What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	15645
title	Track harness/package-lock.json for reproducible Electron toolchain installs
state	Closed
labels	aibuild
assignees	[]
createdAt	Jul 21, 2026, 7:45 PM
updatedAt	Jul 21, 2026, 11:07 PM
githubUrl	https://github.com/neomjs/neo/issues/15645
author	neo-kimi-phoebe
commentsCount	0
parentIssue	null
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
contentTrust
projected
quarantined	0
signals	[]
blockedBy	[]
blocking	[]
closedAt	Jul 21, 2026, 11:07 PM

Track harness/package-lock.json for reproducible Electron toolchain installs

Closed Backlog/active-chunk-8 aibuild

neo-kimi-phoebe commented on Jul 21, 2026, 7:45 PM

Context

harness/package.json (the Electron packaging root, #14962 under #13377) declares electron exact-pinned (43.1.0) but leaves the packaging toolchain on semver ranges: electron-builder ^26.0.12, @electron/rebuild ^4.0.1, cross-env ^10.1.0. Without a tracked lockfile, npm install inside harness/ resolves those ranges fresh every time — non-reproducible builds of the shell, the exact drift class you do not want in a packaging pipeline (builder/rebuild versions change bundling, native-module rebuild, and artifact behavior).

The root repo already tracks package-lock.json for the same reason. harness/ has a real 148K lockfile generated by normal installs — currently untracked, so npm ci cannot work there.

Live latest-open sweep: checked latest 20 open issues at 2026-07-21 ~17:45Z; no equivalent found. A2A in-flight claim sweep (last 60 min): no competing claim.

The Problem

Fresh checkouts and CI cannot install the harness toolchain reproducibly; two agents can build the shell with different builder/rebuild versions on the same day and get different artifacts.

The Fix

Track harness/package-lock.json (verified coherent with harness/package.json: npm ls --depth 0 resolves @electron/rebuild@4.2.0, cross-env@10.1.0, electron-builder@26.15.3, electron@43.1.0) and use npm ci in harness install documentation/automation.

Contract Ledger Matrix

Target Surface	Source of Authority	Proposed Behavior	Fallback	Docs	Evidence
`harness/package-lock.json`	`harness/package.json` + npm lockfile v3	Commit the complete resolved Electron packaging dependency graph; declarations remain unchanged	Regenerate deliberately with npm only when dependencies change; normal installs use `npm ci`	`harness/README.md`	lock-root/spec comparison + `npm ci --dry-run`
`harness/README.md` install recipe	the nested `harness/` package root	Use root `npm install`, then harness-local `npm ci`	`npm install` is reserved for intentional lock refreshes	the file itself	exact-head README diff

Acceptance Criteria

harness/package-lock.json tracked on dev
npm ci succeeds in harness/ from a clean node_modules
Harness docs/scripts that install reference npm ci (whichever of harness/README.md / pack scripts mention install)

Out of Scope

Root-level workspace hoisting of the harness deps (separate architecture question — workspaces vs. nested package)
Any dependency version changes (the existing lockfile pins stay)

Origin Session ID: d8a51237-4fcc-4171-8071-a391da0be361

Retrieval Hint: "harness package-lock electron-builder reproducible npm ci"