morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3201] [Bug] Managed/native verification reports missing module identity as a module mismatch #1138

New issue

Closed

opened 2026-10-15 18:31:25 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:31:25 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3201

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

verify-managed-native-boundaries reports an exact-name P/Invoke symbol candidate as contradicted/module-mismatch when native Evidence omits its module identity or the managed ModuleRef name is an empty string. Both inputs pass authentication and public CLI validation. The empty managed scope also omits the missing-scope limitation that the null-scope control returns.

Independent verification at the stated baseline ran both inspect-managed-native-boundaries inspections and all five verifier calls. Each exited 0 with ok: true. Each verification accepted one native observation containing one symbol. The absent-native and empty-managed cases both returned summary.contradicted: 1 and summary.unresolved: 0, just like the control with a known different module. In the absent-native case, both matched_native.module_name and matched_native.module_path were null.

Inspection of the byte-edited fixture returned module_refs[0].name: "", pinvoke_imports[0].import_scope_name: "", and complete parse coverage without issues. That coverage describes the parse; it does not establish a usable module identity.

Reproduction

Start with a clean checkout of the stated baseline and prepare its locked dependencies and runtime using the repository's pinned development toolchain:

npm ci
npm run build:cached

From the repository root, create the local fixture and verification inputs inline, then invoke both supported CLI commands. Use a supported Node.js runtime with TypeScript stripping, such as the observed runtime. The home and XDG directories below isolate CLI state. Run this in a disposable shell:

mkdir -p .repro/home/config .repro/home/cache .repro/home/data
export HOME="$PWD/.repro/home"
export XDG_CONFIG_HOME="$HOME/config"
export XDG_CACHE_HOME="$HOME/cache"
export XDG_DATA_HOME="$HOME/data"
node --input-type=module <<'JS'
import { mkdirSync, writeFileSync } from 'node:fs';
import { spawnSync } from 'node:child_process';
import { buildManagedPeFixture } from './src/dotnet/ManagedPe.fixture.ts';
import { createEvidence, parseEvidence } from './dist/domain/evidence.js';

mkdirSync('.repro', { recursive: true });
const fixtureBytes = buildManagedPeFixture({
  pinvoke: { moduleName: 'user32.dll', importName: 'MessageBoxW' }
});
writeFileSync('.repro/fixture.dll', fixtureBytes);

function cli(args) {
  const run = spawnSync(process.execPath,
    ['scripts/rea.mjs', ...args, '--format', 'json', '--full-output'],
    { encoding: 'utf8', env: process.env });
  if (run.error) throw run.error;
  if (run.status !== 0) throw new Error(run.stderr || run.stdout);
  const envelope = JSON.parse(run.stdout);
  if (!envelope.ok) throw new Error(run.stdout);
  return envelope.data;
}

const managed = cli(['inspect-managed-native-boundaries', '.repro/fixture.dll']);
const moduleRefOffset = managed.normalized_result.module_refs[0].row_offset;
const emptyScopeBytes = Buffer.from(fixtureBytes);
emptyScopeBytes.writeUInt16LE(0, moduleRefOffset);
writeFileSync('.repro/empty-scope.dll', emptyScopeBytes);
const emptyManaged = cli(['inspect-managed-native-boundaries', '.repro/empty-scope.dll']);
const nullManaged = createEvidence(undefined, emptyManaged.provider, {
  operation: emptyManaged.operation, parameters: {},
  result: {
    ...emptyManaged.normalized_result,
    pinvoke_imports: emptyManaged.normalized_result.pinvoke_imports.map(item => ({
      ...item, import_scope_name: null
    }))
  }, rawResult: null
});
parseEvidence(nullManaged);
console.log(JSON.stringify({
  module_ref_offset: moduleRefOffset,
  changed_byte_offsets: [...fixtureBytes.keys()].filter(i =>
    fixtureBytes[i] !== emptyScopeBytes[i]),
  empty_module_name: emptyManaged.normalized_result.module_refs[0].name,
  empty_import_scope: emptyManaged.normalized_result.pinvoke_imports[0].import_scope_name,
  coverage: emptyManaged.normalized_result.coverage
}, null, 2));
const empty = () => ({ items: [], total: 0, exhaustive: true, limitations: [] });
const result = {
  format: 'mach-o',
  selected_architecture: { name: 'x86_64', container_file_offset: null },
  endian: 'little', word_size: 64, file_type: 'dylib', flags: [], uuid: null,
  entrypoints: empty(), architectures: empty(), build_metadata: empty(),
  load_commands: empty(), dependencies: empty(), imports: empty(),
  exports: {
    items: [{ name: 'MessageBoxW', address: '0x1000', weak: false,
      reexport: false, source: 'nm' }],
    total: 1, exhaustive: true, limitations: []
  },
  segments: empty(), provenance: [], limitations: []
};

for (const [label, managedInput, module] of [
  ['absent', managed, null],
  ['matching', managed, 'user32.dll'],
  ['mismatch', managed, 'other.dll'],
  ['empty-managed', emptyManaged, 'user32.dll'],
  ['null-managed', nullManaged, 'user32.dll']
]) {
  const native = createEvidence(
    module === null ? undefined : {
      path: module, sha256: '9'.repeat(64), format: 'mach-o', architecture: 'x86_64'
    },
    { id: 'native-fixture', name: 'Native fixture', version: '1' },
    {
      operation: 'inspect_macho', predicateType: 'rea.analysis', parameters: {},
      result, rawResult: null, confidence: 'observed',
      subjectUnavailableReason: 'Fixture intentionally omits the subject identity'
    }
  );
  parseEvidence(native);
  const inputPath = `.repro/input-${label}.json`;
  writeFileSync(inputPath, JSON.stringify({
    managed_boundaries: managedInput, native_observations: [native]
  }, null, 2));
  const output = cli(['verify-managed-native-boundaries', inputPath]);
  writeFileSync(`.repro/output-${label}.json`, JSON.stringify(output, null, 2));
  const verification = output.normalized_result;
  const item = verification.pinvoke_imports[0];
  console.log(JSON.stringify({
    label, managed_scope: managedInput.normalized_result.pinvoke_imports[0].import_scope_name, summary: verification.summary,
    native_observations: verification.native_observations,
    status: item.status, basis: item.basis,
    module_name: item.matched_native?.module_name ?? null,
    module_path: item.matched_native?.module_path ?? null,
    limitations: item.limitations
  }, null, 2));
}
JS

Inspect the absent and empty-managed results and compare them with matching, mismatch, and null-managed. The empty managed fixture zeroes the two-byte ModuleRef Name index at the row offset discovered by the control inspection. The script also creates authenticated managed Evidence with an explicit null scope as a control, invokes the public verifier for all five inputs, and retains the returned Evidence locally.

Independent verification replayed the inline reproduction through the already installed and built checkout. The clean-checkout dependency installation and build commands above are preparation instructions; the verifier did not rerun them.

Expected behavior

A supplied export named MessageBoxW establishes a symbol-name candidate. Module comparison may establish a mismatch only when usable identities exist on both sides and disagree. With a declared user32.dll scope and absent native module identity, the candidate must preserve that uncertainty, avoid contradicted/module-mismatch, and avoid claiming a verified module link. With an empty managed scope and a present native identity, the result must preserve the raw empty observation or explicitly record missing scope, avoid a module contradiction, and include "Managed declaration does not name an import scope/module." as the null-scope control does. The contract permits subjectless Evidence and requires uncertainty to remain explicit; it does not require one particular result status for missing native identity.

AGENTS.md:19-21 requires preservation of omission and uncertainty and says unresolved identity must remain unknown rather than be treated as foreign or aligned. docs/managed-code-analysis.md:289-291 defines comparison of declared P/Invoke module and entry-point identities against supplied native Evidence. docs/managed-code-analysis.md:304-308 explicitly permits Evidence without a subject, supporting applicability to the subjectless native input.

Impact and scope

This is a P2 false analysis result for supported, authenticated inputs. It can mislead callers reviewing P/Invoke declaration links by turning missing identity into an asserted module disagreement. The reproduced scope is exact-name candidates with absent native module identity or an empty managed ModuleRef name. The probes establish no data loss or security-boundary crossing and do not establish severe failure of the product's primary workflows.

The matching-subject control demonstrates correct classification when a matching identity is supplied. No real native provider ran, so recovering a truthful module identity for affected callers remains an unverified workaround. No workaround preserving the empty-scope artifact and correct result was verified. Inventing a subject for genuinely unidentified Evidence would not preserve evidence integrity.

REA version

6.4.0 (main at 5830088520)

Runtime and platform

Node 26.10.0; macOS 27.0 arm64

Target and artifact context

A generated 4096-byte PE/CLI fixture with a MessageBoxW P/Invoke declaration for user32.dll, plus synthetic authenticated inspect_macho Evidence containing an exact-name export. The empty-scope fixture zeroes the two-byte ModuleRef Name index at row offset 998; only byte 998 changes because the next byte is already zero. An authenticated managed Evidence input with null import scope supplies the missing-scope control. No native engine, managed-code execution, or network is needed for the reproduction.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

The following is a reduced comparison of the observed CLI results, not an authenticated Evidence envelope.

Case           Managed scope  Native module  Status         Basis              Contradicted  No-scope limitation
absent         user32.dll     null           contradicted   module-mismatch    1             absent
empty-managed  ""             user32.dll     contradicted   module-mismatch    1             absent
matching       user32.dll     user32.dll     verified       exact-export-name  0             absent
mismatch       user32.dll     other.dll      contradicted   module-mismatch    1             absent
null-managed   null           user32.dll     verified       exact-export-name  0             present

Both failing cases and the known different-module control emit:
A symbol name candidate exists, but the supplied native Evidence module identity does not match the managed import scope.

The null-managed control emits:
Managed declaration does not name an import scope/module.

Typed outcome or recovery expected

Repeat all five inputs. The absent and empty-managed cases must return summary.contradicted: 0, avoid a module-mismatch basis, and omit the limitation asserting a mismatch. Missing native module identity must remain explicit without claiming a verified module link. Empty managed scope must preserve its raw observation or explicitly record missing scope, include the no-scope limitation, and avoid asserting that an observed managed module identity matches.

The null-scope control must retain explicit missing-scope reporting without a module contradiction. Known matching modules must continue to return verified/exact-export-name, and known different modules must continue to return contradicted/module-mismatch. The contract does not mandate one particular status for absent native module identity.

Analysis or suspected cause

Source-derived reasoning at baseline 58300885207133422af235e0f2b10658cf958b03 supports the reproduced result:

src/domain/managed/managedNativeVerificationMatch.ts:31-37 derives native module identity from the optional subject.
src/domain/managed/managedNativeVerificationMatch.ts:123-132 tests module compatibility with a boolean. Missing native identity produces no identity candidates, and an empty managed scope does not take the null-scope branch.
src/domain/managed/managedNativeVerificationMatch.ts:193-211 routes an exact-name candidate without module compatibility to contradicted/module-mismatch.
src/domain/managed/managedNativeVerificationMatch.ts:240-242 emits the no-scope limitation only for null. src/domain/managed/managedNativeVerificationMatch.ts:248-252 emits the mismatch assertion for contradicted results.
src/domain/managed/managedArtifact.ts:235 and src/domain/managed/managedArtifact.ts:248 accept the decoded empty module name and import scope.
src/cli/managedCommands.ts:195-211 reaches the authenticated public workflow. src/domain/managed/managedNativeVerificationSchemas.ts:96-127 accepts authenticated native Evidence without requiring a subject.

Static inspection of src/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.ts:82-85 shows that both unresolved and contradicted results can cause an unknown record. MCP execution was not run; this report concerns the false contradiction in the returned CLI result, not whether an unknown record is appropriate.

Additional context

P2 follows the independently verified, bounded false result. The evidence establishes neither severe harm nor failure of all primary analysis workflows. The absent-native and empty-managed cases share one closure condition: a module contradiction requires usable identities on both sides that actually disagree.

Originally created by @coygeek on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3201 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `verify-managed-native-boundaries` reports an exact-name P/Invoke symbol candidate as `contradicted/module-mismatch` when native Evidence omits its module identity or the managed ModuleRef name is an empty string. Both inputs pass authentication and public CLI validation. The empty managed scope also omits the missing-scope limitation that the null-scope control returns. Independent verification at the stated baseline ran both `inspect-managed-native-boundaries` inspections and all five verifier calls. Each exited 0 with `ok: true`. Each verification accepted one native observation containing one symbol. The absent-native and empty-managed cases both returned `summary.contradicted: 1` and `summary.unresolved: 0`, just like the control with a known different module. In the absent-native case, both `matched_native.module_name` and `matched_native.module_path` were null. Inspection of the byte-edited fixture returned `module_refs[0].name: ""`, `pinvoke_imports[0].import_scope_name: ""`, and complete parse coverage without issues. That coverage describes the parse; it does not establish a usable module identity. ### Reproduction 1. Start with a clean checkout of the stated baseline and prepare its locked dependencies and runtime using the repository's pinned development toolchain: ```sh npm ci npm run build:cached ``` 2. From the repository root, create the local fixture and verification inputs inline, then invoke both supported CLI commands. Use a supported Node.js runtime with TypeScript stripping, such as the observed runtime. The home and XDG directories below isolate CLI state. Run this in a disposable shell: ```sh mkdir -p .repro/home/config .repro/home/cache .repro/home/data export HOME="$PWD/.repro/home" export XDG_CONFIG_HOME="$HOME/config" export XDG_CACHE_HOME="$HOME/cache" export XDG_DATA_HOME="$HOME/data" node --input-type=module <<'JS' import { mkdirSync, writeFileSync } from 'node:fs'; import { spawnSync } from 'node:child_process'; import { buildManagedPeFixture } from './src/dotnet/ManagedPe.fixture.ts'; import { createEvidence, parseEvidence } from './dist/domain/evidence.js'; mkdirSync('.repro', { recursive: true }); const fixtureBytes = buildManagedPeFixture({ pinvoke: { moduleName: 'user32.dll', importName: 'MessageBoxW' } }); writeFileSync('.repro/fixture.dll', fixtureBytes); function cli(args) { const run = spawnSync(process.execPath, ['scripts/rea.mjs', ...args, '--format', 'json', '--full-output'], { encoding: 'utf8', env: process.env }); if (run.error) throw run.error; if (run.status !== 0) throw new Error(run.stderr || run.stdout); const envelope = JSON.parse(run.stdout); if (!envelope.ok) throw new Error(run.stdout); return envelope.data; } const managed = cli(['inspect-managed-native-boundaries', '.repro/fixture.dll']); const moduleRefOffset = managed.normalized_result.module_refs[0].row_offset; const emptyScopeBytes = Buffer.from(fixtureBytes); emptyScopeBytes.writeUInt16LE(0, moduleRefOffset); writeFileSync('.repro/empty-scope.dll', emptyScopeBytes); const emptyManaged = cli(['inspect-managed-native-boundaries', '.repro/empty-scope.dll']); const nullManaged = createEvidence(undefined, emptyManaged.provider, { operation: emptyManaged.operation, parameters: {}, result: { ...emptyManaged.normalized_result, pinvoke_imports: emptyManaged.normalized_result.pinvoke_imports.map(item => ({ ...item, import_scope_name: null })) }, rawResult: null }); parseEvidence(nullManaged); console.log(JSON.stringify({ module_ref_offset: moduleRefOffset, changed_byte_offsets: [...fixtureBytes.keys()].filter(i => fixtureBytes[i] !== emptyScopeBytes[i]), empty_module_name: emptyManaged.normalized_result.module_refs[0].name, empty_import_scope: emptyManaged.normalized_result.pinvoke_imports[0].import_scope_name, coverage: emptyManaged.normalized_result.coverage }, null, 2)); const empty = () => ({ items: [], total: 0, exhaustive: true, limitations: [] }); const result = { format: 'mach-o', selected_architecture: { name: 'x86_64', container_file_offset: null }, endian: 'little', word_size: 64, file_type: 'dylib', flags: [], uuid: null, entrypoints: empty(), architectures: empty(), build_metadata: empty(), load_commands: empty(), dependencies: empty(), imports: empty(), exports: { items: [{ name: 'MessageBoxW', address: '0x1000', weak: false, reexport: false, source: 'nm' }], total: 1, exhaustive: true, limitations: [] }, segments: empty(), provenance: [], limitations: [] }; for (const [label, managedInput, module] of [ ['absent', managed, null], ['matching', managed, 'user32.dll'], ['mismatch', managed, 'other.dll'], ['empty-managed', emptyManaged, 'user32.dll'], ['null-managed', nullManaged, 'user32.dll'] ]) { const native = createEvidence( module === null ? undefined : { path: module, sha256: '9'.repeat(64), format: 'mach-o', architecture: 'x86_64' }, { id: 'native-fixture', name: 'Native fixture', version: '1' }, { operation: 'inspect_macho', predicateType: 'rea.analysis', parameters: {}, result, rawResult: null, confidence: 'observed', subjectUnavailableReason: 'Fixture intentionally omits the subject identity' } ); parseEvidence(native); const inputPath = `.repro/input-${label}.json`; writeFileSync(inputPath, JSON.stringify({ managed_boundaries: managedInput, native_observations: [native] }, null, 2)); const output = cli(['verify-managed-native-boundaries', inputPath]); writeFileSync(`.repro/output-${label}.json`, JSON.stringify(output, null, 2)); const verification = output.normalized_result; const item = verification.pinvoke_imports[0]; console.log(JSON.stringify({ label, managed_scope: managedInput.normalized_result.pinvoke_imports[0].import_scope_name, summary: verification.summary, native_observations: verification.native_observations, status: item.status, basis: item.basis, module_name: item.matched_native?.module_name ?? null, module_path: item.matched_native?.module_path ?? null, limitations: item.limitations }, null, 2)); } JS ``` 3. Inspect the `absent` and `empty-managed` results and compare them with `matching`, `mismatch`, and `null-managed`. The empty managed fixture zeroes the two-byte ModuleRef Name index at the row offset discovered by the control inspection. The script also creates authenticated managed Evidence with an explicit null scope as a control, invokes the public verifier for all five inputs, and retains the returned Evidence locally. Independent verification replayed the inline reproduction through the already installed and built checkout. The clean-checkout dependency installation and build commands above are preparation instructions; the verifier did not rerun them. ### Expected behavior A supplied export named `MessageBoxW` establishes a symbol-name candidate. Module comparison may establish a mismatch only when usable identities exist on both sides and disagree. With a declared `user32.dll` scope and absent native module identity, the candidate must preserve that uncertainty, avoid `contradicted/module-mismatch`, and avoid claiming a verified module link. With an empty managed scope and a present native identity, the result must preserve the raw empty observation or explicitly record missing scope, avoid a module contradiction, and include "Managed declaration does not name an import scope/module." as the null-scope control does. The contract permits subjectless Evidence and requires uncertainty to remain explicit; it does not require one particular result status for missing native identity. `AGENTS.md:19-21` requires preservation of omission and uncertainty and says unresolved identity must remain unknown rather than be treated as foreign or aligned. `docs/managed-code-analysis.md:289-291` defines comparison of declared P/Invoke module and entry-point identities against supplied native Evidence. `docs/managed-code-analysis.md:304-308` explicitly permits Evidence without a subject, supporting applicability to the subjectless native input. ### Impact and scope This is a P2 false analysis result for supported, authenticated inputs. It can mislead callers reviewing P/Invoke declaration links by turning missing identity into an asserted module disagreement. The reproduced scope is exact-name candidates with absent native module identity or an empty managed ModuleRef name. The probes establish no data loss or security-boundary crossing and do not establish severe failure of the product's primary workflows. The matching-subject control demonstrates correct classification when a matching identity is supplied. No real native provider ran, so recovering a truthful module identity for affected callers remains an unverified workaround. No workaround preserving the empty-scope artifact and correct result was verified. Inventing a subject for genuinely unidentified Evidence would not preserve evidence integrity. ### REA version 6.4.0 (main at 58300885207133422af235e0f2b10658cf958b03) ### Runtime and platform Node 26.10.0; macOS 27.0 arm64 ### Target and artifact context A generated 4096-byte PE/CLI fixture with a `MessageBoxW` P/Invoke declaration for `user32.dll`, plus synthetic authenticated `inspect_macho` Evidence containing an exact-name export. The empty-scope fixture zeroes the two-byte ModuleRef Name index at row offset 998; only byte 998 changes because the next byte is already zero. An authenticated managed Evidence input with null import scope supplies the missing-scope control. No native engine, managed-code execution, or network is needed for the reproduction. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence The following is a reduced comparison of the observed CLI results, not an authenticated Evidence envelope. ```text Case Managed scope Native module Status Basis Contradicted No-scope limitation absent user32.dll null contradicted module-mismatch 1 absent empty-managed "" user32.dll contradicted module-mismatch 1 absent matching user32.dll user32.dll verified exact-export-name 0 absent mismatch user32.dll other.dll contradicted module-mismatch 1 absent null-managed null user32.dll verified exact-export-name 0 present Both failing cases and the known different-module control emit: A symbol name candidate exists, but the supplied native Evidence module identity does not match the managed import scope. The null-managed control emits: Managed declaration does not name an import scope/module. ``` ### Typed outcome or recovery expected Repeat all five inputs. The `absent` and `empty-managed` cases must return `summary.contradicted: 0`, avoid a `module-mismatch` basis, and omit the limitation asserting a mismatch. Missing native module identity must remain explicit without claiming a verified module link. Empty managed scope must preserve its raw observation or explicitly record missing scope, include the no-scope limitation, and avoid asserting that an observed managed module identity matches. The null-scope control must retain explicit missing-scope reporting without a module contradiction. Known matching modules must continue to return `verified/exact-export-name`, and known different modules must continue to return `contradicted/module-mismatch`. The contract does not mandate one particular status for absent native module identity. ### Analysis or suspected cause Source-derived reasoning at baseline `58300885207133422af235e0f2b10658cf958b03` supports the reproduced result: - `src/domain/managed/managedNativeVerificationMatch.ts:31-37` derives native module identity from the optional subject. - `src/domain/managed/managedNativeVerificationMatch.ts:123-132` tests module compatibility with a boolean. Missing native identity produces no identity candidates, and an empty managed scope does not take the null-scope branch. - `src/domain/managed/managedNativeVerificationMatch.ts:193-211` routes an exact-name candidate without module compatibility to `contradicted/module-mismatch`. - `src/domain/managed/managedNativeVerificationMatch.ts:240-242` emits the no-scope limitation only for null. `src/domain/managed/managedNativeVerificationMatch.ts:248-252` emits the mismatch assertion for contradicted results. - `src/domain/managed/managedArtifact.ts:235` and `src/domain/managed/managedArtifact.ts:248` accept the decoded empty module name and import scope. - `src/cli/managedCommands.ts:195-211` reaches the authenticated public workflow. `src/domain/managed/managedNativeVerificationSchemas.ts:96-127` accepts authenticated native Evidence without requiring a subject. Static inspection of `src/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.ts:82-85` shows that both unresolved and contradicted results can cause an unknown record. MCP execution was not run; this report concerns the false contradiction in the returned CLI result, not whether an unknown record is appropriate. ### Additional context P2 follows the independently verified, bounded false result. The evidence establishes neither severe harm nor failure of all primary analysis workflows. The absent-native and empty-managed cases share one closure condition: a module contradiction requires usable identities on both sides that actually disagree.

bsakaguchi

2026-10-15 18:31:25 +00:00

closed this issue
added the
bug
label

bsakaguchi commented

2026-10-15 18:31:27 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 14, 2026):

Heads up: this looks fixed on main in 3f6b5755b. The change is in src/domain/managed/managedNativeVerificationMatch.ts, and keeps name candidates unresolved when a required module identity is absent covers it. It is listed on tracker #3582. If it still happens on main, please say so here and I'll take it off the list.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 14, 2026): Heads up: this looks fixed on main in 3f6b5755b. The change is in `src/domain/managed/managedNativeVerificationMatch.ts`, and `keeps name candidates unresolved when a required module identity is absent` covers it. It is listed on tracker #3582. If it still happens on main, please say so here and I'll take it off the list. 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-15 18:31:27 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Resolved on main by 3f6b5755b.

Missing module identity remains unresolved instead of being reported as a proven module mismatch.

Rechecked on main b8510ee00 in the current focused run: 17 test files passed, 485 tests passed and one platform-dependent test skipped. Relevant regression coverage: tests/conformance/providers/managed/managedNativeVerification.test.ts.

@morluto commented on GitHub (Oct 14, 2026): Resolved on main by 3f6b5755b. Missing module identity remains unresolved instead of being reported as a proven module mismatch. Rechecked on main b8510ee00 in the current focused run: 17 test files passed, 485 tests passed and one platform-dependent test skipped. Relevant regression coverage: tests/conformance/providers/managed/managedNativeVerification.test.ts.

bsakaguchi referenced this issue

2026-10-17 21:08:54 +00:00

[PR #1138] [MERGED] fix(update): accept npm 12 release metadata #2674

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1138

No description provided.

Rows
Columns