[khaliqgant]

Clean installs fail with EBADPLATFORM because the npm lockfile still contains platform broker packages retired from the workspace. Regenerate the lockfile with CI’s npm 10.9.2 so those unused packages disappear while required optional peer adapters remain resolvable.

The final delta removes six extraneous broker/harness records and updates generated optional/peer/libc metadata. Every retained package version, resolved URL, integrity value and dependency specification matches main; no manifest or runtime code changes.

Validation:

• Exact main 1db553041 Test run 42716346786 and Factory run 42719056583 reproduce the Darwin/ARM64 package refusal.
• Actual clean Linux/x64-target installs pass with npm 10.9.2 (543 packages) and npm 10.9.8 (539 packages).
• Semantic comparison verifies the retained package versions, integrity values and dependency specifications are unchanged. Scoped code/security/secrets review passes.

The initial local-only prune exposed an older-npm peer-resolution failure in CI; the final regeneration corrects it. The earlier dry run was nondiscriminating and is not installation proof. No provider, service, model or release operation is involved.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2fe5e27a-d18f-468d-b80c-e6745e77643b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T23:36:07.078400Z	ac13932	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[AgentRelayBot]

Blocking durability finding at exact 3ec54bf.

The committed pruned lock installs, but the publish workflow does not reuse it: Clean reinstall after version bump deletes package-lock.json and runs npm 11.19.1 install. Reproducing that fresh resolution from this head with Linux/x64 targeting recreates the original broken records:

node v26.9.0; npm 11.19.1
move package-lock.json aside
npm install --package-lock-only --ignore-scripts --no-audit --no-fund --os=linux --cpu=x64

@agent-relay/harness-driver 17.2.1: extraneous=true
@agent-relay/broker-darwin-arm64 17.2.1: extraneous=true
@agent-relay/broker-linux-x64 17.2.1: extraneous=true
fresh lock differs from the committed lock

A package-lock-only reconciliation with the committed lock present is not sufficient evidence; only the fresh no-lock resolution matches publish.yml lines 495-496. On the next release, this PR alone would regenerate the same mandatory cross-platform nodes and commit them again.

Please do not merge #2135 as the durable fix. The manifest-edge approach in draft #2134 is directionally correct because it makes the frozen harness an explicit root dev edge and causes fresh npm 11 resolution to classify the harness devOptional and brokers optional. Select one canonical repair, include a regression that deletes the lock and performs the release-style fresh resolution, and close/supersede the other PR.

[khaliqgant]

Superseded by #2134 (merged as f86ebb6), whose lockfile survives the release's clean reinstall. This one regenerates the extraneous entries on a fresh resolve.