[PR #477] [MERGED] fix: consolidate boundary ownership and cleanup failure paths #2020

New issue

Closed

opened 2026-10-16 21:13:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/477
Author: @morluto
Created: 9/8/2026
Status: ✅ Merged
Merged: 9/8/2026
Merged by: @morluto

Base: main ← Head: codex/consolidate-boundary-ownership

📝 Commits (1)

dcd3ba3 fix: consolidate boundary ownership and cleanup failure paths

📊 Changes

138 files changed (+2218 additions, -1779 deletions)

View changed files

📝 .github/pull_request_template.md (+1 -1)
📝 docs/architecture.mermaid (+1 -1)
📝 scripts/lib/managed-conformance-manifest.mjs (+1 -1)
📝 scripts/lib/managed-conformance-support.mjs (+1 -1)
➕ scripts/verify-package-platform.d.mts (+11 -0)
📝 scripts/verify-package-platform.mjs (+28 -8)
📝 scripts/verify-package-setup.mjs (+2 -2)
📝 scripts/verify-real-ghidra-assertions.mjs (+1 -1)
📝 scripts/verify-real-ghidra-windows.mjs (+1 -1)
📝 scripts/verify-real-ghidra.mjs (+1 -1)
📝 src/application/AbortablePromise.ts (+6 -2)
📝 src/application/ArtifactInventory/classify.ts (+5 -9)
📝 src/application/AuthorizedArtifactInventory.ts (+2 -2)
📝 src/application/BinarySessionOpen.ts (+2 -4)
➕ src/application/BinaryTargetResolver.ts (+293 -0)
📝 src/application/BoundedJsonFiles.ts (+47 -20)
📝 src/application/BrowserObservationService.ts (+2 -10)
📝 src/application/BrowserScenarioCaptureService.ts (+2 -10)
➕ src/application/ClientConfigurationDocument.ts (+36 -0)
📝 src/application/ClientRegistrationStatus.ts (+2 -8)

...and 80 more files

📄 Description

Summary

Consolidate duplicated boundary ownership and fix cleanup, configuration, and admission failures uncovered during a repository audit. This PR groups the related module moves with their callers and regression coverage. No issue is linked because this work was requested directly as a repository cleanup.

Problem and expected behavior

Concurrent writes must not overwrite a successful no-overwrite publication or remove a successor lock. Configuration inspection and mutation must agree on valid input. Failed reads, extraction commits, and replay preparation must release owned resources, and byte limits must apply to observed input.

Change and scope

Share configuration parsing and transactions across setup, doctor, and uninstall; remove obsolete overloads and handle valid nonfinite TOML values without JSON-canonicalization failures.
Give permission capabilities, permission-error projection, filesystem containment, Unicode ordering, ZIP signatures, managed metadata decoding, and MCP resource serialization canonical owners.
Move filesystem-backed binary resolution out of the domain layer, consolidate CLI observation wiring, and remove stale generated descriptions.
Serialize permission-store replacement, protect successor lock ownership, publish no-overwrite files atomically, and bound file/replay reads.
Close descriptor and temporary seccomp-file failure paths; remove duplicate extraction-root state.
Restore the documentation template fact and make package checks distinguish Linux prerequisites from integration idempotency.

Contract and boundary impact

Semantic owner and earliest changed stage: domain values remain pure; application workflows own resolution/configuration; shared process primitives own bounded descriptor reads.
CLI and MCP/tool-catalog contract: tool inventory and schemas preserved; policy CLI accepts all existing capability names. Generated managed-provider description updated.
Provider, bridge, target-format, or platform compatibility: bridge protocols unchanged; ZIP signature recognition rejects invalid byte combinations.
Evidence, artifact, provenance, or reconstruction contract: existing identities and provenance retained; Unicode ordering aligned between reference construction and validation.
Process execution, authorization, cleanup, or containment impact: fixes resource release, bounded reads, permission persistence, and lock ownership without granting additional authority.
Generated metadata (docs/product-catalog.json), package, or installation impact: no dependency or package-version changes; setup transaction and package-verifier corrections included.

Evidence and regression coverage

Tests added or updated: concurrent publication and locks, permission round trips, malformed configuration, TOML values, ZIP signatures, Unicode/path handling, byte admission, cancellation, descriptor cleanup, and seccomp cleanup.
Base reproduction or other evidence: regression failures were reproduced before fixes for concurrent publication, successor lock deletion, permission capability omissions, configuration failures, ZIP signatures, replay limits, and extraction/temporary-file cleanup. Metadata-read descriptor gaps are source-derived.
User-visible CLI/MCP output: canonical policy names previously omitted by the CLI are accepted; malformed configuration and failed writes retain actionable typed outcomes.
Remaining proof gaps: real provider execution and non-Linux runtime behavior were not verified. A process killed before publishing a prepared lock directory can still leave an unreferenced preparation directory.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run check:ci — passed on the accumulated changes.
Focused behavioral suites — passed for each cleanup batch.
npm test — earlier accumulated tree passed 1,745 tests in 351 files; the final full-tree rerun was interrupted and remains pending.
npm run docs:check — passed before the final seccomp and containment batches, with 238 existing TypeDoc warnings.
npm run verify:package — passed before the final reader, resource, and replay batches; final PR package validation remains pending.

Compatibility, safety, and release

Breaking changes or migration steps: none intended for CLI/MCP; obsolete internal overloads removed. Existing PID-file locks remain readable for recovery.
Real Hopper/Ghidra, browser, or OS coverage: local Linux tests only; real Hopper/Ghidra/browser/replay workflows were not run. The Linux host lacks Xvfb, and other native environments were not exercised.
Package or release metadata impact: no version or dependency changes.
Security, privacy, process, or containment review: permission, filesystem, lock, and resource-lifecycle changes received focused review. This remains a draft pending final integration validation.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output descriptions.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/477 **Author:** [@morluto](https://github.com/morluto) **Created:** 9/8/2026 **Status:** ✅ Merged **Merged:** 9/8/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/consolidate-boundary-ownership` --- ### 📝 Commits (1) - [`dcd3ba3`](https://github.com/morluto/rea/commit/dcd3ba3ebd8194c7e1732147754a4f61827b1140) fix: consolidate boundary ownership and cleanup failure paths ### 📊 Changes **138 files changed** (+2218 additions, -1779 deletions) <details> <summary>View changed files</summary> 📝 `.github/pull_request_template.md` (+1 -1) 📝 `docs/architecture.mermaid` (+1 -1) 📝 `scripts/lib/managed-conformance-manifest.mjs` (+1 -1) 📝 `scripts/lib/managed-conformance-support.mjs` (+1 -1) ➕ `scripts/verify-package-platform.d.mts` (+11 -0) 📝 `scripts/verify-package-platform.mjs` (+28 -8) 📝 `scripts/verify-package-setup.mjs` (+2 -2) 📝 `scripts/verify-real-ghidra-assertions.mjs` (+1 -1) 📝 `scripts/verify-real-ghidra-windows.mjs` (+1 -1) 📝 `scripts/verify-real-ghidra.mjs` (+1 -1) 📝 `src/application/AbortablePromise.ts` (+6 -2) 📝 `src/application/ArtifactInventory/classify.ts` (+5 -9) 📝 `src/application/AuthorizedArtifactInventory.ts` (+2 -2) 📝 `src/application/BinarySessionOpen.ts` (+2 -4) ➕ `src/application/BinaryTargetResolver.ts` (+293 -0) 📝 `src/application/BoundedJsonFiles.ts` (+47 -20) 📝 `src/application/BrowserObservationService.ts` (+2 -10) 📝 `src/application/BrowserScenarioCaptureService.ts` (+2 -10) ➕ `src/application/ClientConfigurationDocument.ts` (+36 -0) 📝 `src/application/ClientRegistrationStatus.ts` (+2 -8) _...and 80 more files_ </details> ### 📄 Description ## Summary Consolidate duplicated boundary ownership and fix cleanup, configuration, and admission failures uncovered during a repository audit. This PR groups the related module moves with their callers and regression coverage. No issue is linked because this work was requested directly as a repository cleanup. ## Problem and expected behavior Concurrent writes must not overwrite a successful no-overwrite publication or remove a successor lock. Configuration inspection and mutation must agree on valid input. Failed reads, extraction commits, and replay preparation must release owned resources, and byte limits must apply to observed input. ## Change and scope - Share configuration parsing and transactions across setup, doctor, and uninstall; remove obsolete overloads and handle valid nonfinite TOML values without JSON-canonicalization failures. - Give permission capabilities, permission-error projection, filesystem containment, Unicode ordering, ZIP signatures, managed metadata decoding, and MCP resource serialization canonical owners. - Move filesystem-backed binary resolution out of the domain layer, consolidate CLI observation wiring, and remove stale generated descriptions. - Serialize permission-store replacement, protect successor lock ownership, publish no-overwrite files atomically, and bound file/replay reads. - Close descriptor and temporary seccomp-file failure paths; remove duplicate extraction-root state. - Restore the documentation template fact and make package checks distinguish Linux prerequisites from integration idempotency. ## Contract and boundary impact - Semantic owner and earliest changed stage: domain values remain pure; application workflows own resolution/configuration; shared process primitives own bounded descriptor reads. - CLI and MCP/tool-catalog contract: tool inventory and schemas preserved; policy CLI accepts all existing capability names. Generated managed-provider description updated. - Provider, bridge, target-format, or platform compatibility: bridge protocols unchanged; ZIP signature recognition rejects invalid byte combinations. - Evidence, artifact, provenance, or reconstruction contract: existing identities and provenance retained; Unicode ordering aligned between reference construction and validation. - Process execution, authorization, cleanup, or containment impact: fixes resource release, bounded reads, permission persistence, and lock ownership without granting additional authority. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: no dependency or package-version changes; setup transaction and package-verifier corrections included. ## Evidence and regression coverage - Tests added or updated: concurrent publication and locks, permission round trips, malformed configuration, TOML values, ZIP signatures, Unicode/path handling, byte admission, cancellation, descriptor cleanup, and seccomp cleanup. - Base reproduction or other evidence: regression failures were reproduced before fixes for concurrent publication, successor lock deletion, permission capability omissions, configuration failures, ZIP signatures, replay limits, and extraction/temporary-file cleanup. Metadata-read descriptor gaps are source-derived. - User-visible CLI/MCP output: canonical policy names previously omitted by the CLI are accepted; malformed configuration and failed writes retain actionable typed outcomes. - Remaining proof gaps: real provider execution and non-Linux runtime behavior were not verified. A process killed before publishing a prepared lock directory can still leave an unreferenced preparation directory. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check:ci` — passed on the accumulated changes. - Focused behavioral suites — passed for each cleanup batch. - `npm test` — earlier accumulated tree passed 1,745 tests in 351 files; the final full-tree rerun was interrupted and remains pending. - `npm run docs:check` — passed before the final seccomp and containment batches, with 238 existing TypeDoc warnings. - `npm run verify:package` — passed before the final reader, resource, and replay batches; final PR package validation remains pending. ## Compatibility, safety, and release - Breaking changes or migration steps: none intended for CLI/MCP; obsolete internal overloads removed. Existing PID-file locks remain readable for recovery. - Real Hopper/Ghidra, browser, or OS coverage: local Linux tests only; real Hopper/Ghidra/browser/replay workflows were not run. The Linux host lacks Xvfb, and other native environments were not exercised. - Package or release metadata impact: no version or dependency changes. - Security, privacy, process, or containment review: permission, filesystem, lock, and resource-lifecycle changes received focused review. This remains a draft pending final integration validation. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output descriptions. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:26 +00:00