[PR #1098] [MERGED] fix(javascript): honor cancellation before evidence publication #2645

New issue

Closed

opened 2026-10-17 21:08:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1098
Author: @N0zoM1z0
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/javascript-cancellation-boundaries

📝 Commits (1)

c7396a3 fix(javascript): honor cancellation before evidence publication

📊 Changes

18 files changed (+1080 additions, -74 deletions)

View changed files

📝 docs/mcp-contracts.md (+9 -0)
➕ src/application/javascript/JavaScriptAnalysisControl.test.ts (+39 -0)
➕ src/application/javascript/JavaScriptAnalysisControl.ts (+44 -0)
➕ src/application/javascript/JavaScriptApplicationCancellation.test.ts (+75 -0)
📝 src/application/javascript/JavaScriptApplicationEvidence.ts (+82 -18)
📝 src/application/javascript/JavaScriptApplicationService.ts (+24 -8)
📝 src/application/javascript/JavaScriptArtifactReconstruction.ts (+4 -0)
📝 src/cli/electronCommands.ts (+14 -10)
📝 src/cli/javascriptApplicationAnalysis.ts (+7 -2)
➕ src/domain/canonicalJsonDigestSteps.test.ts (+66 -0)
➕ src/domain/canonicalJsonDigestSteps.ts (+156 -0)
📝 src/domain/evidence.ts (+48 -6)
➕ src/domain/evidenceSteps.test.ts (+117 -0)
📝 src/domain/immutableJson.ts (+78 -25)
➕ src/domain/immutableJsonSteps.test.ts (+83 -0)
📝 src/domain/jsonValue.ts (+35 -5)
➕ tests/acceptance/applications/javascriptCancellationCli.test.ts (+89 -0)
➕ tests/boundary/mcp/javascriptAnalysisCancellation.test.ts (+110 -0)

📄 Description

Summary

Cancelling a large JavaScript application analysis could reject the MCP client immediately while REA continued sealing and hashing the result, reported success, and retained unwanted Evidence. This change stops work during those late phases and prevents publication after cancellation is observed. CLI interrupts now reach the same application signal.

Continues T2 in #1065; the broader roadmap remains open.

Problem and expected behavior

The complete real Notion ASAR reproduced a 14.055-second subsequent ping, successful server completion, and a retained record after a cancellation notification. Cancellation must stop provisional work, preserve prior Evidence, and leave the connection usable. Successful analysis must preserve complete content and semantic identifiers.

Change and scope

Yield between reconstruction phases and before successful publication.
Seal owned results, validate their JSON meaning, and hash canonical content in cooperative steps. The application owns scheduling and cancellation; domain steps contain no timers or transport logic.
Authenticate snapshots only on completion. Cache JSON validation only for authenticated immutable roots; interrupted validation and shallow freezes cannot bypass the boundary.
Forward CLI SIGINT/SIGTERM through the existing cancellation lifecycle. Keep streamed failures visible to CLI logging and exit-status handling.

Single-file parsing, graph completion, full application-result schema validation, and bundle-export cancellation remain separate follow-ups. This PR does not make every analysis phase interruptible.

Contract and boundary impact

Semantic owner and earliest changed stage: JavaScript application workflows, including the checkpoint after the final source file.
CLI and MCP/tool-catalog contract: unchanged inventory and schemas; existing cancelled outcome. CLI SIGINT returns typed cancelled JSON and exit 130; streamed filesystem failures return exit 1.
Provider, bridge, target-format, or platform compatibility: no provider protocol changes; real directory/ASAR paths and native Windows package behavior verified.
Evidence, artifact, provenance, or reconstruction contract: complete payloads and identifiers preserved; partial snapshots are not authenticated or admitted.
Process execution, authorization, cleanup, or containment impact: no new workers, processes, or permission flags; abandoned computation iterators are closed.
Generated metadata, package, or installation impact: generated checks pass; no generated output committed or installation changes required.

Evidence and regression coverage

126 related deterministic tests passed across domain, application, MCP boundary, and CLI acceptance. Regressions cover canonical digest parity (including randomized JSON, long Unicode strings/keys and aliases), partial authentication/cache rejection, depth/profile constraints, phase-triggered cancellation, actual SDK server completion/ledger preservation, CLI interrupts, and streamed failure status.

Actual full shipped artifacts, two CPUs and a 1.5 GiB server heap:

Workflow	Observed outcome
Linux Notion: cancel 300 ms into sealing	Server stops in 11.542 ms; subsequent ping 2.129 ms; prior record preserved and next analysis succeeds.
Linux Obsidian: cancel 300 ms into hashing	Server stops in 11.450 ms; subsequent ping 2.228 ms; same session recovery checks pass.
Native Windows Notion: cancel 300 ms into hashing	Server stops in 7.331 ms; subsequent ping 2.533 ms; same session recovery checks pass.
Notion CLI: SIGINT during hashing	Typed cancelled JSON, exit 130; process and streams close in 125.718 ms.
Successful complete Notion analysis	Exact previous Evidence ID and normalized-result digest preserved.
Native Windows complete Obsidian analysis, trace, export and cleanup	Complete 429,198,332-byte export is byte-identical to the verified main baseline; independent full-document tree proof passes. Default framing returns its retained reference; focused trace and subsequent calls remain usable.

Successful native Windows Obsidian analysis used an extended client deadline; this does not fix the client's default 60-second waiting policy. Sampled peak process-family memory across these real workflows was approximately 1.41–2.11 GiB; no resource reserve guard stopped a run. Large exported files were deleted after proof.

On the same complete Notion result, canonical hashing measured 3.588 s before and 3.961 s with cooperation (about 10.4% hashing overhead / 373 ms). The change buys cancellation responsiveness; it is not a hashing speedup. The discarded encoder experiment cost approximately 3.8 times the CPU and was not adopted.

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Focused deterministic source, boundary and acceptance runs — 126 distinct tests passed.
npm run check -- --concurrency=1 — typecheck, lint/module boundaries, formatting, knip and metadata passed.
npm run docs:check, npm run jscpd, npm run scan:todos — passed.
Actual pinned-SDK stdio and CLI runs against complete Notion 7.6.1 and Obsidian 1.12.7 artifacts — outcomes above.
Isolated Windows tarball installation — changed production files match the final compiled build; installed startup and streamed CLI failure smoke passed.

Compatibility, safety, and release

Breaking changes or migration steps: none. Ordinary synchronous domain APIs and complete successful result contracts remain available.
Real Hopper/Ghidra, browser, or OS coverage: native Windows and Linux JavaScript workflows verified; Hopper/Ghidra/browser workflows were not run for this JavaScript cancellation change.
Package or release metadata impact: patch behavior fix; no version edit or generated outputs committed.
Security, privacy, process, or containment review: artifacts inspected statically; no target application execution, ambient-environment persistence, provider mutation, or new authority. Public examples and measurements omit private host paths.

Review checklist

One focused outcome and conventional PR title.
Related roadmap linked without prematurely closing it.
Changed behavior and meaningful failure paths covered.
Owning documentation and generated checks updated.
CLI/MCP outcomes described with executed evidence.
Final diff checked for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1098 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/javascript-cancellation-boundaries` --- ### 📝 Commits (1) - [`c7396a3`](https://github.com/morluto/rea/commit/c7396a38b4b7d6f205893c5b30055b924c8717e4) fix(javascript): honor cancellation before evidence publication ### 📊 Changes **18 files changed** (+1080 additions, -74 deletions) <details> <summary>View changed files</summary> 📝 `docs/mcp-contracts.md` (+9 -0) ➕ `src/application/javascript/JavaScriptAnalysisControl.test.ts` (+39 -0) ➕ `src/application/javascript/JavaScriptAnalysisControl.ts` (+44 -0) ➕ `src/application/javascript/JavaScriptApplicationCancellation.test.ts` (+75 -0) 📝 `src/application/javascript/JavaScriptApplicationEvidence.ts` (+82 -18) 📝 `src/application/javascript/JavaScriptApplicationService.ts` (+24 -8) 📝 `src/application/javascript/JavaScriptArtifactReconstruction.ts` (+4 -0) 📝 `src/cli/electronCommands.ts` (+14 -10) 📝 `src/cli/javascriptApplicationAnalysis.ts` (+7 -2) ➕ `src/domain/canonicalJsonDigestSteps.test.ts` (+66 -0) ➕ `src/domain/canonicalJsonDigestSteps.ts` (+156 -0) 📝 `src/domain/evidence.ts` (+48 -6) ➕ `src/domain/evidenceSteps.test.ts` (+117 -0) 📝 `src/domain/immutableJson.ts` (+78 -25) ➕ `src/domain/immutableJsonSteps.test.ts` (+83 -0) 📝 `src/domain/jsonValue.ts` (+35 -5) ➕ `tests/acceptance/applications/javascriptCancellationCli.test.ts` (+89 -0) ➕ `tests/boundary/mcp/javascriptAnalysisCancellation.test.ts` (+110 -0) </details> ### 📄 Description ## Summary Cancelling a large JavaScript application analysis could reject the MCP client immediately while REA continued sealing and hashing the result, reported success, and retained unwanted Evidence. This change stops work during those late phases and prevents publication after cancellation is observed. CLI interrupts now reach the same application signal. Continues **T2 in #1065**; the broader roadmap remains open. ## Problem and expected behavior The complete real Notion ASAR reproduced a 14.055-second subsequent ping, successful server completion, and a retained record after a cancellation notification. Cancellation must stop provisional work, preserve prior Evidence, and leave the connection usable. Successful analysis must preserve complete content and semantic identifiers. ## Change and scope - Yield between reconstruction phases and before successful publication. - Seal owned results, validate their JSON meaning, and hash canonical content in cooperative steps. The application owns scheduling and cancellation; domain steps contain no timers or transport logic. - Authenticate snapshots only on completion. Cache JSON validation only for authenticated immutable roots; interrupted validation and shallow freezes cannot bypass the boundary. - Forward CLI SIGINT/SIGTERM through the existing cancellation lifecycle. Keep streamed failures visible to CLI logging and exit-status handling. Single-file parsing, graph completion, full application-result schema validation, and bundle-export cancellation remain separate follow-ups. This PR does not make every analysis phase interruptible. ## Contract and boundary impact - Semantic owner and earliest changed stage: JavaScript application workflows, including the checkpoint after the final source file. - CLI and MCP/tool-catalog contract: unchanged inventory and schemas; existing `cancelled` outcome. CLI SIGINT returns typed cancelled JSON and exit 130; streamed filesystem failures return exit 1. - Provider, bridge, target-format, or platform compatibility: no provider protocol changes; real directory/ASAR paths and native Windows package behavior verified. - Evidence, artifact, provenance, or reconstruction contract: complete payloads and identifiers preserved; partial snapshots are not authenticated or admitted. - Process execution, authorization, cleanup, or containment impact: no new workers, processes, or permission flags; abandoned computation iterators are closed. - Generated metadata, package, or installation impact: generated checks pass; no generated output committed or installation changes required. ## Evidence and regression coverage 126 related deterministic tests passed across domain, application, MCP boundary, and CLI acceptance. Regressions cover canonical digest parity (including randomized JSON, long Unicode strings/keys and aliases), partial authentication/cache rejection, depth/profile constraints, phase-triggered cancellation, actual SDK server completion/ledger preservation, CLI interrupts, and streamed failure status. Actual full shipped artifacts, two CPUs and a 1.5 GiB server heap: | Workflow | Observed outcome | | --- | --- | | Linux Notion: cancel 300 ms into sealing | Server stops in 11.542 ms; subsequent ping 2.129 ms; prior record preserved and next analysis succeeds. | | Linux Obsidian: cancel 300 ms into hashing | Server stops in 11.450 ms; subsequent ping 2.228 ms; same session recovery checks pass. | | Native Windows Notion: cancel 300 ms into hashing | Server stops in 7.331 ms; subsequent ping 2.533 ms; same session recovery checks pass. | | Notion CLI: SIGINT during hashing | Typed cancelled JSON, exit 130; process and streams close in 125.718 ms. | | Successful complete Notion analysis | Exact previous Evidence ID and normalized-result digest preserved. | | Native Windows complete Obsidian analysis, trace, export and cleanup | Complete 429,198,332-byte export is byte-identical to the verified main baseline; independent full-document tree proof passes. Default framing returns its retained reference; focused trace and subsequent calls remain usable. | Successful native Windows Obsidian analysis used an extended client deadline; this does not fix the client's default 60-second waiting policy. Sampled peak process-family memory across these real workflows was approximately 1.41–2.11 GiB; no resource reserve guard stopped a run. Large exported files were deleted after proof. On the same complete Notion result, canonical hashing measured 3.588 s before and 3.961 s with cooperation (about 10.4% hashing overhead / 373 ms). The change buys cancellation responsiveness; it is not a hashing speedup. The discarded encoder experiment cost approximately 3.8 times the CPU and was not adopted. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - Focused deterministic source, boundary and acceptance runs — 126 distinct tests passed. - `npm run check -- --concurrency=1` — typecheck, lint/module boundaries, formatting, knip and metadata passed. - `npm run docs:check`, `npm run jscpd`, `npm run scan:todos` — passed. - Actual pinned-SDK stdio and CLI runs against complete Notion 7.6.1 and Obsidian 1.12.7 artifacts — outcomes above. - Isolated Windows tarball installation — changed production files match the final compiled build; installed startup and streamed CLI failure smoke passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. Ordinary synchronous domain APIs and complete successful result contracts remain available. - Real Hopper/Ghidra, browser, or OS coverage: native Windows and Linux JavaScript workflows verified; Hopper/Ghidra/browser workflows were not run for this JavaScript cancellation change. - Package or release metadata impact: patch behavior fix; no version edit or generated outputs committed. - Security, privacy, process, or containment review: artifacts inspected statically; no target application execution, ambient-environment persistence, provider mutation, or new authority. Public examples and measurements omit private host paths. ## Review checklist - [x] One focused outcome and conventional PR title. - [x] Related roadmap linked without prematurely closing it. - [x] Changed behavior and meaningful failure paths covered. - [x] Owning documentation and generated checks updated. - [x] CLI/MCP outcomes described with executed evidence. - [x] Final diff checked for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:35 +00:00