test(codegen): #235 — engine-validate #199 closure ABI independent of CPS

[hyperpolymath]

#235 — engine-validate the #199 closure ABI independent of the CPS transform

Until #225 PR2 the #199 closure ABI ([fnId@0,envPtr@4] via the exported __indirect_function_table) had only ever been statically compiled estate-wide — the blind spot the two PR2 defects hid in. The async tests now exercise it but only through the CPS transform; the existing tests/codegen/test_closure_*.affine have no .mjs host (compile-only). This adds the missing negative-control.

tests/codegen/closure_indirect_dispatch.{affine,mjs}: a captured closure passed to a plain extern fn invokeCallback(cb: fn(Unit)->Int)->Int; host dispatches via __indirect_function_table (wrapHandler, identical to packages/affine-vscode/mod.js). Unit imports only env.invokeCallback (no thenableThen ⇒ async transform provably uninvolved) yet still exports __indirect_function_table; asserts table exported + closure fired once + captured local reached via envPtr (7+35=42). Protects the shared #199 path for all closure users independent of #205.

tools/run_codegen_wasm_tests.sh green incl. the new test; dune test --force 290/290. Zero regression.

Estate-consumer audit (deliverable 2 — posted on #235)

Only rsr-certifier (standards#123 — full #199 closures + #205 path, ships its own wrapHandler clone, zero wasm tests) genuinely warrants its own runtime smoke. my-lang (#199-only), idaptik/reposystem (.ts generic vscode — not this ABI), boj-server/gitbot-fleet (no consumer) are defensibly static-only now this upstream guarantee exists. The rsr-certifier per-repo smoke (standards repo) is the remaining tracked item.

Refs #235 — deliverable (1) done; not Closes (rsr-certifier smoke remains).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 47 issues detected

Severity	Count
🔴 Critical	12
🟠 High	21
🟡 Medium	14

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence