reverse-engineering-anything/docs/specs/agent-environments/manifest-view/verification.md

# Verification

Verified base: 18aa9af2b2c26fd114113dd39528a91224801840 (fetched main).

Executed on the implementation worktree after `npm ci`, `npm run build` and
`npm run test:prepare`; every check below ran as written in this pass. The
built-group projects and the built-CLI checks ran against a `dist/` rebuilt
after the last source change.

- `npm run check:fast`: typecheck and lint passed (2 tasks successful).
- `npm run format` then `npm run format:check`: all 4028 matched files use the
  correct format.
- `npx knip`: ok (exit 0, no unused files, exports or dependencies reported).
- `npm run check:ci:tasks`: typecheck, lint:built (3730 files, 0 errors), format:check, knip,
  metadata:check, jscpd (3.35% duplicated lines over 3140 files and 2581
  clones, under the 3.5% gate) and the tech-debt marker scan passed (8 tasks,
  3 replayed from this worktree's cache).
- `npm run docs:check`: the six built documentation checks and the README
  consistency conformance test (5 tests) passed; no tracked generated file
  changed.
- `npx vitest run --project domain --project services` (full source group):
  312 files, 5412 tests passed, 3 pre-existing skips.
- `npx vitest run --project cli-boundary` (full project): 111 files; 659 tests passed, 2
  pre-existing skips, 8 failed in three files that drive no analysis-view
  command (`closedStdout`, `commandFinalizationCancellation`,
  `javascriptApplicationJsonOutput`). Re-run in isolation on this worktree the
  three WASM interrupt cases and the four JavaScript JSON-output cases passed
  and only `closedStdout` "stops quietly when the reader closes during streamed
  JSON" (`inspect-sqlite-database`) exited 1 instead of 141. The same three
  files run on a clean export of 18aa9af2 (`git archive`, fresh `npm ci`,
  `npm run build`, `npm run test:prepare`, nothing from this slice) reproduced
  exactly that one failure and passed the other 16, so none of the eight is
  attributable to this slice and none was changed here.
- `npx vitest run --project mcp-boundary` (full project): 153 files passed, 2
  pre-existing file skips; 901 tests passed, 7 pre-existing skips, no failures.
- `npx vitest run --project acceptance` (full project): 123 files passed, 1
  pre-existing file skip; 608 tests passed, 13 pre-existing skips, no failures.
- Built CLI end-to-end on the 28-record Grafana-shaped capture:
  `inspect-web-network-capture ... har --format json` then
  `inspect-analysis-view` with `environment-manifest`, with and without the
  three opt-in rules, and with `api-surface`, twice each. Without rules the 22
  tool templates plus the 3 primary-origin exclusions equal the 25 api-surface
  groups on that origin and every `path_template` equals its
  `api_surface_template`; with rules `/api/dashboards/uid/{uid}`,
  `/api/folders/{uid}` (observed values `fg1jo91e57e2ob` and `general`, records
  12 and 13), `/api/plugins/{plugin_id}/settings` and
  `/api/datasources/uid/{uid}/health` appear across 19 tools with 13 templated
  groups; `normalized_result` and `evidence_id` are identical across the two
  runs of each view; records carry only pointer keys; no recorded body or query
  value appears; three unknowns and `view_digest` are present; confidence is
  `inferred` with authority `historical-reference`.
- Built CLI on the same capture extended with `GET /api/teams/search` and
  `GET /api/teams/mine` (30 records), all three rules selected:
  `/api/teams/{numeric}` keeps observed value `1` only and `get_teams_search`
  and `get_teams_mine` stay their own tools; 21 tools, 13 templated groups.

## Independent review

Findings repaired at their owning boundary:

1. A `__proto__` key in a recorded JSON body became a prototype rather than an
   own property, and the schema clone then dropped it silently. The manifest
   accumulator builds body shapes with `Object.fromEntries`, omits that key and
   states the omission as a limitation; a domain regression covers it.
2. The contract example carried a readonly tuple that the mutable JSON example
   type rejects; the example keeps a literal-typed mutable tuple.
3. Folding a literal sibling into an already templated position took the parts
   of the earliest group, so a literal recorded before the token kept its
   literal, dropped the parameter and claimed the token's record under a
   template it does not match. `mergeGroups` now takes the templated group as
   the shape for parts while the earliest group still names
   `api_surface_template`, `body_shape` and record order; a domain regression
   with the literal recorded first covers it.
4. The request-body parse accepted `text/plain` and `text/markdown` bodies; it
   accepts only `application/json` and `application/*+json`, and the capture
   guide states the earliest-record rule; a domain test covers both media
   types.
5. A repeated entry in `template_rules` was accepted, echoed and hashed into
   `view_digest` while the accumulator deduplicated it; the request schema
   refuses repeats with `template_rules must not repeat a rule`.
6. The sibling-variance fold-in absorbed a non-conforming literal into a
   parameter produced by one of the four format rules, so `/api/teams/mine`
   became an observed value of `/api/teams/{numeric}` and the published rule no
   longer described every observed value. Fold-in is restricted to parameters
   produced by the opt-in rules; literal siblings of a format-rule parameter
   stay their own tools or merge among themselves under `sibling-variance`
   only when identifier-like. A domain test with `/api/teams/1`,
   `/api/teams/2`, `/api/teams/search` and `/api/teams/mine`, the capture
   guide and the spec state the rule; the built-CLI check above exercises it.

## Hosted lane

- `real-web-network-captures` (hosted ubuntu-24.04, workflow run
  https://github.com/earakely-scale/rea/actions/runs/39097105064 on the fork
  at 2d95597f) passed with the manifest block of
  `scripts/verify-web-network-captures.mjs` executed against the lane's
  producer and mitmproxy captures. The first run at 61d35369 failed only in
  that block: the refusal check stringified the whole MCP result, so the
  declared `[` literal matched the result envelope; the follow-up compares the
  parsed refusal as the api-surface branch does.

## Scope and measurement limits

macOS `/usr/bin/time -l`, command accounting only: `npm run check:fast`
reported 5.23 seconds elapsed, 24.20 user and 2.92 system seconds, and
4449140736 bytes maximum RSS; `npm run format` 0.74 seconds elapsed, 4.14
user and 0.73 system seconds, and 223363072 bytes maximum RSS;
`npm run format:check` 0.66 seconds elapsed, 4.03 user and 0.61 system
seconds, and 218759168 bytes maximum RSS; the full source group reported
25.10 seconds elapsed, 67.26 user and 2.72 system seconds, and 2659172352
bytes maximum RSS; `npx knip` 3.68 seconds elapsed, 5.24 user and 0.70 system
seconds, and 865599488 bytes maximum RSS; `npm run check:ci:tasks` 4.65
seconds elapsed, 15.03 user and 4.36 system seconds, and 843333632 bytes
maximum RSS; `npm run docs:check` 3.61 seconds elapsed, 3.81 user and 0.99
system seconds, and 289472512 bytes maximum RSS; the full `cli-boundary`
project 425.66 seconds elapsed, 703.52 user and 206.77 system seconds, and
630456320 bytes maximum RSS; the full `mcp-boundary` project 164.19 seconds
elapsed, 302.85 user and 47.08 system seconds, and 4457529344 bytes maximum
RSS; the full `acceptance` project 960.25 seconds elapsed, 1520.91 user and
520.68 system seconds, and 800063488 bytes maximum RSS. `npx knip` ran while
the `cli-boundary` project was executing, and the clean 18aa9af2 export's
`npm ci`, build and test preparation overlapped the `mcp-boundary` and
`acceptance` runs, so those elapsed figures include host contention. Token usage and full process-family peak are
unmeasured. Local real-tool verification ran on macOS arm64; the hosted Linux lane result is recorded above.

## Automated review findings on the PR (2026-10-18)

Codex and Greptile left seven inline findings on morluto/rea#4954 at
b6d18d23; each was checked against the code and addressed in one follow-up
commit, with a regression test where the behaviour is observable:

- Body shapes walked nested values (both reviewers, P1): `#bodyShape` passed
  the text to `inferJsonShape`, whose per-node path copies grow with the square
  of depth, so a small deeply nested body could exceed the budget it had
  reserved. The reader now parses once and reads top-level key types from the
  parsed object; a test feeds a 2,500-level nested body and gets the four
  top-level types back.
- Literal route parts were not admitted (Codex, P2): a path of many short
  literal segments materialized one part object per segment without a charge.
  Every route part is now charged before the group is created; a test shows a
  5,000-segment path refused under a 1 MiB budget while a 100-segment path is
  retained.
- `sibling-variance` rebuilt a key over the whole route at every position
  (Greptile, P1): routes longer than 32 segments are no longer compared, the
  manifest states it in a limitation, and a test shows two 39-segment siblings
  left unmerged beside a merged short pair.
- `after-uid-literal` templated stop words (Greptile, P1): the rule now skips
  them; a test keeps `/api/items/uid/search` literal beside
  `/api/items/uid/{uid}`.
- Tool-name suffixes restarted at 2 on every collision (Greptile, P2): the
  registry keeps the next suffix per base; a test projects 300 dotted literals
  into `get_item` and `get_item_2` through `get_item_300`.
- An exclusion row could lose its templated flag when two groups printed the
  same row (Codex, P2): the flag is now the logical or of both. The scenario
  needs a literal segment spelled `{numeric}`, which the WHATWG URL parser
  percent-encodes in recorded paths, so no capture reaches it; the one-line
  defence is kept without a test.

Checks after the change: `oxfmt --check .` clean; `tsc --noEmit` clean;
`npm run lint` and `verify:module-boundaries` clean (the complexity warnings
on `#append` predate the change); `npx knip` no findings; `npm run jscpd`
3.35 % duplicated lines; `scan:todos` none; `verify:test-discovery` 1,580
files once; `vitest run` over the view, accumulator, JSON-shape and contract
example tests 32 passed in 4 files; `vitest run` over the service, CLI and
MCP boundary tests for analysis views 73 passed in 3 files.

A sixth automated finding (Codex) was addressed after the collaborator's
merge of main: `sibling-variance` merged a whole bucket when any one literal
carried a digit, so `/api/items/mine` could be folded into `{item_id}`. The
rule now partitions the bucket and merges only the identifier-like siblings
(each with a digit or colon, or three or more hyphenated names under a plural
literal), leaving the other literals as their own tools; with the rule alone
the fixture therefore keeps `/api/folders/general` and
`/api/folders/fg1jo91e57e2ob` separate, while all three rules still fold
`general` into `/api/folders/{uid}` through the opaque-token parameter. Tests:
the new partition case and the updated single-rule table.

Follow-up mixed-cohort regressions reproduced two omissions on `dd87f54e`
with main `8307ea37`: two coded siblings prevented three qualifying hyphenated
siblings from joining the parameter, and one coded sibling was omitted when
three hyphenated siblings merged. Eligibility now belongs to one Set that
combines both qualifying cohorts before the minimum group size is checked.
The consumer reuses that Set and materializes its merge order once. Three
cases cover both omissions and preserve the three-hyphen minimum when only
two hyphenated siblings accompany coded identifiers; `mine` and `search`
remain literal and every source record remains represented.