compat: classify preview dependency changes

[yhay81]

Context

The generated release index shows openclaw@2026.7.1-beta.5 with 56 direct dependencies, two more than stable 2026.6.11. Preview exists to surface this kind of change before it reaches latest.

Evidence: release history and upstream compatibility strategy.

Scope

Compare the exact stable and preview manifests and classify only the added or changed direct dependencies.

Acceptance criteria

• list each added or changed dependency with its exact declared spec;
• classify native-addon, lifecycle-script, Node built-in, network, and browser-capability risk;
• add a focused fixture or reusable report field when the classification can be automated;
• update the preview report or docs without copying runtime PASS evidence from stable;
• run npm run check.

A static classification must not turn any runtime check green.

[yhay81]

Progress is now available in draft PR #1 at commit d0a22fd and on the project page.

The tracker now preserves the exact declared direct-dependency specs in every stable/previous/preview report and derives machine-readable added, removed, and changed entries against stable. The current preview diff is:

• 2 added: @openclaw/ai@2026.7.1-beta.5, @silvia-odwyer/photon-node@0.3.4
• 16 changed specs
• 0 removed

The project page exposes the exact specs behind an explicit preview-manifest disclosure, and validation recomputes the index from the source reports. All runtime checks remain pending; static drift does not promote BrowserPod evidence.

This narrows, but does not close, #2. The remaining bounded contribution is to classify the added/changed packages for native addon, lifecycle script, Node built-in, network, and browser-capability risk, then automate only classifications supported by reproducible evidence.

[yhay81]

The remaining risk-classification acceptance criteria are now implemented in draft PR #1 at commit ba1cceb and published on the release ledger.

For all 18 added or changed preview dependencies, the tracker now:

• binds the declared spec to the shrinkwrap-resolved version and SHA-512;
• downloads the exact npm tarball with scripts disabled;
• rejects package identity, integrity, unsafe path, and inspection-budget drift;
• records lifecycle scripts, native/Wasm artifacts, Node built-ins, network API/package imports, source signals, and derived browser-capability signals;
• records scan completeness; the current 18 scans are all complete;
• preserves every BrowserPod runtime check as pending.

The generated preview summary currently reports package-level signals including filesystem (12), network (10), subprocess (7), native-code (2), install-script (1), and Wasm (4). These are review signals, not compatibility PASS claims.

I am leaving #2 open until draft PR #1 is reviewed/merged; no additional handwritten classification is required for the current preview snapshot.