deps: workspace:* -> file:, and witness a suite that is honestly still red

[SuperInstance]

What this does

1. Replaces the two workspace:* specs with file: specs, so npm install resolves at all.
2. Adds witness/ — the house hash-chained receipt ledger — for this repo's suite.

before	after
@quilt/core workspace:*	file:../quilt/packages/core
@quilt/ai workspace:*	file:../quilt-ai

Before

$ npm install
npm error code EUNSUPPORTEDPROTOCOL
npm error Unsupported URL Type "workspace:": workspace:*

After

$ npm install
up to date, audited 9 packages in 2s
found 0 vulnerabilities

⚠️ This repo's test suite is still red — and the witness says so

$ npm run build
tsconfig.json(16,25): error TS5108: Option 'moduleResolution=node10' has been removed.

$ npm test
Error: Command failed: npx tsc
-> the suite throws before its first assertion. 0 tests run.

$ npm run witness
files 1 / tests 0   <-- EXPECTED 13, MISMATCH
outcome fail — 0 tests / 0 pass / 0 fail across 1 files
FAILING FILES: test/evolve.test.js

The committed ledger records fail / 0. That is deliberate, not a regression.

Cause is the TypeScript pin, not the dependency specs. test/evolve.test.js builds its own dist on line 10 (execSync("npx tsc")) before asserting anything. This package declares typescript: "^7.0.2"; TypeScript 7 removed node10 module resolution, which tsconfig.json asks for. Pre-existing — reproduces on a pristine clone with the original workspace:* specs.

The proven fix — not applied here

option	result
"typescript": "^6.0.3"	tsc --noEmit -p tsconfig.json exits 0, and the suite then runs 13/13 passed
keep ^7, change moduleResolution	also works, larger semantic change

^6.0.3 is the idiom already used across the SuperInstance/quilt monorepo — packages/core, packages/tui, packages/mcp, packages/sdk all declare it. Both were verified; only this one is proposed, because it matches the house.

I did not land it: downgrading a toolchain major is a toolchain decision, not a dependency-spec decision. Once applied, npm run witness rewrites the ledger from fail/0 to pass/13; until then --verify correctly keeps reporting the drift. That is the system working, not the system broken.

Can file: express a cross-repo dependency?

No. file: is a filesystem path; it has no URL form, so it cannot name another repository. It installs only when the sibling checkout is present beside this one. Measured alternatives:

• git+https://… — does not work. npm 10.9.3 silently rewrites it to ssh://git@github.com/… and dies Permission denied (publickey), reproduced on a known-public repo (jonschlinkert/is-number) with no SSH key — npm's behaviour, not repo privacy. npm has no subdirectory fragment, so #packages/core isn't expressible either.
• "*" / bare semver — 404s; nothing named @quilt/* is published to npm.

This does not make the package publishable: npm does not rewrite file: at pack time, so a published manifest would carry an unresolvable spec. That decision stays Casey's. Nothing is renamed and nothing is published here.

The witness

Ported from SuperInstance/quilt-claw → witness/ledger.js (itself from AI-Writings → labs/situation-recorder/recorder.py). fnv1a-64, canonical JSON, GENESIS, chain rule, Ledger, verifyChain and the tamper self-test are byte-identical; cross-checked against quilt-claw on 8 vectors, all agreeing byte-for-byte.

Two things adapted, and only two:

• runFile reads this repo's own tally (=== 13/13 tests passed ===). Hand-rolled harness, not node:test — counting the runner's # tests would record 1 (one file) and witness a number this repo does not claim.
• EXPECTED = 13, not claw's 182.

A witness that could only ever be green would not be a witness.

Why a witness here

@quilt/evolve declares @quilt/core and @quilt/ai, while its own source defines a local interface instead of importing one:

/** A minimal AI engine interface (compatible with @quilt/ai's AIEngine). */

Left declared, deliberately: the phantom deps above are not removed — that is a semantic call about intended contract, not a mechanical one.

[SuperInstance]

Superseded by the scope-and-workspace-protocol branch. Closing so the surface shows one PR per change.