Exempt @cosyte packages from the 24-hour release-age floor

npm-config-allow.json

@@ -88,6 +88,11 @@
       "value": 1440,
       "why": "The publication cooldown in pnpm-workspace.yaml: no dependency version younger than this many minutes may be resolved. Pinned EXACTLY rather than by a floor, because this allow-set answers `what may a release be configured with` and a release configured with a shorter cooldown than the baseline requires is precisely the configuration nobody approved. drift-manifest.json's installHardening group is where the 1440 is derived; a change has to be a reviewed diff in both."
     },
+    {
+      "key": "minimum-release-age-exclude",
+      "value": ["@cosyte/*"],
+      "why": "The one exemption from the publication cooldown, pinned EXACTLY as a list rather than permitted at any value. The operator decided that @cosyte/* is exempt from the 24-hour floor and that every third-party package keeps it, so the list names our own scope and nothing else. pnpm-workspace.yaml carries the same entry with the `# reason:` comment scripts/install-hardening.mjs refuses to do without, and pnpm reads a scope pattern here from 10.17.0, below the 10.34.5 this repository pins. Adding any other entry, a third-party name above all, must be a reviewed diff here as well as in pnpm-workspace.yaml."
+    },
     {
       "key": "trust-policy",
       "value": "no-downgrade",

pnpm-workspace.yaml

@@ -24,7 +24,11 @@ packages:
 # package repo. pnpm's own rationale for the number: "Since malware is usually
 # detected quickly, delaying updates by 24 hours will most likely prevent you
 # from installing a bad version" (https://pnpm.io/supply-chain-security).
+# @cosyte is exempt by operator decision; every third-party package keeps the floor.
 minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  # reason: first-party @cosyte package, exempt from the floor by operator decision
+  - "@cosyte/*"
 
 # Fail the install when a package's trust evidence is weaker than that of an
 # earlier-published version of the same package (a trusted publisher that