mirror/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea synced 2026-10-26 06:16:17 -04:00
Code Issues Packages Projects Releases Wiki Activity

feat(application): add isolated JavaScript replay

Browse Source 
Expose one plan/execute replay contract through both CLI and MCP with exact source, input, runtime, sandbox, limit, and export commitments.

Run selected ESM and extracted CommonJS/Rspack factories in a disposable Linux x64 Bubblewrap namespace with a content-addressed Node ELF closure, architecture-checked seccomp, delegated systemd cgroup limits, bounded protocol capture, cancellation, and observable cleanup.

Preserve left and right observations as Evidence, derive differential comparisons without erasing unknowns, add optional separately authorized reproducers, and fail closed on stale plans or unavailable host boundaries.

Add source-owned parser, sanitizer, clipboard, denial, timeout, OOM, protocol-forgery, and cancellation coverage; a real Linux verifier and workflow; regenerated catalogs and TypeDoc; and updated the packaged REA analysis skill for the 83-tool inventory.
This commit is contained in:
N0zoM1z0
2026-07-16 14:31:37 +08:00
committed by N0zoM1z0
parent 461990da3f
commit d86231ad33
194 changed files with 6332 additions and 604 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/javascript-application-workflows.md
+5 -5
View File
@@ -75,15 +75,15 @@ carry these records without another persistence format.
## Controlled replay boundary
These shipped workflows never execute a graph node or recovered module. A
future extracted-module replay may consume an exact trace handoff only through
the separate `javascript_replay` authority, two-phase content-bound approval,
and mandatory Linux OS sandbox fixed by
Static graph workflows never execute a graph node or recovered module.
`run_controlled_replay` is the separate extracted-module boundary: it requires
the `javascript_replay` authority, a plan call followed by exact content-bound
approval, and the mandatory Linux OS sandbox fixed by
[ADR-0002](adr/0002-controlled-replay-authority-and-sandbox.md). Browser,
Electron, Process Capture, artifact-read, and static-analysis approvals do not
authorize that execution.
Replay observations will retain `controlled-replay` authority. They cannot
Replay observations retain `controlled-replay` authority. They cannot
promote static inference into passive runtime observation or prove that the
original application, renderer, preload, main process, or remote service
behaved identically.