morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #274] [MERGED] feat(mcp)!: harden contracts and Evidence references #1918

New issue

Closed

opened 2026-10-16 21:12:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/274
Author: @morluto
Created: 7/16/2026
Status: ✅ Merged
Merged: 7/16/2026
Merged by: @morluto

Base: main ← Head: codex/rea-2-mcp-contract-hardening

📝 Commits (10+)

ad398a1 chore(deps): detect stale direct dependency installs
ee1cd40 feat(mcp)!: harden contracts and evidence references
8de25d0 test(mcp): cover strict compact wire contracts
b2d1f2a feat(setup): verify installed skill catalog identity
f23f529 fix(test): make host fixtures portable
8a1c128 fix(deps): run freshness check from escaped paths
d1e7220 fix(mcp): align runtime unknown argument validation
37c0f39 fix(mcp): parse adapter inputs exactly once
6e6827c test(hopper): avoid scheduler-sensitive exit timing
9c4a93d fix(mcp): integrate managed contracts after rebase

📊 Changes

325 files changed (+5065 additions, -2045 deletions)

View changed files

📝 .github/pull_request_template.md (+1 -1)
📝 AGENTS.md (+7 -4)
📝 CONTRIBUTING.md (+2 -2)
📝 README.md (+15 -15)
📝 README_ar.md (+15 -15)
📝 README_ja.md (+15 -15)
📝 README_ko.md (+15 -15)
📝 README_zh.md (+15 -15)
📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
📝 docs/api/classes/application_EnhancedTools.EnhancedTools.html (+24 -7)
📝 docs/api/classes/application_PermissionAuthority.PermissionPathError.html (+1 -1)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisCancelledError.html (+5 -5)
📝 docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html (+7 -7)
📝 docs/api/classes/domain_errors.AnalysisError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisInputError.html (+11 -4)
📝 docs/api/classes/domain_errors.AnalysisOutputError.html (+6 -6)

...and 80 more files

📄 Description

Summary

add a network-free direct-dependency freshness gate before builds, checks, packing, and publication
make all 88 MCP contracts strict and self-describing with canonical effect-derived annotations
project safe actionable validation issues through MCP and CLI-compatible error envelopes
replace authoritative embedded Evidence inputs with session-owned references and compact structured results
align installed skill identity with generated version, tool count, and catalog digest metadata
keep complete schemas while preferring capability- and session-scoped tool advertisement over schema truncation

Root cause and implementation

SDK prevalidation produced text-only failures, runtime and advertised object closure could drift, side-effect hints were distributed across contract declarations, and several comparison workflows accepted caller-owned Evidence payloads. Dependency and installed-skill drift were also not checked against canonical local identity.

REA now owns one typed validation boundary, derives wire metadata from ToolEffects, resolves Evidence IDs against the session ledger with operation and predicate checks, serializes text exactly from structured content, and exposes immutable Evidence through resource links. Managed workflows added on current main were integrated into the same reference and capability model and are hidden when no session ledger exists.

This is a breaking contract release and includes BREAKING CHANGE metadata for Release Please.

Verification

npm run check — 138 files, 955 tests passed
npm run knip
npm run jscpd
npm run verify:package — isolated package, 88 MCP tools and 6 prompts
Codex autoreview — dependency-path, schema-closure, sessionless-registration, and byte-gate-removal commits reviewed clean

Real Hopper, Ghidra, browser, and replay verification was not run because provider operation behavior was not changed.

Closes #261
Closes #264
Closes #265
Closes #266
Refs #24
Refs #101

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/274 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/16/2026 **Status:** ✅ Merged **Merged:** 7/16/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/rea-2-mcp-contract-hardening` --- ### 📝 Commits (10+) - [`ad398a1`](https://github.com/morluto/rea/commit/ad398a17f551f976a5ed45ef1698fe473bc117ea) chore(deps): detect stale direct dependency installs - [`ee1cd40`](https://github.com/morluto/rea/commit/ee1cd40405405097b9d5f9686cbcc765ab03d96a) feat(mcp)!: harden contracts and evidence references - [`8de25d0`](https://github.com/morluto/rea/commit/8de25d02302e7a03c1a0c6ab19ccb459758973ca) test(mcp): cover strict compact wire contracts - [`b2d1f2a`](https://github.com/morluto/rea/commit/b2d1f2affdc7faa0e1c56feefe596eb39dea0612) feat(setup): verify installed skill catalog identity - [`f23f529`](https://github.com/morluto/rea/commit/f23f52903cb6df4eed6fec0e09f79c82ad9825dc) fix(test): make host fixtures portable - [`8a1c128`](https://github.com/morluto/rea/commit/8a1c128b67ee41ce054fe984946a5d7bfcc1a3b4) fix(deps): run freshness check from escaped paths - [`d1e7220`](https://github.com/morluto/rea/commit/d1e72207f48609e3214a66c2a248c70a2a1abd6c) fix(mcp): align runtime unknown argument validation - [`37c0f39`](https://github.com/morluto/rea/commit/37c0f399544c9424c55e468d6784da61426a458e) fix(mcp): parse adapter inputs exactly once - [`6e6827c`](https://github.com/morluto/rea/commit/6e6827cd76fc080a959695ab19bfcc34b80c270c) test(hopper): avoid scheduler-sensitive exit timing - [`9c4a93d`](https://github.com/morluto/rea/commit/9c4a93d9b1be36155bd9c0a39d8b541ec3986c64) fix(mcp): integrate managed contracts after rebase ### 📊 Changes **325 files changed** (+5065 additions, -2045 deletions) <details> <summary>View changed files</summary> 📝 `.github/pull_request_template.md` (+1 -1) 📝 `AGENTS.md` (+7 -4) 📝 `CONTRIBUTING.md` (+2 -2) 📝 `README.md` (+15 -15) 📝 `README_ar.md` (+15 -15) 📝 `README_ja.md` (+15 -15) 📝 `README_ko.md` (+15 -15) 📝 `README_zh.md` (+15 -15) 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) 📝 `docs/api/classes/application_EnhancedTools.EnhancedTools.html` (+24 -7) 📝 `docs/api/classes/application_PermissionAuthority.PermissionPathError.html` (+1 -1) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisCancelledError.html` (+5 -5) 📝 `docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html` (+7 -7) 📝 `docs/api/classes/domain_errors.AnalysisError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisInputError.html` (+11 -4) 📝 `docs/api/classes/domain_errors.AnalysisOutputError.html` (+6 -6) _...and 80 more files_ </details> ### 📄 Description ## Summary - add a network-free direct-dependency freshness gate before builds, checks, packing, and publication - make all 88 MCP contracts strict and self-describing with canonical effect-derived annotations - project safe actionable validation issues through MCP and CLI-compatible error envelopes - replace authoritative embedded Evidence inputs with session-owned references and compact structured results - align installed skill identity with generated version, tool count, and catalog digest metadata - keep complete schemas while preferring capability- and session-scoped tool advertisement over schema truncation ## Root cause and implementation SDK prevalidation produced text-only failures, runtime and advertised object closure could drift, side-effect hints were distributed across contract declarations, and several comparison workflows accepted caller-owned Evidence payloads. Dependency and installed-skill drift were also not checked against canonical local identity. REA now owns one typed validation boundary, derives wire metadata from ToolEffects, resolves Evidence IDs against the session ledger with operation and predicate checks, serializes text exactly from structured content, and exposes immutable Evidence through resource links. Managed workflows added on current main were integrated into the same reference and capability model and are hidden when no session ledger exists. This is a breaking contract release and includes BREAKING CHANGE metadata for Release Please. ## Verification - npm run check — 138 files, 955 tests passed - npm run knip - npm run jscpd - npm run verify:package — isolated package, 88 MCP tools and 6 prompts - Codex autoreview — dependency-path, schema-closure, sessionless-registration, and byte-gate-removal commits reviewed clean Real Hopper, Ghidra, browser, and replay verification was not run because provider operation behavior was not changed. Closes #261 Closes #264 Closes #265 Closes #266 Refs #24 Refs #101 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:29 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:56:39 +00:00

[PR #1918] [CLOSED] test(contracts): audit static WASM and Harmony wording #4908

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1918

No description provided.

Rows
Columns