From a13f01e09c27812ea876dce8c15aa3afce41467c Mon Sep 17 00:00:00 2001 From: Omar Sobh Date: Wed, 23 Sep 2026 06:47:39 -0500 Subject: [PATCH] docs: offline npm install proven live; frontend verdict waits on GLM quota Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/TEMPLATE-MATURITY.md | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/docs/TEMPLATE-MATURITY.md b/docs/TEMPLATE-MATURITY.md index d24d74f..085b8c8 100644 --- a/docs/TEMPLATE-MATURITY.md +++ b/docs/TEMPLATE-MATURITY.md @@ -247,9 +247,20 @@ escapes it only because the scratch crates have no dependencies. The judge read the source correctly both times; it failed only on the suite it could not run. -Not counted as evidenced until the judge can run the suite itself. How it -should get the dependencies (offline from the lockfile, registry egress, or -not at all) is an operator decision about the verifier's isolation. +**Fixed (e5b42e5), operator decision: offline from the lockfile.** Before +judging an npm project, the harness copies the mission's npm cache (already on +the host, since `/zeroclaw-data` is bound from `/runtime-data`) into +the verify root and runs `npm ci --offline` against the copy. The judge stays +offline and never runs agent-built binaries, and every package is checked +against the lockfile's hashes. Proven live on the re-run (mission 01a0ce15): +*"DEPENDENCIES: installed by the harness with `npm ci --offline` … node_modules +is present"*. + +That re-run still has no verdict. The GLM judge's weekly quota ran out +(z.ai 1310, resets 2026-09-25 10:01), and the phase failed on the judge with +its pass unspent, as designed. The agents' work was green again: 10 tests, +`tsc -b` clean, +221 lines delivered. Evidenced once a judge with quota +passes it. ## One thing both runs showed: agents reach for Bash