Fix: Re-run verified installer inputs

tests/setup/launcher-search-contract

@@ -116,6 +116,41 @@ grep -q '/etc/profile.d/nvm.sh' "$stage" \
 git -C "$repo_dir" check-ignore -q "$extension/node_modules" 2>/dev/null \
     || note 'the extension node_modules is not gitignored'
 
+# npm must honour the committed dependency graph. This disposable fixture
+# simulates npm rejecting a mismatched lockfile, which must leave that lockfile
+# untouched and keep the launcher stage nonfatal.
+fixture_root="$(mktemp -d -t panama-vicinae-lock.XXXXXX)"
+trap 'rm -rf -- "$fixture_root"' EXIT
+mkdir -p "$fixture_root/config/local/share/vicinae/scripts" \
+    "$fixture_root/config/local/share/vicinae/extensions/panama-search/src" \
+    "$fixture_root/bin"
+printf '{"name":"panama-search","dependencies":{"left-pad":"1.3.0"}}\n' \
+    >"$fixture_root/config/local/share/vicinae/extensions/panama-search/package.json"
+printf '{"lockfileVersion":3,"packages":{}}\n' \
+    >"$fixture_root/config/local/share/vicinae/extensions/panama-search/package-lock.json"
+lockfile="$fixture_root/config/local/share/vicinae/extensions/panama-search/package-lock.json"
+lock_before="$fixture_root/package-lock.before"
+cp -- "$lockfile" "$lock_before"
+cat >"$fixture_root/bin/npm" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"${NPM_LOG:?}"
+[[ "${1:-}" == ci ]] || exit 64
+exit 1
+EOF
+chmod +x "$fixture_root/bin/npm"
+stage_status=0
+stage_output="$(PATH="$fixture_root/bin:$PATH" PANAMA_PATH="$fixture_root" \
+    VICINAE_DATA_DIR="$fixture_root/vicinae-data" NPM_LOG="$fixture_root/npm.log" \
+    bash "$stage" 2>&1)" || stage_status=$?
+[[ "$stage_status" -eq 0 ]] \
+    || note "the Vicinae stage returned $stage_status for a lockfile mismatch instead of remaining nonfatal"
+[[ "$(<"$fixture_root/npm.log")" == 'ci --silent' ]] \
+    || note 'the Vicinae extension dependency command was not npm ci --silent'
+[[ "$stage_output" == *'Vicinae extension panama-search did not build; skipping'* ]] \
+    || note 'a nonzero Vicinae extension dependency install did not fail the extension build'
+cmp -s -- "$lock_before" "$lockfile" \
+    || note 'a rejected Vicinae lockfile mismatch changed package-lock.json'
+
 # ── Report ───────────────────────────────────────────────────────────────────
 
 if (( ${#findings[@]} > 0 )); then

tests/setup/package-provenance-contract

@@ -128,6 +128,19 @@ if (( ${#unsafe_installers[@]} > 0 )); then
     fail 'replace each finding with a reviewed, verified installation path'
 fi
 
+# Re-running install-packages must be keyed to every reviewed trust input it
+# consumes. The update-command fixture proves each input changes the digest;
+# this public-boundary guard keeps any of those inputs from being silently
+# removed from the installer state definition.
+for state_input in \
+    'setup/packages' \
+    'setup/scripts/install-packages' \
+    'setup/lib/artifact-provenance' \
+    'setup/provenance'; do
+    grep -Fq "$state_input" "$repo_dir/install" \
+        || fail "packages hash does not name required state input: $state_input"
+done
+
 # This must be the only production file sourced by the contract.
 # shellcheck source=../../setup/lib/artifact-provenance
 source "$repo_dir/setup/lib/artifact-provenance"

tests/setup/update-command-contract

@@ -46,11 +46,15 @@ build_fixture() {
     local root="$1" packages_rc="${2:-0}" trust_rc="${3:-0}"
     rm -rf "$root"
     mkdir -p "$root/bin" "$root/setup/scripts" "$root/setup/packages" \
+             "$root/setup/lib" "$root/setup/provenance/keys" \
              "$root/config/dot/quickshell/scripts"
 
     cp "$installer" "$root/install"
     : >"$root/bin/ascii"
-    printf 'base-package\n' >"$root/setup/packages/base"
+    printf 'base-package\n' >"$root/setup/packages/core-packages"
+    printf 'artifact provenance\n' >"$root/setup/lib/artifact-provenance"
+    printf 'reviewed installer inputs\n' >"$root/setup/provenance/installers.conf"
+    printf 'reviewed key\n' >"$root/setup/provenance/keys/fixture.asc"
 
     local stage
     for stage in "${STAGE_NAMES[@]}"; do
@@ -210,7 +214,7 @@ grep -qx 'install-packages' <<<"$ran_forced" \
     || note '--packages did not force install-packages to run'
 
 # A changed list brings the stage back.
-printf 'another-package\n' >>"$tmp/a/setup/packages/base"
+printf 'another-package\n' >>"$tmp/a/setup/packages/core-packages"
 install_status=0
 ran_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
 [[ "$install_status" -eq 0 ]] \
@@ -218,6 +222,24 @@ ran_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
 grep -qx 'install-packages' <<<"$ran_changed" \
     || note 'a changed package list did not bring install-packages back'
 
+# The package stage consumes more than package lists. Each reviewed input must
+# independently invalidate a recorded package state so an upgrade cannot keep
+# using a stale trust or installer policy.
+for state_input in \
+    'setup/scripts/install-packages installer adapter' \
+    'setup/lib/artifact-provenance provenance helper' \
+    'setup/provenance/installers.conf installer provenance' \
+    'setup/provenance/keys/fixture.asc provenance key'; do
+    read -r relative label <<<"$state_input"
+    printf 'changed %s\n' "$label" >>"$tmp/a/$relative"
+    install_status=0
+    ran_input_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
+    [[ "$install_status" -eq 0 ]] \
+        || note "install --upgrade failed after a $label change with status $install_status"
+    grep -qx 'install-packages' <<<"$ran_input_changed" \
+        || note "a changed $label did not bring install-packages back"
+done
+
 # A failing stage must not record the hash, or the failure is hidden forever.
 build_fixture "$tmp/c" 1
 install_status=0