jamminrebel/pom-omp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: make audit gates evidence-backed and correct stale check-count claims

Browse Source 
- wire npm audit (prod + full dev tree) through readGate instead of hardcoded NOT RUN reasons
- record real results: production 0 vulns PASS; dev tree 16 dev-only advisories FAIL, disclosed with reach and remediation
- docs/VERIFICATION.md: six checks -> seven, add package-metadata section and mutation row, record executed row-7 proof
- README/SETTINGS: replace six-gate wording with the actual gate ledger
This commit is contained in:
Antigravity
2026-08-19 11:40:18 +02:00
parent 0164fcbddb
commit 7b714bfc6b
8 changed files with 93 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/SETTINGS.md
View File

@@ -57,4 +57,4 @@ built-in defaults
| Bun | `>=1.3.14` | `engines.bun` |
| Node.js + npm | Node 22 or newer | Local scripts and the `node:test` suite |
Verification state: the six repository-local gates pass and `npm run verify` exits 0 from a clean `npm install`; the four host-dependent gates (both `npm audit` scopes, `npm run doctor`, interactive TUI smoke) remain NOT RUN. See the README section Verification status.
Verification state: `npm run verify` exits 0 from a clean `npm install`. Seven evidence-backed gates PASS, `npm audit` on the full development tree FAILS on 16 dev-only transitive advisories under the `@oh-my-pi/*` peer SDK (production audit reports 0, so nothing reaches the published tarball), and two host-dependent gates (`npm run doctor`, interactive TUI smoke) remain NOT RUN. See the README section Verification status.