mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-05 12:29:37 +01:00
merge: reconcile published native prerequisite and current master
Preserve canonical startup ownership, scoped evidence, current Storybook IDs, and the Codex form controls while carrying Claude effort and immutable source bindings. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed
commit
48ffca9438
415 files changed
+22501
-15340
No files matched your search
@@ -2,10 +2,90 @@
|
||||
|
||||
Updated 2026-10-12.
|
||||
|
||||
## Production readiness: owned startup correction
|
||||
|
||||
The human requests production readiness; preparation and normal sequential
|
||||
merges remain authorized. Production deployment and provisioning-default
|
||||
promotion remain separate actions. Nothing in this checkpoint is merged or
|
||||
deployed, and the stack is not production-ready.
|
||||
|
||||
Runtime prerequisite behavior is `ce23716503a2c9158b5a7ab74ab61571ff4ee7a3`
|
||||
on `codex/runner-native-platform-prerequisites`, in
|
||||
[#16028](https://github.com/paperclipai/paperclip/pull/16028). Final qualification
|
||||
reproduced close returning before credential preparation drained, followed by
|
||||
registration and launch. Both direct close and real driver cancellation failed
|
||||
on literal `5a9ce11`. The initial shared repair from Claude commit `463ebb` is
|
||||
reused, with independently identified duplicate-admission, shutdown-readiness and
|
||||
resume ordering corrections. All five source findings are closed in matching
|
||||
source review. Absolute cleanup deadlines, primary cancellation errors,
|
||||
unauthenticated-process protection and existing agents' runner choices remain.
|
||||
|
||||
The existing suites pass 32 credential-free controls across three files; both
|
||||
canonical runner TypeScript no-emit checks pass. No new suite, local Rust/Docker
|
||||
build, provider call or credential-content read was used. Actual daemon
|
||||
readiness/recovery controls remain **hosted-CI required**: local worktrees lack
|
||||
the existing fake-Codex/fake-harness executables. The failed local native attempt
|
||||
never reached the readiness assertion and is not qualification. Receipts are
|
||||
`/private/tmp/pr2-463ebb-owned-startup-review-closure-receipt.json` and
|
||||
`/private/tmp/ci-final-owned-startup-five-gap-closure-review.json`.
|
||||
|
||||
Normal automatic merge is disabled and the prerequisite is draft while this
|
||||
correction receives fresh full CI, package qualification and 5/5 review.
|
||||
Earlier green checks at `5a9ce11` remain historical. Actual code-owner approval
|
||||
is still required; no protection is bypassed. The updated runs/adapters map pair
|
||||
records source-only scope, bringing the prerequisite review to 63 files after the required Storybook
|
||||
catalog review below.
|
||||
|
||||
Codex remains `1a0ca66242121e39d88455aa2b52a07acc4a07d9` in
|
||||
[#15683](https://github.com/paperclipai/paperclip/pull/15683), based on the previous
|
||||
prerequisite. The Claude owner retains its branches, cached guided-setup fix,
|
||||
verification and separate $50 allowance. Coordinate reconciliation of the common
|
||||
repair before rewriting those branches; don't duplicate it in a leaf slice.
|
||||
|
||||
The idle [local preview](http://127.0.0.1:3125/COD/agents/all) still serves literal
|
||||
behavior `fe1ecf1c34`, recovery ready and zero active runs. Its four saved
|
||||
legacy/native configurations and two historical native records remain preserved;
|
||||
it has not been refreshed to this new runtime. Final local/managed acceptance
|
||||
must use the tested source, independent file checks and follow-up continuity.
|
||||
|
||||
The prepared private execution checklist reuses existing evals, installation,
|
||||
Cloud composition and campaign paths. Required holds are final source/image/
|
||||
migrator, the actual verified-master private distribution, pinned QA onboarding,
|
||||
warm/cold signup, production baseline and previous-image compatibility. Production
|
||||
Fleet Admin sign-in is pending. Current paid holds remain $248.179254104 of $250;
|
||||
unknown/cleanup holds stay reserved, and the unstarted managed envelope is $2.50.
|
||||
No new image, paid resource, rollout or default promotion was dispatched.
|
||||
|
||||
Master reconciliation uses `4b958ecbd8f33a7782fe6f29ec825f80f636b833`.
|
||||
The new contribution rules are satisfied: 157 added comment annotations were
|
||||
removed from 35 files, with identical executable JavaScript/TypeScript emission,
|
||||
parsed workflow values, 77 action pins and shell commands. No code file crosses
|
||||
from below 1,000 lines to above that limit. Final focused checks pass 248 tests
|
||||
(107 workflow/package, 54 runner, 42 server, 45 E2E support). Both runner no-emit
|
||||
checks and the canonical server/E2E no-emit checks pass with isolated matching
|
||||
workspace dependencies. Only JavaScript/TypeScript preparation ran locally;
|
||||
root preview links and data stayed unchanged. The earlier linked-source failures
|
||||
remain recorded and are superseded only by the new canonical check receipt.
|
||||
|
||||
The existing Storybook catalog has 21 source-review fingerprint updates because
|
||||
its declared runs/adapters map input changed. All affected stories, subjects,
|
||||
wrappers and fixtures remain byte-identical to master. Review classifications
|
||||
stay unchanged. The catalog check passes 223 files/2,210 stories; this is
|
||||
structural/source evidence, not visual or live proof. Source receipts are
|
||||
`/private/tmp/pr2-9f59-comments-cleanup-receipt.json`,
|
||||
`/private/tmp/pr2-storybook-owned-final-receipt.json` and
|
||||
`/private/tmp/pr2-frozen-canonical-noemit-receipt.json`.
|
||||
|
||||
Next action: publish this reviewed prerequisite correction, require fresh hosted
|
||||
gates, reconcile Codex and Claude with its actual source, then resume the existing
|
||||
remote package/immutable preview and dedicated staging qualification. Merge ready
|
||||
slices normally in the agreed order; actual production readiness requires the
|
||||
private distribution and rollback/forward-recovery evidence afterward.
|
||||
|
||||
## CI fixture, network policy and map synchronization checkpoint
|
||||
|
||||
Runtime prerequisite source is `5a9ce11c49db31440863d633426ebe30bcc850ca`
|
||||
with 60 changed files. The hosted static check on literal Codex source `eee0534`
|
||||
with 59 changed files. The hosted static check on literal Codex source `eee0534`
|
||||
passed 133 cases and failed one: its isolated assembly fixture omitted the new
|
||||
target JSON, so the helper failed before its existing Cursor-identity assertion.
|
||||
The fixture now copies that exact inert JSON; all negative assertions remain.
|
||||
|
||||
@@ -0,0 +1,100 @@
|
||||
# Chat channel callback and delivery boundaries, batch four
|
||||
|
||||
Base: 4b766b872993045a2e787404f0475503683e5ded. Batch three (#15995, #15996, #15999, #16001, #16002)
|
||||
is merged. The service starts at 26,461 lines / 1,046,711 bytes.
|
||||
This batch may create up to ten stacked PRs. Merging the new batch is separate work.
|
||||
|
||||
| Order / boundary | Destination | Approx. moved / net lines | Contract and state | Risks and existing verification |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| 1. Slack callback verification | `slack/callback-verification.ts` | 250 / 230 | Pure signature/workspace/URL inspection plus signed URL verification; explicit vault lookup, URL getter, scheduling and registration callbacks | Preserve signing-secret-only setup, original request, TLS/proxy evidence and workspace checks. Signed verification and callback health cases before/after. |
|
||||
| 2. Discord Gateway events | `discord/gateway-events.ts` | 200 / 185 | Runtime fence and lease-owner predicates, endpoint lookup and lifecycle callback; original per-runtime event queue and sequence | Preserve stale-owner fencing, event order, transient guild recovery and terminal revocation. Gateway lifecycle cases before/after. |
|
||||
| 3. Discord root threads | `discord/root-threads.ts` | 500 / 460 | Credential lease, current principal authority, runtime, message admission and conversation drain callbacks | Preserve uncertain thread creation, restart reconciliation, no duplicate starter and pause/credential serialization. Root-thread public-service cases. |
|
||||
| 4. Receipt reactions | `receipt-reactions.ts` and Slack error classifier beside Slack messages | 545 / 500 | Durable reaction claim/transport/settlement with runtime and credential fences; no scheduling owner moves | Preserve retries, legacy GitHub receipts, terminal-removal supersession and same-attempt settlement. Receipt recovery cases before/after. |
|
||||
| 5. Inbound reactions | `reactions.ts` | 800 / 740 | Conversation lookup/locks, reaction admission and deferred replay together; current principal/runtime callbacks | Preserve exact event dedupe, completed generation links, bounded replay age and no task wakeup. Reaction race/restart/authorization cases. |
|
||||
| 6. Inbound attachments | `inbound-attachments.ts` | 600 / 550 | Existing storage and issue service, retained source authorization and live options; return same attachment results | Preserve size limits, source authority around I/O, omissions and text delivery. Provider attachment/restart/stale-authority cases. |
|
||||
| 7. Outbound attachments | `outbound-attachments.ts`; provider Markdown wrappers beside provider messages | 245 / 220 | Metadata validation and bounded integrity-checked hydration; existing storage object. Keep public hydration export compatible | Preserve stream cleanup, deadlines, byte/digest checks and retry classification. Hydration and publication attachment cases. |
|
||||
| 8. Provider effects | `provider-effects.ts` | 950 / 850 | Durable reply claim, authorization, transport and settlement; endpoint/runtime/credential/principal callbacks | Preserve uncertain-delivery quarantine, credential fence and transaction ordering. Native callback, task-control and reply recovery cases. Put Telegram-only authority under `telegram/` if its contract is narrow. |
|
||||
| 9. Conversation and activity reads | `activity.ts` | 540 / 520 | Endpoint lookup and read-only Teams conflict projection; return existing API models | Preserve company/endpoint joins, mixed-source cursor ties, replay eligibility and read-only GETs. Activity, file receipt projection and conversation-state cases. |
|
||||
| 10. Setup probes | `setup-probes.ts` | 280 / 250 | Credential lease, current identity/principal authority, provider fetch, endpoint projection and live activation hook | Preserve real-message requirement, generation and linked-user activation. Setup-test, reconnect and authorization cases. |
|
||||
|
||||
Each slice must earn its place after reading its complete path and callers.
|
||||
Reassess before implementation; stop short of ten if the remaining contracts are
|
||||
not cohesive. Keep provider-specific code in channel folders and common durable
|
||||
workflows in the shared chat-channels directory.
|
||||
|
||||
Receiver lease ownership stays shared: the existing Discord-named owner is also
|
||||
used by Photon. Shared lifecycle/application admission, queue-drain ownership,
|
||||
worker scheduling, and the largest action/message handlers remain in the service.
|
||||
Do not hide their dependencies in a mutable context object. Preserve live option
|
||||
hooks, runtime-map identity, partial-failure cleanup, and initialization order.
|
||||
|
||||
Run relevant existing public-service tests before and after each mechanical move.
|
||||
Compare moved declarations and remaining statements with normalized syntax, then
|
||||
run server types, module boundaries and whitespace checks. Finish local verification and a fresh
|
||||
5/5 review before opening the next draft PR. GitHub runner-selection jobs remained
|
||||
queued without steps for over 25 minutes in this batch. To continue the authorized
|
||||
stack, publish drafts in review order while tracking CI as pending; CI remains a
|
||||
merge gate. Run cumulative repository gates at handoff.
|
||||
Retain failures and skipped/unrun coverage even when an isolated retry passes.
|
||||
Use fixture-backed assembled service/database tests; do not claim live provider
|
||||
execution. Remap LOC/bytes and the remaining orchestration after the batch.
|
||||
|
||||
## Slice 1: Slack callback verification
|
||||
|
||||
- Service: 26,461 lines / 1,046,711 bytes → 26,201 lines / 1,035,260 bytes.
|
||||
- Destination: 299 lines / 13,038 bytes. Eight declarations move without body
|
||||
changes. Three existing setup types move unchanged into `runtime-types.ts`.
|
||||
- The verification factory initializes after Slack registration. It receives the
|
||||
same registration object, credential resolver, live URL getter and scheduler.
|
||||
Signature/workspace/URL helpers remain callable by shared webhook orchestration.
|
||||
- Nine public-service cases passed before and after on the updated master base.
|
||||
Server typecheck, module boundaries, whitespace and normalized syntax parity
|
||||
passed. Coverage includes signed URL verification, account notification,
|
||||
workspace rejection, callback surfaces, TLS termination and Cloud host evidence.
|
||||
- Next: Discord Gateway event sequencing and health transitions. Keep shared
|
||||
receiver lease ownership and runtime-map lifetime in the service.
|
||||
|
||||
## Batch outcome
|
||||
|
||||
All ten candidates produced cohesive boundaries. Shared receiver ownership, queue
|
||||
management and worker scheduling remain in the service. The only intentional
|
||||
control-wiring change is deferred access to `stageProviderEffect` from identity
|
||||
link construction; typecheck and integration tests caught the initial early read.
|
||||
|
||||
| Slice | Service lines after | Primary module lines | Before/after cases |
|
||||
| --- | ---: | ---: | ---: |
|
||||
| 1. Slack signature, workspace and callback url verification | 26,233 | 300 | 9 |
|
||||
| 2. Discord gateway event sequencing and endpoint health transitions | 26,029 | 253 | 7 |
|
||||
| 3. Discord root-thread admission, provider creation and durable recovery | 25,527 | 570 | 4 |
|
||||
| 4. Durable receipt reaction claims, transport, retries and settlement | 24,975 | 586 | 7 |
|
||||
| 5. Inbound reaction conversation lookup, admission and deferred replay | 24,160 | 891 | 21 |
|
||||
| 6. Inbound attachment authorization, bounded ingestion, registration and omissions | 23,565 | 674 | 39 |
|
||||
| 7. Outbound attachment metadata validation and bounded integrity-checked hydration | 23,298 | 294 | 22 |
|
||||
| 8. Durable provider reply staging, authorization, transport and recovery | 22,331 | 957 | 24 |
|
||||
| 9. Conversation summaries and paginated activity projections | 21,741 | 616 | 16 |
|
||||
| 10. Setup message detection and credential-fenced round-trip qualification | 21,460 | 353 | 7 |
|
||||
|
||||
After rebasing on master `8e7b5db822`, the service shrank from
|
||||
**26,493 lines / 1,048,769 bytes** to **21,460 lines /
|
||||
862,284 bytes** (5,033 fewer lines, about 19%). Normalized syntax comparison
|
||||
checks all 69 moved declarations/types and every remaining original statement.
|
||||
Server types, targeted tests, module boundaries and whitespace checks are the
|
||||
per-slice gates. Cumulative repository gates and remote reviews are recorded in
|
||||
the PR descriptions as they complete.
|
||||
|
||||
Orchestration measurement: the service function has 150 nested functions
|
||||
(19,399 lines) and 67 state/wiring statements (459 lines), versus 191 functions
|
||||
(23,829 lines) and 54 statements (425 lines) at the start. Imports take 400 lines.
|
||||
The remaining large paths are `processMessage` (2,166), `handleAction` (1,074),
|
||||
`configureWithCredentialLease` (868), `processSelectedPublication` (729),
|
||||
`handleModalSubmit` (708), `handleWebhook` (685), and lifecycle processing (657).
|
||||
|
||||
A future pass should inspect publication admission/transport/settlement as one
|
||||
workflow, then inbound delivery authorization and drain ownership. Those cuts
|
||||
need explicit ownership contracts; avoid separating individual checks from their
|
||||
transactions merely to reduce the remaining line count.
|
||||
|
||||
The rebase preserves the merged managed Slack setup flow, including its shared
|
||||
`isProvisionedSlackSetup` predicate in the extracted callback verification
|
||||
module. A fresh syntax audit compares all moved declarations and retained
|
||||
statement ordering with this updated master.
|
||||
@@ -0,0 +1,539 @@
|
||||
{
|
||||
"date": "2026-10-12",
|
||||
"policy": "Each mutation changes one actual production guard or outcome. Only the selected case runs. Every changed source is restored to its exact SHA-256 in finally. Complete unmutated owner and sibling controls run separately.",
|
||||
"controls": [
|
||||
{
|
||||
"id": "api-rejection-eviction",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/api/client.ts",
|
||||
"sourceSha256": "1e1b3f03e3269a5943f55d294f1c7aa9f5c3eca569858d9fdc7c5d976de88bba",
|
||||
"case": "tenant-session recovery preserves ApiError handling for an unrelated 401",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "Error: promise rejected \"ApiError: unauthorized { \u2026(2) }\" instead of resolving\n at Assertion.__VITEST_RESOLVES__ (file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/index.C4tKZ0yW.js:2434:33)\n at Assertion.propertyGetter (file://<workspace>/node_modules/.pnpm/chai@6.3.0/node_modules/chai/index.js:1607:27)\n at Reflect.get (<anonymous>)\n at Object.proxyGetter [as get] (file:///Users/dotta/.codex/worktrees/tes"
|
||||
},
|
||||
{
|
||||
"id": "api-all-abort-eviction",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/api/client.ts",
|
||||
"sourceSha256": "1e1b3f03e3269a5943f55d294f1c7aa9f5c3eca569858d9fdc7c5d976de88bba",
|
||||
"case": "per-caller abort semantics aborts the shared fetch after all callers cancel and permits a fresh request",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected \"vi.fn()\" to be called 2 times, but got 1 times\n at <workspace>/ui/src/api/client.test.ts:210:23\n at processTicksAndRejections (node:internal/process/task_queues:104:5)\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:2783:20"
|
||||
},
|
||||
{
|
||||
"id": "ticker-one-interval",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/hooks/useSecondTick.ts",
|
||||
"sourceSha256": "fd51875adf5f30295d847df58af19f75dcbb59c810b4f02919427cbc6ea4d3b3",
|
||||
"case": "useSecondTick shares a single timer across multiple active subscribers and stops when idle",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected 2 to be 1 // Object.is equality\n at <workspace>/ui/src/hooks/useSecondTick.test.tsx:26:32\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:1628:35\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules"
|
||||
},
|
||||
{
|
||||
"id": "ticker-delivery",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/hooks/useSecondTick.ts",
|
||||
"sourceSha256": "fd51875adf5f30295d847df58af19f75dcbb59c810b4f02919427cbc6ea4d3b3",
|
||||
"case": "useSecondTick shares a single timer across multiple active subscribers and stops when idle",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected '0' to be '1' // Object.is equality\n at <workspace>/ui/src/hooks/useSecondTick.test.tsx:28:37\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:1628:35\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_mod"
|
||||
},
|
||||
{
|
||||
"id": "ticker-idle-cleanup",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/hooks/useSecondTick.ts",
|
||||
"sourceSha256": "fd51875adf5f30295d847df58af19f75dcbb59c810b4f02919427cbc6ea4d3b3",
|
||||
"case": "useSecondTick shares a single timer across multiple active subscribers and stops when idle",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected 1 to be +0 // Object.is equality\n at <workspace>/ui/src/hooks/useSecondTick.test.tsx:37:32\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:1628:35\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_module"
|
||||
},
|
||||
{
|
||||
"id": "ticker-inactive-peer",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/hooks/useSecondTick.ts",
|
||||
"sourceSha256": "fd51875adf5f30295d847df58af19f75dcbb59c810b4f02919427cbc6ea4d3b3",
|
||||
"case": "useSecondTick does not subscribe or start a timer when inactive",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected '1' to be '0' // Object.is equality\n at <workspace>/ui/src/hooks/useSecondTick.test.tsx:48:37\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:1628:35\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_mod"
|
||||
},
|
||||
{
|
||||
"id": "ui-bound-caption",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/components/AgentConfigForm.tsx",
|
||||
"sourceSha256": "bf999102f39bfc762747ce5d598e1e6ec2f926ac5fb28de55fa1baf5493f28b1",
|
||||
"case": "AgentConfigForm environment selector reports the account-binding claim upward exactly once when the session authenticates",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected 'Sign in to OpenAISign inAuthenticated\u2026' to contain 'Agent bound to the signed-in account'\n at <workspace>/ui/src/components/AgentConfigForm.render.test.tsx:1773:35\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:2783:20"
|
||||
},
|
||||
{
|
||||
"id": "ui-onboarding-saved-login",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/components/AgentConfigForm.tsx",
|
||||
"sourceSha256": "bf999102f39bfc762747ce5d598e1e6ec2f926ac5fb28de55fa1baf5493f28b1",
|
||||
"case": "OnboardingWizard restore-gate (stale localStorage across accounts) the adapter step login panel (cheap auth signal, no adapter test) renders no 'Use saved login' control",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected 'Step 2 of 3Ada Connect a modelPapercl\u2026' not to contain 'Use saved login'\n at <workspace>/ui/src/components/OnboardingWizard.test.tsx:2931:45\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:2783:20"
|
||||
},
|
||||
{
|
||||
"id": "ui-agent-footer",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/components/IssueThreadInteractionCard.tsx",
|
||||
"sourceSha256": "fb9beb27481258354942003e6a5c319a23257ef07f4ce811eb9ccbd605e0a585",
|
||||
"case": "IssueThreadInteractionCard tool-action card marks agent resolution with an audit chip in the resolved footer",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: the given combination of arguments (undefined and string) is invalid for this assertion. You can use an array, a map, an object, a set, a string, or a weakset instead of a string\n at Proxy.<anonymous> (file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/index.C4tKZ0yW.js:2077:15)\n at Proxy.<anonymous> (file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_j"
|
||||
},
|
||||
{
|
||||
"id": "ui-markdown-anchor",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "ui/src/components/MarkdownBody.tsx",
|
||||
"sourceSha256": "003b7da23b5ebd0e8cd4de91e0d1dafe697f6602d4d99551b04d0abad699d193",
|
||||
"case": "MarkdownBody opens external links in a new tab with safe rel attributes",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected '<div class=\"paperclip-markdown prose \u2026' to contain '<a href=\"https://example.com/docs\"'\n at <workspace>/ui/src/components/MarkdownBody.test.tsx:587:18\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:1628:35\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_"
|
||||
},
|
||||
{
|
||||
"id": "server-cancelled-reopen",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "server/src/routes/issues.ts",
|
||||
"sourceSha256": "641b3d9cb5e744671527f16129dd78518376dca31616b845ec6b8da99d636d8c",
|
||||
"case": "issue comment reopen routes rejects bare agent reopen requests on cancelled issues before writing a comment",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected 201 to be 409 // Object.is equality\n at <workspace>/server/src/__tests__/issue-comment-reopen-routes.test.ts:1040:24\n at processTicksAndRejections (node:internal/process/task_queues:104:5)\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:2783:20"
|
||||
},
|
||||
{
|
||||
"id": "wiki-genuine-run-id",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "packages/plugins/plugin-llm-wiki/src/wiki/core.ts",
|
||||
"sourceSha256": "35d8543f67ab80479c624f527d0b94fbb0f3b309d40b1276a07518872212ea06",
|
||||
"case": "LLM Wiki plugin scaffold starts query sessions, records run ids, and forwards session events to plugin streams",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected [ \u2026(4) ] to deeply equal [ \u2026(4) ]\n at <workspace>/packages/plugins/plugin-llm-wiki/tests/plugin.spec.ts:3610:44\n at processTicksAndRejections (node:internal/process/task_queues:104:5)\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:2783:20"
|
||||
},
|
||||
{
|
||||
"id": "wiki-positive-source-writes",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "packages/plugins/plugin-llm-wiki/src/wiki/core.ts",
|
||||
"sourceSha256": "35d8543f67ab80479c624f527d0b94fbb0f3b309d40b1276a07518872212ea06",
|
||||
"case": "LLM Wiki plugin scaffold keeps default-space files at the root and isolates managed spaces under slug prefixes",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected [] to have a length of 2 but got +0\n at Proxy.<anonymous> (file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/index.C4tKZ0yW.js:2147:20)\n at Proxy.<anonymous> (file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/index.C4tKZ0yW.js:1944:14)\n at Proxy."
|
||||
},
|
||||
{
|
||||
"id": "wiki-positive-page-writes",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "packages/plugins/plugin-llm-wiki/src/wiki/core.ts",
|
||||
"sourceSha256": "35d8543f67ab80479c624f527d0b94fbb0f3b309d40b1276a07518872212ea06",
|
||||
"case": "LLM Wiki plugin scaffold keeps default-space files at the root and isolates managed spaces under slug prefixes",
|
||||
"expected": "one intended assertion failure",
|
||||
"actualFailedCases": 1,
|
||||
"intendedAssertionFailed": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected [ { \u2026(2) }, { \u2026(2) } ] to have a length of 4 but got 2\n at Proxy.<anonymous> (file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/index.C4tKZ0yW.js:2147:20)\n at Proxy.<anonymous> (file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/index.C4tKZ0yW.js:194"
|
||||
},
|
||||
{
|
||||
"id": "aws-create-must-wait-before",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "server/src/services/secrets.ts",
|
||||
"sourceSha256": "2b7cac8d903802ea47c71033fa2d5dffb4d01a9ccde80837445235b0208b8e97",
|
||||
"case": "secretService serializes an aws_secrets_manager secret create against a concurrent account-home mutation lock holder",
|
||||
"expected": "old weak control passes",
|
||||
"actual": "passed",
|
||||
"intendedResult": true,
|
||||
"sourceRestored": true
|
||||
},
|
||||
{
|
||||
"id": "aws-rotate-must-wait-before",
|
||||
"codeHead": "dfdc39b3a71c74c40e267010c6d8428af523bb65",
|
||||
"owner": "server/src/services/secrets.ts",
|
||||
"sourceSha256": "2b7cac8d903802ea47c71033fa2d5dffb4d01a9ccde80837445235b0208b8e97",
|
||||
"case": "secretService serializes an aws_secrets_manager secret rotate against a concurrent account-home mutation lock holder",
|
||||
"expected": "old weak control passes",
|
||||
"actual": "passed",
|
||||
"intendedResult": true,
|
||||
"sourceRestored": true
|
||||
},
|
||||
{
|
||||
"id": "aws-create-must-wait-after",
|
||||
"codeHead": "445d568ca4e903fc998819cae31d421403514684",
|
||||
"owner": "server/src/services/secrets.ts",
|
||||
"sourceSha256": "2b7cac8d903802ea47c71033fa2d5dffb4d01a9ccde80837445235b0208b8e97",
|
||||
"case": "secretService serializes an aws_secrets_manager secret create against a concurrent account-home mutation lock holder",
|
||||
"expected": "repaired control fails on provider entry before lock release",
|
||||
"actual": "failed",
|
||||
"intendedResult": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected [ 'cleanup-enter', \u2026(1) ] to deeply equal [ 'cleanup-enter' ]\n at <workspace>/server/src/__tests__/secrets-service.test.ts:1013:22\n at processTicksAndRejections (node:internal/process/task_queues:104:5)\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:2783:20"
|
||||
},
|
||||
{
|
||||
"id": "aws-rotate-must-wait-after",
|
||||
"codeHead": "445d568ca4e903fc998819cae31d421403514684",
|
||||
"owner": "server/src/services/secrets.ts",
|
||||
"sourceSha256": "2b7cac8d903802ea47c71033fa2d5dffb4d01a9ccde80837445235b0208b8e97",
|
||||
"case": "secretService serializes an aws_secrets_manager secret rotate against a concurrent account-home mutation lock holder",
|
||||
"expected": "repaired control fails on provider entry before lock release",
|
||||
"actual": "failed",
|
||||
"intendedResult": true,
|
||||
"sourceRestored": true,
|
||||
"failure": "AssertionError: expected [ 'cleanup-enter', \u2026(1) ] to deeply equal [ 'cleanup-enter' ]\n at <workspace>/server/src/__tests__/secrets-service.test.ts:1081:22\n at processTicksAndRejections (node:internal/process/task_queues:104:5)\n at file://<workspace>/node_modules/.pnpm/vitest@5.0.3_@opentelemetry+api@1.9.1_@types+node@24.13.3_jsdom@30.0.1_@noble+hashes@2.4.0__v_wr5mxfuu6kgge6st623q4v5egm/node_modules/vitest/dist/chunks/run.BTlFXlnv.js:2783:20"
|
||||
}
|
||||
],
|
||||
"unmutatedControls": [
|
||||
{
|
||||
"batch": "round4 owners and keepers",
|
||||
"files": 58,
|
||||
"passed": 1455,
|
||||
"failed": 0,
|
||||
"pending": 0
|
||||
},
|
||||
{
|
||||
"batch": "tool-access owners and state keepers",
|
||||
"passed": 623,
|
||||
"failed": 0,
|
||||
"pending": 0
|
||||
},
|
||||
{
|
||||
"batch": "final state-service owners and keepers",
|
||||
"files": 8,
|
||||
"passed": 329,
|
||||
"failed": 0,
|
||||
"pending": 0
|
||||
}
|
||||
],
|
||||
"preservationReviews": [
|
||||
{
|
||||
"batch": "round4-ui",
|
||||
"baseline": "2633dbbba95e853e3cb0de165bdf5116e544e411",
|
||||
"method": "Independent whole-runtime AST comparison after actual new helper expansion and individually reviewed semantic edits. Type-only syntax and source metadata normalized; compiler is a separate gate.",
|
||||
"files": [
|
||||
{
|
||||
"file": "ui/src/components/IssueProperties.test.tsx",
|
||||
"sourceSha256": "6c0a2420fdffeb3ccf6c9f4b43b61b62c3bd0e107276a91402a25ae08ad54bd2",
|
||||
"proposalSha256": "8d604724e4c9c423b560d13dae6e939113f248b050905542970ee0660dfeab98",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"createRelation": 17
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "ui/src/components/AgentConfigForm.render.test.tsx",
|
||||
"sourceSha256": "dd3703a491b43ee5b7cd57c48798e8a4cec4dbabc075f222cea412383eca49d7",
|
||||
"proposalSha256": "57282ae3afe8c55ac118f3a658152d8df500a87b15383c8f6b0530a7fdcfb8a0",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"createFormQueryClient": 17,
|
||||
"renderFormView": 18,
|
||||
"daytonaEnvironments": 12,
|
||||
"e2bEnvironments": 6
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "ui/src/components/OnboardingWizard.test.tsx",
|
||||
"sourceSha256": "c17e65d7e0604b58d398cdf8a2a8588e7bc388ffe6e2612cee8e567e01a30f20",
|
||||
"proposalSha256": "6215ee2f034686deaf2d6091590030dcdeccff1697422574e45e0351eaf5a7fe",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"renderWizardView": 19
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "ui/src/components/IssueThreadInteractionCard.test.tsx",
|
||||
"sourceSha256": "3e3ebbe3da7ad7edd9386760bcf90a83c987956fc4f65b74bb761bd0160ce746",
|
||||
"proposalSha256": "2e8aefda409a2faa7e3a3bc4d3f292a17086c61eac1e34291002b62c7415a184",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {}
|
||||
},
|
||||
{
|
||||
"file": "ui/src/components/MarkdownBody.test.tsx",
|
||||
"sourceSha256": "1be4fe615ed6d9e1b8b49749f291475c12848beb5664758c512f368103121608",
|
||||
"proposalSha256": "7432e047a21ca0a75dc58ca0fd645c7cb0b59edc1719557e4e0cb0aafc8a642a",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"batch": "round4-server",
|
||||
"baseline": "2633dbbba95e853e3cb0de165bdf5116e544e411",
|
||||
"method": "Independent whole-runtime AST comparison after actual new helper expansion and individually reviewed semantic edits. Type-only syntax and source metadata normalized; compiler is a separate gate.",
|
||||
"files": [
|
||||
{
|
||||
"file": "server/src/__tests__/issue-comment-reopen-routes.test.ts",
|
||||
"sourceSha256": "214aaa47ce1a862e4d06f41a440d0dba2a2f9f2efa63259c635209a3f660c33e",
|
||||
"proposalSha256": "2dc9167f66f379cb5a1fe024faf78a79c7009d570c4ca4acc72448d0a00423c7",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"createScheduledRetry": 4,
|
||||
"createAgentReviewPolicy": 12,
|
||||
"createReviewIssue": 9
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "server/src/__tests__/environment-routes.test.ts",
|
||||
"sourceSha256": "8993233f12a3b646f7a9755b817bac68916fda31753c2ffb30c4eba9fbcc9fe8",
|
||||
"proposalSha256": "ef2dd81154c25791d2020362b6a3cd508ae215d60b075e1496ea9c7aa38ee6bd",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"localBoardActor": 39,
|
||||
"createSecurePluginDriver": 6,
|
||||
"createSshConfig": 4,
|
||||
"createSecretBackedSshEnvironment": 3
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "server/src/__tests__/instance-settings-routes.test.ts",
|
||||
"sourceSha256": "f007e394234f82d0014a1f2d83831942d0c3a2b123e026f4c22edd4d6491754f",
|
||||
"proposalSha256": "85f0ddf9afb42cfc3e243e107b47290d9f8c8e5879eb3932805466019c937dc4",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"localAdminActor": 15
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "server/src/__tests__/agent-skills-routes.test.ts",
|
||||
"sourceSha256": "e9c67d26d49c51862cefdde9388893d0e11b32f7d29ee95c664741cd48bc7468",
|
||||
"proposalSha256": "175b4b5f274141a817c2135830c1b73ecdfb9597e1d0579af1d0207c6faf551e",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"skillSnapshot": 6
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "server/src/__tests__/company-skills-routes.test.ts",
|
||||
"sourceSha256": "9fdfa5790bd33b9824e3aeed28daa01065eab248712d2f9482f633f7c33165a9",
|
||||
"proposalSha256": "7037feadb73f235f81afeb9499b5bc9b988e2057b43add48c7546f6558085a03",
|
||||
"fullProgramAstEqualAfterActualHelperExpansionAndEnumeratedBehaviorEdits": true,
|
||||
"helperCalls": {
|
||||
"createCatalogSkill": 3,
|
||||
"createSkillTestRunDetails": 5,
|
||||
"boardActor": 25,
|
||||
"assignedAgentActor": 7
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"batch": "round4-cli-api-ticker",
|
||||
"method": "Actual proposed helper bodies expanded. Source metadata/comments/types and object shorthand normalized; object fields, array rows, JSX props, all values/callbacks/promises/awaits, action/write/Git order and cleanup remain strict. Statement-helper parameters are checked to be stable Identifier bindings. Only enumerated reviewed retirement/migration deltas are permitted.",
|
||||
"checks": [
|
||||
{
|
||||
"file": "cli/src/__tests__/company.test.ts",
|
||||
"sourceSha256": "d957294d6113f3b546e15e36289f5085852fc5ab1350529bc025a192fc05d378",
|
||||
"proposalSha256": "1cd0c0445ab57a8c74416a63da6acb4ddde36e8c09aa5b3c74db589792445be1",
|
||||
"actualHelperExpansionWholeRuntimeAstEqual": true,
|
||||
"expandedCalls": {
|
||||
"allImportEntities": 6,
|
||||
"sourceCompanyManifest": 2,
|
||||
"ceoManifest": 2,
|
||||
"alphaProjectManifest": 2,
|
||||
"kickoffIssueManifest": 2,
|
||||
"openAiEnvInput": 2
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "packages/shared/src/app-definitions.test.ts",
|
||||
"sourceSha256": "cf1aec35f1f4c65dd7059f594e04030c339c2a2f329f6e8216a431280d3865c3",
|
||||
"proposalSha256": "d6aa2d7ba801b049358e89f48d39f3602ac936d1c28e7cd5b3313a2227fd1a95",
|
||||
"actualHelperExpansionWholeRuntimeAstEqual": true,
|
||||
"expandedCalls": {}
|
||||
},
|
||||
{
|
||||
"file": "packages/plugins/plugin-llm-wiki/tests/plugin.spec.ts",
|
||||
"sourceSha256": "21ae3eef99bb450f2cc0cac8cb7d781f0dbb043ad4fdf8c1d09b528021114242",
|
||||
"proposalSha256": "bcb816d66be0b0176d599bbb705f79724abeebe8f52f28ed1fc31787b06f9985",
|
||||
"actualHelperExpansionWholeRuntimeAstEqual": true,
|
||||
"expandedCalls": {
|
||||
"renderWikiPage": 22,
|
||||
"captureWikiWrites": 9,
|
||||
"managedSpaceRow": 3
|
||||
}
|
||||
},
|
||||
{
|
||||
"file": "cli/src/__tests__/worktree.test.ts",
|
||||
"sourceSha256": "90162a4d544e80d7314649f2d0da5ca34c6968fbd4a63e491c57f5fdf7077db7",
|
||||
"proposalSha256": "4dd193538aaf9bdd0cab522a8647ea5fb6a573e26199561e65c725c8bcb51ce1",
|
||||
"actualHelperExpansionWholeRuntimeAstEqual": true,
|
||||
"expandedCalls": {
|
||||
"writeSeedConfigFiles": 6,
|
||||
"initializeTestRepo": 5
|
||||
}
|
||||
}
|
||||
],
|
||||
"canonicalChecks": [
|
||||
{
|
||||
"file": "cli/src/__tests__/worktree.test.ts",
|
||||
"baselineSha256": "47c51bafca401b39bd976c12ddabef00be8ff6d3c2bc79822c49d11a3f79bc85",
|
||||
"repairedSha256": "90162a4d544e80d7314649f2d0da5ca34c6968fbd4a63e491c57f5fdf7077db7",
|
||||
"wholeRuntimeAstEqualApartFromParentCanonicalization": true,
|
||||
"canonicalTempRootWrappers": 35
|
||||
},
|
||||
{
|
||||
"file": "packages/shared/src/worktree-seed-source.test.ts",
|
||||
"baselineSha256": "bd8708bab463280939f0aa8aa18341b028343fe98626d9be2154c87ab191c1a5",
|
||||
"repairedSha256": "b9d021050cced44bcee00fd3209c225c4e26117693b7491a50ef9d3bd0a67d17",
|
||||
"wholeRuntimeAstEqualApartFromParentCanonicalization": true,
|
||||
"canonicalTempRootWrappers": 3
|
||||
}
|
||||
],
|
||||
"coreChecks": [
|
||||
{
|
||||
"file": "ui/src/api/client.ts",
|
||||
"sourceSha256": "cac548df1d20c87a0ea8eede850cfe5081874262eb8c26c78058923db6947f69",
|
||||
"proposalSha256": "1e1b3f03e3269a5943f55d294f1c7aa9f5c3eca569858d9fdc7c5d976de88bba",
|
||||
"onlyDeletedPrivateGetterExport": "__inflightGetCount"
|
||||
},
|
||||
{
|
||||
"file": "ui/src/hooks/useSecondTick.ts",
|
||||
"sourceSha256": "e108dee2647be4f8f5472a70220d1019b18cce9a842e7bc25b863e298654ab07",
|
||||
"proposalSha256": "fd51875adf5f30295d847df58af19f75dcbb59c810b4f02919427cbc6ea4d3b3",
|
||||
"onlyDeletedPrivateGetterExport": "__secondTickInternals"
|
||||
}
|
||||
],
|
||||
"seamTestChecks": [
|
||||
{
|
||||
"file": "ui/src/api/client.test.ts",
|
||||
"sourceSha256": "b056adfc0a935cdabcc1c05b4473f76bc1f46fc6f280a671404c2735211ebe01",
|
||||
"proposalSha256": "1b3666404821ae4550b1fdf48fe27568077f8074dbdff8afc5f2966e79341ffd",
|
||||
"apiWholeRuntimeAstEqualApartFromReviewedPrivateRemovalAndErrorAbortRetry": true,
|
||||
"oldDeclarations": 12,
|
||||
"newDeclarations": 12
|
||||
},
|
||||
{
|
||||
"file": "ui/src/hooks/useSecondTick.test.tsx",
|
||||
"sourceSha256": "29d8f37a65070f28ddb43bec69e74477cdfb1e563b348aff03b6b5ca17902e95",
|
||||
"proposalSha256": "b59f9bab5e41bc611165577d8e095184094dd5b84b6d436d32656fd33fb5e459",
|
||||
"oldDeclarations": 2,
|
||||
"newDeclarations": 2
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"batch": "round5-tools",
|
||||
"baseline": "3e7ee04591fd82f3effb89370f47aa90dcadd6eb",
|
||||
"method": "Only source metadata/comments and object shorthand differ. Actual candidate helper bodies expanded, removing only their new declarations and type-only IdRef aliases. Object-field, nested object, array, table, JSX-free input, promise, await, callback, actor/company/credential/expected value and statement order remain exact. Newly introduced literal spreads are allowed only when there are no overwritten keys or effectful helper arguments. All helper object bodies are fresh literals without external closure state.",
|
||||
"files": [
|
||||
{
|
||||
"path": "server/src/__tests__/tool-access-service.test.ts",
|
||||
"sourceSha256": "4cd7d6d02710eac514f14d87c316d15391028ae36c477d868f6b5a499a29f406",
|
||||
"proposalSha256": "dc3664a18f9fc6c45b3b5555376ae03def2708129ff5c3dc4f4623ea2f994c15",
|
||||
"completeRuntimeAndTypeAstEqualAfterActualHelperExpansionAndOneDeclarationRemoval": true,
|
||||
"helperOccurrences": 78,
|
||||
"allRemainingMatcherCallsEqual": true,
|
||||
"allAwaitExpressionsEqual": true,
|
||||
"allSupertestCallsEqual": true,
|
||||
"remainingMatcherCalls": 1346,
|
||||
"awaitExpressions": 1930,
|
||||
"beforeDeclarations": 266,
|
||||
"afterDeclarations": 265
|
||||
},
|
||||
{
|
||||
"path": "server/src/__tests__/tool-access-policy-service.test.ts",
|
||||
"sourceSha256": "484408a4eb3481e98d89863943b0fac64cf40e3794c06d0b4326a4b0d0f7625f",
|
||||
"proposalSha256": "6982ad8f42fceeb6428117f22db28a589f9b6d5f1b2465ca87ddd29420e06413",
|
||||
"completeRuntimeAndTypeAstEqualAfterActualHelperExpansionAndOneDeclarationRemoval": true,
|
||||
"helperOccurrences": 31,
|
||||
"allRemainingMatcherCallsEqual": true,
|
||||
"allAwaitExpressionsEqual": true,
|
||||
"allSupertestCallsEqual": true,
|
||||
"remainingMatcherCalls": 80,
|
||||
"awaitExpressions": 284,
|
||||
"beforeDeclarations": 35,
|
||||
"afterDeclarations": 35
|
||||
},
|
||||
{
|
||||
"path": "server/src/__tests__/tool-gateway-service.test.ts",
|
||||
"sourceSha256": "29c9b9739a5f928c49cd2982858a1323c242663450277f45fc9e3aea407cbe98",
|
||||
"proposalSha256": "67d8dfb12ef2215296af87be5c573f40175d71a2917b01113aa82c550fe4b6d6",
|
||||
"completeRuntimeAndTypeAstEqualAfterActualHelperExpansionAndOneDeclarationRemoval": true,
|
||||
"helperOccurrences": 58,
|
||||
"allRemainingMatcherCallsEqual": true,
|
||||
"allAwaitExpressionsEqual": true,
|
||||
"allSupertestCallsEqual": true,
|
||||
"remainingMatcherCalls": 231,
|
||||
"awaitExpressions": 431,
|
||||
"beforeDeclarations": 36,
|
||||
"afterDeclarations": 36
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"batch": "round5-state",
|
||||
"baseline": "3e7ee04591fd82f3effb89370f47aa90dcadd6eb",
|
||||
"method": "Independent full runtime AST expansion outside two individually reviewed AWS lock repairs",
|
||||
"files": [
|
||||
{
|
||||
"file": "server/src/__tests__/issue-thread-interactions-service.test.ts",
|
||||
"beforeSha256": "ddfad204b976a8218b6376007c36048154c4a10e25ef4d891531b87477931c10",
|
||||
"afterSha256": "6c70d8af0815de3d3ed9f87de94d20e7a161aa2db5fe938e80204a100ee418e9",
|
||||
"equivalent": true,
|
||||
"expandedBeforeSha256": "0a7affd96c9e84850e2540edea63bbc6eabf24f124468e2526fa3095f2ddd7af",
|
||||
"expandedAfterSha256": "0a7affd96c9e84850e2540edea63bbc6eabf24f124468e2526fa3095f2ddd7af",
|
||||
"allHelperCalls": {
|
||||
"interactionCompanyRow": 14,
|
||||
"parentIssueRow": 7,
|
||||
"activeCodexAgentRow": 19,
|
||||
"acceptIssueScope": 31
|
||||
},
|
||||
"allHelperArgumentsEffectFree": true,
|
||||
"beforeDeclarations": 89,
|
||||
"afterDeclarations": 89
|
||||
},
|
||||
{
|
||||
"file": "server/src/__tests__/secrets-service.test.ts",
|
||||
"beforeSha256": "ab9c9536ee144d9211bb8a205dd2e57ff928360de6ea695af74afd749e9652be",
|
||||
"afterSha256": "95708c40da78768c43c26a56c73cf9479a4a39bf2173561d9501a1ab6d13dfb1",
|
||||
"equivalent": true,
|
||||
"expandedBeforeSha256": "fb5da5592c1de24b62a44e476554924e0854cd2822767e46132ce63431c11475",
|
||||
"expandedAfterSha256": "fb5da5592c1de24b62a44e476554924e0854cd2822767e46132ce63431c11475",
|
||||
"allHelperCalls": {
|
||||
"awsVaultInput": 29,
|
||||
"preparedAwsVersion": 16,
|
||||
"managedAwsVersionRow": 4
|
||||
},
|
||||
"allHelperArgumentsEffectFree": true,
|
||||
"beforeDeclarations": 91,
|
||||
"afterDeclarations": 91
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
# Test audit: consolidate repeated owner fixtures and rendering
|
||||
|
||||
Date: 2026-10-12
|
||||
Branch: `codex/test-audit-next`
|
||||
Discovery baseline: `b4aee6ea18905690686fb318fa9cc6d4cc71a7e1`
|
||||
Integration base: `1e0cfcb4fc4ed78d10f46cd60990935af4ac9973` (merged master)
|
||||
Verified code commit: `4261a7fc1b964e54059c68246a0a4b7ea74bdcea`
|
||||
Parent cleanup: [PR #15978](https://github.com/paperclipai/paperclip/pull/15978)
|
||||
|
||||
This follow-up removes **2,041 net test lines across five files**. Every
|
||||
registered case and assertion remains. It changes no application source.
|
||||
The seven complete owner/sibling files pass all **990 cases** before and after.
|
||||
Workspace typecheck, build, token gates and diff checks pass. The change
|
||||
consolidates fixture setup while preserving execution count.
|
||||
|
||||
The parent PR merged on 2026-10-12 after all remote checks passed and a
|
||||
fresh Greptile 5/5 review. This branch used a separate managed checkout and
|
||||
dependency installation. Only its new follow-up commit was replayed onto
|
||||
the parent merge, with no conflicts or duplicated cleanup commits. All five
|
||||
test files still exactly match the independently reviewed candidates, and
|
||||
all 990 owner/sibling cases pass again on the merged base. The follow-up remains
|
||||
committed locally on its own branch. Earlier cleanup evidence, including its
|
||||
disclosed local timeout and passing owner reproduction, lives in
|
||||
`2026-10-12-test-audit.md`.
|
||||
|
||||
## Measured change
|
||||
|
||||
| File | Before lines | After lines | Net removed | Cases retained |
|
||||
| --- | ---: | ---: | ---: | ---: |
|
||||
| server/src/__tests__/environment-runtime.test.ts | 8,110 | 7,223 | 887 | 162 |
|
||||
| server/src/__tests__/execution-workspaces-service.test.ts | 4,751 | 4,638 | 113 | 67 |
|
||||
| server/src/__tests__/company-portability.test.ts | 6,194 | 6,100 | 94 | 94 |
|
||||
| ui/src/pages/IssueDetail.test.tsx | 6,652 | 6,338 | 314 | 141 |
|
||||
| ui/src/components/IssueChatThread.test.tsx | 5,032 | 4,399 | 633 | 100 |
|
||||
| **Changed owners** | **30,739** | **28,698** | **2,041** | **564** |
|
||||
|
||||
The remaining 426 validation cases are unchanged TaskChatThread (225) and
|
||||
AppsConnect (201) siblings. Figures exclude this report. No case, timeout,
|
||||
skip condition, filename, CI route or production seam is removed.
|
||||
|
||||
## Owner and keeper decisions
|
||||
|
||||
All nominated cases are retained. Each original case remains the primary
|
||||
keeper of its regression assertions; helpers own only repeated inputs.
|
||||
|
||||
- Environment runtime: 71 repeated plugin/lease/worker/foreign-company
|
||||
expressions become synchronous file-local fixture builders. Complete
|
||||
identity, author, schema, readiness, capability, install-order, stale lease,
|
||||
fingerprint and RPC-budget variants remain defaults or explicit overrides.
|
||||
Preserve real persisted rows and the actual foreign-company rejection,
|
||||
orphan teardown/spool recovery and lease-reuse paths. Dynamic/spread rows
|
||||
and the named-constant secret provider stay inline.
|
||||
- Execution workspaces: 19 repeated task/recovery/branch/runtime/agent inputs
|
||||
become synchronous builders. Real Git operations, active claimant/runtime
|
||||
rows, locked races, clean/dirty divergence and durable recovery assertions
|
||||
remain in their original cases.
|
||||
- Company portability: 15 identical export invocations use one local helper;
|
||||
their distinct fixture data, redaction, permission, import, selected-file,
|
||||
logo and membership expectations remain explicit.
|
||||
- IssueDetail: 98 identical root/provider render frames share one synchronous
|
||||
helper. It retains the same QueryClient and root. Four nondefault children
|
||||
remain explicit JSX; unsafe undefined/key/ref/spread shapes stay inline.
|
||||
- IssueChatThread: 70 MemoryRouter/component frames share one synchronous
|
||||
helper with fresh original defaults. Supplied callback references, props,
|
||||
dynamic expression order, root identity and rerender/remount behavior remain.
|
||||
|
||||
TaskChatThread and AppsConnect already have useful fixtures or distinct
|
||||
transport/identity behavior. A TaskChatThread prototype saved only ten lines
|
||||
after helper overhead and was rejected. No further layer retirement was
|
||||
supported in these owners; separate provider, authentication, lifecycle and
|
||||
storage proof remains valuable.
|
||||
|
||||
## Preservation evidence
|
||||
|
||||
Original/candidate SHA-256 guards were validated before any checkout edit.
|
||||
Proposals were prepared outside the checkout during baseline execution.
|
||||
Independent reviewers checked both groups against the committed baseline.
|
||||
|
||||
Server: expand all 105 calls through the 16 actual helper bodies/defaults and
|
||||
compare all three complete programs. Field order, nested schemas/capabilities,
|
||||
types/casts, table rows, callbacks, hooks, 1,347 awaits and 1,201 expectation
|
||||
calls are unchanged. Helpers add no Promise boundary, transaction, UUID,
|
||||
clock read, receipt, assertion, RPC or reset. Objects and mocks remain fresh.
|
||||
|
||||
UI: independently expand all 98 + 70 actual render calls. The complete program
|
||||
outside those checked expressions is unchanged, including types, callbacks,
|
||||
actions, waits, timers, teardown and budgets. All 778 expectation calls and
|
||||
200 declarations remain. Check every thread root identity and dynamic prop
|
||||
evaluation order; check IssueDetail root/client bindings for shadowing.
|
||||
Only unique JSX attribute order is normalized; key/ref/spread shapes are
|
||||
excluded. No React component wrapper or hook is introduced.
|
||||
|
||||
Both independent reviews found no preservation blocker. No assertion was
|
||||
moved or repaired, so no additional production mutation was needed. The
|
||||
earlier parent PR's mutation proof is recorded in its report.
|
||||
|
||||
## Runtime verification and limits
|
||||
|
||||
- Complete baseline: seven files, 990 passed, zero failed/skipped.
|
||||
- Complete candidate: the same seven files, 990 passed, zero failed/skipped.
|
||||
- Rebased candidate: the same seven files, 990 passed, zero failed/skipped.
|
||||
- `pnpm --filter @paperclipai/ui typecheck`: pass before integration.
|
||||
- `pnpm -r typecheck`: pass before integration and at the verified code commit.
|
||||
- `pnpm build`: pass at the verified code commit.
|
||||
- Token gates, palette synchronization and character synchronization: pass.
|
||||
- `git diff --check`: pass.
|
||||
- The new checkout used its own workspace-linked dependencies and built its
|
||||
own TypeScript runner/shared/plugin SDK prerequisites. No dependencies or
|
||||
source files were linked to the concurrently changing PR checkout.
|
||||
- A complete default `pnpm test:run` has not been repeated for this follow-up.
|
||||
Its test-only fixture changes have complete affected-owner/sibling proof.
|
||||
Browser suites were not run; none of those suites changed. The parent PR
|
||||
has its own full CI evidence. No wall-time speedup is attributed to this work.
|
||||
|
||||
## Additional retirement search
|
||||
|
||||
A bounded independent search found no further defensible retirement of
|
||||
200 or more lines. Provider-specific behavior, separately implemented
|
||||
parsers, CSS contrast/theme/layout contracts and runtime/SDK wiring retain
|
||||
independent proof. Similar source guards or DOM class assertions did not
|
||||
provide complete behavioral keepers, so those layers remain.
|
||||
@@ -0,0 +1,92 @@
|
||||
# Test audit: repeated setup, duplicate cases and false proof
|
||||
|
||||
Date: 2026-10-12. Audit branch: `codex/test-audit-next`. Delivery branch: `codex/test-audit-followup`. Verified code revision: `64370831ebe191e5ce092f85f79b6fb661df7e16`, including master `cc88b61c0918f45f6d3215f5d2d2368c88297046`.
|
||||
|
||||
This follow-up removes **5,027 net test lines across 27 test files** and **15 redundant registered executions**. It separately removes **11 unused application lines** from two private test-inspection exports. Most savings come from sharing repeated setup while retaining every distinct case. No wall-time improvement is inferred from line counts.
|
||||
|
||||
The earlier merged [PR #15978](https://github.com/paperclipai/paperclip/pull/15978) removed 11,976 net test/support lines and 1,073 redundant executions. The two changes together save **17,003 test/support lines**. These counts exclude audit reports, upstream changes and the fixture portability repair.
|
||||
|
||||
## Savings and scope
|
||||
|
||||
| Batch | Net test lines removed | Registered executions removed | Preservation |
|
||||
| --- | ---: | ---: | --- |
|
||||
| Earlier local runtime/workspace/portability and IssueDetail/IssueChatThread | 2,041 | 0 | All original cases and assertions retained; 990 owner/sibling cases passed. See [the earlier follow-up report](2026-10-12-test-audit-next.md). |
|
||||
| Route fixtures and duplicate proof | 970 | 5 | Three redundant cases and two identical table executions removed; cancelled-reopen observation repaired. |
|
||||
| UI fixtures and duplicate proof | 521 | 6 | Exact assertions move into named stronger keepers; two weak observations repaired. |
|
||||
| CLI, shared catalog and wiki plugin | 238 | 3 | Exact keepers and fixture expansion; genuine run-receipt and positive-write witnesses added. |
|
||||
| Public API and ticker observations | -10 | 0 | Tests grow by ten lines to replace private-state inspections with observable results. |
|
||||
| Tool access, policy and gateway | 656 | 1 | One exact omitted-scope duplicate removed; all other matcher and await order retained. |
|
||||
| Interactions and secrets state services | 611 | 0 | All 180 declarations / 197 cases retained; two AWS lock observations repaired. |
|
||||
| **Total follow-up** | **5,027** | **15** | **No independent security or lifecycle contract retired.** |
|
||||
|
||||
Line savings include all newly added local helper code. The application reduction is five lines of `__inflightGetCount` and six lines of `__secondTickInternals`. Repository-wide caller searches found only their tests. Both module cores otherwise remain byte-identical. Their tests retain sharing, cancellation, stale-account isolation, rendered ticks and timer lifecycle.
|
||||
|
||||
The final intended diff has 27 test files, those two application files and audit evidence. No schema, telemetry, runtime service, package manifest, lockfile or CI routing change is part of this cleanup. Incoming master changes were merged, so absent upstream files cannot inflate the savings.
|
||||
|
||||
## Removed execution to keeper map
|
||||
|
||||
Each retained declaration is its own keeper for setup-only consolidation. The following is the complete map for the 15 removed executions; the three-row influence table accounts for two of them.
|
||||
|
||||
| Removed proof | Retained keeper and boundary |
|
||||
| --- | --- |
|
||||
| Managed-sandbox duplicate DELETE rejection | Same owner/admin, platform row, DELETE, 403 and code; stronger keeper also forbids blast-radius/removal calls. |
|
||||
| Agent-skills duplicate GET/POST secret-context check | Mandatory resolver callbacks in both successful route keepers check the same actor/user/source/responsible literal context, adapter type, skip-user-secrets and filtered environment. |
|
||||
| Company-skills open-default legacy-consent duplicate | Same actor/company/run, deny-missing-consent decision and POST input; successful write keeper checks no consent-gate invocation and the actual write. |
|
||||
| Two extra missing/wrong-run influence table rows | All three ran the identical zero-argument callback. One retains both POST/PATCH errors, details, two propagation calls and no writes. The identity-variant service sibling and real PostgreSQL race sibling remain. |
|
||||
| Onboarding missing-auth/no-stored-login duplicate | Warning text moves into `blocks the hire on a warn result that holds adapter_auth_missing, and shows the returned checks`. |
|
||||
| Interaction connection controls for another viewer | `shows another viewer only who it is waiting for` retains waiting copy, zero buttons, no actions/auth URL and absence of Not now. |
|
||||
| Legitimate question-card rendering duplicate | `exposes pending question options as selectable radio and checkbox controls` gains positive child count and retains stronger exact radio counts. |
|
||||
| Addressed-user Connect/Not-now duplicate | `opens the shared connection setup for the addressed user` gains the exact copy and absence checks before executing the real setup action. |
|
||||
| Non-GitHub-link icon duplicate | `opens external links in a new tab with safe rel attributes` uses the same docs input and retains exact anchor, no GitHub icon, target and rel. |
|
||||
| External-link trailing-icon duplicate | The same docs-link keeper retains the icon glued to the final character and the original glyph matcher. |
|
||||
| Hugging Face scope duplicate | `requests Airtable record, schema and comment writes, and Hugging Face repository/job actions` retains the same independent `[read-mcp, read-repos, contribute-repos, jobs]` literal. |
|
||||
| Whole-catalog method/field invariants duplicate | Full-catalog `appDefinitionsSchema.parse` enforces nonempty ownership modes, required credential placeholders and API-key key placement for every definition; provider-specific permission literals remain. |
|
||||
| Worktree shutdown formatter duplicate | Real `ensure-seeded` failure retains restore error, safe diagnostic, failed manifest and lock release. The unique migrations fallback expectation moves unchanged into that keeper. |
|
||||
| Tool-access omitted-provider-scope duplicate | `marks a scope inferred from the request when the provider omits one` calls the identical `connectSlackWithTokenScope(null, ["channels:read"])`, retains all three persisted scope fields and also checks the outgoing authorization scope. Reported over-grants remain separately tested. |
|
||||
|
||||
The influence identity sibling uses a fake `counterDb` adapter for locked-row variants. The PostgreSQL sibling independently inserts real rows and races writes. Neither is removed, and fake SQL inputs are not described as durable persistence proof.
|
||||
|
||||
## Preservation review and repairs
|
||||
|
||||
Every nominated owner was read in full, including hooks, declarations, tables and cleanup, before classification as retain, fix false proof, consolidate or delete. Reviews checked actual owner/caller/history/CI boundaries rather than treating similar names as proof. Separate reviewers expanded the actual new helper bodies and arguments against complete original runtime ASTs. Types and source metadata are normalized separately from the compiler gate. Fields, nested values, fresh allocations, action/query/UUID/Date/callback/await order, tables, timeouts and teardown remain strict outside explicitly reviewed semantic edits.
|
||||
|
||||
The tool-access expansion covers 167 helper occurrences, 1,657 remaining matcher calls and 2,645 awaits. The state-service expansion covers 120 helper calls; no DB query is hidden in a new helper, and no new helper manufactures a tested service result. All 106 interaction and 91 secret cases remain. Two AWS repairs add two provider-call assertions while retaining the original durable results.
|
||||
|
||||
Review restored or strengthened these contracts before cutover:
|
||||
|
||||
- Restore the no-agentMap resolved footer/chip case byte-for-byte; a richer mapped-agent case cannot prove its fallback.
|
||||
- Match the exact external `<a href="https://example.com/docs"` prefix; href/target/rel alone could pass on a span.
|
||||
- Issue a fresh successful same-path GET after an unrelated 401 and after all callers abort, with exact two-fetch counts and independent values.
|
||||
- Keep an inactive ticker probe beside an active peer; only the active output may tick, and its unmount must clear the last timer.
|
||||
- Observe actual authenticated account-binding text after waiting, and mount the Claude login card positively before asserting absence of Use saved login.
|
||||
- Require cancelled bare-agent reopen to return the exact 409/error before writing a comment. The old broad status allowance accepted 201.
|
||||
- Capture and return the original wiki SDK `sendMessage` receipt unchanged, and compare its genuine run ID to the operation UPDATE bindings. Positive source/page write counts prevent empty `.every` predicates passing.
|
||||
- Confirm real account-home lock-holder entry, observe actual AWS create/version provider entry, assert exclusion while parked and exact eventual event order. A separate baseline secret preserves the tested rotation's original 1 → 2 result. Immediate rejection observers and `finally` release/all-settle preserve failure cleanup.
|
||||
|
||||
Wiki database witnesses inspect emitted SQL and bindings through the SDK's recorder. They do not claim that the recorder executed real SQL. Assertions guaranteed by its unconditional host-list markup were removed without retiring the real title/binding/configuration-link behavior.
|
||||
|
||||
## Falsification and complete positive controls
|
||||
|
||||
[The compact evidence record](2026-10-12-test-audit-controls.json) preserves actual source SHA guards, independent expansion results and mutation assertion receipts. It records 18 executions: 14 route/UI/wiki mutations, two original AWS weak controls and two repaired AWS controls. The original AWS cases pass their deliberate bypasses; the repaired cases fail on actual provider entry before lock release. All **16 repaired or retained keeper mutations** fail at the intended assertion, and every mutated source is restored byte-for-byte in `finally` before ordinary testing.
|
||||
|
||||
| Complete unmutated control | Result |
|
||||
| --- | --- |
|
||||
| Round 4 selected owners and siblings, including standalone wiki | 1,455 / 1,455 passed across 58 files; zero failed/pending. |
|
||||
| Tool-access owners and state-service keeper baselines | 623 / 623 passed: 491 tool cases plus 132 state siblings; zero failed/pending. |
|
||||
| Final state-service owners and siblings | 329 / 329 passed across eight files: 197 owners plus 132 siblings; zero failed/pending. |
|
||||
| Canonical worktree/shared seed-source control | 80 / 80 passed; zero failed/pending. |
|
||||
| Workspace `pnpm -r typecheck` | Passed at the verified code revision. |
|
||||
| UI `pnpm check:token-gates` | Passed at the verified code revision. |
|
||||
| Workspace `pnpm build` | Passed at the verified code revision. |
|
||||
| Full default `pnpm test:run` | Invoked at the verified code revision. The completed result is recorded in the follow-up PR’s Verification section. |
|
||||
| `git diff --check` | Passed before evidence publication; delivery also checks its final evidence diff. |
|
||||
|
||||
Rows overlap; they are separate receipts and must not be summed into a unique test count. Root Vitest excludes standalone wiki, so its three complete files were also run with its own existing configuration. Browser suites were not run: this change does not touch browser-suite sources or change a product journey. No deadline, retry, skip or shard was weakened for this audit.
|
||||
|
||||
## Portability and environment controls excluded from savings
|
||||
|
||||
The initial 1,157-case main baseline had 14 failures, all in CLI worktree fixtures using `/var` where the production guard correctly requires canonical `/private/var`. A separate shared seed-source baseline had the same alias failure in eight cases. A separate commit wraps only 38 fixture-allocation parents with `fs.realpathSync(os.tmpdir())` (35 CLI, three shared). It preserves every case/assertion and every explicit attacker-symlink negative. The complete 80-case repaired control passed; none of this is counted as pruning.
|
||||
|
||||
The standalone wiki package declares React as a peer, and this checkout disables automatic peer installation. Its baseline initially could not collect two files. An ignored node_modules link supplies the existing pinned React 19.2.8 from this same worktree. All 101 standalone baseline cases then passed. This setup changes no manifest or lockfile and links no dependencies across worktrees.
|
||||
|
||||
PR CI and exact-head review results belong on the follow-up PR. The report records local evidence at an immutable code revision; later evidence-only commits do not change the tested source. Full source ledgers and proposal staging files remain temporary, while the decisions, keeper map, actual preservation receipts and falsification outcomes above are preserved in the repository.
|
||||
Reference in new issue
Block a user