build(reproducibility): restack deterministic npm controls after nanoid

[seonghobae]

Purpose

Controlled dependency-ordered replacement for closed superseded #78. This Draft starts from exact #76 so nanoid@3.3.17 is present before broader package-manager/install-script controls. No #78 check/review evidence transfers.

Fresh identity

• Base: fix/nanoid-cve-2026-67213 / fix(security): update transitive nanoid for CVE-2026-67213 #76 at independently resolved e0106ce16b7b8b493f46bf075ec5baf58762bd95.
• Head: adcc42d2b0fec3106faabb59bbf7e79124714f7a on build/deterministic-npm-toolchain-after-nanoid.
• Draft while fix(security): update transitive nanoid for CVE-2026-67213 #76 is unintegrated and central Security Scan is feature-base-ineligible.

Replayed unique controls

• Node.js 24.19.0 / npm 11.17.0 exact repository/CI identity;
• fail-closed strict-allow-scripts=true with reviewed lifecycle-script identities;
• real hermetic regression proving an unreviewed local postinstall cannot execute;
• exact-live-base schema-v2 lockfile change control with package-object digest evidence;
• duplicate-key, malformed, race, symlink and metadata-churn refusal;
• exact npm ci --legacy-peer-deps=false --install-links=false contract;
• APA 7 doctoring and ## Unreleased changelog evidence.

Representative #78 artifacts were independently preserved before #78 closed; current replacement additionally proves predecessor integration and CHANGELOG contracts.

Test-first CHANGELOG completion

• 96cdc4d37d4e516143217cd4dcbe42210da00853: RED contract required Node/npm identity, strict-allow-scripts=true, and schema-v2 control under ## Unreleased.
• CI 31350000282: exact RED, 691/692 tests with only the missing changelog contract failing.
• Current adcc42d2b0fec3106faabb59bbf7e79124714f7a: GREEN bounded changelog addition.

Newly proven sibling overlap with #80

Fresh compare proves #89 and #80 are diverged siblings with merge base exactly #76. They do not share production/package-manager files, and #89 does not modify AGENTS.md, but both modify CHANGELOG.md under ## Unreleased:

• build(reproducibility): restack deterministic npm controls after nanoid #89 adds the package-manager/install-script reproducibility record.
• fix(security): make product publisher branch creation atomic #80 adds scheduler/publisher/NIM/work-conserving records.

An unrefreshed sibling integrated after the other can conflict with or omit changelog evidence. This is a convergence/traceability hazard, not a reason to mix the implementations now.

After #76, #89 can stabilize independently from #87 because #87 changes only AGENTS.md + governance audit/test. The safest current order is to integrate/refetch #87 and #89 on the protected lineage first, then rebuild/refresh #80's unique work onto their combined protected state so #80 preserves both AGENTS.md and CHANGELOG.md. Old sibling evidence does not transfer and no artificial retarget may manufacture ancestry.

Current exact-head proof

For adcc42d2b0fec3106faabb59bbf7e79124714f7a:

• application ci 31350201695: terminal success; exact source/live predecessor binding, Node/npm identity, lockfile control, frozen install, 71/71 files and 692/692 tests, configured owned statements/branches/functions/lines 100%, real unreviewed-postinstall refusal, doctoring/CHANGELOG contracts, and npm audit --audit-level=high 0 vulnerabilities;
• reviewer-ci 31350201710: terminal success;
• central Security Scan: absent by feature-base event selection, non-passing defer_until_trigger;
• formal reviews: none;
• inline review threads: none.

Missing production KPI/provenance/security-validation/release/deployment/environment/revenue/transfer evidence remains intentionally non-passing and does not become acquisition evidence because this PR is green.

Acceptance boundary

1. fix(security): update transitive nanoid for CVE-2026-67213 #76 integrates under actual live governance.
2. Refresh only build(reproducibility): restack deterministic npm controls after nanoid #89's unique package-manager work onto the then-current protected lineage and preserve any concurrent CHANGELOG.md entries.
3. Require fresh eligible central Security Scan plus all actual exact-source/current-base CI/security/coverage/package/provenance gates.
4. Address current findings/threads and satisfy actual live ruleset and qualifying formal-review requirements.
5. Before fix(security): make product publisher branch creation atomic #80 integration, require fix(security): make product publisher branch creation atomic #80 to refresh onto the combined protected fix(governance): audit independent approval requirement #87/build(reproducibility): restack deterministic npm controls after nanoid #89 lineage rather than overwriting either authority/documentation surface.

No force push, repair workflow, audit waiver, protection weakening, synthetic approval, release or deployment authority is introduced.

Related: #27, #29, #75, #76, #77, #79, #80, #87

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 776d048d-7397-4701-9cb4-e93829e81624

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by clean protected-main successor #91 after #76 integrated. Fresh #91 exact-head evidence is now terminal-success for application ci run 31367707468, reviewer-ci run 31367707469, and central Security Scan run 31367707433, with no formal reviews and no inline review threads. #91 starts from protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 and preserves #89's unique 17-file package-manager/reproducibility delta without transferring #89 checks or reviews. Closing this stale predecessor prevents duplicate writers/evidence lanes; #91 remains the only active implementation line.