test(Timer): complete hardening audit layers 1-2 (#6483) by ManoharPaturi · Pull Request #6609 · facebook/astryx · GitHub
Skip to content

test(Timer): complete hardening audit layers 1-2 (#6483) - #6609

Open
ManoharPaturi wants to merge 1 commit into
facebook:mainfrom
ManoharPaturi:fix/timer-hardening-audit
Open

ManoharPaturi wants to merge 1 commit into
facebook:mainfrom
ManoharPaturi:fix/timer-hardening-audit

Conversation

@ManoharPaturi

Copy link
Copy Markdown
Contributor

Fixes #6483

What this does

Completes the contributor-executable layers (1–2) of the Component Hardening Protocol for Timer. (The issue title says XDSTimer; the shipped component is Timer, owner-approved 2026-09-22 — reviewed against Timer.spec.md.)

Audit result

The automated surface is clean: check:repo contract checks, themingTargets.test.ts (the astryx-timer target is registered and asserted), check:knowledge (spec in sync), eslint with the repo's own plugin, and the doc props table matched against the implementation line by line. No dead CSS, no dropped props, no stale xds naming, no live-region or anatomy violations — the "no aria-live/role by default" contract is explicitly tested and rejected additions are honored.

The tick pipeline itself held up under review: boundary wakes (second/minute cadence switch at the hour), future-origin clamping, non-finite startTime fallback, format switching without remount, and StrictMode resource replay are all covered by tests that can fail.

What changed

Two untested guards are now pinned (both were implemented but invisible to CI):

  • A distant future startTime caps its scheduled wait at the 32-bit setTimeout ceiling (MAX_TIMEOUT_MS). A raw startTime - now delay overflows it and misfires in some browsers; the test proves the cap.
  • An unknown format value coerces to elapsed (resolveFormat), and switching back to clock still works.

The Default story gained a play function asserting in a real browser that the zero-duration first paint advances on its own — the core promise of the component, previously only proven in jsdom.

Routed, not built (for the owner / Layer 3)

  • weight is verified only as render-without-crash across Text, Timestamp, and Timer — it compiles to a StyleX class with no data-weight attribute, so jsdom can't observe it. A data-weight attribute (or a documented exception) is an owner decision.
  • Layer 3 design review is prepared to run against the existing stories (Default, Formats, WaitingMessage, EarlierStart, Typography cover the composition contexts).

Testing

  • pnpm vitest run packages/core/src/Timer/Timer.test.tsx: 19 passed (17 pre-existing unchanged).
  • Prettier + eslint clean on touched files. Changeset included.

#6306/#6314 was the template for this pass.

Copilot AI lite review requested due to automatic review settings September 24, 2026 19:32
@vercel

vercel Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Meta Open Source bot. label Sep 24, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions github-actions Bot added community Authored by a community contributor (not on the eng/design team) needs:code-review High-risk change (new package/component/API) — needs human code review before merge labels Sep 24, 2026
@astracat-bot

astracat-bot Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

AI review status for this pull request.

Review status Updated
🟡 Reviewed (for maintainers only) Sep 24, 2026, 8:04 PM UTC

github-actions Bot added a commit that referenced this pull request Sep 24, 2026
@github-actions

Copy link
Copy Markdown
Contributor

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

Modified Components

Timer (@astryxdesign/core) · View in Storybook
Metric Before After Delta
Bundle Size (ESM) N/A N/A N/A
Lines of Code N/A 186 -
Complexity N/A Medium (15) -

Bundle Size Summary

Package Size (ESM) Size (CJS) Gzipped
@astryxdesign/core N/A 4.9KB 1.2KB

Accessibility Audit

Status: No accessibility violations detected.

Visual Regression

25 of 420 shot(s) changed. View the report

A change here is a question, not a failure: check whether the after is the
picture you intended. Record that review on the PR. Baseline maintenance is an
explicit dispatch of CI; this report never rewrites the baseline or adds a release gate.

component story theme mode pixels
Chat Full AI Chat probe light 42,708
Chat Empty State probe light 42,708
Chat Full AI Chat probe dark 41,786
Chat Empty State probe dark 41,786
Slider Default probe light 15,617
Slider Default probe dark 15,615
Chat With Attachments probe light 12,964
Chat With Attachments probe dark 12,114
InputGroup With Typeahead probe light 11,012
InputGroup With Typeahead probe dark 9,189
ComplexSelector Tree list with search probe light 6,245
TextArea Vertical Form Alignment probe light 5,634
ComplexSelector Tree list with search probe dark 5,602
TextArea Vertical Form Alignment probe dark 5,047
ComplexSelector Fruit ripeness selector neutral light 4,007
ComplexSelector Fruit ripeness selector neutral dark 3,825
ToggleButton Group Single probe dark 1,538
ToggleButton Group Single probe light 1,538
MediaTheme On Dark neutral dark 838
Banner Collapsible Content (Expanded) probe dark 92

and 5 more.

Chat — Full AI Chat — probe light
BeforeAfterDiff
Before visual regression frame After visual regression frame Pixel difference frame
Chat — Empty State — probe light
BeforeAfterDiff
Before visual regression frame After visual regression frame Pixel difference frame
Chat — Full AI Chat — probe dark
BeforeAfterDiff
Before visual regression frame After visual regression frame Pixel difference frame

Generated by PR Enrichment workflow | Storybook | Sandbox | View full report

@astracat-bot astracat-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for a careful hardening pass — the two newly pinned guards are exactly the kind of invisible coverage this audit exists for, and I verified the Timer suite passes (19 tests) with the timeout-ceiling and invalid-format tests in place. No production code or API changes, which matches the audit result.

One thing does need fixing before this can land: the Default story's new play function is described — in the story comment, this PR description, and the changeset — as failing in a real browser if the display ever freezes at 0s. In this repo, a play assertion only fails CI when its story is listed in TARGETS in .github/scripts/story-play-guard.js, and that list currently contains only ChartTooltip and TabList stories. The guard's own header notes that an unlisted play is observed by nothing that can fail, so a frozen Timer would currently keep every required check green despite those claims. Adding core-timer--default to that TARGETS list (with a short guards description) is the documented one-step promotion and would make the claimed protection real — the guard's timeout comfortably covers the play's wait.

Separately, a small heads-up: the description's Fixes #6483 will auto-close that issue on merge while Layer 3 and the weight observability decision are routed to the owner — worth making sure those have follow-up tracking before merging.

[Automated review]

This branch was successfully deployed

1 active deployment
Preview — d2e16b2d Deployed Sep 24, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Meta Open Source bot. community Authored by a community contributor (not on the eng/design team) needs:code-review High-risk change (new package/component/API) — needs human code review before merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Hardening: XDSTimer

2 participants