From 3b2376c77e631d64948e3ef1ed57f9aaceabd495 Mon Sep 17 00:00:00 2001
From: Sage Hart <sagehart@MacBookAir.attlocal.net>
Date: Sun, 12 Jul 2026 10:27:13 -0500
Subject: [PATCH] chore(ci): pin npm 10.9.2 and harden verify.sh for CI parity

Align lockfile generation with GitHub Actions npm 10 on Node 22 and
make ./scripts/verify.sh run npm ci before repo gates.
---
 AGENTS.md         |  1 +
 package-lock.json |  3 ++-
 package.json      |  4 +++-
 scripts/verify.sh | 15 ++++++++++-----
 4 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 77fb2f8..d22a4d3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,6 +37,7 @@ TypeScript multi-agent runtime with policy, approval, and audit control plane. S
 ## Definition of Done
 
 ```bash
+npx npm@10.9.2 ci
 ./scripts/verify.sh
 ```
 
diff --git a/package-lock.json b/package-lock.json
index a863a91..47f5f71 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,7 +31,8 @@
         "vitest": "^4.1.9"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=20",
+        "npm": ">=10.9.2 <11"
       }
     },
     "node_modules/@emnapi/core": {
diff --git a/package.json b/package.json
index b9e6336..6492edc 100644
--- a/package.json
+++ b/package.json
@@ -27,8 +27,10 @@
     "typescript"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=20",
+    "npm": ">=10.9.2 <11"
   },
+  "packageManager": "npm@10.9.2",
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
diff --git a/scripts/verify.sh b/scripts/verify.sh
index e92ac61..70f3d34 100755
--- a/scripts/verify.sh
+++ b/scripts/verify.sh
@@ -1,16 +1,21 @@
 #!/usr/bin/env bash
+# Definition of Done — mirrors CI lint + build matrix jobs (no Docker).
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
-if [[ ! -d node_modules ]]; then
-  echo "Run npm install first" >&2
-  exit 1
+if command -v corepack >/dev/null 2>&1; then
+  corepack enable >/dev/null 2>&1 || true
+  corepack prepare npm@10.9.2 --activate >/dev/null 2>&1 || true
 fi
 
-echo "== verify: typecheck + test + lint =="
+echo "==> npm ci (expect packageManager npm@10.9.2)"
+npm ci
+
+echo "==> typecheck + test + lint + format"
 npm run typecheck
 npm run test
 npm run lint
+npm run format:check
 
-echo "verify: ok"
+echo "verify: ok (ci/web parity)"