The verification's Check 2 (federation plugin exports) and Check 3
(breaker/reporter wire-up) have been blocked by a registry security
policy rejecting `cookies@0.9.1`. Two facts make the obvious fix
non-obvious:
1. `cookies@0.9.1` is the LATEST published version — there is no
newer version to override TO. (`npm view cookies dist-tags` →
latest=0.9.1, no 0.9.2 exists upstream.)
2. `package.json#overrides` is only honored at the ROOT of the
install, so adding an override in the federation plugin's own
manifest does not help downstream consumers (`npm install
@claude-flow/plugin-agent-federation@alpha` from a fresh dir).
But `cookies@0.9.0` (one patch back, same surface, `koa@3.2.0` accepts
either) is NOT blocked and works. So the verification harness can pin
that at its own root.
Add `scripts/verify-federation-plugin.sh` to encode this: create a
temp dir, write `package.json` with `overrides.cookies=0.9.0`, run
`npm install @claude-flow/plugin-agent-federation@<tag>`, then run
Check 2 (required exports present) and Check 3 (`FederationBreakerService`
+ `InMemorySpendReporter` instantiate cleanly).
Verified end-to-end against the live `alpha` tag (3.7.0-alpha.32 era):
$ bash scripts/verify-federation-plugin.sh
[verify-federation] installing @claude-flow/plugin-agent-federation@alpha
added 527 packages in 21s
[verify-federation] resolved cookies version: 0.9.0
[verify-federation] Check 2 OK — FederationNodeState, FederationBreakerService, InMemorySpendReporter
[verify-federation] Check 3 OK — FederationBreakerService + InMemorySpendReporter instantiate cleanly
[verify-federation] all checks PASSED for tag=alpha
exit=0
Dep chain (the issue mis-identified `koa-router`; it's actually plain `koa`):
plugin-agent-federation → agentic-flow → fastmcp → mcp-proxy
→ pipenet@1.4.0 → koa@3.2.0 → cookies@0.9.1 (← blocked → 0.9.0)
Verification harnesses (any cron/CI that exercises these checks) should
call this script in place of a raw `npm install …federation@alpha`.
Co-authored-by: Reuven <cohen@ruv-mac-mini.local>
rUv