[PR #896] [MERGED] refactor(javascript): group application workflows and verification #2327

New issue

Closed

opened 2026-10-16 21:17:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:20 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/896
Author: @N0zoM1z0
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: refactor/javascript-application-owner

📝 Commits (1)

7bd253c refactor(javascript): group application workflows and verification

📊 Changes

129 files changed (+402 additions, -367 deletions)

View changed files

📝 .github/workflows/real-javascript-recovery.yml (+2 -3)
📝 docs/capability-migration.md (+22 -0)
📝 package.json (+4 -4)
📝 scripts/fixtures/javascript-recovery/build.mjs (+2 -6)
📝 scripts/lib/managed-conformance-manifest.mjs (+1 -1)
📝 scripts/verify-managed-conformance.mjs (+1 -1)
📝 scripts/verify/javascript/application-workflows.mjs (+9 -6)
📝 scripts/verify/javascript/digests.mjs (+5 -2)
📝 scripts/verify/javascript/recovery.mjs (+5 -5)
📝 scripts/verify/javascript/runtime-observation.mjs (+6 -3)
📝 src/application/OptionalObservationProviders.ts (+3 -3)
📝 src/application/ReconstructionObligationCandidates.ts (+1 -1)
📝 src/application/javascript/ElectronActiveEvidence.ts (+6 -6)
📝 src/application/javascript/ElectronActiveObservationPort.ts (+7 -4)
📝 src/application/javascript/ElectronActiveObservationService.ts (+6 -6)
📝 src/application/javascript/ElectronBoundaryAnalysis.ts (+3 -3)
📝 src/application/javascript/ElectronBoundaryGraph.ts (+0 -0)
📝 src/application/javascript/ElectronBoundaryGraphContext.ts (+3 -3)
📝 src/application/javascript/ElectronBoundaryGraphIpc.ts (+2 -2)
📝 src/application/javascript/ElectronBoundaryGraphNative.ts (+1 -1)

...and 80 more files

📄 Description

Summary

Group the existing JavaScript/Electron application workflows in src/application/javascript/ and their JavaScript verifier entrypoints in scripts/verify/javascript/. This continues the coherent T6 migrations in #740.

Problem and expected behavior

Static application analysis, graph projections, observation ports, runtime reconciliation and recovery were spread across the application root. Their owning source, tests and verification entrypoints should be navigable together while preserving the actual producer boundaries and invocation semantics.

Change and scope

Move 66 application files, including 12 colocated tests, with direct consumer imports updated.
Move four JavaScript verifier entrypoints and the recovery fixture compiler beside its existing source fixtures.
Update compiled managed-conformance imports, npm paths, existing path-sensitive tests and recovery CI filters together.
Preserve shared inventory/Evidence/execution owners and the existing directory/ASAR acquisition boundary for its separately traced follow-up.

Contract and boundary impact

Semantic owner and earliest changed stage: application capability ownership and development entrypoint resolution.
CLI and MCP/tool-catalog contract: none; command names, schemas, results and generated catalog unchanged.
Provider, bridge, target-format, or platform compatibility: existing Inspector/Electron/recovery ports and producer adapters preserved.
Evidence, artifact, provenance, or reconstruction contract: none; implementation and assertion bodies mechanically unchanged.
Process execution, authorization, cleanup, or containment impact: none; existing cancellation and owned lifecycle preserved.
Generated metadata (docs/product-catalog.json), package, or installation impact: generated artifacts unchanged; new compiled module paths replace old paths.

Evidence and regression coverage

Tests added or updated: existing imports and two actual verifier invocation paths; no new prescribed call sequences.
Base reproduction or other evidence: AST comparison confirms unchanged bodies, exact mapped import owners and import.meta.url roots for all 126 affected TS/MJS modules. Recovery fixture source bytes are unchanged. All 54 implementation modules exist at their new compiled paths, and the old paths are absent after a clean build.
User-visible CLI/MCP output: unchanged; normal/reordered SDK presentation and retained application workflows passed.
Remaining proof gaps: real Wakaru and Electron browser workflows were not executed locally; their separate CI lanes remain authoritative. The opt-in engine-string-limit digest stress lane was not executed locally.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run check -- --output-logs=errors-only — all five static gates passed.
npm run docs:check — fresh build and generated-document checks passed without generated changes.
Exact focused Vitest selection — 517 tests in 48 files passed, including ASAR/directory integrity, source maps, file URLs, CLI/MCP, retained Evidence and the actual relocated workflow/reconciliation scripts.
npm run verify:test-discovery — all 518 files discovered once; exact new-path test:local --dry-run selection also passed.
npm run verify:inspector — actual Linux CLI/MCP discovery and observation passed on eight source-owned filename fixtures, including spaces, hash, percent and quotes.
Relocated recovery entrypoint from an external working directory — module imports succeeded and the original precise missing-engine preflight remained intact.
npm run verify:package — installed CLI/MCP, setup, backup/recovery, Evidence, lifecycle and update passed; 130 tools and 6 prompts. Startup to tools/list was 2098.88 ms; sampled MCP peak RSS was 419885056 bytes.

Compatibility, safety, and release

Breaking changes or migration steps: internal module/script paths moved; all repository consumers and owning entrypoints migrated. Public npm verification command names retained.
Real Hopper/Ghidra, browser, or OS coverage: real Linux Node Inspector executed. This directory move does not broaden engine or host support.
Package or release metadata impact: no dependency/version changes; default recovery REA entrypoint still resolves to scripts/rea.mjs.
Security, privacy, process, or containment review: final import/URL/body checks and diff reviewed; heavy lanes ran serially with two-CPU affinity, reduced priority and heap limits. No Windows disk writes, GUI changes or engine installation.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/896 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `refactor/javascript-application-owner` --- ### 📝 Commits (1) - [`7bd253c`](https://github.com/morluto/rea/commit/7bd253c4d1381ee40b075742a156feb13f2f5942) refactor(javascript): group application workflows and verification ### 📊 Changes **129 files changed** (+402 additions, -367 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/real-javascript-recovery.yml` (+2 -3) 📝 `docs/capability-migration.md` (+22 -0) 📝 `package.json` (+4 -4) 📝 `scripts/fixtures/javascript-recovery/build.mjs` (+2 -6) 📝 `scripts/lib/managed-conformance-manifest.mjs` (+1 -1) 📝 `scripts/verify-managed-conformance.mjs` (+1 -1) 📝 `scripts/verify/javascript/application-workflows.mjs` (+9 -6) 📝 `scripts/verify/javascript/digests.mjs` (+5 -2) 📝 `scripts/verify/javascript/recovery.mjs` (+5 -5) 📝 `scripts/verify/javascript/runtime-observation.mjs` (+6 -3) 📝 `src/application/OptionalObservationProviders.ts` (+3 -3) 📝 `src/application/ReconstructionObligationCandidates.ts` (+1 -1) 📝 `src/application/javascript/ElectronActiveEvidence.ts` (+6 -6) 📝 `src/application/javascript/ElectronActiveObservationPort.ts` (+7 -4) 📝 `src/application/javascript/ElectronActiveObservationService.ts` (+6 -6) 📝 `src/application/javascript/ElectronBoundaryAnalysis.ts` (+3 -3) 📝 `src/application/javascript/ElectronBoundaryGraph.ts` (+0 -0) 📝 `src/application/javascript/ElectronBoundaryGraphContext.ts` (+3 -3) 📝 `src/application/javascript/ElectronBoundaryGraphIpc.ts` (+2 -2) 📝 `src/application/javascript/ElectronBoundaryGraphNative.ts` (+1 -1) _...and 80 more files_ </details> ### 📄 Description ## Summary Group the existing JavaScript/Electron application workflows in `src/application/javascript/` and their JavaScript verifier entrypoints in `scripts/verify/javascript/`. This continues the coherent T6 migrations in #740. ## Problem and expected behavior Static application analysis, graph projections, observation ports, runtime reconciliation and recovery were spread across the application root. Their owning source, tests and verification entrypoints should be navigable together while preserving the actual producer boundaries and invocation semantics. ## Change and scope - Move 66 application files, including 12 colocated tests, with direct consumer imports updated. - Move four JavaScript verifier entrypoints and the recovery fixture compiler beside its existing source fixtures. - Update compiled managed-conformance imports, npm paths, existing path-sensitive tests and recovery CI filters together. - Preserve shared inventory/Evidence/execution owners and the existing directory/ASAR acquisition boundary for its separately traced follow-up. ## Contract and boundary impact - Semantic owner and earliest changed stage: application capability ownership and development entrypoint resolution. - CLI and MCP/tool-catalog contract: none; command names, schemas, results and generated catalog unchanged. - Provider, bridge, target-format, or platform compatibility: existing Inspector/Electron/recovery ports and producer adapters preserved. - Evidence, artifact, provenance, or reconstruction contract: none; implementation and assertion bodies mechanically unchanged. - Process execution, authorization, cleanup, or containment impact: none; existing cancellation and owned lifecycle preserved. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: generated artifacts unchanged; new compiled module paths replace old paths. ## Evidence and regression coverage - Tests added or updated: existing imports and two actual verifier invocation paths; no new prescribed call sequences. - Base reproduction or other evidence: AST comparison confirms unchanged bodies, exact mapped import owners and `import.meta.url` roots for all 126 affected TS/MJS modules. Recovery fixture source bytes are unchanged. All 54 implementation modules exist at their new compiled paths, and the old paths are absent after a clean build. - User-visible CLI/MCP output: unchanged; normal/reordered SDK presentation and retained application workflows passed. - Remaining proof gaps: real Wakaru and Electron browser workflows were not executed locally; their separate CI lanes remain authoritative. The opt-in engine-string-limit digest stress lane was not executed locally. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check -- --output-logs=errors-only` — all five static gates passed. - `npm run docs:check` — fresh build and generated-document checks passed without generated changes. - Exact focused Vitest selection — 517 tests in 48 files passed, including ASAR/directory integrity, source maps, file URLs, CLI/MCP, retained Evidence and the actual relocated workflow/reconciliation scripts. - `npm run verify:test-discovery` — all 518 files discovered once; exact new-path `test:local --dry-run` selection also passed. - `npm run verify:inspector` — actual Linux CLI/MCP discovery and observation passed on eight source-owned filename fixtures, including spaces, hash, percent and quotes. - Relocated recovery entrypoint from an external working directory — module imports succeeded and the original precise missing-engine preflight remained intact. - `npm run verify:package` — installed CLI/MCP, setup, backup/recovery, Evidence, lifecycle and update passed; 130 tools and 6 prompts. Startup to tools/list was 2098.88 ms; sampled MCP peak RSS was 419885056 bytes. ## Compatibility, safety, and release - Breaking changes or migration steps: internal module/script paths moved; all repository consumers and owning entrypoints migrated. Public npm verification command names retained. - Real Hopper/Ghidra, browser, or OS coverage: real Linux Node Inspector executed. This directory move does not broaden engine or host support. - Package or release metadata impact: no dependency/version changes; default recovery REA entrypoint still resolves to `scripts/rea.mjs`. - Security, privacy, process, or containment review: final import/URL/body checks and diff reviewed; heavy lanes ran serially with two-CPU affinity, reduced priority and heap limits. No Windows disk writes, GUI changes or engine installation. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:20 +00:00