After ADR-122 + ADR-123 expanded ruflo's published-package surface
(@claude-flow/browser, ruflo-graph-intelligence) the supply-chain attack
surface grew alongside it. This commit puts five layers of defence on
every PR + push that touches package.json, lockfiles, or the audit
itself.
New files:
.github/supply-chain/allowed-deps.json
Whitelist of direct deps per audited package (ruflo-graph-intelligence,
@claude-flow/browser). New top-level deps require an explicit edit here.
Also lists policies.rejectInRegistry (typosquat block-list — ruflo-graph-
intellligence, sublinear-time-solvor, agent-browse, etc.) and
publisherTrust.criticalUpstreamPackages (upstream identities snapshotted
in CI logs so maintainer takeovers are visible).
.github/supply-chain/accepted-findings.json
Triaged findings the audit currently tolerates. Each entry cites a
tracking issue or ADR and carries an expiresAt date so the audit
re-fails after triage window closes. CODEOWNER review required to
edit.
.github/supply-chain/README.md
Operator guide: how to run the audit locally, how to triage new
findings, how to add a new package to coverage.
.github/CODEOWNERS
Workflows / lockfiles / plugin manifests / supply-chain config now
require explicit maintainer review. Pairs with the automated audit.
scripts/audit-supply-chain.mjs
Five-layer audit:
[1/5] CVE — npm audit --audit-level=high, fail on HIGH/CRITICAL in
DIRECT deps unless accepted
[2/5] Lockfile integrity — every downloaded entry must carry
SHA-512 in `integrity` (skip pnpm-shadow + workspace-link
entries by construction)
[3/5] Top-level allowlist — package.json deps must match
allowed-deps.json
[4/5] Typosquat reject — names matching policies.rejectInRegistry
fail regardless of upstream status
[5/5] Publisher trust — npm view maintainers, log-only (informational)
scripts/__tests__/audit-supply-chain.test.mjs
Smoke test for the audit itself (full-run / --json / each --scope).
Workflow additions in .github/workflows/v3-ci.yml:
supply-chain-audit job — runs the audit + the smoke test on every PR
and push that touches package.json, lockfile, allowed-deps,
accepted-findings, or the audit script.
dependency-review job — actions/dependency-review-action@v4 (PR-only)
flags any new vulnerable dep added by the PR vs base, fails on
`high` severity, denies known-bad licenses (AGPL/GPL/SSPL) and
blocks specific compromised versions (event-stream, flatmap-stream,
ua-parser-js@0.7.29 / 0.8.0 / 1.0.0, colors@1.4.1, faker@6.6.6).
Path filter expanded to include **/package.json, **/package-lock.json,
**/pnpm-lock.yaml, .github/supply-chain/**, scripts/audit-supply-chain.mjs
Dependabot additions in .github/dependabot.yml:
Per-plugin npm stanzas for ruflo-graph-intelligence and
@claude-flow/browser. Major-version bumps are blocked from auto-PR
(they require allowlist re-approval); patch + minor auto-PR'd.
One real-world finding the audit caught on first run + how it was
triaged (recorded in accepted-findings.json):
- HIGH CVE on @claude-flow/browser → agentic-flow (via @xenova/
transformers, agentdb). Already tracked in ADR-121 Phase 4
(Xenova retirement migration). Marked accepted with expiresAt
2026-08-19 so the audit re-fails if the migration hasn't
landed by then.
Audit run on this branch: PASS (0 unaccepted CVE / 0 lockfile issue
/ 0 allowlist violation / 0 typosquat / 5 publisher-trust entries
logged). Audit smoke test: 5/5 passing.
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv