[vincentkoc]

Qualify the upstream-synced engine against the public signed Bun repair series in openclaw/bun#221. The fifteen integration files retain the native proof owners, exact source/adapter identities, source restoration, complete namespace/proxy/stack accounting, and publication guards.

The engine source and upstream merge history from #34 and #46 are preserved. Qualification uses Bun 30f563c446f5c0ebb2d71d16ac985c22c037b53b, tree 5148dde801b8774f4b0fe610f310c89d708c75dd, with a measured artifact-manifest overlay. Shipping pins and release assets are unchanged.

Validation:

• Current-head Linux/native CI and ARM64 CI pass. Linux passes all 44 selected files, 91 namespace cases, the 85-file sync selection, four AOT compiler/runtime cases, and nine compile-cache exit cases.
• Runtime-cache migration verifies the pinned baseline format 36 and candidate format 52. Both candidate runs pass all 56 position checks; the warm run executes the marked cached output without replacing it.
• Native Darwin passes 53 selected files, including the sealing regression, and four AOT compiler/runtime cases. This remains exact Bun 30f563c / engine b801008 evidence. The subsequent three-file Linux cache-check repair leaves all production engine and Darwin control inputs identical; their identities were verified.
• Matched downstream qualification passes on the exact admitted Linux binary, without rebuilding it: OpenClaw's ten packaged-runtime steps and two SQLite cases; Birdclaw's twelve database/server cases and one CLI/server runtime iteration, preserving its logical database digest. Consumer revisions are frozen in the controls.
• Actual native Debug sealing proof reproduces three failures, then passes all five regression cases, 90 active namespace sibling cases and 102 hook cases. The only sibling skip is the unchanged root-only permission case. Node-hook Debug proof reproduces ten failures, then passes all 102 cases and 15 plugin-boundary cases.

Source/control reviews are scoped clean. Earlier full Debug timing failures remain recorded; these results do not claim an all-green full Debug suite. Bun's stock CI still needs a coherent immutable AOT artifact publication and shipping-manifest promotion before its separate merge. This PR does not publish a release.

[vincentkoc]

The terminal run41267060695 contains a concrete external-Node expectation mismatch. The unchanged Bun process test spawns node --version and expects bunEnv.BUN_TEST_NODE_VERSION ?? "v26.12.1"; this workflow installs Node 26.3.0. The retained candidate log reports expected v26.12.1, received v26.3.0. This is the host Node tool pin, not Bun's compiled process.versions.node or a reason to change the runtime.

The test already owns an explicit BUN_TEST_NODE_VERSION input. Align that test input with the admitted tool pin in the governed candidate test environment, preserve its provenance, and assess all other failed rows before making a product verdict. The retained proof still has faithfulness.passed=false and candidate runner status2; this finding does not establish that the Node assertion is its only failure. The29 unreported historical-baseline files remain gaps, not candidate regressions or passing observations.

The newer Bun sync remains a separate qualification target requiring matching AOT artifacts. No rerun or replacement of this PR's execution route was dispatched by this audit.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.