mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-09 15:02:30 +02:00
754b8dd76c
* fix: make the installer runtime pass strict supply-chain vetting
Remediate the four enterprise supply-chain vetting blockers from
affaan-m/ECC#2502 so the installer runtime (package.json + manifests +
scripts/lib/**) passes strict exact-pin evidence policy:
1. Remove the package.json `postinstall` lifecycle script (it only echoed a
post-install banner) and move that banner to an explicit opt-in
`npm run welcome` command. No install-time lifecycle script remains.
2. Exact-pin every dependency in package.json (dependencies + devDependencies)
to the versions already resolved in package-lock.json; no ^/~ ranges.
3. Replace non-ASCII characters on the installer runtime script/config surface:
em-dashes (U+2014) in scripts/lib/{path-safety,install-executor,
install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in
manifests/{install-components,install-modules}.json descriptions become
ASCII, so strict-surface Unicode scanners are clean.
4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file
already carries a complete hand-rolled validator enforcing the same
schemas/install-state.schema.json (ecc.install.v1) constraints, so the
installer closure is dependency-free (zero non-builtin bare requires).
Refs affaan-m/ECC#2502
* fix: avoid unpinned welcome invocations
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: validate translated skill frontmatter
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: repair skill frontmatter YAML
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: add MIT license to core skill manifests; pin verification-loop tsc invocation
* fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail)
* chore(deps): sync lockfiles with exact-pinned package.json
Regenerate package-lock.json and yarn.lock so the pinned dependency
specs are reflected in both lockfiles. npm ci and Yarn's --immutable
install now pass the sync check. The resolution tree is unchanged
(231 yarn resolutions, byte-identical set; zero npm transitive drift);
only the root descriptor strings move from ranges to the versions
already resolved in the committed lockfiles.
Addresses the Codex P1 on #2503.
---------
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>
|
||
|---|---|---|
| .. | ||
| architecture | ||
| business | ||
| de-DE | ||
| design | ||
| drafts | ||
| es | ||
| examples | ||
| fixes | ||
| ja-JP | ||
| ko-KR | ||
| pt-BR | ||
| releases | ||
| ru | ||
| security | ||
| th | ||
| tr | ||
| ur | ||
| vi-VN | ||
| zh-CN | ||
| zh-TW | ||
| ANTIGRAVITY-GUIDE.md | ||
| ARCHITECTURE-IMPROVEMENTS.md | ||
| ATLAS-CLOUD-GUIDE.md | ||
| capability-surface-selection.md | ||
| COMMAND-AGENT-MAP.md | ||
| COMMAND-REGISTRY.json | ||
| continuous-learning-v2-spec.md | ||
| ECC-2.0-GA-ROADMAP.md | ||
| ECC-2.0-REFERENCE-ARCHITECTURE.md | ||
| ECC-2.0-SESSION-ADAPTER-DISCOVERY.md | ||
| ECC-PRO-SECURITY-ROADMAP.md | ||
| HERMES-OPENCLAW-MIGRATION.md | ||
| HERMES-SETUP.md | ||
| hook-bug-workarounds.md | ||
| JOYCODE-GUIDE.md | ||
| legacy-artifact-inventory.md | ||
| MANUAL-ADAPTATION-GUIDE.md | ||
| MCP-CONNECTOR-POLICY.md | ||
| MEGA-PLAN-REPO-PROMPTS-2026-03-12.md | ||
| MIGRATION-1X-TO-2.0.md | ||
| PHASE1-ISSUE-BUNDLE-2026-03-12.md | ||
| PLAN-PRD-PATTERN.md | ||
| PR-399-REVIEW-2026-03-12.md | ||
| PR-QUEUE-TRIAGE-2026-03-13.md | ||
| QWEN-GUIDE.md | ||
| SELECTIVE-INSTALL-ARCHITECTURE.md | ||
| SELECTIVE-INSTALL-DESIGN.md | ||
| SESSION-ADAPTER-CONTRACT.md | ||
| skill-adaptation-policy.md | ||
| SKILL-DEVELOPMENT-GUIDE.md | ||
| SKILL-PLACEMENT-POLICY.md | ||
| stale-pr-salvage-ledger.md | ||
| token-optimization.md | ||
| TROUBLESHOOTING.md | ||