@volter/twin-catalog 0.2.32 → 0.2.34

package/lib/browse.d.mts

@@ -14,6 +14,12 @@ export type Measurements = {
     fixture: string | null;
     sdkDependencies: Record<string, string> | null;
     tools: Record<string, string> | null;
+    application: null | {
+      appLocal: boolean;
+      candidate: { package: string; version: string; integrity: string };
+      kernel: { package: string; version: string };
+      dependencyLockSha256: string;
+    };
     clock: Record<string, unknown> | null;
     retainedReadback: boolean | null;
     retentionNotApplicable: string | null;

package/lib/browse.mjs

@@ -135,6 +135,7 @@ export function browse(root, { vendor, package: packageName, integrity = null }
                       scope: bound.report.consumer.scope ?? null, fixture: bound.report.consumer.fixture ?? null,
                       sdkDependencies: bound.envelope.prepared?.consumerFixture?.dependencies ?? null,
                       tools: bound.report.consumer.tools ?? null, clock: bound.report.consumer.clock ?? null,
+                      application: bound.report.consumer.application ?? null,
                       retainedReadback: bound.report.consumer.retainedReadback ?? null,
                       retentionNotApplicable: bound.report.consumer.retentionNotApplicable ?? null,
                       teardownVerified: bound.report.consumer.teardownVerified ?? null,

package/lib/runner.mjs

@@ -22,23 +22,28 @@ export function withContainer(root, input, output, execute, { spawn = spawnSync
     if (!allowFailure) requireThat(r.status === 0, `container ${args[0]} failed: ${r.error?.message ?? r.stderr}`);
     return r;
   };
-  let volume = false;
+  const volumes = [];
+  const customerVolume = `${id}-customer`;
   try {
     const tools = input.policy.tools;
     requireThat(tools['@volter/world'], 'policy must pin the product CLI for installed customer workflows');
     run(['build', '--iidfile', imageFile, '--build-arg', `NODE_IMAGE=${input.policy.nodeImage}`, '--build-arg', `BUN_VERSION=${input.policy.bun}`, '--build-arg', `STANDARD_VERSION=${tools['@volter/twin-standard']}`, '--build-arg', `CORE_VERSION=${tools['@volter/world-core']}`, '--build-arg', `RUNTIME_VERSION=${tools['@volter/world-runtime']}`, '--build-arg', `CLI_VERSION=${tools['@volter/world']}`, '--build-arg', `PLAYWRIGHT_VERSION=${tools.playwright}`, '-f', join(root, 'runner/Dockerfile'), root]);
     const image = readFileSync(imageFile, 'utf8').trim();
     requireThat(/^sha256:[a-f0-9]{64}$/.test(image), 'container image has no immutable identity');
-    run(['volume', 'create', '--label', `twin-catalog.owner=${id}`, '--label', `twin-catalog.run=${runOwner}`, id]); volume = true;
-    // Docker volumes start root-owned. Only this task's new volume is changed.
-    run(['run', '--rm', '--label', `twin-catalog.owner=${id}`, '--label', `twin-catalog.run=${runOwner}`, '--network', 'none', '--user', '0', '--entrypoint', 'chown', '-v', `${id}:/work`, image, '1000:1000', '/work']);
-    const common = ['run', '--rm', '--label', `twin-catalog.owner=${id}`, '--label', `twin-catalog.run=${runOwner}`, '--init', '--shm-size', '256m', '--read-only', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--tmpfs', '/tmp:rw,nosuid,nodev', '-e', 'HOME=/tmp/home', '-e', 'npm_config_cache=/tmp/npm-cache', '-v', `${id}:/work`, '-v', `${work}:/input:ro`];
+    for (const volume of [id, customerVolume]) {
+      run(['volume', 'create', '--label', `twin-catalog.owner=${id}`, '--label', `twin-catalog.run=${runOwner}`, volume]);
+      volumes.push(volume);
+    }
+    // Only these task-owned new volumes are changed; both persist across container phases.
+    run(['run', '--rm', '--label', `twin-catalog.owner=${id}`, '--label', `twin-catalog.run=${runOwner}`, '--network', 'none', '--user', '0', '--entrypoint', 'chown', '-v', `${id}:/work`, '-v', `${customerVolume}:/customer`, image, '1000:1000', '/work', '/customer']);
+    const common = ['run', '--rm', '--label', `twin-catalog.owner=${id}`, '--label', `twin-catalog.run=${runOwner}`, '--init', '--shm-size', '256m', '--read-only', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--tmpfs', '/tmp:rw,nosuid,nodev', '-e', 'HOME=/tmp/home', '-e', 'npm_config_cache=/tmp/npm-cache', '-v', `${id}:/work`, '-v', `${customerVolume}:/customer`, '-v', `${work}:/input:ro`];
     return execute({ image, common, run, owner: id });
   } finally {
-    const cleanup = volume ? run(['volume', 'rm', id], true) : null;
+    const cleanup = volumes.map(volume => ({ volume, result: run(['volume', 'rm', volume], true) }));
     write(`${output}.logs.json`, logs);
     // Retain input identity and diagnostics on failure; no other actor's resources are touched.
-    requireThat(!cleanup || cleanup.status === 0, `owned volume teardown could not be verified: ${id}`);
+    const failed = cleanup.filter(({ result }) => result.status !== 0);
+    requireThat(failed.length === 0, `owned volume teardown could not be verified: ${failed.map(({ volume }) => volume).join(', ')}`);
   }
 }
 
@@ -57,7 +62,8 @@ export function evaluate(root, input, output, options = {}) {
       const lock = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/work/package-lock.json","utf8"))']).stdout;
       requireThat(digest(lock) === prepared.dependencyLockSha256, 'dependency lock identity changed');
       write(`${output}.lock.json`, JSON.parse(lock));
-      const consumerLock = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/work/customer-app/package-lock.json","utf8"))']).stdout;
+      requireThat(prepared.consumer?.appDir === '/customer/app', 'prepared customer app is outside its owned volume');
+      const consumerLock = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/customer/app/package-lock.json","utf8"))']).stdout;
       requireThat(digest(consumerLock) === prepared.consumerDependencyLockSha256, 'customer SDK lock identity changed');
       write(`${output}.consumer-lock.json`, JSON.parse(consumerLock));
       phase = 'offline-assessment';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-catalog",
-  "version": "0.2.32",
+  "version": "0.2.34",
   "description": "The moderated twin distribution: approved versions and submission tooling for independent publishers.",
   "type": "module",
   "bin": {
@@ -38,7 +38,7 @@
     "evidence"
   ],
   "catalog": {
-    "sourceCommit": "8139c5d489b73762bf5ba34d4cf37235eb30bb46",
-    "digest": "3195c901d6068ef7be8e9e23676b9b6ec58fb4e50c2d5604bbea390fefec9fdb"
+    "sourceCommit": "6974ffe917b9d91212225eed921b735428cf07ec",
+    "digest": "b21e251b1ff51975a212e56872423830967cd3a1b6a258af4eca0db7287574fe"
   }
 }

package/policy.json

@@ -2,11 +2,11 @@
   "schemaVersion": 1,
   "registry": "https://registry.npmjs.org",
   "tools": {
-    "@volter/world-core": "3.0.108",
-    "@volter/world-runtime": "3.0.108",
-    "@volter/twin-standard": "1.0.100",
+    "@volter/world-core": "3.0.113",
+    "@volter/world-runtime": "3.0.113",
+    "@volter/twin-standard": "1.0.105",
     "playwright": "1.63.0",
-    "@volter/world": "3.0.108"
+    "@volter/world": "3.0.113"
   },
   "bun": "1.4.2",
   "nodeImage": "node:24-bookworm-slim",

package/runner/prepare.mjs

@@ -82,23 +82,25 @@ const provenance = await verifiedProvenance(await response.json(), source, bytes
 mkdirSync('/work/packs', { recursive: true });
 cpSync(join('/work/node_modules', s.package), join('/work/packs', s.vendor), { recursive: true });
 const { prepareConsumerApp } = await import(evaluatorRequire.resolve('@volter/twin-standard'));
-const appDir = '/work/customer-app';
-const consumerFixture = prepareConsumerApp(join('/work/packs', s.vendor), appDir);
+const productRoot = '/work/node_modules/@volter/world';
+const product = read(join(productRoot, 'package.json'));
+requireThat(product.name === '@volter/world' && product.version === policy.tools['@volter/world'], 'customer CLI differs from the product pin');
+requireThat(typeof product.bin?.volter === 'string', 'product has no declared volter entry');
+const cli = realpathSync(join(productRoot, product.bin.volter));
+requireThat(!relative(realpathSync(productRoot), cli).startsWith('..'), 'CLI entry is outside the installed product');
+// Keep the app outside /work's evaluator dependency tree.
+const appDir = '/customer/app';
+const consumerFixture = prepareConsumerApp(join('/work/packs', s.vendor), appDir, { cli });
 const appInstall = spawnSync('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--registry', policy.registry], { cwd: appDir, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
 requireThat(appInstall.status === 0, `customer SDK preparation failed: ${appInstall.stderr}`);
 const consumerLock = read(join(appDir, 'package-lock.json'));
+requireThat(consumerLock.packages[`node_modules/${s.package}`]?.integrity === s.integrity, 'customer candidate differs from the admitted artifact');
+requireThat(consumerLock.packages['node_modules/@volter/world-core']?.version === policy.tools['@volter/world-core'], 'customer kernel differs from the CLI pin');
 for (const [path, entry] of Object.entries(consumerLock.packages ?? {})) {
   if (!path) continue;
   requireThat(!entry.link && entry.resolved && entry.integrity, `${path}: customer dependency is not a locked registry artifact`);
   registryURL(entry.resolved, policy.registry);
 }
-// Other dependencies can own the flattened volter shortcut; use the exact product's declared entry.
-const productRoot = '/work/node_modules/@volter/world';
-const product = read(join(productRoot, 'package.json'));
-requireThat(product.name === '@volter/world' && product.version === policy.tools['@volter/world'], 'customer CLI differs from the product pin');
-requireThat(typeof product.bin?.volter === 'string', 'product has no declared volter entry');
-const cli = realpathSync(join(productRoot, product.bin.volter));
-requireThat(!relative(realpathSync(productRoot), cli).startsWith('..'), 'CLI entry is outside the installed product');
 const consumer = { appDir, cli, artifactIntegrity: s.integrity };
 // Retain listing facts from these exact bytes, never the registry's moving latest metadata.
 const packageMetadata = {

package/vendors/linear.json

@@ -0,0 +1,20 @@
+{
+  "vendor": "linear",
+  "packages": [
+    {
+      "name": "@volter/twin-linear",
+      "source": "twin-packs-open",
+      "versions": [
+        {
+          "version": "3.0.3",
+          "status": "live",
+          "integrity": "sha512-3V84nwtDUtwgyZOXzclEZMCZqjEeidbSH32okOm+pUk6z9RqaSHJN87gVdXJht8UYh3sUnr2fYiCA1mK2w75Uw==",
+          "submission": "5eeaa5e7c2a08c8c0818489c40e7b818c114bd74f5c1b8186e0de69f8792049c",
+          "commit": "3233dacae25f66f02b7c27b916757303c976107d",
+          "at": "2026-10-07T04:24:58Z",
+          "by": "moderated-merge"
+        }
+      ]
+    }
+  ]
+}