@volter/twin-catalog 0.2.32 → 0.2.34

package/catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "sourceCommit": "8139c5d489b73762bf5ba34d4cf37235eb30bb46",
-  "digest": "3195c901d6068ef7be8e9e23676b9b6ec58fb4e50c2d5604bbea390fefec9fdb",
+  "sourceCommit": "6974ffe917b9d91212225eed921b735428cf07ec",
+  "digest": "b21e251b1ff51975a212e56872423830967cd3a1b6a258af4eca0db7287574fe",
   "versions": [
     {
       "vendor": "tavily",
@@ -178,6 +178,31 @@
       },
       "assessed": true
     },
+    {
+      "vendor": "linear",
+      "package": "@volter/twin-linear",
+      "source": "twin-packs-open",
+      "version": "3.0.3",
+      "status": "live",
+      "integrity": "sha512-3V84nwtDUtwgyZOXzclEZMCZqjEeidbSH32okOm+pUk6z9RqaSHJN87gVdXJht8UYh3sUnr2fYiCA1mK2w75Uw==",
+      "submission": "5eeaa5e7c2a08c8c0818489c40e7b818c114bd74f5c1b8186e0de69f8792049c",
+      "commit": "3233dacae25f66f02b7c27b916757303c976107d",
+      "at": "2026-10-07T04:24:58Z",
+      "by": "moderated-merge",
+      "evidence": {
+        "submission": "5eeaa5e7c2a08c8c0818489c40e7b818c114bd74f5c1b8186e0de69f8792049c",
+        "admissionCommit": "3233dacae25f66f02b7c27b916757303c976107d",
+        "pullRequest": 33,
+        "url": "https://github.com/volter-ai/twin-catalog-open/releases/tag/evidence-5eeaa5e7c2a08c8c0818489c40e7b818c114bd74f5c1b8186e0de69f8792049c-152efe3a9b34320e1f091209316028794e3d9641da763e7cc68c4f32301d6ed2",
+        "reportSha256": "152efe3a9b34320e1f091209316028794e3d9641da763e7cc68c4f32301d6ed2",
+        "reportPath": "evidence/5eeaa5e7c2a08c8c0818489c40e7b818c114bd74f5c1b8186e0de69f8792049c.json",
+        "moderation": {
+          "mode": "internal-maintainer-merge",
+          "mergedBy": "yueranyuan"
+        }
+      },
+      "assessed": true
+    },
     {
       "vendor": "openai",
       "package": "@volter/twin-openai",

package/docs/process.md

@@ -47,7 +47,7 @@ does not change that pin. Removing a recommendation is not uninstalling a runnin
 Each assessed release exposes its artifact's description, license, Node requirements, kernel peer requirements,
 source directory and issue tracker beside its integrity, provenance and measured behavior. README and license links
 point to the source commit verified by npm provenance. They describe that version, not the publisher's current branch.
-The JSON-only reader also projects installed customer scope, pinned SDK dependencies, actual CLI/kernel/runtime versions, clock conditions, retention and teardown when the bound report measured them. An older report exposes `consumer: null`; it cannot acquire a passing workflow from publisher trust or a later test.
+The JSON-only reader also projects installed customer scope, pinned SDK dependencies, actual CLI/kernel/runtime versions, app-local dependency identity, clock conditions, retention and teardown when the bound report measured them. An older report without a customer workflow exposes `consumer: null`; one without app-local dependency evidence exposes `application: null`. Neither acquires newer installation evidence from publisher trust or a later test.
 
 Historical assessments without these retained fields show them as unavailable; current registry metadata does not
 fill missing historical evidence. A provenance link establishes source and build identity, not vendor fidelity.
@@ -120,6 +120,10 @@ never the contributor's head. Source-registration and maintenance PRs do not exe
 extraction, dependency installation and evaluation occur in disposable containers with no repository, npm, cloud,
 moderation or publication credentials, no Docker socket and no host project mounts. Install scripts are disabled.
 Dependencies are resolved once into a recorded lock; evaluation reuses that installation with network disabled.
+The customer app has its own candidate, CLI-matching kernel and SDK installation in a separate owned volume,
+outside the evaluator's dependency tree. Both volumes survive preparation and offline evaluation; temporary
+container files do not hold prepared inputs. The controller retains both dependency locks and verifies cleanup
+of every volume it created. This proves an app-local installation rather than ancestor dependency resolution.
 Before dependency installation, preparation confirms the candidate's exact version and integrity in npm's
 installation metadata as well as its exact-version metadata. These registry views may propagate separately.
 Tarball downloads also confirm availability and integrity before extraction. Only HTTP 404 or an otherwise valid package document without that version is retried, using the existing measured