build(reproducibility): restack deterministic npm toolchain

[seonghobae]

Purpose

Clean protected-main successor to superseded #89 after #76 integrated. This branch starts from protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 and replays only #89's unique package-manager/reproducibility delta; predecessor checks/reviews do not transfer.

Exact preservation proof

Fresh comparison of #76's exact predecessor head e0106ce16b7b8b493f46bf075ec5baf58762bd95 to #89 head adcc42d2b0fec3106faabb59bbf7e79124714f7a identified exactly 17 unique files. Fresh comparison of protected main to this replacement branch identifies the same 17 paths with the same per-file additions/deletions. Each replacement file was populated from #89's exact current-head content; #76's already-integrated lockfile, reviewer CI, nanoid doctoring, exact-head CI contract and changelog remediation are inherited from protected main rather than replayed.

Unique paths are:

• .github/workflows/ci.yml
• .npmrc
• CHANGELOG.md
• docs/doctoring/package-manager-reproducibility.md
• package.json
• scripts/lockfile-change-control.mjs
• nine lockfile/package-manager regression files
• test/workflow-readiness.test.ts
• vitest.config.ts

Implemented boundary

• repository-declared Node.js 24.19.0 / npm 11.17.0 development and lockfile toolchain;
• strict-allow-scripts=true with exact reviewed install-script identities and an explicit deny for fsevents@2.3.3;
• exact-head CI checkout plus live-base re-resolution before and after verification;
• schema-v2 exact-base lockfile change control binding changed package paths to canonical before/after SHA-256 digests;
• duplicate decoded JSON-key rejection, fatal UTF-8, descriptor/no-follow/bounded-read and identity-drift failure boundaries;
• explicit separation among package-manager/toolchain evidence, install-script authority, vulnerability scanning, formal review and merge/release authority;
• exact owned coverage includes scripts/lockfile-change-control.mjs.

Fresh exact-head evidence

Current exact head: ebde3720ee27292be0ce3315986e0438dd66af9f.

• application ci run 31367707468: terminal success;
• reviewer-ci run 31367707469: terminal success;
• central Security Scan run 31367707433: terminal success under its own scanner/revision semantics;
• formal GitHub reviews: none at the latest fresh read;
• inline review threads: none at the latest fresh read;
• GitHub reports the PR mergeable.

The fresh technical evidence is sufficient to leave Draft. It is not merge authority: live enforceable governance under #27 and qualifying independent formal review remain separate fail-closed gates.

Supersession

#89 was closed only after this clean protected-main successor received fresh terminal-success application/reviewer/security evidence proving the restack is technically intact. Old #89 evidence does not transfer.

Merge boundary

Do not merge unless the unchanged exact head still satisfies every actual current CI/security/coverage/package/provenance gate, current review/thread evidence remains clean, live ruleset/governance requirements are proven, and qualifying independent non-author formal approval is satisfied where required. No repair/self-modifying workflow, protection weakening, synthetic approval, version bump, release or deployment authority is introduced.

Related: #27, #29, #77, #79, #80, #90

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f6e0f3e-035a-4616-98d8-74d13c4a2fd8

📥 Commits

Reviewing files that changed from the base of the PR and between c85d710 and ebde372.

📒 Files selected for processing (17)

• .github/workflows/ci.yml
• .npmrc
• CHANGELOG.md
• docs/doctoring/package-manager-reproducibility.md
• package.json
• scripts/lockfile-change-control.mjs
• test/lockfile-change-control-boundaries.test.ts
• test/lockfile-change-control-canonical-array.test.ts
• test/lockfile-change-control-duplicate-json.test.ts
• test/lockfile-change-control-policy-schema.test.ts
• test/lockfile-change-control-race-boundaries.test.ts
• test/lockfile-change-control.test.ts
• test/package-manager-doctoring-contract.test.ts
• test/package-manager-predecessor-integration.test.ts
• test/package-manager-reproducibility.test.ts
• test/workflow-readiness.test.ts
• vitest.config.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}