[GH-ISSUE #196] evidence: skip missing configured roots instead of failing all evidence reads/writes #142

New issue

Closed

opened 2026-10-15 18:21:36 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:36 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/196

Problem

If any configured evidence root path is missing or inaccessible, evidence file operations can fail even when another configured root is valid.

Evidence

isApproved() resolves every configured root with realpath without catching ENOENT:

src/application/BoundedJsonFiles.ts:86

readBoundedJson() and writeBoundedText() both call isApproved() and treat any thrown error as an I/O error:

src/application/BoundedJsonFiles.ts:19
src/application/BoundedJsonFiles.ts:59

Current behavior:

Configure policy.roots = ["/valid/root", "/missing/root"]
Any read/write call hits isApproved
realpath("/missing/root") throws
readBoundedJson/writeBoundedText catch the thrown error and return EvidenceFileError(..., "io")
Operation fails even when /valid/root should have allowed the path.

Impact

A single stale or missing root entry effectively disables evidence persistence and retrieval, creating a single-point-of-failure configuration behavior.

Suggested fix

Handle missing roots by ignoring ENOENT per-root in isApproved, or validate roots at config load time and only include existing canonical roots. Ideally surface invalid-root configuration as a warning while keeping valid roots usable.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/196 ## Problem If any configured evidence root path is missing or inaccessible, evidence file operations can fail even when another configured root is valid. ## Evidence `isApproved()` resolves every configured root with `realpath` without catching ENOENT: - `src/application/BoundedJsonFiles.ts:86` `readBoundedJson()` and `writeBoundedText()` both call `isApproved()` and treat any thrown error as an I/O error: - `src/application/BoundedJsonFiles.ts:19` - `src/application/BoundedJsonFiles.ts:59` Current behavior: 1. Configure `policy.roots = ["/valid/root", "/missing/root"]` 2. Any read/write call hits `isApproved` 3. `realpath("/missing/root")` throws 4. `readBoundedJson`/`writeBoundedText` catch the thrown error and return `EvidenceFileError(..., "io")` 5. Operation fails even when `/valid/root` should have allowed the path. ## Impact A single stale or missing root entry effectively disables evidence persistence and retrieval, creating a single-point-of-failure configuration behavior. ## Suggested fix Handle missing roots by ignoring ENOENT per-root in `isApproved`, or validate roots at config load time and only include existing canonical roots. Ideally surface invalid-root configuration as a warning while keeping valid roots usable.

bsakaguchi

2026-10-15 18:21:36 +00:00