fred
7dedc8d3c0
ci/woodpecker/pr/ci Pipeline was successful
Per the second M4-1a detached review (REQUEST_CHANGES, R1-R8): - R1: prong (i) now tracks namespace destructuring, nested namespace re-exports (ns.schema.companies), and literal dynamic-import bindings (destructured and namespace) per contract rev 9. - R2: capability-conduit fixpoint (computeCapabilityConduits) closes driver/factory laundering through export-from modules. - R3: dynamic-import check is per call site with a full-literal tail match, so concatenated specifiers no longer pass. - R4: computed-member calls with literal verb names (obj['insert'], obj['query']) and spaced member access are flagged. - R5: prong (ii) adjacency tolerates schema qualification, interposed block comments, COPY, and escaped quotes. - R6/R8: header documents KNOWN RESIDUALS (DI receiver rename in capability-free files, computed non-literal member access, scan perimeter) with the measured counterfactuals. - createRequire fails outside a 5-module measured register (R1 route). - 15 new permanent evasion controls (E9-E23) with helper-file conduits run through the production analyzer. Calibration: tree-wide prong test green with zero new exclusions; tsc, eslint, and the full package suite pass.