[M4n5ter]

Summary

A business-only SDK edit invalidated the notice snapshot, while importing an existing locked package from an untracked TSX file could add shipped code without failing the same check. Replace the 2,931 whole-source fingerprints with 1,361 reviewed component identities and independently recomputed license-data digests. The 2,681,462-byte notice document is byte-identical.

Generation and checking share the Cargo dependency-closure and actual JavaScript bundle-owner collectors. Component identity includes source provenance; license data includes declarations, authors used in the notice, all discovered local license files and supplement references. Conflicting installed copies fail. Existing pinned-license and Playwright source checks remain.

Native packaging consumes bundle-inputs.json from the actual Cargo build script, joined to the executable by package ID. Verify the current target's components after building and before packing; the reviewed catalog can cover other platforms. Standalone notices check builds a temporary product bundle, clears ambient UI-cache selection and does not download license texts. It does not build the complete native CLI.

Verification

• All 31 scripts/rust/*.test.mjs tests pass, including source-only edits, newly bundled locked components, source/integrity/license/supplement changes, target subsets and conflicting installed duplicates.
• A minimal real Cargo build writes the bundle manifest under a custom target directory; the actual notice verifier reads that artifact and rejects its unreviewed component. Mocked bridge tests also prove selection by package ID rather than the last build-script output.
• Actual product rebuild after SDK/TSX business edits: PASS with the same reviewed catalog. Actual TSX import of already locked semver@7.8.5: REJECTED as required, with unchanged lockfiles. Probe changes were restored.
• Full notice generation and standalone check pass; 1,361 components / 693 license texts. Document bytes and digest remain unchanged.
• Biome, ASF headers, dependency inventory, git diff --check and pre-commit checks pass.
• Dedicated GPT-6-astra high advisor reviewed design, final code and artifact evidence: acceptable, no blocking findings.

A complete native CLI/V8 release build was not run. Standalone checking now needs the UI compiler/product bundle to establish actual component coverage; release packaging reuses its already built product and does not run a second bundler.

Review focus

notices.mjs owns one component/licensing collector for generation and validation; the old glob/hash model and its source-change rejection test are removed. cargo.mjs, build-cli.mjs, product.mjs and release-cli.mjs migrate the artifact handoff together, without retaining a string-return compatibility path.

Diff: 11 files, +1968/−3276 (net −1308), including generated catalog reduction. Runtime tooling changes net +27 lines; tests net +231 lines. English/Chinese command documentation describes component coverage and the standalone build cost.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Codex authored the refactor, tests and validation; a dedicated GPT-6-astra high advisor performed read-only design and final reviews. The commit retains Generated-by: Codex.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

The new notice tests depend on the component model and artifact contract; old source-fingerprint behavior was separately reproduced with the real semver counterexample before this refactor. A baseline red-run of the entire new suite is not claimed.

Does this PR entail a change in behavior?

• Yes — source-only edits preserve coverage; actual unreviewed components fail
• No

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

I reviewed the final 11-file diff at 2c2b3c6a3f4d01bea9a9594e0cbdc5cfab0938b8, including the component collector, reviewed-catalog format, Cargo build-output handoff, release ordering, all changed tests and command documentation.

The verifier now recomputes component identities and license-data digests from the target's Cargo dependency closure and actual product bundle inputs. It checks the reviewed notice document digest, rejects unreviewed or changed components and conflicting installed license data, and allows a reviewed platform union to cover a smaller target. cargo.mjs joins build-script output to the executable by package ID; packaging validates the bundle produced by that build before assembling the package. I found no confirmed P0–P2 defect in the inspected source.

Executed locally: three existing notice behavior tests pass, covering first-party source edits versus a newly bundled locked package, license/source/integrity/supplement changes, platform subsets and conflicting installed duplicates. Cargo metadata is mocked by those tests. Eight existing build/launcher tests also pass, covering artifact selection, unrelated build-script output, staging and process failures/signals. I explicitly excluded the notice test that performs a real Cargo build because this machine has no Cargo toolchain; I did not run the standalone product bundler or native packaging.

Separately, I reconstructed the exact #6520 follow-up 9341667e5105d19648df29166e27c4d7b336d1d8 and ran its unchanged production source-fingerprint verifier successfully. Only five manifest entries changed from a2b7d44a; source and notice-document bytes are unchanged. This closes my earlier fingerprint P2 findings in #6517/#6520. It is not a full acceptance of the storage migration or settings UI.

The subsequent merged Rust d513a72e updates the CUA component entries and source URLs. Its completed product worker in run 41277034369 executes the actual new notices.mjs check successfully. That is hosted evidence, not my independent native build. The overall run and the separate PR run remain in progress at this check. I did not reproduce the author's real Cargo/TSX counterexamples, full inventory generation or complete native release build.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

The exact-head run 41275068547 has finished: 1,980 passed, one failed, 26 skipped. The failure is the existing launcher_owned_updates_interrupt_the_old_host_and_wait_for_cleanup test at its 60-second timeout, not the component-notice verifier. The same named failure occurs in #6520's final-head run; I have not attributed it to this notice change.

A later completed d513a72e product worker successfully executes the new verifier. #6529 changes the launcher test's watchdog scope, and current merged-Rust CI is still running. There is no complete native-release acceptance from this follow-up.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.