Stabilize Unit CI

[SuuBro]

Summary

• make preview artifact ordering tests assert the lookup's actual streamed opendir order
• replace archive purge turn-count polling with explicit readiness signals and failure-safe deferred cleanup
• keep registry advisory queries out of normal test suites while enforcing a hardened clean-consumer audit at release time
• document enumeration, cleanup, and release-audit contracts

Verification

• build, type-check, focused regressions, full unit, browser, and E2E suites passed
• automated gap, quality, regression, bug, and security reviews passed

🤖 Generated with Bobbit

[greptile-apps]

Greptile Summary

Stabilizes asynchronous cleanup and preview-order tests while adding a fail-closed packed-consumer vulnerability audit to the release workflow.

• Replaces event-loop turn polling with explicit readiness signals and failure-safe deferred cleanup.
• Makes preview artifact tests assert the lookup’s controlled opendir stream order.
• Moves registry advisory checks out of ordinary E2E execution and into a hardened release-only audit.
• Updates release, runtime compatibility, and cleanup contract documentation.

Confidence Score: 5/5

The PR appears safe to merge, with the changed tests and release audit consistently enforcing their documented ordering, cleanup, and fail-closed contracts.

The controlled preview streams exercise the production enumeration seam, deferred cleanup paths release their holds before lifecycle barriers, and the release audit rejects malformed reports, nonzero audit exits, and every nonzero vulnerability count.

Important Files Changed

Filename	Overview
scripts/release-packed-consumer-audit.mjs	Adds a restricted, temporary packed-consumer installation and validates that npm returns a well-formed, completely clean runtime audit before release.
package.json	Exposes the packed-consumer audit as an explicit release command.
tests2/core/archive-purge-async.test.ts	Replaces finite-turn polling with explicit operation-boundary readiness and releases test-owned holds safely during teardown.
tests2/core/preview-artifacts.test.ts	Controls the exact artifact lookup stream and verifies that concurrent metadata reads preserve first-valid stream order.
tests2/integration/search-preview-api.test.ts	Makes preview API ordering and deferred-hash assertions deterministic against the injected lookup stream.
tests2/core/release-skill-preflight-order.test.ts	Pins release audit behavior, restricted environment construction, failure handling, and build-before-audit ordering.
tests/e2e/pi-packed-consumer.spec.ts	Removes registry-dependent advisory assertions from the normal E2E suite while retaining packed dependency and binary compatibility checks.
.claude/skills/release/SKILL.md	Adds the clean packed-consumer audit as a mandatory, fail-closed release gate after the build.

Sequence Diagram

sequenceDiagram
    participant Release as Release workflow
    participant Build as Bobbit build
    participant Audit as Packed-consumer audit
    participant Consumer as Temporary consumer
    participant Registry as npm registry
    Release->>Build: npm run build
    Release->>Audit: npm run audit:packed-consumer
    Audit->>Audit: npm pack built repository
    Audit->>Consumer: Install tarball with restricted npm environment
    Consumer->>Registry: "npm audit --omit=dev --json"
    Registry-->>Consumer: Advisory report
    Consumer-->>Audit: Exact vulnerability counts and exit status
    Audit-->>Release: Pass only for a valid zero-vulnerability report

Loading

_{Reviews (1): Last reviewed commit: "Document CI stabilization contracts" | Re-trigger Greptile}