Add supply-chain quality helpers

[simple-agent-manager]

Summary

• Adds privacy-preserving supply-chain helper/checker implementations under scripts/quality/ only.
• Covers direct production dependency-addition evidence for npm/Go manifests, diff-local govulncheck applicability, OSV scheduled-policy validation, and Gitleaks redaction/fail-closed semantics.
• Does not wire these helpers into package scripts or CI workflows; that is intentionally left to the coordinating parent branch.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test — focused impacted suite below
• Additional validation run (if applicable)
• If this PR changes candidate selection for a sweep/cron/alarm loop (WHERE clause, status set, join, or equivalent), expected candidate volume and worst-case per-candidate cost are stated in the summary or validation notes (see .claude/rules/47-control-loop-io-budget.md) — N/A: helper-only policy code, no production sweep/cron query is wired.

Additional validation:

• pnpm exec vitest run --config scripts/quality/vitest.config.ts scripts/quality/check-direct-dependency-evidence.test.ts scripts/quality/check-go-vulnerability-diff.test.ts scripts/quality/check-osv-policy.test.ts scripts/quality/check-secret-scan-policy.test.ts — PASS, 4 files / 14 tests.
• pnpm exec prettier --check ...new supply-chain files... — PASS.
• pnpm exec tsx --check scripts/quality/check-direct-dependency-evidence.ts — PASS.
• pnpm exec tsx --check scripts/quality/check-go-vulnerability-diff.ts — PASS.
• pnpm exec tsx --check scripts/quality/check-osv-policy.ts — PASS.
• pnpm exec tsx --check scripts/quality/check-secret-scan-policy.ts — PASS.
• pnpm quality:dependency-governance — PASS, existing dependency-governance suite.
• pnpm quality:scripts:test — ATTEMPTED twice; new tests passed, but existing timeout-prone tests failed outside this diff (check-no-tracked-stale-binaries.test.ts, check-migration-ordering.test.ts).

Staging Verification (REQUIRED for all code changes — merge-blocking)

All checkboxes below are mandatory for any PR that changes runtime code (.ts, .tsx, .go, etc.). Write N/A: docs-only ONLY if the PR contains zero runtime code changes. See .claude/rules/13-staging-verification.md.

• Staging deployment green — N/A by explicit task instruction: never deploy staging.
• Live app verified via Playwright — N/A by explicit task instruction: helper-only quality scripts, no app/runtime behavior changed.
• Existing workflows confirmed working — N/A by explicit task instruction: no staging deployment.
• New feature/fix verified on staging — N/A by explicit task instruction: helper-only quality scripts verified locally.
• Infrastructure verification completed — N/A: no infra paths touched.
• Mobile and desktop verification notes added for UI changes — N/A: no UI changes.

Staging Verification Evidence

Staging intentionally skipped. The user explicitly instructed: never deploy staging. This PR adds local quality helper scripts only and does not change application runtime paths.

UI Compliance Checklist (Required for UI changes)

• Mobile-first layout verified — N/A: no UI changes.
• Accessibility checks completed — N/A: no UI changes.
• Shared UI components used or exception documented — N/A: no UI changes.
• Playwright visual audit run locally — N/A: no UI changes.

End-to-End Verification (Required for multi-component changes)

• Data flow traced from user input to final outcome with code path citations (see .claude/rules/10-e2e-verification.md) — N/A: quality-helper-only library/CLI functions; no user input or app backend path.
• Capability test exercises the complete happy path across system boundaries — N/A: no cross-system boundary; external command execution is injectable and tested with synthetic fixtures.
• All spec/doc assumptions about existing behavior verified against code (not just "read the code") — Existing scripts/quality/vitest.config.ts, CI quality script test wiring, dependency-governance tests, PR template, constitution, and active task record reviewed.
• If any gap exists between automated test coverage and full E2E, manual verification steps documented below.

Data Flow Trace

N/A: helper-only scripts. The relevant local flows are:

• scripts/quality/check-direct-dependency-evidence.ts parses unified diffs, extracts production direct additions from package.json/go.mod, excludes updates/removals/dev/workspace/internal dependencies, then validates scripts/quality/direct-dependency-evidence.json entries.
• scripts/quality/check-go-vulnerability-diff.ts accepts changed file lists, runs injectable govulncheck ./... only when go.mod or go.sum changed, and cannot match unrelated filenames such as go.mod-notes.md.
• scripts/quality/check-secret-scan-policy.ts evaluates synthetic Gitleaks JSON findings, fails closed on findings, and removes Secret/Match values from result payloads.
• scripts/quality/check-osv-policy.ts treats PR events as non-advisory, validates scheduled/workflow-dispatch advisory runs require private SAM/backlog routing, and requires every ignore to have reason plus future expiry.

Untested Gaps

Coordinator wiring is intentionally unimplemented in this child PR. The helpers are not added to package.json, CI workflows, PR template, or shared integration configs due to exclusive ownership constraints.

Post-Mortem (Required for bug fix PRs)

N/A: not a bug fix.

What broke

N/A.

Root cause

N/A.

Class of bug

N/A.

Why it wasn't caught

N/A.

Process fix included in this PR

N/A.

Post-mortem file

N/A.

Specialist Review Evidence (Required for agent-authored PRs)

• All local reviewers completed and findings addressed before merge
• If any reviewer did NOT complete: needs-human-review label added and merge deferred to human — N/A.

Reviewer	Status	Outcome
task-completion-validator	PASS	Scope matches active task and exclusive ownership: only allowed scripts/quality/** families added; coordinator wiring left explicit.
security-auditor	PASS	Secret scan helpers redact Secret/Match fields, tests use synthetic non-secret values, no full-history scans run or encoded in defaults.
test-engineer	PASS	Focused Vitest coverage covers happy/failure/malformed cases, command injection points are injectable, and dependency fixtures cover add/remove/update/dev/workspace/internal cases.
constitution-validator	PASS	No deployment-specific URLs, timeouts, mutable service identifiers, or app config constants added; external evidence URL validation requires generic HTTPS.

Exceptions (If any)

• Scope: Shared workflow/config integration intentionally omitted.
• Rationale: User explicitly restricted ownership to named helper/test families and prohibited edits to workflows, manifests, package scripts, and existing quality scripts.
• Expiration: Parent/coordinator branch should wire these helpers once sibling quality-program tasks converge.

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: no external API integration; helper behavior designed from repository task/instructions and existing quality-script conventions.

Codebase Impact Analysis

Affected paths are limited to scripts/quality/check-direct-dependency-evidence*, scripts/quality/check-go-vulnerability-diff*, scripts/quality/check-osv-policy*, scripts/quality/check-secret-scan-policy*, scripts/quality/direct-dependency-evidence.json, and scripts/quality/fixtures/supply-chain/**.

Documentation & Specs

N/A: no public docs/spec updates. Coordinator wiring/blocker is documented in this PR body.

Constitution & Risk Check

Checked constitution Principle XI and relevant security/quality rules. Key risk is false positives from over-broad applicability; tests cover PR event non-applicability for OSV and exact Go module filename matching for govulncheck. Key privacy risk is secret echo in scan output; tests assert synthetic finding values are absent from returned/loggable structures.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/implement-privacy-preserving-supply-s5bscp (9d15e17) with main (8c689a6)¹}

Footnotes

1. No successful run was found on sam/coordinate-implement-deterministic-runtime-gkq1xt (21e507a) during the generation of this report, so main (8c689a6) was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE