mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
Dragan Spiridonov
c86211c620
Independent adversarial review of 2768c29 found three blockers and two
should-fixes. All five are addressed. Three of the blockers were mine, and two
of them were the same mistake I had already been given once in this work.
B1 — THE LABELLING FIX HAD NO TEST ON THE WIRING.
Reverting channel_read's handler to the pre-PR flat return — the entire defect
this branch exists to fix — left the suite green. All four tests exercised
`labelRelayRead` as a pure function; none reached the handler, which is the half
that regresses by accident. The module reaches the relay through
`await import('ws')`, so that is now mocked and the handler is driven end to end:
a fixture event goes in, and the test asserts the envelope fields and that
`out.channel` is undefined because the payload is nested. That mutant now
reddens two tests.
B2 — AND THE ONE TEST THAT NAMED THE WIRING WAS VACUOUS.
It asserted the tool description matched /Use when/, which matches all six
descriptions in the file: a house-style check wearing a security test's name.
Replaced.
B3 — "ONLY channel_read NEEDED IT" WAS WRONG.
channel_accept pushed `JSON.parse(ev.content).channel` verbatim into
`unopenable[]` on both failure paths — unvalidated third-party text reaching the
caller beside this machine's key-store path, which is the class #3300 exists to
prevent. A grant whose id is not a channel id cannot be a real grant, so it is
refused and reported as `malformedGrants`, a count. No publisher string reaches
the caller.
My first fix for B3 repeated B1's mistake: the test asserted CHANNEL_ID_RE's
behaviour rather than that the handler uses it, and deleting the guard left the
suite green. There is now a handler-level test driving a hostile grant through
the fake relay.
S3 — THE RETURNED LEDGER KEPT ITS NULL PROTOTYPE.
The previous commit spread it back to an ordinary object, which restored the
exact hazard being fixed on the read side: `board.toString` is a truthy
function, so `!board[r]` — the same idiom the reducer uses — reports an unowned
resource as owned, and `Object.assign({}, board)` silently drops a `__proto__`
claim. The justification given for the spread was also wrong: loose
`assert.deepEqual(Object.create(null), {})` passes, and the two tests that broke
did so because this file imports `node:assert/strict`. Both were asserting the
shape of an EMPTY board, not a caller contract, so they now assert
`Object.keys(...)` and the prototype stays off.
S5 — A NON-STRING resourceId IS REFUSED RATHER THAN COERCED.
`fetchRecent` spreads arbitrary JSON, so resourceId is not necessarily a string:
`["repo/website"]` keys as 'repo/website' and squats that resource, and any
object collapses to '[object Object]'. The comment claiming it is a string is
now true.
Mutants, all reddening their own tests: handler reverted to a flat return,
CHANNEL_ID_RE guard deleted, label dropped, label fields made overwritable,
plain-object ledger, ledger returned through a spread, string guard removed.
CLI suite 90 failed files / 112 failed tests before and after (pre-existing),
passing 2426 -> 2433. tsc 463 before and after. Gateway 42 -> 49 pass, 0 fail.
graph-analyzer 0/6 runs failed.
Co-Authored-By: Ruflo & AQE
Claude-Session: https://claude.ai/code/session_01NpXyuvm9QACWhD8egqw8zU