[Pepps233]

Summary

Complete local npm distribution lifecycle validation and prepare the private hosted runtime for controlled candidate testing.

The companion cloud handoff is https://github.com/diffexai/diffex-cloud/pull/162.

Reasoning

Source updater tests did not prove real installed package-manager updates, and broad documentation copies could disclose future internal notes.

The owner confirmed npm-only distribution and that no staging deployment or Daytona consumer is configured.

Local runtime acceptance therefore uses the actual server process with mocked provider boundaries and external networking disabled.

GHCR publication, OCI attestations, real Daytona acceptance, promotion, and rollback remain pending configuration and their documented gates.

Changes

• Add canonical install, PATH, pinned upgrade, legacy migration, interrupted-install recovery, uninstall, and user-data retention guidance.
• Use an explicit user-documentation allowlist in npm, bootstrap, deferred archive staging, and runtime staging, with final-payload rejection tests.
• Exercise real npm and Bun global install/update/remove processes against the reviewed candidate, including invalid discovery, npm integrity failure, and interrupted-download repair.
• Build the Linux amd64 runtime from compiled workspace outputs and required notices; inspect every image layer and test startup, credential denial, prompt/reply, persistence, usage, and shutdown.
• Enable manual private runtime validation and evidence retention without registry publication.
• Remove separate project NOTICE generation and production copies; preserve consolidated attribution and reject reintroduced copies in tarballs and runtime layers.

Testing

• npm run check and ./test.sh passed.
• Focused packaging, runtime-layer, and recovery regression tests passed (35 tests).
• Complete local artifact acceptance passed on Darwin arm64 with Node 22.19.0, npm 10.9.3, and Bun 1.3.11, including installed terminal prompt/reply and lifecycle cleanup.
• Local Linux amd64 Docker build, runtime smoke with --network none, and every-layer inspection passed: 12 runtime workspaces and 30 approved documentation assets.
• Workflow actionlint and the shared cloud release-contract check passed.

The baseline CLI regression workflow passed.
The native artifact workflow passed on all four platforms using PR merge candidate 255001392a1fd131fb95b82d0f709323ed4b673d.
Every runner accepted the same tarball, SHA-256 e4bff793cbe21e570596a552816ab465e15aee4bbc660b33aa332c664cdc8c1f, and recorded successful cleanup.
macOS x64 reproduced npm's partial-dependency cleanup failure and passed the documented move-aside and pinned reinstall recovery.
The Runtime Image workflow passed on lifecycle commit 3e1a87fe4ff1769408a5927e8a2056f124175cc0 and retained the tested Docker image, smoke result, layer inspection, and checksums privately.
Public-to-public upgrades and real hosted inference are not established by controlled fixtures.

The NOTICE exclusion passed npm run check and all 34 packaging and runtime-layer regressions after reproducing four failing artifact-boundary assertions.
The updated runtime validation passed on commit 59045f4a8e192c8db7d393386d3ab82d28b03e59, including the rebuilt image smoke and every-layer rejection of separate project NOTICE files.
The updated native artifact acceptance checks the NOTICE-free npm candidate.