package manager: `torb audit`

orion commented

2026-10-05 21:07:11 +00:00

Collaborator

Context

Readiness lists audit among the package manager's commands (CONCEPT: torb audit checks the locked graph). This issue builds the part the registry index already carries: yanked and deprecated versions. The advisory database ("advised-against" versions) does not exist yet and is split off into #309.

Source

RELEASE.md readiness
docs/design/RELEASE.md sections 7.3 (yanking), 7.4 (index records), 7.6 (threats)
docs/tooling/torb-yank.md, docs/tooling/torb-deprecate.md, docs/tooling/project-lock-trb.md

Acceptance criteria

torb audit [--project <directory>] reads project.lock.trb (never writes it) and, for every locked registry package (direct and transitive; path: packages are skipped), fetches and verifies its index as torb add does
A locked version that the index yanks is reported with its package, version and yank reason; a locked package whose index carries a deprecate notice is reported with its use package and reason
Exit code 0 and a one-line "no findings" message when nothing is reported; exit code 1 when anything is reported (all findings are printed first); exit code 2 for a command written wrong, a missing or unreadable lock, or an index that cannot be fetched or verified
Tests in compiler/tests/ over a file: registry fixture: clean lock, yanked pin, unyanked pin, deprecated package, transitive finding, path: package skipped, missing lock
torb audit appears in the usage text (compiler/src/cli/usage.trb), dispatch (compiler/src/main.trb) and the command table of docs/tooling/the-torb-command.md
Documented in docs/tooling/torb-audit.md (frontmatter per the other tooling pages, listed in docs/tooling/index.md, related links from torb-yank.md and torb-deprecate.md); skills/ regenerated

Seed impact

None expected: TorbScript code in compiler/src/cli and compiler/src/package only, no new native, no syntax change, no driver flag, no std name looked up by string.

Size

One PR, one or two Conventional Commits (feat(cli): add torb audit, docs(tooling): document torb audit).

Dependencies

None open. The advisory database part is #309 (blocked on an owner decision).

Moved from the planning lists of the docs; the design record stays the specification.

## Context Readiness lists `audit` among the package manager's commands (CONCEPT: `torb audit` checks the locked graph). This issue builds the part the registry index already carries: **yanked** and **deprecated** versions. The advisory database ("advised-against" versions) does not exist yet and is split off into #309. ## Source - [RELEASE.md readiness](https://git.torb.dev/torbscript/language/src/commit/393ef2608e4a60b8ff76d8b6b408951b822d887d/docs/design/RELEASE.md#L101) - docs/design/RELEASE.md sections 7.3 (yanking), 7.4 (index records), 7.6 (threats) - docs/tooling/torb-yank.md, docs/tooling/torb-deprecate.md, docs/tooling/project-lock-trb.md ## Acceptance criteria - [ ] `torb audit [--project <directory>]` reads `project.lock.trb` (never writes it) and, for every locked registry package (direct and transitive; `path:` packages are skipped), fetches and verifies its index as `torb add` does - [ ] A locked version that the index yanks is reported with its package, version and yank reason; a locked package whose index carries a `deprecate` notice is reported with its `use` package and reason - [ ] Exit code 0 and a one-line "no findings" message when nothing is reported; exit code 1 when anything is reported (all findings are printed first); exit code 2 for a command written wrong, a missing or unreadable lock, or an index that cannot be fetched or verified - [ ] Tests in `compiler/tests/` over a `file:` registry fixture: clean lock, yanked pin, unyanked pin, deprecated package, transitive finding, `path:` package skipped, missing lock - [ ] `torb audit` appears in the usage text (`compiler/src/cli/usage.trb`), dispatch (`compiler/src/main.trb`) and the command table of `docs/tooling/the-torb-command.md` - [ ] Documented in `docs/tooling/torb-audit.md` (frontmatter per the other tooling pages, listed in `docs/tooling/index.md`, related links from `torb-yank.md` and `torb-deprecate.md`); `skills/` regenerated ## Seed impact None expected: TorbScript code in `compiler/src/cli` and `compiler/src/package` only, no new native, no syntax change, no driver flag, no std name looked up by string. ## Size One PR, one or two Conventional Commits (`feat(cli): add torb audit`, `docs(tooling): document torb audit`). ## Dependencies None open. The advisory database part is #309 (blocked on an owner decision). _Moved from the planning lists of the docs; the design record stays the specification._

orion added this to the Milestone 8: formatter, linter, language server, package manager milestone

2026-10-05 21:07:11 +00:00

orion added the

loop

label

2026-10-05 21:07:11 +00:00

orion commented

2026-10-06 16:34:11 +00:00

Author

Collaborator

[loop:torbscript] intake: in scope (author orion, label loop). torb audit per RELEASE.md readiness; client only, no collision with CONCEPT "Open Questions", no seed impact expected. Where the advisory data comes from (index field) is to settle in refine, possible owner decision. Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: refine (queued)

[loop:torbscript] intake: in scope (author orion, label loop). `torb audit` per RELEASE.md readiness; client only, no collision with CONCEPT "Open Questions", no seed impact expected. Where the advisory data comes from (index field) is to settle in refine, possible owner decision. Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: refine (queued)

orion commented

2026-10-09 05:13:42 +00:00

Author

Collaborator

[loop:torbscript] refine: still queued behind the intake order. next: waiting (ready buffer full: #4, #163, #164, #223 are ready) until 2026-10-10T04:00:00Z

orion commented

2026-10-12 06:53:17 +00:00

Author

Collaborator

[loop:torbscript] claim refine by session:loop-torbscript-20261012 until 2026-10-12T08:53Z

orion commented

2026-10-12 06:56:21 +00:00

Author

Collaborator

[loop:torbscript] release refine: worker aborted before any work (model profile anthropic:theorben hit its weekly limit, resets 2026-10-13 22:00 Berlin). Nothing left half done; the next tick re-dispatches on another profile.

orion commented

2026-10-12 06:58:37 +00:00

Author

Collaborator

[loop:torbscript] release: the worker on anthropic:theorben died on its weekly limit before its first reply; respawning on the next profile.

orion commented

2026-10-12 06:58:38 +00:00

Author

Collaborator

[loop:torbscript] claim refine by session:loop-torbscript-20261012 until 2026-10-12T08:58Z

orion referenced this issue

2026-10-12 06:59:39 +00:00

package manager: torb audit advisory database #309

orion commented

2026-10-12 06:59:53 +00:00

Author

Collaborator

[loop:torbscript] decided by the loop: (1) Scope: this issue covers what the index already carries, yanked versions and deprecated packages. "Advised-against" has no data source yet (RELEASE.md 7.6 describes an advisory repository that does not exist), so it is split into #309, which needs an owner decision before it can be ready (a public repository is an external commitment). (2) Data source: the same verified index fetch torb add uses (fetchIndex + verifiedIndex), no new network protocol. (3) Exit codes: 0 clean, 1 findings, 2 usage or fetch/verify failure (findings are not a refusal, so they get their own code, usage keeps 2 as in yank). (4) Both direct and transitive locked packages are checked, because a yanked transitive pin is the realistic case. (5) No seed impact, one PR.

[loop:torbscript] decided by the loop: (1) Scope: this issue covers what the index already carries, yanked versions and deprecated packages. "Advised-against" has no data source yet (RELEASE.md 7.6 describes an advisory repository that does not exist), so it is split into #309, which needs an owner decision before it can be ready (a public repository is an external commitment). (2) Data source: the same verified index fetch `torb add` uses (`fetchIndex` + `verifiedIndex`), no new network protocol. (3) Exit codes: 0 clean, 1 findings, 2 usage or fetch/verify failure (findings are not a refusal, so they get their own code, usage keeps 2 as in `yank`). (4) Both direct and transitive locked packages are checked, because a yanked transitive pin is the realistic case. (5) No seed impact, one PR.

orion added the

ready

label

2026-10-12 06:59:53 +00:00

orion commented

2026-10-12 06:59:53 +00:00

Author

Collaborator

[loop:torbscript] refine: definition of ready met (goal, testable criteria, design links, no seed impact, one PR; advisory part split into #309), label ready set, next: implement. Worker usage: ~60k tokens (sonnet).

[loop:torbscript] refine: definition of ready met (goal, testable criteria, design links, no seed impact, one PR; advisory part split into #309), label `ready` set, next: implement. Worker usage: ~60k tokens (sonnet).

orion commented

2026-10-12 07:01:13 +00:00

Author

Collaborator

[loop:torbscript] claim implement by session:loop-torbscript-20261012 until 2026-10-12T13:01Z

orion referenced this issue from a pull request that will close it,

2026-10-12 07:08:21 +00:00

feat(cli): add torb audit #319

orion referenced this issue

2026-10-12 08:22:05 +00:00

registry: "elsewhere" owners and the signed owner file #19

orion commented

2026-10-12 11:04:02 +00:00

Author

Collaborator

[loop:torbscript] implement: PR #319 open, CI green on db1867cc (gates success), review requested from argus (the worker died on the account session limit after opening the PR), next: review (merge gate)

[loop:torbscript] implement: PR #319 open, CI green on db1867cc (gates success), review requested from argus (the worker died on the account session limit after opening the PR), next: review (merge gate)