feat(vex): manifest-less VEX from hosted/vendored lockfiles + npm 12 allow-remote auto-config (v5) - #251

Merged

Mikola Lysenko (mikolalysenko) merged 9 commits into

mainfrom

feat/vex-lockfile-inventory

Sep 24, 2026

Commits on Sep 24, 2026

fix(core): hosted/vendored rewriter fixes found by the real-PM matrices

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
e31da36
feat(hosted): auto-configure npm 12 allow-remote in the project .npmrc

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
60ddaf8
refactor(core/vendor): split lock_inventory into per-format submodules

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
56d791f
feat(core/vex): discover hosted and vendored patch references from lockfiles

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
52e71ee
feat(vex): manifest-less VEX — attest hosted and vendored patches from lockfiles
Mikola Lysenko (mikolalysenko)
committed
4868030
test(cli): manifest-less VEX suites, real-PM capstones and shared helpers
Mikola Lysenko (mikolalysenko)
committed
4f595bc
ci: run the manifest-less VEX real-PM matrices and backtest steps
Mikola Lysenko (mikolalysenko)
committed
75c80e8
docs: manifest-less VEX, npm 12 allow-remote and the v5 changelog
Mikola Lysenko (mikolalysenko)
committed
780d76e
test(vex): golden snapshot of discovery over committed fixtures

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
78a9f55