Loop 6 - Private Registry Governance

[sairintechnologycom]

Loop 6 of the PkgSafe Loop Engineering roadmap.

Goal: strengthen dependency confusion and private registry protection while keeping PkgSafe npm-first and local-first.

Scope:

• npm private scopes
• PyPI private prefixes
• no public fallback
• registry token redaction
• registry test command
• dependency confusion evidence

Validation target:

• gofmt -w .
• go test ./...
• go test -race ./...
• go vet ./...
• make build
• evidence recorded in evidence/loops/loop-06-private-registry-governance.md

Do not add SaaS, billing, SSO, hosted services, or behavior analysis changes.

[sairintechnologycom]

Loop 6 evidence recorded in evidence/loops/loop-06-private-registry-governance.md.

Summary:

• Added package-level registry routing evidence via pkgsafe registry test --ecosystem <npm|pypi> --package <name>.
• Added --policy and --registry-config support to registry list and registry test.
• Strengthened registry URL redaction for basic auth and token-like query parameters.
• Updated PyPI private-prefix risk checks to use normalized package matching.
• Added local routing fixture covering private npm scope, disabled private registry fail-closed behavior, PyPI prefix normalization, and disabled public defaults.
• Updated private-registry docs with no-public-fallback examples.

Validation passed: gofmt, go test ./..., go test -race ./..., go vet ./..., make build, make package, registry routing examples, YAML parse, policy validate, markdown link check, and wording/secrets audit.

Known caveat: this branch is stacked on uncommitted Loop 1-5 work.