[PR #1032] [MERGED] refactor(artifacts): move inventory and extraction into provider owners #2596

New issue

Closed

opened 2026-10-17 21:08:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:01 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1032
Author: @N0zoM1z0
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: refactor/artifact-inventory-owners

📝 Commits (1)

43cc65c refactor(artifacts): move inventory and extraction into provider owners

📊 Changes

36 files changed (+147 additions, -91 deletions)

View changed files

📝 docs/architecture.mermaid (+1 -1)
📝 docs/capability-migration.md (+24 -0)
📝 scripts/lib/module-boundaries.mjs (+2 -0)
📝 scripts/verify-package-mcp.mjs (+29 -4)
📝 src/application/artifacts/ArtifactExtractionDestination.ts (+0 -0)
📝 src/application/javascript/JavaScriptArtifactGraphBuilder.ts (+1 -1)
📝 src/application/javascript/JavaScriptArtifactGraphContext.ts (+1 -1)
📝 src/application/javascript/JavaScriptArtifactGraphStructure.ts (+1 -1)
📝 src/application/javascript/JavaScriptArtifactReconstruction.ts (+1 -1)
📝 src/artifacts/ArtifactProvider.ts (+3 -3)
📝 src/artifacts/extraction/ArtifactExtraction.ts (+11 -11)
📝 src/artifacts/inventory/ArtifactGraphConstruction.test.ts (+0 -0)
📝 src/artifacts/inventory/ArtifactGraphConstruction.ts (+5 -5)
📝 src/artifacts/inventory/ArtifactInventory.ts (+6 -6)
📝 src/artifacts/inventory/classify.ts (+2 -2)
📝 src/artifacts/inventory/policy.ts (+0 -0)
📝 src/artifacts/inventory/reader.ts (+6 -6)
📝 src/artifacts/inventory/scanCanonical.ts (+3 -3)
📝 src/artifacts/inventory/scanReader.ts (+5 -5)
📝 src/artifacts/inventory/types.ts (+0 -0)

...and 16 more files

📄 Description

Summary

Artifact inventory and extraction currently live in the application layer even though they own format readers, archive acquisition and materialization. Move them beside their artifact producers so format extensions and lifecycle fixes have a clear owner. This is the next incremental migration in #740.

Problem and expected behavior

Keep shared CLI/MCP workflows in the application layer and format-specific acquisition in the artifact provider boundary. Analysts continue to open, inspect and extract the same targets with the same contracts.

Change and scope

Move inventory classification, policy, readers, canonical scanning and graph construction into src/artifacts/inventory/.
Move transactional extraction into src/artifacts/extraction/; keep default output-destination selection in src/application/artifacts/.
Update consumers and tests, document ownership, and extend the existing acquisition dependency guard.
Verify installed-package MCP extraction contents, inline Evidence and cleanup in the existing package lane.

Contract and boundary impact

Semantic owner and earliest changed stage: artifact acquisition ownership; producer implementations retain their bodies.
CLI and MCP/tool-catalog contract: unchanged named contracts and tool inventory.
Provider, bridge, target-format, or platform compatibility: existing readers and provider dispatch preserved.
Evidence, artifact, provenance, or reconstruction contract: existing identity, metadata and result semantics preserved.
Process execution, authorization, cleanup, or containment impact: existing cancellation, containment, reader cleanup and extraction rollback preserved; verification now also checks packaged MCP extraction cleanup.
Generated metadata, package, or installation impact: relocated emitted modules replace their old paths; generated-document checks pass; no dependency changes.

Evidence and regression coverage

AST comparison against c6dad932 confirms unchanged bodies, mapped import owners and file-URL roots across 31 affected modules.
Boundary cases cover forbidden application/composition/CLI/MCP imports and allowed domain/contracts/reader dependencies.
Actual isolated npm consumer verifies CLI/MCP ZIP and ASAR inventory/extraction, CLI JavaScript application analysis, complete inventory parity, unchanged input bytes and cleanup. All ten relocated runtime modules are packaged; old emitted paths and compiled tests are absent.
CLI/MCP result schemas and output are unchanged.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Build, strict single-threaded typecheck, lint/module-boundaries and generated-document checks — passed.
Vitest with 33 exact files, one worker and file parallelism disabled — 275 passed, three host-specific skips.
npm run verify:test-discovery — all 535 test files discovered exactly once.
Isolated installed-package CLI/MCP artifact verification — passed; peak process-family RSS about 507 MiB; temporary installation and outputs removed.
npm run verify:package — complete isolated install, CLI/MCP catalog and Evidence checks, extraction and cleanup passed.
npm run knip, npm run format:check, final lint/module-boundaries — passed.
Complete CI run — all checks passed on 43cc65c5.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real coverage: Linux filesystem/archive producers and installed CLI/MCP executed locally. Real Apple artifact CLI/MCP CI passed, including the DMG lifecycle; Linux x64/arm64, macOS x64/arm64 and Windows package lanes passed. Hopper/Ghidra were not run for this ownership migration.
Package or release metadata impact: internal emitted paths change; public entrypoints and metadata remain stable.
Review: producer bodies, input identity, file-URL roots, output ownership and cleanup checked. Local work was limited to two CPUs with memory supervision; temporary consumers are cleaned after verification.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP behavior remains unchanged.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1032 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `refactor/artifact-inventory-owners` --- ### 📝 Commits (1) - [`43cc65c`](https://github.com/morluto/rea/commit/43cc65c53410e0ea00345c3df86bdb6a3e997b69) refactor(artifacts): move inventory and extraction into provider owners ### 📊 Changes **36 files changed** (+147 additions, -91 deletions) <details> <summary>View changed files</summary> 📝 `docs/architecture.mermaid` (+1 -1) 📝 `docs/capability-migration.md` (+24 -0) 📝 `scripts/lib/module-boundaries.mjs` (+2 -0) 📝 `scripts/verify-package-mcp.mjs` (+29 -4) 📝 `src/application/artifacts/ArtifactExtractionDestination.ts` (+0 -0) 📝 `src/application/javascript/JavaScriptArtifactGraphBuilder.ts` (+1 -1) 📝 `src/application/javascript/JavaScriptArtifactGraphContext.ts` (+1 -1) 📝 `src/application/javascript/JavaScriptArtifactGraphStructure.ts` (+1 -1) 📝 `src/application/javascript/JavaScriptArtifactReconstruction.ts` (+1 -1) 📝 `src/artifacts/ArtifactProvider.ts` (+3 -3) 📝 `src/artifacts/extraction/ArtifactExtraction.ts` (+11 -11) 📝 `src/artifacts/inventory/ArtifactGraphConstruction.test.ts` (+0 -0) 📝 `src/artifacts/inventory/ArtifactGraphConstruction.ts` (+5 -5) 📝 `src/artifacts/inventory/ArtifactInventory.ts` (+6 -6) 📝 `src/artifacts/inventory/classify.ts` (+2 -2) 📝 `src/artifacts/inventory/policy.ts` (+0 -0) 📝 `src/artifacts/inventory/reader.ts` (+6 -6) 📝 `src/artifacts/inventory/scanCanonical.ts` (+3 -3) 📝 `src/artifacts/inventory/scanReader.ts` (+5 -5) 📝 `src/artifacts/inventory/types.ts` (+0 -0) _...and 16 more files_ </details> ### 📄 Description ## Summary Artifact inventory and extraction currently live in the application layer even though they own format readers, archive acquisition and materialization. Move them beside their artifact producers so format extensions and lifecycle fixes have a clear owner. This is the next incremental migration in #740. ## Problem and expected behavior Keep shared CLI/MCP workflows in the application layer and format-specific acquisition in the artifact provider boundary. Analysts continue to open, inspect and extract the same targets with the same contracts. ## Change and scope - Move inventory classification, policy, readers, canonical scanning and graph construction into `src/artifacts/inventory/`. - Move transactional extraction into `src/artifacts/extraction/`; keep default output-destination selection in `src/application/artifacts/`. - Update consumers and tests, document ownership, and extend the existing acquisition dependency guard. - Verify installed-package MCP extraction contents, inline Evidence and cleanup in the existing package lane. ## Contract and boundary impact - Semantic owner and earliest changed stage: artifact acquisition ownership; producer implementations retain their bodies. - CLI and MCP/tool-catalog contract: unchanged named contracts and tool inventory. - Provider, bridge, target-format, or platform compatibility: existing readers and provider dispatch preserved. - Evidence, artifact, provenance, or reconstruction contract: existing identity, metadata and result semantics preserved. - Process execution, authorization, cleanup, or containment impact: existing cancellation, containment, reader cleanup and extraction rollback preserved; verification now also checks packaged MCP extraction cleanup. - Generated metadata, package, or installation impact: relocated emitted modules replace their old paths; generated-document checks pass; no dependency changes. ## Evidence and regression coverage - AST comparison against `c6dad932` confirms unchanged bodies, mapped import owners and file-URL roots across 31 affected modules. - Boundary cases cover forbidden application/composition/CLI/MCP imports and allowed domain/contracts/reader dependencies. - Actual isolated npm consumer verifies CLI/MCP ZIP and ASAR inventory/extraction, CLI JavaScript application analysis, complete inventory parity, unchanged input bytes and cleanup. All ten relocated runtime modules are packaged; old emitted paths and compiled tests are absent. - CLI/MCP result schemas and output are unchanged. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - Build, strict single-threaded typecheck, lint/module-boundaries and generated-document checks — passed. - Vitest with 33 exact files, one worker and file parallelism disabled — 275 passed, three host-specific skips. - `npm run verify:test-discovery` — all 535 test files discovered exactly once. - Isolated installed-package CLI/MCP artifact verification — passed; peak process-family RSS about 507 MiB; temporary installation and outputs removed. - `npm run verify:package` — complete isolated install, CLI/MCP catalog and Evidence checks, extraction and cleanup passed. - `npm run knip`, `npm run format:check`, final lint/module-boundaries — passed. - [Complete CI run](https://github.com/morluto/rea/actions/runs/37691178106) — all checks passed on `43cc65c5`. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real coverage: Linux filesystem/archive producers and installed CLI/MCP executed locally. Real Apple artifact CLI/MCP CI passed, including the DMG lifecycle; Linux x64/arm64, macOS x64/arm64 and Windows package lanes passed. Hopper/Ghidra were not run for this ownership migration. - Package or release metadata impact: internal emitted paths change; public entrypoints and metadata remain stable. - Review: producer bodies, input identity, file-URL roots, output ownership and cleanup checked. Local work was limited to two CPUs with memory supervision; temporary consumers are cleaned after verification. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP behavior remains unchanged. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:01 +00:00