Harden shape memory: contracts, expiry, freshness, key classifiers

[RhysSullivan]

Hardening pass on runtime shape inference, from the independent design review. Standalone value; also the foundation for the MCP data-contract PR stacked on top.

• Privacy classifiers: width alone (24 keys) missed a two-entry object keyed by email addresses — those keys persisted as "field names". Any data-looking key (email, UUID, ISO date, bare number, URL, long hex) now collapses the object to additionalProperties, regardless of width.
• Freshness persistence fix: the write-only-on-schema-change optimization left observations/updatedAt stale in storage forever. Writes now also happen on observation milestones and a 6h freshness interval.
• Expiry: shapes not reinforced within 30 days stop being served (a confidently wrong type is worse than unknown) and restart on the next observation.
• Contract-scoped records: observe/recall take a result-encoding contract; a mismatch recalls nothing and restarts rather than merging — so a data-contract migration invalidates stale shapes with no deletion pass. Legacy records default to "direct".
• New: tool-result-normalization.ts (the pure result-encoding vocabulary + MCP CallToolResult normalizer, 13 contract-table tests) and optional content/meta side channels on ToolResult — wired up by the stacked PR, inert here.

Tests: 18 new (5 memory behavior with stub storage + TestClock, 2 classifier suites, 13 normalization), sdk suite 683/683.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	a30e433	Commit Preview URL Branch Preview URL	Aug 27 2026, 08:16 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	a30e433	Aug 27 2026, 08:17 AM

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-1768.executor-e2e.workers.dev
MCP	https://executor-preview-pr-1768.executor-e2e.workers.dev/mcp
Deployed commit	a30e433

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1768

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1768

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1768

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1768

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1768

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1768

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1768

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1768

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1768

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1768

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1768

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1768

executor

npm i https://pkg.pr.new/executor@1768

commit: a30e433

[RhysSullivan]

Codex review findings addressed in a30e433: email classifier narrowed to full-string matches (@odata.context-style keys keep struct shapes), added Slack-style / prefixed-id / IPv4 / opaque-token key classifiers with tests, persisted-write bookkeeping now advances only on successful puts (with a failure-injection test), and duplicate-detection equality is depth-bounded so adversarially deep valid JSON degrades to keep-the-block instead of a stack overflow (reproduced case now a test).