fix(lab): CL-02 post-merge hardening

[Wibias]

Summary

Post-merge CL-02 hardening after PR #1333 merged at 025c37916225dd685d9217e5b40190600f06d278 and a final CodeRabbit batch landed immediately before merge.

This PR remains CL-02-only. It does not start CL-03 and does not change frozen CL-00 semantics.

Fixes in this follow-up

• preserves chunked JSONL replay across 64 KiB UTF-8 boundaries without retaining views into the reusable read buffer
• immediately discards oversized unterminated JSONL prefixes after recording one corruption, keeping replay memory bounded
• preserves idempotent content-addressed artifact publication when a concurrent writer wins the same-digest race, while retaining symlink/hardlink rejection and final digest verification
• converts malformed contract JSON / claim-source validation failures to structured artifact_mismatch
• rejects embedded raw POSIX paths such as config=/home/<user>/... before ledger admission
• derives default sensitive purge actions from PURGE_ACTIONS, including export
• distinguishes an already-committed ledger rename from a subsequent directory-fsync durability failure in purge progress reporting
• makes ScenarioRunResult.startedAt/completedAt typed runner output and removes the CL-02 cast-based timestamp seam
• fails closed at runtime for an unmapped conformance failure classification while retaining the compile-time exhaustiveness guard
• corrects the Compatibility Lab stack log to record feat(lab): CL-02 immutable evidence ledger and projection #1333 as merged and fix(lab): CL-02 post-merge hardening #1343 as the post-merge hardening follow-up

Regression coverage

New focused tests cover:

• a real multi-byte UTF-8 code point straddling byte offset 65536
• oversized unterminated ledger-line accounting
• embedded POSIX path privacy rejection
• malformed contract artifact mismatch classification
• default purge removal of export evidence
• suite/scenario freshness using the stricter effective maxAgeMs
• the frozen CL-00 capability_absence_control → UNSUPPORTED projection path using synthetic evidence, without modifying the V1 authority

Base

• upstream base: dev
• base SHA: 025c37916225dd685d9217e5b40190600f06d278
• branch: fix/cl-02-post-merge-hardening

Validation

• earlier hardening head: TypeScript gate passed and React Doctor passed
• current head: CI is running after the final regression/doc commits

Keep this PR draft until the current cross-platform run is green and the post-merge review findings are reconciled.

Summary by CodeRabbit

• Bug Fixes

  • Improved artifact publishing when digest files appear during processing.
  • Strengthened handling of malformed or invalid artifact data.
  • Improved replay of large and multibyte ledger entries.
  • Expanded detection and rejection of unsafe filesystem paths.
  • Improved sensitive-evidence cleanup and durability reporting.
  • Added accurate execution timestamps and fail-closed result classification.
  • Improved purge validation, including targetless cleanup actions.
  • Improved protocol projection for freshness boundaries and unsupported capabilities.

• Tests

  • Added coverage for artifact validation, replay boundaries, path rejection, cleanup, timestamps, and projection behavior.

• Documentation

  • Updated compatibility and post-merge hardening status documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 67a42e5d-6fff-4e08-8ec1-681616d22e78

📥 Commits

Reviewing files that changed from the base of the PR and between 0da8c27 and 953e75f.

📒 Files selected for processing (2)

• src/lab/events/limits.ts
• tests/lab-post-merge-hardening.test.ts

---

📝 Walkthrough

Walkthrough

The PR hardens Compatibility Lab ledger replay, artifact publication and validation, sensitive-evidence purging, filesystem-path detection, conformance timestamps, and projection behavior. It adds regression coverage for these changes.

Changes

Compatibility Lab hardening

Layer / File(s)	Summary
Ledger replay buffering src/lab/ledger/store.ts, tests/lab-post-merge-hardening.test.ts	Replay preserves split UTF-8 code points. Oversized unterminated lines are discarded and counted once.
Artifact publication and mismatch classification src/lab/artifacts/secure-fs.ts, src/lab/artifacts/store.ts, tests/lab-post-merge-hardening.test.ts	Artifact writes recheck digest targets after an initial miss. Invalid JSON and UTF-8 produce artifact_mismatch errors.
Evidence privacy and purge validation src/lab/ledger/purge.ts, src/lab/events/limits.ts, src/lab/events/validate.ts, tests/lab-post-merge-hardening.test.ts	Purge tracks rename completion and directory fsync failures. Unix path detection accepts broader path forms. Targetless purges require a directory-scoped scratch or export action.
Conformance execution timestamps src/lab/conformance/types.ts, src/lab/conformance/executor.ts, src/lab/observe/from-conformance.ts	Scenario results include numeric start and completion timestamps. Observation persistence validates timestamps and unmapped classifications.
Projection verification coverage tests/lab-post-merge-projection.test.ts	Tests cover the 500 ms freshness boundary and capability-absence projection as UNSUPPORTED without corruptions.
Hardening plan and stack status devlog/_plan/260807_compatibility_lab/*	The hardening scope, merge provenance, follow-up state, and authorization status are recorded.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• lidge-jun/opencodex#1286: The PR defines the Compatibility Lab contracts and infrastructure hardened here.
• lidge-jun/opencodex#1320: The PR introduced related conformance-harness, replay, artifact, and failure-classification components.
• lidge-jun/opencodex#1333: The PR introduced the CL-02 implementations hardened here.

Suggested reviewers: ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the CL-02 post-merge hardening work, which is the main purpose of the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.