{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=himanshu-jha/lockfile-trust-chain@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Audits a normalized manifest-plus-lockfile snapshot as a trust chain. Use it on every dependency PR or lockfile regeneration and again before a release cut. It rejects blank package names, versions, explicit node IDs, root resolved IDs, dependency references, and any supplied non-string or blank source coordinate before analysis. Four parallel probes then find mutable registry/path/URL/Git sources—including case-insensitive git+, git://, ssh://, and SCP-style Git coordinates unless pinned to a full commit—missing, weak, malformed, or truncated integrity evidence using algorithm-specific decoded digest lengths, roots whose transitive closure is absent or padded with unreachable entries using iterative traversal with bounded cycle witnesses, and version/source conflicts against manifest intent including npm-compatible caret-zero bounds; a synthesis join reports whether the lock can anchor a repeatable install and orders repairs by severity. It reads JSON only and performs no install, fetch, write, or registry c","distribution":{"digest":"sha256:08674b21238506373f2f087b367af4fc7821098f9b3d4835b76ab2c59cceb2d7","mediaType":"application/vnd.modiqo.rote-flow","size":14032,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"license":"MIT","links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0.json"},"name":"lockfile-trust-chain","owner":{"kind":"org","slug":"himanshu-jha"},"parameters":[{"description":"Workspace-relative normalized manifest/lock snapshot JSON. Omit for the bundled demo; pass input=evidence/package-lock-normalized.json for fresh evidence.","example":"evidence/package-lock-normalized.json","input":{"allowCustom":true,"choices":[],"label":"Input"},"name":"input","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/himanshu-jha/lockfile-trust-chain@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-04T12:23:07.124772+00:00","reference":"himanshu-jha/lockfile-trust-chain@0.1.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":2,"installs":0},"steps":{"count":5,"names":["detect_mutable_dependency_sources","prove_manifest_resolution_closure","reconcile_resolution_conflicts","synthesize_lockfile_trust","verify_integrity_coverage"]},"title":"lockfile-trust-chain","type":"play","version":"0.1.0","visibility":"public"}