[PR #2968] [CLOSED] fix(javascript): omit dynamic key names from structural fingerprints #5525

New issue

Closed

opened 2026-10-31 01:07:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:07:18 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2968
Author: @rudycelekli
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: candidate/rea-next10-fingerprint-20261013

📝 Commits (3)

30a450f fix(javascript): omit dynamic key names from structural fingerprints
7fe73a0 test(javascript): enforce v2 fingerprint worker contract
ce7c367 Merge remote-tracking branch 'origin/main' into HEAD

📊 Changes

1 file changed (+41 additions, -0 deletions)

View changed files

📝 tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts (+41 -0)

📄 Description

Renaming a local key in value[key] currently changes its advertised rename-resistant bundle fingerprint; computed and fixed member access can also collide. Keep computed access syntax, omit the dynamic binding spelling, and retain template contents through their own AST tokens. Introduce one shared babel-ast-v2 identity for producer, static types and worker admission. Retained v1/v2 values cannot structurally match; re-analyze both snapshots for v2 comparison. Exact factory source digests remain distinct. AI-assisted implementation and verification with OpenAI Codex; no linked issue because this came from a reproduced source audit.

Verified against base 8fef2aa6: npm run check, test discovery and 43 focused/boundary/owned-worker tests pass; generated documentation checks also passed for the unchanged production contract. The committed worker-schema regression round-trips actual producer v2 facts and rejects v1 at the algorithm field; a mutant permitting v1 fails this test. The affected artifact graph boundary now expects v2 and passes after reproducing the stale v1 failure. Whole-repository version search leaves v1 only in intentional incompatibility documentation and the negative test. Actual compiled CLI and SDK stdio MCP comparisons show distinct source digests and matching v2 fingerprints for renamed keys, with Evidence parity, subsequent ping and cleanup. This is static JavaScript workflow verification, not human approval or an external-provider claim.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2968 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `candidate/rea-next10-fingerprint-20261013` --- ### 📝 Commits (3) - [`30a450f`](https://github.com/morluto/rea/commit/30a450f7f69c5dfb72e1dcffe9b91e306a58c9be) fix(javascript): omit dynamic key names from structural fingerprints - [`7fe73a0`](https://github.com/morluto/rea/commit/7fe73a0f2795f29dd1d8eb9e88ab0e6bd90db9e4) test(javascript): enforce v2 fingerprint worker contract - [`ce7c367`](https://github.com/morluto/rea/commit/ce7c367f85df95e7868586b593866d477fe78058) Merge remote-tracking branch 'origin/main' into HEAD ### 📊 Changes **1 file changed** (+41 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `tests/boundary/filesystem/javascript-applications/javascriptArtifactReconstruction.test.ts` (+41 -0) </details> ### 📄 Description Renaming a local key in `value[key]` currently changes its advertised rename-resistant bundle fingerprint; computed and fixed member access can also collide. Keep computed access syntax, omit the dynamic binding spelling, and retain template contents through their own AST tokens. Introduce one shared `babel-ast-v2` identity for producer, static types and worker admission. Retained v1/v2 values cannot structurally match; re-analyze both snapshots for v2 comparison. Exact factory source digests remain distinct. AI-assisted implementation and verification with OpenAI Codex; no linked issue because this came from a reproduced source audit. Verified against base `8fef2aa6`: `npm run check`, test discovery and 43 focused/boundary/owned-worker tests pass; generated documentation checks also passed for the unchanged production contract. The committed worker-schema regression round-trips actual producer v2 facts and rejects v1 at the algorithm field; a mutant permitting v1 fails this test. The affected artifact graph boundary now expects v2 and passes after reproducing the stale v1 failure. Whole-repository version search leaves v1 only in intentional incompatibility documentation and the negative test. Actual compiled CLI and SDK stdio MCP comparisons show distinct source digests and matching v2 fingerprints for renamed keys, with Evidence parity, subsequent ping and cleanup. This is static JavaScript workflow verification, not human approval or an external-provider claim. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:07:18 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5525

No description provided.

Rows
Columns