Release and conformance contract

Retain referenced native browser receipts, 2026-10-02

Commit f03f4cc corrects the CI artifact paths. Inspection of the successful run at 0b533e8 found eight referenced receipts missing from its downloaded artifact: production script timing, header rules, redirect rules and response-body results for Chromium and Firefox. Their tests and the executed-evidence gate passed, but the original payloads were not retained.

The upload now matches production JSON/screenshots in both browser directories and native trust JSON, alongside the existing persistence and development paths. A direct check against docs/contracts/api-coverage.json confirms that all 26 referenced receipt paths match. The correction changes no SDK code, fixture or acceptance gate.

for each browser receipt referenced by the inventory:
  require at least one CI artifact path to match its workspace-relative file

Definition of Ready for this slice

Missing payloads confirmed against the downloaded successful CI artifact, rather than inferred from source globs alone.
Every required receipt comes from the existing executed inventory; no new evidence category or test bypass is introduced.

Definition of Done for this slice

All 26 referenced native receipt paths match the corrected upload paths.
Workflow formatting and diff checks pass; scoped strict tooling checks already pass.
CI for the corrected upload passes at f03f4cc. Its downloaded artifact retains all 26 referenced payloads; every reference was independently checked against its actual JSON. All five Firefox encoding/framing observations also match between the retained production/development receipts.

Release-age exception cleanup, 2026-10-02

Commit 0b533e8 removes the four temporary exact-version minimumReleaseAgeExclude entries. The registry reports all four releases as more than 388 hours old; their documented seven-day thresholds expired on September 23. Dependency versions, the 10,080-minute minimum age, trustPolicy: no-downgrade, existing patches and build permissions stay unchanged.

The native adapter consumer copies the actual workspace installation policy into a clean temporary project. Its real package installation, strict Bundler/NodeNext consumers, native host composition and browser RPC therefore verify the policy removal against the maintained package graph. No runtime or public contract changed.

minimumReleaseAge: 10080
trustPolicy: no-downgrade
# No release-age exclusions.

Definition of Ready for this slice

Registry publication dates verified for the exact four releases.
Their expiry requirement is already documented in docs/TOOLING.md.
Verification uses the actual policy and packed native adapters without relaxing dependency trust or changing pins.

Definition of Done for this slice

All four expired exclusions removed; recorded dates remain in the tooling document as context.
pnpm's automatic lockfile supply-chain check passes for all 656 entries with no exclusions.
pnpm artifacts:native passes its isolated clean installation, strict TypeScript consumers, native host and browser RPC checks.
pnpm run tooling:lint, pnpm run tooling:typecheck and formatting of the two changed files pass.
Full CI for this head passes. This narrow cleanup does not close release or full conformance acceptance.

Current combined CI evidence

Attempt 1 of the preceding combined run passed full workspace checks, Chromium production and opt-in persistence. Chromium natural idle completed its state/lifecycle assertions, then Page.captureScreenshot timed out. The unchanged maintained idle scenario passes locally on Chromium 153.0.8010.12 with no attached worker sessions or page errors. No screenshot or runtime behavior has been changed; the cause is not yet established. Attempt 2 was cancelled by the subsequent main push. The completed run above establishes all maintained native gates, including the new Firefox quota check with passed: true and immediateReliefPassed: false.

Native publisher module identity, 2026-10-02

Commit 8916018 uses Vite's native resolve.dedupe: ['@devframes/json-render'] in the production and WXT hosts. Vitest applies the same resolution and inlines the native publication dependencies. This preserves one native publisher/index owner when pnpm resolves the identical pinned release through separate peer contexts. It adds no SDK index, renderer, RPC or lifecycle mechanism.

Both Chromium and Firefox startup failures, plus the unit fixture's missing native view index, reproduced from unchanged 944501a source using the same installed dependencies. Candidate deduplication restores the original counter view. Diagnosis and removal boundary.

Definition of Ready for this slice

Native module ownership and exact duplicated peer contexts inspected.
Startup failure reproduced on unchanged source before installing the response-body recipe.
Native Vite resolution supplies the correction without replacing upstream factories.

Definition of Done for this slice

Production bundle test asserts exactly one native publisher module.
Existing unit publication/storage fixtures pass with native module identity preserved.
Strict affected-example lint and TypeScript 7 checks pass.
Both native production builds and all four production/development browser suites pass on Chromium 153.0.8010.12 and Firefox 157.0 with this correction.
Combined full CI passed at bcf4bf1, including this change, workspace gates, both production browsers, concurrent native development transitions and the exact API-evidence gate.

The preceding combined full CI passed at 944501a. An earlier renderer remount failure remains a separate native state-echo investigation; a passing rerun is not treated as its fix. This slice does not close release or full conformance acceptance.

Native build test timeout, 2026-10-02

The CI diagnosis and minimal correction reproduce a 5-second real-build timeout and the resulting assertion spillover into the next row. The two build-test groups now use an explicit 30-second budget. All 24 extension package tests, lint, types and formatting pass. The delayed-build replay passes as well. Full CI passed for f11b7153badd4ad19be5b6786371f89ac98503d1, including workspace validation, all maintained native browser suites, concurrent development transitions and the final API-evidence gate; release and full conformance remain open.

Part of Design a portable contribution SDK and WebExtension runtime.

Upstream integration boundary, 2026-09-27

Upstream owns its RPC codec/protocol and JSON renderer model. Version SDK public contracts and any concrete additional metadata deliberately, rather than maintaining independent copies of native format versions. On upgrades run affected public-export/type/runtime/packed-consumer checks, and remove exact-version patches once the unpatched release passes their guards.

See the implementation and map review. This narrows implementation mechanisms without dropping the accepted feature or real-host coverage requirements.

Question

What evidence must exist before a version of the framework can claim support for its public SDK, host adapters, renderers, browser targets, and live development workflows?

Resolve compatibility policy, versioned conformance evidence, publication checks, and release-blocking failures. The result is a concrete release contract that implementation work can satisfy later.

Context and current behavior

The framework will live in the devkit-extension pnpm/Turbo monorepo and publish modular build-time npm packages. Consumers may use the shared contribution API through Devframe, Devtools, Chrome extension, or Firefox extension hosts. They may replace the JSON renderer and optionally enable a real CDB integration.

Planning has identified capabilities without implementing or certifying them. Tests must establish that extensions load, routing selects the correct provider, and scripts run at the promised timing. Development previews and packaged extensions require separate evidence.

Every piece needs a runnable example. Every public SDK API, hook, and feature needs supported-host and unsupported/failure-path tests. Examples and API coverage contract owns the versioned API-to-example-to-test-to-host matrix. This ticket defines release checks against it.

Requirements and scope

Version the SDK public API, contribution/capability contracts, any concrete SDK-only metadata and the compatibility matrix deliberately. Reuse upstream RPC serialization and renderer contracts without inventing independent replacements or format versions.
State the tested host, browser, dependency, and build-mode versions for each release. Compatibility must distinguish verified combinations from unsupported or unverified combinations.
Require working examples for contribution compositions, renderer implementations, Devframe and Devtools hosts, Chrome and Firefox extension hosts, and the enabled optional CDB integration.
Verify supported behavior and the documented response to unsupported capabilities, permission failures, disconnection, cancellation, malformed input, teardown, and recovery wherever those paths apply.
Validate packed artifacts and clean installs so workspace aliases or source-only imports cannot hide missing package files.
Require the foundation migration to strict Oxlint and Oxfmt before admitting production SDK packages and maintained examples. Replace ESLint, Stylelint and Prettier direct dependencies, active configuration, scripts, staged-file hooks and CI invocations. Commit shared configurations, fail on warnings/formatting differences and verify supported type-aware linting alongside independent TypeScript checks. Preserve narrowly justified exceptions and audit active callers; default-rule feasibility probes do not count as migration evidence.
Use Vite/Oxc tooling selected by Toolchain and reload audit. Evaluate TypeScript 7 against the actual supported build, lint, type-check and package-consumption workflows rather than declaring compatibility from the package version alone.
Keep local checks package-scoped. Full-repository validation belongs in CI unless the user explicitly authorizes a bounded local exception.

Options and recommendation

A coverage percentage can pass while an exported hook fails in a browser. Manual checklists drift as exports change. Example tests prove integration but need complementary invalid-input and lifecycle tests.

Recommend a versioned matrix reconciled against public exports and capability declarations, plus layered automated checks. Each public item must point to its runnable example, behavioral tests, supported hosts, and expected unsupported outcomes. A release fails if an item lacks required evidence, if a supported combination is skipped, or if an example cannot run from the published artifacts.

Adopt a documented compatibility policy for SDK-owned changes and tested upstream dependency versions. Incompatible peers should produce an actionable version-mismatch outcome before executing work. Decide the supported version range from the prototype and toolchain evidence; do not invent a broad range in advance. Keep optional adapters separately identifiable so missing CDB dependencies do not misreport a working default installation as broken.

Proposed API or experiment

The matrix shape below is illustrative. Its final schema belongs to Examples and API coverage contract:

const conformanceEntry = {
  publicItem: 'operations.invoke',
  contractVersion: 1,
  examples: ['examples/provider-routing'],
  tests: ['routing.behavior', 'routing.chrome', 'routing.firefox'],
  hosts: {
    devframe: 'supported',
    devtools: 'supported',
    chrome: 'supported',
    firefox: 'supported',
  },
  requiredFailures: ['unavailable-provider', 'disconnected-provider'],
};

Prototype a check for missing public items, dangling examples, missing test references, and unverified supported hosts. Run examples from packed release candidates installed in a clean fixture. Record browser and adapter versions.

Use focused unit and type-contract tests for API semantics, adapter integration tests for transport and lifecycle behavior, and real Chrome plus Firefox tests for extension execution. Smoke-test the installed JSON renderer and a replacement renderer. Exercise both the development HMR workflow and watch-build/live-preview workflow, using the selected retention expectations.

Tests must use exact expect.assertions counts where Vitest assertions are present. Mock real module or I/O boundaries instead of adding production parameters only for tests. Accept and investigate meaningful coverage gaps; do not insert ignore pragmas to make a number pass. A supported public API still requires behavioral evidence even when a coverage report looks healthy.

Scenarios and acceptance criteria

Adding a public SDK export without a matrix entry blocks release, including hooks and extension-only features.
Marking Firefox support while skipping its required integration test blocks release. An explicit unsupported result remains a testable contract rather than a silent skip.
A packaged contribution, renderer, and each host example work after clean installation, without private workspace source paths.
Native protocol or SDK contract mismatch, optional CDB absence, permission denial, and worker/provider restart produce the documented outcomes.
The enabled CDB profile runs against the real integration and records its version and behavior.
Dependency upgrades rerun affected host evidence and type-contract checks. The report identifies the tested range instead of assuming all later versions work.
Narrow local configured Oxlint, Oxfmt check, type checks, and relevant tests pass; CI supplies complete repository and host-matrix evidence. A known lint violation/warning or formatting difference must fail its check. Legacy source-linter/formatter invocations must not remain active.
The migration audit distinguishes active legacy tooling from unrelated transitive names and valid Oxlint eslint/... rule identifiers; it does not claim formatting replaces every semantic CSS check.

Dependencies

Portable contribution proof supplies real behavior across the selected hosts. Toolchain and reload audit supplies verified tooling, dependency, browser, and reload constraints. Examples and API coverage contract supplies the canonical inventory and evidence schema. All three block the final release policy because an untested assumption cannot define an honest support claim.

Definition of Ready

Every patch or compatibility shim names the upstream/public API gap, covered behavior and removal condition; tested versions and publication consequences are explicit.
The prototype provides reproducible results and known failures.
The toolchain audit names verified versions and unresolved compatibility limits.
The matrix can enumerate public items, examples, tests, hosts, and failure expectations.

Definition of Done

Upgrade evidence includes affected native host and extension transport/renderer tests. Published packages do not silently rely on workspace pnpm patches; no separate codec/renderer protocol is created to satisfy this gate.
The resolution fixes release gates, support labels, compatibility behavior, and evidence retention.
Every gate has a concrete check and a named failure outcome.
Real-browser, packed-artifact, optional-adapter, and reload checks are included.
Implementation tasks inherit the complete gates without claiming they already pass.
Strict Oxlint and Oxfmt migration has explicit dependency/configuration/script/hook/CI removal checks, demonstrated failing enforcement checks and maintained-example coverage. Actual migration remains an implementation gate, not a claim made by closing this policy ticket.
The human has confirmed the resolution through discussion; the agent has not supplied the human side of the decision.

Resolution record

Pending. Record the release contract and required evidence. This decision closes when policy is complete; release remains blocked until implementation and conformance checks pass.

Upstream reuse audit resolution adopts exact released artifacts and public exports as the baseline: Devframe family 1.0.0, DevTools/kit 0.7.5, CDB 0.3.0. All thirteen baseline tarballs matched registry SHA-512 values; all 150 declared export targets existed. Complete equivalence to upstream source commits is unproved and not assumed.

Acceptance: pin versions and integrity, enforce peer compatibility and public-entry use, and gate upgrades on affected real-host tests plus the complete inventory from Examples and API coverage contract. Track source-only patches explicitly. CDB's Devframe adapter pins 1.0.0; JSON-render's wrapper requires core ^0.20.0, so independently adopting upstream 0.21.0 needs compatibility evidence. Require stronger source-build provenance only for a concrete release policy. CDB adapter metadata, JSON-render metadata.

Research handoff and acceptance gates

Sources: Toolchain and reload audit.

Accountable owner: dvcol, until reassigned. These observations inform this open contract; they do not resolve it.

The strict portable TS7 pipeline and standalone packed root ESM/types consumer passed. The final tarball includes declaration-map source targets. Other public export conditions remain untested. Node 26.9.0 was the measured environment; an LTS baseline remains a release decision.

WXT compatibility is a required adoption gate before the portable proof: a minimal import of Browser from wxt/browser with full library checking duplicates HARFormatEntry/HARFormatLog when Chrome ambient types are present; removing them leaves unresolved chrome references. Pinned inputs are WXT 0.21.4, @wxt-dev/browser 0.3.0, @types/chrome 0.3.0 and TypeScript 7.0.2. The retained reproduction is independent of the full application fixture.

Acceptance additions:

Resolve this minimum with a supported pinned dependency/environment combination, or choose the custom Vite fallback. Do not waive it with blanket library-check suppression.
Install tarballs into independent consumers and verify every public export condition, declarations/maps and actual runtime dependency graph.
Admit stable-browser version advances only with dated real-host conformance results. Enforce the full public API/example/test/host matrix in CI while keeping local validation scoped.

Strict Oxlint and Oxfmt migration

Owner requirement recorded on 2026-09-23 for Release and conformance contract. Implement this during monorepo foundation work, before admitting production SDK packages and maintained examples. Release checks retain the same gates. This document records required work; the old scaffold has not been migrated yet.

The tools are Oxlint for lint rules and Oxfmt, package oxfmt, for formatting. Commit their configuration and enforce it in local package scripts, staged-file hooks and CI. The formatter uses explicit formatting settings and a failing --check gate, not an invented lint-style strict preset. Oxlint configuration, Oxfmt usage.

Existing integration points to replace

Current location	Required migration
Root `package.json` and lockfile	Replace ESLint, Stylelint, Prettier and their directly configured presets/plugins with current compatible pinned Oxlint/Oxfmt tooling; refresh resolved dependencies
`eslint.config.js`, `stylelint.config.js`, `prettier.config.js`	Remove legacy configuration after committing the new shared lint/format configuration and explicit ignore scope
`lint`, `lint:fix`, `style`, `style:fix` scripts	Use Oxlint check/fix and Oxfmt check/write commands; remove or deliberately replace obsolete script names and update their callers
`lint-staged.config.js` and `.husky` hooks	Invoke the same new tools against eligible changed files; remove legacy and stale framework commands
`.github/workflows/build.yml` and other workflows	Replace legacy version reporting and command invocations; fail CI on lint findings or formatting differences
Workspace/package/example scripts and editor settings	Resolve the committed shared configuration consistently; avoid a package silently falling back to default lint rules or another formatter

The current scaffold still lists @dvcol/eslint-config, @dvcol/stylelint-plugin-presets, @prettier/plugin-xml, eslint, eslint-plugin-format, eslint-plugin-vuejs-accessibility, prettier and stylelint. This inventory is a starting point; migration must inspect all active callers rather than delete a fixed name list and assume the work is complete.

Strict enforcement contract

Enable correctness, suspicious and pedantic lint categories as errors, then explicitly configure relevant TypeScript, import, promise, test and maintainability rules. Record narrowly justified exceptions; do not weaken whole packages merely to make migration pass.
Enable and verify supported type-aware linting against the selected TypeScript 7 pipeline. A compatibility failure is explicit adoption work, not permission to silently replace the configured check with default Oxlint.
Fail checks on warnings and formatting drift. Apply one reviewed Oxfmt configuration across source, configuration and supported documentation formats; distinguish intentional generated/vendor exclusions from maintained source.
Preserve the project's coding conventions, including descriptive identifiers, no IIFEs, exact Vitest assertion counts and no coverage-ignore patches. Identify what is enforced by rules and what still needs type checks or review; do not claim a rule covers behavior it cannot check.
Oxlint and Oxfmt have different responsibilities. Formatting CSS does not establish all former Stylelint semantic checks. When replacing the old frontend scaffold, remove obsolete rules; any relevant constraint for retained renderer/example assets must have an explicit supported check or documented review obligation.
Keep conventional-commit validation if still used. Commit-message linting is a separate responsibility from replacing source linters and the formatter.

Completion gates

Current compatible tool versions, actual CLI flags and TypeScript/type-aware integration are verified and pinned with the lockfile.
Shared Oxlint and Oxfmt configurations express the enforced rules/settings and justified exceptions.
Maintained packages, examples, scripts, hooks, editor settings and CI invoke those configurations; obsolete legacy invocations/configurations/direct dependencies are removed.
A scoped negative check proves a configured lint violation fails, a warning cannot pass, and formatter check rejects formatting drift. Type checks remain independently enforced.
All affected maintained files pass the new configured lint and formatting checks plus type checks. Local validation stays package-scoped; full repository checks run in CI.
A dependency/caller audit distinguishes legacy tools still actively invoked from unrelated transitive package names and Oxlint's valid eslint/... rule identifiers.
The implementation commit and CI evidence are linked from the owning ticket. Until then, migration remains incomplete.

The earlier core declaration fixtures used explicitly selected strict Oxlint categories. The server feasibility probes used default Oxlint and preserve exact executed evidence. Neither proves the monorepo migration or the eventual maintained-example lint preset. If a probe becomes a maintained example, migrate and rerun it under the shared configuration before counting it toward conformance.

Requirement record

The owner explicitly reiterated strict Oxlint and Oxfmt migration. This is a required foundation step, not a new unresolved tooling choice. Local commit 2461adc on dvcol/wayfinder/tooling-enforcement updates ARCHITECTURE.md and preserves this requirement in docs/planning/016-tooling-migration.md. The branch is not pushed. The map and this ticket now carry the enforcement/removal gates. The current template still uses the legacy tools; no implementation or lint/format conformance is claimed by this documentation update. Document links, fence structure and whitespace checks passed.

Foundation implementation

Local commit ebe167e replaces the old Vue application scaffold with the strict Oxc workspace required by this ticket. The implementation branch is dvcol/implementation/foundation; it is not pushed and no upstream PR has been opened.

Implemented:

pnpm workspace/Turbo task graph, TypeScript 7.0.2 with strict checking and skipLibCheck: false, Vite 8.3.0 builds, and current compatible exact dependency pins respecting the existing seven-day release-age policy.
Shared Oxlint 1.83.0 configuration with correctness, suspicious and pedantic rules as errors, type-aware rules through oxlint-tsgolint, warnings rejected, unused suppressions rejected, and explicit import/promise/test checks.
Shared Oxfmt 0.68.0 settings/check/write scripts, staged-file checks, editor settings and CI integration. Maintained canonical architecture/glossary documents use the new formatter; archived research source remains preserved with its recorded evidence.
Removal of ESLint/Stylelint/Prettier direct dependencies, configs, hook/CI/editor invocations and obsolete Vue application tooling. Commitlint still owns commit-message validation. Old deployment/publish workflows targeted the removed application and are removed; the eventual SDK release workflow remains this ticket's work.

docs/TOOLING.md records exact commands, narrow rule exceptions and review obligations. Deep-readonly parameter lint is the single production rule exception because upstream schema/native handles and intentionally owned mutable registries cannot be rewritten into deep-readonly types without changing contracts. Explicit declaration readonly types remain enforced. Test scenario length/assertion ceilings have specific exceptions; exact expect.assertions(N) remains mandatory.

Executed local proof

The root-tooling-only lint and TypeScript checks pass. scripts/check-enforcement.ts executes positive and negative fixtures and verifies that a lint error, a lint warning, an unhandled promise found through types, a TypeScript mismatch and formatting drift each fail for the intended reason. Oxfmt repairs the drift and the subsequent check passes. Active legacy caller/dependency audit finds no old linter invocations. Diff whitespace and scoped formatting checks pass.

pnpm tooling:lint
pnpm tooling:typecheck
pnpm tooling:test

This is actual foundation migration evidence. It does not close the release/conformance decision, certify the future host matrix, or claim CI has run. Core declarations and adapter ownership implementation are progressing in separate issue-5 commits. Packed-consumer verification is being added as a separate follow-up.

Packed consumer gate implemented

Follow-up local commit 76b09e4 adds pnpm artifacts:test and runs it in CI after builds. Reviewable source archive, SHA-256 aaaec5d63ce427ed4c85b57eeb062c4b29d4f72053b52cfdf42fba9a26ac3d4a.

The executable gate packs core/runtime, installs the actual tarballs in a temporary directory outside the workspace, and checks package contents and rewritten dependency versions. Both Bundler and NodeNext consumers compile under strict TypeScript 7 with skipLibCheck: false, including a negative inference fixture. Their emitted JavaScript exercises admission/release, guarded invocation, cancellation and cleanup. A Vite browser bundle rejects external imports and unexpected workspace/host/framework modules; the bundled scenario executes too. The core source map is checked for inlined code outside its own portable modules.

The final isolated run passed against the rebuilt committed packages. Root-tooling lint, type checks and scoped formatting also pass. Dependency installation uses pinned existing public dependencies with lifecycle scripts disabled. CI is configured but has not run for this local branch.

This extends the implemented foundation migration in ebe167e. It proves these package artifacts and this consumer scenario; real extension behavior, renderer behavior, full host conformance and release policy remain open. Separate issue-5 commit 5c3469b supplies the implemented declarations and ownership components exercised by this gate.

chore(issue-16): preserve archived research validation boundaries

fix(issue-16): lock pnpm bootstrap dependencies for CI

fix(issue-16): stabilize lint gate diagnostics in Actions

Published main history, cleanup and CI bootstrap corrections

All current implementation and research is now on main with a linear history. The original implementation commit IDs remain intact. Unique initial audits were consolidated separately for #2 (4514429), #3 (e1211be) and #4 (6963605); 208 archived source/evidence files were verified byte-for-byte before deleting their old worktrees. Current reports use Oxfmt. Archived evidence retains its recorded validation rather than being reformatted.

Seven clean task worktrees and all seven task-local branches were removed, plus the temporary remote implementation branch. Only the primary checkout, local main and remote main remain. No force-push or pull request was used.

The first full Actions run exposed a missing pnpm 12 package-manager lock document. afd083d adds the pinned manager/platform metadata without changing the ordinary workspace dependency graph. Strict frozen installation now succeeds without the local pmOnFail override that had hidden this check. The next run exposed an environment-sensitive warning assertion because Oxlint switches to GitHub annotation output in Actions. 0fbaf3e requests JSON for the enforcement probe and checks severity and rule identity. Both normal and GITHUB_ACTIONS=true executions pass; production lint rules remain unchanged.

Full CI passed on 0fbaf3e: builds, root enforcement negative controls, strict lint, TypeScript, Oxfmt, packed consumer checks and all current package/example tests.

Working examples and the complete browser/host conformance matrix remain separate acceptance obligations. This establishes the current workspace's CI result, not completion of every SDK feature.

test(packaging): verify native adapters outside workspace (#16)

Native adapter tarball gate implemented

Commit 110656a adds pnpm artifacts:native to the existing CI artifact gate.

The check packs core, runtime, client, devframe, server and webext, installs their tarballs outside the workspace, and verifies every exported artifact path. The installation explicitly copies the current exact-version patches and package extensions. This proves an explicitly patched consumer; it does not claim that pnpm patches propagate through npm packages or settle the release publication policy.

Both Bundler and NodeNext consumers pass strict TypeScript 7 with skipLibCheck: false. Negative checks retain numeric input inference and reject provider selection without a realm. Executed consumers exercise native RPC over an actual MessageChannel through the packed Port adapter, invoke and broadcast through the portable router, and initialize both genuine Devframe hub and DevTools kit contexts for dynamic plugin installation, invocation and disposal.

The Vite browser bundle rejects Node imports, retained external imports and module resolution outside the isolated installation. It must observe all six SDK packages through their installed dist entries. Running this bundle under Node's MessageChannel establishes artifact composition. The separately maintained Chromium and Firefox suites remain the real-browser evidence.

Local validation passed: affected server/webext dependency-graph builds, the isolated consumer through its new command, changed-script Oxlint, root-tooling TypeScript and changed-file Oxfmt. Full CI passed, including the artifact gate and both live Chromium and Firefox suites. No production contract, dependency version or patch changed in this commit.

The release contract remains open: exhaustive public-export/example/host inventory, remaining extension features and surfaces, HMR, optional debugger integration, and unpatched distribution compatibility are still acceptance obligations.

Observed Firefox 157.0 test compatibility gap

The local system Firefox updated to 157.0 while CI remains pinned to 156.0.1. During renderer coverage work, the full extension suite failed at the native sidebar fixture's selector sidebarswitcher_menu_devkit-native-port_example_invalid-sidebar-action, in tests/firefox-sidebar.ts:openSidebar. This happens after the options/popup/DevTools checks.

The same selector failure was reproduced with unchanged committed tests from ef43f0f, preserving their relative publisher/script-timing fixtures. It is not caused by the additional provider-view scenario. Focused view publication/state/action/removal/disconnect checks pass on 157.0. The full suite passes with checksum-verified official Firefox 156.0.1 and geckodriver 0.37.1. The implementation's full CI also passed on the pinned baseline.

Next implementation scope:

Inspect the actual Firefox 157 native sidebar menu and identify a stable interaction in the existing owned WebDriver fixture.
Keep extension/SDK code unchanged unless a separate native application defect is reproduced. Do not disable the sidebar scenario or add a fake sidebar page.
Run packaged and development sidebar lifecycle checks on the proposed browser baseline, then update CI pins and retained receipts together. The development fixture imports the same openSidebar helper.

Ready: the failing selector, unchanged-base reproduction and passing pinned comparison are known. Done: the native sidebar opens through an actual user gesture and passes open/close/reopen/state/action plus development transitions on the chosen baseline; CI pin, commands and exact-version evidence agree. Until then, do not claim full Firefox 157 conformance.

test(webext): validate native sidebar on Firefox 157 (#16)

Firefox 157 upgrade implemented in 517ac55.

The browser's redesigned sidebar removed the old extension menu and hidden close-button selectors. The maintained test now finds the real extension button in the native sidebar's shadow root and clicks it through WebDriver. There are no extension/runtime changes or preference overrides.

Verified locally on Firefox 157.0 / geckodriver 0.37.1:

test:firefox: 39 production scenario groups, including opening, closing, reopening and tab transitions in the actual sidebar.
test:dev:firefox: nine development scenario groups, including sidebar module HMR, HTML reload, background replacement, configuration restart to manifest 0.0.2 and final native browser shutdown.
Affected workspace lint/type checks, changed-file formatting and diff checks pass.

The commit updates CI to Firefox 157.0 and refreshes the maintained production/development receipts and screenshots. Full CI will verify the Linux browser baseline and remaining host suites. This closes the known local sidebar automation gap; it does not claim the complete release contract or host/mode matrix is finished.

Full CI passed for the Firefox 157 upgrade: Validate run. This includes production Chromium/Firefox extension tests, native JSON rendering/routing, permission prompts, debugger checks, and concurrent native development transitions. The release policy and complete conformance matrix remain open.

test(webext): allow native build time in bundle checks (#16)

The CI run for the Chromium restart proof failed before browser installation. Its real Chromium bundle build crossed Vitest's default 5-second test limit at 5,110 ms. The next Firefox row then reported 14 assertions instead of 7.

The two-row bundle test and its Vite config were unchanged from 1e64fb6, whose full CI passed. The new standalone Chromium restart script is outside Vitest's test-file pattern and did not run in the failing step. All four ordinary bundle tests pass locally.

A temporary controlled replay used the unchanged base test and delayed completion of its first real build. At the default budget, the first row timed out at 5,006 ms; releasing its pending result when the next row started reproduced that row's exact 14-versus-7 assertion failure. Vitest timing out a test does not stop the pending build promise. With the same delayed completion and a scoped 30-second budget, both rows passed, including the first at 6,391 ms. This isolates the timeout and assertion spillover; it does not establish why that particular CI build was slower.

f11b715 adds only the explicit 30-second budget to both real-build parameterized tests. Every original assertion, the package-wide default timeout, production code, test concurrency and failure behavior remain unchanged. No retry or error suppression was added. The temporary replay file was removed.

Validation: all 24 extension package tests, strict Oxlint, TypeScript and changed-file formatting pass. The maintained Chromium restart proof separately passed its seven scenarios. Full CI passed for f11b7153badd4ad19be5b6786371f89ac98503d1, including all maintained native browser suites, the new Chromium restart check, concurrent development transitions and the final executed API-evidence gate. Release/conformance remains open.

fix(webext): preserve native publisher module identity (#16)

Native publisher module identity, 2026-10-02

Commit 8916018 uses Vite's native resolve.dedupe: ['@devframes/json-render'] in the production and WXT hosts. Vitest applies the same resolution and inlines the native publication dependencies. This preserves one native publisher/index owner when pnpm resolves the identical pinned release through separate peer contexts. It adds no SDK index, renderer, RPC or lifecycle mechanism.

Both Chromium and Firefox startup failures, plus the unit fixture's missing native view index, reproduced from unchanged 944501a source using the same installed dependencies. Candidate deduplication restores the original counter view. Diagnosis and removal boundary.

Definition of Ready for this slice

Native module ownership and exact duplicated peer contexts inspected.
Startup failure reproduced on unchanged source before installing the response-body recipe.
Native Vite resolution supplies the correction without replacing upstream factories.

Definition of Done for this slice

Production bundle test asserts exactly one native publisher module.
Existing unit publication/storage fixtures pass with native module identity preserved.
Strict affected-example lint and TypeScript 7 checks pass.
Both native production builds and all four production/development browser suites pass on Chromium 153.0.8010.12 and Firefox 157.0 with this correction.
Full CI for this commit completes successfully after push.

The preceding combined full CI passed at 944501a. An earlier renderer remount failure remains a separate native state-echo investigation; a passing rerun is not treated as its fix. This slice does not close release or full conformance acceptance.

chore(tooling): remove expired release-age exceptions (#16)

ci: retain all referenced native browser receipts (#16)

Release and conformance contract #16

Description

Retain referenced native browser receipts, 2026-10-02

Definition of Ready for this slice

Definition of Done for this slice

Release-age exception cleanup, 2026-10-02

Definition of Ready for this slice

Definition of Done for this slice

Current combined CI evidence

Native publisher module identity, 2026-10-02

Definition of Ready for this slice

Definition of Done for this slice

Native build test timeout, 2026-10-02

Upstream integration boundary, 2026-09-27

Question

Context and current behavior

Requirements and scope

Options and recommendation

Proposed API or experiment

Scenarios and acceptance criteria

Dependencies

Definition of Ready

Definition of Done

Resolution record

Activity

dvcolomban commented on Sep 22, 2026

dvcolomban commented on Sep 22, 2026

Research handoff and acceptance gates

dvcolomban commented on Sep 23, 2026

Strict Oxlint and Oxfmt migration

Existing integration points to replace

Strict enforcement contract

Completion gates

Requirement record

dvcolomban commented on Sep 23, 2026

Foundation implementation

Executed local proof

dvcolomban commented on Sep 23, 2026

Packed consumer gate implemented

dvcolomban commented on Sep 23, 2026

Published main history, cleanup and CI bootstrap corrections

dvcolomban commented on Sep 29, 2026

Native adapter tarball gate implemented

dvcolomban commented on Sep 30, 2026

Observed Firefox 157.0 test compatibility gap

dvcolomban commented on Oct 1, 2026

dvcolomban commented on Oct 1, 2026

dvcolomban commented on Oct 1, 2026

dvcolomban commented on Oct 2, 2026

Native publisher module identity, 2026-10-02

Definition of Ready for this slice

Definition of Done for this slice

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions