0.42.0-alpha.6 — audit round 2 remediation (TP-5.6) - #594
Merged
Conversation
added 3 commits
July 28, 2026 13:44
…(TP-5.6) Morph client correctness (round-2 review #576-#593): explicit form action wins on enhanced submits (formAction IDL is only honored with a formaction attribute); popstate guard persists via sessionStorage and covers bfcache pageshow restores; DSD templates instantiate manually before morph insertions so morphed-in islands hydrate the server render; __morphChildren rewritten as an ordered walk with relocation and exact deletion; island comparison recurses with template/whitespace normalization on both sides; late-hydrating islands get the submit listener; cancelable open:action-error precedes the network-failure reload; region-miss and network fallbacks log a reason; detached shadow roots pruned from the listener registry. Detection: hasEnhancedForms follows relative imports (bounded, cycle-safe) so shared-component forms keep the enhancement layer. Protocol tail: malformed form bodies answer 400 on both channels; redirect duck type honors the 3xx whitelist; 405 carries no-store/Vary; redirect() constructor validation has unit tests. Evidence: parity contract extended (JSON 404, contract-violation 500, malformed 400, 405 no-store, 303-to-GET chain); local playwright retries zeroed; alpha.2 note enhancement-inert erratum; MORPH_CONTRACT updated; fixture 49 tests x 3 engines = 147 green. Refs #576-#593
….41-era stale-claim pattern that collided with the real 0.42.0-alpha.6
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
|
APIError: Insufficient Balance |
This was referenced Jul 28, 2026
Closed
Closed
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
0.42.0-alpha.6 — audit round 2 remediation (TP-5.6)
Plan: VERSION_PLAN TP-5.6 (inserted; TP-6 准入 updated).
ADRs: none new (ADR-0121 implementation continues).
Scope: second independent review (docs/audit/2026-07-28-alpha5-round2-review.md), issues #576–#593 — five high-severity morph-client defects (form action URL, popstate-after-reload, DSD instantiation, ordered morph matching, import-following detection) plus protocol tail (400/405/duck whitelist), evidence (parity matrix, retries, alpha.2 erratum).
Local: autoflow:ci full suite green (fixture 49×3=147; parity 10/10; consumer local+packaged; WC smoke); docs:truth; interface:snapshot; workflow:check.
Release docs: CHANGELOG entry, docs/release/v0.42.0-alpha.6.md, www roadmap current entry.
CI: dev CI pending on HEAD.