feat(graph): harden React frontend extraction for agent workflows

[forhappy]

Summary

• Add typed, provenance-preserving React JSX render evidence plus component, hook, client/server, route, loader/action, provider/consumer, and framework-specific graph semantics.
• Add conservative Next.js, TanStack Router/Start, React Router/Remix, and Vite framework packs with package-scoped activation, deterministic identities, route stages, config/file-set facts, and fail-closed ambiguity handling.
• Harden project evidence for npm aliases, jsxImportSource, Vite alias declaration order, regex-alias diagnostics, multiple-config ambiguity, JSONC config closure, and nearest-package qualification projections.
• Extend graph/query/task-context/MCP/VS Code/viewer contracts for agent-facing frontend workflows.
• Add independent source-oracle matching, pinned-corpus qualification, bounded process/file handling, interruption/resume checks, frontend fixtures, and a versioned performance baseline.
• Preserve the grounded Agent Graph and native document/architecture work now merged from origin/main.
• Add package-gated Remix React runtime activation (remix/ui), exported-only client directive roles, and lazy-component render edges owned by the lazy binding.

Conflict update

• Merged current origin/main (including PR feat(agent-graph): prepare grounded ingestion material #285) into codex/react-frontend-agentic-graph-hardening.
• Resolved the grounded ingestion, document/OCR, architecture viewer, CLI/MCP, contract, and generated-asset conflicts without touching local out-of-scope roots.
• Pushed merge commit a02ddc13; GitHub now reports this PR as conflict-free (CLEAN).
• After the first CI run exposed that offline qualification had no parser bundle on hosted runners, added checksum-verified parser-source provisioning for both CI and release qualification and pushed ad4c2a08.
• The follow-up rerun verified provisioning, then exposed a missing Cargo cache for the deliberate offline build; added an explicit locked cargo fetch step and pushed 2a0571ea.
• The next hosted run compiled all Rust dependencies but correctly stopped at the optional OCR/ONNX linker because Cargo-wide offline mode also blocked ort-sys; kept parser acquisition offline while allowing this explicit build-time dependency boundary and pushed 7887ffe1.

Verification

• cargo check --workspace --lib --bins --locked — passed.
• cargo fmt --all -- --check — passed.
• cargo test -p compass-languages --test react_universal_pack --locked — 4 passed.
• cargo test -p compass-resolve --test react_frontend --locked — 4 passed.
• cargo test -p compass-agent-graph --tests --locked — all passed, including ingestion-preparation contracts.
• python3 -m unittest scripts.tests.test_react_frontend_qualification — 5 passed.
• python3 scripts/check_agent_graph_contracts.py, sh scripts/check_product_boundary.sh, and deterministic viewer asset validation — passed.
• bash -n scripts/provision_parser_sources.sh, bash -n scripts/qualify_code_graph_v1.sh, bash -n scripts/qualify_react_frontend_graph.sh, existing local parser-bundle reuse, and hosted parser-bundle provisioning — passed.

Hosted runs have now validated parser provisioning and Cargo dependency prefetch. The remaining blocker was the optional ONNX Runtime build artifact being intentionally unavailable under Cargo-wide offline mode; 7887ffe1 limits offline behavior to the pinned parser source boundary and lets ort-sys use its normal build-time artifact path. The latest required checks are rerunning. The full pinned qualification rerun after the Remix activation fix and the independent Graphify comparison/decision ledger remain release gates.

Current review state

This remains a draft while the tracked performance-baseline comparison and independent Graphify comparison are completed. No release-complete Plan 021 claim is made yet.

Local out-of-scope roots (3rd/, domain/, routes/, qualification/, .vercel/, and screenshots/artifacts) remain uncommitted.

[forhappy]

Conflict update complete.

• Merged latest origin/main and regenerated the deterministic viewer assets in 88b628402609558b0b32d29cc97f7b070f8d256c; node scripts/check_viewer_assets.mjs passes.
• CI run 32699278143 is green across all 14 checks, including code-graph fixtures, JS/VS Code, quality, dependency, and native platform jobs.
• React frontend qualification remains exact: pinned v8 expected/matched 13236/13236, precision/recall 1.0/1.0, zero fabricated targets; fixture graph digest is 48f78b9a23ad5e8d7b3c2260761d15ef72681517a43ace3decbc9ec650ff539b.

PR remains draft.

[forhappy]

Updated PR #286 for the conflict-resolution follow-up.

Head: c25fa25c (fix(graph): close frontend qualification audit gaps)

This update adds:

• parser-backed default-export detection for Next.js/React Router and parser-bound TanStack Route activation, with negative fixtures for comments/strings and unresolved re-exports;
• recursive graph-anchor path validation and containment-based source matching in the qualification scorer;
• release-build revision binding in the pinned runner;
• a qualification-only Compass-vs-Graphify comparator and documentation of the retained fixture evidence;
• Python regression coverage for unsafe paths and partial-span matches.

Local verification passed:

• focused Next.js, React Router, and TanStack Rust tests;
• cargo clippy -p compass-languages --lib --locked -- -D warnings;
• React frontend Python qualification tests, py_compile, shell syntax, formatting, and git diff --check;
• ./scripts/qualify_react_frontend_graph.sh --fixtures-only;
• Graphify diagnostic comparison: Compass 113 nodes / 133 links vs Graphify 40 / 44, zero Compass dangling targets, independent oracle passed.

The PR is currently MERGEABLE / CLEAN. The historical pinned release artifact is from revision 7887ffe1; the exact current-revision pinned corpus run remains the release-promotion gate and is documented as such. CI has started for this head.

[forhappy]

The fresh current-head pinned qualification is now recorded in the PR follow-up docs.

Current result:

• head/release revision: c25fa25c2cfe9b6aefcfaaa6937f9e9a2351d921
• result: /Volumes/Workspace/crabbuild-target/compass-021-react-frontend/qualification/plan021-current-c25fa25c/react-frontend-pinned-result.json
• result SHA-256: fedda8d8b97df8dbf15cb77c6144190976fa31bf0e28d03c6e2dbecd8d878e89
• 227,696 oracle records; 13,236/13,236 matches; precision/recall 1.0; Wilson lower 0.9997098561; zero fabricated and unsafe paths; interruption evidence passed.

The normal release gate correctly failed on one performance row: vite-react-template-and-core / warm was 1.5928499× versus the reviewed 1.10× budget (RSS passed); the other 41 rows passed. No threshold was widened. The plan/docs now keep Plan 021 IN PROGRESS and also call out the under-100-record capability rows (react.hooks, tanstack.loader, vite.file_set.glob) instead of treating aggregate results as full release qualification.

PR head is b037cdaf and remains open/draft; CI has restarted for the documentation update.

[forhappy]

Updated PR #286 with commit bde73c8 (feat(graph): enforce frontend capability evidence floor).

What changed:

• Added checksum-bound, checked-in scale fixtures for React, Next App/Pages, React Router, Remix, TanStack Router, and Vite.
• Enforced minimumCapabilityRecords=100 in the manifest, reviewed expectation policy, projection limits, and pinned scorecard; added a regression test for the floor.
• Kept the independent TypeScript 5.9.3 oracle compiler-backed for the fixture subtree without a project-wide source-text fallback.
• Updated Plan 021, support reference, performance baseline documentation, and marked the plan/index phase complete; TanStack Start remains pre-stable.

Committed-head pinned qualification passed:

• result: /Volumes/Workspace/crabbuild-target/compass-021-react-frontend/qualification/plan021-final-release/react-frontend-pinned-result.json
• result SHA-256: cbebe2aa4073e93455b19cd7f13fd7fd9c2854fbbaa41f0b5389c5e2a7f688f2
• release binary SHA-256: 846f96c20d1bb67a156a0f03ac21dd0fb903f20d4e9751a2ccd9cf34914118cf
• exact revision: bde73c8
• 232,446 oracle records; 17,986/17,986 matched; precision/recall 1.0; Wilson lower 0.9997864651; zero fabricated/unsafe targets; deterministic worker/lifecycle and clean SIGINT/resume; all 42 performance rows passed.

Local Python/oracle, product-boundary, formatting, fixture frontend, JavaScript/VS Code (88 browser tests), and viewer checks passed. The broad code-graph fixture command hit the mounted-volume limit during a fresh debug rebuild; its CI job is pending along with the rest of the PR checks. The PR is now mergeable/clean; CI run 32722378493 is pending.

[forhappy]

Conflict-resolution verification for the current PR head:

• bde73c86af03acb0a3b49e147e9423b553827e97 is pushed and matches the current PR head.
• origin/main is 3e8c10a6292078a3ef66758144db0038a900333f; the branch shares that merge base and is 33 commits ahead.
• GitHub reports mergeable: MERGEABLE; no conflict markers or tracked merge-conflict changes remain.
• CI run 32722378493 is still in progress; completed jobs are passing, with the remaining platform/quality/code-graph jobs running.

Plan 021’s current-revision audit remains closed: seven stable React-family targets meet the reviewed capability floor and the exact pinned qualification passed; TanStack Start remains pre-stable.

[forhappy]

Final verification: CI run 32722378493 completed successfully across all 14 jobs, including the broad code-graph-v1-fixtures qualification (29m16s), full quality, all native platform targets, JavaScript/VS Code, dependency policy, and dependency audit.

PR #286 is now CLEAN / MERGEABLE at bde73c86af03acb0a3b49e147e9423b553827e97. Plan 021 current-revision evidence remains: 17,986/17,986 scored matches, precision/recall 1.0, zero fabricated/unsafe targets, 42/42 performance rows passing, deterministic worker/lifecycle output, and Graphify comparison surpassesGraphify=true. The PR remains draft.