[PR #585] [MERGED] fix(mcp): return complete inline Evidence records #2085

New issue

Closed

opened 2026-10-16 21:14:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:14:04 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/585
Author: @N0zoM1z0
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/mcp-inline-evidence

📝 Commits (3)

d28841e fix(mcp): return complete inline Evidence records
3651466 chore: sync main for inline Evidence review
f9af94e chore: sync package verification from main

📊 Changes

12 files changed (+253 additions, -31 deletions)

View changed files

📝 docs/mcp-contracts.md (+7 -2)
📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 scripts/lib/native-value-e2e.mjs (+70 -6)
📝 scripts/verify-package-mcp.mjs (+74 -2)
📝 scripts/verify-package.mjs (+2 -1)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 src/contracts/toolOutputSchemaPrimitives.ts (+1 -3)
📝 src/generatedMcpToolCatalog.ts (+1 -1)
📝 src/server/toolResult.ts (+6 -10)
➕ tests/boundary/mcp/inlineEvidenceCompositionMcp.test.ts (+49 -0)
📝 tests/boundary/mcp/toolResult.test.ts (+38 -1)

📄 Description

Summary

Closes #551.

Return the complete canonical Evidence record inline, including normalized_result, in both MCP text and structured content.
Use the canonical envelope schema for inline Evidence so producer outputs satisfy existing Evidence consumer contracts.
Preserve the convenience result and evidence_id fields. Regenerate catalog metadata and document direct tool composition.
Add fail-before regression coverage for canonical round trips, missing fields, null/falsy/array results, direct function comparison, and session bundle equality.
Extend installed-package artifact verification and real Ghidra CLI/MCP verification to consume returned Evidence directly.
Package setup support was corrected independently in upstream #584 during validation; the final PR uses that upstream implementation and contains no duplicate setup change.

MCP example

const analyzed = await client.callTool({
  name: "analyze_function",
  arguments: { procedure: "fixture_main" },
});
const source = analyzed.structuredContent.evidence;
// source.normalized_result equals analyzed.structuredContent.result.
const compared = await client.callTool({
  name: "compare_functions",
  arguments: { left: source, right: source },
});

inspect_artifact Evidence can likewise be passed directly to compare_artifacts. The returned records match the corresponding session bundle records.

Verification

npm run check:pr: 350 files passed; 1,978 tests passed, 1 existing skip. Full run uses process-local single CPU affinity to keep existing startup tests within their unchanged deadlines.
npm run check:ci: all 7 tasks passed.
npm run docs:generate, generated-document checks, and commit formatting/lint hooks passed.
node scripts/verify-real-ghidra.mjs: real Linux x64 Ghidra 12.1.4/JDK 21 host-format verification passed, including actual CLI/stdio MCP direct Evidence handoff. Existing switch oracle still recovers 40 cases and the default, with no switch residual unknowns.
Fresh final tarball, independently installed without lifecycle scripts: real Ghidra CLI/MCP trace parity and direct analyze_function Evidence → compare_functions → exact bundle-record equality passed; input unchanged. Trace: 165 nodes, 296 edges, 7 decompilations; 1 existing alias unknown retained.
env -u GHIDRA_INSTALL_DIR TMPDIR=/tmp node scripts/verify-package.mjs after the verified build: passed complete installed CLI/MCP, artifact handoff, 4-client setup/idempotence/backup/recovery/symlink checks, and exact-version update/read-only maintenance. Full 116-tool catalog available in ~2.9 seconds.
Final tarball: 696 entries, 945,584 bytes; required runtime/bridge entrypoints present, private/binary fixture inputs excluded. Critical shipped modules match the checked build.
Additional private local acceptance: 3 owned samples passed direct canonical Evidence parsing/comparison and input/cleanup checks. Their Ghidra/Evidence module bytes match the final artifact; no private inputs, identifiers, captures, or test code are included here.

Fail-before regression run: 8 failures out of 10 tests; after the fix: 10/10 passed. An initial full-run timeout in an unchanged 15-second runtime test was isolated and re-run, followed by clean full-suite runs. No deadlines or assertions were loosened.

After main added #538, resolved all four generated-file conflicts by regeneration. Incremental validation: 37/37 focused Evidence + semantic-scope tests, all four catalog/skill/product/ledger checks, and commit hooks passed. Earlier complete gate/package/Ghidra evidence above is retained; final exact-head GitHub CI is checked before merge. After upstream #584, adopted its setup support helper and removed the duplicated verifier fix; 26/26 targeted setup-support + Evidence tests passed. Final PR delta is 12 files.

Coverage

Real provider claims are limited to Linux x64 Ghidra 12.1.4 with JDK 21. The package smoke lane uses its existing controlled Hopper seam; no real Hopper, macOS, or Windows host verification is claimed. Public fixtures are generated from generic repository source.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/585 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/mcp-inline-evidence` --- ### 📝 Commits (3) - [`d28841e`](https://github.com/morluto/rea/commit/d28841e36aac67b9d07f039d6939156f4a8883f1) fix(mcp): return complete inline Evidence records - [`3651466`](https://github.com/morluto/rea/commit/3651466e07d709b25c2af6d2cefa3a83450c5387) chore: sync main for inline Evidence review - [`f9af94e`](https://github.com/morluto/rea/commit/f9af94eb0c1c9eb99dfe14369a0bccc7ed645e5f) chore: sync package verification from main ### 📊 Changes **12 files changed** (+253 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `docs/mcp-contracts.md` (+7 -2) 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `scripts/lib/native-value-e2e.mjs` (+70 -6) 📝 `scripts/verify-package-mcp.mjs` (+74 -2) 📝 `scripts/verify-package.mjs` (+2 -1) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `src/contracts/toolOutputSchemaPrimitives.ts` (+1 -3) 📝 `src/generatedMcpToolCatalog.ts` (+1 -1) 📝 `src/server/toolResult.ts` (+6 -10) ➕ `tests/boundary/mcp/inlineEvidenceCompositionMcp.test.ts` (+49 -0) 📝 `tests/boundary/mcp/toolResult.test.ts` (+38 -1) </details> ### 📄 Description ## Summary Closes #551. - Return the complete canonical Evidence record inline, including `normalized_result`, in both MCP text and structured content. - Use the canonical envelope schema for inline Evidence so producer outputs satisfy existing Evidence consumer contracts. - Preserve the convenience `result` and `evidence_id` fields. Regenerate catalog metadata and document direct tool composition. - Add fail-before regression coverage for canonical round trips, missing fields, null/falsy/array results, direct function comparison, and session bundle equality. - Extend installed-package artifact verification and real Ghidra CLI/MCP verification to consume returned Evidence directly. - Package setup support was corrected independently in upstream #584 during validation; the final PR uses that upstream implementation and contains no duplicate setup change. ## MCP example ```js const analyzed = await client.callTool({ name: "analyze_function", arguments: { procedure: "fixture_main" }, }); const source = analyzed.structuredContent.evidence; // source.normalized_result equals analyzed.structuredContent.result. const compared = await client.callTool({ name: "compare_functions", arguments: { left: source, right: source }, }); ``` `inspect_artifact` Evidence can likewise be passed directly to `compare_artifacts`. The returned records match the corresponding session bundle records. ## Verification - `npm run check:pr`: **350 files passed; 1,978 tests passed, 1 existing skip**. Full run uses process-local single CPU affinity to keep existing startup tests within their unchanged deadlines. - `npm run check:ci`: all 7 tasks passed. - `npm run docs:generate`, generated-document checks, and commit formatting/lint hooks passed. - `node scripts/verify-real-ghidra.mjs`: real Linux x64 Ghidra 12.1.4/JDK 21 host-format verification passed, including actual CLI/stdio MCP direct Evidence handoff. Existing switch oracle still recovers 40 cases and the default, with no switch residual unknowns. - Fresh final tarball, independently installed without lifecycle scripts: real Ghidra CLI/MCP trace parity and direct `analyze_function` Evidence → `compare_functions` → exact bundle-record equality passed; input unchanged. Trace: 165 nodes, 296 edges, 7 decompilations; 1 existing alias unknown retained. - `env -u GHIDRA_INSTALL_DIR TMPDIR=/tmp node scripts/verify-package.mjs` after the verified build: passed complete installed CLI/MCP, artifact handoff, 4-client setup/idempotence/backup/recovery/symlink checks, and exact-version update/read-only maintenance. Full 116-tool catalog available in ~2.9 seconds. - Final tarball: 696 entries, 945,584 bytes; required runtime/bridge entrypoints present, private/binary fixture inputs excluded. Critical shipped modules match the checked build. - Additional private local acceptance: 3 owned samples passed direct canonical Evidence parsing/comparison and input/cleanup checks. Their Ghidra/Evidence module bytes match the final artifact; no private inputs, identifiers, captures, or test code are included here. Fail-before regression run: **8 failures out of 10 tests**; after the fix: **10/10 passed**. An initial full-run timeout in an unchanged 15-second runtime test was isolated and re-run, followed by clean full-suite runs. No deadlines or assertions were loosened. After main added #538, resolved all four generated-file conflicts by regeneration. Incremental validation: **37/37 focused Evidence + semantic-scope tests**, all four catalog/skill/product/ledger checks, and commit hooks passed. Earlier complete gate/package/Ghidra evidence above is retained; final exact-head GitHub CI is checked before merge. After upstream #584, adopted its setup support helper and removed the duplicated verifier fix; **26/26 targeted setup-support + Evidence tests passed**. Final PR delta is 12 files. ## Coverage Real provider claims are limited to Linux x64 Ghidra 12.1.4 with JDK 21. The package smoke lane uses its existing controlled Hopper seam; no real Hopper, macOS, or Windows host verification is claimed. Public fixtures are generated from generic repository source. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:14:04 +00:00