morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7206] [MERGED] fix(harmony): classify exact manifest names once #7716

New issue

Closed

opened 2026-11-03 13:39:51 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 13:39:51 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7206
Author: @rudycelekli
Created: 10/26/2026
Status: ✅ Merged
Merged: 10/27/2026
Merged by: @gensokyo-dev

Base: main ← Head: fix-harmony-manifest-filename-case

📝 Commits (10+)

d34b6d4 fix(harmony): match module.json and config.json exactly
cf0c9f9 Merge commit '60b55be7e7' into HEAD
21a4765 Merge branch 'main' of https://github.com/morluto/rea into remediate/7206-20261027
921225d fix(apk): match signer serials by signed integer identity (#7205)
3e590e5 fix(evidence): retain malformed native observations
160648c fix(filesystem): unify stable file identity checks
7968ceb fix(process): normalize capture environment overrides
b95d8b1 fix(harmony): classify exact manifest paths once
0f1d711 Merge original Harmony manifest fix with shared classification
b1eb79f test(harmony): group manifest boundary regressions

📊 Changes

17 files changed (+586 additions, -121 deletions)

View changed files

📝 docs/harmony-analysis.md (+4 -1)
📝 src/application/native/NativeCallRoutes.ts (+20 -1)
📝 src/application/native/NativeDispatchMetadataInspection.ts (+29 -5)
➕ src/application/native/NativeReaderEvidence.test.ts (+95 -0)
📝 src/application/native/NativeValueTrace.test.ts (+52 -0)
📝 src/application/native/NativeValueTrace.ts (+18 -18)
📝 src/domain/apkSignature/apkV1SignatureBlock.test.ts (+52 -0)
📝 src/domain/apkSignature/apkV1SignatureBlock.ts (+22 -8)
📝 src/domain/harmony/harmonyApplication.ts (+25 -20)
📝 src/filesystem/RegularFile.ts (+30 -0)
📝 src/filesystem/StableFileHash.ts (+6 -13)
📝 src/filesystem/readStableFileBytes.ts (+4 -37)
➕ src/process/capture/ProcessCaptureEnvironment.test.ts (+53 -0)
📝 src/process/capture/ProcessCaptureEnvironment.ts (+24 -12)
📝 tests/boundary/filesystem/harmony/application.test.ts (+74 -0)
📝 tests/boundary/filesystem/stableFileHashOwnership.test.ts (+41 -1)
📝 tests/fixtures/apkSignature/v1SignatureBlock.ts (+37 -5)

📄 Description

Summary

MODULE.JSON, CONFIG.JSON and PACK.INFO were treated as the advertised lowercase manifest names, causing false Stage/FA hints and manifest components. Match exact ZIP member names. No exact open issue is linked; this was reported directly as a PR. OpenHarmony package structure describes the emitted lowercase names.

One manifest classifier now owns the path rule for both model hints and component collection, replacing the duplicated model scans and manifest filter. It reads already parsed file/slice occurrences, excludes resource paths, preserves Stage precedence and keeps path hints when content identity is unavailable. Encrypted/unavailable content still has null identity and partial coverage. CLI/MCP use the same domain implementation; docs clarify the rule. This is an execution-free boundary correction within existing scope.

Validation

Fresh main 7968ceb4508cd5be55c21c86e8da5338ba655659 (contains merged #7205). Original case regression on unchanged production: 1 failed / 27 passed.

Final focused Harmony boundary suite: 33 passed, including exact names, FA/Stage precedence in both traversal orders, resource exclusion, encrypted/unavailable manifests, signing suffixes, App Pack children and source-integrity boundaries. The first static run caught a new oversized test group; manifest regressions were moved into a focused group and all 33 tests passed again.
docs:check passed (including 9 conformance tests). Serial check:fast: passed in 37.587 s elapsed / 55.564 s CPU, 3650.13 MiB sampled family RSS. No broad CI/resource configuration change.
Actual published harmony-next-pipeline 1.0.1 HAP: 112885 bytes, SHA-256 928a4c6718125328695d2c32297ef5dfba2e06d16fd501d507d4aa32423cbad6, pinned by the repository fixture manifest. CLI inspection/projection and actual stdio MCP open/inspection/projection/close were exercised before and after. Original HAP retains its complete projection Evidence, source IDs, projection ID, component hashes, one ets/modules.abc path and eight resources. A generated ZIP derivative changes only the two manifest names (payload bytes preserved): base falsely reports Stage/manifests, fix returns unknown/no manifests. Inputs are SHA-checked after inspection. No Harmony device execution, manifest/Ark decoding or independently reproduced compiler/SDK build is claimed.
Same carrier supplied to CLI/MCP yields identical projection facts and source links; native MCP inspection/projection separately retains its own carrier identity. The first two probe attempts had invalid harness assumptions about equality across different inspection metadata/provenance; corrected before successful baseline/fixed runs. The shipped node scripts/verify/harmony/analysis.mjs was also executed: CLI and MCP inspection pass, then its line-196 equality assertion fails on differing source/projection IDs. An unchanged exact-main 7968ceb45 build reproduces the identical failure and IDs. It is not reported as a passing verifier; the independent same-carrier/native-provenance probe above passes.
Same 16-call workflow (6 CLI / 10 MCP): 15.493 → 15.683 s elapsed, 19.001 → 19.308 s CPU, 718.49 → 713.20 MiB sampled family RSS, two CPUs. One uncontrolled pair establishes no speedup/regression. CLI cold phases and warmed MCP projections were recorded separately. Canonical CLI/MCP replies remain 6489/13463 bytes; corrected uppercase replies shrink because false manifest facts are removed, with full source Evidence retained. Model tokens are unmeasured; RSS sums can double-count shared pages and miss short peaks. No new cache or protocol request.

Hosted CI and review

Final CI 40453848066 tested exact f1af6e3193dc9a35cd30729c5616abfda0b8dc54 against main 98e47e37a2c657342196313b0381157f01b38771: 7 successful, 4 failed, 19 skipped, 7 cancelled jobs. Build, static, docs and real-apk-signature passed; seven fail-fast-cancelled test shards remain unverified.

Source: 17 failed / 20682 passed / 15 skipped. Unchanged exact-main control reproduces identical 17 Apple inventory/provider-binding/Windows-loader failures (17 failed / 49 passed).
Shard 8: 20 failed / 1900 passed / 15 skipped. Unchanged exact-main replay reproduces all 20 failing names/assertions (20 failed / 121 filtered). These involve Electron IPC counts, process cleanup ownership, model/PCAP and client-registration fixtures, not Harmony manifest classification. Portable/required jobs aggregate these existing-main failures.
The separate shipped-Harmony verifier's cross-carrier source/projection-ID assertion also fails identically on unchanged starting main, as detailed above. Independent real-HAP same-source and native-provenance checks passed.

Greptile reviewed final f1af6e319 at 4/5 with one existing-main generic file-reader cleanup suggestion. Producer/consumer inspection and identical-blob scope proof: resolved outside this three-file Harmony change, not fixed or runtime-reproduced. No actionable manifest finding was raised. The tested b1eb79fa4 and final head have the identical whole Git tree ee6a6e4b8bde1734ae41b582e183798025f68c92; a concurrent fork synchronization merge changed ancestry only. This resolves the review's temporary-candidate provenance concern without claiming a human review. Codex quota is exhausted. Human declarations remain unchecked; requester explicitly authorized readiness and unrelated-main CI bypass.

Author readiness

Human owner: @rudycelekli

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7206 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/26/2026 **Status:** ✅ Merged **Merged:** 10/27/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `fix-harmony-manifest-filename-case` --- ### 📝 Commits (10+) - [`d34b6d4`](https://github.com/morluto/rea/commit/d34b6d4363180d18373c1abf6b12467da15ba0c5) fix(harmony): match module.json and config.json exactly - [`cf0c9f9`](https://github.com/morluto/rea/commit/cf0c9f9d021fbc75278860917c135c0cafa373d1) Merge commit '60b55be7e7ef666ec071b6bf9099f55c6aa75b45' into HEAD - [`21a4765`](https://github.com/morluto/rea/commit/21a4765679f10ea72ea92b2d497580bff3ede1f6) Merge branch 'main' of https://github.com/morluto/rea into remediate/7206-20261027 - [`921225d`](https://github.com/morluto/rea/commit/921225d4b2b83bb8331e4b41aa1a7bafd9f3fbcf) fix(apk): match signer serials by signed integer identity (#7205) - [`3e590e5`](https://github.com/morluto/rea/commit/3e590e5b2ff21510fb143d1334cad8f9caa85d9f) fix(evidence): retain malformed native observations - [`160648c`](https://github.com/morluto/rea/commit/160648cc60e5550e2faf410f5f5bd693fe8a8afc) fix(filesystem): unify stable file identity checks - [`7968ceb`](https://github.com/morluto/rea/commit/7968ceb4508cd5be55c21c86e8da5338ba655659) fix(process): normalize capture environment overrides - [`b95d8b1`](https://github.com/morluto/rea/commit/b95d8b1433a9955d2c1796a7dc93daf5a483630b) fix(harmony): classify exact manifest paths once - [`0f1d711`](https://github.com/morluto/rea/commit/0f1d7119b1e41a89069b7e3b80e2d383f014ab1b) Merge original Harmony manifest fix with shared classification - [`b1eb79f`](https://github.com/morluto/rea/commit/b1eb79fa49652b41e52f84651633f7f290824d45) test(harmony): group manifest boundary regressions ### 📊 Changes **17 files changed** (+586 additions, -121 deletions) <details> <summary>View changed files</summary> 📝 `docs/harmony-analysis.md` (+4 -1) 📝 `src/application/native/NativeCallRoutes.ts` (+20 -1) 📝 `src/application/native/NativeDispatchMetadataInspection.ts` (+29 -5) ➕ `src/application/native/NativeReaderEvidence.test.ts` (+95 -0) 📝 `src/application/native/NativeValueTrace.test.ts` (+52 -0) 📝 `src/application/native/NativeValueTrace.ts` (+18 -18) 📝 `src/domain/apkSignature/apkV1SignatureBlock.test.ts` (+52 -0) 📝 `src/domain/apkSignature/apkV1SignatureBlock.ts` (+22 -8) 📝 `src/domain/harmony/harmonyApplication.ts` (+25 -20) 📝 `src/filesystem/RegularFile.ts` (+30 -0) 📝 `src/filesystem/StableFileHash.ts` (+6 -13) 📝 `src/filesystem/readStableFileBytes.ts` (+4 -37) ➕ `src/process/capture/ProcessCaptureEnvironment.test.ts` (+53 -0) 📝 `src/process/capture/ProcessCaptureEnvironment.ts` (+24 -12) 📝 `tests/boundary/filesystem/harmony/application.test.ts` (+74 -0) 📝 `tests/boundary/filesystem/stableFileHashOwnership.test.ts` (+41 -1) 📝 `tests/fixtures/apkSignature/v1SignatureBlock.ts` (+37 -5) </details> ### 📄 Description ## Summary `MODULE.JSON`, `CONFIG.JSON` and `PACK.INFO` were treated as the advertised lowercase manifest names, causing false Stage/FA hints and manifest components. Match exact ZIP member names. No exact open issue is linked; this was reported directly as a PR. [OpenHarmony package structure](https://github.com/openharmony/docs/blob/master/en/application-dev/quick-start/application-package-structure-stage.md) describes the emitted lowercase names. One manifest classifier now owns the path rule for both model hints and component collection, replacing the duplicated model scans and manifest filter. It reads already parsed file/slice occurrences, excludes resource paths, preserves Stage precedence and keeps path hints when content identity is unavailable. Encrypted/unavailable content still has null identity and partial coverage. CLI/MCP use the same domain implementation; docs clarify the rule. This is an execution-free boundary correction within existing scope. ## Validation Fresh main `7968ceb4508cd5be55c21c86e8da5338ba655659` (contains merged #7205). Original case regression on unchanged production: **1 failed / 27 passed**. - Final focused Harmony boundary suite: **33 passed**, including exact names, FA/Stage precedence in both traversal orders, resource exclusion, encrypted/unavailable manifests, signing suffixes, App Pack children and source-integrity boundaries. The first static run caught a new oversized test group; manifest regressions were moved into a focused group and all 33 tests passed again. - `docs:check` passed (including 9 conformance tests). Serial `check:fast`: passed in 37.587 s elapsed / 55.564 s CPU, 3650.13 MiB sampled family RSS. No broad CI/resource configuration change. - Actual published `harmony-next-pipeline` 1.0.1 HAP: 112885 bytes, SHA-256 `928a4c6718125328695d2c32297ef5dfba2e06d16fd501d507d4aa32423cbad6`, pinned by the repository fixture manifest. CLI inspection/projection and actual stdio MCP open/inspection/projection/close were exercised before and after. Original HAP retains its complete projection Evidence, source IDs, projection ID, component hashes, one `ets/modules.abc` path and eight resources. A generated ZIP derivative changes only the two manifest names (payload bytes preserved): base falsely reports Stage/manifests, fix returns unknown/no manifests. Inputs are SHA-checked after inspection. No Harmony device execution, manifest/Ark decoding or independently reproduced compiler/SDK build is claimed. - Same carrier supplied to CLI/MCP yields identical projection facts and source links; native MCP inspection/projection separately retains its own carrier identity. The first two probe attempts had invalid harness assumptions about equality across different inspection metadata/provenance; corrected before successful baseline/fixed runs. The shipped `node scripts/verify/harmony/analysis.mjs` was also executed: CLI and MCP inspection pass, then its line-196 equality assertion fails on differing source/projection IDs. An unchanged exact-main `7968ceb45` build reproduces the identical failure and IDs. It is **not** reported as a passing verifier; the independent same-carrier/native-provenance probe above passes. - Same 16-call workflow (6 CLI / 10 MCP): **15.493 → 15.683 s elapsed, 19.001 → 19.308 s CPU, 718.49 → 713.20 MiB sampled family RSS**, two CPUs. One uncontrolled pair establishes no speedup/regression. CLI cold phases and warmed MCP projections were recorded separately. Canonical CLI/MCP replies remain 6489/13463 bytes; corrected uppercase replies shrink because false manifest facts are removed, with full source Evidence retained. Model tokens are unmeasured; RSS sums can double-count shared pages and miss short peaks. No new cache or protocol request. ## Hosted CI and review [Final CI 40453848066](https://github.com/morluto/rea/actions/runs/40453848066) tested exact `f1af6e3193dc9a35cd30729c5616abfda0b8dc54` against main `98e47e37a2c657342196313b0381157f01b38771`: **7 successful, 4 failed, 19 skipped, 7 cancelled jobs**. Build, static, docs and real-apk-signature passed; seven fail-fast-cancelled test shards remain unverified. - Source: 17 failed / 20682 passed / 15 skipped. Unchanged exact-main control reproduces identical 17 Apple inventory/provider-binding/Windows-loader failures (17 failed / 49 passed). - Shard 8: 20 failed / 1900 passed / 15 skipped. Unchanged exact-main replay reproduces all 20 failing names/assertions (20 failed / 121 filtered). These involve Electron IPC counts, process cleanup ownership, model/PCAP and client-registration fixtures, not Harmony manifest classification. Portable/required jobs aggregate these existing-main failures. - The separate shipped-Harmony verifier's cross-carrier source/projection-ID assertion also fails identically on unchanged starting main, as detailed above. Independent real-HAP same-source and native-provenance checks passed. Greptile reviewed final `f1af6e319` at **4/5** with one existing-main generic file-reader cleanup suggestion. [Producer/consumer inspection and identical-blob scope proof](https://github.com/morluto/rea/pull/7206#discussion_r4385355150): resolved outside this three-file Harmony change, not fixed or runtime-reproduced. No actionable manifest finding was raised. The tested `b1eb79fa4` and final head have the identical whole Git tree `ee6a6e4b8bde1734ae41b582e183798025f68c92`; a concurrent fork synchronization merge changed ancestry only. This resolves the review's temporary-candidate provenance concern without claiming a human review. Codex quota is exhausted. Human declarations remain unchecked; requester explicitly authorized readiness and unrelated-main CI bypass. ## Author readiness Human owner: @rudycelekli - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-03 13:39:51 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7716

No description provided.

Rows
Columns