Activate native audit and traverse production dependencies by resolved package

Refs #66, #703, #709.

Strict native Home audit still routes to Pantry instead of the copied owned AuditCommand. The complete unchanged original bun-audit.test.ts reports 4 pass / 12 fail in runtime a4b73596f5ac51e1a59e330caa5a431becfa04bc; pinned Bun passes 16/16. The four Pantry-route passes are not native audit feature credit. Sources and snapshots remain unchanged. Both complete outputs and JUnit are retained.

A separate real installed-graph control reproduces a logical bug in pinned Bun's production audit: production-parent -> bridge@1 -> production-leaf and development-parent -> bridge@2 -> development-leaf result in --prod audit sending BOTH bridge versions to the registry. The copied traversal keys by package name; this also risks omitting distinct children when multiple production versions share a name. Shared upstream failure is not accepted as logical parity.

Native activation and package-ID traversal are pushed in 7b8877ee1; expanded regression coverage in 91495b738. The build is running. Native audit now uses Home's existing output color policy rather than unconditionally inserting ANSI escapes.

• Build the native activation and retain initial original/control failures.
• Pass the complete original audit file without changing source/snapshots or deadlines.
• Verify real POST/gzip JSON payload, bearer/basic authorization, JSON/text reports, severity/ignore filtering, invalid JSON and HTTP failure handling.
• Verify exact production package versions, traversal of both production versions, and exclusion of workspace dev-only edges using actual installed lockfiles.
• Preserve lockfile bytes; run adjacent native package regressions and publish evidence.

Current raw evidence is outside the disposable worktree under zig-out/bun-port-recovery (symlink into Git metadata): native-audit-before/manifest.json, audit-production-before.log, and audit-protocol-pinned-control.mjs. No live user registry credentials are used: the protocol regression uses a loopback fixture registry and explicit synthetic fixture credentials. macOS arm64 execution is available; platform-wide and full-suite completion remain open.

Native audit activation and resolved-package production traversal are pushed in 7b8877ee1/91495b738. Initial production compilation found a dormant u32 audit result vs u8 process exit mismatch; f2bbead95 adds the checked conversion. The corrected build is running.

The complete original audit comparison (Home Pantry route 4 pass/12 fail, pinned Bun 16/16) and the real installed-graph pinned Bun failure (development-only bridge@2 included in production request) are retained in 13 committed artifacts, published in cdcfeabfb. Reported Pantry-route passes do not count as native activation. The new private regression checks three production graph configurations, real gzip POST payloads, both auth forms, reports/filtering/error handling and lock preservation. Runtime verification remains pending. Refs #66, #720.

Runtime f2bbead95 builds 46/46; all seven native private regressions pass, including production-version payloads, both production branches, workspace dev filtering, gzip POST/auth, response/filter/error handling and lock preservation. Original link cases remain 11/11 per runtime. Original audit is Home 15/16, pinned Bun 16/16, with source/snapshots unchanged.

The remaining original failure is an omitted insertion-ordered report map already present in the pinned Rust implementation. A separate real Home/Bun control also proves a logical reporting defect: audit --prod prints development-parent › bridge even though that path resolves bridge@2 and the advisory affects only bridge@1. Home's request payload is already correct; reporting still used the older name-based graph.

13fda557c ports insertion order and traces actual resolved package IDs matching the advisory semver range, honors production reachability, merges distinct affected-version paths, preserves intermediate workspace path components, and releases path allocations. The expanded private regression checks those behaviors. Build is pending. 44 committed artifacts retain activation, report failures, controls, and the first compile failure.

Disk admission stopped the report build before compilation at 6612 MB free. I removed 12 obsolete generated executable/object cache directories in this worktree, preserving the current executable and all source/evidence, recovered to about 10 GiB, and started a fresh guarded build. Cleanup metadata and admission failure are preserved. Refs #66, #720; full port remains incomplete.

Verified and pushed runtime 952744932, cycle regression 8c8c57740, and final evidence 3ff5c660a, as Chris Breuer without coauthors. Build 46/46. All seven native private regression files pass; original link/binlink 11/11 per runtime. The audit fixture exercises real installed cycles, version-specific production reachability, workspace paths, advisory ranges, actual gzip POST/authentication, filters/errors and unchanged locks.

Original audit: Home 15/16; pinned Bun 16/16, each with 16 JUnit cases and unchanged original sources/snapshots. The snapshot now differs by exactly one line: its expected csrf/uid-safe@2.1.4 -> base64-url edge does not exist in the pinned fixture. Home's express-session -> uid-safe@2.0.0 -> base64-url@1.2.1 path is valid. All other representative paths match. This remains a recorded original failure, with no snapshot rewrite or fabricated dependency edge. #720/#721 remain open; full parity remains incomplete under #66.

Baseline · 38 final build/test artifacts · pinned edge proof. Generated fixture data was archived/inventoried and removed.