feat(authoring): stage and verify private npm entrypoint pair

[777genius]

Change

Create two independent private npm archives from the verified, frozen Linux amd64 candidate. Each installed wrapper selects its fixed product, forwards the CLI contract, and uses the shared acquisition verifier. Exercise both packaged products through generation and the existing installer planner's injected dry-run boundary.

This is a private preparation checkpoint. Public publication, platform acceptance and attestation remain disabled. Useful plugin.yaml implementation, dependencies, tests and design documents are preserved.

Dependencies and scope

Depends on #167 (shared npm verifier) and #169 (release CLI composition), and their existing upstream release gates. The integrated dependency base is 08716f8. The temporary base branch feat/authoring-private-npm-base combines those reviewed dependencies. This draft must be retargeted onto the accepted upstream stack after #167 and #169 land; do not merge into the temporary base as a release delivery.

At 070663e, the diff from that combined base is 2,053 changed lines across 15 files. It slightly exceeds the approximate 2,000-line review target because the packaged generation path and its planner handoff form one coherent verification boundary. The two-file discovery correction is included.

Evidence at dcfa206

• Frozen candidate build and integrity verification passed.
• Bare native E2E and actual private npm archive staging passed.
• Packaged native journey passed: 741 recorded invocations, 2 tests, 0 failures and 0 skips.
• Packed-project planner handoff passed: 10 generated projects and 30 plans, with input preservation checks and all release/platform/attestation claims false.
• Independent review requested two test-discovery corrections. Both were corrected in 070663e. ROOT independently ran discovery and bridge tests on that commit: 6/6 passed on each of Node22 and Node24, zero skips. Worker integrated focused evidence has 34 passes and one explicit native opt-in skip per runtime; detached default evidence has 167 passes, zero failures and 46 expected skips. They concern unintended test discovery in the minimal helper fixture and unsupported-platform POSIX fixture setup.

These results belong to dcfa206 only. A later test commit must retain this identity explicitly and add its own appropriate verification; historical output must not be relabelled as a new-head run.

Remaining gates

Final exact-head CI and release acceptance remain pending. Node 18 execution, other native platforms, public registry/provenance and release activation remain unproved. Upstream Windows concurrency and macOS policy gates remain open. This PR does not narrow or bypass them.

Final integrated local proof at 070663e

Frozen candidate build, verification, bare native journey, actual npm staging and packaged native E2E all passed. Packaged native: 741 invocations, 2 tests, zero failures/skips. The same-commit packed-to-planner test passed all 10 project subtests and 30 plans. These are Linux amd64 private, injected-planner proofs; all release/platform/attestation claims remain false.

GitHub native CI remains red: the ordinary matrix discovers the separate opt-in packed test without its evidence, Windows also discovers its Linux-only source harness, and Windows amd64 repeats the existing concurrent-init failure. CI integration is being designed without relaxing skip gates; no retry-to-green was requested.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}