[9larsons]

What changed

• Added minimumReleaseAge: 4320 to enforce an explicit 72-hour dependency cooldown.
• Added strictDepBuilds: true so unapproved lifecycle scripts fail installation.
• Added blockExoticSubdeps: true so transitive dependencies cannot resolve from exotic Git or tarball sources.
• Preserved the existing package-wide dtrace-provider: false denial.
• Kept the build permission surface empty; there are no allowBuilds: true entries.
• Retained pnpm-workspace.yaml in the generated standalone source.zip so standalone installs receive the same policy.

Why

Source is consumed in two forms: Ghost updates it as a full git submodule, and Source releases a standalone theme archive. The submodule path already carries the root configuration, but the zip task explicitly removed pnpm-workspace.yaml, leaving the standalone artifact without the repository's dependency-install policy.

Both paths now retain the same explicit 72-hour and fail-closed pnpm controls without permitting any dependency lifecycle scripts.

This is the Source portion of PLA-321.

Impact

There is no theme runtime behavior change. Newly published dependencies wait 72 hours, unapproved build scripts fail installation, and exotic transitive sources are blocked. The standalone theme zip gains the small pnpm policy manifest; it continues to exclude pnpm-lock.yaml and other development-only files.

Validation

• corepack pnpm --version (11.19.0)
• Effective pnpm settings verified with pnpm config get
• corepack pnpm install --frozen-lockfile (751 lockfile entries passed supply-chain policy verification)
• corepack pnpm build
• corepack pnpm test:ci (zip generation and fatal gscan)
• Standalone fatal gscan after restoring tracked build artifacts
• Verified source.zip contains a byte-identical pnpm-workspace.yaml and excludes pnpm-lock.yaml
• Verified the effective allow map remains only dtrace-provider: false
• git diff --check

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The workspace configuration enables strict dependency builds, sets the minimum release age to 4320, and blocks exotic subdependencies. The zipper task now includes pnpm-workspace.yaml in the archive.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: aileen

Merge Risk: Minimal · up to 3b15c

No actionable merge-blocking risk remains from the reviewed changes.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts