[GH-ISSUE #5071] [Bug] UI trace discovery rejects working authored and native-seed routes #3107

Closed
opened 2026-10-31 00:36:43 +00:00 by bsakaguchi · 1 comment
Owner

Originally created by @morluto on GitHub (Oct 18, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5071

Area

Provider or capability discovery; MCP.

Observed behavior

On main 50b6975d861069e2c6cfa202780621449f863802, binary_session reports trace_native_ui_action unavailable (provider_missing) for two controlled providers that return useful traces through that public MCP tool:

  • A provider with decode_interface_builder and direct inspect_native_dispatch_metadata returns an authored UI action → Objective-C handler edge, without list_names or callee enumeration.
  • A provider with direct metadata, procedure_address, and typed procedure_references returns a native seed → direct call edge 0x1000 → 0x2000, without a UI decoder or procedure_callees.

Reproduction and evidence

Ran vitest run --project mcp-boundary tests/boundary/mcp/nativeUiAvailability.test.ts with pinned Node 24.18.0 on macOS arm64. The production session/server/registry and official SDK InMemoryTransport are used with explicitly advertised, controlled provider capabilities. For each route, open a fixture session target, read binary_session, call the trace tool, assert the concrete objc_dispatch or typed direct_call edge, then assert inventory availability. Both route executions and edge assertions pass before inventory fails with provider_missing. A missing-metadata control and no-target control pass. Target SHA/profile are supplied by the bound session, not unrelated fixture identities; opened targets and MCP resources are closed.

Expected behavior

Discovery should represent the workflow's useful route prerequisites rather than requiring every optional or fallback operation. It should still refuse providers lacking the metadata identity source and keep no-target state explicit. A broad OR over all operations would be insufficient: metadata alone can yield an empty partial trace and is not evidence of a supported useful route.

Impact and scope

Observed false-negative session discovery, so a discovery-driven caller can skip a usable trace. Controlled providers establish adapter composition behavior; real macOS UI decoding, native engines, model tool selection, and other hosts were not exercised. NOT_ENOUGH_INFO for those runtime scopes.

Earliest failure stage

Transport or result projection: session capability inventory.

Source-derived cause and proposed check

src/application/CapabilityInventory.ts requires decode + names + callees as a flat conjunction. NativeUiActionTrace.ts permits an authored UI dispatch without call expansion and an explicit native seed with optional UI coverage. Metadata comes from the shared direct-or-symbol workflow; NativeCallRoutes.ts prefers typed references and can fall back to callees. Review a route-based composition with named source owners, preserving failure/cancellation precedence, target/provenance checks, and explicit unknown coverage. Do not change execution merely to satisfy discovery.

Searched open/closed titles and current open narratives. #3343 concerns receiver-kind joins and #3922 concerns bounded omitted-call relation classification, not inventory. #5070 fixes the simpler metadata tool's alternatives and does not fix this workflow.

Originally created by @morluto on GitHub (Oct 18, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5071 ### Area Provider or capability discovery; MCP. ### Observed behavior On main `50b6975d861069e2c6cfa202780621449f863802`, `binary_session` reports `trace_native_ui_action` unavailable (`provider_missing`) for two controlled providers that return useful traces through that public MCP tool: - A provider with `decode_interface_builder` and direct `inspect_native_dispatch_metadata` returns an authored UI action → Objective-C handler edge, without `list_names` or callee enumeration. - A provider with direct metadata, `procedure_address`, and typed `procedure_references` returns a native seed → direct call edge `0x1000` → `0x2000`, without a UI decoder or `procedure_callees`. ### Reproduction and evidence Ran `vitest run --project mcp-boundary tests/boundary/mcp/nativeUiAvailability.test.ts` with pinned Node 24.18.0 on macOS arm64. The production session/server/registry and official SDK InMemoryTransport are used with explicitly advertised, controlled provider capabilities. For each route, open a fixture session target, read `binary_session`, call the trace tool, assert the concrete `objc_dispatch` or typed `direct_call` edge, then assert inventory availability. Both route executions and edge assertions pass before inventory fails with `provider_missing`. A missing-metadata control and no-target control pass. Target SHA/profile are supplied by the bound session, not unrelated fixture identities; opened targets and MCP resources are closed. ### Expected behavior Discovery should represent the workflow's useful route prerequisites rather than requiring every optional or fallback operation. It should still refuse providers lacking the metadata identity source and keep no-target state explicit. A broad OR over all operations would be insufficient: metadata alone can yield an empty partial trace and is not evidence of a supported useful route. ### Impact and scope Observed false-negative session discovery, so a discovery-driven caller can skip a usable trace. Controlled providers establish adapter composition behavior; real macOS UI decoding, native engines, model tool selection, and other hosts were not exercised. NOT_ENOUGH_INFO for those runtime scopes. ### Earliest failure stage Transport or result projection: session capability inventory. ### Source-derived cause and proposed check `src/application/CapabilityInventory.ts` requires decode + names + callees as a flat conjunction. `NativeUiActionTrace.ts` permits an authored UI dispatch without call expansion and an explicit native seed with optional UI coverage. Metadata comes from the shared direct-or-symbol workflow; `NativeCallRoutes.ts` prefers typed references and can fall back to callees. Review a route-based composition with named source owners, preserving failure/cancellation precedence, target/provenance checks, and explicit unknown coverage. Do not change execution merely to satisfy discovery. Searched open/closed titles and current open narratives. #3343 concerns receiver-kind joins and #3922 concerns bounded omitted-call relation classification, not inventory. #5070 fixes the simpler metadata tool's alternatives and does not fix this workflow.
bsakaguchi 2026-10-31 00:36:43 +00:00
  • closed this issue
  • added the
    triage
    bug
    labels
Author
Owner

@morluto commented on GitHub (Oct 18, 2026):

Fixed on main in 32f0e51209.

Root cause: inventory flattened the workflow's alternative useful routes into decode + names + callees. Discovery now exposes authored_ui_dispatch (UI decoding plus direct-or-symbol metadata) and native_seed_call_trace (metadata, address resolution and typed-reference-or-callee reading). Named operations are shared with their execution owners. One evaluator derives both availability and unmet prerequisites, so a usable source does not leave its absent alternative marked missing. UI routes have no request selector/default; default_mode_available is omitted. Existing navigation/directional defaults and failure precedence remain.

The baseline public MCP test reproduced two false discovery assertions after concrete dispatch/call edges succeeded. Final validation: 56 source tests; 64 public MCP/schema checks in seven files, plus final 10-case reruns after test cleanup; full static/architecture, documentation (5 checks), type/lint/pre-push and discovery (1591 files exactly once). Tests include both metadata sources, both call readers, metadata-only/no-match, missing and unavailable prerequisites, fatal metadata without fallback masking, decoder cancellation and no target. Static review replaced an undefined-field negative assertion with explicit reason/coverage facts. Independent source/design review found no blocker.

Twelve completed controlled SDK tasks retained identical 207-tool catalog and per-task normalized traces. Repeated-process medians, baseline→fixed: authored UI full-response cl100k estimate 823970→824185, elapsed 2.548→2.526s, CPU 3.552→3.439s, sampled family RSS 814.3→733.8MB; native seed 822397→822491 tokens, 2.696→2.449s, 3.540→3.200s, 809.1→739.1MB. This includes full SDK catalog and duplicate wire representations, not actual model context. First processes were separate from two repeats per variant/task; no true cold reset, statistical or general speedup claim. Requests/framing, model selection/retries, actual client context delivery and real engine/large-target costs were not measured.

These are controlled providers over the official SDK, not real native-engine or cross-host qualification. Related source auditing reproduced a separate typed-route loss during mixed-reference fallback, tracked as #5073. It requires preserving per-route facts/provenance in the producer; requiring both reader operations in discovery would hide that defect. #5071's discovery fix does not claim that data-loss fix.

<!-- gh-comment-id:6254276803 --> @morluto commented on GitHub (Oct 18, 2026): Fixed on main in 32f0e5120966be59d17a1e092353816c76a9c5e2. Root cause: inventory flattened the workflow's alternative useful routes into decode + names + callees. Discovery now exposes `authored_ui_dispatch` (UI decoding plus direct-or-symbol metadata) and `native_seed_call_trace` (metadata, address resolution and typed-reference-or-callee reading). Named operations are shared with their execution owners. One evaluator derives both availability and unmet prerequisites, so a usable source does not leave its absent alternative marked missing. UI routes have no request selector/default; `default_mode_available` is omitted. Existing navigation/directional defaults and failure precedence remain. The baseline public MCP test reproduced two false discovery assertions after concrete dispatch/call edges succeeded. Final validation: 56 source tests; 64 public MCP/schema checks in seven files, plus final 10-case reruns after test cleanup; full static/architecture, documentation (5 checks), type/lint/pre-push and discovery (1591 files exactly once). Tests include both metadata sources, both call readers, metadata-only/no-match, missing and unavailable prerequisites, fatal metadata without fallback masking, decoder cancellation and no target. Static review replaced an undefined-field negative assertion with explicit reason/coverage facts. Independent source/design review found no blocker. Twelve completed controlled SDK tasks retained identical 207-tool catalog and per-task normalized traces. Repeated-process medians, baseline→fixed: authored UI full-response cl100k estimate 823970→824185, elapsed 2.548→2.526s, CPU 3.552→3.439s, sampled family RSS 814.3→733.8MB; native seed 822397→822491 tokens, 2.696→2.449s, 3.540→3.200s, 809.1→739.1MB. This includes full SDK catalog and duplicate wire representations, not actual model context. First processes were separate from two repeats per variant/task; no true cold reset, statistical or general speedup claim. Requests/framing, model selection/retries, actual client context delivery and real engine/large-target costs were not measured. These are controlled providers over the official SDK, not real native-engine or cross-host qualification. Related source auditing reproduced a separate typed-route loss during mixed-reference fallback, tracked as #5073. It requires preserving per-route facts/provenance in the producer; requiring both reader operations in discovery would hide that defect. #5071's discovery fix does not claim that data-loss fix.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#3107
No description provided.