[jdx]

Summary

Activates trustPolicy=no-downgrade end-to-end (previously a documented but no-op setting), adds a paranoid bundle switch for the strict-security posture, ships a security overview doc + GitHub-recognized SECURITY.md, and flips the trustPolicy default to on. Mirrors pnpm's failIfTrustDowngraded algorithm exactly — verified against pnpm's source + test suite at /tmp/pnpm.

BREAKING CHANGE: installs of packages whose newest version lost trust evidence (provenance attestation or trusted-publisher OIDC link) compared to any earlier published version will now fail unless the user opts out via trustPolicy = off, trustPolicyExclude, or trustPolicyIgnoreAfter. Drop the ! from the title before merge to delay this to a later major.

Trust enforcement

Trust evidence ranks: _npmUser.trustedPublisher (2) > dist.attestations.provenance (1). Install fails when any earlier-published version of the same package carried stronger evidence than the picked one.

• Algorithm in crates/aube-resolver/src/trust.rs — exact mirror of pnpm's failIfTrustDowngraded including the v10.24.0+ "skip prior prereleases when picking stable" rule and the JS-style truthiness on both evidence fields.
• trustPolicyExclude parser supports the full pnpm syntax: name, name@1.0.0, name@1.0.0 || 1.0.1 (exact versions only — ^/~/>= rejected), is-* name glob, scoped names. Exclude check runs before the time lookup so excluded packages don't error on registries that omit time.
• Resolver integration at resolve.rs:1271 — fires immediately after PickResult::Found, mirrors pnpm's placement. Forces the full-packument fetch path so per-version time is available, including suppressing the corgi-shortcircuit when both minimumReleaseAge and trustPolicy are active.
• Graceful degradation when the registry doesn't ship time at all (Verdaccio fixtures, private mirrors). Per-version time gaps still error — that's the registry-quirk shape pnpm's check catches.

paranoid master switch

paranoid: true forces every setting in the strict-security bundle on, regardless of how each is configured individually:

Setting	Without paranoid	With paranoid
trustPolicy	no-downgrade (default)	no-downgrade (forced)
jailBuilds	false	true
minimumReleaseAgeStrict	falls back to lowest satisfying version	fails the install
strictStoreIntegrity	warns on missing dist.integrity	fails the install
strictDepBuilds	silently skips unreviewed dep build scripts	fails after link

Default flip

trustPolicy defaults to no-downgrade. Both the codegen settings layer and TrustPolicy::default() agree (the latter aligned with the former in 30e3cd8 so library consumers calling Resolver::new directly inherit the documented behavior).

Cost analysis: trust check itself is microseconds (a few BTreeMap::get lookups). Cold-cache installs pay one full-packument fetch instead of corgi (~3-5× larger response); warm-cache installs are free. Same hit minimumReleaseAge already takes today.

Documentation

• SECURITY.md at the repo root — GitHub-recognized vulnerability disclosure path (private advisory form, since issues are disabled) + at-a-glance feature table.
• docs/security.md — comprehensive overview covering paranoid, default-deny lifecycle scripts, jailed builds, trust policy, minimum release age, exotic-deps blocking, tarball/CAS integrity, auth-token handling, aube audit. Each section links to the relevant setting.
• VitePress sidebar gets a new "Security" section.
• README + landing-hero copy point at /security and accurately list defaults vs opt-ins.
• Settings docstrings rewritten in settings.toml and regenerated into docs/settings/index.md.

Test plan

• cargo test --workspace — 297 + 162 + ~700 more tests pass, including 30+ new trust unit tests (truthiness, exclude parsing, prerelease handling, exclude-bypasses-missing-time, empty-time-map skip, ignore-after cutoff, downgrade detection)
• Two resolver-level integration tests using a TCP test server: one asserts Error::TrustDowngrade fires + trustPolicyExclude unblocks, one is the regression test for the corgi-shortcircuit interaction with minimumReleaseAge
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --check clean
• All bats files affected by the default flip pass locally (bundled_dependencies, add, global_install, node_gyp_rebuild)
• End-to-end smoke against npmjs.org with a real package known to have lost provenance between versions

Review-comment fixes landed

• Cursor Bugbot — corgi-shortcircuit suppression with concurrent minimumReleaseAge + trustPolicy
• Cursor Bugbot — provenance evidence now is_truthy-gated to match trustedPublisher
• Cursor Bugbot — TrustPolicy::default() aligned with settings.toml default
• Greptile — is_truthy covers all JS falsy values (0, "", NaN)
• Greptile — TrustExcludeRules::parse_lossy returns (rules, errors) so we don't double-parse with a silent fail-open fallback
• Greptile — README/hero copy no longer implies trust-downgrade detection is default-on (it is now, after the default flip — copy updated again accordingly)
• Greptile — SECURITY.md table corrected (trustPolicy is a string enum, not a bool)

🤖 Generated with Claude Code

Greptile Summary

Wires the previously-stubbed trustPolicy=no-downgrade enforcement end-to-end: new aube_registry fields extract _npmUser.trustedPublisher (rank 2) and dist.attestations.provenance (rank 1) from packuments, aube-resolver/src/trust.rs implements the pnpm-mirrored downgrade check, and the resolver integration correctly suppresses the corgi-packument shortcircuit when the policy is active so per-version time data is always present. The paranoid bundle switch is fully wired for all five documented settings (trustPolicy, jailBuilds, minimumReleaseAgeStrict, strictStoreIntegrity, strictDepBuilds). Test coverage is thorough: 25+ unit tests in trust::tests plus two resolver-level integration tests with a real TCP server.

Confidence Score: 5/5

Safe to merge; all findings are P2 (cosmetic error-message quality and a PR-description discrepancy).

No P0 or P1 bugs found. The algorithm correctly mirrors pnpm's failIfTrustDowngraded, the corgi-shortcircuit suppression is properly guarded and regression-tested, the is_truthy implementation correctly handles all JS falsy values including 0/""/[], and parse_lossy prevents a single malformed exclude from silently dropping all rules. Only P2 findings remain.

No files require special attention; crates/aube-resolver/src/types.rs carries the default-flip that is intentional but contradicts the PR description prose.

Important Files Changed

Filename	Overview
crates/aube-resolver/src/trust.rs	New trust-policy module: evidence_for, check_no_downgrade, TrustExcludeRules; 25+ unit tests covering all edge cases; JS truthiness implementation is correct (empty arrays are truthy in JS, addressing the previous review thread concern).
crates/aube-resolver/src/resolve.rs	Trust check integrated immediately after PickResult::Found; minimum_release_age_only shortcircuit correctly suppressed when trustPolicy=NoDowngrade to prevent corgi packument from omitting per-version time data needed by the check.
crates/aube-resolver/src/types.rs	TrustPolicy::NoDowngrade is now the #[default] variant (previously Off), and trust_policy_exclude changed from BTreeSet<String> to TrustExcludeRules; breaking change for library consumers relying on DependencyPolicy::default().
crates/aube/src/commands/install/settings.rs	paranoid flag wires all five bundle settings; trust_policy_exclude now parsed with parse_lossy so one malformed entry doesn't silently drop all exclude rules (addresses previous review thread concern).
crates/aube-registry/src/lib.rs	Adds NpmUser and Attestations structs with tolerant _npmUser deserializer that degrades pre-2010 string-form packuments to None instead of failing the whole parse; well-tested with 5 new unit tests.
crates/aube-resolver/src/tests.rs	Two new integration tests: one verifying the corgi-shortcircuit suppression and one asserting TrustDowngrade fires for a 3-version packument with evidence loss plus verifying trustPolicyExclude unblocks it.
crates/aube-resolver/src/error.rs	Two new error variants TrustDowngrade and TrustCheckMissingTime with miette help text suggesting all three escape hatches.
crates/aube-resolver/src/builder.rs	should_record_times predicate extended to include trust_policy == NoDowngrade so the full-packument fetch path activates when trust policy is on.
crates/aube-settings/settings.toml	Default for trustPolicy changed from "off" to "no-downgrade", new paranoid bundle setting added, exclude pattern syntax documented; default flip is a user-visible breaking change.
crates/aube-manifest/src/workspace.rs	Adds paranoid: Option<bool> field with serde rename/default for workspace config.
crates/aube/src/commands/install/lifecycle.rs	paranoid=true forces jail builds on via `

_{Reviews (4): Last reviewed commit: "fix(resolver): align TrustPolicy::defaul..." | Re-trigger Greptile}

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit adf2b61. Configure here.}