morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #6481] [MERGED] fix(artifacts): disclose unavailable content hashes in summaries #7364

New issue

Closed

opened 2026-11-01 21:47:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:47:20 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6481
Author: @xiajiahang
Created: 10/23/2026
Status: ✅ Merged
Merged: 10/23/2026
Merged by: @morluto

Base: main ← Head: fix/asar-summary-hash-uncertainty

📝 Commits (1)

3d6834c fix(artifacts): disclose unavailable content hashes in summaries

📊 Changes

2 files changed (+91 additions, -4 deletions)

View changed files

📝 src/domain/analysisView/artifactInventoryView.ts (+2 -4)
➕ tests/boundary/cli/asarSummaryHashUncertainty.test.ts (+89 -0)

📄 Description

Summary

Fixes #6436. ASAR summaries now disclose known unavailable content hashes when an unpacked companion is missing, matching the existing inventory-view caveat. The complete parent Evidence and graph completeness remain intact.

Problem and expected behavior

A complete ASAR inventory can contain an unavailable file hash. Both inspect-artifact --detail summary and a summary of its retained parent previously omitted that known uncertainty. Missing content hashes must remain visible independently of graph completeness.

Change and scope

Compute the shared inventory counts for every view and reuse them in the summary. Hash-count output fields retain their existing format selection. Ordinary static projection fix; a new maintainer scope decision is not applicable.

Contract and boundary impact

Semantic owner: shared artifact inventory view projection.
CLI/MCP contracts: existing unknowns now disclose known hash uncertainty; no schema or tool-catalog change.
Format/platform: format-independent projection; ASAR verified with generated fixtures on macOS.
Evidence/provenance: complete parent retained; unavailable occurrence retains null artifact ID; source_complete remains graph completeness.
Authority/cleanup: reads existing archive bytes; test-generated temporary files use existing test cleanup. No target execution or external service added.
Generated/package/installation impact: none.

Expected effects:

Read existing files or captured data.

Evidence and regression coverage

Public CLI regression generates an ASAR containing inert unpacked addon bytes, then inspects it with the companion present, missing, and restored. Both summary routes must disclose uncertainty only in the missing phase; the saved complete parent retains the matching occurrence. The base regression failed with missing-phase caveat absent. After repair all three phases and both routes pass.

Representative output: missing phase has unknowns containing Content hashes are unknown for some recorded files; missing node IDs do not prove content absence. and source_complete: true. The retained occurrence has hash_status: unavailable, artifact_id: null. Present/restored phases have verified hashes and no such caveat.

Observed, derived, and inferred claims remain distinguishable.
Artifact identity and source provenance remain preserved.
Unavailable outcomes remain visible.

Validation performed

npm run test:focused -- tests/boundary/cli/asarSummaryHashUncertainty.test.ts src/domain/analysisView/artifactInventoryView.test.ts — 11 passed, including six public CLI calls.
npm run check — six tasks passed; architecture guards passed across 1892 source files.
npm run verify:test-discovery — all 2106 test files discovered exactly once.
npm test — started, then manually interrupted (exit 130) during acceptance tests due to the broad suite cost; full suite is not verified. No failure was printed before interruption.

Compatibility, safety, and release

No breaking schema, migration or release metadata changes. Static inspection only; no deep-analysis provider or target application executed. Windows/Linux and MCP transport were not replayed for this change. Shared projector reuse is source-derived.

Author readiness

Human owner: @xiajiahang

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

Maintainer checks and merge decision pending.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6481 **Author:** [@xiajiahang](https://github.com/xiajiahang) **Created:** 10/23/2026 **Status:** ✅ Merged **Merged:** 10/23/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/asar-summary-hash-uncertainty` --- ### 📝 Commits (1) - [`3d6834c`](https://github.com/morluto/rea/commit/3d6834c862f3cfa274ffab2caad15d46b56bb9d4) fix(artifacts): disclose unavailable content hashes in summaries ### 📊 Changes **2 files changed** (+91 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/analysisView/artifactInventoryView.ts` (+2 -4) ➕ `tests/boundary/cli/asarSummaryHashUncertainty.test.ts` (+89 -0) </details> ### 📄 Description ## Summary Fixes #6436. ASAR summaries now disclose known unavailable content hashes when an unpacked companion is missing, matching the existing inventory-view caveat. The complete parent Evidence and graph completeness remain intact. ## Problem and expected behavior A complete ASAR inventory can contain an unavailable file hash. Both `inspect-artifact --detail summary` and a summary of its retained parent previously omitted that known uncertainty. Missing content hashes must remain visible independently of graph completeness. ## Change and scope Compute the shared inventory counts for every view and reuse them in the summary. Hash-count output fields retain their existing format selection. Ordinary static projection fix; a new maintainer scope decision is not applicable. ## Contract and boundary impact - Semantic owner: shared artifact inventory view projection. - CLI/MCP contracts: existing unknowns now disclose known hash uncertainty; no schema or tool-catalog change. - Format/platform: format-independent projection; ASAR verified with generated fixtures on macOS. - Evidence/provenance: complete parent retained; unavailable occurrence retains null artifact ID; source_complete remains graph completeness. - Authority/cleanup: reads existing archive bytes; test-generated temporary files use existing test cleanup. No target execution or external service added. - Generated/package/installation impact: none. Expected effects: - [x] Read existing files or captured data. ## Evidence and regression coverage Public CLI regression generates an ASAR containing inert unpacked addon bytes, then inspects it with the companion present, missing, and restored. Both summary routes must disclose uncertainty only in the missing phase; the saved complete parent retains the matching occurrence. The base regression failed with missing-phase caveat absent. After repair all three phases and both routes pass. Representative output: missing phase has `unknowns` containing `Content hashes are unknown for some recorded files; missing node IDs do not prove content absence.` and `source_complete: true`. The retained occurrence has `hash_status: unavailable`, `artifact_id: null`. Present/restored phases have verified hashes and no such caveat. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity and source provenance remain preserved. - [x] Unavailable outcomes remain visible. ## Validation performed - `npm run test:focused -- tests/boundary/cli/asarSummaryHashUncertainty.test.ts src/domain/analysisView/artifactInventoryView.test.ts` — 11 passed, including six public CLI calls. - `npm run check` — six tasks passed; architecture guards passed across 1892 source files. - `npm run verify:test-discovery` — all 2106 test files discovered exactly once. - `npm test` — started, then manually interrupted (exit 130) during acceptance tests due to the broad suite cost; full suite is not verified. No failure was printed before interruption. ## Compatibility, safety, and release No breaking schema, migration or release metadata changes. Static inspection only; no deep-analysis provider or target application executed. Windows/Linux and MCP transport were not replayed for this change. Shared projector reuse is source-derived. ## Author readiness Human owner: @xiajiahang - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [ ] Maintainer checks and merge decision pending. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:47:20 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-05 01:48:00 +00:00

[PR #7366] [CLOSED] test: align fixtures with admitted sources, inventory rows and Java property framing #7835

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7364

No description provided.

Rows
Columns