[PR #433] [MERGED] feat: add runtime reconstruction roadmap workflows #1982

New issue

Closed

opened 2026-10-16 21:13:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:04 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/433
Author: @morluto
Created: 7/24/2026
Status: ✅ Merged
Merged: 7/24/2026
Merged by: @morluto

Base: main ← Head: codex/roadmap-implementation

📝 Commits (10+)

205bf15 feat(process): support explicit stdin closure
8e7709d feat(analysis): add bounded memory and call tracing
d997728 feat(artifacts): add provider-neutral inspection
1ac3118 feat(browser): capture controlled Playwright scenarios
f27dd74 feat(browser): compare scenario and storage evidence
8271650 feat(runtime): add passive V8 Inspector observation
697be94 feat(javascript): compare source with shipped bundles
38c883b feat(javascript): recover runtime semantic effects
9d48ca7 feat(reconstruction): add obligation ledgers
38ff741 feat(reconstruction): evaluate end-to-end readiness

📊 Changes

269 files changed (+27097 additions, -1152 deletions)

View changed files

📝 .github/workflows/ci.yml (+45 -0)
📝 AGENTS.md (+13 -2)
📝 README.md (+64 -13)
📝 README_ar.md (+12 -11)
📝 README_ja.md (+12 -11)
📝 README_ko.md (+12 -11)
📝 README_zh.md (+12 -11)
📝 bridge/hopper_bridge.py (+142 -4)
📝 docs/browser-observation.md (+7 -6)
➕ docs/browser-scenario-contract.md (+80 -0)
📝 docs/javascript-application-workflows.md (+39 -11)
➕ docs/javascript-runtime-observation.md (+101 -0)
📝 docs/javascript-runtime-reconciliation.md (+14 -5)
📝 docs/mcp-contracts.md (+8 -2)
📝 docs/product-catalog.json (+83 -15)
➕ docs/reconstruction-obligation-ledgers.md (+333 -0)
➕ docs/reconstruction-readiness.md (+99 -0)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 package-lock.json (+13 -0)
📝 package.json (+5 -2)

...and 80 more files

📄 Description

Description

Implements the current reconstruction roadmap as one end-to-end, evidence-backed workflow spanning artifact triage, controlled browser/runtime observation, source comparison, semantic tracing, and release readiness.

adds provider-neutral artifact inspection and bounded call-path tracing
adds approval-gated Playwright scenario capture with exact replay, page/origin containment, bounded artifacts and events, deterministic normalization, and structural/accessibility/storage comparison
adds passive Node/Electron V8 Inspector observation and reconciles runtime scripts with static application graphs
adds source-to-bundle scoring, export-shape and semantic-effect comparison, and explicit uncertainty under incomplete evidence or limits
adds authenticated reconstruction-obligation ledgers, dependency closure, readiness reports, and the public CLI/MCP conformance journey
makes MCP tool availability capability- and policy-aware while keeping CLI and MCP contracts aligned

The implementation stays fail closed: sensitive storage fingerprints require separate approval, proof Evidence is bound to its obligation/case/verifier claims, attached browser scenarios reject active service-worker control, and truncated observations cannot produce exact equality or closure claims.

Type of Change

New feature
Bug fix
Refactoring
Documentation update
Tool contract change

Tool Contract Impact

The canonical catalog now contains 110 MCP tools and 6 prompts. New tool families cover artifact inspection, controlled browser scenarios, JavaScript runtime observation and reconciliation, source/bundle and semantic comparison, reconstruction obligation ledgers, and readiness reporting. Generated catalog and bundled-skill metadata are updated with the final schemas.

Verification

npm run check:pr — typecheck, lint (zero warnings), formatting, Knip, metadata, build, TypeDoc, and generated-document checks passed. The aggregate Vitest run passed 1,477/1,482 tests; five unrelated tests hit exact host-load timeouts/transient provider deadlines, and all five passed on immediate focused reruns on the unchanged tree.
focused changed-area runs — 90 browser/reconstruction/comparison tests and 85 follow-up boundary/runtime tests passed.
focused timeout reruns — hopperClient, electronMcp, processCaptureElicitation, productCatalog, and serverIdentity all passed.
npm run verify:package — passed against the packed artifact; 110 tools and 6 prompts.
real Chromium verification — passed with Chrome 149, including passive CDP, page-scoped transport, launch/attach scenario cleanup, non-default device scale, duplicate-origin storage seeds, screenshots, WebSockets, bundle analysis, and source maps.
Real Hopper and Ghidra verification were not run; this branch does not change either provider protocol or bridge.

Review Order

Browser scenario authority and capture boundaries in src/domain/browserScenario.ts and src/browser/PlaywrightScenario*.
JavaScript runtime, semantic, and source-comparison domain modules.
Reconstruction obligation and readiness evaluation in src/application/Reconstruction*.
Tool registration, CLI parity, generated catalog metadata, and verification scripts.

Closes #347.
Closes #348.
Closes #373.
Closes #374.
Closes #377.
Closes #378.
Closes #379.
Closes #380.
Closes #392.
Closes #397.
Closes #404.
Closes #405.
Closes #406.

Related to #361.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/433 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/24/2026 **Status:** ✅ Merged **Merged:** 7/24/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/roadmap-implementation` --- ### 📝 Commits (10+) - [`205bf15`](https://github.com/morluto/rea/commit/205bf1529bf0679095f817ef2bc82c9e8166a669) feat(process): support explicit stdin closure - [`8e7709d`](https://github.com/morluto/rea/commit/8e7709d35ae0ab49392418106b67c2eaa9ea82dc) feat(analysis): add bounded memory and call tracing - [`d997728`](https://github.com/morluto/rea/commit/d9977286f95090b5db3afab78573fa29841f7e90) feat(artifacts): add provider-neutral inspection - [`1ac3118`](https://github.com/morluto/rea/commit/1ac3118aa29d846c266edd1e8cd504c4707cf4df) feat(browser): capture controlled Playwright scenarios - [`f27dd74`](https://github.com/morluto/rea/commit/f27dd745b8e398bba544a97374eed9a45aa4b688) feat(browser): compare scenario and storage evidence - [`8271650`](https://github.com/morluto/rea/commit/82716509451fff1d0b1f91d8e9479b9c7d94ec20) feat(runtime): add passive V8 Inspector observation - [`697be94`](https://github.com/morluto/rea/commit/697be942e8780f3b94aaa6e9fd37432c0bb31b47) feat(javascript): compare source with shipped bundles - [`38c883b`](https://github.com/morluto/rea/commit/38c883bbc8a8d059ef21cdd85272e6f31a9ee45c) feat(javascript): recover runtime semantic effects - [`9d48ca7`](https://github.com/morluto/rea/commit/9d48ca788cacabb5bc329e9cc0467784359c5d6d) feat(reconstruction): add obligation ledgers - [`38ff741`](https://github.com/morluto/rea/commit/38ff7418efc3299150f3a8a1eab65e8314ef7aa3) feat(reconstruction): evaluate end-to-end readiness ### 📊 Changes **269 files changed** (+27097 additions, -1152 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+45 -0) 📝 `AGENTS.md` (+13 -2) 📝 `README.md` (+64 -13) 📝 `README_ar.md` (+12 -11) 📝 `README_ja.md` (+12 -11) 📝 `README_ko.md` (+12 -11) 📝 `README_zh.md` (+12 -11) 📝 `bridge/hopper_bridge.py` (+142 -4) 📝 `docs/browser-observation.md` (+7 -6) ➕ `docs/browser-scenario-contract.md` (+80 -0) 📝 `docs/javascript-application-workflows.md` (+39 -11) ➕ `docs/javascript-runtime-observation.md` (+101 -0) 📝 `docs/javascript-runtime-reconciliation.md` (+14 -5) 📝 `docs/mcp-contracts.md` (+8 -2) 📝 `docs/product-catalog.json` (+83 -15) ➕ `docs/reconstruction-obligation-ledgers.md` (+333 -0) ➕ `docs/reconstruction-readiness.md` (+99 -0) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `package-lock.json` (+13 -0) 📝 `package.json` (+5 -2) _...and 80 more files_ </details> ### 📄 Description ## Description Implements the current reconstruction roadmap as one end-to-end, evidence-backed workflow spanning artifact triage, controlled browser/runtime observation, source comparison, semantic tracing, and release readiness. - adds provider-neutral artifact inspection and bounded call-path tracing - adds approval-gated Playwright scenario capture with exact replay, page/origin containment, bounded artifacts and events, deterministic normalization, and structural/accessibility/storage comparison - adds passive Node/Electron V8 Inspector observation and reconciles runtime scripts with static application graphs - adds source-to-bundle scoring, export-shape and semantic-effect comparison, and explicit uncertainty under incomplete evidence or limits - adds authenticated reconstruction-obligation ledgers, dependency closure, readiness reports, and the public CLI/MCP conformance journey - makes MCP tool availability capability- and policy-aware while keeping CLI and MCP contracts aligned The implementation stays fail closed: sensitive storage fingerprints require separate approval, proof Evidence is bound to its obligation/case/verifier claims, attached browser scenarios reject active service-worker control, and truncated observations cannot produce exact equality or closure claims. ## Type of Change - [x] New feature - [x] Bug fix - [x] Refactoring - [x] Documentation update - [x] Tool contract change ## Tool Contract Impact The canonical catalog now contains 110 MCP tools and 6 prompts. New tool families cover artifact inspection, controlled browser scenarios, JavaScript runtime observation and reconciliation, source/bundle and semantic comparison, reconstruction obligation ledgers, and readiness reporting. Generated catalog and bundled-skill metadata are updated with the final schemas. ## Verification - `npm run check:pr` — typecheck, lint (zero warnings), formatting, Knip, metadata, build, TypeDoc, and generated-document checks passed. The aggregate Vitest run passed 1,477/1,482 tests; five unrelated tests hit exact host-load timeouts/transient provider deadlines, and all five passed on immediate focused reruns on the unchanged tree. - focused changed-area runs — 90 browser/reconstruction/comparison tests and 85 follow-up boundary/runtime tests passed. - focused timeout reruns — `hopperClient`, `electronMcp`, `processCaptureElicitation`, `productCatalog`, and `serverIdentity` all passed. - `npm run verify:package` — passed against the packed artifact; 110 tools and 6 prompts. - real Chromium verification — passed with Chrome 149, including passive CDP, page-scoped transport, launch/attach scenario cleanup, non-default device scale, duplicate-origin storage seeds, screenshots, WebSockets, bundle analysis, and source maps. - Real Hopper and Ghidra verification were not run; this branch does not change either provider protocol or bridge. ## Review Order 1. Browser scenario authority and capture boundaries in `src/domain/browserScenario.ts` and `src/browser/PlaywrightScenario*`. 2. JavaScript runtime, semantic, and source-comparison domain modules. 3. Reconstruction obligation and readiness evaluation in `src/application/Reconstruction*`. 4. Tool registration, CLI parity, generated catalog metadata, and verification scripts. ## Related Issues Closes #347. Closes #348. Closes #373. Closes #374. Closes #377. Closes #378. Closes #379. Closes #380. Closes #392. Closes #397. Closes #404. Closes #405. Closes #406. Related to #361. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:04 +00:00