fix(core): isolate scan cache boundaries and retain deterministic validation

.github/workflows/agents-ci.yml

@@ -0,0 +1,44 @@
+name: Agents CI
+
+on:
+  pull_request:
+    paths:
+      - "agents/**"
+      - ".github/workflows/agents-ci.yml"
+  push:
+    branches: [main]
+    paths:
+      - "agents/**"
+      - ".github/workflows/agents-ci.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agents-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  functions:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: agents
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22.20.0"
+          cache: npm
+          cache-dependency-path: agents/package-lock.json
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts
+      - name: Build deployable function graph
+        run: npm run gcp-build
+      - name: Test Cloud Function boundary
+        run: npm test -w @llm-shield/functions
+      - name: Audit production dependencies
+        run: npm audit --omit=dev --audit-level=high

.github/workflows/publish.yml

@@ -1,11 +1,11 @@
-name: Publish to NPM
+name: Manual Publish to NPM
 
 on:
-  push:
-    branches:
-      - main
   workflow_dispatch:
 
+# Publishing and production documentation deployment are deliberately manual.
+# Ordinary merges to main must never release packages or deploy production docs.
+
 jobs:
   release:
     name: Release
@@ -27,8 +27,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-          cache: 'npm'
-          registry-url: 'https://registry.npmjs.org'
+          cache: "npm"
+          registry-url: "https://registry.npmjs.org"
 
       - name: Setup Rust
         uses: actions-rs/toolchain@v1
@@ -100,7 +100,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci
@@ -115,7 +115,7 @@ jobs:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
           vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
-          vercel-args: '--prod'
+          vercel-args: "--prod"
           working-directory: docs
 
   notify:

.github/workflows/test.yml

@@ -6,191 +6,165 @@ on:
   pull_request:
     branches: [main, develop]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CORE_DIRECTORY: packages/core
+
 jobs:
+  cache-contract:
+    name: Live Cache Contract and Signed Replay
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 20.19.5
+      - name: Prepare frozen baseline and locked tools
+        run: |
+          git worktree add --detach "$RUNNER_TEMP/shield-cache-baseline" 60bcd3c463228ee8c8ccadc4c7c560502d73e273
+          npm ci --ignore-scripts --prefix packages/core/security/tools
+          for root in "$RUNNER_TEMP/shield-cache-baseline/packages/core" "$GITHUB_WORKSPACE/packages/core"; do
+            (cd "$root" && npm ci --ignore-scripts && npm run build:rollup && npm run build:types)
+          done
+      - name: Execute both revisions, frozen anchors, signed lineage and benchmark
+        working-directory: packages/core
+        run: |
+          mkdir -p cache-evidence
+          node security/evaluate-cache.mjs "$RUNNER_TEMP/shield-cache-baseline/packages/core" "$PWD" "$PWD/security/tools" cache-evidence/cache-flywheel.json
+          node security/benchmark-cache.mjs "$RUNNER_TEMP/shield-cache-baseline/packages/core" "$PWD" cache-evidence/cache-benchmark.json
+      - name: Retain project-only synthetic cache receipts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: shield-cache-contract
+          path: packages/core/cache-evidence/cache-*.json
+          if-no-files-found: error
+          retention-days: 30
+
   test:
-    name: Test on ${{ matrix.os }} with Node ${{ matrix.node }}
+    name: Core on ${{ matrix.os }} with Node ${{ matrix.node }}
     runs-on: ${{ matrix.os }}
-
+    timeout-minutes: 30
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        node: [16, 18, 20]
+        os: [ubuntu-24.04, macos-15, windows-2025]
+        node: [20.19.5, 22.20.0]
         exclude:
-          # Reduce matrix for faster builds
-          - os: macos-latest
-            node: 16
-          - os: windows-latest
-            node: 16
-
+          - os: macos-15
+            node: 22.20.0
+          - os: windows-2025
+            node: 22.20.0
+    defaults:
+      run:
+        working-directory: packages/core
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node }}
-          cache: 'npm'
-
-      - name: Setup Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+          cache: npm
+          cache-dependency-path: packages/core/package-lock.json
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts
 
       - name: Lint
         run: npm run lint
 
       - name: Type check
         run: npm run typecheck
 
-      - name: Build WASM
-        working-directory: packages/core
-        run: |
-          chmod +x scripts/build-wasm.sh
-          ./scripts/build-wasm.sh
-
-      - name: Build package
-        working-directory: packages/core
-        run: npm run build
+      - name: Build independently tested wrapper
+        run: npm run build:rollup && npm run build:types
 
       - name: Run unit tests
-        working-directory: packages/core
         run: npm run test:unit
 
       - name: Run integration tests
-        working-directory: packages/core
         run: npm run test:integration
 
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
-        if: matrix.os == 'ubuntu-latest' && matrix.node == 20
-        with:
-          file: ./packages/core/coverage/coverage-final.json
-          flags: unittests
-          name: codecov-umbrella
-
   bundle-size:
     name: Check Bundle Size
-    runs-on: ubuntu-latest
-
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: packages/core
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-
-      - name: Setup Rust
-        uses: actions-rs/toolchain@v1
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          profile: minimal
-          toolchain: stable
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build WASM
-        working-directory: packages/core
-        run: |
-          chmod +x scripts/build-wasm.sh
-          ./scripts/build-wasm.sh
-
-      - name: Build package
-        working-directory: packages/core
-        run: npm run build
-
+          node-version: 20.19.5
+          cache: npm
+          cache-dependency-path: packages/core/package-lock.json
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts
+      - name: Build TypeScript bundle
+        run: npm run build:rollup && npm run build:types
       - name: Check bundle size
-        working-directory: packages/core
         run: npm run size
 
   security:
-    name: Security Audit
-    runs-on: ubuntu-latest
-
+    name: NPM Security Audit
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: packages/core
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
+          node-version: 20.19.5
+          cache: npm
+          cache-dependency-path: packages/core/package-lock.json
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts
       - name: Run npm audit
-        run: npm audit --audit-level=moderate
-
-      - name: Run Snyk security scan
-        uses: snyk/actions/node@master
-        continue-on-error: true
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          args: --severity-threshold=high
+        run: npm audit --omit=dev --audit-level=moderate
 
   browser-tests:
     name: Browser Tests
-    runs-on: ubuntu-latest
-
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: packages/core
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-
-      - name: Setup Rust
-        uses: actions-rs/toolchain@v1
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          profile: minimal
-          toolchain: stable
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Install Playwright
-        working-directory: packages/core
-        run: npx playwright install --with-deps
-
-      - name: Build WASM
-        working-directory: packages/core
-        run: |
-          chmod +x scripts/build-wasm.sh
-          ./scripts/build-wasm.sh
-
-      - name: Build package
-        working-directory: packages/core
-        run: npm run build
-
+          node-version: 20.19.5
+          cache: npm
+          cache-dependency-path: packages/core/package-lock.json
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts
+      - name: Install Playwright Chromium
+        run: npx playwright install --with-deps chromium
+      - name: Build TypeScript bundle
+        run: npm run build:rollup && npm run build:types
       - name: Run browser tests
-        working-directory: packages/core
         run: npm run test:browser
-
       - name: Upload browser test results
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: playwright-report

.gitignore

@@ -12,6 +12,7 @@ crates/llm-shield-wasm/target/
 # Node.js / NPM
 node_modules/
 package-lock.json
+!agents/package-lock.json
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*