morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3951] [Bug] Canonical mobile application graph examples omit required inventory fields #1558

New issue

Closed

opened 2026-10-16 21:07:08 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:07:08 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3951

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

All four original examples were observed to exit 1 through the production CLI. The Android call returns this meaningful diagnostic:

{
  "code": "invalid_request",
  "category": "invalid_input",
  "details": {
    "operation": "project_android_application_graph",
    "issues": [
      {
        "path": [],
        "reason": "invalid_value",
        "message": "A nested value failed validation at integrity_contradictions: Invalid input: expected array, received undefined"
      },
      {
        "path": [],
        "reason": "invalid_value",
        "message": "A nested value failed validation at coverage: Invalid input: expected object, received undefined"
      }
    ]
  }
}

The outer canonical input schema accepts each original example. The nested inventory-result schema rejects it during execution. Direct evaluation of the advertised-example projection returns zero examples for each affected tool contract, and the existing advertised-example test passes all three tests despite these execution failures.

For controls, each example's inventory result received integrity_contradictions: [] and coverage: {"scope":"root","status":"complete"}, and its enclosing Evidence was regenerated. All four controls were observed to exit 0 and return the matching projection Evidence. Existing graph and manifest digests remained unchanged. The controls correctly return partial projection coverage because they cover the root rather than container entries. An Android control with coverage status invalid still exits 1 with a coverage-status diagnostic.

Reproduction

Use the baseline checkout and its built runtime. From the repository root, emit the Android canonical example into a shell variable and submit it as the documented inline JSON argument:

example="$(node --input-type=module -e 'import {ANDROID_APPLICATION_GRAPH_EXAMPLE} from "./dist/contracts/mobileApplicationGraphExamples.js"; process.stdout.write(JSON.stringify(ANDROID_APPLICATION_GRAPH_EXAMPLE));')"
node scripts/rea.mjs project-android-application-graph "$example" --format json

This inline call was executed and exits 1. The same example was also submitted as a JSON file, with the same result. The other three canonical examples were independently submitted as JSON files to their matching CLI commands and failed identically:

APPLE_APPLICATION_GRAPH_EXAMPLE with project-apple-application-graph.
MACOS_APPLICATION_GRAPH_EXAMPLE with project-apple-application-graph.
HARMONY_APPLICATION_GRAPH_EXAMPLE with project-harmony-application-graph.

To reproduce each additional variant, substitute its export name and command into the two commands above. These examples do not require the named fixture artifacts to exist because the projection consumes supplied Evidence without opening those paths.

Expected behavior

Each canonical tool example should be a valid request that the matching projection operation can execute. Current inventory Evidence must include explicit producer-owned coverage and an integrity-contradiction list. A caller supplying a canonical example should receive projection Evidence whose completeness and limitations reflect the example's actual inventory scope.

Impact and scope

Consumers copying any of the four canonical examples encounter an input failure instead of the documented projection. The failure is bounded to these examples, which are omitted from MCP schema advertising; successful corrected controls show that the projection commands remain usable.

Workaround: Supply complete inventory Evidence. Controls that add the two missing fields and regenerate the enclosing Evidence succeeded for all four variants without changing graph or manifest digests, demonstrating a safe workaround for these examples while preserving coverage validation.

REA version

rea 6.5.0 at source commit 4692bb3330; current-main source checked at 22ec8bdb2f

Runtime and platform

Node 24.18.0; macOS arm64

Target and artifact context

Four canonical inventory-projection inputs for Android, IPA, macOS app directories and Harmony, attached to three tool contracts; no actual target files are opened.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

src/contracts/toolContractTypes.ts:15-19 defines validated examples; docs/mcp-contracts.md:41-44,673-678 requires explicit inventory coverage while retaining inline canonical examples. src/domain/artifactGraph.ts:190-208 requires integrity_contradictions and coverage. src/contracts/mobileApplicationGraphExamples.ts:54-76 omits both fields, and src/contracts/applicationToolContracts.ts:270-319 attaches the examples. src/domain/artifactInventoryEvidence.ts:59-78,161-183 rejects the nested result. All four production CLI inputs failed; schema-complete authenticated controls all succeeded.

Typed outcome or recovery expected

Each canonical example should execute through its corresponding CLI and return valid projection Evidence. Keep malformed or unsupported coverage rejected, and preserve partial projection scope for root-only inventories.

Analysis or suspected cause

Source-derived: the outer schema accepts the examples, but nested inventory-result validation rejects them during projection. src/contracts/advertisedInputExamples.ts:54-74 filters these inline-Evidence examples out of MCP advertising, so the advertised-example test does not execute them.

Additional context

These are canonical examples, not examples published in tools/list. IPA and macOS share the Apple projection tool. Corrected controls added integrity_contradictions: [] and coverage: {scope: "root", status: "complete"}, then regenerated only enclosing Evidence IDs. Graph and manifest digests remained unchanged.

Freshness check: the failing source is unchanged on current upstream main at 22ec8bdb2f. The only change among the cited files is unrelated CLI output-flag normalization. Runtime observations above are from the stated baseline; current-main persistence is source-derived.

Originally created by @coygeek on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3951 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior All four original examples were observed to exit 1 through the production CLI. The Android call returns this meaningful diagnostic: ```json { "code": "invalid_request", "category": "invalid_input", "details": { "operation": "project_android_application_graph", "issues": [ { "path": [], "reason": "invalid_value", "message": "A nested value failed validation at integrity_contradictions: Invalid input: expected array, received undefined" }, { "path": [], "reason": "invalid_value", "message": "A nested value failed validation at coverage: Invalid input: expected object, received undefined" } ] } } ``` The outer canonical input schema accepts each original example. The nested inventory-result schema rejects it during execution. Direct evaluation of the advertised-example projection returns zero examples for each affected tool contract, and the existing advertised-example test passes all three tests despite these execution failures. For controls, each example's inventory result received `integrity_contradictions: []` and `coverage: {"scope":"root","status":"complete"}`, and its enclosing Evidence was regenerated. All four controls were observed to exit 0 and return the matching projection Evidence. Existing graph and manifest digests remained unchanged. The controls correctly return partial projection coverage because they cover the root rather than container entries. An Android control with coverage status `invalid` still exits 1 with a coverage-status diagnostic. ### Reproduction Use the baseline checkout and its built runtime. From the repository root, emit the Android canonical example into a shell variable and submit it as the documented inline JSON argument: ```sh example="$(node --input-type=module -e 'import {ANDROID_APPLICATION_GRAPH_EXAMPLE} from "./dist/contracts/mobileApplicationGraphExamples.js"; process.stdout.write(JSON.stringify(ANDROID_APPLICATION_GRAPH_EXAMPLE));')" node scripts/rea.mjs project-android-application-graph "$example" --format json ``` This inline call was executed and exits 1. The same example was also submitted as a JSON file, with the same result. The other three canonical examples were independently submitted as JSON files to their matching CLI commands and failed identically: - `APPLE_APPLICATION_GRAPH_EXAMPLE` with `project-apple-application-graph`. - `MACOS_APPLICATION_GRAPH_EXAMPLE` with `project-apple-application-graph`. - `HARMONY_APPLICATION_GRAPH_EXAMPLE` with `project-harmony-application-graph`. To reproduce each additional variant, substitute its export name and command into the two commands above. These examples do not require the named fixture artifacts to exist because the projection consumes supplied Evidence without opening those paths. ### Expected behavior Each canonical tool example should be a valid request that the matching projection operation can execute. Current inventory Evidence must include explicit producer-owned coverage and an integrity-contradiction list. A caller supplying a canonical example should receive projection Evidence whose completeness and limitations reflect the example's actual inventory scope. ### Impact and scope Consumers copying any of the four canonical examples encounter an input failure instead of the documented projection. The failure is bounded to these examples, which are omitted from MCP schema advertising; successful corrected controls show that the projection commands remain usable. Workaround: Supply complete inventory Evidence. Controls that add the two missing fields and regenerate the enclosing Evidence succeeded for all four variants without changing graph or manifest digests, demonstrating a safe workaround for these examples while preserving coverage validation. ### REA version rea 6.5.0 at source commit 4692bb33300c7cb77b095b6cc0c33da861c1b860; current-main source checked at 22ec8bdb2f7d4626587f23b1eed4a207df600386 ### Runtime and platform Node 24.18.0; macOS arm64 ### Target and artifact context Four canonical inventory-projection inputs for Android, IPA, macOS app directories and Harmony, attached to three tool contracts; no actual target files are opened. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence `src/contracts/toolContractTypes.ts:15-19` defines validated examples; `docs/mcp-contracts.md:41-44,673-678` requires explicit inventory coverage while retaining inline canonical examples. `src/domain/artifactGraph.ts:190-208` requires integrity_contradictions and coverage. `src/contracts/mobileApplicationGraphExamples.ts:54-76` omits both fields, and `src/contracts/applicationToolContracts.ts:270-319` attaches the examples. `src/domain/artifactInventoryEvidence.ts:59-78,161-183` rejects the nested result. All four production CLI inputs failed; schema-complete authenticated controls all succeeded. ### Typed outcome or recovery expected Each canonical example should execute through its corresponding CLI and return valid projection Evidence. Keep malformed or unsupported coverage rejected, and preserve partial projection scope for root-only inventories. ### Analysis or suspected cause Source-derived: the outer schema accepts the examples, but nested inventory-result validation rejects them during projection. `src/contracts/advertisedInputExamples.ts:54-74` filters these inline-Evidence examples out of MCP advertising, so the advertised-example test does not execute them. ### Additional context These are canonical examples, not examples published in tools/list. IPA and macOS share the Apple projection tool. Corrected controls added integrity_contradictions: [] and coverage: {scope: "root", status: "complete"}, then regenerated only enclosing Evidence IDs. Graph and manifest digests remained unchanged. Freshness check: the failing source is unchanged on current upstream main at 22ec8bdb2f7d4626587f23b1eed4a207df600386. The only change among the cited files is unrelated CLI output-flag normalization. Runtime observations above are from the stated baseline; current-main persistence is source-derived.

bsakaguchi commented

2026-10-16 21:07:09 +00:00

Author

Owner

@z2Ace0107 commented on GitHub (Oct 15, 2026):

I'd like to take this on. On Windows with pinned Node 24.18.0/npm 11.16.0, all four canonical mobile application graph examples fail through the public CLI because the nested inventory result lacks integrity_contradictions and coverage. Temporary controls with those fields and regenerated Evidence succeed for all four examples. I'll update the canonical examples and add execution-based regression coverage, preserving root-only projection limitations.

@z2Ace0107 commented on GitHub (Oct 15, 2026): I'd like to take this on. On Windows with pinned Node 24.18.0/npm 11.16.0, all four canonical mobile application graph examples fail through the public CLI because the nested inventory result lacks integrity_contradictions and coverage. Temporary controls with those fields and regenerated Evidence succeed for all four examples. I'll update the canonical examples and add execution-based regression coverage, preserving root-only projection limitations.

bsakaguchi referenced this issue

2026-10-17 21:01:20 +00:00

[GH-ISSUE #1558] [Feature] Java Reverse Engineering #525

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

~~bsakaguchi referenced this issue 2026-10-17 21:01:59 +00:00~~

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

bsakaguchi closed this issue

2026-10-17 21:02:14 +00:00

bsakaguchi referenced this issue

2026-10-17 21:03:46 +00:00