WIP: Migrate dependency sources to the Caution forge #5

Closed

vincent wants to merge 0 commits from feat/forge-migration into main

vincent commented

2026-10-15 11:56:43 +00:00

Owner

Move installation, repository metadata, the tee-attestation-js dependency URL and the widget’s STEVE link to git.caution.co/public. Retain tee-attestation-js at ba0d0c57de673c8576c91a8730775a87575f5c10 and esbuild at 0.24.0. README source documentation contains the canonical URL.

Signed branch head and Platform pin: 7d60e623b4d1c151590d8d5dd925f88dc627e01e. Platform #479, revision 85e6300a99e5efb0badde6b74793746bb101e1a8, now consumes this reachable revision. Its complete Git tree equals the previously validated 900474ad3fc34d032728d229ddea93df609b4f31; no additional source or bundle changes were needed during stabilization.

Validation: signature and tree equality verified; ordinary fresh canonical clone/checkout and exact archive download passed. The final Platform revision passed clean-cache npm installation, 137 frontend tests and production build. Its lockfile changes only the widget SHA; package versions and integrity hashes are unchanged. The earlier pinned StageX bundle-build evidence applies to the identical tree; the bundle was not regenerated again in this pass.

Keep this PR as a draft. Before Platform lands, retain this exact revision through a signed ancestry-preserving merge. GitHub mirror setup remains a separate gate; no working widget mirror is assumed. No main-branch merge, tag, mirror configuration, deployment or trust-policy change was performed.

Move installation, repository metadata, the tee-attestation-js dependency URL and the widget’s STEVE link to git.caution.co/public. Retain tee-attestation-js at `ba0d0c57de673c8576c91a8730775a87575f5c10` and esbuild at 0.24.0. README source documentation contains the canonical URL. Signed branch head and Platform pin: `7d60e623b4d1c151590d8d5dd925f88dc627e01e`. [Platform #479](https://git.caution.co/public/platform/pulls/479), revision `85e6300a99e5efb0badde6b74793746bb101e1a8`, now consumes this reachable revision. Its complete Git tree equals the previously validated `900474ad3fc34d032728d229ddea93df609b4f31`; no additional source or bundle changes were needed during stabilization. Validation: signature and tree equality verified; ordinary fresh canonical clone/checkout and exact archive download passed. The final Platform revision passed clean-cache npm installation, 137 frontend tests and production build. Its lockfile changes only the widget SHA; package versions and integrity hashes are unchanged. The earlier pinned StageX bundle-build evidence applies to the identical tree; the bundle was not regenerated again in this pass. Keep this PR as a draft. Before Platform lands, retain this exact revision through a signed ancestry-preserving merge. GitHub mirror setup remains a separate gate; no working widget mirror is assumed. No main-branch merge, tag, mirror configuration, deployment or trust-policy change was performed.

vincent added 1 commit

2026-10-15 11:56:43 +00:00