[jderochervlk]

Makes the package installable with ReScript 13 alpha and checks the npm package that consumers will actually install.

Improves the test runner, adds browser tests, and updates vulnerable development dependencies. Alpha releases use numbered versions and are checked before publishing. Pull request checks do not receive publishing permissions.

This is the base for #399 and #398. A maintainer still needs to verify npm Trusted Publishing before publishing the v1 alpha (#385).

Closes #384. Closes #396. Refs #383 and #385.

[jderochervlk]

Independent review of exact head 77b59836d6ef1838795f78496f7dd89cd98816de against live issue bodies #383/#384/#385/#396 (base ebe9cca601fb85e6064c786367e546ded9b07d05). No source edits or approval submitted.

One P2 finding: tests/browser/native-api.spec.mjs:24–28: the failure formatter can itself throw. In Chromium, injecting an awaited module rejection shaped as {RE_EXN_ID: "Review_bigint", _1: 1n, Error: new Error("original")} produces only page.evaluate: TypeError: Do not know how to serialize a BigInt; a cyclic payload similarly produces the circular-JSON error. These replace the original exception and lose fixture/source-stack diagnostics. This is not a false pass, but violates the requested robust failure reporting. Use a nonthrowing formatter that always retains fixture, exception identity and original stack; cover these cases. Ordinary async ReScript Assert_failure diagnostics work.

Independent evidence: fresh npm ci, formatting, build, feature checks, packed consumers, negative consumers, Node tests, Chromium tests, docs build, release check, full/prod audits, and npm publish <same consumer-validated tarball> --dry-run --access public --tag alpha all passed. Artifact SHA-256 was unchanged. Local toolchain: Node 24.16.0/npm 11.15.0; GitHub CI and Release also passed on the configured Node 26 (release pins npm 11.5.1), with actual publication skipped. In-memory probes confirmed Node assertion and registration-omission failures, empty browser-registry failure, useful ordinary async assertion diagnostics, and main/event/published-version/fail-closed registry guards.

Acceptance still open: #383 needs the formatter fix above; binding-specific native/unsafe/nullable cases are intentionally stacked, not missing foundation dependencies. #384 installation/artifact behavior passes, but supported/tested compiler-version prose is absent from this head. #385 machinery passes inspection/execution, but release/tag/release-note/changelog/dist-tag-verification instructions are absent here, and external npm configuration remains unverified: owner rescript-lang, repository experimental-rescript-webapi, workflow release.yml, environment unset, direct npm publish allowed. Keep #385 open. Documentation gaps can be owned by the docs stack; the intentionally deferred docs-link gate is not a foundation defect. #396 passes: narrow patched overrides, clean install, zero full/prod audit findings, no added runtime dependencies.

[jderochervlk]

Independent agent follow-up review — exact head 1a6aceb398a22d2a38ebf4bc6a73ba092b302e45

Both P2 findings from the review at 858d87f remain resolved. No new concrete code defect found. This is a separate follow-up verdict, not a relabeling of the completed review of e6d5adf42e6e7e8b88b05d01a367f725cf640291. Base main remains ebe9cca601fb85e6064c786367e546ded9b07d05.

Reviewed delta

Checked the immutable GitHub compare and local Git trees: e6d5adf…1a6aceb contains exactly one commit and one added line, in the expected checkout fixture: publishConfig: { access: "public", provenance: true }. Production code, workflow, package metadata/lockfile, docs, consumers, and browser harness are byte-for-byte unchanged. The malformed packed-config cases now explicitly run against valid checkout configuration; the helper must still inspect the packed manifest.

Previous findings

1. Lifecycle hooks under OIDC — resolved. The publish job directly invokes node scripts/check-release.mjs --publish, so candidate precheck:release / postcheck:release hooks are not run. Real publication and validation dry-run both use --ignore-scripts. No candidate dependency installation/build/pack/test/npm-script command executes in the privileged job; the global npm installation only bootstraps the toolchain. The no-OIDC validation job and needs: validate + main-only/manual-dispatch/non-dry-run publication guard remain intact.
2. Checkout-versus-packed configuration — resolved. The workflow verifier extracts package/package.json from the downloaded tarball and passes packed to the helper. Only public access and boolean provenance are allowed in publishConfig; every other key, including registry/scoped-registry/tag overrides and latest, is rejected before publication. Lifecycle scripts are rejected too. The default download is scoped to the same workflow run's named artifact; the verified archive path is the published path.

Evidence and limits

Rerun on an isolated archive of exact 1a6aceb…, Node 26.3.0 / npm 11.5.1: node --test scripts/validate-release-artifact.test.mjs (6/6), npm run check:release (6/6 plus successful live unpublished-version check), and git diff --check all passed. GitHub CI for this head succeeded: https://github.com/rescript-lang/experimental-rescript-webapi/actions/runs/42323173253 . Release validation was still in progress at inspection: https://github.com/rescript-lang/experimental-rescript-webapi/actions/runs/42323173275 .

Carried forward transparently from the unchanged-code e6d5adf review, not rerun here: fresh install, formatting, build, all 28 feature checks, packed supported/unsupported compiler and default/Fetch/SafeFetch scenarios, negative consumers, Node runtime, Chromium, docs, full/prod audits (zero vulnerabilities), exact archive consumer validation and dry-run, actual workflow-verifier malformed-archive probes, direct-guard lifecycle-hook sentinel probes, and harness failure-path probes. That earlier review used Node 26.3.0 / npm 11.5.1 too. No need to repeat those unrelated checks for this test-only addition.

Acceptance gaps unchanged

• Accept supported ReScript 13 prereleases and verify tarball installation #384 and Update vulnerable documentation-tooling transitive dependencies #396: prior installation/compiler/artifact and dependency-patch criteria remain verified; supported/tested compiler prose is present at this head.
• Establish reliable runtime regression tests for the alpha #383: the runtime/Chromium harness is verified, but binding-specific native and unsafe-widening/nullable-contract negative regressions remain intentionally deferred to the binding stack. The current URL smoke and generic string-to-int negative fixture do not establish those binding cases. This is not a new foundation-code defect or evidence that all of Establish reliable runtime regression tests for the alpha #383 is complete.
• Publish explicit numbered v1.0.0 alpha versions safely #385 docs stack: release/tag (v1.0.0-alpha.1), release-note/changelog, publishing-configuration, and manual dist-tag-verification instructions remain absent. This documentation acceptance criterion remains unmet.
• Publish explicit numbered v1.0.0 alpha versions safely #385 external gate: npm trusted-publisher account configuration remains unverified: GitHub owner rescript-lang, repository experimental-rescript-webapi, workflow filename release.yml, environment unset, and direct npm publish allowed. Successful provenance-bearing publication has not been established by YAML or dry-run evidence.

No source edits, merge, actual publication, account/settings changes, issue closure, or formal approval performed. This same-account agent comment is not an independent maintainer approval or a release-ready claim.

[jderochervlk]

Independent agent follow-up — exact head 6fa3016a58700c1986acc705f7ff851efc54709e

Both previous P2 release findings remain resolved; no new concrete code defect found. This verdict separately reviews the delta after 1a6aceb398a22d2a38ebf4bc6a73ba092b302e45; it does not silently relabel earlier reviews.

The immutable GitHub comparison and local Git trees confirm one commit modifying only package.json's two formatter scripts. Each replaces the three explicit current browser .mjs paths with ./tests/browser/*.mjs. Parsed-package comparison confirmed no other metadata or script changes. The glob still includes all three current modules and automatically includes additional top-level browser helpers; it does not require importing stacked binding fixtures into this foundation PR. No source/workflow/dependency change accompanies it.

Rerun on an isolated archive of exact 6fa3016…, Node 26.3.0 / npm 11.5.1:

• Fresh npm ci passed (installation audit reported zero vulnerabilities).
• Exact npm run format:check passed.
• Exact npm run check:release passed: six validator/guard tests plus the live unpublished-version check.
• git diff --check passed.
• A scratch-only additional malformed browser-helper .mjs made the exact npm run format:check fail and identify that helper, confirming the intended newly included coverage. The probe was removed; the worktree was not edited.

All release workflow/validator and runtime/consumer/harness code is unchanged from the prior reviewed SHAs. Their earlier checks are carried forward, not rerun here: direct Node guard avoids candidate pre/postcheck hooks; publish/dry-run suppress lifecycle scripts; no candidate installation/build/test runs in the privileged job; main/manual/non-dry-run gating and no-OIDC validation remain intact; actual packed-manifest validation rejects registry/tag overrides before publishing the same-run archive. Earlier exhaustive build/feature/consumer/Node/Chromium/docs/audit/exact-artifact dry-run evidence remains applicable to those unchanged paths. GitHub CI and Release runs for this new SHA were still in progress at inspection, not claimed successful.

Unchanged acceptance boundaries: #384/#396 remain supported by the prior evidence. #383 binding-specific native/unsafe-widening/nullable-contract regressions remain intentionally stacked, not demonstrated by the current URL smoke/generic negative fixture. #385 release/tag/release-notes/changelog/configuration/manual-dist-tag runbook remains absent (docs-stack gap). External npm trusted-publisher configuration remains unverified: owner rescript-lang, repo experimental-rescript-webapi, workflow filename release.yml, environment unset, direct npm publish allowed; successful provenance-bearing publication remains unproven.

No source edits, merge, actual publication, settings changes, issue closure, or formal approval. This same-account agent comment is not independent maintainer approval or a release-readiness claim.

[jderochervlk]

Acceptance status for foundation PR #397 at head ebe4fca (same full tree as independently reviewed 779568e):

• Establish reliable runtime regression tests for the alpha #383 — regression testing across the stack: The foundation provides explicit compile-only, documentation-example, Node-runtime, and browser-runtime fixture categories, a discovery guard, Node assertions, native Chromium execution, error reporting, and diagnostic-matched negative consumer support. The stacked bindings PR fix(webapi): correct browser API types and calls [Codex] #399 at 0b46425 adds the native API regressions, typed/null/unsafe negative consumers, local WebSocket/Worker flows, and isolated configurable browser server; docs PR docs(webapi): update alpha guides and fix broken links [Codex] #398 at fd007c8 documents the local port override. Binding and docs checks passed, and the final author/review evidence is linked at fix(webapi): correct browser API types and calls [Codex] #399 (comment) and docs(webapi): update alpha guides and fix broken links [Codex] #398 (comment).
• Accept supported ReScript 13 prereleases and verify tarball installation #384 — packed compiler consumers: ReScript 13.0.0-alpha.5 is the tested compiler and the peer range admits supported prereleases. The packed tarball installs without bypasses; default, Fetch, SafeFetch, Crypto, and Node runtime consumers compile/run; Fetch-only SafeFetch and unsupported compiler consumers fail with the expected diagnostic; contents are checked. The exact artifact passed alpha-tagged npm publish dry-run.
• Publish explicit numbered v1.0.0 alpha versions safely #385 — safe alpha machinery: package/lock/docs use 1.0.0-alpha.1; the workflow validates and dry-runs the exact artifact, checks for an existing version, isolates OIDC to main/manual/non-dry-run publication, validates downloaded metadata, uses --ignore-scripts, publishes only to alpha, and verifies the alpha/latest tags. The operator runbook is in docs(webapi): update alpha guides and fix broken links [Codex] #398. npm Trusted Publishing account configuration remains unverified (owner rescript-lang, repository experimental-rescript-webapi, workflow filename release.yml, no environment, direct npm publish allowed), and no real publication occurred. Publish explicit numbered v1.0.0 alpha versions safely #385 remains open.
• Update vulnerable documentation-tooling transitive dependencies #396 — dependency advisories: the patched documentation-tooling dependencies are locked; fresh npm ci and full/production audits report zero vulnerabilities, with no consumer runtime dependency added.

GitHub CI build and Release validate passed for #397 (publish/deploy skipped), #399, and #398. Independent review of the foundation tree found both prior P2 release defects resolved and no new defect: #397 (comment). This is an author acceptance update, not a request to merge, publish, close issues, or claim account-level release readiness. No issue is manually closed by this comment.

[jderochervlk]

Update: local browser isolation has now been implemented in stacked bindings PR #399 at head d938c719b016e439aeeec3da2d185dcd0b4e714f: WEBAPI_TEST_PORT drives server/baseURL, reuseExistingServer is false, and invalid/occupied ports fail closed. Its author reports local default/4192 runs and occupied/invalid-port rejection; GitHub build and Release validate pass at that head. This code is in #399, not foundation #397, and its final independent review remains pending, so #383 acceptance is a stack-level outcome rather than claim that #397 alone includes the fix.

[jderochervlk]

Coordinator verification of the current foundation head 779568e28c1caef5554b6ebbe9292fc0e9daa0dd:

• Its complete Git tree is identical to independently reviewed 6fa3016a58700c1986acc705f7ff851efc54709e: both tree IDs are dfd9e21de46e3c757793692e05abb00ccb12585c, and the GitHub comparison contains zero changed files.
• The intervening downstream-only browser-port documentation addition was restored out of this foundation. That guidance will accompany the actual isolation feature in fix(webapi): correct browser API types and calls [Codex] #399, so each PR remains accurate on its own.
• GitHub CI build and Release validate passed on the current 779568e head; deployment and real publication were skipped.

The earlier independent source-review evidence and author acceptance report carry forward by exact tree identity; this is not a claim that every earlier local command was rerun, nor a maintainer approval or landing instruction. #383 still awaits the corrected binding-stack acceptance/review, and #385 still has the docs-runbook and external npm configuration gates. No merge, actual publication, settings change, or manual issue closure was performed.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T18:08:44.044295Z	0bae03a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc5342b383

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".