PhiOS v0.67: provenance and license-evidence census for pinned frontends

[MichaelWave369]

Draft, evidence-only. Adds a strictly read-only installed-npm dependency census for pinned Vessie and ThinkTank CI checkouts, rooted in the same SHA-verified source and npm lockfiles as v0.65/v0.66. Enumerates installed (including nested/scoped) packages; rejects undeclared package folders, symlinks, package-version mismatches, and missing required entries; records lock integrity, declared license metadata, and SHA-256/length of root LICENSE/NOTICE/COPYING etc. files. Creates a deterministic per-app component manifest and explicit human-review queue for missing/ambiguous evidence. Works within the existing clean npm ci + two-build reproducibility CI; retains bounded JSON receipts. No license clearance, attribution sign-off, redistribution, vulnerability audit, installation, models, physical airgap or external DONE. Hold merge until CI and operator review; existing PhiOS qualification remains independent.

[MichaelWave369]

v0.67: exact-head dependency/license-evidence receipts

Reviewed PR head: b04036d7ecbe336f9533384eb0de243f77f05d70. Locked-dependency audit, two-clean-build workflow: SUCCESS. Artifact: phios-v067-frontends-provenance contains the full JSON ledgers and prior locked-build receipts. The first attempt failed on a hidden build-cache directory; the corrective commit audits immediately after npm ci and before Vite runs, retaining the hidden-entry rejection. New run: all license-inventory tests, both real package censuses and independent build-replay comparisons PASS.

Vessie: 21 installed Linux npm packages; 50 optional platform packages absent by design; 3 packages queued for legal evidence review: @esbuild/linux-x64@0.25.12, @napi-rs/lzma-linux-x64-gnu@1.5.1, @rollup/rollup-linux-x64-gnu@4.64.5. ThinkTank: 46 installed Linux npm packages; 25 optional platform packages absent; 1 flagged: @rolldown/binding-linux-x64-gnu@1.2.13.

These four installed package manifests all declare MIT, but do not include a root-level LICENSE/NOTICE/COPYING file in their npm installation; follow the canonical upstream license and any attribution/notice requirements before redistribution. They are not automatic license violations. Every installed package path/version was checked against the exact PhiOS-owned reviewed lockfile and a per-app deterministic SHA-256 component ledger was produced. The two same-runner clean-build output sets remained byte-identical.

Explicit holds: No legal/license clearance, complete binary SBOM, vulnerability audit, production install, model access, cross-platform optional package review, or external DONE. The full PhiOS qualification/image-build workflow is independent and must finish green before founder review/merge. Ledger Above Ego. DONE Means Verified.