[PR #1366] [MERGED] fix(mcp): preserve JavaScript workflow identity validation #2830

New issue

Closed

opened 2026-10-17 21:10:47 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:10:47 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1366
Author: @N0zoM1z0
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/application-comparison-provenance-1364

📝 Commits (3)

50e94be fix(mcp): preserve JavaScript workflow identity validation
39966fe Merge remote-tracking branch 'origin/main' into fix/application-comparison-provenance-1364
cb21132 test(mcp): validate advertised workflow schema dialects

📊 Changes

5 files changed (+444 additions, -44 deletions)

View changed files

📝 src/application/javascript/JavaScriptApplicationWorkflowService.ts (+28 -7)
📝 src/domain/javascript/javascriptApplicationVersionComparisonSchemas.ts (+47 -20)
📝 src/domain/javascript/javascriptExportShapeComparisonSchemas.ts (+27 -8)
📝 src/domain/javascript/javascriptFeatureTraceSchemas.ts (+24 -9)
➕ tests/boundary/cli/workflowInputIdentities.test.ts (+318 -0)

📄 Description

MCP JavaScript version and export-shape comparison reconstructed reference-aware request schemas from canonical fields, losing the existing distinct-source refinements. Comparing a retained record with itself consequently reached the producer and failed output validation with unreadable_output, while CLI rejected the request with an actionable invalid_request.

Reuse the canonical identity refinements at the shared application entry points after retained inputs resolve. Invalid version/export comparisons and duplicate native observations in version comparison or feature tracing now return structured REA input errors before graph parsing and computation. These checks project only Evidence identities, avoiding another complete graph capture. Canonical full input rules and output contracts remain unchanged.

Validation:

Six focused tests passed after integrating main 6ce3288f, including a compiled public CLI and actual SDK stdio server workflow with producer-generated JavaScript Evidence.
Inline, retained and mixed self-comparison requests return the same field and reason; duplicate native identities retain their respective field errors. Valid distinct comparison preserves exact CLI/MCP Evidence parity; export comparison, tracing, connection ping and close remain usable.
Advertised input/output schemas for the three affected tools validate as JSON Schema 2020-12.
A real Notion ASAR workflow on this branch/main integration passed: analysis returned an actionable transport constraint with retained Evidence; summary/module views, typed identity rejection, feature tracing, close, expired-reference rejection and subsequent pings succeeded. The artifact digest stayed unchanged. Two CPUs, Node 1536 MiB heap, 2304 MiB family guard; 73.746 seconds overall and 1.91 GiB sampled family peak. Coverage limitations from the parent record remain explicit.
npm run check:fast and npm run docs:check passed; the public CLI/MCP regression was rerun after normalizing the SDK optional dialect field for the schema validator.
This is correctness/recovery verification, not a claimed speedup or cancellation benchmark.

The native-observation rejection cases use malformed duplicate identities, not a claim of real native-provider acceptance. Real Hopper/Ghidra verification was not performed for this provider-neutral change.

Fixes #1364
Refs #1065

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1366 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/application-comparison-provenance-1364` --- ### 📝 Commits (3) - [`50e94be`](https://github.com/morluto/rea/commit/50e94bedd295fe37cea9e3f15785af97673d1911) fix(mcp): preserve JavaScript workflow identity validation - [`39966fe`](https://github.com/morluto/rea/commit/39966fef2ee3640f865a2a074f34a5e8be9674e9) Merge remote-tracking branch 'origin/main' into fix/application-comparison-provenance-1364 - [`cb21132`](https://github.com/morluto/rea/commit/cb21132abec981f7f446c2d3eb7fb5dde6feab88) test(mcp): validate advertised workflow schema dialects ### 📊 Changes **5 files changed** (+444 additions, -44 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptApplicationWorkflowService.ts` (+28 -7) 📝 `src/domain/javascript/javascriptApplicationVersionComparisonSchemas.ts` (+47 -20) 📝 `src/domain/javascript/javascriptExportShapeComparisonSchemas.ts` (+27 -8) 📝 `src/domain/javascript/javascriptFeatureTraceSchemas.ts` (+24 -9) ➕ `tests/boundary/cli/workflowInputIdentities.test.ts` (+318 -0) </details> ### 📄 Description MCP JavaScript version and export-shape comparison reconstructed reference-aware request schemas from canonical fields, losing the existing distinct-source refinements. Comparing a retained record with itself consequently reached the producer and failed output validation with `unreadable_output`, while CLI rejected the request with an actionable `invalid_request`. Reuse the canonical identity refinements at the shared application entry points after retained inputs resolve. Invalid version/export comparisons and duplicate native observations in version comparison or feature tracing now return structured REA input errors before graph parsing and computation. These checks project only Evidence identities, avoiding another complete graph capture. Canonical full input rules and output contracts remain unchanged. Validation: - Six focused tests passed after integrating main `6ce3288f`, including a compiled public CLI and actual SDK stdio server workflow with producer-generated JavaScript Evidence. - Inline, retained and mixed self-comparison requests return the same field and reason; duplicate native identities retain their respective field errors. Valid distinct comparison preserves exact CLI/MCP Evidence parity; export comparison, tracing, connection ping and close remain usable. - Advertised input/output schemas for the three affected tools validate as JSON Schema 2020-12. - A real Notion ASAR workflow on this branch/main integration passed: analysis returned an actionable transport constraint with retained Evidence; summary/module views, typed identity rejection, feature tracing, close, expired-reference rejection and subsequent pings succeeded. The artifact digest stayed unchanged. Two CPUs, Node 1536 MiB heap, 2304 MiB family guard; 73.746 seconds overall and 1.91 GiB sampled family peak. Coverage limitations from the parent record remain explicit. - `npm run check:fast` and `npm run docs:check` passed; the public CLI/MCP regression was rerun after normalizing the SDK optional dialect field for the schema validator. - This is correctness/recovery verification, not a claimed speedup or cancellation benchmark. The native-observation rejection cases use malformed duplicate identities, not a claim of real native-provider acceptance. Real Hopper/Ghidra verification was not performed for this provider-neutral change. Fixes #1364 Refs #1065 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:10:47 +00:00