morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #734] [MERGED] feat(evidence): accept exact retained application references #2204

New issue

Closed

opened 2026-10-16 21:15:37 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:37 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/734
Author: @N0zoM1z0
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/722-retained-evidence-references

📝 Commits (3)

f12e4c1 feat(evidence): accept exact retained application references
91409e2 chore: merge main into retained evidence references
c3e54db chore: synchronize retained references with current main

📊 Changes

21 files changed (+569 additions, -36 deletions)

View changed files

📝 docs/mcp-contracts.md (+41 -0)
📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 skills/reverse-engineer-anything/references/javascript-applications.md (+11 -0)
➕ src/application/EvidenceInputResolver.test.ts (+80 -0)
➕ src/application/EvidenceInputResolver.ts (+70 -0)
📝 src/contracts/applicationToolContracts.ts (+42 -5)
📝 src/contracts/applicationWorkflowInputContracts.ts (+13 -13)
➕ src/contracts/evidenceInputContracts.ts (+18 -0)
📝 src/domain/analysisErrorPresentation.ts (+11 -1)
📝 src/domain/evidenceErrors.ts (+5 -1)
📝 src/generatedMcpToolCatalog.ts (+1 -1)
📝 src/server/createServer.ts (+13 -2)
📝 src/server/registerApplicationTools/compareExportShapes.ts (+7 -1)
📝 src/server/registerApplicationTools/compareSourceToBundle.ts (+9 -2)
📝 src/server/registerApplicationTools/compareVersions.ts (+7 -1)
📝 src/server/registerApplicationTools/traceFeature.ts (+9 -2)
📝 src/server/registerApplicationTools/traceSemantics.ts (+9 -2)
📝 src/server/registerApplicationTools/types.ts (+1 -0)

...and 1 more files

📄 Description

Summary

Fixes #722. Application follow-ups can use {kind: "retained-evidence", evidence_id: "ev_<digest>"} instead of retransmitting complete Evidence already retained on the same MCP connection. Complete portable inline inputs remain supported, and results remain inline.

Problem and expected behavior

A small JS application produced approximately 180 KB of analysis Evidence that callers had to send back for an ordinary next question. An exact retained reference should give the same findings, identity, authority, and provenance without running analysis again.

Change and scope

Add a strict reference alternative for application inputs in feature trace, semantic trace, application version comparison, source-to-bundle comparison, and JavaScript export-shape comparison. Resolve against the current session through a shared application boundary, then run the existing semantic validators/workflows. Native observation arrays continue to use full Evidence. Reuse the existing typed reference-error contract with actionable recovery and an identity-mismatch reason.

Contract and boundary impact

Semantic owner and earliest changed stage: application Evidence resolution before existing workflow authentication.
CLI and MCP/tool-catalog contract: additive union in application, left, and right inputs; unchanged tool inventory/results. CLI file-backed Evidence runs the same analysis workflows; a standalone CLI cannot access another connection's ledger.
Provider, bridge, target-format, or platform compatibility: no provider protocol changes or new provider support.
Evidence, artifact, provenance, or reconstruction contract: full inline Evidence and semantic identity checks preserved; missing/foreign/cleared references report their exact ID and observed missing state without guessing provenance.
Process execution, authorization, cleanup, or containment impact: lookup performs no execution, provider selection, or approval step; close_binary retains its existing ledger-clearing behavior.
Generated metadata (docs/product-catalog.json), package, or installation impact: regenerated tool catalog, product/skill identities and dependent conformance manifest; no dependency changes.

Evidence and regression coverage

Tests added or updated: all five workflows produce identical inline/reference results without extra records; mixed paired inputs, detached ledger reads, malformed references, lookup identity mismatch, semantic/predicate/operation rejection, connection isolation, close expiration, portable recovery, and bundle import covered.
Base reproduction or other evidence: #722 records full-input retransmission; the new reference calls are rejected by the affected inline-only base contracts.
User-visible MCP example: trace_application_feature({application: {kind: "retained-evidence", evidence_id: "ev_<producer ID>"}, seed: {kind: "module", value: "search.js"}}) returns the complete trace/Evidence. Missing references include details.reason: "missing" and recovery via inline Evidence, producer rerun, or bundle import.
Remaining proof gaps: real stdio verification is Linux x64; no local Windows/macOS run. Native observation references and result lifetime changes are outside this PR.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:focused -- src/application/EvidenceInputResolver.test.ts tests/boundary/mcp/retainedApplicationEvidenceMcp.test.ts tests/acceptance/applications/applicationEvidenceMcp.test.ts tests/acceptance/applications/applicationWorkflowCli.test.ts tests/acceptance/applications/javascriptApplicationWorkflows.test.ts — 26 tests passed.
npm run test:focused -- tests/boundary/mcp/retainedApplicationEvidenceMcp.test.ts tests/boundary/mcp/toolSchemaValidity.test.ts src/contracts/toolContracts.test.ts — 13 tests passed, including SDK-advertised Draft 2020-12 input/output schemas and example validation.
npm run check:fast — passed.
npm run docs:generate and npm run docs:check — passed.
Real pinned-SDK stdio connection with the original evaluation JS fixture — analysis followed by four inline/reference workflows produced identical complete results; close expiration and portable inline recovery passed. Serialized comparison input fell from 366,704 bytes to 242 bytes; this measures request serialization, not model-host context consumption.
git diff --check — passed.

Current main integration: merged main through 75a75cbb (including #732,
#733, #736, and the intervening main fixes) into this branch at c3e54db5. Both directory-route and
retained-reference recovery messages are preserved, and shared generated
metadata was regenerated from the combined contracts.

Post-integration verification:

Eleven focused test files, 265 tests passed: retained application references,
Evidence resolver, SDK schema validity, process comparison identity/unknowns,
target diagnostics, prompts, application CLI workflows, and the newly merged
semantic-union/return-shape and typed-seed-array regressions.
npm run check:fast, npm run docs:generate, npm run docs:check, and
git diff --check passed.
Real pinned-SDK stdio workflow repeated after integration: all four
inline/reference follow-up results were identical; close expiration and
portable inline recovery passed. Five-tool coverage, including
source-to-bundle comparison, is established by the SDK boundary tests.
Verification ran serially with two-CPU affinity and a bounded Node heap.

Final merge verification: all 19 checks passed for head c3e54db5 in
CI run 37461463397.
The additional composition with main 00eb03d0 also passed 17 tests across
retained-reference MCP behavior, application CLI workflows, and CLI reference
source import status. Squash merge: d0f3480a.

Compatibility, safety, and release

Breaking changes or migration steps: none; callers may continue to supply complete inline Evidence.
Real Hopper/Ghidra, browser, or OS coverage: Linux CLI/stdio and execution-free JS analysis tested. No Hopper/Ghidra/browser launch was required or performed.
Package or release metadata impact: additive contracts and regenerated metadata; no installation changes.
Security, privacy, process, or containment review: exact IDs are resolved only from the supplied session ledger; no global cache, permission flag, ambient-environment persistence, or guessed cross-session lookup. Public examples use placeholders. Build and test commands used two-CPU affinity and a bounded Node heap; real stdio workflows inherited the CPU affinity.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/734 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/722-retained-evidence-references` --- ### 📝 Commits (3) - [`f12e4c1`](https://github.com/morluto/rea/commit/f12e4c16ce2e10e6c85711babc83d11d4aa8eb45) feat(evidence): accept exact retained application references - [`91409e2`](https://github.com/morluto/rea/commit/91409e2b55d0189a733353a6a02e42725d300f21) chore: merge main into retained evidence references - [`c3e54db`](https://github.com/morluto/rea/commit/c3e54db5d0f740bcd801875f850dca2a67571031) chore: synchronize retained references with current main ### 📊 Changes **21 files changed** (+569 additions, -36 deletions) <details> <summary>View changed files</summary> 📝 `docs/mcp-contracts.md` (+41 -0) 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `skills/reverse-engineer-anything/references/javascript-applications.md` (+11 -0) ➕ `src/application/EvidenceInputResolver.test.ts` (+80 -0) ➕ `src/application/EvidenceInputResolver.ts` (+70 -0) 📝 `src/contracts/applicationToolContracts.ts` (+42 -5) 📝 `src/contracts/applicationWorkflowInputContracts.ts` (+13 -13) ➕ `src/contracts/evidenceInputContracts.ts` (+18 -0) 📝 `src/domain/analysisErrorPresentation.ts` (+11 -1) 📝 `src/domain/evidenceErrors.ts` (+5 -1) 📝 `src/generatedMcpToolCatalog.ts` (+1 -1) 📝 `src/server/createServer.ts` (+13 -2) 📝 `src/server/registerApplicationTools/compareExportShapes.ts` (+7 -1) 📝 `src/server/registerApplicationTools/compareSourceToBundle.ts` (+9 -2) 📝 `src/server/registerApplicationTools/compareVersions.ts` (+7 -1) 📝 `src/server/registerApplicationTools/traceFeature.ts` (+9 -2) 📝 `src/server/registerApplicationTools/traceSemantics.ts` (+9 -2) 📝 `src/server/registerApplicationTools/types.ts` (+1 -0) _...and 1 more files_ </details> ### 📄 Description ## Summary Fixes #722. Application follow-ups can use `{kind: "retained-evidence", evidence_id: "ev_<digest>"}` instead of retransmitting complete Evidence already retained on the same MCP connection. Complete portable inline inputs remain supported, and results remain inline. ## Problem and expected behavior A small JS application produced approximately 180 KB of analysis Evidence that callers had to send back for an ordinary next question. An exact retained reference should give the same findings, identity, authority, and provenance without running analysis again. ## Change and scope Add a strict reference alternative for application inputs in feature trace, semantic trace, application version comparison, source-to-bundle comparison, and JavaScript export-shape comparison. Resolve against the current session through a shared application boundary, then run the existing semantic validators/workflows. Native observation arrays continue to use full Evidence. Reuse the existing typed reference-error contract with actionable recovery and an identity-mismatch reason. ## Contract and boundary impact - Semantic owner and earliest changed stage: application Evidence resolution before existing workflow authentication. - CLI and MCP/tool-catalog contract: additive union in `application`, `left`, and `right` inputs; unchanged tool inventory/results. CLI file-backed Evidence runs the same analysis workflows; a standalone CLI cannot access another connection's ledger. - Provider, bridge, target-format, or platform compatibility: no provider protocol changes or new provider support. - Evidence, artifact, provenance, or reconstruction contract: full inline Evidence and semantic identity checks preserved; missing/foreign/cleared references report their exact ID and observed missing state without guessing provenance. - Process execution, authorization, cleanup, or containment impact: lookup performs no execution, provider selection, or approval step; `close_binary` retains its existing ledger-clearing behavior. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: regenerated tool catalog, product/skill identities and dependent conformance manifest; no dependency changes. ## Evidence and regression coverage - Tests added or updated: all five workflows produce identical inline/reference results without extra records; mixed paired inputs, detached ledger reads, malformed references, lookup identity mismatch, semantic/predicate/operation rejection, connection isolation, close expiration, portable recovery, and bundle import covered. - Base reproduction or other evidence: #722 records full-input retransmission; the new reference calls are rejected by the affected inline-only base contracts. - User-visible MCP example: `trace_application_feature({application: {kind: "retained-evidence", evidence_id: "ev_<producer ID>"}, seed: {kind: "module", value: "search.js"}})` returns the complete trace/Evidence. Missing references include `details.reason: "missing"` and recovery via inline Evidence, producer rerun, or bundle import. - Remaining proof gaps: real stdio verification is Linux x64; no local Windows/macOS run. Native observation references and result lifetime changes are outside this PR. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- src/application/EvidenceInputResolver.test.ts tests/boundary/mcp/retainedApplicationEvidenceMcp.test.ts tests/acceptance/applications/applicationEvidenceMcp.test.ts tests/acceptance/applications/applicationWorkflowCli.test.ts tests/acceptance/applications/javascriptApplicationWorkflows.test.ts` — 26 tests passed. - `npm run test:focused -- tests/boundary/mcp/retainedApplicationEvidenceMcp.test.ts tests/boundary/mcp/toolSchemaValidity.test.ts src/contracts/toolContracts.test.ts` — 13 tests passed, including SDK-advertised Draft 2020-12 input/output schemas and example validation. - `npm run check:fast` — passed. - `npm run docs:generate` and `npm run docs:check` — passed. - Real pinned-SDK stdio connection with the original evaluation JS fixture — analysis followed by four inline/reference workflows produced identical complete results; close expiration and portable inline recovery passed. Serialized comparison input fell from 366,704 bytes to 242 bytes; this measures request serialization, not model-host context consumption. - `git diff --check` — passed. Current main integration: merged main through `75a75cbb` (including #732, #733, #736, and the intervening main fixes) into this branch at `c3e54db5`. Both directory-route and retained-reference recovery messages are preserved, and shared generated metadata was regenerated from the combined contracts. Post-integration verification: - Eleven focused test files, 265 tests passed: retained application references, Evidence resolver, SDK schema validity, process comparison identity/unknowns, target diagnostics, prompts, application CLI workflows, and the newly merged semantic-union/return-shape and typed-seed-array regressions. - `npm run check:fast`, `npm run docs:generate`, `npm run docs:check`, and `git diff --check` passed. - Real pinned-SDK stdio workflow repeated after integration: all four inline/reference follow-up results were identical; close expiration and portable inline recovery passed. Five-tool coverage, including source-to-bundle comparison, is established by the SDK boundary tests. - Verification ran serially with two-CPU affinity and a bounded Node heap. Final merge verification: all 19 checks passed for head `c3e54db5` in [CI run 37461463397](https://github.com/morluto/rea/actions/runs/37461463397). The additional composition with main `00eb03d0` also passed 17 tests across retained-reference MCP behavior, application CLI workflows, and CLI reference source import status. Squash merge: `d0f3480a`. ## Compatibility, safety, and release - Breaking changes or migration steps: none; callers may continue to supply complete inline Evidence. - Real Hopper/Ghidra, browser, or OS coverage: Linux CLI/stdio and execution-free JS analysis tested. No Hopper/Ghidra/browser launch was required or performed. - Package or release metadata impact: additive contracts and regenerated metadata; no installation changes. - Security, privacy, process, or containment review: exact IDs are resolved only from the supplied session ledger; no global cache, permission flag, ambient-environment persistence, or guessed cross-session lookup. Public examples use placeholders. Build and test commands used two-CPU affinity and a bounded Node heap; real stdio workflows inherited the CPU affinity. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:37 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:03:33 +00:00

[PR #2206] [MERGED] fix(ghidra): encode Java probe output as UTF-8 #5082

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2204

No description provided.

Rows
Columns