[vincentkoc]

Problem and change

Qualify the pinned Bun AOT frontend against engine 8e335354a58fa9a8eed14a70a8b9bf97b5d3073f using secretless Linux native execution. The source adapter retains the frozen Bun base fd40ba44187c721ee023062fa153a6a27560e6b1 and complete source/index, generated-input and executable identity checks. Existing engine fixes belong to PR46; strip their identical copies here after that parent lands.

The first complete native build passed in run41277014748, including both ICU79.1 smokes. Its actual TESTAOT emitter replay then failed with IdOutOfRange in record293; subsequent gates did not run.

Proven cause and repair

The bounded diagnostic capture retained a 1,734,344-byte wire program and eight matching generated schema/builtin contexts. All30 manifest records and four controls were verified. Types[293].builtins contains builtin4119, Symbol.iterator, whose table kind is Constant. The engine reader intentionally rejects primitive constants in that list.

Port the existing canonical Bun repair: represent well-known symbols as primitive symbol types, retain canonical identities for object/function builtins, and leave other primitive expectations unchanged. Both lowering callers change together; own-module export handling remains intact. Constructor assertions cover ordinary builtin, Symbol.iterator and Math.PI. No engine validation is relaxed.

The diagnostic mode is removed. Candidate patch:573 paths,1,743,224 bytes; SHA256 f741a41ff4953e4d7be5a4c903671b5dbc6fa7922a5b03055e1760c988e6d336. The five-file repair passed independent P0–P3 review; every573-path preimage/postimage/hash/mode matches the frozen base and proposed source. The qualification script adds only the constructor contract to the existing gates.

Validation and completion

Full native replay at7a38bc1 compiled successfully and passed both ICU79.1 smokes and all25 exact Rust contracts, including the original emitter replay. The subsequent module suite reported395 passed and one stale recording expectation failed. The removed namespace-observation marking no longer controls Site.records; the production binder sets it only when the module object is observed. A reviewed, not-yet-published test migration replaces the obsolete bind-only case with paired production-binder cases for namespace observation and module.children recording. The remaining IR, JavaScript, compiled-program and startup gates were not reached. No complete native pass is claimed.

The separate required Debug pre-push run compiled at 1233d6cb0f5394348f159a00679bcf0034f71298, then its sole JSON.parse/json() AOT test failed with a real RELEASE_ASSERT in AOTRepresentationRules.cpp:75. The generic integer operand path receives a non-integer-only type; the assertion remains intact. The follow-up diagnostic run completed red at 53f926fa945c19f6d43ef154414f0e9e925b5045 and preserved the original failed verdict. It captured a 1,742,064-byte frontend wire (SHA256 1a695e99f2554935c7ebfe714af00984855f35b097aefa18ace0026bb8dda43c). Both Bun and its matching-table Debug testaot report operand-type mismatches after AddGenericVersion, affecting 45 builtin/prelude functions; the first tool case is function120 next, block3/value5 StepArrayIterator. Verification stops before NumberAndEncode, so no post-pass IR was printed. The offending operand definition/type before and after that pass is still needed to establish the repair owner; this does not yet prove the cause of the later representation assertion. No verifier weakening or fixture change is proposed. Normal full qualification remains byte-identical and held. The run uses the same 573-path source and original bun bd test Debug/ASAN/assertion defaults, clears CI-mode flags to execute trailing tests, and has no command timeout. Debug proof is failed, not skipped or qualified.

Full replay proof:artifact13080423355,577,971 bytes, ZIP SHA256 dfbf7f4193b47272b6e66f6a60ebe0dbf735eef502cb60b8feee224ba0eb590f. All49 manifest records, four controls and25 contract logs were verified. Debug proof:artifact13081525184,481,013 bytes, ZIP SHA256 6527f47a896ca8022a0affc6ca5c52407fae4bf189eeed77668aecbcd3582497.

Capture ZIP:artifact13075341147,1,744,887 bytes, SHA256 105a690d10cf171386529ce8106b0c4b67a220d5ec09c8bb3e2ccd9e818a3046. Captured wire SHA256 f66f8f4250b2efd7b7b90649a27066422a3086f449dc6ab99b425a075737bae6. The diagnostic job is intentionally red and supplies no native verdict.

Linux proof does not qualify macOS27 AOT production or OpenClaw/Birdclaw pins. Trimmed-executable disk loading remains a gap because its canonical fixture needs a flag absent from the frozen frontend. No release, artifact publication or consumer-pin change is included.

Diagnostic proof: artifact13083618243, 874,291 bytes, ZIP SHA256 88b5033b161b415fa5d7a095553f54465265aaaf699fd2426b882ddd06a2b53b. The TAR checksum and all 23 manifest records were independently verified.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.