/claim #10

Summary

Adds repository-external-reference-pin-guard/, a focused issue #10 Project Repository & Version Control slice.

The guard validates repository releases and export bundles that depend on Git submodules, linked datasets, API snapshots, model weights, or external code/data references. It blocks DOI publication/export when external references are floating, authenticated-only, stale, future-dated, missing verification evidence, malformed, or missing durable checksum/DOI/version evidence. It also stages metadata-only revision when immutable references still lack license or attribution metadata.

Hardening Updates

• Blocks repository packets with missing or invalid assessedAt timestamps, so otherwise pinned references cannot release DOI/export evidence without auditable assessment timing.
• Blocks malformed top-level repository packets with MALFORMED_REPOSITORY_PACKET, stable unidentified-repository evidence, and repair_repository_packet:* remediation instead of crashing before reviewer packets are generated.
• Blocks malformed object-shaped references manifests with MALFORMED_REFERENCE_MANIFEST and repair_reference_manifest:* instead of treating them as clean empty audits.
• Blocks malformed external-reference entries with MALFORMED_REFERENCE_ENTRY and repair_reference_entry:* instead of crashing or dropping them from reviewer packets.
• Blocks blank or missing reference IDs with MISSING_REFERENCE_ID, assigns stable unidentified-reference-* packet IDs, and emits assign_reference_id:* remediation instead of releasing ambiguous evidence.
• Rejects invalid checksum placeholders such as pending, truncated checksums such as sha256:abcdef, invalid DOI placeholders, all-zero Git commit placeholders, floating version aliases, future-dated verification timestamps, and future-dated API snapshots.
• Requires otherwise pinned references to carry verification timestamps before release.

Non-overlap

This is scoped to immutable external reference pins and exportable citation evidence for submodules, linked datasets, API sources, model weights, and external code/data pointers. It does not duplicate broad repository ledgers, release engines, structured diffs, provenance attestations, release embargo controls, notebook replay, schema migration, citation impact, API/export contract verification, merge queue governance, environment drift, access review, DOI tombstone handling, metadata readiness, branch hypothesis lineage, sensitive-artifact scanning, dependency-license checks, legal hold, component-owner approval, restore rehearsal, compute sandbox policy, or semantic version-tag governance.

Validation

• Latest red regression failed before implementation with release_repository_references instead of hold_repository_release when otherwise pinned dataset evidence omitted repository assessedAt.
• Prior malformed top-level regression failed before implementation with TypeError: Cannot read properties of null (reading 'policy') for assessExternalReferences(null).
• npm test from repository-external-reference-pin-guard passed: 18 tests.
• npm run demo regenerated 8 deterministic JSON packets plus Markdown/SVG evidence, including missing-assessed-at-packet.json and malformed-repository-packet.json.
• npm run video regenerated reports/demo.mp4.
• npm run check passed: JS syntax checks and Python compile check.
• Parsed all 8 generated JSON packets successfully.
• ffprobe verified reports/demo.mp4 as H.264, 1280x720, 24 fps, 7.5s, 180 frames, 82,218 bytes.
• git diff --check and git diff --cached --check passed; only Windows line-ending normalization warnings appeared.
• Staged diff was limited to repository-external-reference-pin-guard/.
• Focused restricted-string scan returned no credential, payout, or token matches.

Demo Artifacts

• repository-external-reference-pin-guard/reports/blocked-packet.json
• repository-external-reference-pin-guard/reports/malformed-repository-packet.json
• repository-external-reference-pin-guard/reports/malformed-manifest-packet.json
• repository-external-reference-pin-guard/reports/malformed-packet.json
• repository-external-reference-pin-guard/reports/missing-reference-id-packet.json
• repository-external-reference-pin-guard/reports/missing-assessed-at-packet.json
• repository-external-reference-pin-guard/reports/clean-packet.json
• repository-external-reference-pin-guard/reports/warning-packet.json
• repository-external-reference-pin-guard/reports/external-reference-report.md
• repository-external-reference-pin-guard/reports/summary.svg
• repository-external-reference-pin-guard/reports/demo.mp4

Synthetic data only. No external repositories, live APIs, DOI registries, object stores, credentials, private research data, identity providers, payment systems, or private services are contacted.

AI-assisted with OpenAI Codex; I reviewed and locally verified the diff before submitting.