fix(runner-e2e): refresh SDK public input pins after lockfile refresh (#20618)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - The Runner support suite checks the SDK public source pins in
`tests/runner-e2e/source-sdk-public-inputs.json`
> - The automated lockfile refresh #20615 changed `pnpm-lock.yaml` and
`tests/runner-e2e/report-lock.json`
> - It did not update the two lockfile values in the SDK pin registry
> - So `ci / Runner support suite` and `ci / verify` fail on every PR
and on master
> - This pull request refreshes those two values
> - The benefit is that PR CI is green again without a maintainer
override

## Linked Issues or Issue Description

Refs #20615. Refs #20550 (the same kind of resync).

**What happened?**
After #20615, the Runner support suite fails in
`source-sdk-public-inputs.test.mjs` ("source-sdk-public-inputs.json is
stale for 1 pinned input(s): pnpm-lock.yaml (changed)"). It also fails
in `source-sdk-evidence.test.ts` and `source-sdk-public-type.test.ts`
("Reviewed SDK reference policy does not match public proof").

**What did you expect?**
The pin registry matches the committed lockfile and the reviewed
report-lock policy, and the suite passes.

**Steps to reproduce**
On master `3bf7af6c77`, run `node
tests/runner-e2e/source-sdk-public-inputs.mjs $(git rev-parse HEAD)
--check`. It exits 1 with `"changed": true`.

## What Changed

- `inputs["pnpm-lock.yaml"]` is now the git blob of master's lockfile
(`6d825f97…`). I generated it with `node
tests/runner-e2e/source-sdk-public-inputs.mjs <HEAD> --write`.
- `lockSha256` is now `b3208306…`. This is the `outputSha256` in
`tests/runner-e2e/report-lock.json` after #20615, and the sha256 of the
committed lockfile. `source-sdk-reviewed-fixture.ts` requires these two
values to be equal.
- No other values change.

## Verification

- `node tests/runner-e2e/source-sdk-public-inputs.mjs $(git rev-parse
HEAD) --check` exits 0 with `"changed": false`.
- `shasum -a 256 pnpm-lock.yaml` equals `report-lock.json`
`outputSha256` and the new `lockSha256`.
- CI `ci / Runner support suite` on this PR runs the three failing test
files.

## Risks

Low risk. The change is test pin data only. It does not change product
code, the lockfile, or the report-lock policy.

## Model Used

- Claude Opus 5.5 (`claude-opus-5-5`), Anthropic, with tool use in
Claude Code.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
DottaandClaude Opus 5.5 authored and GitHub committed 2026-11-10 13:20:48 -06:00
1 parent 42d4499489
commit 161ee3b9a2

Diff Content Not Available