Repository navigation
Track #136 remediation and #144 testing-runtime ripple across all 50 Quirk repositories #54
Description
Quirk-wide dependency ripple ledger — 2026-10-14
Source: project-scaffold #136, #144, canonical audit #91, separate runtime decision #87.
Disposition: #136 is merged and its Tinypool remediation stands. #144 at 40b29d74405bbdf4a9448323869933e8583e5932 is deferred / changes requested. No fleet version rollout or merges.
Hosted unit CI fails, build/E2E skipped, Evidence Binding fails on uncovered manifest and lockfile. Fresh local Node 24.19.0 / Bun 1.4.3 frozen install, 252 unit tests, coverage, lint/types and audits support the candidate on that runtime only. Vitest 5 requires ^22.12 || ^24 || >=26; jsdom 30.1.2 requires ^22.22.2 || ^24.15 || >=26; jest-dom 7 requires >=22. Node 20 CI cannot admit this testing lane. Production audit is empty, full audit retains braces and esbuild only; no Tinypool in candidate lockfile/installed graph. Security result is scoped to scaffold; it does not certify other repositories.
Portfolio coverage
All 50 repositories exposed by the Quirk-Systems installation were inventoried: 21 nonempty trees (not truncated), 29 GitHub-reported empty Git repositories; 12 package manifests across 7 repos inspected. Six repos directly use the testing lane. Five downstream lockfiles and testing CI configurations were read at the listed immutable heads. No downstream installed-graph, full audit, test or hosted-success claim is made.
Reuse rules
- Inherit the verified #136 baseline when compatible; do not propagate #144's majors as an approved template.
- Check package engines AND peer intersections against each repo's declared floor and actual Node process. Bun invocation does not prove Bun execution.
- Keep Vitest and coverage provider paired, Vite override compatible, jest-dom /vitest setup and required DOM peer present, coverage include explicit.
- Frozen install must leave lockfile unchanged; verify installed graph, full and prod audit, Tinypool absence.
- Require exact-base/head evidence for every downstream change; no inherited success receipts.
- Browser upgrades require fresh matching binaries, production server, isolated test state and actual E2E execution. Test discovery is not an E2E pass.
- Separate runtime contracts, residual advisories and optional feature exploration from dependency remediation.
- Playwright 1.64 WebMCP/video capabilities are possible future test improvements, not enabled or authorized system behavior.
Immutable inspection ledger
| Repository | Inspected head | Observed surface | Declared Node | Disposition |
|---|---|---|---|---|
| project-scaffold | 1e04dfc91941905fff7312403bf0817eb2768c0f | Manifest inspected | >=20.0.0 | Defer PR #144; retain verified #136 baseline; runtime decision #87. |
| quirk-generator | 8b5d979e3c4cb42f076d2bf5836267e290bf873f | Manifest inspected | >=20.0.0 | Retain paired 4.1.11 baseline; prevent unreviewed testing majors; declared >=20 vs CI 22 needs its own contract review. |
| .github | eb889ad | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-feed | a338ea3e0158437167cd875bb4655b67c3b9dc68 | Manifest inspected | >=24.21.0 <25 | Already on Vitest 5/jsdom 30 lane; retain own >=24.21 <25 runtime. Refresh locally bound audits and tests before copying any newer targets. |
| .github-private | fe3ec1c978ee748d90c5645467eff3261af7b0c3 | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-beauty | b46ae13da7bf051e2c8041f81c2f5fdae54aa5a5 | Manifest inspected | >=22.0.0 | Locked Vitest 5.0.3/jsdom 30.1.2; declared >=22 admits unsupported patches and odd Node majors; align its own contract with supported intersections. |
| quirk-pet | 587430b8d57161a3eb1d870094f7ef34b9d93571 | Manifest inspected | ^22.22.2 || ^24.15.0 || >=26.0.0 | Paired 5.0.3/jsdom 30.1.1; runtime ^22.22.2 || ^24.15 || >=26 and CI 22.22.2 already align with the observed newer lane. Preserve E2E isolation changes; verify any new patch independently. |
| quirk-town | 16bea366061b16f3a39809607fc9a270160abcf8 | Manifest inspected | >=22.0.0 | Locked Vitest 5.0.3/jsdom 30.1.2; declared >=22 admits unsupported patches and odd Node majors; align its own contract with supported intersections. |
| Quirk | aab729221fcc5b32bf1f6abd9c05e8460ca91a66 | Manifest inspected | >=18.13.0 | Six manifests inspected; none directly use these testing packages. Native Node test lane; no dependency migration indicated. |
| quirk-data | 0c395daaad5d83855cf90275925769cb295434b5 | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-os | 03f70e1a790bac09294fe0f31a3c5f0d0fb4418e | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-me | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-run | 8c1097b8ac16de4a5a52996cd65e241810ef3e6f | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-core | b3162b0cd6dcc6c07570f240ca33c711ed860f0b | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-dog | 84d228a4de0ee1138ea69170a2f39a879e089964 | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-music | 3f5339efdd7b720d126575b9926c204a1a68d817 | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-preference | bcc22aea2edb15ed17adca4730b9394250b72f09 | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-art | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-city | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-style | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-fitness | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-feedback | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-press | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-work | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-intelligence | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-skills | 8fbe2e9553ff140a783eaf8bbd7d97d64ec6c47c | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-code | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-bio | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-health | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-home | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-prompt | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-ops | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-agents | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-lab | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-memory | de6c0e71d8cb0fbfee1e14daf007086e30afd882 | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-merchant | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-arcade | 0dadb82bca57d218492cf708a9e3c762d946bacf | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-house | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-club | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-flirt | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-money | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-format | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-hygiene | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-design | 7cff24ed918629dbc5b5e91cbe6623844cc08383 | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
| quirk-local | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-directory | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-arena | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-word | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| quirk-market | — | Empty Git repository | — | Apply reviewed scaffold baseline at first implementation; no current package update. |
| greenfield | 6e6d4b425fe9082d469493d64a5b8e12b15dc9da | No package.json in full tree | — | No direct JS testing-package migration indicated by this tree scan; re-evaluate on adoption. |
Completion conditions for affected repositories
Each downstream owner/change must retain its own runtime decision, frozen-lock evidence, engine/peer check, unit/coverage/build/E2E evidence, audit findings and exact commit binding. Record links here as follow-ups are completed. Empty and non-JS repos remain explicitly covered without manufacturing package changes.
This ledger is evidence and follow-up guidance, not a fleet security certification or runtime admission.
Persisted downstream follow-ups
- quirk-generator: Verify testing-runtime ripple from scaffold #136 / deferred #144 quirk-generator#21
- quirk-feed: Verify testing-runtime ripple from scaffold #136 / deferred #144 quirk-feed#35
- quirk-beauty: https://github.com/Quirk-Systems/quirk-beauty/issues/46
- quirk-pet: https://github.com/Quirk-Systems/quirk-pet/issues/58
- quirk-town: https://github.com/Quirk-Systems/quirk-town/issues/48
Local scaffold production build also passed on Node 24.19.0. It does not establish E2E execution or Node-20 support.
Activity
bryansayler commentedon Oct 15, 2026
Beauty / Town runtime follow-up — 2026-10-15
Separate focused draft candidates now exist; neither is merged or deployed:
Each changes only package.json engines to
^22.22.2 || ^24.15.0and CI to Node 24.19.0, frozen install and coverage. No dependencies, lockfiles, action/Bun pins or scaffold #144 upgrades changed. Pet was comparison only; its >=26 allowance was not inherited.Actual installed engine reads confirm Vitest 5.0.3 requires ^22.12 || ^24 || >=26 and jsdom 30.1.2 requires ^22.22.2 || ^24.15 || >=26. Beauty's locked Vite is 8.2.2; Town's is 8.3.2. Installed Node-engine metadata scans (328 Beauty / 323 Town declarations) reject none of 22.22.2, 24.15.0 or 24.19.0; relevant Vite/plugin/Vitest/coverage peers align. This establishes metadata compatibility, not execution across the range.
Local Node 24.19.0 / Bun 1.3.11: unit (Beauty 10, Town 6), coverage, lint (two existing warnings each), type-check and production builds pass. Measured line coverage: Beauty 100%, Town 89.47%. All reconstructed base blobs except the intended manifest match exact base blob hashes. Lockfile hashes remain unchanged; no Tinypool lock entry or installed top-level package.
Limits remain explicit: subsequent no-change frozen installs exit 0, but forced native reinstalls fail because node-gyp header extraction hits this container's fchown restriction. Clean native install remains unproved. E2E attempts use separate temp DBs, CI mode and serial production servers, but stop before assertions on uv_interface_addresses container failure. Matching browser installation also fails (apt permission / invalid download ZIP). Hosted Beauty run and Town run report startup_failure with zero jobs, no diagnostic check-runs; these are unavailable hosted execution, not failing test assertions. Node 22/minimum-patch execution remains unverified.
Audit findings persist: Beauty full 10 (7 high / 3 moderate), production 1 high source-map-js; Town full 2 (1 high / 1 moderate), production none reported. These are repository-specific observed audit reports, not inherited scaffold results or a fleet certification.
Keep #46/#48 open and both PRs draft pending clean install, actual E2E, hosted validation and review. No new tracking issues, merges or deployments.
bryansayler commentedon Oct 16, 2026
Merge follow-up after Bryan's conditional authorization: Beauty PR #47 is now at
7e3775be6b91041efad2706f3c0a41f8714dc4c3; Town PR #49 at88ca5760c0d47370f130422b6939a62254968949. Each adds a Node 22.22.2 / 24.19.0 validation matrix and runtime logging, without changing dependencies or lockfiles. Additional local Node 22.22.2 unit, coverage, lint, type-check and production builds pass for both source payloads; installed/report-state coverage failures were diagnosed and cleared without repository dependency edits. Detailed chronology is in existing Beauty #46 / Town #48. New hosted runs 38850191096 / 38850191565 fail at startup with zero jobs; retries of earlier startup failures are rejected by GitHub with HTTP 403. Clean native lifecycle install and actual E2E remain unproved, with browser download and container syscall restrictions recorded. Both PRs remain OPEN / UNMERGED, readiness BLOCKED. Merge authorization is recorded, not confused with passing validation. No checks bypassed or deployments performed.