PR #256 still tells the decider that Bun and Playwright authenticate restored executable content. Focused probes disproved both claims, and the implementation now relies on fresh run-scoped paths plus successful-main-only publication instead. Leaving the extra defense in the durable PR history can cause approval on a false premise and invite a later weakening of the controls that actually carry the trust boundary.
Evidence
The live PR body says Bun validates cached packages through frozen-lockfile integrity and Playwright downloads its pinned browser revision regardless of cache contents. A Bun 1.3.14 probe tampered with an extracted cache entry and bun install --frozen-lockfile installed and executed it successfully. Playwright 1.61.1 returns when a revision directory contains INSTALLATION_COMPLETE; it does not hash or redownload that executable. The base workflow comment made the same claims before fix commit 43ccd38, while that commit correctly removed them from the tracked workflow. The documentation defect therefore predates the fix delta and must be deferred under the bounded verification rule.
Concrete failure
A reviewer approves the PR believing there are two independent defenses. Later, a maintainer can weaken run-scoped isolation or publication ordering because the PR history says the installers independently authenticate cache contents. The real guarantee silently loses force.
Suggested verification
Rewrite PR #256's cache-boundary paragraph to describe only fresh run-scoped paths, pull-request read-only behavior, and publication after a successful complete main gate. Then run gh pr view 256 --repo davidvornholt/standards --json body and confirm it makes no Bun or Playwright self-verification claim.
Found while verifying #256.
PR #256 still tells the decider that Bun and Playwright authenticate restored executable content. Focused probes disproved both claims, and the implementation now relies on fresh run-scoped paths plus successful-main-only publication instead. Leaving the extra defense in the durable PR history can cause approval on a false premise and invite a later weakening of the controls that actually carry the trust boundary.
Evidence
The live PR body says Bun validates cached packages through frozen-lockfile integrity and Playwright downloads its pinned browser revision regardless of cache contents. A Bun 1.3.14 probe tampered with an extracted cache entry and
bun install --frozen-lockfileinstalled and executed it successfully. Playwright 1.61.1 returns when a revision directory containsINSTALLATION_COMPLETE; it does not hash or redownload that executable. The base workflow comment made the same claims before fix commit43ccd38, while that commit correctly removed them from the tracked workflow. The documentation defect therefore predates the fix delta and must be deferred under the bounded verification rule.Concrete failure
A reviewer approves the PR believing there are two independent defenses. Later, a maintainer can weaken run-scoped isolation or publication ordering because the PR history says the installers independently authenticate cache contents. The real guarantee silently loses force.
Suggested verification
Rewrite PR #256's cache-boundary paragraph to describe only fresh run-scoped paths, pull-request read-only behavior, and publication after a successful complete
maingate. Then rungh pr view 256 --repo davidvornholt/standards --json bodyand confirm it makes no Bun or Playwright self-verification claim.Found while verifying #256.