Hardening: versioned ledger hash, flow graph API, error handling#103
Merged
Conversation
…ocesso) Adiciona docs/melhorias.md: 36 achados verificados (arquivo:linha) com severidade P0-P2, esforço estimado e roadmap em 3 fases, cobrindo: - Backend: canonicalJson arredondando números em fronteira de hashing/ assinatura, parser XML O(n²), duplicação soundness×simulation, validação de fronteira JSON, round-trip multi-processo, lacunas de teste (DMN) - Frontend: clipboard/duplicate/select-all ausentes, canvas sem navegação por teclado, hit-testing O(N) por frame, i18n vazando no canvas, barrel export, workers fora do hot path, theming manual - Processo: escopo obsoleto no release.yml, changesets, TypeDoc parcial, drift no catálogo de dados, ESLint abaixo do rigor declarado Linka o documento na seção Documentation do README. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uvc7SeMVpKAxY4tQsqeHgT
…melhorias Bloco A) - MiniXmlParser: lazy line computation — parsing was O(n²) on large BPMN - canonicalJsonExact + versioned ledger hash recipe (v2: exact JSON of the whole entry; v1 chains keep verifying; identity/attest/assurance switch to exact bytes — signature bytes unchanged for string-only payloads) - flow classification hoisted to core (model/flow.ts); soundness/simulation import it instead of duplicating - JsonSerializer.deserialize validates node/edge/version shapes (CLI boundary) - BpmnXmlConverter warns when extra <process> elements are dropped - escapeXmlAttribute escapes TAB/CR for exact round-trips - diff fieldChanges compares primitives without JSON serialization - error taxonomy: SimulationError/AdapterError/DMN/CLI/attest onto BpmnError (agentflow/library/recipeAdapter stay dependency-free by design) - VersionRegistry: per-lane publication index (publish/timeline/publicationAt) - CLI valueOf: rejects flag-as-value, supports --flag=value - react: per-diagram activeNodes/activeEdges cache for per-frame hot paths - new DMN round-trip suite (quotes/empty cells/byte-stability/DMNDI/XXE) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uvc7SeMVpKAxY4tQsqeHgT
…d (melhorias Bloco B) - clipboard/duplicate/select-all: Ctrl+C/X/V/D/A + context-menu copy/ duplicate/paste-here; id remap (endpoints, containment, boundary hosts, lane refs), atomic composite undo, navigator.clipboard with internal fallback (gestures/clipboard.ts) - roving keyboard focus on the canvas: tabIndex 0/-1 on element <g>s, arrows browse (spatial order), Enter selects, focus ring CSS; canvas svg is the Tab entry point (editor only — viewer equivalence preserved) - axe gate upgraded: fails on serious AND critical (was critical-only) - i18n canvas surfaces: new canvas.* fragment (EN/PT-BR) for node/port/ resize arias, FECHADO seal, no-route title, recovery banner; files added to the no-hardcoded-strings guard (fixes mixed EN/PT leakage) - ConnectedNode/ConnectedEdge consolidated to one flattened selector each (was 7+/6 store subscriptions per element per frame) - rule engine evaluated only on hover-target change during connect - subpath exports ./simulation ./replay ./agent ./copilot (mirror ./viewer) - manual dark theme counterparts for the remaining DMN CSS blocks - hit-testing extracted to pure canvas/hitTest.ts (testable without canvas) - example package: first unit tests; deterministic SVG markup snapshot - nudge follows editor convention: arrow = 1px, Shift = grid step - e2e title assertions updated for the now-translated PT_BR canvas Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uvc7SeMVpKAxY4tQsqeHgT
…, CI matrix (melhorias Bloco C) - adopt @changesets/cli (access public, private apps ignored); scripts changeset/version-packages; release.yml fails on unconsumed changesets; CONTRIBUTING gains a Releasing section and the real publishable-package policy (~21 packages, not the stale list of 5) - release.yml: correct npm scope in the checklist (@Buildtovalue, not the pre-rename @bpmn-react) - TypeDoc: entryPoints for all 23 publishable packages (+ react subpaths) via a shared tsconfig.typedoc.json; docs/api regenerated — 23 packages now have an API reference (was react-only) - ESLint: no-explicit-any back on (4 generic seams carry justified disables), react-hooks rules-of-hooks/exhaustive-deps wired, lint glob widened to tests/, e2e/ and scripts/ (fixes found by the wider net) - CI: Node 20+22 matrix; lcov uploaded as artifact - prettier removed: declared but never configured/enforced; adopting it now would reformat 134-267 files (decision recorded in docs/melhorias.md) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uvc7SeMVpKAxY4tQsqeHgT
…ado (melhorias Bloco D) - docs/README.md: índice único (guias EN, referência, processo PT-BR, handoffs históricos) + convenção de idioma declarada; README raiz linka o índice e os docs antes órfãos (uml/, documentação/, api/, assurance, CONFORMANCE); architecture.md referencia as visões C4/4+1 - pendencias.md dividido: só pendências realmente abertas ficam (9 seções); o histórico de decisões fechadas (handoffs 3-14) foi extraído para DECISIONS.md, que também registra as decisões desta rodada (hash v2, prettier removido, worker routing adiado, regras compiler do react-hooks) - docs/documentação/ sincronizado com o código: contagens com drift corrigidas e números absolutos frágeis removidos (o número vivo é o find); novas entradas (core/model/flow.ts, canvas/activeCache.ts, canvas/ hitTest.ts, gestures/clipboard.ts, fragment canvas.ts, barrels de subpath) e anotações Δ 2026-07 nas entradas cujos dados mudaram (hashVersion, canonicalJsonExact, focusedElementId, ClipboardPayload, índice de lanes, validação do serializer) - docs/melhorias.md ganha a seção de status: o que foi implementado, o que foi adiado com registro e as exceções arquiteturais Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uvc7SeMVpKAxY4tQsqeHgT
danzeroum
pushed a commit
that referenced
this pull request
Jul 15, 2026
Tabela painel a painel (1a-1g) com ✅/⚠/⬜ e evidência (teste/arquivo:linha) para cada item das checklists da spec: - 1a context pad: núcleo ✅ (composto atômico, empurra em colisão); ⬜ slot de plugin/⋯, Tab-cria-conectado, touch 44px, teste de precedência; ⚠ geometria 14px/72px vs 8px/+140 da spec (proposta: adotar) - 1b guias: snap centro+borda ✅; ⚠ 6px vs ±4px (proposta: adotar), filtro por viewport; ⬜ badges de distância igual, spy-test - 1c busca: overlay/Esc/cicla/drill ✅; ⬜ props/refs, lista de resultados, pulso de halo - 1d lint: motor headless ✅; toda a superfície (dock, fix(ctx)→command, corrigir todos, ✦ C5, adapter de política) é U-5 - 1e layout: motor determinístico ✅; ⚠ CENTRAL: aplica direto (cerca §1.7 exige proposta aplicar/recusar — U-6); ⚠ rotas 📍 não transladadas - 1f execução: regras EXEC ✅, adiamentos confirmados; aba/deploy gated ⬜ - 1g matriz: gerada anti-drift ✅; colunas de terceiros e site ⬜ Nenhuma divergência propõe 'manter'; dois pontos pedem decisão (Esc do pad, alocação do 1g). pendencias.md §2.2 registra o estado 'aguardando validação'. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uvc7SeMVpKAxY4tQsqeHgT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR hardens the core library with three major improvements: a versioned ledger entry hash algorithm (v2 using SHA-256 of canonical JSON), a new flow graph API for structural analysis, and consistent error handling across adapters. It also reorganizes API documentation into per-package modules and adds comprehensive test coverage for new features.
Key Changes
Core Ledger & Hash
computeEntryHashnow dispatches byAuditEntry.hashVersion; new entries use v2 (SHA-256 ofcanonicalJsonExact), existing entries verify via v1 for backward compatibilitycanonicalJsonExactfunction: Deterministic JSON serialization without numeric rounding, replacing the ambiguousjoin('|')preimageflow.tsmodule: ExportsflowEdges()for structural graph analysis (reachability, SCC detection) used by soundness rules and simulationAdapter & Error Handling
AdapterErrorclass: New error type inadapters-bpmn/src/errors.tsfor adapter lookup/mapping failuresAdapterErrorfor unknown artifacts or bad referencesBpmnParseError,BpmnValidationError,BpmnAuditErrornow imported where needed (DMN converter, Copilot plan, audit attestation)React & UI
gestures/clipboard.tsfor Ctrl+C/X/V operationsactiveCache.tsandhitTest.tsmodules for rendering performancereact/agent,react/copilot,react/replay,react/simulation,react/viewerfor tree-shakinguseKeyboardShortcuts, new snapshot testsDocumentation & Build
Tests & Validation
Notable Implementation Details
https://claude.ai/code/session_01Uvc7SeMVpKAxY4tQsqeHgT