[PR #573] [MERGED] fix(conformance): preserve own JSON keys during comparison #2074

New issue

Closed

opened 2026-10-16 21:13:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:57 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/573
Author: @kaoru0822-kitauji
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: fix/conformance-preserve-json-keys

📝 Commits (1)

78a1703 fix(conformance): preserve own JSON keys during comparison

📊 Changes

3 files changed (+91 additions, -5 deletions)

View changed files

📝 src/domain/conformanceTrustGate.ts (+5 -5)
📝 tests/conformance/providers/conformanceReplay.test.ts (+50 -0)
📝 tests/conformance/providers/conformanceTrustGate.test.ts (+36 -0)

📄 Description

Summary

Preserve every own JSON key when comparing structured conformance dimensions. An own __proto__ field was silently discarded during recursive key sorting, allowing different captured values to produce a passing trust gate.

Found during a repository audit; no existing issue describes this comparison error.

Problem and expected behavior

JSON can contain a data field named __proto__. The comparator copied sorted fields into {} with assignment, which invokes the inherited prototype setter for this key instead of retaining the data field. For example, comparing {"__proto__":{"version":1}} with {"__proto__":{"version":2}} returned match. Adding that field to captured replay data also failed to report drift.

All own JSON fields must participate in semantic comparison, including inside nested arrays and objects.

Change and scope

Build sorted objects with Object.fromEntries, which retains own data properties.
Add regressions for changed object/string values, an added null-valued key, nested arrays/objects, constructor/prototype controls, input preservation, and key-order equivalence.
Exercise the package replay path and verify failed trust-gate status, drift detection, and the observed Evidence citation.

The scope is values reaching the comparison and captured-replay boundary. Earlier jsonValueSchema normalization can separately discard __proto__; this PR does not change that schema or claim complete JSON round-trip preservation.

Contract and boundary impact

Semantic owner: conformance comparison's recursive key normalization.
CLI/MCP/tool inventory and schemas: unchanged.
Provider, bridge, target-format, platform, execution, authorization, or cleanup behavior: unchanged.
Evidence and reconstruction: changed own-key data now produces a mismatch/drift witness while retaining existing source citations.
Generated metadata and packaging: no changes required.

Evidence and regression coverage

On current base c6d3bdf597d9cd75a6f7396236e1a47f5ee4288d, five new regressions fail: four direct comparisons incorrectly match, and package replay incorrectly reports no drift. Existing tests and ordinary-property/key-order controls pass.

Independent review found no correctness issue and checked 4,761 comparison pairs against a separate reference, 69 reordered equivalents, trust-gate propagation, and unchanged Object.prototype.

Validation performed

Focused conformance trust-gate, replay, and package suites: 44 tests passed.
npm run check:ci: passed all seven static tasks.
npm run docs:check: passed; TypeDoc reported 218 existing warnings and no errors.
npm run verify:package: passed the Linux package/install, CLI, and MCP verifier.
npm pack --dry-run --json: passed.
git diff --check: passed.
npm run check:pr: static stages passed; full deterministic suite reported 1,983 passed, 40 failed, and 2 skipped. All 40 failures across the same seven native bridge suites reproduce on unchanged current base c6d3bdf. This execution environment rejects Unix-domain socket listeners with EPERM, causing bridge-startup failures/timeouts. No tests or permission checks were relaxed.

Compatibility, safety, and release

No breaking schema or migration changes. No broad security claim is made; this repairs loss of data during comparison. No real Hopper/Ghidra verification was performed because provider behavior is unchanged. Package verification establishes its narrower package/integration claims.

Review checklist

One focused outcome with a Conventional Commit title.
Baseline failure and passing regression coverage.
Independent code review completed.
Earlier normalization limitation disclosed.
Diff checked for unrelated changes and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/573 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/conformance-preserve-json-keys` --- ### 📝 Commits (1) - [`78a1703`](https://github.com/morluto/rea/commit/78a17038c11c5d94f2ceb3c614bdf0319d982f16) fix(conformance): preserve own JSON keys during comparison ### 📊 Changes **3 files changed** (+91 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/conformanceTrustGate.ts` (+5 -5) 📝 `tests/conformance/providers/conformanceReplay.test.ts` (+50 -0) 📝 `tests/conformance/providers/conformanceTrustGate.test.ts` (+36 -0) </details> ### 📄 Description ## Summary Preserve every own JSON key when comparing structured conformance dimensions. An own `__proto__` field was silently discarded during recursive key sorting, allowing different captured values to produce a passing trust gate. Found during a repository audit; no existing issue describes this comparison error. ## Problem and expected behavior JSON can contain a data field named `__proto__`. The comparator copied sorted fields into `{}` with assignment, which invokes the inherited prototype setter for this key instead of retaining the data field. For example, comparing `{"__proto__":{"version":1}}` with `{"__proto__":{"version":2}}` returned `match`. Adding that field to captured replay data also failed to report drift. All own JSON fields must participate in semantic comparison, including inside nested arrays and objects. ## Change and scope - Build sorted objects with `Object.fromEntries`, which retains own data properties. - Add regressions for changed object/string values, an added null-valued key, nested arrays/objects, `constructor`/`prototype` controls, input preservation, and key-order equivalence. - Exercise the package replay path and verify failed trust-gate status, drift detection, and the observed Evidence citation. The scope is values reaching the comparison and captured-replay boundary. Earlier `jsonValueSchema` normalization can separately discard `__proto__`; this PR does not change that schema or claim complete JSON round-trip preservation. ## Contract and boundary impact - Semantic owner: conformance comparison's recursive key normalization. - CLI/MCP/tool inventory and schemas: unchanged. - Provider, bridge, target-format, platform, execution, authorization, or cleanup behavior: unchanged. - Evidence and reconstruction: changed own-key data now produces a mismatch/drift witness while retaining existing source citations. - Generated metadata and packaging: no changes required. ## Evidence and regression coverage On current base `c6d3bdf597d9cd75a6f7396236e1a47f5ee4288d`, five new regressions fail: four direct comparisons incorrectly match, and package replay incorrectly reports no drift. Existing tests and ordinary-property/key-order controls pass. Independent review found no correctness issue and checked 4,761 comparison pairs against a separate reference, 69 reordered equivalents, trust-gate propagation, and unchanged `Object.prototype`. ## Validation performed - Focused conformance trust-gate, replay, and package suites: 44 tests passed. - `npm run check:ci`: passed all seven static tasks. - `npm run docs:check`: passed; TypeDoc reported 218 existing warnings and no errors. - `npm run verify:package`: passed the Linux package/install, CLI, and MCP verifier. - `npm pack --dry-run --json`: passed. - `git diff --check`: passed. - `npm run check:pr`: static stages passed; full deterministic suite reported 1,983 passed, 40 failed, and 2 skipped. All 40 failures across the same seven native bridge suites reproduce on unchanged current base `c6d3bdf`. This execution environment rejects Unix-domain socket listeners with `EPERM`, causing bridge-startup failures/timeouts. No tests or permission checks were relaxed. ## Compatibility, safety, and release No breaking schema or migration changes. No broad security claim is made; this repairs loss of data during comparison. No real Hopper/Ghidra verification was performed because provider behavior is unchanged. Package verification establishes its narrower package/integration claims. ## Review checklist - [x] One focused outcome with a Conventional Commit title. - [x] Baseline failure and passing regression coverage. - [x] Independent code review completed. - [x] Earlier normalization limitation disclosed. - [x] Diff checked for unrelated changes and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:57 +00:00