[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Summary

A hosted scan of a vlt project no longer downloads every granted patch archive just to hash it. That probe guarded against the patch server's CDN re-gzipping archives, which vlt rejects with EINTEGRITY because it hashes the raw response. The server side of that is fixed: depscan #26856 and #26867 send Cache-Control: no-transform on every archive response and 304, and production serves archives unencoded today. On a third-party mirror that still re-encodes, vlt ci fails closed with EINTEGRITY, so nothing installs unpatched bytes.

This is PR 1 of a stack that moves vendored and hosted logic back into core and drops /patches/view from hosted scans.

User-visible changes

• Hosted scans of vlt projects make no artifact requests: one full download per patched package per run is gone.
• The redirect_vlt_artifact_unverifiable warning and skip reason no longer exist (contract, docs and vlt-coverage.json updated).
• The in-memory hosted engine (Node addon, hosted-bundle) used to judge every vlt dependency "offline" and withhold it, because it has no network. It now pins vlt dependencies the way the disk flow does.
• The warm-tree heal checks the Socket-owned lock instances this run confirmed. With no patch record and no hidden lock it reports the copy as undeterminable and asks for vlt ci, instead of comparing it against downloaded archive bytes; that advisory's wording changed.
• scripts/backtest-vlt.py still probes the live artifact itself and records blocked-by-server-encoding for a cell whose probe sees an encoded response, without running the CLI.

Changes

• Deleted core/patch/redirect/vlt_preflight.rs (probe, ArtifactProbe, VLT_ACCEPT_ENCODING, scope planning).
• core/hosted/vlt.rs keeps only install_state_present and bun_lockb_present. The withheld_everywhere and withheld_from_vlt plumbing is gone from hosted/engine.rs and hosted/memory/stages.rs. rewrite_registry_redirect_withholding_vlt is renamed to rewrite_registry_redirect_with_host, and helpers that only the probe used are removed.
• CLI: scan/hosted.rs and vlt_heal.rs drop artifact_preflight and the heal's artifact-bytes fallback.

Validation

All of these ran locally:

Command	Result
cargo fmt --check	ok
cargo clippy --workspace --all-features -- -D warnings	ok
core --lib	7123 passed
CLI --lib --bins	865 passed
in_process_redirect	135 passed
scan	248 passed
e2e_vex_lockfile	354 passed
hosted_memory_engine	49 passed (a_vlt_project_is_pinned replaces the withholding test)
in_process_vendor_bun_takeover	44 passed
in_process_rollback_hosted	41 passed
in_process_get_modes	23 passed
in_process_get_hosted_ecosystems	10 passed
e2e_hosted_production	62 passed
e2e_vendored_production	61 passed
e2e_redirect_vlt_build	28 passed
scripts/tests	380 passed

Not run locally: the ignored cases that need a real vlt toolchain or the live service, including the rewritten heal test and the production install proof (its "encoded" branch is removed). A manual probe against production served identity with no-transform and a matching sha512. vlt-serve-watchdog.yml stays continue-on-error.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes hosted vlt behavior and removes a safety gate that refused pins when artifacts were content-encoded; misconfigured CDNs would surface as install-time EINTEGRITY instead of scan-time refusal.

Overview
Hosted vlt pinning no longer runs an artifact preflight that downloaded each granted tarball (vlt-style Accept-Encoding, sha512 check) before rewriting vlt-lock.json. The scan pins hosted URLs without any artifact GETs; verification is deferred to vlt ci / install, relying on the patch server serving unencoded archives via Cache-Control: no-transform.

The redirect_vlt_artifact_unverifiable warning/skip path and socket-patch-core vlt_preflight are removed, along with withhold_everywhere / withheld_from_vlt plumbing in the hosted engine and in-memory addon (which previously treated every vlt dep as offline). Warm-tree heal keys off confirmed vlt uuids instead of preflight-downloaded bytes; missing records now yield an undeterminable reinstall advisory rather than byte comparison.

Docs, CLI_CONTRACT, CI comments, production e2e, and tests drop encoding-refusal branches and assert zero artifact hits on hosted scan/get; backtest still records blocked-by-server-encoding at the probe layer when needed.

^{Reviewed by Cursor Bugbot for commit e9d8e31. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review by the burn-down agent.

• Head: e9d8e31293f9937dd3b9d2fe2232466e22394ab9
• CI: 51/51 check runs green (32 success, 19 skipped by path filters)
• Bugbot: reviewed this head, no findings
• Reviewer note: Refuse vendored patches the same way everywhere #2015 and Stop fetching patch views during hosted scans #2021 are stacked on this branch; merge this one first.
• Slack announcement not sent this run (Slack send tool unavailable); next run retries.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. Hosted scans no longer download each vlt artifact before pinning it. That download was a scan-time check for CDN re-encoding, and this PR deletes it along with the redirect_vlt_artifact_unverifiable skip, the withholding paths in the disk and in-memory engines, and the plain_http client. The warm-tree heal now targets the vlt uuids this run confirmed, and when there is no patch record and no hidden lock it reports the copy as undeterminable instead of comparing it to a downloaded tarball.

Risk: medium. The rewriter edits are mechanical, but a fail-closed gate at scan time is gone. If a mirror re-encodes archives, users now find out as EINTEGRITY at vlt ci rather than as a refusal during the scan. That still fails closed, so no unpatched bytes get installed. The in-memory engine goes from withholding every vlt dependency to pinning them.

Look here

• vlt_heal.rs:291: the heal filter changes from preflight.passed to confirmed_vlt. Already-pinned deps still land in confirmed_vlt_uuids (redirect/vlt.rs:621), so re-runs still heal.
• patch/redirect/vlt_heal.rs:314:`` bytes_check returns Unknown when there is no record, and the tarball comparison is removed.
• hosted/engine.rs:1921 and :3438: exempt is now only the takeover uuids, and confirmation uses a single needle group.
• hosted/memory/stages.rs:183: the in-memory engine now pins vlt deps. hosted_memory_engine::a_vlt_project_is_pinned checks this byte for byte.
• scan/hosted.rs:1244: the three rewrite call sites and the heal inputs.

Verified

• Read the full diff (35 files, +267/-2379) against the description.
• No references to the removed symbols remain in code, docs or workflows, and no debug code was left behind.
• The deleted tests covered only behaviour that is now gone. Vendored-to-hosted vlt takeover is still covered.
• The new tests assert zero artifact requests on scan, dry-run scan and get.
• CHANGELOG.md is untouched.
• CI: ci-ok and clippy are green, and Bugbot passed.

Changes I made. None.

Open questions (non-blocking)

• A dry run on a warm tree with no hidden lock now reports "undeterminable", while the wet run (which has the patch record) reports stale. They used to agree. This only shows up when the hidden lock is missing.
• These removals are not in the description: the SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED env var and its guard, and the backtest identity-mirror fallback.
• Nits that could be a follow-up:
  • The comment at hosted.rs:1248 is 120 columns.
  • The comments at socket-patch-bench/src/fixtures/npm.rs:237 and :861 still describe the vlt artifact preflight.
• The rewritten heal e2e and the production install proof are #[ignore] tests that need a real vlt toolchain.

Auto-merge is armed, so approving sends this straight to the merge queue. #2015 and #2021 are stacked on this PR.

---

Generated by Claude Code