From 175d341e604fcb4f9f6f3f5ab200cc2e8cd2cb32 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <adambrettmalin@protonmail.com>
Date: Sun, 27 Sep 2026 18:16:52 -0400
Subject: [PATCH] Qualify standalone package artifact

---
 ...grity-note-2026-09-27-portable-kernel.yaml |  4 ++
 test/fleet/package-distribution.test.mjs      | 56 +++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 test/fleet/package-distribution.test.mjs

diff --git a/reports/test-audit/test-integrity-note-2026-09-27-portable-kernel.yaml b/reports/test-audit/test-integrity-note-2026-09-27-portable-kernel.yaml
index 5d6c3de..364e58c 100644
--- a/reports/test-audit/test-integrity-note-2026-09-27-portable-kernel.yaml
+++ b/reports/test-audit/test-integrity-note-2026-09-27-portable-kernel.yaml
@@ -170,6 +170,10 @@ test_integrity_note:
       given: a persistent specialist whose recurring work no longer justifies its coordination cost
       when: the Session Manager proposes retirement and the owner approves it
       then: live, dirty, guarded, leased, uniquely committed, or actively assigned work blocks retirement; safe activation removes the worktree and identity while preserving its branch and durable decision
+    - id: SCN-package-distribution
+      given: a clean TORCH source checkout and an isolated package consumer
+      when: npm builds and installs the published artifact without registry access
+      then: the packaged CLI runs outside the source checkout and performs read-only repository discovery
     - id: SCN-cli-fleet-evolution
       given: an installed Fleet and a file-backed proposed domain
       when: the manager proposes it and the owner separately approves, plans, and activates it through the public CLI
diff --git a/test/fleet/package-distribution.test.mjs b/test/fleet/package-distribution.test.mjs
new file mode 100644
index 0000000..70bc965
--- /dev/null
+++ b/test/fleet/package-distribution.test.mjs
@@ -0,0 +1,56 @@
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+
+const ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+
+test('SCN-package-distribution: the npm artifact installs offline and runs outside the source checkout', () => {
+  const temporary = mkdtempSync(join(tmpdir(), 'torch-package-distribution-'));
+  try {
+    execFileSync('npm', ['pack', '--pack-destination', temporary], {
+      cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const artifacts = readdirSync(temporary).filter((name) => name.endsWith('.tgz'));
+    assert.equal(artifacts.length, 1);
+    const artifact = join(temporary, artifacts[0]);
+    const packagedPaths = execFileSync('tar', ['-tzf', artifact], { encoding: 'utf8' })
+      .trim().split('\n').map((path) => path.replace(/^package\//, ''));
+    assert.equal(packagedPaths.includes('bin/torch.mjs'), true);
+    assert.equal(packagedPaths.includes('src/cli.mjs'), true);
+    assert.equal(packagedPaths.includes('docs/PORTABLE_AGENT_FLEET_SPEC.md'), true);
+    assert.equal(packagedPaths.some((path) => path.startsWith('test/')), false);
+    assert.equal(packagedPaths.some((path) => path.startsWith('reports/')), false);
+
+    const installRoot = join(temporary, 'consumer');
+    mkdirSync(installRoot);
+    writeFileSync(join(installRoot, 'package.json'), '{"name":"torch-package-consumer","private":true}\n');
+    const installed = spawnSync('npm', [
+      'install', '--offline', '--ignore-scripts', '--no-audit', '--no-fund', artifact,
+    ], { cwd: installRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    assert.equal(installed.status, 0, installed.stderr || installed.stdout);
+
+    const binary = join(installRoot, 'node_modules', '.bin', 'torch');
+    const help = execFileSync(binary, ['--help'], { cwd: installRoot, encoding: 'utf8' });
+    assert.match(help, /TORCH — portable agent fleet/);
+
+    const project = join(temporary, 'project');
+    mkdirSync(project);
+    execFileSync('git', ['init', '-b', 'main', project]);
+    writeFileSync(join(project, 'README.md'), '# Package fixture\n');
+    execFileSync('git', ['-C', project, 'add', 'README.md']);
+    execFileSync('git', ['-C', project, '-c', 'user.name=TORCH Test', '-c', 'user.email=torch@example.invalid', 'commit', '-m', 'fixture']);
+    const initialized = JSON.parse(execFileSync(binary, ['init', '--repo', project, '--json'], {
+      cwd: installRoot, encoding: 'utf8', env: { ...process.env, NODE_NO_WARNINGS: '1' },
+    }));
+    assert.equal(initialized.repository.root, project);
+    assert.equal(initialized.analysis.mutationPerformed, false);
+    assert.equal(readFileSync(join(project, 'README.md'), 'utf8'), '# Package fixture\n');
+    assert.equal(execFileSync('git', ['-C', project, 'status', '--porcelain'], { encoding: 'utf8' }), '');
+  } finally {
+    rmSync(temporary, { recursive: true, force: true });
+  }
+});