[stiwicourage]

Summary

• Complete the native PowerShellGet update path with exact target-version forwarding, installation-lock handoff, repository initialization, verification, and recovery safeguards.
• Support mixed flat and numeric-version module layouts without treating resource directories as installed module versions.
• Stabilize Linux process ownership checks and fail closed for legacy recovery receipts.
• Harden CI dependency provisioning with safe PSGallery initialization, bounded retries, isolated dependency validation, and expanded platform evidence.
• Declare Microsoft.PowerShell.PSResourceGet 1.2.0 as an exact PMU runtime dependency.
• Expand source-mirrored tests and update user, contributor, recovery, architecture, and release documentation.
• Needed to unblock reliable Gerber Core updates while preserving exact source, consent, rollback, and installation-verification contracts.
• Relates to Fix Core update discovery for mixed flat and versioned module installations #2 and follows the initial mixed-layout correction in Bug/2 fix core update discovery for mixed flat and versioned module installations #3.

Affected area

• Public PowerShell cmdlet behavior
• Scaffolding or project layout
• Build, test, analyzer, or CI behavior
• Release, changelog, or versioning flow
• Contributor documentation
• End-user documentation
• Command help
• Other

Review guidance

• Start with the native mutation and recovery path under src/private/provider/, src/private/transport/, and src/private/identity/.
• Review scripts/build/ci/ next for temporary PSGallery ownership, bounded retries, dependency isolation, and platform evidence.
• Verify project.json and tests/RuntimeDependency.Tests.ps1 together: PMU requires exactly PSResourceGet 1.2.0.
• The large test diff strengthens source-mirrored behavior, recovery, and CI contracts; production behavior must remain fail-closed.
• Known limitations remain explicit: provider-owned installation metadata is required, dotted prerelease labels are unsupported by the native installer, and no Force or install fallback is introduced.

Validation

• Invoke-NovaBuild
• Test-NovaBuild
• Targeted validation for the changed path
• Full repository quality loop
• Docs-only change; executable validation not needed

Validation notes:

Last completed branch validation:
- pwsh -NoLogo -NoProfile -File ./run.ps1
- PSScriptAnalyzer: 0 findings
- Unit tests: 827 passed
- Coverage: 96.64%
- Build-validation integration tests: 6 passed
- Clean isolated macOS PowerShell 7.4 and stable lanes passed with the expected pinned dependencies.

The final quality loop must be rerun after completing the current develop merge; the latest invocation was interrupted before completion.

Documentation and release follow-up

• README.md reviewed and updated if needed
• CONTRIBUTING.md reviewed and updated if needed
• CHANGELOG.md reviewed and updated if needed
• RELEASE_NOTE.md reviewed and updated if needed
• Command help updated if needed
• End-user docs updated if needed
• No documentation or release-note updates were needed

Maintainability, compatibility, and risk

• Maintainability impact considered
• No breaking change
• Breaking change
• CI or release impact

Risk, rollout, or rollback notes:

Publish PSModuleUpdate before publishing the Gerber version that raises its PMU minimum to 0.1.1. Confirm the published PMU package declares the exact PSResourceGet 1.2.0 dependency before continuing the Gerber release.

Existing locally copied module installations still require provider-owned metadata before native updates can run. Do not fabricate or copy provider metadata, bypass source validation, or introduce a Force/install fallback.

Rollback is performed by reverting this change set; do not publish Gerber against an unavailable PMU dependency.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codescene-access]

Gates Passed
6 Quality Gates Passed

See analysis details in CodeScene

Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codescene-access]

Code Coverage Gates Passed
Overall Coverage: 98.6% (required = 95%)
New & Changed Code Coverage: 99.2% (required = 99%)

Review details by gate

• Overall Coverage

  • Pass/Fail Reason:
    The overall coverage gate was checked for all code and meets the goal: 98.6% covered >= threshold = 95%
  • Action:
    You have 229 files with a sum of 1555 covered and 22 uncovered lines of code.

• New & Changed Code Coverage

  • Pass/Fail Reason:
    New or changed code meets coverage goal: 99.2% covered >= threshold = 99%
  • Action:
    You modified 212 files, and covered 1032 added/modified lines of code.