Za-z0-9._-]+$/
-const PRODUCT_WORKSPACE_PATH = /^apps\/[A-Za-z0-9._-]+$/
-const REGISTRY_ORIGIN = 'https://registry.npmjs.org'
-const REGISTRY_RESPONSE_MAX_BYTES = 1024 * 1024
-const REGISTRY_USER_AGENT = 'qijenchen-governance-anchor-preflight/1'
-
-function parseVersion(value) {
-  const match = String(value || '').match(EXACT)
-  if (!match) throw new Error(`exact semver required; got ${JSON.stringify(value)}`)
-  return { core: match.slice(1, 4).map(Number), pre: match[4]?.split('.') ?? null }
-}
-
-function compareVersion(a, b) {
-  const left = parseVersion(a)
-  const right = parseVersion(b)
-  for (let i = 0; i < 3; i += 1) if (left.core[i] !== right.core[i]) return left.core[i] - right.core[i]
-  if (left.pre === null || right.pre === null) return left.pre === right.pre ? 0 : left.pre === null ? 1 : -1
-  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i += 1) {
-    if (left.pre[i] === undefined || right.pre[i] === undefined) return left.pre[i] === undefined ? -1 : 1
-    if (left.pre[i] === right.pre[i]) continue
-    const an = /^\d+$/.test(left.pre[i])
-    const bn = /^\d+$/.test(right.pre[i])
-    if (an && bn) return Number(left.pre[i]) - Number(right.pre[i])
-    if (an !== bn) return an ? -1 : 1
-    return compareUtf8Bytes(left.pre[i], right.pre[i])
-  }
-  return 0
-}
-
-function readJson(path, label) {
-  try { return JSON.parse(readFileSync(path, 'utf8')) }
-  catch (error) { throw new Error(`${label} is missing or invalid: ${error.message}`) }
-}
-
-function canonicalTarball(name, version) {
-  return `https://registry.npmjs.org/${name}/-/${name.split('/').at(-1)}-${version}.tgz`
-}
-
-function inspectCandidateSource(root, { allowInstalledDependencies = false } = {}) {
-  const rootStat = lstatSync(root)
-  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) throw new Error('candidate root must be a real directory')
-  const digest = createHash('sha256')
-  const visit = (directory) => {
-    for (const entry of readdirSync(directory).sort()) {
-      const path = join(directory, entry)
-      const rel = relative(root, path).replaceAll('\\', '/')
-      const stat = lstatSync(path)
-      if (rel === '.git') {
-        if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error('candidate .git must be a real directory')
-        continue
-      }
-      if (entry === 'node_modules') {
-        if (!allowInstalledDependencies) throw new Error(`candidate preinstall dependency tree forbidden: ${rel}`)
-        if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error(`installed dependency root must be a real directory: ${rel}`)
-        if (rel !== 'node_modules' && !/^apps\/[A-Za-z0-9._-]+\/node_modules$/.test(rel)) {
-          throw new Error(`installed dependency tree is outside canonical npm roots: ${rel}`)
-        }
-        continue
-      }
-      if (stat.isSymbolicLink()) throw new Error(`candidate symlink forbidden: ${rel}`)
-      if (stat.isDirectory()) {
-        digest.update(`directory\0${rel}\0${stat.mode & 0o777}\0`)
-        visit(path)
-      } else if (stat.isFile()) {
-        digest.update(`file\0${rel}\0${stat.mode & 0o777}\0`)
-        digest.update(readFileSync(path))
-        digest.update('\0')
-      } else {
-        throw new Error(`candidate special filesystem entry forbidden: ${rel}`)
-      }
-    }
-  }
-  visit(root)
-  return digest.digest('hex')
-}
-
-function packageSetDigest(packages) {
-  return createHash('sha256').update(JSON.stringify(packages)).digest('hex')
-}
-
-function validateInstalledWorkspaceLinks(candidate, lock) {
-  const dependencyRoot = join(candidate, 'node_modules')
-  const expected = new Map(Object.entries(lock.packages)
-    .filter(([, entry]) => entry?.link === true)
-    .map(([path, entry]) => [path, entry.resolved]))
-  const observed = new Map()
-  const inspectLink = (absolute, rel) => {
-    const stat = lstatSync(absolute)
-    if (!stat.isSymbolicLink()) return
-    observed.set(rel, resolve(join(absolute, '..'), readlinkSync(absolute)))
-  }
-  for (const name of readdirSync(dependencyRoot).sort()) {
-    const absolute = join(dependencyRoot, name)
-    const stat = lstatSync(absolute)
-    const rel = `node_modules/${name}`
-    if (stat.isSymbolicLink()) inspectLink(absolute, rel)
-    else if (stat.isDirectory() && name.startsWith('@')) {
-      for (const child of readdirSync(absolute).sort()) inspectLink(join(absolute, child), `${rel}/${child}`)
-    }
-  }
-  for (const [path, target] of observed) {
-    if (!expected.has(path)) throw new Error(`installed tree contains an unexpected workspace symlink: ${path}`)
-    if (target !== resolve(candidate, expected.get(path))) throw new Error(`installed workspace symlink target differs from the exact lock: ${path}`)
-  }
-  for (const [path, target] of expected) {
-    const absolute = join(candidate, path)
-    if (!observed.has(path) || !lstatSync(absolute).isSymbolicLink() || observed.get(path) !== resolve(candidate, target)) {
-      throw new Error(`installed tree is missing the exact locked workspace symlink: ${path}`)
-    }
-  }
-}
-
-export function createPreinstallEvidence(locked, candidateRoot) {
-  return {
-    schemaVersion: 1,
-    candidateRoot: resolve(candidateRoot),
-    sourceDigest: locked.sourceDigest,
-    designSystem: locked.designSystem,
-    lockEntries: locked.files,
-    packageSetDigest: packageSetDigest(locked.packages),
-  }
-}
-
-function validatePreinstallEvidence(evidence, candidateRoot) {
-  const expectedKeys = ['candidateRoot', 'designSystem', 'lockEntries', 'packageSetDigest', 'schemaVersion', 'sourceDigest']
-  if (!evidence || typeof evidence !== 'object' || Array.isArray(evidence)
-    || JSON.stringify(Object.keys(evidence).sort()) !== JSON.stringify(expectedKeys)) {
-    throw new Error('preinstall evidence has an open or incomplete shape')
-  }
-  if (evidence.schemaVersion !== 1 || evidence.candidateRoot !== resolve(candidateRoot)) throw new Error('preinstall evidence candidate/schema binding mismatch')
-  if (!/^[0-9a-f]{64}$/.test(evidence.sourceDigest || '') || !/^[0-9a-f]{64}$/.test(evidence.packageSetDigest || '')) {
-    throw new Error('preinstall evidence digest is invalid')
-  }
-  if (!Number.isSafeInteger(evidence.lockEntries) || evidence.lockEntries < 1) throw new Error('preinstall evidence lock cardinality is invalid')
-  parseVersion(evidence.designSystem)
-  return evidence
-}
-
-function canonicalRegistryMetadataUrl(name, version) {
-  if (!PACKAGES.includes(name)) throw new Error(`registry package is outside the closed governance set: ${name}`)
-  parseVersion(version)
-  return `${REGISTRY_ORIGIN}/${name.replace('/', '%2F')}/${encodeURIComponent(version)}`
-}
-
-export async function liveRegistry(name, version, {
-  fetchImpl = globalThis.fetch,
-  signal = AbortSignal.timeout(30_000),
-} = {}) {
-  if (typeof fetchImpl !== 'function') throw new Error('native HTTPS registry transport is unavailable')
-  const expectedUrl = canonicalRegistryMetadataUrl(name, version)
-  const response = await fetchImpl(expectedUrl, {
-    method: 'GET',
-    redirect: 'error',
-    credentials: 'omit',
-    cache: 'no-store',
-    referrerPolicy: 'no-referrer',
-    headers: {
-      Accept: 'application/json',
-      'User-Agent': REGISTRY_USER_AGENT,
-    },
-    signal,
-  })
-  if (!response || response.status !== 200) {
-    throw new Error(`registry metadata response status is not exactly 200: ${String(response?.status)}`)
-  }
-  if (response.url !== expectedUrl) throw new Error('registry metadata response URL differs from the exact request')
-
-  const contentType = response.headers?.get?.('content-type') || ''
-  if (!/^application\/json(?:\s*;\s*charset=utf-8)?$/i.test(contentType)) {
-    throw new Error(`registry metadata content type is not exact JSON: ${contentType}`)
-  }
-  const declaredLength = response.headers?.get?.('content-length')
-  if (declaredLength !== null && declaredLength !== undefined) {
-    if (!/^(?:0|[1-9]\d*)$/.test(declaredLength)) throw new Error('registry metadata content length is invalid')
-    const length = Number(declaredLength)
-    if (!Number.isSafeInteger(length) || length > REGISTRY_RESPONSE_MAX_BYTES) {
-      throw new Error('registry metadata response exceeds the closed byte limit')
-    }
-  }
-  if (!response.body || typeof response.body[Symbol.asyncIterator] !== 'function') {
-    throw new Error('registry metadata response body is not a bounded byte stream')
-  }
-
-  const chunks = []
-  let total = 0
-  for await (const chunk of response.body) {
-    if (!(chunk instanceof Uint8Array)) throw new Error('registry metadata response emitted a non-byte chunk')
-    total += chunk.byteLength
-    if (total > REGISTRY_RESPONSE_MAX_BYTES) throw new Error('registry metadata response exceeds the closed byte limit')
-    chunks.push(Buffer.from(chunk))
-  }
-  if (declaredLength !== null && declaredLength !== undefined && total !== Number(declaredLength)) {
-    throw new Error('registry metadata response length differs from the declared byte count')
-  }
-  if (total === 0) throw new Error('registry metadata response body is empty')
-
-  let raw
-  try {
-    raw = new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks, total))
-  } catch (error) {
-    throw new Error(`registry metadata response is not valid UTF-8: ${error.message}`)
-  }
-  let body
-  try {
-    body = JSON.parse(raw)
-  } catch (error) {
-    throw new Error(`registry metadata response is not valid JSON: ${error.message}`)
-  }
-  const expectedTarball = canonicalTarball(name, version)
-  if (!body || typeof body !== 'object' || Array.isArray(body)
-    || body.name !== name || body.version !== version
-    || !body.dist || typeof body.dist !== 'object' || Array.isArray(body.dist)
-    || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(body.dist.integrity || '')
-    || body.dist.tarball !== expectedTarball) {
-    throw new Error('registry metadata identity or exact artifact binding is invalid')
-  }
-  return Object.freeze({
-    integrity: body.dist.integrity,
-    tarball: body.dist.tarball,
-  })
-}
-
-export async function verifyCandidateLock({
-  trustedRoot,
-  candidateRoot,
-  registryLookup = liveRegistry,
-  allowInstalledDependencies = false,
-  expectedSourceDigest = null,
-}) {
-  const trusted = resolve(trustedRoot)
-  const candidate = resolve(candidateRoot)
-  assertNoRootNpmShrinkwrap(candidate, { errorPrefix: 'GOV-ANCHOR-PREFLIGHT-LOCK-001' })
-  const sourceDigest = inspectCandidateSource(candidate, { allowInstalledDependencies })
-  if (expectedSourceDigest && sourceDigest !== expectedSourceDigest) throw new Error('candidate source changed after the preinstall trust check')
-
-  const trustedBom = readJson(join(trusted, 'governance/lock.json'), 'trusted governance lock')
-  const candidateBom = readJson(join(candidate, 'governance/lock.json'), 'candidate governance lock')
-  validateUpgradeTrustPolicy(trustedBom.upgradeTrust)
-  validateUpgradeTrustPolicy(candidateBom.upgradeTrust)
-  if (JSON.stringify(candidateBom.upgradeTrust) !== JSON.stringify(trustedBom.upgradeTrust)) {
-    throw new Error('candidate upgrade trust policy differs from the protected base')
-  }
-  const pkg = readJson(join(candidate, 'package.json'), 'candidate package.json')
-  const lock = readJson(join(candidate, 'package-lock.json'), 'candidate package-lock.json')
-  if (JSON.stringify(pkg.workspaces) !== JSON.stringify(PRODUCT_WORKSPACES)) {
-    throw new Error(`candidate workspaces must equal the protected product roots: ${PRODUCT_WORKSPACES.join(', ')}`)
-  }
-  if (lock.lockfileVersion !== 3 || !lock.packages || typeof lock.packages !== 'object') throw new Error('candidate requires closed npm lockfileVersion 3')
-
-  const rootLock = lock.packages[''] || {}
-  if (JSON.stringify(rootLock.workspaces) !== JSON.stringify(PRODUCT_WORKSPACES)) {
-    throw new Error(`candidate root lock workspaces must equal the protected product roots: ${PRODUCT_WORKSPACES.join(', ')}`)
-  }
-  for (const name of PACKAGES) {
-    const declared = pkg.dependencies?.[name]
-    parseVersion(declared)
-    const key = name === PACKAGES[0] ? 'designSystem' : 'storybookConfig'
-    const trustedVersion = trustedBom.release?.[key]
-    if (compareVersion(declared, trustedVersion) < 0) throw new Error(`${name} downgrade ${declared} < trusted base ${trustedVersion}`)
-    if (candidateBom.release?.[key] !== declared) throw new Error(`${name} does not match candidate governance lock`)
-    if (rootLock.dependencies?.[name] !== declared) throw new Error(`${name} root lock declaration is not exact`)
-
-    const entry = lock.packages[`node_modules/${name}`]
-    const expectedTarball = canonicalTarball(name, declared)
-    if (entry?.version !== declared || entry?.resolved !== expectedTarball || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(entry?.integrity || '')) {
-      throw new Error(`${name} lock entry is not the canonical exact npm artifact`)
-    }
-    const registry = await registryLookup(name, declared)
-    if (registry.tarball !== expectedTarball || registry.integrity !== entry.integrity) throw new Error(`${name} lock does not match live npm registry metadata`)
-  }
-  if (pkg.dependencies[PACKAGES[0]] !== pkg.dependencies[PACKAGES[1]]) throw new Error('DS and Storybook governance releases must move in lockstep')
-
-  for (const [path, entry] of Object.entries(lock.packages)) {
-    if (!entry || path === '') continue
-    if (entry.link === true) {
-      if (!PRODUCT_WORKSPACE_LINK.test(path) || !PRODUCT_WORKSPACE_PATH.test(entry.resolved || '')) throw new Error(`unsafe or non-product workspace link in lock: ${path}`)
-      const workspace = readJson(join(candidate, entry.resolved, 'package.json'), `workspace manifest for ${entry.resolved}`)
-      if (workspace.private !== true || workspace.name !== path.slice('node_modules/'.length)) throw new Error(`workspace link identity is not private and exact: ${path}`)
-      continue
-    }
-    if (entry.resolved && !String(entry.resolved).startsWith('https://registry.npmjs.org/')) throw new Error(`non-canonical registry source in lock: ${path}`)
-    if (entry.resolved && !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(entry.integrity || '')) throw new Error(`missing sha512 integrity in lock: ${path}`)
-  }
-  if (allowInstalledDependencies) validateInstalledWorkspaceLinks(candidate, lock)
-
-  return {
-    designSystem: pkg.dependencies[PACKAGES[0]],
-    files: Object.keys(lock.packages).length,
-    sourceDigest,
-    policy: trustedBom.upgradeTrust,
-    packages: PACKAGES.map((name) => ({
-      name,
-      version: pkg.dependencies[name],
-      integrity: lock.packages[`node_modules/${name}`].integrity,
-    })),
-  }
-}
-
-export async function verifyCandidate({
-  trustedRoot,
-  candidateRoot,
-  registryLookup = liveRegistry,
-  auditReport,
-  releaseLookup,
-  preinstallEvidence = null,
-}) {
-  const evidence = preinstallEvidence ? validatePreinstallEvidence(preinstallEvidence, candidateRoot) : null
-  const locked = await verifyCandidateLock({
-    trustedRoot,
-    candidateRoot,
-    registryLookup,
-    allowInstalledDependencies: Boolean(evidence),
-    expectedSourceDigest: evidence?.sourceDigest || null,
-  })
-  if (evidence && (
-    locked.designSystem !== evidence.designSystem
-    || locked.files !== evidence.lockEntries
-    || packageSetDigest(locked.packages) !== evidence.packageSetDigest
-  )) throw new Error('candidate lock identity changed after the preinstall trust check')
-  if (!auditReport) throw new Error('verified npm audit-signatures JSON with provenance bundles is required')
-  const provenance = await verifyUpgradeProvenance({
-    auditReport,
-    packages: locked.packages,
-    version: locked.designSystem,
-    policy: locked.policy,
-    ...(releaseLookup ? { releaseLookup } : {}),
-  })
-  return { designSystem: locked.designSystem, files: locked.files, provenance }
-}
-
-if (fileURLToPath(import.meta.url) === process.argv[1]) {
-  const rawArgs = process.argv.slice(2)
-  const valueOf = (name) => {
-    const index = rawArgs.indexOf(name)
-    return index >= 0 ? rawArgs[index + 1] : undefined
-  }
-  const args = {
-    trusted: valueOf('--trusted'),
-    candidate: valueOf('--candidate'),
-    verifiedAttestations: valueOf('--verified-attestations'),
-    evidenceOut: valueOf('--evidence-out'),
-    preinstallEvidence: valueOf('--preinstall-evidence'),
-    lockOnly: rawArgs.includes('--lock-only'),
-  }
-  if (!args.trusted || !args.candidate) {
-    console.error('usage: governance-anchor-preflight.mjs --trusted <base> --candidate <head> [--lock-only --evidence-out <file> | --verified-attestations <npm-audit.json> --preinstall-evidence <file>]')
-    process.exit(2)
-  }
-  try {
-    if (args.lockOnly === Boolean(args.verifiedAttestations)
-      || args.lockOnly !== Boolean(args.evidenceOut)
-      || Boolean(args.verifiedAttestations) !== Boolean(args.preinstallEvidence)) {
-      throw new Error('select lock-only with evidence-out, or verified-attestations with preinstall-evidence')
-    }
-    let result
-    if (args.lockOnly) {
-      result = await verifyCandidateLock({ trustedRoot: args.trusted, candidateRoot: args.candidate })
-      writeFileSync(resolve(args.evidenceOut), `${JSON.stringify(createPreinstallEvidence(result, args.candidate), null, 2)}\n`, { flag: 'wx', mode: 0o600 })
-    } else {
-      result = await verifyCandidate({
-        trustedRoot: args.trusted,
-        candidateRoot: args.candidate,
-        auditReport: readJson(resolve(args.verifiedAttestations), 'verified npm attestation report'),
-        preinstallEvidence: readJson(resolve(args.preinstallEvidence), 'preinstall trust evidence'),
-      })
-    }
-    const identity = result.provenance
-      ? `; ${result.provenance.repository}@${result.provenance.gitCommit} ${result.provenance.releaseAssetDigest}`
-      : '; lock-only'
-    console.log(`✅ base-trusted candidate preflight PASS (${result.designSystem}; ${result.files} lock entries${identity})`)
-  } catch (error) {
-    console.error(`❌ GOV-ANCHOR-PREFLIGHT: ${error.message}`)
-    process.exit(1)
-  }
-}

package/ds-canonical/fork/consumer/managed-files/e1b11160d6c4043002d2cbff6d9a4ae551698a96137773c4244dadfac152fcb0.blob

@@ -1,222 +0,0 @@
-name: Governance anchor
-
-# This workflow is loaded from protected base. Candidate code runs only in the
-# credential-free verify job. A separate fresh runner, restricted to the
-# protected-branches-only governance-check-verdict environment, publishes the
-# verdict with the dedicated check-only App. Rulesets pin that App integration
-# ID, never the spoofable github-actions job context.
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review]
-  repository_dispatch:
-    # The dedicated Writer App may trigger ordinary candidate workflows, but those
-    # runs are never the required trust anchor. This explicit event reloads only the
-    # protected-default workflow and binds the automatic Check App validation path.
-    types: [governance-upgrade-candidate-validation]
-
-permissions:
-  contents: read
-
-jobs:
-  verify-candidate:
-    name: Base-trusted candidate verification
-    runs-on: ubuntu-24.04
-    timeout-minutes: 25
-    outputs:
-      base_sha: ${{ steps.request.outputs.base_sha }}
-      candidate_repo: ${{ steps.request.outputs.candidate_repo }}
-      head_sha: ${{ steps.request.outputs.head_sha }}
-      pull_number: ${{ steps.request.outputs.pull_number }}
-    steps:
-      - name: Resolve live PR and bind explicit dispatch to protected main
-        id: request
-        env:
-          GH_TOKEN: ${{ github.token }}
-          EVENT_NAME: ${{ github.event_name }}
-          EVENT_SOURCE: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.source || 'pull-request-target-v1' }}
-          EVENT_PR_NUMBER: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.pull_number || github.event.pull_request.number }}
-          EVENT_HEAD_SHA: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.head_sha || github.event.pull_request.head.sha }}
-          EVENT_BASE_SHA: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.base_sha || github.event.pull_request.base.sha }}
-        run: |
-          test -n "$GH_TOKEN"
-          [[ "$EVENT_PR_NUMBER" =~ ^[1-9][0-9]*$ ]]
-          [[ "$EVENT_HEAD_SHA" =~ ^[a-f0-9]{40}$ ]]
-          [[ "$EVENT_BASE_SHA" =~ ^[a-f0-9]{40}$ ]]
-          if [ "$EVENT_NAME" = repository_dispatch ]; then
-            test "$EVENT_SOURCE" = governance-upgrade-writer-v1
-            jq -e '(.client_payload | keys | sort) == ["base_sha","head_sha","pull_number","source"]' "$GITHUB_EVENT_PATH" >/dev/null
-          fi
-
-          PR_JSON=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$EVENT_PR_NUMBER")
-          test "$(jq -r '.state' <<<"$PR_JSON")" = open
-          test "$(jq -r '.base.ref' <<<"$PR_JSON")" = main
-          test "$(jq -r '.base.sha' <<<"$PR_JSON")" = "$EVENT_BASE_SHA"
-          test "$(jq -r '.head.sha' <<<"$PR_JSON")" = "$EVENT_HEAD_SHA"
-          CANDIDATE_REPO=$(jq -r '.head.repo.full_name' <<<"$PR_JSON")
-          HEAD_REF=$(jq -r '.head.ref' <<<"$PR_JSON")
-          [[ "$CANDIDATE_REPO" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
-          [[ "$HEAD_REF" =~ ^[A-Za-z0-9._/-]+$ ]]
-          if [ "$EVENT_NAME" = repository_dispatch ]; then
-            test "$CANDIDATE_REPO" = "$GITHUB_REPOSITORY"
-            [[ "$HEAD_REF" =~ ^governance/upgrade- ]]
-          fi
-          LIVE_MAIN_SHA=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq '.object.sha')
-          test "$LIVE_MAIN_SHA" = "$EVENT_BASE_SHA" || {
-            echo 'GOV-ANCHOR-SOURCE-001: protected main moved before candidate validation'
-            exit 1
-          }
-          echo "base_sha=$EVENT_BASE_SHA" >> "$GITHUB_OUTPUT"
-          echo "candidate_repo=$CANDIDATE_REPO" >> "$GITHUB_OUTPUT"
-          echo "head_sha=$EVENT_HEAD_SHA" >> "$GITHUB_OUTPUT"
-          echo "pull_number=$EVENT_PR_NUMBER" >> "$GITHUB_OUTPUT"
-
-      - name: Checkout protected base verifier
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          ref: ${{ steps.request.outputs.base_sha }}
-          path: trusted
-          persist-credentials: false
-
-      - name: Checkout candidate as untrusted data
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          repository: ${{ steps.request.outputs.candidate_repo }}
-          ref: ${{ steps.request.outputs.head_sha }}
-          path: candidate
-          persist-credentials: false
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '24.14.0'
-
-      - name: Install protected-base verifier dependencies without lifecycle execution
-        working-directory: trusted
-        env:
-          NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/empty-user.npmrc
-          NPM_CONFIG_GLOBALCONFIG: ${{ runner.temp }}/empty-global.npmrc
-        run: |
-          npm run setup:governance
-
-      - name: Stage protected product-check tools and exact Playwright runtime before candidate execution
-        run: |
-          node trusted/scripts/consumer-source-harness.mjs \
-            --stage-trusted-product-checks trusted/.governance-tools \
-            --trusted trusted
-          node trusted/node_modules/playwright/cli.js install --with-deps chromium
-
-      - name: Reject downgrade, alternate registry, lock and provenance substitution
-        run: >-
-          node trusted/scripts/governance-anchor-preflight.mjs
-          --trusted trusted --candidate candidate --lock-only
-          --evidence-out "$RUNNER_TEMP/candidate-preinstall-evidence.json"
-
-      - name: Install and audit candidate dependencies without executing installed code
-        working-directory: candidate
-        env:
-          NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/empty-user.npmrc
-          NPM_CONFIG_GLOBALCONFIG: ${{ runner.temp }}/empty-global.npmrc
-        run: >-
-          node ../trusted/scripts/setup-governance.mjs
-          --dependencies-only --root .
-
-      - name: Verify every registry signature
-        working-directory: candidate
-        env:
-          NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/empty-user.npmrc
-          NPM_CONFIG_GLOBALCONFIG: ${{ runner.temp }}/empty-global.npmrc
-        run: |
-          EXPECTED_NPM=$(node ../trusted/scripts/workflow-static-validation.mjs \
-            print-exact-npm-version --manifest ../trusted/package.json)
-          ACTUAL_NPM=$(node ../trusted/node_modules/npm/bin/npm-cli.js --version)
-          test "$ACTUAL_NPM" = "$EXPECTED_NPM"
-          node ../trusted/node_modules/npm/bin/npm-cli.js audit signatures \
-            --json --include-attestations --registry=https://registry.npmjs.org/ \
-            > "$RUNNER_TEMP/verified-attestations.json"
-
-      - name: Bind verified provenance to immutable GitHub Release BOM
-        run: >-
-          node trusted/scripts/governance-anchor-preflight.mjs
-          --trusted trusted --candidate candidate
-          --verified-attestations "$RUNNER_TEMP/verified-attestations.json"
-          --preinstall-evidence "$RUNNER_TEMP/candidate-preinstall-evidence.json"
-
-      - name: Execute only the authenticated immutable checker
-        working-directory: candidate
-        run: >-
-          node ../trusted/scripts/setup-governance.mjs
-          --installed-check-only --root .
-
-      - name: Base-owned exhaustive workspace type/build harness under a candidate-only identity
-        run: |
-          sudo useradd --system --user-group --no-create-home --shell /usr/sbin/nologin governance-candidate
-          sudo install -d -o governance-candidate -g governance-candidate -m 0700 "$RUNNER_TEMP/governance-candidate-home"
-          sudo chown -R governance-candidate:governance-candidate candidate
-          NODE_BIN=$(command -v node)
-          test -n "$NODE_BIN"
-          NODE_DIR=$(dirname "$NODE_BIN")
-          sudo -u governance-candidate env -i \
-            HOME="$RUNNER_TEMP/governance-candidate-home" \
-            PATH="$NODE_DIR:/usr/bin:/bin" \
-            CI=true \
-            "$NODE_BIN" trusted/.governance-tools/scripts/consumer-source-harness.mjs --repo candidate
-          set +e
-          sudo pkill -KILL -u governance-candidate
-          PKILL_STATUS=$?
-          set -e
-          test "$PKILL_STATUS" = 0 || test "$PKILL_STATUS" = 1
-          sudo chmod -R a-w candidate
-
-      - name: Reverify protected tools then treat the frozen candidate only as product-check input
-        run: |
-          node trusted/scripts/consumer-source-harness.mjs \
-            --verify-trusted-product-checks trusted/.governance-tools \
-            --trusted trusted
-          node trusted/.governance-tools/scripts/lint-ds-internal-imports.mjs --repo candidate
-          node trusted/.governance-tools/scripts/audit-consumer-a11y.mjs --repo candidate
-
-  publish-app-verdict:
-    name: Publish Governance App verdict
-    if: ${{ always() && needs.verify-candidate.outputs.head_sha != '' }}
-    needs: verify-candidate
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    environment:
-      name: governance-check-verdict
-    steps:
-      - name: Mint check-only Governance App token on a fresh runner
-        id: app-token
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
-        with:
-          app-id: ${{ secrets.GOVERNANCE_CHECK_APP_ID }}
-          private-key: ${{ secrets.GOVERNANCE_CHECK_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: ${{ github.event.repository.name }}
-          permission-checks: write
-
-      - name: Publish non-spoofable aggregate check
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          HEAD_SHA: ${{ needs.verify-candidate.outputs.head_sha }}
-          WORKFLOW_REF: ${{ github.workflow_ref }}
-          WORKFLOW_SHA: ${{ github.workflow_sha }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-          DETAILS_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          VERIFY_RESULT: ${{ needs.verify-candidate.result }}
-        run: |
-          if [ "$VERIFY_RESULT" = success ]; then
-            CONCLUSION=success
-            SUMMARY='Base-trusted preflight, signed immutable governance, typecheck, build and accessibility audit passed.'
-          else
-            CONCLUSION=failure
-            SUMMARY="Base-trusted verification ended with: $VERIFY_RESULT"
-          fi
-          jq -n \
-            --arg name 'Immutable consumer snapshot' \
-            --arg head_sha "$HEAD_SHA" \
-            --arg external_id "governance-check-v1|$WORKFLOW_REF|$WORKFLOW_SHA|$HEAD_SHA|$RUN_ID|$RUN_ATTEMPT" \
-            --arg details_url "$DETAILS_URL" \
-            --arg conclusion "$CONCLUSION" \
-            --arg summary "$SUMMARY" \
-            '{name:$name,head_sha:$head_sha,external_id:$external_id,details_url:$details_url,status:"completed",conclusion:$conclusion,output:{title:$name,summary:$summary}}' \
-            | gh api --method POST "repos/$GITHUB_REPOSITORY/check-runs" --input -