fix(system-update): match the npm install-script gate to measured risk

[verlyn13]

Purpose

The install-script gate required an exact version on every --allow-scripts grant. A walk of the live global tree shows what that was policing, and it is not much:

• 5 packages / 7 versions out of 891 carry an install script at all — 0.79%
• zero of the 12 top-level globals declares one in its own manifest
• zero of those scripts fetches from a non-registry host
• @openai/codex has none anywhere in its tree, so strict mode on that lane has zero enforcement targets and can only ever exit 0

Meanwhile the exact-version grain generated the whole maintenance cost: over 2026-07 the gate named 7 dependency identities but 15 version tuples, and workerd alone moved 8 times in 33 days. None of those edits was a review.

What changed

Grain → dependency identity. wrangler=esbuild,fsevents,workerd, owner-scoped as before. A new script-bearing identity still stops the install. SYSTEM_UPDATE_NPM_ALLOW_SCRIPTS_REQUIRE_PIN=true restores the old grain. Semver ranges, dist-tags and globs are now rejected by name — npm discards them silently, which fails open on a non-strict npm. Globs matter most: the sibling knob min-release-age-exclude is minimatch, allow-scripts is not.

Per-lane release-age cooldown. 2 days on stable globals, 0 on the AI channels. Across seven documented npm hijacks the dwell-time distribution is bimodal — five inside 24h, then 8–10 days and 72 days — so 1, 2 and 7 all catch the same five; 2 buys margin against detection-to-removal lag. The AI lane is 0 because a cooldown on a dist-tag does not delay a channel, it moves it: verified, codex@alpha resolves to stable 0.146.0 and copilot@prerelease to 1.0.77, exit 0, no warning. --min-release-age-exclude is never emitted and a test enforces it — npm ≥ 12 only, and on 11.16 the unknown flag becomes a positional spec and kills the step with E404.

Artifact verification where the allowlist never applied. ai_cli_platform_dep_ok existed but was wired only into --check; it now runs in update mode on a parent version change. The platform-binary drop is a plain tarball no script touches, and command health cannot see it — the loader falls back and --version answers from the JS wrapper.

The npm 12 timebomb this defuses

npm 12.0.2 has been latest since 2026-07-08 and inverts the default: npm 11 runs an uncovered install script with a notice, npm 12 blocks it and still exits 0. It also renamed the log prefix allow-scripts → install-scripts. The counters matched only the npm-11 wording and would have silently returned zero — a v12 host would have installed globals without their native binaries and reported a clean green row.

Both wordings now match, npm_scripts_blocked_at_exit_zero separates blocked-at-success from pending review, and both steps print npm-major:. The arrival lane is mise upgrade --yes against a floating node = "24" — no operator decision involved. Runway exists: node 26.5.1 still bundles npm 11.17.0. npm is deliberately neither pinned nor upgraded (the mise shim shadows ~/.npm-global/bin, corepack is gone in Node 26).

Two defects fixed in passing

• The AI lane could never reach blocked in production. npm_script_review_is_sole_failure rejected any log containing ^ai-cli-channel-failed: — which is the gate's own marker. The existing assertion passed only because its fixture omitted the line production always emits. §16.1 documented behavior the code did not have.
• grep | grep -qv misclassified large logs. Under pipefail the reader's short-circuit hands the writer SIGPIPE and the pipeline returns 141, read as "no second cause". Reproduced at ≥800 matched lines. Now a single awk pass.

Reporting contract

Every tolerated state is stated rather than rendered green — npm-script-identity-grant, npm-global-resolved-drift, ai-cli-cooldown-hazard, ai-cli-platform-drift. All are printed markers promoted by collect_notices, since step functions run in a subshell.

Validation

• scripts/validate-repo.sh — PASS (shellcheck 0.11.0 pinned)
• tests/system-update/run.sh — 153 passed, 0 failed (was 96 before this line of work)
• Live --check run: clean on both lanes
• Live update run: gemini moved 20260801 → 20260802, so the version-change branch executed — platform check ran and passed, and the run disclosed 1 package(s) ran install scripts under an identity-scoped grant, so the script's version was not reviewed this run
• A transient network failure during one run was correctly classified network — retryable, not a hard failure

Risk

Does not protect against runtime compromise — 43% of the same incident set, including the most recent (node-ipc, 2026-05-14), which explicitly bypassed lifecycle scripts. For a global CLI invoked daily, "runtime" means every invocation. Also misses long-dwell compromise (event-stream, ~72 days), and a 2-day cooldown delays this host's own npm audit fix by 2 days. All three are stated in §22.