Close evidence-guard gaps: wire npm packaging tests into dist-validation, correct stale OSTW oracle CI claims

.github/workflows/ci.yml

@@ -322,6 +322,12 @@ jobs:
       - name: Validate package-manager metadata and install script
         run: python scripts/verify-dist.py
 
+      # #183 moved the npm tarball determinism/executable-bit regressions
+      # (#123) to scripts/tests and declared them part of distribution
+      # validation; this step is that wiring.
+      - name: Run npm packaging unit regressions (#123)
+        run: python -m unittest discover -s scripts/tests
+
       - name: Run installer functional tests
         if: runner.os != 'Windows'
         run: scripts/test-install.sh

compatibility/ostw/README.md

@@ -47,6 +47,11 @@ set is explicit and fixed per observation. A session that drops mid-stream
 (transient container failure) is retried; the recorded triple is unchanged.
 
 The corpus runner re-run twice produces byte-identical `results.json`; running
-it without `--update` is the CI drift guard (`OSTW_ORACLE_DRIFT`).
-`accept`/`reject` is derived from the final `elementCount` (`>= 0` means the
-reference produced Workshop code; `-1` means it reported errors).
+it without `--update` fails with `OSTW_ORACLE_DRIFT` when the recorded
+evidence no longer reproduces under the pinned reference. That drift check is
+a manual maintainer command, not a Wright CI gate: the upstream-reference CI
+job was removed in #177, and future oracle reproducibility workflows belong to
+`del-rs` (del-rs#49, tracked in Wright by #182). Wright CI still consumes the
+recorded evidence through the #119 compile differential; it does not re-derive
+it. `accept`/`reject` is derived from the final `elementCount` (`>= 0` means
+the reference produced Workshop code; `-1` means it reported errors).

docs/ostw/compatibility-baseline.md

@@ -215,7 +215,12 @@ reference-rejected boundaries are distinguishable.
   reference-rejected), so the probes are the initial target.
 * **Determinism.** The corpus runner was re-run twice under the pinned
   reference with byte-identical `results.json`; the drift check
-  (`run_oracle.py` without `--update`) guards CI against silent drift.
+  (`run_oracle.py` without `--update`) fails on divergence. It is a manual
+  maintainer command, not a Wright CI gate: the upstream-reference replay was
+  removed from CI in #177, and future oracle reproducibility workflows belong
+  to `del-rs` (del-rs#49, tracked in Wright by #182). Wright CI consumes the
+  recorded evidence through the #119 compile differential; it does not
+  re-derive it.
 
 ## Reference/oracle feasibility report
 

scripts/tests/test_npm_packaging.py

@@ -182,7 +182,11 @@ def test_verify_tarball_still_rejects_non_executable_bin(self):
             package_npm.verify_tarball(tgz, is_meta=True)
         message = str(ctx.exception)
         self.assertIn("not executable", message)
-        self.assertIn("mode 0o644", message)
+        # The observed mode is platform-dependent (0o644 on POSIX,
+        # 0o666 on Windows where exec bits do not exist); the contract is
+        # that the rejection names the offending file and reports the mode.
+        self.assertIn("package/bin/", message)
+        self.assertIn("mode 0o", message)
 
     def test_normalized_tarballs_pass_real_verify(self):
         for layout, is_meta in ((META_LAYOUT, True), (PLATFORM_LAYOUT, False)):