Fix: remove domain default port singletons - #705
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe PR removes domain default codec/crypto singletons, adds required-port guards and runtime resolver wiring, and introduces unmaterialized intent types, admission logic, and runtime surface exposure. It also updates CLI, scripts, and tests to use explicit infrastructure-backed codec and crypto dependencies. ChangesDomain default removal and DI hardening
Unmaterialized intent capability
Estimated code review effort🎯 5 (Critical) | ⏱️ ~120 minutes Possibly related issues
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
Release Preflight
If this PR is from a |
Release Preflight
If this PR is from a |
1 similar comment
Release Preflight
If this PR is from a |
Release Preflight
If this PR is from a |
…line TypeScript boundaries
…Math.random, complexity, and base-to-string rules
…cyclomatic complexity 4
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 23
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (8)
src/domain/services/index/IndexStalenessChecker.ts (1)
53-58: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRequire the codec only on the CBOR decode path.
Line 58 throws before we know whether
frontier.cborexists or whetherindexStore.decodeShard()will be used. That breaks legacyfrontier.jsonfallback and any index-store-backed read when no codec was supplied, even though neither path needs one.Suggested fix
type CborDeps = { storage: BlobPort; - codec: CodecPort; + codec?: CodecPort; indexStore?: IndexStorePort; }; function buildCborDeps( storage: BlobPort, codec?: CodecPort, indexStore?: IndexStorePort, ): CborDeps { - const deps: CborDeps = { storage, codec: requireCodec(codec, 'loadIndexFrontier') }; + const deps: CborDeps = { storage }; + if (codec) { + deps.codec = codec; + } if (indexStore) { deps.indexStore = indexStore; } return deps; }if (indexStore) { envelope = await indexStore.decodeShard(oid); } else { const buffer = await storage.readBlob(oid); - envelope = codec.decode(buffer); + envelope = requireCodec(codec, 'loadIndexFrontier').decode(buffer); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/index/IndexStalenessChecker.ts` around lines 53 - 58, The CBOR dependency builder in buildCborDeps is requiring the codec too early, which blocks legacy frontier.json fallback and indexStore-backed reads that do not need a codec. Move the requireCodec(codec, 'loadIndexFrontier') check out of buildCborDeps and only invoke it on the CBOR decode path in IndexStalenessChecker/loadIndexFrontier, so frontier.cbor and indexStore.decodeShard() can proceed without a supplied codec when appropriate.src/domain/services/index/BitmapIndexReader.ts (1)
261-270: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDon't swallow
E_CODEC_REQUIREDas shard corruption.Line 263 now runs
requireCodec(...)inside the decodetry. If the reader is misconfigured, that exception is rewrapped asShardCorruptionErrorand, in non-strict mode, silently downgraded to{}. That hides the real configuration failure and can return incomplete query results.Suggested fix
private _decodeAndCacheShard(buffer: Uint8Array, path: string, oid: string): LoadedShard { + const codec = requireCodec(this._codec, 'BitmapIndexReader'); try { - const data = requireCodec(this._codec, 'BitmapIndexReader').decode<LoadedShard>(buffer); + const data = codec.decode<LoadedShard>(buffer); if (!isPlainLoadedShard(data)) { return this._handleInvalidShardShape(path, oid, 'shard_not_object'); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/index/BitmapIndexReader.ts` around lines 261 - 270, The _decodeAndCacheShard method is swallowing codec configuration failures by wrapping requireCodec and decode in the same try/catch, which turns E_CODEC_REQUIRED into shard corruption handling. Move the requireCodec check in BitmapIndexReader out of the decode/catch path (or explicitly rethrow E_CODEC_REQUIRED) so _handleDecodeError only handles actual decode failures, while misconfiguration surfaces as a hard error instead of being downgraded to an empty shard.src/domain/services/optic/StreamingCheckpointBasisBuilder.ts (1)
93-103: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winMake
codecrequired in the options type.
requireCodec(validOptions.codec, ...)makes the constructor fail whenever the codec is omitted, but the public options shape still advertisescodec?: CodecPort. That preserves the retired implicit-default contract in the type system and pushes the break to runtime.As per coding guidelines, "Keep helper corridors, fake shape trust, transitional duplication, and compile-time theater out of the codebase; runtime-honest TypeScript must reflect actual behavior."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/optic/StreamingCheckpointBasisBuilder.ts` around lines 93 - 103, The constructor in StreamingCheckpointBasisBuilder already requires a codec via requireCodec, so the public options type is still lying about an optional field. Update StreamingCheckpointBasisBuilderOptions to make codec required instead of codec?: CodecPort, and adjust any related type declarations/usages so the builder’s compile-time contract matches the actual constructor behavior.Source: Coding guidelines
src/domain/services/sync/SyncAuthService.ts (1)
67-73: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not bypass the injected crypto for nonce generation.
signSyncRequestnow requiresdeps.crypto, but the nonce still comes fromglobalThis.crypto.randomUUID()and the signature still typescryptoas optional. That leaves ambient entropy insidesrc/domain/**and a call pattern that only fails at runtime. Inject nonce/entropy through a port or parameter and make the type reflect that requirement.As per coding guidelines, "In
src/domain/**, do not usecrypto.randomUUID()... time, entropy, and external capabilities must enter through ports or parameters."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/sync/SyncAuthService.ts` around lines 67 - 73, `signSyncRequest` is still using ambient entropy via `globalThis.crypto.randomUUID()` and the `deps.crypto` requirement is not reflected in the types. Update `SyncAuthService.signSyncRequest` to generate the nonce through the injected `CryptoPort` (or another explicit parameter/port) instead of `globalThis.crypto`, and make the dependency type non-optional if the function requires it. Ensure the nonce source and `requireCrypto` usage are aligned so all entropy stays inside the injected domain boundary.Source: Coding guidelines
src/domain/services/state/CheckpointSerializer.ts (1)
41-45: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winMake the codec parameter required in these exported helpers.
Every helper here now throws through
requireCodec(...)whencodecis omitted, but the signatures still advertise{ codec?: CodecPort }. That keeps the old implicit-default contract alive and lets downstream code compile intoE_CODEC_REQUIREDat runtime.As per coding guidelines, "Keep helper corridors, fake shape trust, transitional duplication, and compile-time theater out of the codebase; runtime-honest TypeScript must reflect actual behavior."
Also applies to: 87-97, 138-156, 214-230
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/state/CheckpointSerializer.ts` around lines 41 - 45, Make the codec parameter required in the exported serializer helpers so the TypeScript signatures match the actual runtime behavior enforced by requireCodec(...). Update serializeFullState and the other affected helper functions in CheckpointSerializer to accept codec: CodecPort instead of an optional codec property in the destructured options, and adjust any related call sites/types so they must pass a codec explicitly rather than relying on an omitted default.Source: Coding guidelines
src/domain/services/provenance/ProvenanceIndex.ts (1)
109-123: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMake the codec mandatory in this API.
These methods still type-check without a codec, but both now unconditionally throw via
requireCodec(...)when it is omitted. That leavesserialize()/deserialize()as deterministic runtime traps instead of compile-time errors.Proposed fix
- serialize({ codec }: { codec?: CodecPort } = {}): Uint8Array { + serialize({ codec }: { codec: CodecPort }): Uint8Array { const c = requireCodec(codec, 'ProvenanceIndex.serialize'); return c.encode({ version: 1, entries: this.#sortedEntries() }); } @@ - static deserialize(buffer: Uint8Array, { codec }: { codec?: CodecPort } = {}): ProvenanceIndex { + static deserialize(buffer: Uint8Array, { codec }: { codec: CodecPort }): ProvenanceIndex { const c = requireCodec(codec, 'ProvenanceIndex.deserialize');As per coding guidelines, "Keep helper corridors, fake shape trust, transitional duplication, and compile-time theater out of the codebase; runtime-honest TypeScript must reflect actual behavior."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/provenance/ProvenanceIndex.ts` around lines 109 - 123, Make the codec required in the ProvenanceIndex API so TypeScript rejects missing codecs at compile time instead of relying on requireCodec() to throw at runtime. Update the serialize() and deserialize() signatures in ProvenanceIndex to take a mandatory codec parameter, and adjust any internal call sites or related typings so the required CodecPort is reflected consistently.Source: Coding guidelines
src/domain/services/audit/TrustEvaluationService.ts (1)
125-139: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDon't classify missing
TrustCryptoPortas an invalid trust record chain.The new precondition at Lines 129-130 flows through
_failWith(), which hardcodesTRUST_RECORD_CHAIN_INVALID. That makes a DI/configuration failure indistinguishable from corrupted or malformed trust evidence for any caller inspectingreasonCode. Please emit a config-specific reason here instead of reusing the chain-integrity code.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/audit/TrustEvaluationService.ts` around lines 125 - 139, The missing TrustCryptoPort precondition in TrustEvaluationService is being reported with the same reasonCode as an invalid trust record chain. Update _checkPreconditions and/or _failWith so the TrustCryptoPort null case uses a config/DI-specific reason code instead of TRUST_REASON_CODES.TRUST_RECORD_CHAIN_INVALID, while keeping the Trust chain port not configured case separate and preserving the existing failure assessment flow.src/domain/trust/TrustCanonical.ts (1)
16-27: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMake
cryptorequired inCryptoDeps.This helper now always throws when
deps.cryptois absent, but the API still models it as optional and defaults to{}. That preserves a compile-time-valid call shape that can only fail at runtime.Proposed fix
type CryptoDeps = { - readonly crypto?: CryptoPort; + readonly crypto: CryptoPort; }; @@ async function computeRecordId( record: TrustRecordFields, - deps: CryptoDeps = {}, + deps: CryptoDeps, ): Promise<string> {As per coding guidelines, "Keep helper corridors, fake shape trust, transitional duplication, and compile-time theater out of the codebase; runtime-honest TypeScript must reflect actual behavior."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/trust/TrustCanonical.ts` around lines 16 - 27, Make crypto mandatory in CryptoDeps so the type matches computeRecordId’s actual behavior. Update the CryptoDeps definition in TrustCanonical to require crypto, then adjust computeRecordId to accept deps with a required crypto property and remove the empty-object default so callers must pass a valid CryptoPort. Keep the requireCrypto call and computeRecordId identifier aligned with this change so the helper is runtime-honest and no longer allows compile-time-valid missing-crypto calls.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/topics/unmaterialized-intents.md`:
- Line 63: The documentation in WarpIntentDescriptor currently makes a hard O(1)
complexity promise for precommit guard evaluation, which is stronger than the
described invariant. Update the wording to describe bounded/localized guard
checks without asserting constant time unless there is a documented contractual
guarantee in the runtime or backend; if such a guarantee exists, cite the
specific invariant in the same sentence.
In `@docs/topics/wasm-verified-admission.md`:
- Around line 26-30: Clarify the trust anchor in the Wasm admission docs: the
current description in the `admitWasmIntent`/`WasmVerifierReport` section
conflates `reportDigest` and `wasmDigest`. Update the wording so it explicitly
says which digest is compared against the expected Wasm plugin SHA-256 identity,
and describe the rejection path using the same symbol names (`wasmDigest`,
`reportDigest`, `WarpIntentDescriptor`, `WasmVerifierReport`) to avoid ambiguity
for integrators.
In `@src/application/RuntimeHostBrowserDefaults.ts`:
- Around line 12-15: The browser default port setup in
installDefaultRuntimeHostBrowserPorts() is missing a TrustCryptoPort, so
trust-enabled opens now fail through resolveConfiguredTrustCrypto() with
E_TRUST_CRYPTO_REQUIRED. Update the browser composition root to either register
a browser trust crypto resolver alongside the existing codec and crypto
resolvers, or explicitly block trust mode earlier with a browser-specific error
before open proceeds. Use installDefaultRuntimeHostBrowserPorts() and
resolveConfiguredTrustCrypto() as the key places to adjust the
wiring/validation.
In `@src/domain/services/admission/WasmVerifiedAdmissionService.ts`:
- Around line 11-22: The admission check in WasmVerifiedAdmissionService is
still hardcoding a trusted WASM digest, which should instead come from injected
trust policy. Remove the static TRUSTED_WASM_DIGEST constant and update the
WasmVerifiedAdmissionService constructor to accept the trusted digest or digest
policy from the composition root, then use that injected value inside
admitWasmIntent when comparing report.wasmDigest so verifier rotation and
environment-specific trust can be configured without changing domain code.
In `@src/domain/services/controllers/IntentController.ts`:
- Around line 86-100: queueIntent and getWriterIntents are using different map
keys, which makes queued intents unreachable when strandId and writerId differ.
Update IntentController so both methods use the same identifier consistently
when storing and retrieving from _queuedIntents, and verify the naming in
queueIntent, getWriterIntents, and the surrounding call sites reflects that
shared key.
- Around line 46-57: The _checkGuard method in IntentController currently
ignores edgeExists guards, so they always pass through as null. Extend
_checkGuard to recognize guard.op === 'edgeExists' and route it to a dedicated
edge validation helper (or the existing edge-check logic if already present),
returning a failure when the required edge is missing. Make sure the new branch
is handled alongside _checkStatusGuard and _checkAgentGuard so precommit guards
are actually enforced.
- Around line 29-43: Keep intent serialization out of IntentController by
removing the direct TextEncoder/JSON.stringify blob creation from admitIntent.
Move encoding to an adapter or injected codec/persistence port, and have
admitIntent depend only on a constructor-injected abstraction for producing the
persisted bytes or blob reference. Preserve the existing guard flow and return
shape, but replace the ad hoc serialization path in admitIntent with the
injected port so src/domain stays free of host/Node-specific serialization
logic.
In `@src/domain/services/Frontier.ts`:
- Around line 96-97: Make the public Frontier API runtime-honest by making codec
required wherever serialize and deserialize are exposed, since these methods now
fail deterministically when omitted. Update the Frontier type/signature for
serialize and deserialize to remove the optional codec path, and ensure the
implementation around requireCodec in Frontier.serialize and
Frontier.deserialize matches the new required contract.
In `@src/domain/services/index/IncrementalIndexUpdater.ts`:
- Line 58: The IncrementalIndexUpdater constructor currently treats codec as
optional in its options type, but requireCodec in the constructor makes it
mandatory at runtime. Update the constructor’s options type to require codec, or
refactor IncrementalIndexUpdater to use the same lazy-guard pattern as the other
index updater classes; make sure the type signature and the requireCodec call
stay aligned.
In `@src/domain/services/index/StreamingBitmapIndexBuilder.ts`:
- Line 45: StreamingBitmapIndexBuilder currently accepts and stores a null
codec, which delays E_CODEC_REQUIRED until flush()/finalize() instead of failing
immediately. Update the StreamingBitmapIndexBuilder constructor to require and
resolve a CodecPort up front, remove the nullable _codec state, and adjust the
builder contract so the codec must be present before any work starts; then
simplify any downstream checks in flush, finalize, and related helpers to rely
on the constructor guarantee.
In `@src/domain/services/index/WarpStateIndexBuilder.ts`:
- Around line 49-50: The public API is exposing an unused crypto dependency in
WarpStateIndexBuilder, while the constructor and helper functions only use
codec. Update WarpStateIndexBuilder’s constructor signature and the related
helper functions referenced in the diff to remove the crypto option entirely,
and adjust any associated types/call sites so they accept only the codec port
that is actually used at runtime.
In `@src/domain/services/MaterializedViewService.ts`:
- Around line 60-63: The constructor in MaterializedViewService is validating
codec too early, which makes codec-free uses fail unnecessarily. Move the
requireCodec check out of the constructor and resolve or validate the codec only
inside the codec-using methods build(), loadFromOids(), and applyDiff() right
before the first codec access, while leaving persistIndexTree() and
verifyIndex() usable without a codec.
In `@src/domain/services/state/StateSerializer.ts`:
- Around line 67-69: `serializeState`, `deserializeState`, and
`computeStateHash` currently accept optional `codec`/`crypto` ports even though
they immediately require them via `requireCodec`/`requireCrypto`, so update the
function signatures to make those dependencies mandatory at the type boundary.
Adjust the corresponding symbols in `StateSerializer` so callers must pass the
injected ports at compile time, and keep the internal
`requireCodec`/`requireCrypto` checks aligned with the now-required parameters.
In `@src/domain/types/WarpIntentDescriptor.ts`:
- Around line 5-30: The intent types are currently modeled as open shape bags,
especially SuffixTransform.payload using Record<string, unknown>, which violates
the domain rules. Refactor WarpIntentDescriptor, SuffixTransform, and any
related aliases into validated runtime-backed domain objects or discriminated
variants with explicit constructors/guards, and avoid exposing unvalidated
payloads from src/domain/types/WarpIntentDescriptor.ts. Ensure the new intent
surface uses concrete domain concepts, Object.freeze where appropriate, and
runtime validation instead of compile-time-only aliases.
In `@src/domain/utils/seekCacheKey.ts`:
- Around line 25-34: `buildSeekCacheKey` now requires a crypto port at runtime,
so its signature should no longer pretend `options.crypto` is optional or
default `options` to an empty object. Update `buildSeekCacheKey` to require a
`CryptoPort` (or a required `crypto` field in `options`) and adjust the
`requireCrypto` call site accordingly so the public helper’s types match its
actual behavior.
In `@src/domain/warp/RuntimeHostPortResolvers.ts`:
- Around line 14-35: The module-scoped resolver slots in
RuntimeHostPortResolvers are ambient mutable state and should not be used to
select codecs/crypto globally. Remove the installRuntimeHost*Resolver setters
and instead pass CommitMessageCodecResolver, RuntimeHostCodecResolver,
RuntimeHostCryptoResolver, and RuntimeHostTrustCryptoResolver through the
RuntimeHost construction boundary via constructor-injected dependencies so each
RuntimeHost instance uses its own ports. Update any callers/composition root
that currently rely on the shared resolver state to provide the resolvers
explicitly.
- Around line 49-83: Validate the resolved port values in
resolveConfiguredCodec, resolveConfiguredCrypto, and
resolveConfiguredTrustCrypto, not just whether a resolver exists. Right now
these helpers accept null or an undefined return from the installed resolver,
which can bypass the E_CODEC_REQUIRED, E_CRYPTO_REQUIRED, and
E_TRUST_CRYPTO_REQUIRED guarantees; follow the same nullish-check pattern used
by resolveConfiguredCommitMessageCodec() and throw the matching WarpError when
the resolved value is missing. Ensure the check happens after calling
runtimeHostCodecResolver, runtimeHostCryptoResolver, and
runtimeHostTrustCryptoResolver so all three helpers reject invalid resolver
outputs consistently.
In `@test/helpers/mockPorts.ts`:
- Around line 144-158: The fallback in fakeEncode is too permissive for
object-like values, so keep it aligned with CborCodec by handling Map explicitly
and rejecting non-plain objects instead of serializing everything with
Object.entries. Update the fake codec logic in mockPorts.ts around fakeEncode so
Map payloads are encoded in the same shape as the production codec, and add a
guard that throws for class instances or other non-plain objects rather than
flattening them.
In `@test/helpers/runtimeHostCommitMessageCodecSetup.ts`:
- Around line 1-3: The helper’s name and usage no longer match its side effects:
runtimeHostCommitMessageCodecSetup currently calls
installDefaultRuntimeHostNodePorts, which installs broader defaults than
commit-message codec setup. Update this helper and its callers so the identifier
reflects the full scope, or narrow the helper to only the commit-message codec
wiring; use installDefaultRuntimeHostNodePorts as the key symbol to locate the
behavior.
In `@test/unit/boundary/domain-default-port-modules.test.ts`:
- Around line 12-15: The boundary scan is too narrow because SCANNED_ROOTS only
covers src/domain and src/ports, so it can miss migrated non-domain consumers.
Update the root list in the domain-default-port-modules test to include the
relevant non-domain entry points such as the CLI command and migration script
paths referenced by this PR, and make sure the scan logic still uses the same
test helpers to catch stale imports there.
In `@test/unit/domain/services/BoundaryTransitionRecord.test.ts`:
- Around line 53-57: The helper setup in BoundaryTransitionRecord tests is
applying the default stateCodec before spreading opts, so an explicit undefined
stateCodec from callers can overwrite the fallback and leak into
createBTRUseCase. Update the affected helper calls to spread opts first and then
apply the default codec override, keeping btrCodec intact, in the shared test
helper used by the createBTRUseCase invocations so the fallback always wins when
stateCodec is missing or undefined.
In `@test/unit/domain/WarpWorldline.admitIntent.test.ts`:
- Line 20: The `WarpWorldline.admitIntent` contract test is bypassing TypeScript
with `any`, so it won’t catch public API or signature regressions. Remove the
`as any` escapes in `handle.admitIntent(...)` calls and keep the test fixture
strongly typed so the compiler validates the surface. Use the `admitIntent`
method on `handle` directly everywhere in this test to ensure the contract is
enforced.
In `@test/unit/ports/WasmVerifiedAdmissionPort.test.ts`:
- Around line 60-76: The `WasmVerifiedAdmissionService.admitWasmIntent`
invalid-report path is only asserting the returned obstruction, so it does not
prove `WarpWorldline.admitIntent` is bypassed. Update the `should reject
admission if verifier report is invalid or untrusted` test to spy on
`admitIntent` in the `mockWorldline` and assert it is never called when
`invalidReport` is passed, while keeping the existing
`UntrustedWasmVerifierReport` obstruction checks.
---
Outside diff comments:
In `@src/domain/services/audit/TrustEvaluationService.ts`:
- Around line 125-139: The missing TrustCryptoPort precondition in
TrustEvaluationService is being reported with the same reasonCode as an invalid
trust record chain. Update _checkPreconditions and/or _failWith so the
TrustCryptoPort null case uses a config/DI-specific reason code instead of
TRUST_REASON_CODES.TRUST_RECORD_CHAIN_INVALID, while keeping the Trust chain
port not configured case separate and preserving the existing failure assessment
flow.
In `@src/domain/services/index/BitmapIndexReader.ts`:
- Around line 261-270: The _decodeAndCacheShard method is swallowing codec
configuration failures by wrapping requireCodec and decode in the same
try/catch, which turns E_CODEC_REQUIRED into shard corruption handling. Move the
requireCodec check in BitmapIndexReader out of the decode/catch path (or
explicitly rethrow E_CODEC_REQUIRED) so _handleDecodeError only handles actual
decode failures, while misconfiguration surfaces as a hard error instead of
being downgraded to an empty shard.
In `@src/domain/services/index/IndexStalenessChecker.ts`:
- Around line 53-58: The CBOR dependency builder in buildCborDeps is requiring
the codec too early, which blocks legacy frontier.json fallback and
indexStore-backed reads that do not need a codec. Move the requireCodec(codec,
'loadIndexFrontier') check out of buildCborDeps and only invoke it on the CBOR
decode path in IndexStalenessChecker/loadIndexFrontier, so frontier.cbor and
indexStore.decodeShard() can proceed without a supplied codec when appropriate.
In `@src/domain/services/optic/StreamingCheckpointBasisBuilder.ts`:
- Around line 93-103: The constructor in StreamingCheckpointBasisBuilder already
requires a codec via requireCodec, so the public options type is still lying
about an optional field. Update StreamingCheckpointBasisBuilderOptions to make
codec required instead of codec?: CodecPort, and adjust any related type
declarations/usages so the builder’s compile-time contract matches the actual
constructor behavior.
In `@src/domain/services/provenance/ProvenanceIndex.ts`:
- Around line 109-123: Make the codec required in the ProvenanceIndex API so
TypeScript rejects missing codecs at compile time instead of relying on
requireCodec() to throw at runtime. Update the serialize() and deserialize()
signatures in ProvenanceIndex to take a mandatory codec parameter, and adjust
any internal call sites or related typings so the required CodecPort is
reflected consistently.
In `@src/domain/services/state/CheckpointSerializer.ts`:
- Around line 41-45: Make the codec parameter required in the exported
serializer helpers so the TypeScript signatures match the actual runtime
behavior enforced by requireCodec(...). Update serializeFullState and the other
affected helper functions in CheckpointSerializer to accept codec: CodecPort
instead of an optional codec property in the destructured options, and adjust
any related call sites/types so they must pass a codec explicitly rather than
relying on an omitted default.
In `@src/domain/services/sync/SyncAuthService.ts`:
- Around line 67-73: `signSyncRequest` is still using ambient entropy via
`globalThis.crypto.randomUUID()` and the `deps.crypto` requirement is not
reflected in the types. Update `SyncAuthService.signSyncRequest` to generate the
nonce through the injected `CryptoPort` (or another explicit parameter/port)
instead of `globalThis.crypto`, and make the dependency type non-optional if the
function requires it. Ensure the nonce source and `requireCrypto` usage are
aligned so all entropy stays inside the injected domain boundary.
In `@src/domain/trust/TrustCanonical.ts`:
- Around line 16-27: Make crypto mandatory in CryptoDeps so the type matches
computeRecordId’s actual behavior. Update the CryptoDeps definition in
TrustCanonical to require crypto, then adjust computeRecordId to accept deps
with a required crypto property and remove the empty-object default so callers
must pass a valid CryptoPort. Keep the requireCrypto call and computeRecordId
identifier aligned with this change so the helper is runtime-honest and no
longer allows compile-time-valid missing-crypto calls.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: d93cc69e-9ee5-4097-8a56-5f518d70e045
📒 Files selected for processing (144)
bin/cli/commands/trust.tsbin/cli/commands/verify-audit.tsbrowser.tsdocs/ANTI_SLUDGE_POLICY.mddocs/topics/unmaterialized-intents.mddocs/topics/wasm-verified-admission.mdindex.tsscripts/contamination-map.tsscripts/migrations/v17.0.0/checkpoint-schema-upgrade.tssemgrep/typescript-anti-sludge.ymlsrc/application/RuntimeHostBrowserDefaults.tssrc/application/RuntimeHostCommitMessageCodecDefaults.tssrc/application/RuntimeHostNodeDefaults.tssrc/domain/RuntimeHost.tssrc/domain/WarpGraph.tssrc/domain/WarpWorldline.tssrc/domain/capabilities/IntentCapability.tssrc/domain/services/Frontier.tssrc/domain/services/MaterializedViewService.tssrc/domain/services/WormholeService.tssrc/domain/services/admission/WasmVerifiedAdmissionService.tssrc/domain/services/audit/AuditVerifierService.tssrc/domain/services/audit/TrustEvaluationService.tssrc/domain/services/codec/CodecRequirement.tssrc/domain/services/controllers/IntentController.tssrc/domain/services/crypto/CryptoRequirement.tssrc/domain/services/index/BitmapIndexBuilder.tssrc/domain/services/index/BitmapIndexReader.tssrc/domain/services/index/IncrementalIndexUpdater.tssrc/domain/services/index/IndexRebuildService.tssrc/domain/services/index/IndexStalenessChecker.tssrc/domain/services/index/LogicalIndexReader.tssrc/domain/services/index/PropertyIndexReader.tssrc/domain/services/index/StreamingBitmapIndexBuilder.tssrc/domain/services/index/WarpStateIndexBuilder.tssrc/domain/services/optic/StreamingCheckpointBasisBuilder.tssrc/domain/services/provenance/ProvenanceIndex.tssrc/domain/services/state/CheckpointSerializer.tssrc/domain/services/state/StateSerializer.tssrc/domain/services/sync/SyncAuthService.tssrc/domain/trust/TrustCanonical.tssrc/domain/types/WarpIntentDescriptor.tssrc/domain/utils/defaultCodec.tssrc/domain/utils/defaultCrypto.tssrc/domain/utils/defaultTrustCrypto.tssrc/domain/utils/seekCacheKey.tssrc/domain/warp/RuntimeHostBoot.tssrc/domain/warp/RuntimeHostPortResolvers.tssrc/domain/warp/RuntimeHostProduct.tssrc/domain/warp/WarpCoreRuntimeProduct.tssrc/domain/warp/WarpGraphRuntimeProduct.tssrc/infrastructure/adapters/NodeCryptoSingleton.tssrc/infrastructure/adapters/TrustCryptoAdapter.tssrc/infrastructure/adapters/TrustCryptoSingleton.tssrc/ports/TrustCryptoPort.tssrc/ports/WasmVerifiedAdmissionPort.tstest/bats/helpers/seed-setup.tstest/conformance/comparisonLiveCoordinateSeam.test.tstest/helpers/fixtureDsl.tstest/helpers/mockPorts.tstest/helpers/runtimeHostCommitMessageCodecSetup.tstest/integration/WarpGraph.integration.test.tstest/integration/api/helpers/setup.tstest/integration/api/multiwriter.test.tstest/runtime/deno/helpers.tstest/unit/benchmark/detachedReadBenchmark.fixture.test.tstest/unit/boundary/domain-default-port-modules.test.tstest/unit/domain/WarpCore.snapshotHashStability.test.tstest/unit/domain/WarpGraph.encryption.test.tstest/unit/domain/WarpWorldline.admitIntent.test.tstest/unit/domain/WarpWorldline.capabilities.test.tstest/unit/domain/WarpWorldline.test.tstest/unit/domain/properties/Join.property.test.tstest/unit/domain/publicStrandAndRuntimeSeams.test.tstest/unit/domain/runtimeReadingBasisErrors.test.tstest/unit/domain/seekCache.test.tstest/unit/domain/services/AuditReceiptService.coverage.test.tstest/unit/domain/services/AuditReceiptService.test.tstest/unit/domain/services/AuditVerifierService.bench.tstest/unit/domain/services/AuditVerifierService.test.tstest/unit/domain/services/BitmapIndexBuilder.frontier.test.tstest/unit/domain/services/BitmapIndexBuilder.integrity.test.tstest/unit/domain/services/BitmapIndexBuilder.test.tstest/unit/domain/services/BitmapIndexReader.chunked.test.tstest/unit/domain/services/BitmapIndexReader.test.tstest/unit/domain/services/BoundaryTransitionRecord.test.tstest/unit/domain/services/CheckpointSerializer.test.tstest/unit/domain/services/CheckpointService.anchors.test.tstest/unit/domain/services/CheckpointService.edgeCases.test.tstest/unit/domain/services/CheckpointService.test.tstest/unit/domain/services/Frontier.test.tstest/unit/domain/services/HttpSyncServer.auth.test.tstest/unit/domain/services/HttpSyncServer.authorize.test.tstest/unit/domain/services/HttpSyncServer.test.tstest/unit/domain/services/IncrementalIndexUpdater.test.tstest/unit/domain/services/IndexRebuildService.deep.test.tstest/unit/domain/services/IndexRebuildService.streaming.test.tstest/unit/domain/services/IndexRebuildService.test.tstest/unit/domain/services/IndexStalenessChecker.test.tstest/unit/domain/services/JoinReducer.integration.test.tstest/unit/domain/services/LogicalIndexReader.test.tstest/unit/domain/services/MaterializedView.equivalence.test.tstest/unit/domain/services/MaterializedViewService.test.tstest/unit/domain/services/MaterializedViewService.verify.test.tstest/unit/domain/services/MessageCodecModules.test.tstest/unit/domain/services/PropertyIndex.test.tstest/unit/domain/services/ProvenanceIndex.test.tstest/unit/domain/services/StateSerializer.test.tstest/unit/domain/services/StreamingBitmapIndexBuilder.chunked.test.tstest/unit/domain/services/StreamingBitmapIndexBuilder.test.tstest/unit/domain/services/SyncAuthService.test.tstest/unit/domain/services/SyncSecret.test.tstest/unit/domain/services/TreeConstruction.determinism.test.tstest/unit/domain/services/WarpStateIndexBuilder.stateSession.test.tstest/unit/domain/services/WarpStateIndexBuilder.test.tstest/unit/domain/services/WormholeService.test.tstest/unit/domain/services/controllers/CheckpointController.snapshotCache.test.tstest/unit/domain/services/logging.integration.test.tstest/unit/domain/services/noBufferGlobal.test.tstest/unit/domain/services/optic/CheckpointPatchFactStream.test.tstest/unit/domain/services/optic/CheckpointShardFactReader.manifest.test.tstest/unit/domain/services/optic/CheckpointTailBasisVerifier.test.tstest/unit/domain/services/optic/CoordinateCheckpointTailOpticSource.test.tstest/unit/domain/services/optic/StreamingCheckpointBasisBuilder.test.tstest/unit/domain/services/optic/TraversalOptic.test.tstest/unit/domain/services/optic/WorldlineOptic.test.tstest/unit/domain/trust/TrustAdversarial.test.tstest/unit/domain/trust/TrustCanonical.test.tstest/unit/domain/trust/canonical.freeze.test.tstest/unit/domain/utils/defaultCodec.test.tstest/unit/domain/utils/defaultCrypto.unavailable.test.tstest/unit/domain/utils/defaultTrustCrypto.unavailable.test.tstest/unit/domain/warp/RuntimeHostPortResolvers.test.tstest/unit/domain/warp/WarpOpenOptions.test.tstest/unit/domain/warp/hydrateCheckpointIndex.regression.test.tstest/unit/helpers/fixtureDsl.test.tstest/unit/infrastructure/CasIndexStorageAdapter.streamingIndexBuilder.test.tstest/unit/infrastructure/adapters/NodeCryptoSingleton.test.tstest/unit/infrastructure/adapters/TrustCryptoSingleton.test.tstest/unit/infrastructure/codecs/CborCodec.test.tstest/unit/ports/WasmVerifiedAdmissionPort.test.tstest/unit/scripts/checkpoint-schema-upgrade.test.tstest/unit/scripts/v16-to-v17-upgrade.test.tstest/unit/scripts/visible-state-upgrade.test.ts
💤 Files with no reviewable changes (9)
- test/unit/domain/utils/defaultCodec.test.ts
- test/unit/domain/utils/defaultTrustCrypto.unavailable.test.ts
- docs/ANTI_SLUDGE_POLICY.md
- test/unit/domain/utils/defaultCrypto.unavailable.test.ts
- src/domain/utils/defaultCodec.ts
- src/domain/utils/defaultTrustCrypto.ts
- scripts/contamination-map.ts
- src/domain/utils/defaultCrypto.ts
- semgrep/typescript-anti-sludge.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: coverage-threshold
- GitHub Check: test-node (22)
- GitHub Check: preflight
🧰 Additional context used
📓 Path-based instructions (5)
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx,js,jsx}: Do not use direct imports fromsrc/infrastructure/**insrc/domain/**orsrc/ports/**; depend on a port instead.
Do not use direct Node built-ins insrc/domain/**orsrc/ports/**; use a port instead.
Files:
test/helpers/runtimeHostCommitMessageCodecSetup.tssrc/domain/services/codec/CodecRequirement.tssrc/application/RuntimeHostNodeDefaults.tssrc/infrastructure/adapters/NodeCryptoSingleton.tsbrowser.tstest/integration/api/multiwriter.test.tssrc/ports/TrustCryptoPort.tstest/unit/domain/services/optic/CheckpointShardFactReader.manifest.test.tstest/unit/domain/services/optic/WorldlineOptic.test.tstest/unit/domain/warp/RuntimeHostPortResolvers.test.tstest/unit/domain/services/optic/TraversalOptic.test.tstest/unit/domain/WarpWorldline.capabilities.test.tsindex.tstest/unit/boundary/domain-default-port-modules.test.tstest/unit/domain/services/SyncSecret.test.tstest/unit/benchmark/detachedReadBenchmark.fixture.test.tstest/unit/helpers/fixtureDsl.test.tstest/unit/domain/services/noBufferGlobal.test.tstest/unit/scripts/v16-to-v17-upgrade.test.tstest/unit/infrastructure/adapters/NodeCryptoSingleton.test.tstest/unit/domain/publicStrandAndRuntimeSeams.test.tstest/unit/domain/trust/canonical.freeze.test.tstest/unit/domain/services/AuditVerifierService.bench.tssrc/infrastructure/adapters/TrustCryptoSingleton.tssrc/application/RuntimeHostBrowserDefaults.tstest/unit/domain/services/StreamingBitmapIndexBuilder.chunked.test.tstest/unit/ports/WasmVerifiedAdmissionPort.test.tstest/unit/domain/runtimeReadingBasisErrors.test.tssrc/domain/services/optic/StreamingCheckpointBasisBuilder.tstest/unit/infrastructure/adapters/TrustCryptoSingleton.test.tssrc/application/RuntimeHostCommitMessageCodecDefaults.tstest/unit/domain/services/optic/CoordinateCheckpointTailOpticSource.test.tstest/unit/domain/WarpWorldline.test.tstest/integration/WarpGraph.integration.test.tstest/unit/domain/services/WarpStateIndexBuilder.stateSession.test.tstest/unit/domain/services/IndexRebuildService.deep.test.tstest/unit/infrastructure/CasIndexStorageAdapter.streamingIndexBuilder.test.tstest/conformance/comparisonLiveCoordinateSeam.test.tstest/unit/domain/services/TreeConstruction.determinism.test.tssrc/domain/services/crypto/CryptoRequirement.tstest/unit/domain/warp/hydrateCheckpointIndex.regression.test.tssrc/domain/services/WormholeService.tstest/unit/domain/services/AuditReceiptService.test.tssrc/domain/services/provenance/ProvenanceIndex.tssrc/ports/WasmVerifiedAdmissionPort.tstest/runtime/deno/helpers.tstest/unit/scripts/checkpoint-schema-upgrade.test.tssrc/domain/warp/WarpGraphRuntimeProduct.tstest/unit/domain/services/BitmapIndexBuilder.test.tstest/unit/domain/services/MessageCodecModules.test.tstest/unit/domain/WarpCore.snapshotHashStability.test.tssrc/domain/utils/seekCacheKey.tssrc/domain/warp/RuntimeHostProduct.tstest/unit/domain/services/IndexStalenessChecker.test.tstest/unit/domain/services/HttpSyncServer.authorize.test.tssrc/domain/capabilities/IntentCapability.tssrc/domain/services/index/IncrementalIndexUpdater.tstest/unit/domain/warp/WarpOpenOptions.test.tstest/unit/domain/services/MaterializedViewService.test.tstest/helpers/fixtureDsl.tstest/unit/domain/services/controllers/CheckpointController.snapshotCache.test.tstest/unit/domain/services/optic/CheckpointTailBasisVerifier.test.tssrc/domain/services/Frontier.tstest/unit/scripts/visible-state-upgrade.test.tstest/unit/domain/trust/TrustCanonical.test.tstest/unit/domain/WarpGraph.encryption.test.tstest/unit/domain/WarpWorldline.admitIntent.test.tssrc/domain/warp/WarpCoreRuntimeProduct.tstest/unit/domain/seekCache.test.tstest/unit/domain/services/BitmapIndexReader.chunked.test.tssrc/domain/types/WarpIntentDescriptor.tsbin/cli/commands/trust.tstest/unit/domain/services/AuditVerifierService.test.tsbin/cli/commands/verify-audit.tstest/unit/domain/services/IndexRebuildService.streaming.test.tstest/unit/domain/services/HttpSyncServer.test.tssrc/domain/services/index/BitmapIndexBuilder.tssrc/domain/services/admission/WasmVerifiedAdmissionService.tssrc/domain/services/index/PropertyIndexReader.tssrc/domain/trust/TrustCanonical.tstest/unit/domain/properties/Join.property.test.tstest/unit/domain/services/optic/CheckpointPatchFactStream.test.tstest/unit/domain/services/CheckpointService.anchors.test.tstest/unit/domain/services/MaterializedViewService.verify.test.tstest/unit/domain/services/MaterializedView.equivalence.test.tstest/unit/domain/services/AuditReceiptService.coverage.test.tstest/bats/helpers/seed-setup.tssrc/domain/WarpGraph.tstest/unit/domain/services/BitmapIndexBuilder.integrity.test.tstest/integration/api/helpers/setup.tstest/unit/domain/services/Frontier.test.tssrc/domain/services/MaterializedViewService.tstest/unit/domain/services/optic/StreamingCheckpointBasisBuilder.test.tssrc/domain/services/sync/SyncAuthService.tssrc/domain/services/audit/AuditVerifierService.tstest/unit/domain/services/WormholeService.test.tstest/unit/domain/services/HttpSyncServer.auth.test.tsscripts/migrations/v17.0.0/checkpoint-schema-upgrade.tssrc/domain/services/index/IndexRebuildService.tstest/unit/domain/services/logging.integration.test.tssrc/domain/services/state/CheckpointSerializer.tstest/unit/domain/services/BitmapIndexBuilder.frontier.test.tssrc/domain/services/state/StateSerializer.tstest/unit/domain/services/IndexRebuildService.test.tstest/unit/domain/trust/TrustAdversarial.test.tstest/unit/domain/services/ProvenanceIndex.test.tssrc/domain/services/controllers/IntentController.tstest/unit/domain/services/PropertyIndex.test.tstest/unit/domain/services/WarpStateIndexBuilder.test.tssrc/infrastructure/adapters/TrustCryptoAdapter.tssrc/domain/services/index/LogicalIndexReader.tssrc/domain/warp/RuntimeHostPortResolvers.tstest/unit/domain/services/StateSerializer.test.tstest/unit/infrastructure/codecs/CborCodec.test.tssrc/domain/services/audit/TrustEvaluationService.tssrc/domain/services/index/WarpStateIndexBuilder.tssrc/domain/services/index/IndexStalenessChecker.tstest/unit/domain/services/CheckpointSerializer.test.tssrc/domain/RuntimeHost.tssrc/domain/services/index/BitmapIndexReader.tstest/unit/domain/services/CheckpointService.edgeCases.test.tssrc/domain/WarpWorldline.tstest/unit/domain/services/LogicalIndexReader.test.tssrc/domain/services/index/StreamingBitmapIndexBuilder.tstest/unit/domain/services/SyncAuthService.test.tstest/helpers/mockPorts.tstest/unit/domain/services/IncrementalIndexUpdater.test.tstest/unit/domain/services/BoundaryTransitionRecord.test.tstest/unit/domain/services/StreamingBitmapIndexBuilder.test.tstest/unit/domain/services/JoinReducer.integration.test.tstest/unit/domain/services/CheckpointService.test.tstest/unit/domain/services/BitmapIndexReader.test.tssrc/domain/warp/RuntimeHostBoot.ts
src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
src/**/*.{ts,tsx,js,jsx}: Do not introduceany,as any,as unknown as,unknown(outside adapters),Record<string, unknown>(outside adapters),*Likeplaceholder types,JSON.parse/JSON.stringify(outside adapters),fetch(outside adapters),process.env(outside adapters),@ts-ignore, orz.any()in core code; use validated boundary models and ports instead.
Use constructor-injected ports for external capabilities; do not rely on ambient dependencies for I/O, clocks, persistence, or entropy.
Do not createutils.ts,helpers.ts,misc.ts, orcommon.ts; name files after the actual concept they model.
Prefer one file per class, type, or object; if a file accumulates peer concepts, split it.
Keep helper corridors, fake shape trust, transitional duplication, and compile-time theater out of the codebase; runtime-honest TypeScript must reflect actual behavior.
No enum usage; prefer runtime-backed domain forms and unions.
Do not use boolean trap parameters; prefer named option objects or separate methods.
Avoid magic strings or numbers when a named constant should exist.
Keep domain bytes asUint8Array;Bufferbelongs in infrastructure adapters.
Files:
src/domain/services/codec/CodecRequirement.tssrc/application/RuntimeHostNodeDefaults.tssrc/infrastructure/adapters/NodeCryptoSingleton.tssrc/ports/TrustCryptoPort.tssrc/infrastructure/adapters/TrustCryptoSingleton.tssrc/application/RuntimeHostBrowserDefaults.tssrc/domain/services/optic/StreamingCheckpointBasisBuilder.tssrc/application/RuntimeHostCommitMessageCodecDefaults.tssrc/domain/services/crypto/CryptoRequirement.tssrc/domain/services/WormholeService.tssrc/domain/services/provenance/ProvenanceIndex.tssrc/ports/WasmVerifiedAdmissionPort.tssrc/domain/warp/WarpGraphRuntimeProduct.tssrc/domain/utils/seekCacheKey.tssrc/domain/warp/RuntimeHostProduct.tssrc/domain/capabilities/IntentCapability.tssrc/domain/services/index/IncrementalIndexUpdater.tssrc/domain/services/Frontier.tssrc/domain/warp/WarpCoreRuntimeProduct.tssrc/domain/types/WarpIntentDescriptor.tssrc/domain/services/index/BitmapIndexBuilder.tssrc/domain/services/admission/WasmVerifiedAdmissionService.tssrc/domain/services/index/PropertyIndexReader.tssrc/domain/trust/TrustCanonical.tssrc/domain/WarpGraph.tssrc/domain/services/MaterializedViewService.tssrc/domain/services/sync/SyncAuthService.tssrc/domain/services/audit/AuditVerifierService.tssrc/domain/services/index/IndexRebuildService.tssrc/domain/services/state/CheckpointSerializer.tssrc/domain/services/state/StateSerializer.tssrc/domain/services/controllers/IntentController.tssrc/infrastructure/adapters/TrustCryptoAdapter.tssrc/domain/services/index/LogicalIndexReader.tssrc/domain/warp/RuntimeHostPortResolvers.tssrc/domain/services/audit/TrustEvaluationService.tssrc/domain/services/index/WarpStateIndexBuilder.tssrc/domain/services/index/IndexStalenessChecker.tssrc/domain/RuntimeHost.tssrc/domain/services/index/BitmapIndexReader.tssrc/domain/WarpWorldline.tssrc/domain/services/index/StreamingBitmapIndexBuilder.tssrc/domain/warp/RuntimeHostBoot.ts
src/domain/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
src/domain/**/*.{ts,tsx,js,jsx}: Insrc/domain/**, do not useDate.now(),new Date(),Date(),performance.now(),Math.random(),crypto.randomUUID(),crypto.getRandomValues(),setTimeout,setInterval, rawnew Error(...)/new TypeError(...), or direct imports from Node built-ins; time, entropy, and external capabilities must enter through ports or parameters, and domain errors should extendWarpError.
Construct domain objects only in core when doing so establishes validated runtime truth; do not build infrastructure adapters, host APIs, persistence implementations, wall clocks, or entropy sources inside core.
Prefer discriminated unions and explicit result types instead of boolean-flag bags, and model expected failures as return values rather than exceptions.
src/domain/must not import host APIs or Node-specific globals; hexagonal architecture boundaries are mandatory.
Domain code must not use the wall clock directly; time must enter through a port or parameter.
Files:
src/domain/services/codec/CodecRequirement.tssrc/domain/services/optic/StreamingCheckpointBasisBuilder.tssrc/domain/services/crypto/CryptoRequirement.tssrc/domain/services/WormholeService.tssrc/domain/services/provenance/ProvenanceIndex.tssrc/domain/warp/WarpGraphRuntimeProduct.tssrc/domain/utils/seekCacheKey.tssrc/domain/warp/RuntimeHostProduct.tssrc/domain/capabilities/IntentCapability.tssrc/domain/services/index/IncrementalIndexUpdater.tssrc/domain/services/Frontier.tssrc/domain/warp/WarpCoreRuntimeProduct.tssrc/domain/types/WarpIntentDescriptor.tssrc/domain/services/index/BitmapIndexBuilder.tssrc/domain/services/admission/WasmVerifiedAdmissionService.tssrc/domain/services/index/PropertyIndexReader.tssrc/domain/trust/TrustCanonical.tssrc/domain/WarpGraph.tssrc/domain/services/MaterializedViewService.tssrc/domain/services/sync/SyncAuthService.tssrc/domain/services/audit/AuditVerifierService.tssrc/domain/services/index/IndexRebuildService.tssrc/domain/services/state/CheckpointSerializer.tssrc/domain/services/state/StateSerializer.tssrc/domain/services/controllers/IntentController.tssrc/domain/services/index/LogicalIndexReader.tssrc/domain/warp/RuntimeHostPortResolvers.tssrc/domain/services/audit/TrustEvaluationService.tssrc/domain/services/index/WarpStateIndexBuilder.tssrc/domain/services/index/IndexStalenessChecker.tssrc/domain/RuntimeHost.tssrc/domain/services/index/BitmapIndexReader.tssrc/domain/WarpWorldline.tssrc/domain/services/index/StreamingBitmapIndexBuilder.tssrc/domain/warp/RuntimeHostBoot.ts
src/domain/**/!(*.test).{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use explicit domain concepts with validated constructors,
Object.freeze, andinstanceofdispatch; domain objects should be runtime-backed nouns, not ad hoc shape bags.
Files:
src/domain/services/codec/CodecRequirement.tssrc/domain/services/optic/StreamingCheckpointBasisBuilder.tssrc/domain/services/crypto/CryptoRequirement.tssrc/domain/services/WormholeService.tssrc/domain/services/provenance/ProvenanceIndex.tssrc/domain/warp/WarpGraphRuntimeProduct.tssrc/domain/utils/seekCacheKey.tssrc/domain/warp/RuntimeHostProduct.tssrc/domain/capabilities/IntentCapability.tssrc/domain/services/index/IncrementalIndexUpdater.tssrc/domain/services/Frontier.tssrc/domain/warp/WarpCoreRuntimeProduct.tssrc/domain/types/WarpIntentDescriptor.tssrc/domain/services/index/BitmapIndexBuilder.tssrc/domain/services/admission/WasmVerifiedAdmissionService.tssrc/domain/services/index/PropertyIndexReader.tssrc/domain/trust/TrustCanonical.tssrc/domain/WarpGraph.tssrc/domain/services/MaterializedViewService.tssrc/domain/services/sync/SyncAuthService.tssrc/domain/services/audit/AuditVerifierService.tssrc/domain/services/index/IndexRebuildService.tssrc/domain/services/state/CheckpointSerializer.tssrc/domain/services/state/StateSerializer.tssrc/domain/services/controllers/IntentController.tssrc/domain/services/index/LogicalIndexReader.tssrc/domain/warp/RuntimeHostPortResolvers.tssrc/domain/services/audit/TrustEvaluationService.tssrc/domain/services/index/WarpStateIndexBuilder.tssrc/domain/services/index/IndexStalenessChecker.tssrc/domain/RuntimeHost.tssrc/domain/services/index/BitmapIndexReader.tssrc/domain/WarpWorldline.tssrc/domain/services/index/StreamingBitmapIndexBuilder.tssrc/domain/warp/RuntimeHostBoot.ts
src/ports/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
In
src/ports/**, do not import Node built-ins orsrc/infrastructure/**; ports must stay abstract and depend only on boundary-safe types.
Files:
src/ports/TrustCryptoPort.tssrc/ports/WasmVerifiedAdmissionPort.ts
| end | ||
| ``` | ||
|
|
||
| `WarpIntentDescriptor` decouples intent from `Patch`. Precommit guards declare localized property expectations (`nodeStatus`, `edgeExists`) that the runtime evaluates in constant time $O(1)$. |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win
Avoid promising O(1) unless that guarantee is actually contractual.
Line 63 upgrades “localized guard evaluation” into a hard complexity promise. The supplied change context supports bounded localized reads without whole-graph materialization, but not a blanket O(1) guarantee for every backend. Please soften this or cite the invariant that makes it true.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/topics/unmaterialized-intents.md` at line 63, The documentation in
WarpIntentDescriptor currently makes a hard O(1) complexity promise for
precommit guard evaluation, which is stronger than the described invariant.
Update the wording to describe bounded/localized guard checks without asserting
constant time unless there is a documented contractual guarantee in the runtime
or backend; if such a guarantee exists, cite the specific invariant in the same
sentence.
| Accepts a `WarpIntentDescriptor` and a `WasmVerifierReport`. The service verifies the report digest against the expected Wasm plugin SHA-256 identity, ensuring the intent was generated by a certified lowerer (`continuum.lane.lawful-autonomous/v1`) without modification or prompt injection tamper. | ||
|
|
||
| ### 2. Guard & Obstruction Handling | ||
|
|
||
| Once the verifier report is cryptographically authenticated, the service forwards the `WarpIntentDescriptor` to `WarpWorldline.admitIntent`. If any precommit guards (such as `nodeStatus` or `nodeUnassignedOrSelf`) are obstructed by the current worldline causal state, `admitWasmIntent` reflects the exact `WarpIntentOutcome` containing the obstruction tag and actual state back to the caller. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Clarify whether trust is keyed off wasmDigest or reportDigest.
The verifier report shape used by the new tests carries both fields, and the rejection path surfaces the untrusted wasmDigest as the actual value. Lines 26-30 currently describe this as checking the “report digest” against the plugin identity, which conflates two different digests and can mislead integrators about what needs to be pinned.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/topics/wasm-verified-admission.md` around lines 26 - 30, Clarify the
trust anchor in the Wasm admission docs: the current description in the
`admitWasmIntent`/`WasmVerifierReport` section conflates `reportDigest` and
`wasmDigest`. Update the wording so it explicitly says which digest is compared
against the expected Wasm plugin SHA-256 identity, and describe the rejection
path using the same symbol names (`wasmDigest`, `reportDigest`,
`WarpIntentDescriptor`, `WasmVerifierReport`) to avoid ambiguity for
integrators.
| export function installDefaultRuntimeHostBrowserPorts(): void { | ||
| installRuntimeHostCodecResolver(() => defaultCodec); | ||
| installRuntimeHostCryptoResolver(() => DEFAULT_WEB_CRYPTO); | ||
| installDefaultRuntimeHostCommitMessageCodec(); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Browser defaults leave trust-enabled opens without a TrustCryptoPort.
installDefaultRuntimeHostBrowserPorts() wires codec and crypto, but resolveConfiguredTrustCrypto() now throws E_TRUST_CRYPTO_REQUIRED whenever trust mode is enabled and no explicit trustCrypto was passed. That means the browser composition root now breaks trust-enabled opens by default. Either install a browser trust resolver here or reject browser trust mode earlier with a platform-specific error.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/application/RuntimeHostBrowserDefaults.ts` around lines 12 - 15, The
browser default port setup in installDefaultRuntimeHostBrowserPorts() is missing
a TrustCryptoPort, so trust-enabled opens now fail through
resolveConfiguredTrustCrypto() with E_TRUST_CRYPTO_REQUIRED. Update the browser
composition root to either register a browser trust crypto resolver alongside
the existing codec and crypto resolvers, or explicitly block trust mode earlier
with a browser-specific error before open proceeds. Use
installDefaultRuntimeHostBrowserPorts() and resolveConfiguredTrustCrypto() as
the key places to adjust the wiring/validation.
| private static readonly TRUSTED_WASM_DIGEST = 'sha256:7f8a9b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a'; | ||
|
|
||
| constructor(worldline: WarpWorldline) { | ||
| super(); | ||
| this._worldline = worldline; | ||
| } | ||
|
|
||
| async admitWasmIntent( | ||
| descriptor: WarpIntentDescriptor, | ||
| report: WasmVerifierReport, | ||
| ): Promise<WarpIntentOutcome> { | ||
| if (!report.verified || report.wasmDigest !== WasmVerifiedAdmissionService.TRUSTED_WASM_DIGEST) { |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Inject the trusted verifier digest/policy instead of hardcoding it in the domain.
TRUSTED_WASM_DIGEST reintroduces a domain-owned default trust anchor. Any verifier rotation or environment-specific trust policy change will start rejecting every intent until this file is changed and redeployed. Push the trusted digest set/policy into the constructor from the composition root and validate against that injected value instead.
Suggested direction
export default class WasmVerifiedAdmissionService extends WasmVerifiedAdmissionPort {
private readonly _worldline: WarpWorldline;
- private static readonly TRUSTED_WASM_DIGEST = 'sha256:7f8a9b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a';
+ private readonly _trustedWasmDigests: ReadonlySet<string>;
- constructor(worldline: WarpWorldline) {
+ constructor(worldline: WarpWorldline, trustedWasmDigests: ReadonlySet<string>) {
super();
this._worldline = worldline;
+ this._trustedWasmDigests = trustedWasmDigests;
}
@@
- if (!report.verified || report.wasmDigest !== WasmVerifiedAdmissionService.TRUSTED_WASM_DIGEST) {
+ if (!report.verified || !this._trustedWasmDigests.has(report.wasmDigest)) {
return {
admitted: false,📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| private static readonly TRUSTED_WASM_DIGEST = 'sha256:7f8a9b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a'; | |
| constructor(worldline: WarpWorldline) { | |
| super(); | |
| this._worldline = worldline; | |
| } | |
| async admitWasmIntent( | |
| descriptor: WarpIntentDescriptor, | |
| report: WasmVerifierReport, | |
| ): Promise<WarpIntentOutcome> { | |
| if (!report.verified || report.wasmDigest !== WasmVerifiedAdmissionService.TRUSTED_WASM_DIGEST) { | |
| private readonly _trustedWasmDigests: ReadonlySet<string>; | |
| constructor(worldline: WarpWorldline, trustedWasmDigests: ReadonlySet<string>) { | |
| super(); | |
| this._worldline = worldline; | |
| this._trustedWasmDigests = trustedWasmDigests; | |
| } | |
| async admitWasmIntent( | |
| descriptor: WarpIntentDescriptor, | |
| report: WasmVerifierReport, | |
| ): Promise<WarpIntentOutcome> { | |
| if (!report.verified || !this._trustedWasmDigests.has(report.wasmDigest)) { |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/domain/services/admission/WasmVerifiedAdmissionService.ts` around lines
11 - 22, The admission check in WasmVerifiedAdmissionService is still hardcoding
a trusted WASM digest, which should instead come from injected trust policy.
Remove the static TRUSTED_WASM_DIGEST constant and update the
WasmVerifiedAdmissionService constructor to accept the trusted digest or digest
policy from the composition root, then use that injected value inside
admitWasmIntent when comparing report.wasmDigest so verifier rotation and
environment-specific trust can be configured without changing domain code.
| async admitIntent(descriptor: WarpIntentDescriptor): Promise<WarpIntentOutcome> { | ||
| const worldline = this._host.worldline(); | ||
| for (const guard of descriptor.precommitGuards) { | ||
| const nodeProps = await worldline.getNodeProps(guard.nodeId); | ||
| const obstruction = this._checkGuard(guard, nodeProps); | ||
| if (obstruction !== null) { | ||
| return { admitted: false, obstruction, intentId: descriptor.intentId }; | ||
| } | ||
| } | ||
| const jsonBytes = new TextEncoder().encode(JSON.stringify(descriptor)); | ||
| let sha = `blob:intent:${descriptor.intentId}:${this._host._writerId}`; | ||
| if (typeof this._host._persistence.writeBlob === 'function') { | ||
| sha = await this._host._persistence.writeBlob(jsonBytes); | ||
| } | ||
| return { admitted: true, sha, intentId: descriptor.intentId }; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Keep intent serialization out of the domain layer.
Line 38 hard-codes JSON.stringify and TextEncoder in src/domain/**, then persists those bytes through _persistence.writeBlob. That bypasses the codec boundary this PR is trying to enforce and introduces an ad hoc blob format whose stability now depends on JS object serialization instead of a validated port. Inject a codec/persistence port and encode in an adapter instead. As per coding guidelines, "Do not introduce JSON.parse/JSON.stringify (outside adapters)", "Use constructor-injected ports for external capabilities; do not rely on ambient dependencies for I/O", and "src/domain/ must not import host APIs or Node-specific globals; hexagonal architecture boundaries are mandatory."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/domain/services/controllers/IntentController.ts` around lines 29 - 43,
Keep intent serialization out of IntentController by removing the direct
TextEncoder/JSON.stringify blob creation from admitIntent. Move encoding to an
adapter or injected codec/persistence port, and have admitIntent depend only on
a constructor-injected abstraction for producing the persisted bytes or blob
reference. Preserve the existing guard flow and return shape, but replace the ad
hoc serialization path in admitIntent with the injected port so src/domain stays
free of host/Node-specific serialization logic.
Source: Coding guidelines
| import { installDefaultRuntimeHostNodePorts } from '../../src/application/RuntimeHostNodeDefaults.ts'; | ||
|
|
||
| installDefaultRuntimeHostCommitMessageCodec(); | ||
| installDefaultRuntimeHostNodePorts(); |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Keep this helper’s contract honest.
This module now installs codec, crypto, and trust-crypto defaults, but its filename still reads like commit-message-codec-only setup. That makes it easy for tests to accidentally mask missing explicit port wiring. Either rename this helper/callers to reflect the broader side effect, or keep this file scoped to commit-message codec setup only.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/helpers/runtimeHostCommitMessageCodecSetup.ts` around lines 1 - 3, The
helper’s name and usage no longer match its side effects:
runtimeHostCommitMessageCodecSetup currently calls
installDefaultRuntimeHostNodePorts, which installs broader defaults than
commit-message codec setup. Update this helper and its callers so the identifier
reflects the full scope, or narrow the helper to only the commit-message codec
wiring; use installDefaultRuntimeHostNodePorts as the key symbol to locate the
behavior.
| const SCANNED_ROOTS = Object.freeze([ | ||
| 'src/domain', | ||
| 'src/ports', | ||
| ]); |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Broaden this scan beyond src/domain and src/ports.
This guard misses the exact non-domain consumers that were migrated in this PR, including bin/cli/commands/verify-audit.ts and scripts/migrations/v17.0.0/checkpoint-schema-upgrade.ts. A future stale import there will still pass this test.
Suggested adjustment
const SCANNED_ROOTS = Object.freeze([
- 'src/domain',
- 'src/ports',
+ 'src',
+ 'bin',
+ 'scripts',
+ 'test',
]);Also applies to: 71-80
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/unit/boundary/domain-default-port-modules.test.ts` around lines 12 - 15,
The boundary scan is too narrow because SCANNED_ROOTS only covers src/domain and
src/ports, so it can miss migrated non-domain consumers. Update the root list in
the domain-default-port-modules test to include the relevant non-domain entry
points such as the CLI command and migration script paths referenced by this PR,
and make sure the scan logic still uses the same test helpers to catch stale
imports there.
| return createBTRUseCase(initialState, payload, { | ||
| stateCodec: opts.stateCodec ?? defaultCodec, | ||
| ...opts, | ||
| btrCodec, | ||
| }); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Spread opts before applying the default codec.
If a caller passes stateCodec: undefined, the later ...opts overwrites the fallback and forwards undefined into the use case, which defeats the explicit-codec guard these helpers are supposed to enforce.
Suggested fix
function createBTR(
initialState: CreateBTRArgs[0],
payload: CreateBTRArgs[1],
opts: TestCreateBTROptions,
): ReturnType<typeof createBTRUseCase> {
return createBTRUseCase(initialState, payload, {
- stateCodec: opts.stateCodec ?? defaultCodec,
...opts,
+ stateCodec: opts.stateCodec ?? defaultCodec,
btrCodec,
});
}
function verifyBTR(
btr: VerifyBTRArgs[0],
key: VerifyBTRArgs[1],
opts: TestVerifyBTROptions = {},
): ReturnType<typeof verifyBTRUseCase> {
return verifyBTRUseCase(btr, key, {
- stateCodec: opts.stateCodec ?? defaultCodec,
...opts,
+ stateCodec: opts.stateCodec ?? defaultCodec,
btrCodec,
});
}
function replayBTR(
btr: ReplayBTRArgs[0],
opts: TestReplayBTROptions = {},
): ReturnType<typeof replayBTRUseCase> {
return replayBTRUseCase(btr, {
- stateCodec: opts.stateCodec ?? defaultCodec,
...opts,
+ stateCodec: opts.stateCodec ?? defaultCodec,
});
}Also applies to: 65-69, 76-78
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/unit/domain/services/BoundaryTransitionRecord.test.ts` around lines 53 -
57, The helper setup in BoundaryTransitionRecord tests is applying the default
stateCodec before spreading opts, so an explicit undefined stateCodec from
callers can overwrite the fallback and leak into createBTRUseCase. Update the
affected helper calls to spread opts first and then apply the default codec
override, keeping btrCodec intact, in the shared test helper used by the
createBTRUseCase invocations so the fallback always wins when stateCodec is
missing or undefined.
| }, | ||
| }), | ||
| admitIntent: admitIntentMock ?? (async (desc) => ({ admitted: true, sha: 'intent-sha', intentId: desc.intentId })), | ||
| } as any); |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Drop the any escapes so this test actually locks the public API.
Lines 20, 27, and 56 bypass TypeScript for the new admitIntent surface. That means a visibility or signature regression on WarpWorldline.admitIntent can keep compiling, which weakens the purpose of this contract test. Call handle.admitIntent(...) directly and keep the fixture typed.
Also applies to: 27-27, 56-56
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/unit/domain/WarpWorldline.admitIntent.test.ts` at line 20, The
`WarpWorldline.admitIntent` contract test is bypassing TypeScript with `any`, so
it won’t catch public API or signature regressions. Remove the `as any` escapes
in `handle.admitIntent(...)` calls and keep the test fixture strongly typed so
the compiler validates the surface. Use the `admitIntent` method on `handle`
directly everywhere in this test to ensure the contract is enforced.
| it('should reject admission if verifier report is invalid or untrusted', async () => { | ||
| const mockWorldline = { | ||
| admitIntent: async (descriptor: WarpIntentDescriptor): Promise<WarpIntentOutcome> => ({ | ||
| admitted: true, | ||
| sha: 'blob:intent:sha123', | ||
| intentId: descriptor.intentId, | ||
| }), | ||
| } as unknown as WarpWorldline; | ||
|
|
||
| const service = new WasmVerifiedAdmissionService(mockWorldline); | ||
| const outcome = await service.admitWasmIntent(validIntentDescriptor, invalidReport); | ||
|
|
||
| expect(outcome.admitted).toBe(false); | ||
| if (!outcome.admitted) { | ||
| expect(outcome.obstruction.tag).toBe('UntrustedWasmVerifierReport'); | ||
| expect(outcome.obstruction.actual).toBe('sha256:unknownWasmDigest'); | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
Assert that untrusted reports never reach WarpWorldline.
This test only checks the returned obstruction. If admitWasmIntent() mistakenly called worldline.admitIntent() before synthesizing that failure, it would still pass, so the actual gate guarantee remains untested. Spy on admitIntent here and assert it is not called for the invalid report path.
Suggested test hardening
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
…
- const mockWorldline = {
- admitIntent: async (descriptor: WarpIntentDescriptor): Promise<WarpIntentOutcome> => ({
+ const admitIntent = vi.fn(async (descriptor: WarpIntentDescriptor): Promise<WarpIntentOutcome> => ({
admitted: true,
sha: 'blob:intent:sha123',
intentId: descriptor.intentId,
- }),
+ }));
+ const mockWorldline = {
+ admitIntent,
} as unknown as WarpWorldline;
…
if (!outcome.admitted) {
expect(outcome.obstruction.tag).toBe('UntrustedWasmVerifierReport');
expect(outcome.obstruction.actual).toBe('sha256:unknownWasmDigest');
}
+ expect(admitIntent).not.toHaveBeenCalled();📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| it('should reject admission if verifier report is invalid or untrusted', async () => { | |
| const mockWorldline = { | |
| admitIntent: async (descriptor: WarpIntentDescriptor): Promise<WarpIntentOutcome> => ({ | |
| admitted: true, | |
| sha: 'blob:intent:sha123', | |
| intentId: descriptor.intentId, | |
| }), | |
| } as unknown as WarpWorldline; | |
| const service = new WasmVerifiedAdmissionService(mockWorldline); | |
| const outcome = await service.admitWasmIntent(validIntentDescriptor, invalidReport); | |
| expect(outcome.admitted).toBe(false); | |
| if (!outcome.admitted) { | |
| expect(outcome.obstruction.tag).toBe('UntrustedWasmVerifierReport'); | |
| expect(outcome.obstruction.actual).toBe('sha256:unknownWasmDigest'); | |
| } | |
| it('should reject admission if verifier report is invalid or untrusted', async () => { | |
| const admitIntent = vi.fn(async (descriptor: WarpIntentDescriptor): Promise<WarpIntentOutcome> => ({ | |
| admitted: true, | |
| sha: 'blob:intent:sha123', | |
| intentId: descriptor.intentId, | |
| })); | |
| const mockWorldline = { | |
| admitIntent, | |
| } as unknown as WarpWorldline; | |
| const service = new WasmVerifiedAdmissionService(mockWorldline); | |
| const outcome = await service.admitWasmIntent(validIntentDescriptor, invalidReport); | |
| expect(outcome.admitted).toBe(false); | |
| if (!outcome.admitted) { | |
| expect(outcome.obstruction.tag).toBe('UntrustedWasmVerifierReport'); | |
| expect(outcome.obstruction.actual).toBe('sha256:unknownWasmDigest'); | |
| } | |
| expect(admitIntent).not.toHaveBeenCalled(); | |
| }); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/unit/ports/WasmVerifiedAdmissionPort.test.ts` around lines 60 - 76, The
`WasmVerifiedAdmissionService.admitWasmIntent` invalid-report path is only
asserting the returned obstruction, so it does not prove
`WarpWorldline.admitIntent` is bypassed. Update the `should reject admission if
verifier report is invalid or untrusted` test to spy on `admitIntent` in the
`mockWorldline` and assert it is never called when `invalidReport` is passed,
while keeping the existing `UntrustedWasmVerifierReport` obstruction checks.
…r WarpWorldline test mocks
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/domain/services/controllers/IntentController.ts (1)
49-52: 📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy liftReplace raw
unknownnode props with a validated domain model
IntentControlleris still threadingReadonly<{ [key: string]: unknown }>through core and then compensating withas unknown ascasts. DecodegetNodeProps()at the port boundary into a runtime-backed domain type, and have the guard helpers consume that type instead of indexing ad hoc bags. The same pattern also leaks intoWarpIntentDescriptor.tsviaRecord<string, unknown>.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/domain/services/controllers/IntentController.ts` around lines 49 - 52, IntentController is still passing raw unknown-shaped node props through core and relying on casts instead of a validated model. Move the runtime decoding to the port boundary in getNodeProps(), introduce a proper domain type for node props, and update _checkGuard and the guard helpers to accept that type rather than Readonly<{ [key: string]: unknown }> or ad hoc indexing. Also align WarpIntentDescriptor.ts to use the same validated type instead of Record<string, unknown> so the unsafe as unknown as casts can be removed.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/domain/services/controllers/IntentController.ts`:
- Around line 49-52: IntentController is still passing raw unknown-shaped node
props through core and relying on casts instead of a validated model. Move the
runtime decoding to the port boundary in getNodeProps(), introduce a proper
domain type for node props, and update _checkGuard and the guard helpers to
accept that type rather than Readonly<{ [key: string]: unknown }> or ad hoc
indexing. Also align WarpIntentDescriptor.ts to use the same validated type
instead of Record<string, unknown> so the unsafe as unknown as casts can be
removed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8f61a98d-3c65-4d0e-8b90-1b068d787227
📒 Files selected for processing (4)
policy/quarantines/0025A-casts.jsonpolicy/quarantines/0025B-boundary.jsonsrc/domain/services/controllers/IntentController.tstest/unit/ports/WasmVerifiedAdmissionPort.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: coverage-threshold
- GitHub Check: preflight
- GitHub Check: test-node (22)
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx,js,jsx}: Do not use direct imports fromsrc/infrastructure/**insrc/domain/**orsrc/ports/**; depend on a port instead.
Do not use direct Node built-ins insrc/domain/**orsrc/ports/**; use a port instead.
Files:
test/unit/ports/WasmVerifiedAdmissionPort.test.tssrc/domain/services/controllers/IntentController.ts
src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
src/**/*.{ts,tsx,js,jsx}: Do not introduceany,as any,as unknown as,unknown(outside adapters),Record<string, unknown>(outside adapters),*Likeplaceholder types,JSON.parse/JSON.stringify(outside adapters),fetch(outside adapters),process.env(outside adapters),@ts-ignore, orz.any()in core code; use validated boundary models and ports instead.
Use constructor-injected ports for external capabilities; do not rely on ambient dependencies for I/O, clocks, persistence, or entropy.
Do not createutils.ts,helpers.ts,misc.ts, orcommon.ts; name files after the actual concept they model.
Prefer one file per class, type, or object; if a file accumulates peer concepts, split it.
Keep helper corridors, fake shape trust, transitional duplication, and compile-time theater out of the codebase; runtime-honest TypeScript must reflect actual behavior.
No enum usage; prefer runtime-backed domain forms and unions.
Do not use boolean trap parameters; prefer named option objects or separate methods.
Avoid magic strings or numbers when a named constant should exist.
Keep domain bytes asUint8Array;Bufferbelongs in infrastructure adapters.
Files:
src/domain/services/controllers/IntentController.ts
src/domain/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
src/domain/**/*.{ts,tsx,js,jsx}: Insrc/domain/**, do not useDate.now(),new Date(),Date(),performance.now(),Math.random(),crypto.randomUUID(),crypto.getRandomValues(),setTimeout,setInterval, rawnew Error(...)/new TypeError(...), or direct imports from Node built-ins; time, entropy, and external capabilities must enter through ports or parameters, and domain errors should extendWarpError.
Construct domain objects only in core when doing so establishes validated runtime truth; do not build infrastructure adapters, host APIs, persistence implementations, wall clocks, or entropy sources inside core.
Prefer discriminated unions and explicit result types instead of boolean-flag bags, and model expected failures as return values rather than exceptions.
src/domain/must not import host APIs or Node-specific globals; hexagonal architecture boundaries are mandatory.
Domain code must not use the wall clock directly; time must enter through a port or parameter.
Files:
src/domain/services/controllers/IntentController.ts
src/domain/**/!(*.test).{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use explicit domain concepts with validated constructors,
Object.freeze, andinstanceofdispatch; domain objects should be runtime-backed nouns, not ad hoc shape bags.
Files:
src/domain/services/controllers/IntentController.ts
🔇 Additional comments (4)
test/unit/ports/WasmVerifiedAdmissionPort.test.ts (1)
63-67: Still missing theadmitIntentbypass assertion.This path still only verifies the returned obstruction, so a regression that calls
worldline.admitIntent()before synthesizing the failure would still pass.src/domain/services/controllers/IntentController.ts (3)
40-45: Intent serialization is still happening insidesrc/domain/**.The prior boundary comment is still valid here:
TextEncoder+JSON.stringify+ direct blob persistence are still hard-coded in core domain code.
53-59:edgeExistsguards are still falling through as successful.The dispatch still only handles
nodeStatusandnodeUnassignedOrSelf, so the previously raisededgeExistsguard bug remains.
89-103: Queued intents are still written and read under different keys.
queueIntent()still stores bystrandIdwhilegetWriterIntents()still reads bywriterId, so the earlier retrieval bug remains unresolved.
Release Preflight
If this PR is from a |
1 participant
Summary
Validation
Closes #169