0.42.0-alpha.5 — audit round 1 remediation (TP-5.5) - #574
Merged
Conversation
added 4 commits
July 28, 2026 02:50
…d 1 remediation (TP-5.5) Protocol hardening per ADR-0121: hasAction covers named actions, own-key named-action dispatch, unified x-openelement-action header (true/enhance) with Vary, Response-return contract violation, PRG action-marker strip, 3xx-to-303 coercion on POST + redirect() status validation, fetch-channel 404/500 JSON symmetry with PROD scrub, no-store default on request-time responses, POST error-boundary parity, bodyLimit on action POSTs, defined 405 for non-GET/POST, renderIntent.mode validation. Morph client rewrite (alpha.3 enhancement never fired: submit is not composed and page content lives in page-element DSD): per-shadow-root submit interception, shadow-content morph, id-keyed + bounded-lookahead matching, form-scoped regions with navigation fallback, popstate reload, open:action-failure restored, submitter-preserving body, 500/cross-origin navigation fallback, double-submit guard, fragment preservation, state-mirroring attribute skip list. Evidence and gates: fixture three-engine e2e in ci+release gate tiers, static-output freeze tool (release tier), dev/build parity contract test, dev SSR customElements polyfill (dev SSR 500 fix), perf baseline with environment fields, alpha.3/alpha.4 release-note errata (false survival claims), MORPH_CONTRACT survival matrix doc. Manifest and surface: self-contained matchRequestTimeRoute host contract, [...path] wildcard fix, /item/[id] fixture, zero-island enhancement with conditional enhancement layer (lean bundles for form-less sites), Spa* loader/action type split, PACKAGE_SURFACE completion, starter contact.tsx shipping fix + Nitro-node POST smoke, CSRF threat-model guide page, dev customElements polyfill shared with the build banner. Refs #539-#573 (fix evidence posted per issue).
…tion precision - contact.tsx drops the redundant customElements.define (the generated server registers route defaults): the call fails typecheck against packed npm types (OpenElement vs HTMLElement), breaking consumer:packaged. - hasEnhancedForms detection requires attribute shape (= or >) so prose mentioning data-open-enhance (e.g. the www guide) no longer pulls the enhancement layer — and the popstate reload listener now only fires after an actual enhanced navigation, keeping SPA-style client routing on the same bundle unaffected (www router-guard e2e).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| .map((route) => { | ||
| const params = route.paramNames.map((name) => JSON.stringify(name)).join(', '); | ||
| // '/' must be escaped or it would terminate the regex literal. | ||
| const pattern = routePatternToRegExpSource(route.path).replace(/\//g, '\\/'); |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
|
APIError: Insufficient Balance |
The fixture dist is not committed and the coverage/test gates run before any build gate, so the dev/build parity test failed in CI with 'fixture not built' while always passing locally. Build the fixture in the test when dist is missing (no-op when present).
Deploying openelement with
|
| Latest commit: |
e38976c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://9719ae80.lessjs.pages.dev |
| Branch Preview URL: | https://dev.lessjs.pages.dev |
Contributor
|
APIError: Insufficient Balance |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
0.42.0-alpha.5 — audit round 1 remediation (TP-5.5)
Target version / plan:
0.42.0-alpha.5underdocs/current/VERSION_PLAN.mdTP-5.5 (audit round 1 remediation), inserted between TP-5 and TP-6 by the first implementation audit of the 0.42 WC Application Loop.ADRs added/changed: ADR-0121 (PROPOSED,
docs/adr/ADR-0121-0-42-action-protocol-hardening-amendment.md) — 12 protocol-visible decisions from the audit (header negotiation, Response-return policy, redirect algebra, PRG target, fetch-channel symmetry, no-cache, POST error parity, region semantics, morph architecture + identity, popstate,open:action-failure, CSRF threat model). ADR index updated.Version-plan tasks completed: all of TP-5.5 — the 35 audit issues (#539–#573) are fixed with code + test/gate evidence posted per issue (issues intentionally left open for maintainer review).
Headline: the alpha.3 morph enhancement never fired (
submitis not composed; page content lives in page-element DSD) — the client is rewritten around shadow-root interception and shadow-content morphing. Errata appended to the alpha.3/alpha.4 release notes.Local commands run:
deno task autoflow:ci— full suite green (unit 971; fixture e2e 42 × 3 engines = 126; www e2e; consumer local+packaged; third-party WC smoke; package artifacts)deno task nitro:proof:node/nitro:proof:workers— greendeno task pack:dry-run— five0.42.0-alpha.5tarballs (publish dry-run)deno task docs:truth,workflow:check,interface:snapshot(re-baselined: only the fourSpa*type exports),check:static-output-freeze --self-check(422 files byte-identical), lint/formatCI status: dev CI pending on this PR's HEAD (link follows in checks).
Release-document impact:
docs/release/v0.42.0-alpha.5.mdadded; CHANGELOG entry added; errata appended tov0.42.0-alpha.3.md/v0.42.0-alpha.4.md;PACKAGE_SURFACE.md0.42 section completed;MORPH_CONTRACT.mdadded; www roadmap current entry rewritten;docs/integrations/validation.mdnow names the CI gate.