Omar SobhandClaude Opus 5.5
e5b42e5627
The judge verifies a copy that excludes node_modules (on purpose: it must not run agent-built binaries) in a container with no registry route, so every npm project failed any "tests pass" condition — the frontend team's first run was correct (10/10 re-run by hand) and failed twice on `vitest: not found`. When the copy has package-lock.json, the harness copies the mission's npm cache (already on the host: /zeroclaw-data is bound from <mission>/runtime-data) into the verify root and runs `npm ci --offline` against the copy, so the judge stays offline, every tarball is checked against the lockfile's hashes, and nothing root-owned lands in the mission's tree. The judge is told whether the install worked, so a missing install never reads as a failing suite. Exit status is npm's own (no `| tail` laundering) — tested with a fake npm in both directions; the real path was run by hand on the delivered branch: offline install of 173 packages, then 10/10. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>