[PR #95] [MERGED] feat!: add evidence-safe process capture v4 and native DMG traversal #1833

New issue

Closed

opened 2026-10-16 21:11:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:11:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/95
Author: @morluto
Created: 7/13/2026
Status: ✅ Merged
Merged: 7/13/2026
Merged by: @morluto

Base: main ← Head: codex/process-capture-v4

📝 Commits (8)

ee4d284 feat(process): introduce evidence-safe capture v4
24d000a feat(artifacts): add approved native DMG traversal
aca518b docs: document capture v4 and native mounts
ac78de0 fix(process): harden capture validation and cleanup
c8d762e refactor(artifacts): simplify inventory traversal
07e1b5a refactor(setup): split setup and CLI registration
f0a9a3c docs(skill): document capture v4 and DMG mounts
19bb231 fix(ci): remove redundant process exports

📊 Changes

43 files changed (+2689 additions, -1246 deletions)

View changed files

📝 README.md (+4 -4)
📝 docs/process-capture.md (+19 -2)
📝 skills/rea-analysis/SKILL.md (+19 -4)
📝 src/application/ArtifactInventory.ts (+137 -68)
📝 src/application/CommandShimReplay.ts (+2 -0)
📝 src/application/EvidenceBundleFiles.ts (+12 -1)
➕ src/application/ProcessCaptureAuthority.ts (+48 -0)
➕ src/application/ProcessCaptureCapability.ts (+38 -0)
➕ src/application/ProcessCaptureError.ts (+6 -0)
➕ src/application/ProcessCaptureLifecycle.ts (+417 -0)
📝 src/application/ProcessCli.ts (+10 -6)
📝 src/application/ProcessEvidence.ts (+11 -8)
📝 src/application/ProcessHarness.ts (+304 -476)
📝 src/application/ProcessOwnership.ts (+41 -0)
📝 src/application/Setup.ts (+71 -96)
➕ src/application/SetupSkill.ts (+55 -0)
📝 src/application/runtime.ts (+1 -1)
📝 src/artifacts/ArtifactProvider.ts (+16 -5)
➕ src/artifacts/NativeDmgArtifactReader.ts (+227 -0)
📝 src/cli.ts (+55 -48)

...and 23 more files

📄 Description

Summary

replace Process Capture v3 with the evidence-safe v4 manifest, settlement, validation, comparison, and agent-facing recapture guidance
add explicitly approved, policy-gated native macOS DMG traversal with nested ASAR integrity checks and owned cleanup
preserve CLI/MCP behavior and the existing 68-tool inventory
modularize process, artifact, setup, and CLI paths to clear all lint warnings without rule suppressions

Verification

npm run check
npm run verify:package
final full npm test: 355 tests passed across 57 files
packaged MCP inventory: 68 tools

Real Hopper verification was not run because these changes make no new Hopper claims.

BREAKING CHANGE: Process Capture v3 inputs are no longer accepted. Agents and users receive actionable guidance to recapture with Process Capture v4.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/95 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/13/2026 **Status:** ✅ Merged **Merged:** 7/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/process-capture-v4` --- ### 📝 Commits (8) - [`ee4d284`](https://github.com/morluto/rea/commit/ee4d284597a32b4acc4279b74083d9bf4e32d08b) feat(process): introduce evidence-safe capture v4 - [`24d000a`](https://github.com/morluto/rea/commit/24d000a76e3fb98c69d47ab26ac1322a4c87f901) feat(artifacts): add approved native DMG traversal - [`aca518b`](https://github.com/morluto/rea/commit/aca518bb885825b912567eba95eb64a776a5624c) docs: document capture v4 and native mounts - [`ac78de0`](https://github.com/morluto/rea/commit/ac78de0a74b09a01efd91d9f88a16fde4f0ed9d9) fix(process): harden capture validation and cleanup - [`c8d762e`](https://github.com/morluto/rea/commit/c8d762e6ffe0a2e23fb539590d7b1850ef1ce2a7) refactor(artifacts): simplify inventory traversal - [`07e1b5a`](https://github.com/morluto/rea/commit/07e1b5ac5f6a1724b1064c47ea05f04ccffcb4f3) refactor(setup): split setup and CLI registration - [`f0a9a3c`](https://github.com/morluto/rea/commit/f0a9a3cd258d60046dcd74feea243956489c60dc) docs(skill): document capture v4 and DMG mounts - [`19bb231`](https://github.com/morluto/rea/commit/19bb2317d1bd6773e5fa3f61e32cbf3d6d257830) fix(ci): remove redundant process exports ### 📊 Changes **43 files changed** (+2689 additions, -1246 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+4 -4) 📝 `docs/process-capture.md` (+19 -2) 📝 `skills/rea-analysis/SKILL.md` (+19 -4) 📝 `src/application/ArtifactInventory.ts` (+137 -68) 📝 `src/application/CommandShimReplay.ts` (+2 -0) 📝 `src/application/EvidenceBundleFiles.ts` (+12 -1) ➕ `src/application/ProcessCaptureAuthority.ts` (+48 -0) ➕ `src/application/ProcessCaptureCapability.ts` (+38 -0) ➕ `src/application/ProcessCaptureError.ts` (+6 -0) ➕ `src/application/ProcessCaptureLifecycle.ts` (+417 -0) 📝 `src/application/ProcessCli.ts` (+10 -6) 📝 `src/application/ProcessEvidence.ts` (+11 -8) 📝 `src/application/ProcessHarness.ts` (+304 -476) 📝 `src/application/ProcessOwnership.ts` (+41 -0) 📝 `src/application/Setup.ts` (+71 -96) ➕ `src/application/SetupSkill.ts` (+55 -0) 📝 `src/application/runtime.ts` (+1 -1) 📝 `src/artifacts/ArtifactProvider.ts` (+16 -5) ➕ `src/artifacts/NativeDmgArtifactReader.ts` (+227 -0) 📝 `src/cli.ts` (+55 -48) _...and 23 more files_ </details> ### 📄 Description ## Summary - replace Process Capture v3 with the evidence-safe v4 manifest, settlement, validation, comparison, and agent-facing recapture guidance - add explicitly approved, policy-gated native macOS DMG traversal with nested ASAR integrity checks and owned cleanup - preserve CLI/MCP behavior and the existing 68-tool inventory - modularize process, artifact, setup, and CLI paths to clear all lint warnings without rule suppressions ## Verification - npm run check - npm run verify:package - final full npm test: 355 tests passed across 57 files - packaged MCP inventory: 68 tools Real Hopper verification was not run because these changes make no new Hopper claims. BREAKING CHANGE: Process Capture v3 inputs are no longer accepted. Agents and users receive actionable guidance to recapture with Process Capture v4. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:11:35 +00:00