jamminrebel/pom-omp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: make audit gates evidence-backed and correct stale check-count claims

Browse Source 
- wire npm audit (prod + full dev tree) through readGate instead of hardcoded NOT RUN reasons
- record real results: production 0 vulns PASS; dev tree 16 dev-only advisories FAIL, disclosed with reach and remediation
- docs/VERIFICATION.md: six checks -> seven, add package-metadata section and mutation row, record executed row-7 proof
- README/SETTINGS: replace six-gate wording with the actual gate ledger
This commit is contained in:
Antigravity
2026-08-19 11:40:18 +02:00
parent 0164fcbddb
commit 7b714bfc6b
8 changed files with 93 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@@ -86,7 +86,7 @@ Precondition: the tarball must contain `prompts/`. `src/prompts.ts` resolves bun
### Verification status
Overall readiness: GREEN for the six repository-local gates; four host-dependent gates remain NOT RUN.
Overall readiness: PARTIAL. Seven evidence-backed gates PASS, one FAILS on dev-only transitive advisories, and two host-dependent gates remain NOT RUN.
`npm run verify` exits 0 from a clean `npm install` on this host. Each gate below is recorded as evidence under `00_admin/validation/` and rendered into `RELEASE.json` by `scripts/release-manifest.mjs`; a missing evidence file renders NOT RUN, and `passed !== true` renders FAIL.
@@ -98,11 +98,13 @@ Overall readiness: GREEN for the six repository-local gates; four host-dependent
| Structural verification | `node scripts/verify.mjs` | PASS |
| Theme schema | asserted inside `scripts/verify.mjs` | PASS |
| Pack dry run | `npm run pack:dry` | PASS |
| Production dependency audit | `npm audit --omit=dev` | NOT RUN |
| Full development tree audit | `npm audit` | NOT RUN |
| Production dependency audit | `npm audit --omit=dev` | PASS — 0 vulnerabilities |
| Full development tree audit | `npm audit` | **FAIL** — 16 advisories (9 moderate, 7 high) |
| OMP plugin doctor | `npm run doctor` | NOT RUN — requires Bun plus an installed OMP host |
| Interactive TUI smoke | manual OMP session | NOT RUN — requires an interactive terminal |
The development-tree FAIL is disclosed, not waived. Every advisory (`adm-zip`, `fast-xml-parser`, `sharp`/libvips, `@opentelemetry/core`, `tar`) is transitive under the `@oh-my-pi/*` peer SDK and dev-only: `npm audit --omit=dev` reports 0, and POM's three runtime dependencies are `crc-32`, `yauzl`, and `yazl`, so nothing reaches the published tarball. No in-window remediation exists — `npm audit fix --dry-run` changes 0 packages and still reports 16, because the vulnerable versions are pinned by the SDK's own ranges. Clearing it requires an upstream `@oh-my-pi` release; forcing it would leave the `>=16.4.6 <17` peer window.
Never satisfy a gate with a stub: do not vendor dependencies into the repository, and do not hand-write or copy the OMP SDK packages or the OMP theme schema. A gate satisfied by a stub proves nothing about the shipped extension.
Dependency requirements per check: