[PR #7248] feat(scripts): add repository integrity check #7744

Open
opened 2026-11-03 13:40:05 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7248
Author: @diegorhoger
Created: 10/26/2026
Status: 🔄 Open

Base: main ← Head: cleanup/integrity-recovery-20261021


📝 Commits (5)

  • fd2ed3e chore(deps): decide dependency install scripts
  • a032ab2 feat(scripts): add repository integrity check
  • 5f9d190 test(conformance): cover repository integrity
  • eaeb62e chore(ci): run integrity check in gates
  • 9e3b6da docs: document repository integrity checks

📊 Changes

6 files changed (+696 additions, -4 deletions)

View changed files

📝 CONTRIBUTING.md (+35 -0)
📝 package.json (+8 -4)
➕ scripts/lib/repository-integrity.d.mts (+39 -0)
➕ scripts/lib/repository-integrity.mjs (+288 -0)
➕ scripts/verify-repository-integrity.mjs (+130 -0)
➕ tests/conformance/repositoryIntegrity.test.ts (+196 -0)

📄 Description

Summary

Adds a read-only repository-integrity gate: pure rules in scripts/lib/repository-integrity.mjs, a CLI entry point, conformance coverage, CI wiring, and a documented install-script policy. The gate verifies general invariants of the repository's sensitive configuration instead of matching historical payload signatures.

Problem and expected behavior

The repository's install-time execution and executable configuration surfaces were only reviewed by hand. A dependency that adds an install hook, an unpinned direct dependency, an unresolved lock entry, a duplicate JSON key, or an off-registry resolution could pass review unnoticed. Expected behavior: npm run verify:repository-integrity fails with the specific violation; it reads the working tree and Git index only and never installs, builds, or executes what it inspects.

Change and scope

  • scripts/lib/repository-integrity.mjs + .d.mts: pure rules (findInstallTimeHooks, findUndecidedInstallScripts, findUnpinnedDirectDependencies, findUnresolvedLockEntries, findDuplicateJsonKeys, findConfigurationViolations) over already-loaded documents, so the CLI and the conformance suite read one owner.
  • scripts/verify-repository-integrity.mjs: read-only CLI that loads the tracked JSON/lock/config surfaces and reports findings.
  • tests/conformance/repositoryIntegrity.test.ts: exercises the same exported rules against the real tree.
  • package.json: verify:repository-integrity script, gated in check, check:fast, and check:ci:deep, plus explicit allowScripts decisions for esbuild and fsevents.
  • CONTRIBUTING.md: install-script and integrity-gate policy.

Intentionally not included: no new provider, no target execution, no mutation of inspected configuration, no dependency upgrades.

Follow the contribution scope. Scope decision: not applicable (local static check within existing boundaries, no target interaction).

Contract and boundary impact

  • Semantic owner and earliest changed stage: scripts/lib/repository-integrity.mjs owns parsing of config surfaces and the findings; consumers are the CLI and the conformance test. No superseded path removed.
  • Contribution scope fit and linked maintainer decision: local read-only verification; not applicable.
  • CLI and MCP/tool-catalog contract: no tool-catalog change; adds one npm script.
  • Provider, bridge, target-format, or platform compatibility: none.
  • Evidence, artifact, provenance, or reconstruction contract: findings name the offending file and rule; no evidence artifacts produced.
  • Target selection, authority, upstream behavior, and cleanup details: read-only; no target interaction.
  • Generated metadata, package, or installation impact: allowScripts decisions added; no build outputs committed.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: tests/conformance/repositoryIntegrity.test.ts (8 tests) covering every exported rule.
  • Base reproduction or other evidence: source-derived. The rules fail on the conditions they describe (malformed fixtures are exercised in the conformance test); no historical incident reproduction was performed.
  • User-visible CLI/MCP output: Repository integrity check passed (89 JSON documents, 64 configuration surfaces).
  • Remaining proof gaps: the gate was validated on Windows with Node 24.22.1 only; no Linux/macOS run was performed here.

Validation performed

  • npm run verify:repository-integrity — passed (89 JSON documents, 64 configuration surfaces)
  • npm run test:local -- tests/conformance/repositoryIntegrity.test.ts — 8/8 tests passed
  • npm run check:fast — passed (typecheck + lint, then the integrity gate)
  • npm ci — completed on Node 24.22.1 (required by the current engines)
  • git diff --check origin/main..HEAD — clean

Compatibility, safety, and release

  • Breaking changes or migration steps: none.
  • Real Hopper/Ghidra, browser, or OS coverage: not applicable; no target or provider code touched.
  • Package or release metadata impact: new npm script; allowScripts decisions for existing locked packages (esbuild@0.28.2, esbuild@0.25.12, fsevents@2.3.3) set to false.
  • Security, privacy, process, or containment review: the gate is read-only and inspects but never executes configuration.

Author readiness

Human owner:

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

No issue is linked because none was identified for this gate; the contribution is a self-contained hardening change.


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7248 **Author:** [@diegorhoger](https://github.com/diegorhoger) **Created:** 10/26/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `cleanup/integrity-recovery-20261021` --- ### 📝 Commits (5) - [`fd2ed3e`](https://github.com/morluto/rea/commit/fd2ed3e5082456cb6265bad1bf7d83abd67df1ad) chore(deps): decide dependency install scripts - [`a032ab2`](https://github.com/morluto/rea/commit/a032ab2bab978244cdc51d3facc89ebe1e02cd93) feat(scripts): add repository integrity check - [`5f9d190`](https://github.com/morluto/rea/commit/5f9d190720d67ade826d95bc6726dff0f5c515f5) test(conformance): cover repository integrity - [`eaeb62e`](https://github.com/morluto/rea/commit/eaeb62e97f670900c7875a3a73f5e1d117a57c20) chore(ci): run integrity check in gates - [`9e3b6da`](https://github.com/morluto/rea/commit/9e3b6dabfbd076a87a9a6028341b8c4f07ecfcdb) docs: document repository integrity checks ### 📊 Changes **6 files changed** (+696 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `CONTRIBUTING.md` (+35 -0) 📝 `package.json` (+8 -4) ➕ `scripts/lib/repository-integrity.d.mts` (+39 -0) ➕ `scripts/lib/repository-integrity.mjs` (+288 -0) ➕ `scripts/verify-repository-integrity.mjs` (+130 -0) ➕ `tests/conformance/repositoryIntegrity.test.ts` (+196 -0) </details> ### 📄 Description ## Summary Adds a read-only repository-integrity gate: pure rules in `scripts/lib/repository-integrity.mjs`, a CLI entry point, conformance coverage, CI wiring, and a documented install-script policy. The gate verifies general invariants of the repository's sensitive configuration instead of matching historical payload signatures. ## Problem and expected behavior The repository's install-time execution and executable configuration surfaces were only reviewed by hand. A dependency that adds an install hook, an unpinned direct dependency, an unresolved lock entry, a duplicate JSON key, or an off-registry resolution could pass review unnoticed. Expected behavior: `npm run verify:repository-integrity` fails with the specific violation; it reads the working tree and Git index only and never installs, builds, or executes what it inspects. ## Change and scope - `scripts/lib/repository-integrity.mjs` + `.d.mts`: pure rules (`findInstallTimeHooks`, `findUndecidedInstallScripts`, `findUnpinnedDirectDependencies`, `findUnresolvedLockEntries`, `findDuplicateJsonKeys`, `findConfigurationViolations`) over already-loaded documents, so the CLI and the conformance suite read one owner. - `scripts/verify-repository-integrity.mjs`: read-only CLI that loads the tracked JSON/lock/config surfaces and reports findings. - `tests/conformance/repositoryIntegrity.test.ts`: exercises the same exported rules against the real tree. - `package.json`: `verify:repository-integrity` script, gated in `check`, `check:fast`, and `check:ci:deep`, plus explicit `allowScripts` decisions for `esbuild` and `fsevents`. - `CONTRIBUTING.md`: install-script and integrity-gate policy. Intentionally not included: no new provider, no target execution, no mutation of inspected configuration, no dependency upgrades. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Scope decision: not applicable (local static check within existing boundaries, no target interaction). ## Contract and boundary impact - Semantic owner and earliest changed stage: `scripts/lib/repository-integrity.mjs` owns parsing of config surfaces and the findings; consumers are the CLI and the conformance test. No superseded path removed. - Contribution scope fit and linked maintainer decision: local read-only verification; not applicable. - CLI and MCP/tool-catalog contract: no tool-catalog change; adds one npm script. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: findings name the offending file and rule; no evidence artifacts produced. - Target selection, authority, upstream behavior, and cleanup details: read-only; no target interaction. - Generated metadata, package, or installation impact: `allowScripts` decisions added; no build outputs committed. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `tests/conformance/repositoryIntegrity.test.ts` (8 tests) covering every exported rule. - Base reproduction or other evidence: source-derived. The rules fail on the conditions they describe (malformed fixtures are exercised in the conformance test); no historical incident reproduction was performed. - User-visible CLI/MCP output: `Repository integrity check passed (89 JSON documents, 64 configuration surfaces).` - Remaining proof gaps: the gate was validated on Windows with Node 24.22.1 only; no Linux/macOS run was performed here. ## Validation performed - `npm run verify:repository-integrity` — passed (89 JSON documents, 64 configuration surfaces) - `npm run test:local -- tests/conformance/repositoryIntegrity.test.ts` — 8/8 tests passed - `npm run check:fast` — passed (typecheck + lint, then the integrity gate) - `npm ci` — completed on Node 24.22.1 (required by the current `engines`) - `git diff --check origin/main..HEAD` — clean ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; no target or provider code touched. - Package or release metadata impact: new npm script; `allowScripts` decisions for existing locked packages (`esbuild@0.28.2`, `esbuild@0.25.12`, `fsevents@2.3.3`) set to `false`. - Security, privacy, process, or containment review: the gate is read-only and inspects but never executes configuration. ## Author readiness Human owner: <!-- to be completed by the human owner --> - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. No issue is linked because none was identified for this gate; the contribution is a self-contained hardening change. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7744
No description provided.