security: remove tracked Packrat build artifacts

.github/workflows/code-quality.yml

@@ -22,15 +22,44 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
-      - name: Lint workflow YAML
+      - name: Verify Packrat source-only boundary
+        shell: bash
         run: |
-          python3 -m pip install --user yamllint
-          python3 -m yamllint .yamllint.yml .github/dependabot.yml .github/workflows/*.yml
+          set -euo pipefail
+
+          test -f packrat/packrat.lock
+          test -f packrat/init.R
+          test -d packrat/src/packrat
+
+          tracked_generated="$({
+            git ls-files \
+              'packrat/lib/**' \
+              'packrat/lib-R/**' \
+              'packrat/lib-ext/**'
+          } || true)"
+          if [[ -n "$tracked_generated" ]]; then
+            printf '%s\n' \
+              'Generated Packrat installation artifacts must not be tracked:' \
+              "$tracked_generated" >&2
+            exit 1
+          fi
+
+      - name: Lint workflow YAML
+        uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c
+        with:
+          file_or_dir: .yamllint.yml .github/dependabot.yml .github/workflows/*.yml
 
       - name: Lint markdown docs
-        run: |
-          npm install -g markdownlint-cli2@0.18.1
-          markdownlint-cli2 README.md AGENTS.md ARCHITECTURE.md CLAUDE.md CONTRIBUTING.md .github/**/*.md docs/**/*.md
+        uses: DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe
+        with:
+          globs: |
+            README.md
+            AGENTS.md
+            ARCHITECTURE.md
+            CLAUDE.md
+            CONTRIBUTING.md
+            .github/**/*.md
+            docs/**/*.md
 
       - name: Lint GitHub workflows
         run: |

.gitignore

@@ -16,3 +16,8 @@ task_agent_mapping.json
 
 # local package build artifacts
 aFIPC_*.tar.gz
+
+# generated packrat libraries (restore from packrat/packrat.lock + packrat/src)
+packrat/lib/
+packrat/lib-R/
+packrat/lib-ext/

AGENTS.md

@@ -63,17 +63,17 @@ Applies to every agent (Claude, Codex, Cursor, opencode, ...) working in this re
   fixable only). It runs against each PR base, **including stacked PRs**.
 - A failing `trivy-fs` is a **REAL finding, not a flake.** Read the job log (it
   prints each finding's rule id, severity, and file) or the run's SARIF results,
-  then **remediate**: bump the offending R dependency (this package vendors its
-  library tree under `packrat/`), or, only for a genuine false positive, add a
+  then **remediate**: bump the offending tracked dependency source under
+  `packrat/src`, or, only for a genuine false positive, add a
   narrow, path-scoped, commented entry to `.trivyignore.yaml`. Never weaken or
   disable the gate. This repo has no Dockerfile or k8s manifests, so misconfig
   findings are not expected; a hit here is a dependency or secret finding.
-- The vendored packrat openssl docs include a verified false-positive example
-  key at `packrat/lib/x86_64-pc-linux-gnu/3.4.1/openssl/doc/keys.html`; keep
-  its `private-key` suppression path-scoped in `.trivyignore.yaml` and do not
-  blanket-ignore the rule.
+- Generated `packrat/lib`, `packrat/lib-R`, and `packrat/lib-ext` trees are
+  ignored and must never be committed; `packrat/init.R` restores them from the
+  tracked lock file and source cache.
 - A local `trivy` scan with a stale DB misses findings: run
-  `trivy --download-db-only` first, and scan the **merge ref**, not just the PR head.
+  `trivy --download-db-only` first, and scan the **merge ref**, not just the PR
+  head.
 - The org `code_scanning` ruleset is intentionally **CodeQL-only** (multiple
   code-scanning tools cannot converge on one PR ref). Gating is by the Security
   Scan **job result**, not the `code_scanning` rule; do not add tools to that rule.

ARCHITECTURE.md

@@ -12,7 +12,8 @@ metadata and CI are wired, and which parts are safe to evolve.
 - `DESCRIPTION` - Package metadata (name, version, imports, license)
 - `NAMESPACE` - Export map for package functions
 - `man/` - Generated R documentation (`.Rd` files)
-- `packrat/` - Historical dependency lock/vendor directory
+- `packrat/` - Historical dependency lock and source cache. The installed
+  `packrat/lib` tree is generated locally, ignored, and never committed.
 - `.github/workflows/` - CI + security automation
 - `.github/SECURITY.md` - Vulnerability reporting policy
 - `.github/PULL_REQUEST_TEMPLATE.md` - PR review checklist template

CLAUDE.md

@@ -74,7 +74,8 @@ See `ARCHITECTURE.md` for the full map. Essentials:
   imports `mirt` and `methods` (`DESCRIPTION`).
 - `man/` — generated `.Rd` docs for the exported functions.
 - `tests/testthat/` — testthat suite, driven by `tests/testthat.R`.
-- `packrat/` — historical vendored dependency tree; opt-in only.
+- `packrat/` — historical dependency lock and source cache; opt-in only. The
+  generated `packrat/lib` installation tree is ignored and never committed.
 - `.github/workflows/` — `r.yml` (R CMD check), `code-quality.yml`
   (yamllint + markdownlint + actionlint), `security-audit.yml` (gitleaks +
   actionlint). All action refs are pinned to full commit SHAs.
@@ -108,9 +109,9 @@ Summarized from `AGENTS.md` and `CONTRIBUTING.md`; read those for detail.
   `confirmCommonItems = TRUE` in non-interactive contexts (the tests assert
   that implicit approval fails).
 - A failing `trivy-fs` in the Security Scan gate is a real finding, not a
-  flake: bump the offending vendored dependency under `packrat/`, or add a
-  narrow, path-scoped, commented entry to `.trivyignore.yaml`. Never weaken
-  the gate. (`trivy.yaml` skips `packrat/lib` for local scans.)
+  flake: bump the offending tracked dependency source under `packrat/src`, or
+  add a narrow, path-scoped, commented entry to `.trivyignore.yaml`. Never
+  weaken the gate. Generated `packrat/lib` content must remain untracked.
 - New copyleft dependencies (GPL/AGPL/LGPL) are not accepted; never commit
   secrets.
 - Use the PR template (`.github/PULL_REQUEST_TEMPLATE.md`): include risk

README.md

@@ -11,15 +11,17 @@ preserve numerical behavior while modernizing repository operations
 
 - `R/aFIPC.R`: core `autoFIPC()` implementation
 - `DESCRIPTION`, `NAMESPACE`, `man/`: package metadata and generated docs
-- `packrat/`: historical dependency lock/vendor directory
+- `packrat/`: historical dependency lock and source cache; restored libraries
+  are generated locally and not tracked
 - `.github/workflows/`: CI/security automation
 
 ## Development status
 
 - Algorithmic core is legacy but trusted for historical outputs.
 - Operational guardrails are now maintained via GitHub Actions and Dependabot.
 - Legacy `packrat` bootstrap is opt-in via `AFIPC_ENABLE_PACKRAT=true`.
-- Broken host-specific `packrat/lib-R` symlinks were removed for portable builds.
+- `packrat/init.R` can rebuild the ignored `packrat/lib` tree from the tracked
+  lock file and source cache; host-specific installed binaries are not committed.
 - Architectural and agent operation docs are available in:
   - `ARCHITECTURE.md`
   - `AGENTS.md`