fix(install): preserve local declaring sources and audit current intent read-only

[Daniel Meppiel (danielmeppiel)]

fix(install): preserve local declaring sources and audit current intent read-only

TL;DR

Recover the combined local-source and current-intent audit portion of #2820, addressing #2815 and #2816 while preserving the #2818 process obligations.
Local children resolve from established declaring sources; audit replays current target intent without initializing live configuration.
The matching corrective draft and complete binding harness remain explicitly DRAFT / UNSATISFIED, not implementation certification or ratification.
This is a provisional lineage-preserving draft, not a landing-ready successor.

Important

Actual base: main at d26ccdaf2fbcb29775abc94b7413790b3e32b600.
This PR is not yet based on the narrowed original foundation branch.
After both successor links permit #2820 to be narrowed, inherit the actual stable foundation and retarget truthfully.
#2901's runtime and normative changes are not integrated; its human landing and subsequent actual-main reconciliation remain separate prerequisites.
Do not request qualifying human approval against this moving draft.

Problem (WHY)

• Blanket user-scope relative-path rejection loses a valid local declaring-parent anchor. The [BUG] Global install exits successfully after silently omitting a relative local transitive dependency #2815 regression exercises the real resolution and acquisition boundaries rather than substituting a mock admission decision.
• Package-controlled source spelling is not acquisition provenance: a remote name resembling _local/... must not authorize local filesystem access.
• Replaying historical lock targets instead of current intent can miss target contraction or report an empty success. Historical claims still need comparison, integrity and membership checks.
• [!] Startup, configuration readers and native discovery can violate an audit's read-only boundary before content comparison begins.
• [!] Collected requirement bindings cannot establish execution, historical compliance, qualified-human review or ratification.

These boundaries use concrete regression cases rather than inferred success:
"Effective skills are grounded in real expertise."
The source/replay split preserves coherent responsibilities:
"you want it to encapsulate a coherent unit of work that composes well with other skills."
Execution evidence remains separate from generated inventories:
"Run the skill against real tasks, then feed the results — all of them, not just failures — back into the creation process."

Approach (WHAT)

• Project an acquisition-only source kind at resolver activation; never accept authored metadata as that authority.
• Reuse user_scope_rejection_reason at both resolution and acquisition, preserving the original declaring source.
• Inherit the same committed source-restoration helper and cached caller/test prerequisite as the independent aggregate successor.
• Resolve current audit intent centrally, replay into scratch and retain historical lock claims only for comparison.
• Preserve read-only startup/configuration/protocol/native discovery and existing scanner/MCP boundaries.
• Reconcile the draft against the real retained normative baseline, with all 123 requirement IDs bound and human conditions explicit.

Implementation (HOW)

Surface	Change and boundary
models/apm_package.py, deps/apm_resolver.py	Separate acquisition provenance from authored source spelling; preserve current-main skill-bundle validation. Activation authority.
install/package_resolution.py, install/phases/resolve.py, install/sources.py	One admission owner and original-source anchoring at both boundaries; shared cached identity restoration. Admission.
core/target_detection.py, install/audit_target_roots.py, install/audit_replay.py, install/drift.py	Current-intent target selection, scratch replay and historical comparison. Equivalent local-bundle dictionary removal reduces drift from 1,029 to 1,020 lines without changing the budget.
cli.py, config.py, deps/github_downloader.py, deps/git_auth_env.py	Audit startup and read-only configuration/protocol setup do not bootstrap user configuration; install defaults remain compatible.
integration/copilot_cowork_paths.py, integration/mcp_config_view.py, policy/_shared.py, policy/ci_checks.py, security/file_scanner.py	Keep discovery, replay, policy, scanner and MCP-view reads on the read-only path. No new native database backend.
.apm/architecture/owners/{core-runtime,install-deployment,contracts-tooling}.json and the five changed architecture-check modules	Canonical routing guards, deterministic inventory ordering and source/conformance boundaries. Cached-route guard ownership remains with the aggregate successor; no duplicate local authority.
tests/unit/{deps,install,core}/, config/protocol tests, resolver tests and architecture integration companions	Restore original acquisition, scope, replay, transport and mutation cases; relocate the shared cached/fresh pair rather than duplicate it.
tests/integration/test_{audit_target_intent_e2e,global_local_transitive_dependency_e2e,audit_unrecorded_unicode_lifecycle,version_notification}.py	Preserve installed-CLI startup, lifecycle and scanning controls. Their presence is not claimed as final-head native execution.
tests/spec_conformance/*, tests/fixtures/spec-conformance/manifest/valid-local-parent.yml	Complete original harness recovery, preservation fingerprints, fresh collection, Mode B companion and explicit known limitations.
openapm-v0.2.md, its requirements manifest, docs/astro.config.mjs	Exact parent-authorized inactive normative overlay; v0.1 bytes and latest remain unchanged.
.github/workflows/spec-conformance.yml, .gitignore, CONFORMANCE.{json,md}	Version-qualified coverage handling and freshly generated static bindings, not pass certificates.
CONTRIBUTING.md, CHANGELOG.md, CLI audit/config/install docs, conformance docs and packaged commands/dependencies guidance	Practical local-source and read-only audit guidance with draft, native, schema and integrity limitations.

Exact lineage

Artifact	Identity / disposition
Original source	824b17058826aef375c0446085197a81e1418dd8, original base 8faecc6c0cbc25864e63fd0081f8eb22accd2359
Shared model helper	f1a605862d586773ee6e74ee37bf201a01722d4c, inherited as the exact commit
Shared cached caller and two-case test	63b3619905298efca014a6621b725b5448ffefff, inherited as the same object by both successors
Parent normative source / local exact overlay	0858443a9930c996d4aaa2f63d4f27348f2263ab / 9a45efde1faf5cd5d8e50a8335f12e0c1d0c417d
Retained normative contents	Exact f8df1b75 bytes, unchanged by current runtime base d26ccdaf
Parent canonical source accounting	248 local/shared U1 hunk identities: 127 exact-file, 100 retained-addition/context, 18 explicit adaptations, 3 approved lock omission hunks; original test functions retained
Canonical apm.lock.yaml	Unchanged. VP approved omitting only the original 20 deleted lines for two machine-local native URIs and their two deployment receipts.

Original authorship and source-commit attribution are preserved in commits.
Prior general R1/R2/R3 and spec R2 receipts remain historical, not fresh approvals:
general recommendation,
shared specification review surface.
The same unfinished outer iteration 4 continues; both Copilot rounds are already consumed.
No new Copilot fetch or CI recovery was performed for this preparation.

Diagrams

Dashed stages show the corrected authority boundaries: original acquisition determines local admission, while current intent—not historical lock targets—determines audit replay.

flowchart LR
    subgraph Install["Local-source install"]
        R["_source_kind_for_dependency"] --> P["Acquisition-only proven_source_kind"]
        P --> A["user_scope_rejection_reason"]
        A -->|"admitted"| C["Original declaring source"]
        C --> D["Contained materialization destination"]
        A -->|"rejected"| E["No local acquisition"]
    end
    subgraph Audit["Read-only audit"]
        I["Current manifest and saved intent"] --> T["resolve_audit_targets"]
        T --> S["prepare_ci_audit_replay: scratch only"]
        S --> V["Compare expected and live outputs"]
        L["Historical lock claims"] --> V
    end
    classDef new stroke-dasharray: 5 5;
    class P,A,T,S new;

Loading

Trade-offs

• Original sources, not destination aliases. Relative ../ source references are valid when established by a local declaring package; destination containment remains a separate authority. fix(alias): reject path-traversing dependency aliases — fixes #2900 #2901 integration is deferred until the permitted actual-main boundary, not simulated with copied dirty work.
• Draft assessment, not retroactive compliance. Preserve v0.1's contract verbatim rather than rewriting it to fit current behavior. The 123-ID draft is the retained 122-ID baseline plus req-lk-023; future alias requirements are not guessed into it.
• Honest audit limitations. Bare content audit still uses source-derived replay rather than the stored-hash baseline required by unqualified req-lk-017. Internal resource-link dereferencing can still produce a false orphan; its narrow xfail and unsuppressed escaping-link refusal remain. No req-lk-017 or req-sc-015 weakening.
• Bounded native claims. Cowork uses a controlled pre-existing snapshot, not a proved install/audit round trip. Unsupported native replay fails before its live writer; no hosted-native or cross-platform Git-tree qualification is implied.
• Human gates remain real. Two qualified nonauthor human approvals, the process-issue label and explicit ratification/publication remain unsatisfied. The recorded #2818 exception covers only public comment, not these gates or fix(alias): reject path-traversing dependency aliases — fixes #2900 #2901's separate obligations.

Benefits

1. Both local admission boundaries use the same declaring-source decision.
2. Cached/fresh source restoration has one shared prerequisite and one two-case test module.
3. All original source test functions remain represented; the draft binds exactly 123 requirement IDs.
4. Four distinct warm/cold clean/refusal startup controls are retained, with acceptance still requiring unique successful native execution.
5. The drift module meets its existing 1,020-line limit through a real reduction.

Validation

Exact head: fda7d05716718d960c677d68265fbdf163fce854, incorporating actual main d26ccdaf.
The authorized single batch and complete current CI-mirror lint/architecture chain finished successfully.
This is local evidence; hosted CI has not yet been observed for this new PR.

Targeted command:

UV_FROZEN=1 uv run --frozen --extra dev pytest -q -p no:cacheprovider \
  tests/unit/test_protocol_config_precedence.py::test_downloader_config_bootstrap_preserves_transport_precedence \
  tests/unit/test_protocol_config_precedence.py::test_read_only_windows_sentinel_preserves_temp_precedence \
  tests/unit/install/test_cached_source_identity.py \
  tests/unit/deps/test_declaring_source_provenance.py \
  tests/spec_conformance/test_manifest_reqs.py::test_agent_plugin_target_exclusion_materializes_without_projection

50 passed in 3.50s

Current-head lint evidence and historical preparation boundaries

The canonical Ruff pair covered src/, tests/, scripts/lint_architecture_boundaries.py and scripts/architecture_linter/.
The YAML-write, 2,100-line and portable-relative-path guards passed; pylint R0801, auth-signal lint, architecture boundaries and the narrower 1,020-line drift limit passed.
The working tree and tested head remained unchanged.

All checks passed!
1851 files already formatted
CI YAML, 2100-line, and portable-relative-path guards passed.
Your code has been rated at 10.00/10 (previous run: 10.00/10, +0.00)
[+] auth-signal lint clean

Earlier recovered-tree preparation: 548 local/resolver/source cases passed; complete source conformance collected 319 cases with 317 passed, one publisher-SHOULD waiver skip and one known internal-link replay xfail.
All 216 original conformance functions and parameterizations were retained, and generation was deterministic.
Those earlier executions are not borrowed as exact-current-head or native certification.
Behavioral mutation preparation made the local-admission and cached-restoration cases fail when their protected decisions were removed, then restored them.
Final owner evidence, native acceptance, general panel/docs-sync and the parent's sole final spec-guardian round remain pending their approved integration boundaries.

Scenario Evidence

The table identifies actual tests and their evidence level; e2e rows remain pending native allocation.

#	Scenario (user promise)	Principle(s)	Test(s) proving it	Type
1	Install a global local parent's relative child from its original directory	Portability by manifest; DevX	tests/unit/install/test_local_scope_admission.py::test_user_scope_preserves_local_parent_anchor (regression-trap for #2815); tests/integration/test_global_local_transitive_dependency_e2e.py::test_local_transitive_scope_parity	Cross-module component; e2e pending
2	A remote or unknown package cannot impersonate a local source	Secure by default; Vendor-neutral	tests/unit/deps/test_declaring_source_provenance.py::test_boundaries_refuse_nonlocal_declaring_context	Component, current-head pass
3	Cached/fresh Git packages retain complete source identity	Vendor-neutral; Governed by policy	tests/unit/install/test_cached_source_identity.py::test_cached_acquisition_restores_original_git_source	Component, current-head pass
4	Audit current targets while still detecting historical drift and tampering	Governed by policy; Multi-harness support	tests/spec_conformance/test_audit_current_intent_contract.py::test_current_intent_overrides_old_target_ownership; ::test_configured_target_keeps_integrity_and_membership_checks	Cross-module component, preparation evidence
5	Audit startup leaves home/project unchanged on warm/cold success and refusal	Secure by default; DevX	tests/integration/test_audit_target_intent_e2e.py::test_audit_startup_leaves_fresh_home_unchanged_outside_test_mode	Four e2e cases, pending
6	Read-only setup retains transport precedence without creating configuration	Secure by default; Vendor-neutral	tests/unit/test_protocol_config_precedence.py::test_downloader_config_bootstrap_preserves_transport_precedence; ::test_read_only_windows_sentinel_preserves_temp_precedence	Component, current-head pass
7	Reject stale/incomplete assessment bindings and preserve previous normative bytes	Governed by policy; OSS / community-driven	tests/spec_conformance/test_spec_version_contract.py	Component, preparation evidence

How to test

• Run the targeted command above in the development environment; expect 50 passing cases and no live native campaign.
• Run UV_FROZEN=1 uv run --frozen --extra dev pytest tests/spec_conformance -q; distinguish the documented skip/xfail from passing assertions.
• Run UV_FROZEN=1 uv run --frozen --extra dev python -m tests.spec_conformance.gen_statement, then inspect git diff -- CONFORMANCE.json CONFORMANCE.md; expect deterministic DRAFT bindings, not ratification.
• Under an allocated installed-CLI lifecycle slot, run the two new e2e modules and require all four startup control IDs to pass uniquely with unchanged full home/project snapshots.
• After actual prerequisite landing and foundation retargeting, repeat exact-head owner, native, lint and hosted-CI evidence before final advisory review. Do not reuse this provisional result as that acceptance.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com