feat(core): widen retained boundaries to plain data and standard built-ins#3047
Draft
NathanColosimo wants to merge 1 commit into
Draft
feat(core): widen retained boundaries to plain data and standard built-ins#3047NathanColosimo wants to merge 1 commit into
NathanColosimo wants to merge 1 commit into
Conversation
…t-ins Replace the primitives-only retention gate with the retained-input walker: descriptor-only inspection (getters/proxies never fire) accepts plain objects and arrays (own enumerable string-keyed data properties), and workflow-realm Map/Set/Date/typed arrays/ArrayBuffer whose frozen prototypes guarantee serialization executes nothing workflow-planted. Host dispatch points that cannot be frozen (shared constructors, inherited serializer statics, BigInt.prototype.toString) are verified per boundary via own-descriptor reads; the checker itself runs exclusively on module-load-captured primordials. An instrumentation test locks the serializer's measured prototype touch-surface so serde drift fails CI loudly.
🦋 Changeset detectedLatest commit: 6590434 The changes in this PR will be included in the next version bump. This PR includes changesets to release 16 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Contributor
🧪 E2E Test Results✅ All tests passed Summary
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ 📋 Other
✅ vercel-multi-region
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Third of the 3-PR stack from #2990 — replaces #3046's primitives-only retention gate with the retained-input walker, so real-world step arguments keep the fast path:
Map/Set/Date/typed arrays/ArrayBuffer(their prototypes are frozen by feat(core): deterministic sandbox hardening #3045, so serialization can execute nothing workflow-planted — includingconstructorreads)RegExp/DataView/SAB, host-realm built-in instances, subclassed collectionsstructuredCloneresults, exposed classes) — ~40 own-descriptor reads per retained batch verify no plantedSymbol.hasInstance, serializer statics (incl. inherited via hostFunction.prototype/Object.prototype), orBigInt.prototype.toStringWhy this is safe (one invariant)
Step-argument serialization runs once (at suspension) and never re-runs during replay, so its only hazard is executing workflow code whose side effects live on in the retained VM. Bytes cannot differ by mode — there is a single serialization path shared by all modes. The walker + freeze + host verification together prove the no-code property; anything unprovable serializes identically and demotes.
Known residual (deliberate, documented): generic host-realm escape (replacing shared host statics via constructor chains) breaks the whole process for every mode and is tracked by the realm-local-intrinsics follow-up.
Review focus
Pure policy — every line answers "does serializing this value execute workflow code?". The state machine and loop integration were reviewed in #3046; the sandbox semantics in #3045.
Validation
Full core suite green in both modes: 74 files, 1,556 passed, 3 expected failures each. Walker tests cover accept/decline matrices, non-invocation guarantees (getters/proxies/serializers never fire during checking), freeze semantics, host-spoof demotion, and the instrumentation coverage test.
Stack: #3045 → #3046 → this. #2990 stays open as the reference implementation.