jochen 6f7d06726c gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624) ...

The forge writes every tarball at its public name and the lab reaches it at
a private address, so npm 12 refused every locked @novox package. The public
name now comes from the mesh's own composition of the forge's route, through
the lab's binding, and the lab compares scheme, host and port.

2026-10-13 20:33:02 +02:00

..

test

gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624)

2026-10-13 20:33:02 +02:00

tools

gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624)

2026-10-13 20:33:02 +02:00

module.json

lab: name the bound credential in the tools bundle's env, and skip the locked-tree test as root (hq issue 624, reviews 198, 199)

2026-10-13 14:51:18 +02:00

package.json

Install each lab checkout where its lock file is, check out mesh-tools-go, and have lab_check catch both (hq issue 624)

2026-10-13 11:55:01 +02:00

tsconfig.json

lab: the lab as a module, running beds when the mesh asks

2026-10-02 14:15:42 +02:00