fix(vendor): re-vendor conformance-kit → e8838ed (unblock main; restore integrity)

integrity/structure-audit/structure.json

@@ -59,7 +59,7 @@
   },
   "conformance.html": {
     "h1": "Conformance, computed against the running build",
-    "outline": "12222222222",
+    "outline": "123333333333",
     "mains": 1,
     "readerOk": null,
     "internalLinks": [
@@ -85,6 +85,9 @@
       "/#build-provenance",
       "/#build-provenance",
       "/#build-provenance",
+      "/#build-provenance",
+      "/#build-provenance",
+      "/#build-provenance",
       "/llms.txt",
       "/provenance.json",
       "/sbom.spdx.json",

vendor/conformance-kit.lock.json

@@ -1,14 +1,14 @@
 {
   "source": "https://github.com/bounded-systems/conformance-kit",
-  "ref": "bf20952d61e4e536d01ea64c7f0210266c5286c5",
-  "commit": "bf20952d61e4e536d01ea64c7f0210266c5286c5",
-  "fetched": "2026-06-28",
+  "commit": "e8838edcbfda95ce564230cb53f334336810ecec",
+  "ref": "e8838edcbfda95ce564230cb53f334336810ecec",
+  "fetched": "2026-06-29T00:00:00Z",
   "vendoredTo": "vendor/conformance-kit/",
-  "note": "Hash-pinned, vendored copy of bounded-systems/conformance-kit (mirrors the bdelanghe/site vendor/*/provenance.json shape). Re-vendor by copying the kit at the pinned commit; verify before use with `node scripts/verify-vendor.mjs`, which re-hashes each file below and fails closed on any mismatch. 2026-06-28: re-vendored to add the conformance-projection gates (gates/conformance-report.mjs + the zero-dep lone web-build model in gates/conformance/), byte-identical to the copy shipped in bdelanghe/site; their sha256 pins are added below. 2026-06-28: added gates/axe-gate.mjs (the axe-core a11y gate), byte-identical to conformance-kit PR #6 / the copy in bdelanghe/site; its sha256 pin is added below. 2026-06-29: advanced ONLY the integrity/verify/ subtree to conformance-kit @ c45be5003128 (PR #16, the installable + identity-correct standalone verifier: X509 SAN extraction, sigstore ^2.3.1, + package-lock.json), byte-identical to that commit; the rest of the tree remains @ bf20952d. Mixed provenance is intentional and minimal — a full re-vendor to a single newer commit pulls 18+ unrelated gate/fixture changes and is deferred to its own PR. (#98 merged the advanced verify/ files but not these pins, breaking verify-vendor on main; this restores it.)",
+  "note": "Hash-pinned, vendored copy of bounded-systems/conformance-kit (mirrors the bdelanghe/site vendor/*/provenance.json shape). Re-vendor by copying the kit at the pinned commit; verify before use with `node scripts/verify-vendor.mjs`, which re-hashes each file below and fails closed on any mismatch. 2026-06-28: re-vendored to add the conformance-projection gates (gates/conformance-report.mjs + the zero-dep lone web-build model in gates/conformance/), byte-identical to the copy shipped in bdelanghe/site; their sha256 pins are added below. 2026-06-28: added gates/axe-gate.mjs (the axe-core a11y gate), byte-identical to conformance-kit PR #6 / the copy in bdelanghe/site; its sha256 pin is added below. 2026-06-29: advanced ONLY the integrity/verify/ subtree to conformance-kit @ c45be5003128 (PR #16, the installable + identity-correct standalone verifier: X509 SAN extraction, sigstore ^2.3.1, + package-lock.json), byte-identical to that commit; the rest of the tree remains @ bf20952d. Mixed provenance is intentional and minimal — a full re-vendor to a single newer commit pulls 18+ unrelated gate/fixture changes and is deferred to its own PR. (#98 merged the advanced verify/ files but not these pins, breaking verify-vendor on main; this restores it.) 2026-06-29: re-vendored bf20952 → e8838ed (conformance-kit main #26) to restore integrity after the #98 verify.mjs drift and adopt the split vulns/asvs schema + ai-readability gate; full subset re-hashed below.",
   "files": {
-    ".gitignore": "sha256:5f6adeaed232a001b6801f8a4e611ea490adcd7ab279e04d1841d92a30a72d21",
+    ".gitignore": "sha256:f43c5590d1954f871cafe267ed91afdaa6df2ec6179552492fca869f9a4f9435",
     "LICENSE": "sha256:559e93c466421832cdcfe7a000d0c19cdb2cec9d24bfb9b41f7c5bd9d448f65e",
-    "README.md": "sha256:6160882ba5fb9cd2ec8bfbc4b78593da674470b92d97bab2477d7076e4ba16f9",
+    "README.md": "sha256:b6c278d8dda1ea8663e77e324ef4b9e2951d7cb0d93c02ff0cfec805d5a07f3c",
     "emitters/index.mjs": "sha256:1e45fa9122986d60a1c478438b077482b15c1c068d7ac8109902ca19a697cf8b",
     "fixtures/corpus.json": "sha256:65f9cdd41c499e12c412b4a85d132ff3efcb5f0d753c48fc86c8398f9fdf3b23",
     "fixtures/jsonld.shapes.ttl": "sha256:da2b1bde9d3b2d1b3efd304d84245fa0a0c66b27390d3fb4fd3921c18f35e32b",
@@ -22,9 +22,9 @@
     "fixtures/site/sitemap.xml": "sha256:5066e5bdbb7e870b96a6c1129c7896a02cf6696af77ea707b414276225983d71",
     "gates/axe-gate.mjs": "sha256:a8b19486e4e2379310112cad7390ac86abde885a162172e2ade9cb4d902ada79",
     "gates/commonmark-runner.mjs": "sha256:bbc05d54d426e9f56337fa1c9e958f452e5d32e60a0bd3a2ab60191a8ab7eab3",
-    "gates/conformance-report.mjs": "sha256:bb7e494d3ced672b5b5ba500289f9e9d31bea201813824bd5aed81156020d66a",
-    "gates/conformance/conformance.mjs": "sha256:5d17bea295458433860e9774728e06981bba3a947e969ab23ebb75dd26ecefbb",
-    "gates/conformance/web-build.mjs": "sha256:b2b2d18ce380d300c15faa7d643fd9a3f13b29bdc3f63ac0fa15772293db5089",
+    "gates/conformance-report.mjs": "sha256:160ee7d32d811a15e38b2ae24ec242f7af9549b5104b973b137b70067a642b5a",
+    "gates/conformance/conformance.mjs": "sha256:c42e0b4df2c1c0f7900b4816fe973fb474e3821b9d9ef8edc897d711f49d94b5",
+    "gates/conformance/web-build.mjs": "sha256:d63a87524f9e0f83297003b1c9f079a7ed34bcbc13b64e400c584135464f993f",
     "gates/readability-gate.mjs": "sha256:ff4216bc3acc0828197ed0d769c7c78fd152a3d9e450c1684b3e3ebc3c28599c",
     "gates/sbom/check-sbom.mjs": "sha256:c306ed0eeddd4d29513761903e99b1e04e81f58424aa98b36ac7abfb13b0ec63",
     "gates/sbom/gen-sbom.mjs": "sha256:426d2f09f77253c10d532fac009609d416d6882955e7b0c5ca0c168f0cd90b15",
@@ -46,10 +46,10 @@
     "integrity/verify/verify.mjs": "sha256:4e3ba56de1c7ebe2f062e4e1d19f48cfdb3ac8367dcdd6051acdd9dcc9835728",
     "lib/config.mjs": "sha256:17cb89afd2ba8599d4f288187abbacaf0ab2d9dc5b39ee23d9d2e11a8f952055",
     "lib/schema-validate.mjs": "sha256:888f75ec549073ea895118178cad46d287573b42017cf162b4a8adee0e58e4d0",
-    "package-lock.json": "sha256:7a3b9da48fe5628746242eab0582a45ffede86322b6425cd28b8e052dfaebcc7",
-    "package.json": "sha256:998e9c5f8ab1411408d2cbb35956caa2892117e4a37b1c718982fd4b6c115162",
-    "provenance.json": "sha256:3f22ef8280c890cf29253494f0766ba736e2bba999dbcdd32bfdf372e2f01b0a",
-    "test/run.mjs": "sha256:e38a1139ce39d4fed52b1f0e28ab564a26af73b0de4b88f6325cf8ab9e0c1beb",
+    "package-lock.json": "sha256:6d0bc8e8cfba00c01fed488127cd16fb357df65fbe7e1aa10e7bff3ab7b9373f",
+    "package.json": "sha256:9225f6e9f8ab4354d3e406679e2cc04dfcad18a04515cfc3ed4dfc6080763acc",
+    "provenance.json": "sha256:a2a4bfdb92b58cc55d13d42e001b5495de8308576120e11af155066ad9a62f62",
+    "test/run.mjs": "sha256:3b7c90b57e7139baf94032ae74f7049cccd8397a9a1a82277b7b31bcc0ef1096",
     "vendor.example.json": "sha256:4a67af1b7c00c85de7ae122b54c46108f93ea187db2fad3da2de9ca998304ead"
   }
 }

vendor/conformance-kit/.gitignore

@@ -3,3 +3,4 @@ node_modules/
 .DS_Store
 test/.work/
 deno.lock
+node_modules/