morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5452] [Bug] CLI artifact bundle leaves its linked inventory ID unresolved after import #3310

New issue

Closed

opened 2026-10-31 00:39:02 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:39:02 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5452

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

inspect-artifact --detail summary --evidence_output saves a bundle containing the complete inspection parent and its inline inventory Evidence. After MCP import, the inventory ID advertised by the CLI summary and the parent's Evidence links cannot be used as a retained reference: inspect_analysis_view returns evidence_integrity_mismatch with details.reason: "missing".

The inventory content survives inside the parent. The same inventory/nodes view succeeds using the imported parent ID. Direct MCP inspection of the identical ZIP retains an addressable atomic inventory ID.

Reproduction

Independently reproduced at the baseline below; the submission check repeated the same workflow at upstream 052956af3416fa01d93837e54fdec3ad2739f6d1, with the same failure and controls. Both used the real CLI and local stdio MCP server.

Create a ZIP named input.zip containing one member, hello.txt, with bytes hello\n (Python standard-library zipfile). Use isolated HOME and XDG configuration/data/cache/state directories for the CLI and MCP child processes.
From a built checkout, run this command with INPUT and OUTPUT set to absolute fixture paths:

node scripts/rea.mjs inspect-artifact "$INPUT" --detail summary --evidence_output "$OUTPUT" --json

In the CLI JSON, read parent_id from summary.normalized_result.parent_evidence_id and inventory_id from summary.normalized_result.summary.inventory_evidence_ids[0]. The saved bundle has one top-level inspect_artifact record, links to inventory_id, and contains that inventory Evidence inline.
Connect an MCP SDK stdio client to node scripts/rea.mjs mcp, inheriting the same isolated directories. Call import_evidence_bundle with {"path":"<absolute bundle path>"}, then immediately call get_evidence_bundle with {"detail":"complete"}. Only the parent is registered.
Call inspect_analysis_view, replacing <inventory_id> with the actual ID read above:

{"source":{"kind":"retained-evidence","evidence_id":"<inventory_id>"},"view":{"kind":"inventory","collection":"nodes"}}

This returns the missing-reference error. Repeat with parent_id: it succeeds with two nodes.
6. Control: in a fresh MCP connection, call open_binary with the ZIP path, then inspect_artifact with {"detail":"summary"}, and export_evidence_bundle with a new absolute output path. The export contains inspect_artifact, inventory_artifact, and the derived inspect_analysis_view records. The same retained inventory/nodes request succeeds using the atomic inventory record's ID.

Expected behavior

The inventory ID advertised by the CLI summary should remain addressable after importing its complete portable bundle, without rerunning its producer.

Source contract at the baseline: docs/mcp-contracts.md:265-268 promises retention of complete inspection and atomic inventory Evidence; :310-323 documents inventory IDs and views for both record types; :390-410 documents import before retained-reference use and complete portable CLI inspection Evidence. src/cli/analysisEvidenceDelivery.ts:24-26 describes saving complete Evidence as a bundle. The direct MCP control supports the expected addressability.

Impact and scope

Bounded CLI-to-MCP portability failure: callers following an advertised inventory reference cannot page it after import. Inventory bytes are preserved, and using the imported inspection parent's ID for the same view is a verified workaround. Direct MCP inspection is also usable. One reproduction at the baseline and one submission rerun on current upstream produced the same result. Other artifact formats and platforms were not tested; no security-boundary crossing or target execution was observed.

REA version

6.7.0; source baseline 074768901f3cdc8205b61773fb1faf6f6c7b3ca8. Also reproduced on upstream 052956af3416fa01d93837e54fdec3ad2739f6d1 (package version 6.7.0).

Runtime and platform

Baseline verifier: macOS arm64, installed MCP SDK over local stdio. NOT_ENOUGH_INFO: the verifier did not record the exact Node.js or macOS version. Submission rerun: Node.js 26.12.0 on the same host; no external analysis provider was used.

Target and artifact context

Valid local ZIP containing hello.txt (hello\n); CLI-exported Evidence bundle with one top-level inspection record and one nested atomic inventory. The safe artifact graph provider performs static inspection.

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

Observed CLI exit status: 0; stderr empty. The immediate complete ledger query ran before any view calls.

CLI bundle operations: [inspect_artifact]
import_evidence_bundle: {"imported":1,"unknowns_added":0,"total":1}
Immediate ledger operations: [inspect_artifact]
View using advertised inventory ID: isError=true
  code: evidence_integrity_mismatch
  details.reason: missing
  message: Evidence <inventory_id> is not retained in this session. ...
View using imported parent ID: success, examined=2, total=2, exhausted=true
Direct MCP control export: 3 records
  [inspect_artifact, inventory_artifact, inspect_analysis_view]
View using direct MCP atomic inventory ID: success, examined=2, total=2

IDs and absolute fixture paths are omitted; reproduction reads the actual IDs from the result and bundle.

Typed outcome or recovery expected

After import, the advertised inventory ID should resolve to the original inventory through inspect_analysis_view without rerunning inspection. Preserve the working parent-ID view, inventory content, and Evidence identities.

Analysis or suspected cause

Source-derived reasoning at the baseline: src/cli/analysisEvidenceDelivery.ts:117-118 writes only the inspection parent as a top-level record. src/application/investigation/EvidenceLedger.ts:99-125 imports top-level records without separately registering nested inventory Evidence. The direct MCP path supplies substeps as separate source Evidence at src/server/registerArtifactTools.ts:49-60.

Upstream commit 1417bf943bf49e49b414e8a508bf28a31304be83 added optional sourceEvidence to CLI delivery for derived workflows. The current-upstream runtime rerun above confirms it does not restore this artifact inspection workflow. This report does not prescribe whether export or import should own the repair.

Additional context

Prepared with AI assistance and independently reproduced by a separate verifier. No implementation changes were made. Related reports #3459 and #3220 concern selecting inventories after the first nested substep; this report concerns addressability of the sole inventory ID after an ordinary CLI-produced bundle is imported.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5452 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `inspect-artifact --detail summary --evidence_output` saves a bundle containing the complete inspection parent and its inline inventory Evidence. After MCP import, the inventory ID advertised by the CLI summary and the parent's Evidence links cannot be used as a retained reference: `inspect_analysis_view` returns `evidence_integrity_mismatch` with `details.reason: "missing"`. The inventory content survives inside the parent. The same inventory/nodes view succeeds using the imported parent ID. Direct MCP inspection of the identical ZIP retains an addressable atomic inventory ID. ### Reproduction Independently reproduced at the baseline below; the submission check repeated the same workflow at upstream `052956af3416fa01d93837e54fdec3ad2739f6d1`, with the same failure and controls. Both used the real CLI and local stdio MCP server. 1. Create a ZIP named `input.zip` containing one member, `hello.txt`, with bytes `hello\n` (Python standard-library `zipfile`). Use isolated HOME and XDG configuration/data/cache/state directories for the CLI and MCP child processes. 2. From a built checkout, run this command with `INPUT` and `OUTPUT` set to absolute fixture paths: ```sh node scripts/rea.mjs inspect-artifact "$INPUT" --detail summary --evidence_output "$OUTPUT" --json ``` 3. In the CLI JSON, read `parent_id` from `summary.normalized_result.parent_evidence_id` and `inventory_id` from `summary.normalized_result.summary.inventory_evidence_ids[0]`. The saved bundle has one top-level `inspect_artifact` record, links to `inventory_id`, and contains that inventory Evidence inline. 4. Connect an MCP SDK stdio client to `node scripts/rea.mjs mcp`, inheriting the same isolated directories. Call `import_evidence_bundle` with `{"path":"<absolute bundle path>"}`, then immediately call `get_evidence_bundle` with `{"detail":"complete"}`. Only the parent is registered. 5. Call `inspect_analysis_view`, replacing `<inventory_id>` with the actual ID read above: ```json {"source":{"kind":"retained-evidence","evidence_id":"<inventory_id>"},"view":{"kind":"inventory","collection":"nodes"}} ``` This returns the missing-reference error. Repeat with `parent_id`: it succeeds with two nodes. 6. Control: in a fresh MCP connection, call `open_binary` with the ZIP path, then `inspect_artifact` with `{"detail":"summary"}`, and `export_evidence_bundle` with a new absolute output path. The export contains `inspect_artifact`, `inventory_artifact`, and the derived `inspect_analysis_view` records. The same retained inventory/nodes request succeeds using the atomic inventory record's ID. ### Expected behavior The inventory ID advertised by the CLI summary should remain addressable after importing its complete portable bundle, without rerunning its producer. Source contract at the baseline: `docs/mcp-contracts.md:265-268` promises retention of complete inspection and atomic inventory Evidence; `:310-323` documents inventory IDs and views for both record types; `:390-410` documents import before retained-reference use and complete portable CLI inspection Evidence. `src/cli/analysisEvidenceDelivery.ts:24-26` describes saving complete Evidence as a bundle. The direct MCP control supports the expected addressability. ### Impact and scope Bounded CLI-to-MCP portability failure: callers following an advertised inventory reference cannot page it after import. Inventory bytes are preserved, and using the imported inspection parent's ID for the same view is a verified workaround. Direct MCP inspection is also usable. One reproduction at the baseline and one submission rerun on current upstream produced the same result. Other artifact formats and platforms were not tested; no security-boundary crossing or target execution was observed. ### REA version 6.7.0; source baseline `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. Also reproduced on upstream `052956af3416fa01d93837e54fdec3ad2739f6d1` (package version 6.7.0). ### Runtime and platform Baseline verifier: macOS arm64, installed MCP SDK over local stdio. NOT_ENOUGH_INFO: the verifier did not record the exact Node.js or macOS version. Submission rerun: Node.js 26.12.0 on the same host; no external analysis provider was used. ### Target and artifact context Valid local ZIP containing `hello.txt` (`hello\n`); CLI-exported Evidence bundle with one top-level inspection record and one nested atomic inventory. The safe artifact graph provider performs static inspection. ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence Observed CLI exit status: 0; stderr empty. The immediate complete ledger query ran before any view calls. ```text CLI bundle operations: [inspect_artifact] import_evidence_bundle: {"imported":1,"unknowns_added":0,"total":1} Immediate ledger operations: [inspect_artifact] View using advertised inventory ID: isError=true code: evidence_integrity_mismatch details.reason: missing message: Evidence <inventory_id> is not retained in this session. ... View using imported parent ID: success, examined=2, total=2, exhausted=true Direct MCP control export: 3 records [inspect_artifact, inventory_artifact, inspect_analysis_view] View using direct MCP atomic inventory ID: success, examined=2, total=2 ``` IDs and absolute fixture paths are omitted; reproduction reads the actual IDs from the result and bundle. ### Typed outcome or recovery expected After import, the advertised inventory ID should resolve to the original inventory through `inspect_analysis_view` without rerunning inspection. Preserve the working parent-ID view, inventory content, and Evidence identities. ### Analysis or suspected cause Source-derived reasoning at the baseline: `src/cli/analysisEvidenceDelivery.ts:117-118` writes only the inspection parent as a top-level record. `src/application/investigation/EvidenceLedger.ts:99-125` imports top-level records without separately registering nested inventory Evidence. The direct MCP path supplies substeps as separate source Evidence at `src/server/registerArtifactTools.ts:49-60`. Upstream commit `1417bf943bf49e49b414e8a508bf28a31304be83` added optional `sourceEvidence` to CLI delivery for derived workflows. The current-upstream runtime rerun above confirms it does not restore this artifact inspection workflow. This report does not prescribe whether export or import should own the repair. ### Additional context Prepared with AI assistance and independently reproduced by a separate verifier. No implementation changes were made. Related reports #3459 and #3220 concern selecting inventories after the first nested substep; this report concerns addressability of the sole inventory ID after an ordinary CLI-produced bundle is imported.

bsakaguchi closed this issue

2026-10-31 00:39:02 +00:00

bsakaguchi commented

2026-10-31 00:39:03 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

CLI Evidence delivery now reads inspect_artifact atomic substep Evidence through readArtifactInspectionSources and publishes those records alongside the complete parent, deduplicated by evidence ID. This restores the exact advertised inventory identity after ordinary top-level import rather than inventing a replacement. The updated production CLI/MCP regression obtains the atomic ID from the inspection substep, asserts it is a top-level exported record, imports that bundle, and successfully pages retained inventory using the atomic ID; its remaining flow also verifies parent inline portability after ZIP deletion.

Implementation: analysisEvidenceDelivery.ts, artifactInspection.ts.

The relevant regression checks in analysisViewCli.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. CLI Evidence delivery now reads inspect_artifact atomic substep Evidence through readArtifactInspectionSources and publishes those records alongside the complete parent, deduplicated by evidence ID. This restores the exact advertised inventory identity after ordinary top-level import rather than inventing a replacement. The updated production CLI/MCP regression obtains the atomic ID from the inspection substep, asserts it is a top-level exported record, imports that bundle, and successfully pages retained inventory using the atomic ID; its remaining flow also verifies parent inline portability after ZIP deletion. Implementation: [analysisEvidenceDelivery.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/cli/analysisEvidenceDelivery.ts#L183), [artifactInspection.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/domain/artifactInspection.ts#L449). The relevant regression checks in [analysisViewCli.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/analysisViewCli.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 00:44:27 +00:00

[GH-ISSUE #6380] [Bug] TypeScript member keys, enum members, meta properties, and import attribute keys create false resolved lexical reads #3831

bsakaguchi referenced this issue

2026-10-31 01:09:59 +00:00

[PR #3638] [MERGED] fix(javascript): exclude class member keys from lexical reads #5860

bsakaguchi referenced this issue

2026-11-01 21:47:04 +00:00

[PR #6384] [CLOSED] fix(javascript): exclude type, enum and meta-property names from lexical reads #7325