M2-03: Pin reproducible Moss dependency #24

Activity

1. pillowtalk-Qy

   added this to the M2 - Moss Integration & Mini-Demo Core milestone on Jul 29, 2026
2. pillowtalk-Qy

   added

   area:securitySecurity controls and boundariesSecurity controls and boundaries

   priority:P0Critical priorityCritical priority

   type:choreRepository maintenanceRepository maintenance

   status:blockedBlocked by an unresolved dependencyBlocked by an unresolved dependency

   area:moss-integrationMoss integrationMoss integration

   risk:trust-boundaryChanges a trust or evidence boundaryChanges a trust or evidence boundary

   on Jul 29, 2026
3. pillowtalk-Qy

   added a parent issue on Jul 29, 2026

   • M2-00: Hackathon delivery tracker and GitHub setup #21
4. pillowtalk-Qy

   marked this as blocked on Jul 29, 2026

   • M2-01: Decide Web runtime and freeze module boundaries #22
5. pillowtalk-Qy

   marked this as blocking 2 issues on Jul 29, 2026

   • M2-04: Create moss-adapter package and public ports #25
   • M2-08: Add Monad live smoke and provenance record #29
6. pillowtalk-Qy commented on Jul 31, 2026

   

   pillowtalk-Qy

   on Jul 31, 2026

   Last edited by pillowtalk-Qy

   ContributorAuthor

   More actions

   Dependency gate cleared and dependency audit refresh - 2026-07-31

   M2-01 / #22 is Maintainer Accepted and its Node 22 Next/Moss compatibility spike passed. The architecture dependency for #24 is satisfied.

   Current external audit:

   • Moss upstream main: 2e7c1dbeb5e6f3b1492455034e3b0348a3c0094d.
   • PR #138 remains open and unmerged at head d3b169551084c58eda67d9b9716cd48063286bb5.
   • GitHub/npm release remains v0.1.0 / 0.1.0 at tag commit a83434a61f81bdcc253f9b22dac53775cf6f659f.
   • npm @themoss/core@0.1.0 still identifies the legacy Plan model.
   • @themoss/protocol-pancakeswap is not published.
   • The earlier Node 22 spike proved the candidate package workspace can build and import, but it did not create the final integration fork, patch digest, submodule, or clean-clone delivery.

   Control decision:

   • The official release path is not currently sufficient for this Mini-Demo.
   • The Issue's reviewed integration-fork/submodule path remains the default.
   • M2-03: Pin reproducible Moss dependency #24 is released from Blocked to Ready.

   Next required action:

   1. Re-audit the exact upstream code delta from the recorded candidate to current main.
   2. Propose the immutable integration base/head and minimal reviewed patch list.
   3. Produce API fingerprint, license attribution, patchset digest, recursive-submodule CI, and fresh-clone evidence.
   4. Do not track a floating branch or treat PR #138 as merged.
   5. Merge M2-03: Pin reproducible Moss dependency #24 before M2-11: Create Web/API baseline and strict request contracts #32 enters final review because both may modify workspace and lockfile state.

   This record authorizes dependency implementation, not an unreviewed fork or supply-chain exception.
7. pillowtalk-Qy

   added

   status:readyReady to startReady to start

   and removed

   status:blockedBlocked by an unresolved dependencyBlocked by an unresolved dependency

   status:readyReady to startReady to start

   on Jul 31, 2026
8. pillowtalk-Qy

   self-assigned this

   on Aug 5, 2026
9. pillowtalk-Qy commented on Aug 5, 2026

   

   pillowtalk-Qy

   on Aug 5, 2026

   ContributorAuthor

   More actions

   M2_EXECUTION_SLOT_ASSIGNED

   Builder: pillowtalk-Qy
   Planning baseline: origin/main@aae0397da1ba4924422d5a456123e9a4243b1797

   M1 closure evidence:

   • Tracker M1-00: Evidence Contract Delivery Tracker #4 M1_CLOSURE_PASS: M1-00: Evidence Contract Delivery Tracker #4 (comment)
   • Merged-main quality-gate: https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30941143295/job/92099515288
   • Tracker M1-00: Evidence Contract Delivery Tracker #4: Closed / Project Done
   • M1 Milestone: Closed

   Issue #24 is the single active M2 execution slot and is moved to Project In Progress for planning.

   The next required evidence is a closed, path-specific Work Plan based on the exact main SHA above. In Progress does not mean SCOPE_CONFIRMED, implementation authorization, QA PASS, Review, Merge Gate, or merge authorization. No branch, worktree, file modification, commit, dependency change, or PR may begin before Maintainer scope confirmation.

   Issues #23 and #32 remain Ready and unassigned. Other M2 Issues remain governed by their existing direct dependency gates.
10. pillowtalk-Qy commented on Aug 5, 2026

    

    pillowtalk-Qy

    on Aug 5, 2026

    ContributorAuthor

    More actions

    Final Implementation Work Plan - Reproducible Moss Dependency - Awaiting Maintainer Scope Confirmation

    1. Planning control

    • Issue: M2-03: Pin reproducible Moss dependency #24 M2-03 Pin reproducible Moss dependency.
    • Planning baseline: origin/main@aae0397da1ba4924422d5a456123e9a4243b1797.
    • Baseline merged-main gate: https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30941143295/job/92099515288
    • Status: PLANNING_ONLY / AWAITING_MAINTAINER_SCOPE_CONFIRMATION.
    • This comment is a complete, closed implementation request based on the current audit. It updates the mutable facts in the earlier dependency audit without deleting or rewriting the historical comments.
    • No branch, worktree, repository file, commit, dependency, fork, submodule, workflow, or PR may be created or changed until a Maintainer records explicit SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED.

    2. Current external audit and dependency decision

    Audit date: 2026-08-05.

    1. Moss upstream main currently resolves to immutable commit 1ae6b6322d51fae9104f047efb94e601050b967f.
    2. Upstream PR #138 is no longer open. It was merged on 2026-08-04:
       • PR: fix(kuru): represent flip-order receipt evidence nishuzumi/moss#138
       • reviewed head: f39560dbcb18e62298f0f75ac7eb020fb1d01548
       • merge commit: 0c11b5ee672672d1b381afbabb587ae165805aa1
       • the selected upstream commit above contains this merge.
    3. The latest tagged GitHub release remains v0.1.0 at a83434a61f81bdcc253f9b22dac53775cf6f659f.
    4. npm @themoss/core@0.1.0 still exposes the rejected legacy Plan API, and @themoss/protocol-pancakeswap@0.1.0 is not published. The registry release path therefore cannot provide the required Capability/Receipt source set.
    5. The proposed team repository https://github.com/Moss-Mini-Demo/moss does not currently exist or is not readable by this Contributor. Creating or exposing that repository is a Maintainer-owned prerequisite; the Builder will not create a fork or change organization permissions.
    6. Default source mode remains INTEGRATION_FORK, but the current audited upstream already contains PR #138 and the required source packages. The minimal proposal is therefore a zero-patch mirror of the exact upstream commit. No unreviewed patch is authorized.

    The immutable dependency identity requested for Scope Gate is:

    {
      "sourceMode": "INTEGRATION_FORK",
      "upstreamRepository": "https://github.com/nishuzumi/moss",
      "upstreamCommit": "1ae6b6322d51fae9104f047efb94e601050b967f",
      "integrationRepository": "https://github.com/Moss-Mini-Demo/moss",
      "integrationCommit": "1ae6b6322d51fae9104f047efb94e601050b967f",
      "patchsetDigest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "packages": {
        "@themoss/core": "0.1.0",
        "@themoss/simulator": "0.1.0",
        "@themoss/protocol-kuru": "0.1.0",
        "@themoss/protocol-pancakeswap": "0.1.0"
      },
      "officialRelease": false
    }

    The package values above are source-tree manifest versions, not proof that equivalent npm artifacts exist. The repository and commit pair is authoritative. The empty patch digest is the SHA-256 of the exact byte stream produced by:

    git diff --binary --no-ext-diff \
      1ae6b6322d51fae9104f047efb94e601050b967f..1ae6b6322d51fae9104f047efb94e601050b967f

    If the integration commit differs from the upstream commit, the zero-patch proposal is invalid. Implementation must stop and return a new exact patch list, diff review, digest, API fingerprint, and Scope Gate request.

    3. API and license fingerprint

    The selected commit must be verified against these immutable Git blob identities:

    Contract surface	Source path	Git blob SHA	Required observation
    Capability/Receipt contracts	packages/core/src/types.ts	ed6fb07d851a652a826220d6a73520eb58376f3a	public CapabilityNode, CapabilityResult, and Receipt contracts exist; no legacy Plan fallback
    Single-tree simulator entry	packages/simulator/src/index.ts	26016966d2588587995892b22f914bc59d6773f7	simulator consumes one root CapabilityNode tree
    Kuru public entry	packages/protocols/kuru/src/index.ts	992e51ec2c6f5381230f1241b1c4343e29cf82a0	source package has a public package entry
    PancakeSwap public entry	packages/protocols/pancakeswap/src/index.ts	60cd62e4fb6c27fe790a699f09144436fee83704	source package has a public package entry even though the npm package is absent
    License	LICENSE	41416c0feb1e55d569ff759db4eaa34cd40a93a3	upstream MIT attribution is retained

    docs/moss-dependency.md will record this fingerprint, the package manifest versions, the source decision, PR #138 state, license attribution, patch digest algorithm, and the exact MossBuildInfo value. This is dependency provenance only. It is not a runnable adapter, a real Moss/Monad execution, chain evidence, or a safety guarantee.

    4. Closed writable scope

    Only these four Mini-Demo repository paths are requested:

    1. .gitmodules - add the single vendor/moss mapping to the team-controlled HTTPS repository; no branch key and no floating ref.
    2. vendor/moss - add one Git submodule gitlink pinned to exact integration commit 1ae6b6322d51fae9104f047efb94e601050b967f; no copied source files.
    3. docs/moss-dependency.md - add the immutable provenance, build information, API/license fingerprint, verification commands, limitations, and update procedure.
    4. .github/workflows/quality-gate.yml - retain the job name, triggers, and contents: read permission while enabling recursive submodule checkout and adding the pinned Moss offline workspace gate before the unchanged root pnpm check.

    No wildcard path is writable. No fifth path may be added during implementation.

    The following paths are deliberately excluded: package.json, pnpm-lock.yaml, and pnpm-workspace.yaml. Moss remains an independent workspace under the submodule, so the root workspace must not absorb vendor/moss and must not silently resolve Moss from npm. Runtime dependency linkage belongs to the later moss-adapter issue. If a root package, workspace, or lockfile change is found necessary, implementation stops and returns SCOPE_CHANGES_REQUESTED.

    The workflow change requires the Contributor credential to have GitHub workflow OAuth scope before the file can be pushed. The Maintainer must explicitly restore/confirm that scope before implementation reaches the workflow edit. The Builder will not request broader repository permissions, alter Actions permissions, or change branch protection or required checks.

    5. Maintainer prerequisites

    Implementation remains blocked until all of the following are recorded:

    1. Maintainer accepts the exact upstream commit and the zero-patch integration decision.
    2. Maintainer creates or confirms a Contributor-readable team repository at https://github.com/Moss-Mini-Demo/moss.
    3. That repository independently serves exact commit 1ae6b6322d51fae9104f047efb94e601050b967f; it must not require a floating branch for checkout.
    4. Maintainer confirms the four-path writable list and docs-only MossBuildInfo record for this issue.
    5. Maintainer confirms workflow OAuth scope is available for the authorized workflow edit. Job protection, required checks, workflow permissions, and branch protection remain Maintainer-controlled.
    6. Maintainer records explicit SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED on Issue M2-03: Pin reproducible Moss dependency #24.

    Failure of any prerequisite leaves the issue in planning. The Builder must not substitute a personal fork, direct upstream submodule, npm dependency, copied source, or private credential.

    6. Implementation sequence after authorization

    1. Fetch origin and re-scan the then-current origin/main. If Mini-Demo main differs from the planning baseline, record the new exact baseline and verify that the four-path scope still applies before creating any branch.
    2. Create codex/issue-24-reproducible-moss-dependency from that exact main in an isolated worktree.
    3. Read-only verify the team repository serves the exact integration commit and compare it to upstream:
       • integration commit equals the accepted SHA;
       • git diff --binary is empty;
       • computed digest is the recorded empty SHA-256;
       • API and license blob identities match the table.
    4. Add .gitmodules and the vendor/moss gitlink. The URL is HTTPS, no branch is recorded, and the gitlink is the only representation of Moss source in Mini-Demo.
    5. Add docs/moss-dependency.md with:
       • audit date and exact repository/commit identities;
       • npm rejection rationale;
       • PR #138 merged state;
       • canonical MossBuildInfo;
       • zero-patch list and digest method;
       • API/license fingerprint;
       • clean-clone and offline verification procedure;
       • explicit statement that officialRelease=false;
       • explicit statement that package version text alone is not dependency identity;
       • update rule requiring a separate reviewed issue and new immutable commit/digest.
    6. Update only the existing quality-gate workflow:
       • keep workflow/job name quality-gate;
       • keep pull-request and main-push triggers;
       • keep permissions: contents: read;
       • configure checkout for recursive submodules;
       • use Node 22.23.1;
       • run the Moss workspace with its recorded pnpm 11.10.0;
       • run frozen install, build, typecheck, and test:offline within vendor/moss;
       • restore/use Mini-Demo pnpm 11.16.0;
       • run root frozen install and the existing pnpm check entry unchanged.
    7. Inspect the complete diff and submodule metadata. Any change outside the four paths, any non-empty Moss patch, or any root workspace/lock change stops implementation.
    8. Validate from both the implementation worktree and a new remote recursive clone with no retained node_modules, dist, store state, or untracked source.
    9. Commit, push the one issue branch, and create a Draft PR titled chore: pin reproducible Moss dependency with Closes #24 only.
    10. Wait for exact-Head quality-gate success, update the Implementation Report, add a Pre-PR QA handoff, freeze the head, and return to independent review. Do not execute Review, Ready, Merge Gate, Merge, Issue closure, Project state, permission, or branch-protection operations.

    7. Verification contract

    Local implementation environment:

    Mini-Demo Node: 22.23.1
    Mini-Demo pnpm: 11.16.0
    Pinned Moss workspace pnpm: 11.10.0
    

    Required implementation-worktree checks:

    node --version
    pnpm --version
    git submodule status --recursive
    git -C vendor/moss rev-parse HEAD
    git -C vendor/moss diff --exit-code
    git -C vendor/moss diff --cached --exit-code
    
    corepack install --global pnpm@11.10.0
    pnpm -C vendor/moss --version
    pnpm -C vendor/moss install --frozen-lockfile
    pnpm -C vendor/moss build
    pnpm -C vendor/moss typecheck
    pnpm -C vendor/moss test:offline
    
    corepack install --global pnpm@11.16.0
    pnpm --version
    pnpm install --frozen-lockfile
    pnpm check
    
    git diff --check origin/main...HEAD
    git diff --name-status origin/main...HEAD
    git status --short

    The final clean-clone proof must use the pushed Draft PR branch and the public repository path:

    issue24_clone_dir=$(mktemp -d)
    git clone --recurse-submodules \
      --branch codex/issue-24-reproducible-moss-dependency \
      https://github.com/Moss-Mini-Demo/moss-mini-demo.git \
      "$issue24_clone_dir/repo"
    cd "$issue24_clone_dir/repo"
    
    git submodule status --recursive
    test "$(git -C vendor/moss rev-parse HEAD)" = \
      "1ae6b6322d51fae9104f047efb94e601050b967f"
    
    corepack enable
    corepack install --global pnpm@11.10.0
    pnpm -C vendor/moss install --frozen-lockfile
    pnpm -C vendor/moss build
    pnpm -C vendor/moss typecheck
    pnpm -C vendor/moss test:offline
    
    corepack install --global pnpm@11.16.0
    pnpm install --frozen-lockfile
    pnpm check
    git diff --check origin/main...HEAD
    git status --short

    The PR evidence must include command exit results, Moss test counts, Mini-Demo test counts, submodule status, computed digest, exact base/head, and the exact-Head Actions run/job URL.

    8. Acceptance criteria

    • Fresh recursive clone obtains the same Moss bytes from a Contributor-readable team repository.
    • The submodule gitlink is exact; .gitmodules has no branch tracking.
    • Upstream/integration SHA, zero-patch list, digest method/result, API blobs, package manifests, and MIT license attribution are recorded.
    • MossBuildInfo.sourceMode is INTEGRATION_FORK; officialRelease is false.
    • PR #138 is accurately recorded as merged and included; it is not reapplied as a patch.
    • Required public source packages build from the pinned tree. The process never falls back to the legacy npm Plan API or assumes the unpublished PancakeSwap npm package exists.
    • Moss tests are offline. No RPC, wallet, private key, API key, signature, transaction, receipt, quote, or real-chain evidence is introduced.
    • Root Mini-Demo pnpm check remains the sole project quality-gate entry and passes after the Moss workspace gate.
    • GitHub workflow and job names, triggers, and contents: read minimum permission remain unchanged.
    • Exact diff contains only the four approved paths.
    • Draft PR remains Draft and receives exact-Head CI success before Pre-PR QA handoff.

    9. Non-goals

    This issue does not implement or modify:

    • packages/moss-adapter, preflight-core, web/server code, report assembly, orchestration, UI, or Clear402.
    • Moss Capability/Receipt mapping, Quote, Selection, Simulation mapping, RPC, Monad, wallets, signing, transaction submission, or live-chain tests.
    • PreflightReport Schema, Decision Engine, M1 fixtures, STOP presentation, ADRs, architecture, security rules, README, or real-vs-mock documentation.
    • Mini-Demo dependencies, root workspace registration, or lockfile entries.
    • Moss source code or a patch carried only for convenience.
    • Issue M2-02: Freeze scope, judge map and Gate contracts #23, M2-11: Create Web/API baseline and strict request contracts #32, or any other M2 implementation/status operation.
    • organization/repository creation by the Contributor, OAuth expansion, Actions permission changes, branch protection, required checks, review, ready-for-review, merge, or release.

    The dependency pin proves source provenance and reproducible offline build inputs only. It does not prove that Moss is safe, that an application exists, or that any protocol/chain result is real.

    10. Risks, stop conditions, and rollback

    • Fork availability: if the team repository is absent, private to the Builder, or cannot serve the exact commit, stop. Do not replace it with a personal fork or token.
    • Source drift: later upstream commits are ignored by this pin. Updating the gitlink requires a separate reviewed dependency-update scope.
    • Unexpected patch: any integration/upstream delta invalidates the empty digest and requires a new patch-level Work Plan and Scope Gate.
    • API drift or legacy fallback: any mismatch in blob/API fingerprint, package exports, or build output stops implementation.
    • Toolchain mismatch: upstream records pnpm 11.10.0 while Mini-Demo records 11.16.0. Each workspace must pass with its recorded version in the same Node 22 clean clone. Do not edit either lockfile to conceal incompatibility.
    • Online behavior: any test requiring network, RPC, credentials, or live state is excluded from the regular gate. Only test:offline is accepted.
    • Workflow permission: no workflow change is attempted until OAuth scope is restored/confirmed. No broader workflow permission is needed; contents: read remains fixed.
    • Rollback: revert the single M2-03: Pin reproducible Moss dependency #24 commit/PR to remove the documentation, workflow step, gitlink, and .gitmodules entry together. The external team repository is not deleted or rewritten. No generated Moss source is retained in Mini-Demo.

    11. Requested Maintainer Scope Gate

    Please record one of:

    • SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED for the exact commit identity, zero-patch decision, four writable paths, workflow prerequisite, and validation contract above; or
    • SCOPE_CHANGES_REQUESTED with the exact path/contract change required.

    Until that record exists, Builder state remains:

    WORK_PLAN_SUBMITTED
    AWAITING_MAINTAINER_SCOPE_CONFIRMATION
    NO_IMPLEMENTATION_STARTED
    
11. pillowtalk-Qy commented on Aug 5, 2026

    

    pillowtalk-Qy

    on Aug 5, 2026

    ContributorAuthor

    More actions

    MAINTAINER_REVIEW - MAINTAINER_DECISION_REQUIRED

    Audit date: 2026-08-05
    Mini-Demo baseline: main@aae0397da1ba4924422d5a456123e9a4243b1797
    Reviewed Work Plan: #24 (comment)

    Independent verification completed

    • Mini-Demo main is still the reviewed baseline; merged-main quality-gate run 30941143295 is successful.
    • There are no open Mini-Demo pull requests.
    • Upstream Moss main resolves to 1ae6b6322d51fae9104f047efb94e601050b967f.
    • PR #138 is merged at 0c11b5ee672672d1b381afbabb587ae165805aa1; the selected commit is one commit ahead and contains that merge.
    • Release v0.1.0 resolves to a83434a61f81bdcc253f9b22dac53775cf6f659f.
    • npm @themoss/core@0.1.0 exposes the legacy Plan contract; @themoss/protocol-pancakeswap@0.1.0 returns registry E404.
    • All five API/license blob identities in the Work Plan match the selected commit.
    • The zero-patch digest recomputes to sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
    • Under Node 22.23.1 and pnpm 11.10.0, a clean detached checkout passed frozen install, build, typecheck, and test:offline: 30 test files, 249 passed, 14 skipped by the upstream suite. The checkout remained clean.
    • Contributor authentication has workflow scope. Existing workflow identity, contents: read, and strict required quality-gate protection remain intact.

    Scope assessment

    The immutable upstream commit, zero-patch integration decision, docs-only MossBuildInfo, four writable Mini-Demo paths, and proposed dual-workspace validation contract are technically acceptable.

    One prerequisite must be made stricter: Contributor-readable is insufficient for cross-repository Actions and credential-free fresh-clone reproducibility. The integration repository must be a public, anonymously readable organization fork at https://github.com/Moss-Mini-Demo/moss. A private repository, personal fork, direct floating upstream reference, copied source, or hidden credential is not accepted.

    The organization repository does not currently exist. The current user is an active organization admin and can create repositories, so this is a Maintainer action rather than an external blocker.

    Decision and assignment

    Formal conclusion: MAINTAINER_DECISION_REQUIRED.

    Maintainer Qy is the next active role and must:

    1. Create the public organization fork Moss-Mini-Demo/moss from nishuzumi/moss.
    2. Confirm anonymous read access and that exact commit 1ae6b6322d51fae9104f047efb94e601050b967f is served by that repository.
    3. Confirm the fork's selected tree and the five recorded blobs match upstream, and that the integration diff is empty.
    4. Record those repository facts here, then issue SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED if they pass.

    Builder Qy remains NO_IMPLEMENTATION_STARTED: do not create a branch/worktree, edit files, add the submodule, change the workflow, commit, push, or open a PR yet.

    #24 remains the single active M2 slot in planning. #23 and #32 remain Ready and unassigned. #25-#31, #33, and #34 remain blocked by their direct dependency gates.
12. pillowtalk-Qy commented on Aug 5, 2026

    

    pillowtalk-Qy

    on Aug 5, 2026

    ContributorAuthor

    More actions

    SCOPE_CONFIRMED / IMPLEMENTATION_AUTHORIZED

    Reviewed Work Plan:
    #24 (comment)

    Mini-Demo planning baseline:
    main@aae0397da1ba4924422d5a456123e9a4243b1797

    Maintainer prerequisite verification

    The organization fork has been created and verified:

    • Integration repository: https://github.com/Moss-Mini-Demo/moss
    • Repository identity: public GitHub fork
    • Visibility: PUBLIC
    • Parent/source: nishuzumi/moss
    • Upstream commit: 1ae6b6322d51fae9104f047efb94e601050b967f
    • Integration commit: 1ae6b6322d51fae9104f047efb94e601050b967f
    • Fork main: 1ae6b6322d51fae9104f047efb94e601050b967f
    • Anonymous HTTPS ls-remote, clone, and explicit fetch: PASS with GitHub tokens, credential helpers, global Git configuration, terminal prompting, and SSH credentials disabled
    • Integration name-status diff against upstream: empty
    • Binary integration diff SHA-256: sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    The five immutable API/license blobs match the accepted upstream tree exactly:

    • packages/core/src/types.ts: ed6fb07d851a652a826220d6a73520eb58376f3a
    • packages/simulator/src/index.ts: 26016966d2588587995892b22f914bc59d6773f7
    • packages/protocols/kuru/src/index.ts: 992e51ec2c6f5381230f1241b1c4343e29cf82a0
    • packages/protocols/pancakeswap/src/index.ts: 60cd62e4fb6c27fe790a699f09144436fee83704
    • LICENSE: 41416c0feb1e55d569ff759db4eaa34cd40a93a3

    The authenticated Maintainer session includes GitHub workflow scope. No Actions permission, branch protection, required-check, Team, or repository permission setting was changed.

    Authorized implementation contract

    The fixed zero-patch INTEGRATION_FORK decision and the Final Work Plan are approved.

    Writable Mini-Demo paths are exactly:

    1. .gitmodules
    2. vendor/moss gitlink pinned to 1ae6b6322d51fae9104f047efb94e601050b967f
    3. docs/moss-dependency.md
    4. .github/workflows/quality-gate.yml

    The Work Plan requirements for immutable provenance, docs-only MossBuildInfo, officialRelease=false, recursive submodule checkout, dual pnpm workspace validation, public package/API fingerprint, MIT attribution, offline Moss tests, clean recursive clone, and unchanged root pnpm check remain mandatory.

    No fifth path, Moss source patch, root package/workspace/lockfile change, direct upstream submodule, npm fallback, floating branch/tag, private credential, live-chain behavior, adapter implementation, Schema/Decision Engine change, or product capability is authorized.

    Any repository-visibility change, commit drift, non-empty integration diff, blob mismatch, added path, dependency change, or workflow/permission expansion invalidates this authorization and requires a new Scope Gate.

    This record is implementation scope authorization only. It is not QA PASS, Review, Ready for review, Merge Gate, merge authorization, M2 Gate completion, or evidence that Moss or the Mini-Demo is safe or operational.

    No Builder branch, worktree, file change, commit, push, or PR is created by this Maintainer task. Builder execution remains unstarted until a separate role handoff.
13. pillowtalk-Qy

    added a commit that references this issue on Aug 5, 2026

    chore: pin reproducible Moss dependency (#70)

    ...

    93235e5
14. pillowtalk-Qy

    closed this as completedin #70on Aug 5, 2026
15. pillowtalk-Qy commented on Aug 5, 2026

    

    pillowtalk-Qy

    on Aug 5, 2026

    ContributorAuthor

    More actions

    POST_MERGE_AUDIT

    PR #70 was squash-merged under the exact Maintainer Merge Gate.

    • Accepted head: ac40e615ffd197abdba1eb4946a3d1fd9d4d677e
    • Accepted base: main@aae0397da1ba4924422d5a456123e9a4243b1797
    • READY_TO_MERGE: chore: pin reproducible Moss dependency #70 (comment)
    • Squash/main commit: 93235e5c3ef531075c860beadc6ad2ce6b3dc8a0
    • Merge time: 2026-08-05T04:26:53Z
    • Squash parent: aae0397da1ba4924422d5a456123e9a4243b1797
    • Merged-main quality-gate: SUCCESS
    • Run: https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30975163159
    • Job: https://github.com/Moss-Mini-Demo/moss-mini-demo/actions/runs/30975163159/job/92207551610
    • Feature branch ref: deleted, GitHub ref lookup returns 404
    • Issue M2-03: Pin reproducible Moss dependency #24: Closed / Completed / Project Done
    • Main protection: strict required quality-gate, resolved conversations, linear history, enforce admins, no force push/delete, Maintainers-only push restriction

    No admin bypass or auto-merge was used. No permission, Team, protection, Tag, Release, product, or live-chain operation was changed by this audit.