morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4690] [Bug] CI fixtures drift from runtime prerequisites and Evidence contracts #2448

New issue

Closed

opened 2026-10-17 21:04:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:04:48 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4690

Before submitting

Searched open and closed reports for the fixture names and CSPRNG failure. Existing mentions in #4038/#2884 describe baseline failures rather than this fixture repair.
Credentials and private target data are omitted.

Area

Other — CI test fixtures.

Observed behavior

Main CI at 4d980d017622d3175d86aaf3b0dcfbdf4ca3d091 fails three fixture families after newer ownership/readiness and comparison contracts. The former BinarySessionStatus failures are already fixed by 870dcb1fd.

Family	Executed evidence
JEB configuration isolation	Linux shard 5: discovery exits 1. A separate compiled CLI probe on main `0ec4826633482be4ac3bbc194cc677f50db72a87` reports `spawn ps ENOENT` because the fixture sets PATH empty; JEB's own malformed-timeout refusal still returns configuration_invalid.
Source-module comparison	Linux shard 1: exact module-source identity is matched but status is unknown, while the older assertion expects unchanged.
Java-shaped probe	Hosted Windows lane: nine cases fail. The controlled Node child exits 134 with `Assertion failed: ncrypto::CSPRNG(nullptr, 0)` before its probe script executes. This is not a real JVM result.

Expected behavior

Fixtures supply required OS runtime prerequisites while preserving their isolation purpose. Java home/bitness/output-limit assertions examine the controlled producer's output. Exact source-byte identity remains distinct from incomplete relationship conclusions: identity can match exactly while comparison status remains unknown, with provenance and limitations retained.

Shortest reproduction actually run

Linux x64, pinned Node 24.18.0/npm 11.16.0, clean main 0ec4826633482be4ac3bbc194cc677f50db72a87:

npm run test:focused -- tests/acceptance/providers/jebConfigurationIsolation.test.ts tests/boundary/filesystem/javascript-applications/javascriptModuleRelationships.test.ts

Observed 2 failed / 10 passed. A candidate test-only correction passes those files plus ghidraJavaProbe.test.ts (21 passed) on Linux. No local Windows execution is claimed; its correction still requires hosted Windows CI.

Tested version and environment

Source checkout 6.5.0; Linux x64 locally. Windows evidence is the linked hosted Windows/Node 24.18.0 run. No JEB or Ghidra engine is required or qualified by these fixtures.

Earliest failure stage

Fixture setup/runtime admission and comparison assertion; no production defect is established by these failures.

Relevant evidence and suspected cause

The JEB fixture's empty PATH removes a documented ownership prerequisite. The Windows launcher passes an empty environment to its substitute Node executable; missing SystemRoot is the suspected CSPRNG cause, pending Windows verification. Main's new comparison contract explicitly keeps unresolved/incomplete relationships unknown; source digest matching alone does not prove an unchanged complete comparison.

Impact and frequency

Observed in the pinned main CI and independently reproduced for both Linux failures. These failures block required CI for unrelated contributor PRs. Repeated-run frequency and additional platform coverage are NOT_ENOUGH_INFO; no broader runtime regression is claimed.

Additional main fixture failure and verified follow-up

Main 0ec4826633482be4ac3bbc194cc677f50db72a87 also fails tests/acceptance/applications/hopperRegexFailureCli.test.ts: 1 failure reproduced locally. The compiled CLI returns provider_unavailable with publisher_verification/unsupported_hopper_build before launching its unauthenticated fixture; the test instead reads a nonexistent request trace and reports ENOENT. Same hosted failure on the candidate. This is correct production admission, not an authenticated Hopper regression.

The correction keeps a real compiled CLI foreign-launcher refusal test and exercises the six regex success/failure cases using production CLI composition/provider/client against an explicit launcher substitution in the isolated process-global test project. Exact socket request IDs, method/error type, Evidence and child cleanup are asserted; the obsolete bespoke launcher is removed. Thirteen focused tests pass on Linux. No production trust bypass is introduced; real Hopper runtime behavior is not established by these fixtures.

The earlier Windows correction is now verified on hosted Windows: all nine controlled Java-shaped Node probes pass. This remains fixture validation, not a real JVM/provider qualification.

Final remaining baseline assertion family

After the four preceding fixture corrections, complete CI shard 5 reports exactly three failures in evmoleInterfaceProvider.test.ts (late cancellation, cleanup failure and their combination); all other shards and Windows/native package lanes pass. Clean main 7086768a27242a15daa93486aefbaacc3c891e78 independently reproduces 3 failures / 27 passes / 2 platform skips. The new test from d694aef22 expects the execution-target shape subject.path/sha256, while validated serialized Evidence correctly uses subject.local_path/digest.sha256.

The test-only correction uses typed field accesses, checks the exact original carrier SHA-256 and unchanged source bytes, and keeps the cancellation, cleanup, warnings and partial-Evidence assertions. Provider/service/MCP selection passes 54 tests with 2 platform skips on Linux. No production Evidence change is needed. These are controlled worker/process lifecycle tests, not new real-worker qualification.

Originally created by @N0zoM1z0 on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4690 ## Before submitting - [x] Searched open and closed reports for the fixture names and CSPRNG failure. Existing mentions in #4038/#2884 describe baseline failures rather than this fixture repair. - [x] Credentials and private target data are omitted. ## Area Other — CI test fixtures. ## Observed behavior Main CI at `4d980d017622d3175d86aaf3b0dcfbdf4ca3d091` fails three fixture families after newer ownership/readiness and comparison contracts. The former BinarySessionStatus failures are already fixed by `870dcb1fd`. | Family | Executed evidence | |---|---| | JEB configuration isolation | [Linux shard 5](https://github.com/morluto/rea/actions/runs/39004126573/job/117315320809): discovery exits 1. A separate compiled CLI probe on main `0ec4826633482be4ac3bbc194cc677f50db72a87` reports `spawn ps ENOENT` because the fixture sets PATH empty; JEB's own malformed-timeout refusal still returns configuration_invalid. | | Source-module comparison | [Linux shard 1](https://github.com/morluto/rea/actions/runs/39004126573/job/117315320822): exact module-source identity is matched but status is unknown, while the older assertion expects unchanged. | | Java-shaped probe | [Hosted Windows lane](https://github.com/morluto/rea/actions/runs/39004126573/job/117315946946): nine cases fail. The controlled Node child exits 134 with `Assertion failed: ncrypto::CSPRNG(nullptr, 0)` before its probe script executes. This is not a real JVM result. | ## Expected behavior Fixtures supply required OS runtime prerequisites while preserving their isolation purpose. Java home/bitness/output-limit assertions examine the controlled producer's output. Exact source-byte identity remains distinct from incomplete relationship conclusions: identity can match exactly while comparison status remains unknown, with provenance and limitations retained. ## Shortest reproduction actually run Linux x64, pinned Node 24.18.0/npm 11.16.0, clean main `0ec4826633482be4ac3bbc194cc677f50db72a87`: ```sh npm run test:focused -- tests/acceptance/providers/jebConfigurationIsolation.test.ts tests/boundary/filesystem/javascript-applications/javascriptModuleRelationships.test.ts ``` Observed 2 failed / 10 passed. A candidate test-only correction passes those files plus ghidraJavaProbe.test.ts (21 passed) on Linux. No local Windows execution is claimed; its correction still requires hosted Windows CI. ## Tested version and environment Source checkout 6.5.0; Linux x64 locally. Windows evidence is the linked hosted Windows/Node 24.18.0 run. No JEB or Ghidra engine is required or qualified by these fixtures. ## Earliest failure stage Fixture setup/runtime admission and comparison assertion; no production defect is established by these failures. ## Relevant evidence and suspected cause The JEB fixture's empty PATH removes a documented ownership prerequisite. The Windows launcher passes an empty environment to its substitute Node executable; missing SystemRoot is the suspected CSPRNG cause, pending Windows verification. Main's new comparison contract explicitly keeps unresolved/incomplete relationships unknown; source digest matching alone does not prove an unchanged complete comparison. ## Impact and frequency Observed in the pinned main CI and independently reproduced for both Linux failures. These failures block required CI for unrelated contributor PRs. Repeated-run frequency and additional platform coverage are NOT_ENOUGH_INFO; no broader runtime regression is claimed. ## Additional main fixture failure and verified follow-up Main `0ec4826633482be4ac3bbc194cc677f50db72a87` also fails `tests/acceptance/applications/hopperRegexFailureCli.test.ts`: 1 failure reproduced locally. The compiled CLI returns `provider_unavailable` with `publisher_verification/unsupported_hopper_build` before launching its unauthenticated fixture; the test instead reads a nonexistent request trace and reports ENOENT. [Same hosted failure on the candidate](https://github.com/morluto/rea/actions/runs/39006464000/job/117320150517). This is correct production admission, not an authenticated Hopper regression. The correction keeps a real compiled CLI foreign-launcher refusal test and exercises the six regex success/failure cases using production CLI composition/provider/client against an explicit launcher substitution in the isolated process-global test project. Exact socket request IDs, method/error type, Evidence and child cleanup are asserted; the obsolete bespoke launcher is removed. Thirteen focused tests pass on Linux. No production trust bypass is introduced; real Hopper runtime behavior is not established by these fixtures. The earlier Windows correction is now [verified on hosted Windows](https://github.com/morluto/rea/actions/runs/39006464000/job/117320314474): all nine controlled Java-shaped Node probes pass. This remains fixture validation, not a real JVM/provider qualification. ## Final remaining baseline assertion family After the four preceding fixture corrections, [complete CI shard 5](https://github.com/morluto/rea/actions/runs/39007383341/job/117322747690) reports exactly three failures in `evmoleInterfaceProvider.test.ts` (late cancellation, cleanup failure and their combination); all other shards and Windows/native package lanes pass. Clean main `7086768a27242a15daa93486aefbaacc3c891e78` independently reproduces 3 failures / 27 passes / 2 platform skips. The new test from `d694aef22` expects the execution-target shape `subject.path/sha256`, while validated serialized Evidence correctly uses `subject.local_path/digest.sha256`. The test-only correction uses typed field accesses, checks the exact original carrier SHA-256 and unchanged source bytes, and keeps the cancellation, cleanup, warnings and partial-Evidence assertions. Provider/service/MCP selection passes 54 tests with 2 platform skips on Linux. No production Evidence change is needed. These are controlled worker/process lifecycle tests, not new real-worker qualification.

bsakaguchi

2026-10-17 21:04:48 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi referenced this issue

2026-10-31 01:05:03 +00:00

[PR #2448] [MERGED] fix(targets): retain unsupported PE machine in diagnostics #5236

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2448

No description provided.

Rows
Columns