fix(toolchain): replace Wrangler/Miniflare GPL-family path

[seonghobae]

Purpose and owner boundary

Replace the former Wrangler/Miniflare/Sharp development path with pinned workerd@1.20260625.1 + esbuild@0.28.1, keeping Cloudflare lifecycle truth and foreign routing/security authority outside Noema.

Current authority — 2026-09-08 KST

Protected Noema normally integrated #542 and is GitHub-verified main@d6394b2aa73e6fc57fccdad74ea38ad87f79e7f8. This lane is ordinary/non-force converged on that ancestry at exact 05bc2d47c3899ebe17538070f9a30172f90307ac; fresh compare is ahead-only with behind_by=0 and merge-base exactly protected main. The effective candidate is 15 paths and does not replace #542 Durable Workflow/State/Checkpoint source or wrangler.toml.

Hosted RED → causal repairs

1. e420b5d... patch-validator image failed Materialize exact patch-validator dependencies: direct workerd/esbuild had been added to the development toolchain but validator pruning still removed only Wrangler. fd8a38b6eec893c8d24cec901609820ae279b81a removes direct workerd/esbuild before prune and asserts workerd, esbuild, @esbuild, Miniflare and Wrangler are absent from the validator dependency payload. On later exact c20d915..., the validator materialization step passed and advanced to image build.

2. After feat(workflow): add atomic durable task claim and checkpoint CAS #542 integration, exact 9aa2d9c... CI 34154917767 passed exact checkout/toolchain/live-base verification then failed only lockfile change control because .github/lockfile-change-policy.json still bound historical protected 39f3683.... Protected package-lock.json had not changed between 39f3683... and d6394b2...; therefore c20d915c0b5cd428dc4af29760d9f95c62784267 changed only policy baseSha to exact d6394b2..., preserving all reviewed package digests, metadata digests, provenance sources, justification and schema. The next exact CI confirmed Lockfile change control passed for 51 changed package node(s).

3. Exact c20d915... then exposed a second real CI RED in release tests: test/lockfile-reproducibility-workflow.test.ts and test/upload-artifact-node24-integrity.test.ts showed that the prior semantic convergence had accidentally dropped fix(toolchain): replace Wrangler/Miniflare GPL-family path #540's canonical lockfile-regeneration evidence steps together with its obsolete concurrency form. 05bc2d47c3899ebe17538070f9a30172f90307ac restores only the intended disposable npm install --package-lock-only regeneration, checksum-equivalent comparison, pinned actions/upload-artifact evidence, and reproducibility enforcement while retaining protected PR-scoped/work-conserving concurrency and current live-base guards.

Exact-head verification

On unchanged 05bc2d47..., CI 34155490139 is terminal success: exact checkout, live-base verification, lockfile control, canonical regeneration, artifact upload, install, typecheck, full release tests, security scan, KPI, dependency-license inventory, acquisition manifest/integrity and post-verification base-drift guard all passed. Reviewer CI 34155490036 and required Security Scan 34155490066 are also terminal success. patch-validator-image 34155490034 is still running, so historical image evidence is not transferred and the PR remains Draft.

Fresh review-thread inventory is clean. Normal merge is authorized only after patch-validator-image 34155490034 reaches terminal success on unchanged 05bc2d47..., review/thread authority is re-read, compare remains behind_by=0, and protected ancestry is unchanged. No force push, destructive rebase, self-approval or gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Evidence: lockfile regenerated, 3 stale test fixtures repaired — 5c17c82

Fresh exact-head CI (ci 33772121594 / job 100734009932, and lockfile-reproducibility job 100733942817) surfaced real, non-congestion failures on c09f1cb. Diagnosed via job logs and confirmed locally on the exact pinned toolchain (downloaded Node.js 24.19.0 / npm 11.17.0 to match devEngines):

1. package-lock.json was stale — exactly the causal gap the PR description already flagged. Regenerated with npm install --package-lock-only --ignore-scripts --no-audit --no-fund --legacy-peer-deps=false --install-links=false in a fresh directory (same recipe as lockfile-reproducibility.yml); the result is byte-identical (cmp clean) to what that workflow's own fresh-directory regeneration produces. Confirmed test/cloudflare-toolchain-license-boundary.test.ts now passes and the lockfile no longer contains node_modules/wrangler, node_modules/miniflare, node_modules/sharp, @img/sharp-libvips-*, or any LGPL-3.0 entry.
2. test/upload-artifact-node24-integrity.test.ts — the reviewed-workflow inventory was missing the new lockfile-reproducibility.yml. Its two actions/upload-artifact@ uses already pin the reviewed SHA (043fb46d... / v7.0.1), so this is inventory-tracking only, not a new review decision.
3. test/patch-validator-image-contract.test.ts — asserted the old single-line npm pkg delete devDependencies.@cloudflare/workers-types devDependencies.wrangler; the current workflow correctly deletes workerd/esbuild too (this PR's new devDependencies) across multiple continuation lines. Updated the assertions to match, and added the corresponding node_modules/esbuild / node_modules/@esbuild absence checks the workflow already performs.
4. test/cloudflare-worker-config.test.mjs ("fails closed when a root field would be silently omitted") — this fixture appended the new key after the [vars] section header. TOML is section-scoped, so it was actually exercising the (intentionally open-ended) vars path, not the root-key allowlist. Moved it ahead of [vars]; the parser's root-key rejection was already correct and required no change.

Verified via npm run typecheck and the full vitest suite on the pinned toolchain. Remaining local failures (acquisition symlink/owner-only-mode checks, one SIGTERM-reaping timing test) only reproduce because this sandbox runs as root/uid 0 — untouched, and consistent with CI reporting exactly 4 failed files before this push.

Pushed non-force, fast-forward from c09f1cb → 5c17c82. CHANGELOG.md Unreleased updated. No security/license/deployment-boundary logic was changed — this is lockfile regeneration plus test-fixture repair only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BV96rXhqoR3tYZ9AeAVur4

---

Generated by Claude Code