Recognize external editor presentation stylesheet identities - #2451
Merged
Conversation
Editor presentation capture harvested blocks-engine-presentation identities only from inline <style> content. A generated stylesheet delivered as a real enqueued asset carries its content hash in the canonical version parameter instead, so bounded external delivery reported every expected identity as missing even when the stylesheet was loaded in the canvas. Certify an identity from an observed external stylesheet URL when its version exactly matches an expected identity. Unrequested hashes, non-hash versions, and captures without an expected set contribute nothing, so the expected-set comparison stays fail-closed.
This was referenced Sep 1, 2026
chubes4
added a commit
to Automattic/blocks-engine
that referenced
this pull request
Sep 1, 2026
The gate resolved wp-codebox through an SSI workflow pinned at v0.21.0, so the editor presentation capture could not observe an identity carried by an external stylesheet URL version. Bounded external delivery of the generated editor styles therefore reported 0 of 6 expected identities on both solved fixtures while the stylesheets were in fact loaded. Move the reusable workflow and the checked-out SSI code to 8a9edbce, which pins wp-codebox v0.26.5 and carries the capture fix from Automattic/wp-codebox#2451.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2449.
Problem
summarizeEditorPresentationharvestedblocks-engine-presentation:<sha256>identities only from inline<style>content:External canvas stylesheet URLs were already recorded, but never contributed an identity. A generated stylesheet delivered as a real enqueued asset carries its content hash in the canonical version parameter rather than in inline marker text, so a bounded external-delivery migration reported every expected identity as missing even when the stylesheet was present in the editor iframe.
Change
When capture receives expected identities, an observed external stylesheet URL certifies an identity if its version parameter exactly matches one of them. Inline marker support is unchanged.
The match is deliberately restricted to the expected set, so the expected-set comparison stays fail-closed: an unrequested hash cannot manufacture an observed identity, and a capture with no expected set certifies nothing from URLs alone.
Acceptance coverage
Added to
tests/editor-actions.test.ts:?ver=6.7.1, and a URL with no version contribute nothing.Verification
npx tsx tests/editor-actions.test.tspasses.actual: []vs the expected identity), so they are not vacuous.npm run test:browser-routed-command-securitypasses, covering the real-browser capture and settle loop that consumes this summary.npm run build:releasecompiles clean.Downstream
This is the upstream half of Automattic/blocks-engine#1478, whose solved-site promotion gate currently fails with
expected_identity_count: 6, observed_identity_count: 0on both solved fixtures despite exact frontend visual parity, clean editors, and all generated stylesheet URLs present in the canvas. That PR still needs a released wp-codebox and a pin bump before its gate can pass; this PR does not perform any release.AI assistance
Diagnosed and implemented with Claude Sonnet 4.5 via opencode. The model traced the failure from the blocks-engine gate output through the SSI workflow pin to this capture function, wrote the change and the tests, and verified them by running the suites above and confirming the new assertions fail without the fix. Reviewed by me before submission.