[agamal026]

Summary

Addresses #4280 by emitting one aggregate warning when a public lockfile is saved with missing provenance for non-bundled registry dependencies. A real Arborist.reify() test covers the case where an installed dependency is present but neither public nor hidden lockfile is present: the rebuilt entry retains unknown resolved and integrity, and the caller receives the warning.

• Warn when integrity is missing, or when resolved is missing without omitLockfileRegistryResolved.
• A registry version can resolve to a Git artifact. When the serialized resolved URL is Git with a committish, do not require registry tarball integrity. When integrity is absent, omitting that URL or using one without a committish still warns. Registry-version dependencies resolved to HTTP(S) tarballs remain covered.
• Exclude bundles, links, direct non-registry sources, hidden lockfiles, and entries omitted during serialization. Use the root inventory for linked project roots.
• Leave serialized content and write/error behavior unchanged. Metadata-only saves do not infer registry origin. The diagnostic contains no package names, paths, or source URLs.

Validation

At exact published head 2e9c314:

• On Node 26.2.0 with the PR lockfile dependencies, the full Arborist tap --100 --jobs=2 -R classic suite passes 60/60 test files: 5,189 assertions passing, three platform-specific skips, zero failures, and 100% statements, branches, functions, and lines. An isolated Node 22.23.1 checkout also passes all 60 Arborist files after an offline lockfile install; coverage was disabled for that Node 22 run.
• The head merges without conflict into live npm latest at 7b0c2e8f. In an isolated, uncommitted merge, npm ci --ignore-scripts --no-audit --no-fund --prefer-offline --registry=https://registry.npmjs.org installed the current latest lockfile dependencies. The full Arborist tap --100 --jobs=2 -R classic suite then passes 60/60 files: 5,219 assertions passing, three platform-specific skips, zero failures, and 100% statements, branches, functions, and lines. This validates the overlapping build-ideal-tree.js test file against current upstream. The PR branch was not rebased or pushed for this check.
• Focused install and ci CLI command suites pass. A real offline npm install in a seeded installed-dependency project emits the aggregate provenance warning and saves a lockfile with unknown resolved and integrity still absent.
• The custom hosted Git URL reify case passes with the serialized-Git-resolution fix. New focused tests cover a serialized Git URL with a committish fragment, an omitted URL, and a Git URL without a committish fragment. The seeded lockfile-absent Arborist.reify() warning case failed on the pre-PR parent because no warning was emitted. Two existing no-old-lockfile fixtures now require the new provenance warning and still reject the old-lockfile warning.
• Repository-configured ESLint passes on all three changed files; node --check and git diff --check pass.

These are local Linux Arborist and focused CLI checks, not a full npm monorepo run. The Arborist hosted workflow is awaiting maintainer approval and has not run jobs; maintainer review remains pending. Implementation and tests were AI-assisted and received separate AI code reviews. No human review is claimed.

[agamal026]

Could a maintainer authorize the workflows for current head 2e9c31473c5e7557f4a506a586f4a1b1f1f7c770, or let me know if another admission step is needed?

The latest Pull Request run and Arborist run both still report action_required, with no jobs created. Exact-head local Arborist coverage and focused CLI results are documented in the PR description; enabling the upstream runs would add the repository's own CI evidence.