RFC: install trust audit — classified fetch telemetry for package publishers

[davidnichols-ops]

Slimmed revision of #916. Drops all blocking modes (require/require-human) per technical review feedback. Ships audit-only: the registry classifies every tarball fetch as human, automation, or spam_user and emits a structured install-trust-check event. No fetch is ever blocked.

What changed from #916

• Removed: require and require-human modes, WebAuthn/biometric flows, CAPTCHA deprecation section, browser trust check page, UI mockups, token caching, 428/403 responses
• Kept: audit mode, classification taxonomy, event format, signal catalog
• Added: provenancePresent field in audit events — catches the Shai-Hulud/chalk pattern (new version loses provenance that prior versions had)
• Added: Explicit Rejected: blocking modes section documenting why require/require-human were dropped

Why audit-only

The technical review on #916 identified that blocking modes:

1. Do not address publish-side compromise (the actual 2025 incident pattern)
2. Introduce credential-caching attack surfaces
3. Break headless/SSH workflows disproportionately
4. Heuristic automation is not cryptographic proof (compromised CI is still CI)

Audit mode delivers the real value — publisher visibility into human vs automated traffic — at zero install-time cost.

Files

• accepted/0000-install-trust-audit.md — the proposal