Stop downloading vlt artifacts during hosted scans

.github/workflows/ci.yml

@@ -2919,8 +2919,7 @@ jobs:
               --ignored --nocapture --test-threads=4 2>&1 | tee hosted-e2e.log || status=$?
             echo "::endgroup::"
             if [ "$status" -eq 0 ]; then
-              # The vlt leg (probe-driven: the clean refusal while the artifact
-              # is content-encoded, the full install proof once it is not).
+              # The vlt leg: the hosted pin and the fresh-checkout install proof.
               python3 scripts/check-vlt-legs.py \
                 --manifest crates/socket-patch-cli/tests/vlt-leg-manifest.json hosted-e2e.log
               exit $?

.github/workflows/vlt-compatibility.yml

@@ -466,10 +466,10 @@ jobs:
         # minutes (EAI_NONAME) while the service is up; see the action.
         uses: ./.github/actions/pin-socket-hosts
       - name: Backtest against production
-        # Every hosted cell probes the artifact first; it records
-        # blocked-by-server-encoding only when that probe saw a non-identity
-        # Content-Encoding and the CLI refused cleanly. Any other failure is an
-        # error.
+        # Every hosted cell probes the artifact first; a must-patch cell
+        # records blocked-by-server-encoding (without running the CLI) only
+        # when that probe saw a non-identity Content-Encoding. Any other
+        # failure is an error.
         shell: bash
         env:
           VLT_TEST_VERSION: ${{ matrix.vlt }}

.github/workflows/vlt-serve-watchdog.yml

@@ -3,8 +3,8 @@ name: vlt serve watchdog
 # vlt hashes the wire body of a registry tarball and asks for
 # `accept-encoding: gzip;q=1.0, identity;q=0.5`, so a patch artifact that
 # patch.socket.dev (or its CDN) serves content-encoded fails `EINTEGRITY` on
-# every vlt release, and hosted mode refuses to pin it
-# (`redirect_vlt_artifact_unverifiable`). This job fetches the public free
+# every vlt release (hosted mode pins it without downloading it, relying on
+# the server's `Cache-Control: no-transform`). This job fetches the public free
 # minimist artifact exactly that way and fails when the response is
 # content-encoded or its sha512 differs from the API's integrity, which pages
 # through the repository's workflow-failure notification.

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -870,23 +870,6 @@ async fn run_redirect_selected_untracked(
         );
     }
 
-    // vlt artifact preflight: before any takeover or rewrite (dry runs
-    // included), each in-scope artifact is fetched as vlt fetches it. A
-    // failure while vlt drives withholds the dep from every rewriter;
-    // otherwise only from the vlt rewrite.
-    let vlt_preflight = {
-        let deps: Vec<(&str, &DepOverride)> = candidates
-            .iter()
-            .filter(|c| c.dep.ecosystem == "npm")
-            .map(|c| (c.purl.as_str(), &c.dep))
-            .collect();
-        vlt::artifact_preflight(common, api_client, &deps).await
-    };
-    engine::withhold_everywhere(
-        &mut candidates,
-        &vlt_preflight.withheld_everywhere,
-        &mut skipped,
-    );
     // A NEW row the lockfiles already pin on the patch server these
     // references name (not a configured one, so the recorded view's
     // discovery could not see it) is ALREADY: decided here, before the lock
@@ -1257,20 +1240,12 @@ async fn run_redirect_selected_untracked(
         .then(|| (read.clone(), python_metadata.clone()));
     // A retracted takeover rewrites again without it (see below).
     let takeover_metadata = takeover.is_staged().then(|| python_metadata.clone());
-    let mut done = engine::rewrite(
-        &view,
-        read,
-        &candidates,
-        python_metadata,
-        &vlt_preflight.withheld_from_vlt,
-        rewrite_options(),
-    )
-    .await;
+    let mut done =
+        engine::rewrite(&view, read, &candidates, python_metadata, rewrite_options()).await;
 
     // The rollout gate (§5.2): every write-free check has run — grants,
-    // purl/url, vlt preflight, takeover refusals, wheel metadata, and the
-    // rewrite above, whose confirmation probe proves a NEW row would be
-    // pinned. Only then is the budget spent; deferred rows leave the
+    // purl/url, takeover refusals, wheel metadata, and the rewrite above,
+    // whose confirmation probe proves a NEW row would be pinned. Only then is the budget spent; deferred rows leave the
     // rewrite set, which is rewritten again without them.
     if let (Some(gate), Some((read, python_metadata))) = (rollout.as_mut(), second_pass) {
         let eligible: std::collections::HashSet<(String, String)> = done
@@ -1290,15 +1265,8 @@ async fn run_redirect_selected_untracked(
         let before = candidates.len();
         candidates.retain(|c| !deferred.contains(&(sel_purl(c), c.dep.patch_uuid.clone())));
         if candidates.len() != before {
-            done = engine::rewrite(
-                &view,
-                read,
-                &candidates,
-                python_metadata,
-                &vlt_preflight.withheld_from_vlt,
-                rewrite_options(),
-            )
-            .await;
+            done =
+                engine::rewrite(&view, read, &candidates, python_metadata, rewrite_options()).await;
         }
     }
     // A staged takeover the rewrite did not pin must not happen: undo every
@@ -1330,7 +1298,6 @@ async fn run_redirect_selected_untracked(
             read,
             &candidates,
             takeover_metadata.clone().unwrap_or_default(),
-            &vlt_preflight.withheld_from_vlt,
             rewrite_options(),
         )
         .await;
@@ -1553,7 +1520,6 @@ async fn run_redirect_selected_untracked(
                     .get(lock_key)
                     .or_else(|| done.files.get(lock_key))
                     .map(String::as_str),
-                preflight: &vlt_preflight,
                 records: &records,
                 confirmed: &confirmed,
                 confirmed_vlt: &rewrite.confirmed_vlt_uuids,
@@ -1729,7 +1695,6 @@ async fn run_redirect_selected_untracked(
     // rewriter's own warnings first (e.g. `no package-lock.json`), then the
     // record, package-manager, stale-install, takeover and prune warnings.
     let mut engine_warnings = rewrite.warnings.clone();
-    engine_warnings.extend(vlt_preflight.warnings.iter().cloned());
     engine_warnings.extend(record_warnings);
     engine_warnings.extend(done.rush_warnings.iter().cloned());
     engine_warnings.extend(done.pnpm_warnings.iter().cloned());
@@ -2234,9 +2199,6 @@ fn describe_skip_reason(reason: &str) -> String {
              (see the warning)"
                 .into()
         }
-        "redirect_vlt_artifact_unverifiable" => {
-            "vlt could not verify the hosted artifact (see the warning)".into()
-        }
         "redirect_unattributable" => {
             "lockfile discovery could not attribute its pin to one package version, so \
              nothing was written for it (reconcile the project's lockfiles; --json has the \
@@ -3808,10 +3770,6 @@ mod tests {
             describe_skip_reason("redirect_bun_lockb_invalid"),
             describe_skip_reason("redirect_bun_lock_unsupported")
         );
-        assert_eq!(
-            describe_skip_reason("redirect_vlt_artifact_unverifiable"),
-            "vlt could not verify the hosted artifact (see the warning)"
-        );
         assert_eq!(
             describe_skip_reason("redirect_vlt_lock_unsupported"),
             "vlt-lock.json blocks the vendored-to-hosted migration (see the warning)"