feat(runtime-host): attest the bundled npm runtime - #2621

Closed

zhiiw wants to merge 10 commits into

apache:mainfrom

zhiiw:codex/bundled-npm-runtime-attestation

Commits on Aug 23, 2026

feat(runtime-host): constrain managed npm provisioning
zhiiw
committed
04c4c77
fix(runtime-host): defer npm admission to runtime attestation
zhiiw
committed
1a5af1e
fix(runtime-host): reap descendants after producer root exit
zhiiw
committed
2c37025
feat(runtime-host): attest bundled npm runtime
zhiiw
committed
2772169
test(runtime-host): verify real bundled npm installs
zhiiw
committed
2e2838e
fix(runtime-host): keep Windows npm home path bounded
zhiiw
committed
d525404
fix(release): canonicalize bundled npm verifier paths
zhiiw
committed
57f9fb9
style(runtime-host): format rebased producer boundary
zhiiw
committed
f14e621
fix(release): verify legacy installers against legacy resources
zhiiw
committed
e1b9786
fix(release): exclude generated npm bin links
zhiiw
committed
9f1418b