[GH-ISSUE #198] fix(application): make policy-root canonicalization resilient to missing roots #143

New issue

Closed

opened 2026-10-15 18:21:36 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:36 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/198

Problem

In process-capture authority checks and artifact inventory authorization, a single stale configured root can make the whole operation fail, even when valid roots still authorize the requested path.

Evidence

Process capture

src/application/ProcessCaptureAuthority.ts

Promise.all(policy.executableRoots.map((root) => realpath(root)))
Promise.all(policy.workingRoots.map((root) => realpath(root)))
const resolvedRoot = await realpath(root) for each requested filesystem root

Artifact inventory

src/application/AuthorizedArtifactInventory.ts

Promise.all([realpath(inputPath), Promise.all(roots.map(async (root) => realpath(root)))])

No missing-root filtering or explicit policy validation is done before these canonicalizations.

Impact

A non-existent configured executable/working root in policy can reject process captures with a generic IO-like error before policy evaluation runs.
A non-existent configured artifact input root causes scanAuthorizedArtifactInventory to fail before a clear "outside-root" authorization decision.
Remediation for operators is to restart and repair policy lists, which may be unrelated to the current requested operation.

Reproduction sketch

Configure policy-like state with one missing root plus one valid root.
Run compare-artifact-versions (or any workflow that uses scanAuthorizedArtifactInventory) where both candidate artifacts are under the valid root.
Observe the run fail before scan due root resolution instead of being authorized by the valid root.

Same for process capture: set a valid executable path and working directory under an existing root, but include an additional missing entry in REA_PROCESS_EXECUTABLE_ROOTS_JSON or REA_PROCESS_WORKING_ROOTS_JSON.

Suggested fix

Canonicalize configured roots by filtering ENOENT/missing entries and report clear configuration diagnostics once when a configured root cannot be resolved.
For missing roots, continue evaluation against remaining roots when possible so operation authorization still works.
Return consistent typed errors for policy-configuration failures instead of generic IO behavior.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/198 ## Problem In process-capture authority checks and artifact inventory authorization, a single stale configured root can make the whole operation fail, even when valid roots still authorize the requested path. ## Evidence ### Process capture `src/application/ProcessCaptureAuthority.ts` - `Promise.all(policy.executableRoots.map((root) => realpath(root)))` - `Promise.all(policy.workingRoots.map((root) => realpath(root)))` - `const resolvedRoot = await realpath(root)` for each requested filesystem root ### Artifact inventory `src/application/AuthorizedArtifactInventory.ts` - `Promise.all([realpath(inputPath), Promise.all(roots.map(async (root) => realpath(root)))])` No missing-root filtering or explicit policy validation is done before these canonicalizations. ## Impact - A non-existent configured executable/working root in policy can reject process captures with a generic IO-like error before policy evaluation runs. - A non-existent configured artifact input root causes `scanAuthorizedArtifactInventory` to fail before a clear "outside-root" authorization decision. - Remediation for operators is to restart and repair policy lists, which may be unrelated to the current requested operation. ## Reproduction sketch 1. Configure policy-like state with one missing root plus one valid root. 2. Run `compare-artifact-versions` (or any workflow that uses `scanAuthorizedArtifactInventory`) where both candidate artifacts are under the valid root. 3. Observe the run fail before scan due root resolution instead of being authorized by the valid root. Same for process capture: set a valid executable path and working directory under an existing root, but include an additional missing entry in `REA_PROCESS_EXECUTABLE_ROOTS_JSON` or `REA_PROCESS_WORKING_ROOTS_JSON`. ## Suggested fix - Canonicalize configured roots by filtering ENOENT/missing entries and report clear configuration diagnostics once when a configured root cannot be resolved. - For missing roots, continue evaluation against remaining roots when possible so operation authorization still works. - Return consistent typed errors for policy-configuration failures instead of generic IO behavior.

bsakaguchi

2026-10-15 18:21:36 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:11:48 +00:00

[PR #203] [MERGED] fix: resolve triaged correctness issues #1854

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#143

No description provided.

Rows
Columns