[PR #700] [MERGED] fix(comparison): break JSON shape collation ties #2180

New issue

Closed

opened 2026-10-16 21:15:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:20 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/700
Author: @kaoru0822-kitauji
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/json-shape-collation

📝 Commits (1)

805c338 fix(comparison): break JSON shape collation ties

📊 Changes

3 files changed (+358 additions, -1 deletions)

View changed files

📝 src/domain/jsonShape.test.ts (+79 -0)
📝 src/domain/jsonShape.ts (+7 -1)
➕ tests/boundary/browser/cdpJsonShapeComparison.test.ts (+272 -0)

📄 Description

Summary

Make JSON-shape property ordering deterministic when distinct paths have equal locale collation.

No separate issue: this is a reproduced producer-to-comparison correctness defect.

Problem and expected behavior

The distinct JSON keys "é" and "e\u0301" collate equally. Sorting only with localeCompare retains their input-dependent insertion order, so equivalent property permutations produce different shape arrays. The network comparator hashes those arrays and incorrectly reports a modified network record.

The capture contract is value-free shape evidence. These property names must stay distinct, while reordering identical path/type/count associations must not invent a shape difference.

Change and scope

Preserve the existing primary locale order and use the repository's compareCodePoints only as a tie-break. Preserve exact paths, types, observation counts, node counts and depth.

This does not normalize Unicode names, merge keys, or claim cross-locale ordering equivalence.

Contract and boundary impact

Semantic owner: approved JSON payload shape inference.
CLI/MCP: equivalent property permutations no longer create false network modifications; no schemas or tools change.
Provider/platform: no CDP protocol, admission or authority change.
Evidence/provenance: shape values remain discarded and distinct property identities remain intact. Corrected shape order may change derived identifiers for formerly input-dependent cases.
Process/authorization/cleanup: no new execution or data collection.
Generated metadata/package: unchanged.

Evidence and regression coverage

Baseline on main a6a8f67: 18 tests fail and 15 controls pass.

Tests feed synthetic CDP events with owned JSON inputs through production CdpCaptureEvents request ingestion and plain/base64 response ingestion, then validated normalized captures through compareWebCaptureEvidence and serialized Evidence parsing. All paired UTF-8 lengths are equal and every capture field outside body_shapes is deeply equal; raw body content/hashes are not confounding this comparison.

Equivalent inputs retain attach-limited unknown network coverage with zero changes. Genuine type changes, removing either distinct key and swapping their type associations remain modified. Domain cases include all three-key permutations, nested null/arrays, object arrays, escaped pointer names and unchanged non-tied locale order.

Validation performed

Regression plus adjacent browser network/sensitive-data/comparator suites: 49 tests passed across six files.
Build and npm run check: passed; all five tasks succeeded (101 warnings, no errors; none reference changed files).
npm run jscpd, npm run scan:todos, and git diff --check: passed.
Independent review completed before publication with no blocking findings.

Material verification limit

npm run verify:browser was attempted with installed Chromium. It aborted before CDP startup with process_singleton_posix socket() failed: Operation not permitted and SIGABRT; a second supported execution attempt had the same failure and a Crashpad ptrace denial. The Chrome sandbox remained enabled. No real-browser pass is claimed.

The existing real-browser workflow's path filters do not include these changed files, so ordinary hosted CI must not be mistaken for that separate lane.

Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Hosted CI is tracked separately; no full local suite pass is claimed.

Compatibility, safety, and release

No schema, dependency, packaging or execution-authority changes. Package-install and real Hopper/Ghidra lanes were not rerun for this JSON-shape correction.

Prepared with AI assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/700 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/json-shape-collation` --- ### 📝 Commits (1) - [`805c338`](https://github.com/morluto/rea/commit/805c338f360184d73ae335a723fca656830d6328) fix(comparison): break JSON shape collation ties ### 📊 Changes **3 files changed** (+358 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/jsonShape.test.ts` (+79 -0) 📝 `src/domain/jsonShape.ts` (+7 -1) ➕ `tests/boundary/browser/cdpJsonShapeComparison.test.ts` (+272 -0) </details> ### 📄 Description ## Summary Make JSON-shape property ordering deterministic when distinct paths have equal locale collation. No separate issue: this is a reproduced producer-to-comparison correctness defect. ## Problem and expected behavior The distinct JSON keys `"é"` and `"e\u0301"` collate equally. Sorting only with `localeCompare` retains their input-dependent insertion order, so equivalent property permutations produce different shape arrays. The network comparator hashes those arrays and incorrectly reports a modified network record. The capture contract is value-free shape evidence. These property names must stay distinct, while reordering identical path/type/count associations must not invent a shape difference. ## Change and scope Preserve the existing primary locale order and use the repository's `compareCodePoints` only as a tie-break. Preserve exact paths, types, observation counts, node counts and depth. This does not normalize Unicode names, merge keys, or claim cross-locale ordering equivalence. ## Contract and boundary impact - Semantic owner: approved JSON payload shape inference. - CLI/MCP: equivalent property permutations no longer create false network modifications; no schemas or tools change. - Provider/platform: no CDP protocol, admission or authority change. - Evidence/provenance: shape values remain discarded and distinct property identities remain intact. Corrected shape order may change derived identifiers for formerly input-dependent cases. - Process/authorization/cleanup: no new execution or data collection. - Generated metadata/package: unchanged. ## Evidence and regression coverage Baseline on main `a6a8f67`: 18 tests fail and 15 controls pass. Tests feed synthetic CDP events with owned JSON inputs through production `CdpCaptureEvents` request ingestion and plain/base64 response ingestion, then validated normalized captures through `compareWebCaptureEvidence` and serialized Evidence parsing. All paired UTF-8 lengths are equal and every capture field outside `body_shapes` is deeply equal; raw body content/hashes are not confounding this comparison. Equivalent inputs retain attach-limited `unknown` network coverage with zero changes. Genuine type changes, removing either distinct key and swapping their type associations remain modified. Domain cases include all three-key permutations, nested null/arrays, object arrays, escaped pointer names and unchanged non-tied locale order. ## Validation performed - Regression plus adjacent browser network/sensitive-data/comparator suites: 49 tests passed across six files. - Build and `npm run check`: passed; all five tasks succeeded (101 warnings, no errors; none reference changed files). - `npm run jscpd`, `npm run scan:todos`, and `git diff --check`: passed. - Independent review completed before publication with no blocking findings. ### Material verification limit `npm run verify:browser` was attempted with installed Chromium. It aborted before CDP startup with `process_singleton_posix socket() failed: Operation not permitted` and SIGABRT; a second supported execution attempt had the same failure and a Crashpad ptrace denial. The Chrome sandbox remained enabled. No real-browser pass is claimed. The existing real-browser workflow's path filters do not include these changed files, so ordinary hosted CI must not be mistaken for that separate lane. Node.js 24.19.0, npm 11.9.0, exact locked dependencies. Hosted CI is tracked separately; no full local suite pass is claimed. ## Compatibility, safety, and release No schema, dependency, packaging or execution-authority changes. Package-install and real Hopper/Ghidra lanes were not rerun for this JSON-shape correction. Prepared with AI assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:20 +00:00