fix: support exact Machines bootstrap self-upgrade

[andrei-hasna]

Task

Focused remediation cycle two for Todos task caa2a6fa-484d-4739-884f-54add928e0c1.

Change

• permit one exact @hasna/machines Bun transaction step at order 10 while rejecting mixed Machines/Infinity/Factory transactions;
• preserve the exact two-package order @hasnaxyz/infinity at 10 then @hasnaxyz/factory at 20, including the accepted Factory-only partial replan;
• accept fleet quarantine exclusion supersets only when all four required exact package names are present, while keeping minimumReleaseAge exactly 604800;
• normalize an omitted Bun registry to https://registry.npmjs.org and continue rejecting explicit non-canonical registries;
• bump the release candidate and coupled station template to @hasna/machines@0.2.20.

Finite acceptance gates

• exact Machines-only transaction passes; wrong order and a mixed transaction fail;
• Infinity 10 then Factory 20 passes; reversed order fails; installed-state partial and zero-step replans remain accepted;
• quarantine superset passes and a missing required entry fails without lowering quarantine;
• omitted/default and explicit canonical npm registry pass; an explicit alternate registry fails;
• immutable source SHA-256, byte-preimage snapshot, consumer-configured secret delivery, structured exact-key probes, rollback, private-output controls, and Machines 0.2.17/0.2.18 target bootstrap compatibility remain covered;
• required release/typecheck/test/build gates pass, staged and exact-head secret scans report zero findings, and the exact pack contains the required entrypoints.

Evidence

• regression RED: 13 pass, 3 fail, 72 expects, 16 tests, 1 file;
• focused installer GREEN: 16 pass, 0 fail, 81 expects, 1 file;
• affected lanes: 74 pass, 0 fail, 402 expects, 5 files;
• bun run verify:release: 610 pass, 0 fail, 3263 expects, 66 files; build and consumer conformance pass;
• final Shield and Gitleaks scans: 0 findings;
• pack: hasna-machines-0.2.20.tgz, 804253 bytes, SHA-256 408251199c3a5964da16baad3f8dccf6569e0b5453974108ecaa05dc6f7b0af1.

No merge, publish, install, manifest apply, Infinity/Factory install, or station mutation is part of this candidate. Independent focused review remains assigned to Euclid.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #91 @ 36039b2 — lens: correctness+security+gates, reviewer Phaedon (1 of 1)

Exact candidate reviewed

• Base: origin/main at 3072837; merge-base matched that commit.
• Head: 36039b2.
• Read: the full base-to-head diff for all six changed files, plus the surrounding installer, manifest schema, apps/reconcile callers, controller bootstrap, and installer tests.

Commands and gates

• git log --oneline origin/main..HEAD — exit 0; one commit: 36039b2 fix: support exact Machines bootstrap self-upgrade.
• git diff origin/main...HEAD --stat — exit 0; 6 files, 181 insertions, 24 deletions.
• bun install — exit 0; setup only, 116 packages installed; not counted as a test gate.
• bun run typecheck — exit 0; no diagnostics; pass/fail test counts not applicable.
• bun run test — exit 0; 610 pass, 0 fail, 3263 expect() calls, 66 files.
• git diff --check origin/main...HEAD — exit 0; no whitespace errors.

Blocking findings

1. P1 correctness — the accepted Machines self-upgrade policy does not require @hasna/machines to bypass the seven-day release-age gate.

   • validateBunPolicy() requires only the four legacy exclusions. The new successful self-upgrade test uses that four-entry policy and stubs runSource, so it never exercises Bun's resolver.
   • Same-run public-registry control for the current published release: AGE_GATE_WITH_REQUIRED_FOUR_EXIT=1 with error: No version matching "@hasna/machines" found for specifier "0.2.19" (blocked by minimum-release-age: 604800 seconds); adding @hasna/machines produced AGE_GATE_WITH_MACHINES_EXCLUDED_EXIT=0.
   • Reachable impact: a validator-accepted target with the documented seven-day policy cannot perform the newly supported fresh Machines self-upgrade. Require every transaction package name in the target exclusions, then cover the rejected and accepted self-upgrade policies.

2. P1 security/provenance — a supported scope-specific Bun registry override bypasses the canonical-registry gate.

   • validateBunPolicy() checks only install.registry or root registry; it ignores install.scopes.
   • Same-run local-server control: a policy with [install.scopes] hasna = <alternate> returned VALIDATOR_SCOPE_OVERRIDE=accepted state=COMMITTED, and Bun then emitted BUN_SCOPE_REQUEST_COUNT=1 with BUN_SCOPE_FIRST_REQUEST=/@hasna%2fmachines to that alternate registry.
   • Reachable impact: the exact @hasna/machines transaction can resolve from a non-canonical registry even though the release note says explicit alternate registries fail. Validate the effective scope registry for every transaction package and reject non-canonical overrides.

Non-blocking follow-ups

• None.

Verdict: NO_GO until both named validator defects and their direct regression tests are fixed. The declared repository gates are otherwise green.

[andrei-hasna]

[REVIEW] GO — #91 @ 9749d9f — lens: correctness+security+gates, reviewer Phaedon (1 of 1)

Focused re-review of the two blocking findings reported at 36039b2 and their direct regressions.

What I read:

• The full PR diff against the freshly fetched origin/main commit 3072837, plus surrounding source and callers.
• The remediation diff in src/commands/bun-registry-installer.ts and test/bun-registry-installer.test.ts.
• The exact commit message and Agent: Phaedon trailer on 9749d9f.

Commands and results:

• git log --oneline origin/main..HEAD — exit 0.
• git diff origin/main...HEAD --stat — exit 0.
• bun install — exit 0; setup only, not counted as a test gate.
• bun run typecheck — exit 0; no diagnostics.
• bun run test on the original candidate — exit 0; 610 pass, 0 fail, 3263 expect calls, 66 files.
• bun run test with the regression tests added before the source fix — exit 1; 608 pass, 2 fail, 3260 expect calls, 66 files. Both new tests failed on the named defects.
• bun run typecheck after the fix — exit 0; no diagnostics.
• bun run test after the fix — exit 0; 610 pass, 0 fail, 3265 expect calls, 66 files.
• git diff --cached --check — exit 0.
• gitleaks protect --staged --no-banner --redact — exit 0; 2.24 KB scanned, no leaks found.
• git push origin HEAD:task/caa2a6fa-machines-bootstrap-self-upgrade-0.2.20 — exit 0; the PR head advanced to 9749d9f.

Blocking P0/P1 findings:

• None remain. The exact transaction package set is now required in minimumReleaseAgeExcludes, so a Machines self-upgrade cannot pass validation while Bun quarantines @hasna/machines.
• None remain. Target package entries in [install.scopes] are now validated against the canonical npm registry, so a scoped override cannot redirect the transaction after the default-registry check passes.

Non-blocking follow-ups:

• None.

[andrei-hasna]

[REVIEW] NO_GO — #91 @ 9749d9f — focused remediation cycle 2, reviewer Euclid

Blocking finding

• P1 exact-candidate/package identity failure. The public @hasna/machines@0.2.20 artifact is not the reviewed 9749d9f candidate. The target bootstrap actually delivered to Machines 0.2.17/0.2.18 targets contains later PR 92 code.

Exact evidence

• PR 91 head is 9749d9f; recorded base is 3072837; squash is 53620e7. Final-head tree and squash tree both equal b9b42305da3ee841d2406750a76a1a9f44d1550e.
• Current origin/main is 03ad192. Recomputed current-base merge tree is a0a96d759dc1ea53e28dba54cdc52d0b9209d6fb, not the reviewed/squash tree.
• Registry publication is 2026-08-11T12:29:27.947Z. Registry integrity exactly matches sha512-19d0/iFRbzoKlebbyIds53t1NKmIACkxKH4KF9B01669UD/Vr/T1QR5NyDuL/BAtnt6bUe2A75tCHVMqAyTkBg==. Downloaded tarball: 804733 bytes, SHA-256 d13cb40b1d9cee2de5996a036b790cc7415f07e546a185ca758bab722a4ffea0.
• Fresh 9749d9f build/pack: 804433 bytes, SHA-256 ce4663ae28e76dfd4ceb7e3bc81cd684e690ca0c664dae6edda6f161435fdd80. Extracted content comparison found one content difference among 133 files: dist/exact-bun-bootstrap.js.
• Reviewed-head bootstrap: 154086 bytes, SHA-256 eeaed473b95460e2292e03b0948fc43469ddc35d406b0c4484b9f7e60b583308. Registry bootstrap: 154405 bytes, SHA-256 abb3c07d6d073c848263930fa0c6241a25720692b07c18ffe0cbd5224a65dda8.
• The registry bootstrap is byte-identical to a fresh build of e3f8c30, the later PR 92 squash merged at 2026-08-11T05:28:34Z. It is not a build of the exact reviewed PR 91 head.

Focused/direct-regression evidence

• Delta 36039b2..9749d9f changes only src/commands/bun-registry-installer.ts and test/bun-registry-installer.test.ts.
• Focused test: 16 pass, 0 fail, 83 expects. It preserves Machines single-step acceptance, wrong/mixed transaction rejection, and Infinity order 10 before Factory order 20.
• Independent policy controls: omitted, canonical install, canonical root, and canonical Machines scope registries accept; alternate install, alternate root, and alternate Machines scope registries reject; missing @hasna/machines exclusion and lowered age reject.
• Full suite: 610 pass, 0 fail, 3265 expects. Typecheck, build, and consumer conformance pass. The post-publication verify:release chain exits only at its intentional publishability guard: @hasna/machines@0.2.20 is already published.
• Hosted test check is success. git diff --check is clean. Exact-range Gitleaks scanned two commits with no leaks. Shield staged review reports no staged changes.
• Branch commits use the canonical author/committer identity and each has one Agent trailer. No private manifest, secret value, raw target metadata, check URL, or auth payload was emitted.

This is the final permitted focused cycle. The exact-candidate identity gate fails, so the repair stops with no remediation or rollout authorization.