sec-02 reproduction
Public source retained with the related article. Generated results, dependency directories, runtime storage, secrets, and oversized binary artifacts are intentionally excluded.
README
# SEC-02 Composer lockfile fixture
This fixture characterizes what Composer 2.10.2 reads from a lockfile and
which dependency decisions remain outside it. The synthetic packages,
repository, cache, and application are created inside the disposable
container.
Run:
```sh
./run.sh
```
The core profile covers locked selection, a repeatable malicious update,
archive checksum failure, root-manifest drift, root-script suppression, and
plugin refusal, approval, and suppression. It also proves that a final artifact
can change while the lockfile remains identical, and that advisory knowledge
can change while the lockfile does not. Partial-update authority is also
explicit: the direct update is a no-op until transitive updates are allowed.
The decision record keeps 12 dependency properties separate and retains the
vendoring or internal-mirror alternative. Eleven official source responses
retain their observations and hashes. Twenty-six semantic mutations reject the
planned dependency shortcuts. Clean-export reproduction remains the final
publication gate rather than an implied result.
After committing fixture changes, reproduce the complete gate from the selected
Git object:
```sh
./bin/run-clean-export.sh
```
The runner archives that commit into a temporary directory and retains the
resolved commit, result hashes, mutation count, output, and exit code.