fix(coverage): validate nested npm metadata through canonical pins

[seonghobae]

Problem

Central changed-head npm-lock validation currently requires every non-link node_modules location to repeat its own registry tarball and SHA-512 integrity. npm v3 can serialize workspace or peer locations with only version/classification metadata while one canonical package location carries the actual artifact pin. BandScope's valid apps/desktop/node_modules/@types/react-dom entry therefore blocks central coverage even though the canonical root entry is hash-bounded.

Intended focused contract

• retain exact npm lockfile v2/v3, path, link, HTTPS registry, port, userinfo, query, fragment, tarball, and SHA-512 validation;
• accept a metadata-only nested location only when one canonical root package has the same scoped/unscoped identity and exact version plus a valid npm-registry tarball and SHA-512 SRI;
• reject missing canonical metadata, version mismatch, partial pin fields, malformed identities, non-registry URLs, invalid integrity, and conflicting complete pins;
• consume the validated lock unchanged rather than repairing or inventing metadata;
• add BandScope-shaped positive evidence and negative identity/version/provenance cases;
• update APA 7 doctoring and CHANGELOG.md;
• require complete central statement/branch/docstring evidence.

TDD state

A bounded self-removing workflow on the branch adds the permanent tests, proves the BandScope-shaped case fails against current protected main, applies the minimal production change, executes the full central quality suite, removes itself, and publishes only the four permanent source/test/documentation files. Keep Draft until that workflow-free exact head exists.

Standards basis

The decision follows npm CLI v11's official package-lock.json format, which defines packages as location-keyed descriptors and explicitly notes that some dependency locations may omit artifact fields while retaining metadata. The central policy remains stricter than generic npm by requiring every accepted metadata-only location to resolve to one exact canonical public-registry SHA-512 pin.

Merge gate

No predecessor-head evidence is accepted. Require workflow-free current head, full central tests, 100% production statement/branch/docstring evidence, compilation, Ruff, all security/supply-chain gates, OpenCode, Noema, CodeRabbit, zero actionable threads, a qualifying non-author approval, and branch protection without bypass.

Refs ContextualWisdomLab/bandscope#751 and #748.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ad535ca8-dccd-49e6-9874-558e27503725

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}