website-xp-phone 2.2.11 → 2.2.12

package/README.md

@@ -56,6 +56,12 @@ Build for production:
 npm run build
 ```
 
+`npm run build:local` runs the full pre-push pipeline locally — the same
+checks CI ("Website CI") runs on main: lockfile STABLE, the full build
+(with checksums + drift report), and the drift-policy gate, plus
+lint/tests/audit. `npm run check:ci` runs just the CI-equivalent subset
+(lockfile + build + drift policy) without the content refresh.
+
 Run linting:
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "website-xp-phone",
-  "version": "2.2.11",
+  "version": "2.2.12",
   "license": "GPL v2",
   "author": "Kirill <kine> Nevzorov <akinevz@outlook.com>",
   "type": "module",
@@ -15,7 +15,7 @@
     "refresh:content": "node ./scripts/refresh-content.mjs",
     "render": "echo 'https://render.com/'",
     "build": "vite build && npm run checksums && npm run render",
-    "build:local": "npm run refresh:content && npm run check:all && npm run build && npm run dev && git add -A && git commit",
+    "build:local": "npm run refresh:content && npm run check:lockfile && npm run check:all && npm run build && npm run verify:policy && npm run dev && git add -A && git commit",
     "build:ready": "git add -A && npm run push",
     "push": "git push origin main",
     "preview": "vite preview --host 127.0.0.1 --port 8086",
@@ -26,6 +26,8 @@
     "check:audit": "npm audit --audit-level=low",
     "check:security": "npm run lint && npm run test",
     "check:all": "npm run check:security && npm run check:audit",
+    "check:lockfile": "git diff --exit-code package-lock.json",
+    "check:ci": "npm run check:lockfile && npm run build && npm run verify:policy",
     "checksums": "node ./scripts/write-dist-checksums.mjs",
     "verify:policy": "node ./scripts/verify-policy.mjs",
     "postinstall": "node ./scripts/ensure-xpcss.mjs"

package/public/checksums.txt

@@ -30,7 +30,6 @@ c53afc7432e19212cdc0c22c3bbfd87e2dbde6b76dd6eee560b5ddda2a1db7b8  addons/rueg-wa
 98dea05b5d5a429c6f49e92d8e4501735f96615e5e2525093ab951a7eaf45192  addons/rueg-wa-rueg.txt
 0fab27c7181385b8817de8a6ed3a547b044956af021043240d102dc8a83508bd  addons/rueg-wa-shaman.txt
 0a11450902acc459dacd274070c894590339e4134ca99e210169bf201dfe3462  addons/rueg-wa-warrior.txt
-f4b9f4400d79673bfd2c6b4a0036983a2637b5ab9d0a15408e59864b47f7be58  addons/sidetip-0.1.19.zip
 6ce859ccf2408b5b733815e79b9446ffa8e2879d5081ede5fb9bba076ebd0b8b  addons/spirit-smash.txt
 93f4825028c263e69ca4560f45ff54415fccad38c10e37ea1eefef3ab0ff3f29  assets/PerfectDOSVGA437Win-BZfDqYRn.woff2
 c71295b97f51c2f199b8f1a0ef3cc55fbe5dec6f78daee9098b4dbfe942931a8  assets/PerfectDOSVGA437Win-C4lD4zTj.woff

package/public/documents/drift-report.json

@@ -1,6 +1,6 @@
 {
   "baselineUrl": "https://akinevz.com/checksums.txt",
-  "generatedAt": "2026-10-23T21:21:29.982Z",
+  "generatedAt": "2026-10-23T21:26:15.171Z",
   "mutablePaths": [
     "index.html",
     "404.html",
@@ -25,6 +25,8 @@
     "projects/index.html",
     "blog/",
     "stories/",
+    "dist.7z",
+    "documents/drift-report.json",
     "checksums.txt",
     "assets/*.js"
   ],

package/scripts/mutable-assets.mjs

@@ -50,6 +50,13 @@ export const MUTABLE_PATHS = Object.freeze([
   // documents embedded into posts via blog.json.
   "blog/",
   "stories/",
+  // Git-LFS artifact: CI checkouts that do not smudge LFS see the pointer
+  // bytes, so its digest depends on the checkout environment — and the
+  // archive itself legitimately changes.  Never a STABLE invariant.
+  "dist.7z",
+  // Self-referential sidecar: write-dist-checksums.mjs rewrites it on
+  // every build (generatedAt, violation counts), so it changes each run.
+  "documents/drift-report.json",
   "checksums.txt",
   "assets/*.js",
 ]);

package/test/mutable-assets.test.js

@@ -20,6 +20,13 @@ test("blog pages remain mutable", () => {
   assert.equal(isMutablePath("blog/index.html"), true);
 });
 
+test("LFS and self-referential artifacts are mutable", () => {
+  // LFS: digest depends on whether the checkout smudged the pointer
+  assert.equal(isMutablePath("dist.7z"), true);
+  // rewritten on every build by write-dist-checksums.mjs itself
+  assert.equal(isMutablePath("documents/drift-report.json"), true);
+});
+
 test("stable non-blog artifacts are not mutable", () => {
   assert.equal(isMutablePath("configs.html"), false);
   assert.equal(isMutablePath("spinner.svg"), false);