[rush reporter][R1B] Generate install-run-rush bootstrap protocol

[Sean Larkin (TheLarkInn)]

Summary

• generate the reporter's self-contained bootstrap envelope encoder and protocol-major constant into a committed rush-lib module
• validate the extracted TypeScript syntax tree against static, dynamic, type, export-from, import.meta, and require-rooted module edges
• preserve the required payload field when callers provide an undefined payload
• run deterministic generated-artifact checks from both the reporter source build and the rush-lib artifact-owner build
• embed the generated module in the existing install-run-rush webpack entry without importing @rushstack/rush-reporter at runtime

Stack

• parent: Wire rush-reporter package dependencies #5985 (copilot/reporter-r1a-package-wiring)

This is the R1B child of #5985. Auto-merge stays disabled while #5985 is open. After #5985 merges, retarget this PR to main, verify its slice and full CI, then merge it before #5987.

Generation and boundary guarantees

libraries/reporter/scripts/generateBootstrapProtocol.js extracts only the marked protocol region, parses it with TypeScript, verifies its major matches REPORTER_PROTOCOL_VERSION.major, rejects module-loading edges, and writes the committed artifact. Check mode compares the artifact deterministically after normalizing checkout line endings.

The rush-lib build owns validation of the committed generated artifact. The reporter build also validates source changes early. The generated module contains only the frozen major, envelope DTO types, and JSON encoder. The built install-run-rush.js contains the encoder and contains no @rushstack/rush-reporter runtime reference.

Validation

• reporter build and full test suite
• rush-lib build and full test suite
• generated protocol write and check round trip
• stale generated artifact rejection through the rush-lib build
• syntax-tree rejection matrix for import and require module edges
• undefined payload envelope preservation
• frozen Rush install against the committed lockfile
• rush check and rush change --verify --no-fetch
• gh pr diff 5986 contains only the 13-file R1B bootstrap-generation slice

Non-goals

This slice does not implement the bootstrap handoff prelude, reporter selection, or the Rush 6 default change. Those remain separate workstreams.

Part of #5974

[Sean Larkin (TheLarkInn)]

Linear stack update: R1B is now head 1b4252c based on #5985. Its GitHub diff is exactly the 10-file bootstrap-generation slice; CRLF-safe generation and the committed generated protocol remain intact. Auto-merge is disabled until #5985 merges.

[Sean Larkin (TheLarkInn)]

Combined deep review of current head 1b4252ccd8.

No critical, high, or medium actionable findings. No useful low follow-ons.

[Copilot]

Copilot review overview

🟡 Changes recommended

The generator must detect inline dynamic imports before its zero-dependency guarantee is reliable.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	libraries/​reporter/​scripts/​generateBootstrapProtocol.js — The import guard only matches statements whose first token is import, so an inline dynamic import…

What changed in this PR

Generates and embeds a zero-dependency reporter bootstrap protocol for install-run-rush, with deterministic synchronization checks.

Changes:

• Adds the generated bootstrap encoder and protocol constant.
• Integrates generation checks into builds and tests.
• Updates bootstrap buffering and change records.

File	Description
libraries/​rush-lib/​src/​scripts/​install-run-rush.ts	Embeds and validates the bootstrap protocol.
libraries/​rush-lib/​src/​scripts/​generated/​BootstrapProtocol.ts	Provides the generated protocol artifact.
libraries/​reporter/​src/​test/​Bootstrap.test.ts	Tests deterministic envelope encoding.
libraries/​reporter/​src/​bootstrap/​BootstrapProtocol.ts	Defines the generated protocol source region.
libraries/​reporter/​src/​bootstrap/​BootstrapEventBuffer.ts	Uses the shared encoder.
libraries/​reporter/​scripts/​generateBootstrapProtocol.js	Generates and verifies the artifact; its import guard misses inline dynamic imports, allowing unintended runtime dependencies.
libraries/​reporter/​package.json	Adds generation and validation commands.
libraries/​reporter/​config/​heft.json	Adds build-time synchronization validation.
common/​changes/​@rushstack/​rush-reporter/​copilot-reporter-bootstrap-generation_2026-08-28-01-58.json	Records the reporter change.
common/​changes/​@microsoft/​rush/​copilot-reporter-bootstrap-generation_2026-08-28-01-58.json	Records the Rush change.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Sean Larkin (TheLarkInn)]

Deep review of current head 4a97962 found no critical, high, or medium actionable issues.

Fixed the inline dynamic import guard, generated-artifact cache ownership, require-rooted module edge coverage, and undefined payload envelope handling. Reporter and rush-lib builds and tests, stale-artifact rejection, frozen install, generation checks, and repository policy gates pass.

Low follow-ons are non-blocking: the duplicate reporter-side artifact check has a weaker cache ownership contract, and the rush-lib task uses a repository-relative sibling path. The rush-lib artifact-owner check remains authoritative.