[PR #926] [MERGED] refactor(managed): group capability workflows and verification #2353

New issue

Closed

opened 2026-10-16 21:17:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:42 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/926
Author: @N0zoM1z0
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: refactor/managed-capability-owner

📝 Commits (3)

5089c2d refactor(managed): group capability workflows and verification
8b77fcc chore: integrate main with managed capability owners
6aa3676 chore: integrate verified parser fix and main

📊 Changes

75 files changed (+217 additions, -177 deletions)

View changed files

📝 docs/capability-migration.md (+24 -0)
📝 docs/testing.md (+10 -0)
📝 package.json (+1 -1)
📝 scripts/fixtures/managed/pe.d.mts (+0 -0)
📝 scripts/fixtures/managed/pe.mjs (+0 -0)
📝 scripts/generate-completion-ledger.mjs (+1 -1)
📝 scripts/generate-mcp-tool-catalog.mjs (+1 -1)
📝 scripts/lib/catalog-core.mjs (+6 -5)
📝 scripts/verify-package-managed.mjs (+1 -1)
📝 scripts/verify/managed/completion-report.mjs (+1 -1)
📝 scripts/verify/managed/config.mjs (+0 -0)
📝 scripts/verify/managed/conformance.mjs (+18 -15)
📝 scripts/verify/managed/manifest-parser.mjs (+0 -0)
📝 scripts/verify/managed/manifest.mjs (+8 -8)
📝 scripts/verify/managed/oracles.mjs (+6 -6)
📝 scripts/verify/managed/support.mjs (+3 -3)
📝 src/application/AnalysisProvider.ts (+1 -1)
📝 src/application/DirectAnalysis.ts (+1 -1)
📝 src/application/javascript/JavaScriptApplicationEvidenceGraph.ts (+1 -1)
📝 src/application/managed/ManagedApplicationGraphService.ts (+7 -7)

...and 55 more files

📄 Description

Summary

Group managed semantics, Evidence workflows and named contracts under their corresponding managed layer owners, with their conformance verifier and portable PE fixture builder. This continues T6/T7 in #740.

Problem and expected behavior

Managed analysis already has distinct semantics and producer parsing, but its workflow/domain/contracts and conformance helpers were spread across layer and script roots. Maintainers should be able to follow one managed capability from its contracts through shared workflows to its fixture and verification lane, with existing results and producer boundaries preserved.

Change and scope

Move 14 domain files, five application service/test files and three contracts/examples into their managed layer directories.
Group the conformance entrypoint and six helpers under scripts/verify/managed/, and the portable PE fixture builder/declaration under scripts/fixtures/managed/.
Migrate source/type/reexports, CLI/MCP/provider consumers, compiled catalog/generator imports, package verification and the completion-ledger entrypoint together.
Preserve shared target resolution, Evidence, ordering and investigation records, and existing metadata/IL parsing in dotnet. NativeAOT's existing cross-provider fixture/engine lane keeps its owner.
Include relocated verifier/fixture runtime scripts in document-check cache inputs; existing recursive checks continue to cover the moved source and fixture declaration.

Contract and boundary impact

Semantic owner and earliest changed stage: managed capability ownership and source/compiled module resolution.
CLI and MCP/tool-catalog contract: unchanged named contracts, schemas, examples and results.
Provider, bridge, target-format, or platform compatibility: unchanged parser/provider implementations and platform claims.
Evidence, artifact, provenance, or reconstruction contract: implementation bodies, Evidence identities and generated completion commitments preserved.
Process execution, authorization, cleanup, or containment impact: existing verifier cleanup, caller-cwd optional manifest resolution and optional tool behavior preserved.
Generated metadata (docs/product-catalog.json), package, or installation impact: generated catalogs/ledger are byte-identical; 20 new compiled production owners replace their old paths. No dependency/version/installer change.

Evidence and regression coverage

Tests added or updated: migrate existing source/compiled imports and fixture paths; no new prescribed workflows or caps.
Base reproduction or other evidence: exact comparison of all 70 affected TS/MJS bodies, mapped import identities and file-URL roots; fixture declaration bytes unchanged. Two moved tests retain their source-only build exclusion.
User-visible CLI/MCP output: actual managed PE opening/inspection, Evidence/workflow and canonical/reordered SDK contract presentation passed.
Remaining proof gaps: optional local ILSpy and operator-manifest inputs are unconfigured and reported unsupported. Portable fixture success does not establish a new real managed-engine/Ghidra/Hopper/IDA claim. Hosted native checks must pass before merge.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run check -- --output-logs=errors-only — all five static gates passed.
npm run docs:check and npm run build:cached — fresh build/generated checks passed, 20 new compiled owners present and old paths absent; catalog and completion commitments byte-identical to integrated main (e6ba9c3a).
Exact focused Vitest selection — 230 cases in 33 files passed, covering producer metadata/IL, managed source/Evidence workflows, actual MCP/CLI, canonical/reordered SDK schemas/examples and module boundaries.
Relocated conformance entrypoint invoked from outside repository cwd — 11 portable scenarios passed; the two unconfigured optional oracle/manifest claims remained unsupported.
Installed Turbo 2.11.7 dry-run input inspection — all eight relocated runtime verifier/fixture scripts appear in document-check inputs, and the fixture declaration appears in typecheck inputs. Bundled version-matched configuration/run documentation was read before changing inputs.
npm run verify:test-discovery — all 533 files discovered once.
npm run verify:package — installed CLI/MCP, managed analysis/reconstruction/native-verification/application-graph workflows, configuration backups/recovery, Evidence, lifecycle and update passed; 131 tools and six prompts. Observed tools/list startup: 2140.01 ms; sampled MCP peak RSS: 369053696 bytes. The final process report had no owned descendants, and its tarball was cleaned. No comparative performance claim.

Compatibility, safety, and release

Breaking changes or migration steps: internal modules and verifier/fixture paths moved; source and compiled consumers migrated together. Public commands/contracts unchanged.
Real Hopper/Ghidra, browser, or OS coverage: portable fixture conformance and actual local Linux installed CLI/MCP. No fresh local proprietary-engine/browser-engine or optional actual ILSpy run; hosted native Linux/macOS x64/arm64 and Windows x64 baselines are required before merge.
Package or release metadata impact: no dependency/version/installation change; generated catalog/completion commitments match integrated main.
Security, privacy, process, or containment review: final diff and exact source/import/URL mapping reviewed. Heavy local lanes ran serially on two CPUs with reduced priority, one worker and one-GiB heap. No Windows writes or user-GUI mutation; no new acquisition, permission field, provider protocol or background process.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

All 70 affected module bodies/import/file-URL owners compare exactly to integrated main e6ba9c3a. The separately merged parser-recovery fix #929 and current main changes are preserved.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/926 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `refactor/managed-capability-owner` --- ### 📝 Commits (3) - [`5089c2d`](https://github.com/morluto/rea/commit/5089c2de73b051d7417847ccf543dc0e47da7dd5) refactor(managed): group capability workflows and verification - [`8b77fcc`](https://github.com/morluto/rea/commit/8b77fcc0305b9db95dad48f4f8307b4953c17a9e) chore: integrate main with managed capability owners - [`6aa3676`](https://github.com/morluto/rea/commit/6aa367677da2cd0a78093051e4a21371d33d23bf) chore: integrate verified parser fix and main ### 📊 Changes **75 files changed** (+217 additions, -177 deletions) <details> <summary>View changed files</summary> 📝 `docs/capability-migration.md` (+24 -0) 📝 `docs/testing.md` (+10 -0) 📝 `package.json` (+1 -1) 📝 `scripts/fixtures/managed/pe.d.mts` (+0 -0) 📝 `scripts/fixtures/managed/pe.mjs` (+0 -0) 📝 `scripts/generate-completion-ledger.mjs` (+1 -1) 📝 `scripts/generate-mcp-tool-catalog.mjs` (+1 -1) 📝 `scripts/lib/catalog-core.mjs` (+6 -5) 📝 `scripts/verify-package-managed.mjs` (+1 -1) 📝 `scripts/verify/managed/completion-report.mjs` (+1 -1) 📝 `scripts/verify/managed/config.mjs` (+0 -0) 📝 `scripts/verify/managed/conformance.mjs` (+18 -15) 📝 `scripts/verify/managed/manifest-parser.mjs` (+0 -0) 📝 `scripts/verify/managed/manifest.mjs` (+8 -8) 📝 `scripts/verify/managed/oracles.mjs` (+6 -6) 📝 `scripts/verify/managed/support.mjs` (+3 -3) 📝 `src/application/AnalysisProvider.ts` (+1 -1) 📝 `src/application/DirectAnalysis.ts` (+1 -1) 📝 `src/application/javascript/JavaScriptApplicationEvidenceGraph.ts` (+1 -1) 📝 `src/application/managed/ManagedApplicationGraphService.ts` (+7 -7) _...and 55 more files_ </details> ### 📄 Description ## Summary Group managed semantics, Evidence workflows and named contracts under their corresponding managed layer owners, with their conformance verifier and portable PE fixture builder. This continues T6/T7 in #740. ## Problem and expected behavior Managed analysis already has distinct semantics and producer parsing, but its workflow/domain/contracts and conformance helpers were spread across layer and script roots. Maintainers should be able to follow one managed capability from its contracts through shared workflows to its fixture and verification lane, with existing results and producer boundaries preserved. ## Change and scope - Move 14 domain files, five application service/test files and three contracts/examples into their managed layer directories. - Group the conformance entrypoint and six helpers under `scripts/verify/managed/`, and the portable PE fixture builder/declaration under `scripts/fixtures/managed/`. - Migrate source/type/reexports, CLI/MCP/provider consumers, compiled catalog/generator imports, package verification and the completion-ledger entrypoint together. - Preserve shared target resolution, Evidence, ordering and investigation records, and existing metadata/IL parsing in dotnet. NativeAOT's existing cross-provider fixture/engine lane keeps its owner. - Include relocated verifier/fixture runtime scripts in document-check cache inputs; existing recursive checks continue to cover the moved source and fixture declaration. ## Contract and boundary impact - Semantic owner and earliest changed stage: managed capability ownership and source/compiled module resolution. - CLI and MCP/tool-catalog contract: unchanged named contracts, schemas, examples and results. - Provider, bridge, target-format, or platform compatibility: unchanged parser/provider implementations and platform claims. - Evidence, artifact, provenance, or reconstruction contract: implementation bodies, Evidence identities and generated completion commitments preserved. - Process execution, authorization, cleanup, or containment impact: existing verifier cleanup, caller-cwd optional manifest resolution and optional tool behavior preserved. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: generated catalogs/ledger are byte-identical; 20 new compiled production owners replace their old paths. No dependency/version/installer change. ## Evidence and regression coverage - Tests added or updated: migrate existing source/compiled imports and fixture paths; no new prescribed workflows or caps. - Base reproduction or other evidence: exact comparison of all 70 affected TS/MJS bodies, mapped import identities and file-URL roots; fixture declaration bytes unchanged. Two moved tests retain their source-only build exclusion. - User-visible CLI/MCP output: actual managed PE opening/inspection, Evidence/workflow and canonical/reordered SDK contract presentation passed. - Remaining proof gaps: optional local ILSpy and operator-manifest inputs are unconfigured and reported unsupported. Portable fixture success does not establish a new real managed-engine/Ghidra/Hopper/IDA claim. Hosted native checks must pass before merge. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check -- --output-logs=errors-only` — all five static gates passed. - `npm run docs:check` and `npm run build:cached` — fresh build/generated checks passed, 20 new compiled owners present and old paths absent; catalog and completion commitments byte-identical to integrated main (e6ba9c3a). - Exact focused Vitest selection — 230 cases in 33 files passed, covering producer metadata/IL, managed source/Evidence workflows, actual MCP/CLI, canonical/reordered SDK schemas/examples and module boundaries. - Relocated conformance entrypoint invoked from outside repository cwd — 11 portable scenarios passed; the two unconfigured optional oracle/manifest claims remained unsupported. - Installed Turbo 2.11.7 dry-run input inspection — all eight relocated runtime verifier/fixture scripts appear in document-check inputs, and the fixture declaration appears in typecheck inputs. Bundled version-matched configuration/run documentation was read before changing inputs. - `npm run verify:test-discovery` — all 533 files discovered once. - `npm run verify:package` — installed CLI/MCP, managed analysis/reconstruction/native-verification/application-graph workflows, configuration backups/recovery, Evidence, lifecycle and update passed; 131 tools and six prompts. Observed tools/list startup: 2140.01 ms; sampled MCP peak RSS: 369053696 bytes. The final process report had no owned descendants, and its tarball was cleaned. No comparative performance claim. ## Compatibility, safety, and release - Breaking changes or migration steps: internal modules and verifier/fixture paths moved; source and compiled consumers migrated together. Public commands/contracts unchanged. - Real Hopper/Ghidra, browser, or OS coverage: portable fixture conformance and actual local Linux installed CLI/MCP. No fresh local proprietary-engine/browser-engine or optional actual ILSpy run; hosted native Linux/macOS x64/arm64 and Windows x64 baselines are required before merge. - Package or release metadata impact: no dependency/version/installation change; generated catalog/completion commitments match integrated main. - Security, privacy, process, or containment review: final diff and exact source/import/URL mapping reviewed. Heavy local lanes ran serially on two CPUs with reduced priority, one worker and one-GiB heap. No Windows writes or user-GUI mutation; no new acquisition, permission field, provider protocol or background process. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. All 70 affected module bodies/import/file-URL owners compare exactly to integrated main e6ba9c3a. The separately merged parser-recovery fix #929 and current main changes are preserved. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:42 +00:00