grim8/23/2026, 10:01:57 AM

bun install --frozen-lockfile failed in the image:

  error: Workspace dependency "@tripwire/forge-opengit" not found
  Searched in "./*"

I added that dependency to the ROOT package so the e2e harness could import
the real webhook signer. The root is not itself a workspace member, so a
workspace:* there has no workspace scope to resolve against on the bun version
the image runs (1.3.14). Local installs on 1.4.0 tolerated it, so it passed
every check here and only failed at deploy.

The harness now computes the signature itself. It is four lines of node:crypto
and the comment says why it is not an import.

Drift is caught END TO END rather than by a shared symbol, which is stronger
than the import was: the api verifies with the real verifyWebhookSignature, so
a scheme change makes the injected delivery 401 and the run fails loudly with
'the api refused the delivery'.

Verified: bun install --frozen-lockfile passes, all five gates pass, and the
live open-git suite is 3/3 with every injected delivery accepted at http 200.

Parentaeb6d9a