[PR #862] [MERGED] build: verify resolved module boundaries #2298

New issue

Closed

opened 2026-10-16 21:16:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:55 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/862
Author: @N0zoM1z0
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: build/resolved-module-boundaries

📝 Commits (1)

959c24b build: verify resolved module boundaries

📊 Changes

10 files changed (+365 additions, -141 deletions)

View changed files

📝 .oxlintrc.json (+0 -122)
📝 docs/capability-migration.md (+15 -0)
📝 package.json (+4 -3)
➕ scripts/lib/module-boundaries.d.mts (+18 -0)
➕ scripts/lib/module-boundaries.mjs (+100 -0)
➕ scripts/verify-module-boundaries.mjs (+56 -0)
📝 tests/boundary/browser/browserObservationService.test.ts (+6 -6)
📝 tests/boundary/providers/managed/managedMemberComparisonFromMetadata.test.ts (+3 -3)
📝 tests/boundary/providers/managed/managedMemberComparisonPartialBodies.test.ts (+3 -3)
📝 tests/evaluation/moduleBoundaries.test.ts (+160 -4)

📄 Description

Summary

Check resolved source ownership before the capability folder moves in #740. This replaces overlapping import globs that misclassified nested pure capability directories and allowed test overrides to mask forbidden provider dependencies.

Problem and expected behavior

domain/android must remain pure domain code, while an import of the adapter at src/android must be rejected. The guard must inspect actual import syntax and normalized local paths rather than a provider name anywhere in the raw specifier. The new gate exposed five masked provider imports across three producer-dependent tests.

Rebased onto the newly merged JavaScript recovery implementation to resolve configuration conflicts; its construction restrictions and verification command remain intact.

Change and scope

Parse static/type/reexport/import-type/import-equals/literal dynamic imports using existing Babel dependencies. Resolve local paths and module URLs before checking settled layer ownership.
Check Git-owned tracked and untracked non-ignored source; skip cached paths removed during a move. Report the importing file, line, original specifier, resolved target and failed boundary.
Run with npm lint/lint:fix and existing cached static gates. Preserve the exact binary-runtime exception, admitted shared browser utilities and Oxlint test-lane restrictions.
Move the browser and managed PE comparison tests into boundary lanes, preserving their assertions and fixtures.

Contract and boundary impact

Semantic owner and earliest changed stage: development-time source dependency checks.
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: unchanged; construction guards remain scoped to the already migrated adapters.
Evidence, artifact, provenance, or reconstruction contract: none.
Process execution, authorization, cleanup, or containment impact: no production change or user-facing permission flow.
Generated metadata, package, or installation impact: generated outputs and package contents unchanged; no dependency or Turbo configuration change.

Evidence and regression coverage

54 guard probes cover nested pure folders and forbidden counterparts, real CLI failures, AST forms, encoded module URLs, native absolute paths/file URLs, malformed source, invalid arguments and untracked/removed source discovery.
All 9 moved producer-dependent behavior cases passed with unchanged assertions.
The real source scan reproduced the five previously masked imports before reclassification; it now checks 1,054 source files successfully.
User-visible output: not applicable.
Remaining proof gaps: extra production entrypoint checks reached their unchanged 15-second deadlines on this loaded, two-CPU local lane. Each Linux case also completed within the original deadline in isolated runs, and an equivalent standalone SDK sequence completed in 8.4 seconds. No deadline or production code was changed. CI acceptance must pass before merging.
Evidence-bearing change checklist: not applicable; no product evidence representation changes.

Validation performed

Focused guard, moved boundary and affected recovery tests — 74 cases passed (54 guard probes, 9 moved behavior cases and 11 recovery service/command cases).
Serial compiled MCP contract presentation test — original/reversed presentation both passed.
Additional production entrypoint tests — intermittent local timeout as described above, recorded rather than waived.
npm run check -- --output-logs=errors-only — all five tasks passed.
npm run docs:check — passed; generated outputs unchanged.
npm run verify:test-discovery — 502 test files discovered exactly once.
git diff --check and pre-commit/pre-push checks — passed.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: no new real-tool claim; these were not rerun locally for development checks. CI package/runtime/Apple lanes remain required.
Package or release metadata impact: none.
Security/privacy/process review: no credentials, host paths, binaries or local artifacts committed. Heavy local lanes were bounded and run serially.

Review checklist

One focused outcome and Conventional Commit title.
Related issue linked: #740; remaining T6 migrations and final T7 guidance stay open.
Changed behavior and meaningful failure paths covered.
Owning migration guide updated; generated contracts unchanged.
User-visible output examples: not applicable.
Final diff checked for secrets, unrelated changes and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/862 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `build/resolved-module-boundaries` --- ### 📝 Commits (1) - [`959c24b`](https://github.com/morluto/rea/commit/959c24bbc77fe7ff1516aae0ce5bd0ba8ed03869) build: verify resolved module boundaries ### 📊 Changes **10 files changed** (+365 additions, -141 deletions) <details> <summary>View changed files</summary> 📝 `.oxlintrc.json` (+0 -122) 📝 `docs/capability-migration.md` (+15 -0) 📝 `package.json` (+4 -3) ➕ `scripts/lib/module-boundaries.d.mts` (+18 -0) ➕ `scripts/lib/module-boundaries.mjs` (+100 -0) ➕ `scripts/verify-module-boundaries.mjs` (+56 -0) 📝 `tests/boundary/browser/browserObservationService.test.ts` (+6 -6) 📝 `tests/boundary/providers/managed/managedMemberComparisonFromMetadata.test.ts` (+3 -3) 📝 `tests/boundary/providers/managed/managedMemberComparisonPartialBodies.test.ts` (+3 -3) 📝 `tests/evaluation/moduleBoundaries.test.ts` (+160 -4) </details> ### 📄 Description ## Summary Check resolved source ownership before the capability folder moves in #740. This replaces overlapping import globs that misclassified nested pure capability directories and allowed test overrides to mask forbidden provider dependencies. ## Problem and expected behavior `domain/android` must remain pure domain code, while an import of the adapter at `src/android` must be rejected. The guard must inspect actual import syntax and normalized local paths rather than a provider name anywhere in the raw specifier. The new gate exposed five masked provider imports across three producer-dependent tests. Rebased onto the newly merged JavaScript recovery implementation to resolve configuration conflicts; its construction restrictions and verification command remain intact. ## Change and scope - Parse static/type/reexport/import-type/import-equals/literal dynamic imports using existing Babel dependencies. Resolve local paths and module URLs before checking settled layer ownership. - Check Git-owned tracked and untracked non-ignored source; skip cached paths removed during a move. Report the importing file, line, original specifier, resolved target and failed boundary. - Run with npm lint/lint:fix and existing cached static gates. Preserve the exact binary-runtime exception, admitted shared browser utilities and Oxlint test-lane restrictions. - Move the browser and managed PE comparison tests into boundary lanes, preserving their assertions and fixtures. ## Contract and boundary impact - Semantic owner and earliest changed stage: development-time source dependency checks. - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: unchanged; construction guards remain scoped to the already migrated adapters. - Evidence, artifact, provenance, or reconstruction contract: none. - Process execution, authorization, cleanup, or containment impact: no production change or user-facing permission flow. - Generated metadata, package, or installation impact: generated outputs and package contents unchanged; no dependency or Turbo configuration change. ## Evidence and regression coverage - 54 guard probes cover nested pure folders and forbidden counterparts, real CLI failures, AST forms, encoded module URLs, native absolute paths/file URLs, malformed source, invalid arguments and untracked/removed source discovery. - All 9 moved producer-dependent behavior cases passed with unchanged assertions. - The real source scan reproduced the five previously masked imports before reclassification; it now checks 1,054 source files successfully. - User-visible output: not applicable. - Remaining proof gaps: extra production entrypoint checks reached their unchanged 15-second deadlines on this loaded, two-CPU local lane. Each Linux case also completed within the original deadline in isolated runs, and an equivalent standalone SDK sequence completed in 8.4 seconds. No deadline or production code was changed. CI acceptance must pass before merging. - Evidence-bearing change checklist: not applicable; no product evidence representation changes. ## Validation performed - Focused guard, moved boundary and affected recovery tests — 74 cases passed (54 guard probes, 9 moved behavior cases and 11 recovery service/command cases). - Serial compiled MCP contract presentation test — original/reversed presentation both passed. - Additional production entrypoint tests — intermittent local timeout as described above, recorded rather than waived. - `npm run check -- --output-logs=errors-only` — all five tasks passed. - `npm run docs:check` — passed; generated outputs unchanged. - `npm run verify:test-discovery` — 502 test files discovered exactly once. - `git diff --check` and pre-commit/pre-push checks — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: no new real-tool claim; these were not rerun locally for development checks. CI package/runtime/Apple lanes remain required. - Package or release metadata impact: none. - Security/privacy/process review: no credentials, host paths, binaries or local artifacts committed. Heavy local lanes were bounded and run serially. ## Review checklist - [x] One focused outcome and Conventional Commit title. - [x] Related issue linked: #740; remaining T6 migrations and final T7 guidance stay open. - [x] Changed behavior and meaningful failure paths covered. - [x] Owning migration guide updated; generated contracts unchanged. - [x] User-visible output examples: not applicable. - [x] Final diff checked for secrets, unrelated changes and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:55 +00:00