morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5808] [Design] Audit recovery controls for remaining provider timeouts and limits #3514

New issue

Open

opened 2026-10-31 00:41:22 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-31 00:41:22 +00:00

Owner

Originally created by @gensokyo-dev on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5808

Before submitting

Searched related reports and compared the current source; this tracks follow-up coverage, not a duplicate claim that all provider budgets are fixed.
Reviewed contribution scope; unresolved authority or verification questions must be resolved before integration.
No credentials, private samples or sensitive target data.

Area

MCP or agent integration

Decision needed

Audit remaining timeout/limit recovery at each producing boundary. A real adjustable budget must name the exact CLI/MCP/configuration control, units, scope, valid range, restart/retry boundary and cleanup condition. A fixed safety/representation ceiling must say it is fixed and offer only supported narrowing/selection/paging or an honest blocker. Do not globally recommend increasing a client deadline/heap or waiting for deterministic refusals.

This is a bounded source-derived follow-up, not a claim of runtime failure for every listed provider. WABT is implemented and experimentally verified in #5797 / #5798; the 13-session actual Codex evidence includes actual larger-budget recovery, fixed-limit refusal and partial Evidence summary retrieval.

Context and evidence

Owner	Source-derived state / remaining question
SQLite worker	`SqliteDatabaseLimits.ts` fixes 30,000 ms; `SqliteDatabaseWorkerExecution.ts` uses it; `SqliteDatabaseFailures.ts` projects a generic timeout. Current public schema has exact table/columns/sample selection, no timeout knob. Decide and implement a safe per-call worker budget or explicitly fixed recovery; never suggest a nonexistent current argument. Preserve frozen DB/WAL identity, byte/heap/reply limits, partial facts and owned cleanup.
Firmware analysis	`FirmwareRelease.ts` / provider/command use 120,000 ms analysis budgets. `FirmwareFailures.ts` gives specific guidance for adjustable publication but generic analysis timeout guidance. Analysis and publication must remain distinct; `publication_timeout_ms` cannot repair an analysis-phase timeout. Check both outer and command deadlines before proposing an actual control.
Ghidra/Hopper startup	Existing environment settings (`REA_GHIDRA_STARTUP_TIMEOUT_MS`, `REA_HOPPER_STARTUP_TIMEOUT_MS`) already have startup guidance; verify exact launch/restart/close semantics rather than replacing them with a per-call fiction. No new runtime qualification in this report.
JavaScript analysis	Existing per-source `analysis_timeout_ms`, semantic limits and selectors; prior #5608. Check total-versus-source and memory/transfer refusal interactions separately. Summary changes delivery, not analysis work.
Fixed allowances	Current main includes `fixedAllowanceOptions` and multiple non-retryable corrections, including #5506's WASM comparison path. Audit residual producer-specific refusals without making permanent caps adjustable or occupied capacity permanently non-retryable.

Verification available so far

Source observations for remaining providers; executed WABT results linked above. Remaining real-provider and actual-agent checks are proposed, not completed.

Expected interaction with targets

Read existing files/captured data and launch existing caller-supplied analysis tools in their current private-workspace workflows. No target program execution, new attachment/injection, network service, protection recovery or source mutation is authorized by this tracker.

Success criteria and open questions

For each remaining focused issue: latest-main worktree/branch, reproduce a minimal real boundary failure, fail-before/pass-after guard at its owner, exact advertised-schema/CLI control verification, actual Codex CLI corrected success where an authorized repair exists, and honest blocked controls where it does not. Include rejected/partial Evidence and timeout-plus-cleanup combinations, not just happy-path profiles. Keep full Evidence accessible without forcing whole-report delivery. Measure whole-session tokens, elapsed, CPU and process-family memory with cold/warm and sampling limits explicit; bound CPU/memory and concurrency.

No target execution, provider installation, protection recovery or new mutation capability is proposed by this tracker. Such expansions would require their own scope decision. New knobs should preserve current defaults and real safety limits.

Impact / unknowns

NOT_ENOUGH_INFO: natural timeout frequency, large-target performance and affected releases for the remaining owners are unmeasured. The rows above are source observations and proposed checks, not claims of real-provider reproduction. This is not an exhaustive inventory of every REA timeout or limit.

Originally created by @gensokyo-dev on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5808 ### Before submitting - [x] Searched related reports and compared the current source; this tracks follow-up coverage, not a duplicate claim that all provider budgets are fixed. - [x] Reviewed contribution scope; unresolved authority or verification questions must be resolved before integration. - [x] No credentials, private samples or sensitive target data. ### Area MCP or agent integration ### Decision needed Audit remaining timeout/limit recovery at each producing boundary. A real adjustable budget must name the exact CLI/MCP/configuration control, units, scope, valid range, restart/retry boundary and cleanup condition. A fixed safety/representation ceiling must say it is fixed and offer only supported narrowing/selection/paging or an honest blocker. Do not globally recommend increasing a client deadline/heap or waiting for deterministic refusals. This is a **bounded source-derived follow-up**, not a claim of runtime failure for every listed provider. WABT is implemented and experimentally verified in #5797 / #5798; the [13-session actual Codex evidence](https://github.com/morluto/rea/issues/5797#issuecomment-6309988721) includes actual larger-budget recovery, fixed-limit refusal and partial Evidence summary retrieval. ### Context and evidence | Owner | Source-derived state / remaining question | | --- | --- | | SQLite worker | `SqliteDatabaseLimits.ts` fixes 30,000 ms; `SqliteDatabaseWorkerExecution.ts` uses it; `SqliteDatabaseFailures.ts` projects a generic timeout. Current public schema has exact table/columns/sample selection, **no timeout knob**. Decide and implement a safe per-call worker budget or explicitly fixed recovery; never suggest a nonexistent current argument. Preserve frozen DB/WAL identity, byte/heap/reply limits, partial facts and owned cleanup. | | Firmware analysis | `FirmwareRelease.ts` / provider/command use 120,000 ms analysis budgets. `FirmwareFailures.ts` gives specific guidance for adjustable publication but generic analysis timeout guidance. Analysis and publication must remain distinct; **`publication_timeout_ms` cannot repair an analysis-phase timeout**. Check both outer and command deadlines before proposing an actual control. | | Ghidra/Hopper startup | Existing environment settings (`REA_GHIDRA_STARTUP_TIMEOUT_MS`, `REA_HOPPER_STARTUP_TIMEOUT_MS`) already have startup guidance; verify exact launch/restart/close semantics rather than replacing them with a per-call fiction. No new runtime qualification in this report. | | JavaScript analysis | Existing per-source `analysis_timeout_ms`, semantic limits and selectors; prior #5608. Check total-versus-source and memory/transfer refusal interactions separately. Summary changes delivery, not analysis work. | | Fixed allowances | Current main includes `fixedAllowanceOptions` and multiple non-retryable corrections, including #5506's WASM comparison path. Audit residual producer-specific refusals without making permanent caps adjustable or occupied capacity permanently non-retryable. | ### Verification available so far Source observations for remaining providers; executed WABT results linked above. Remaining real-provider and actual-agent checks are proposed, not completed. ### Expected interaction with targets Read existing files/captured data and launch existing caller-supplied analysis tools in their current private-workspace workflows. No target program execution, new attachment/injection, network service, protection recovery or source mutation is authorized by this tracker. ### Success criteria and open questions For each remaining focused issue: latest-main worktree/branch, reproduce a minimal real boundary failure, fail-before/pass-after guard at its owner, exact advertised-schema/CLI control verification, actual Codex CLI corrected success where an authorized repair exists, and honest blocked controls where it does not. Include rejected/partial Evidence and timeout-plus-cleanup combinations, not just happy-path profiles. Keep full Evidence accessible without forcing whole-report delivery. Measure whole-session tokens, elapsed, CPU and process-family memory with cold/warm and sampling limits explicit; bound CPU/memory and concurrency. No target execution, provider installation, protection recovery or new mutation capability is proposed by this tracker. Such expansions would require their own scope decision. New knobs should preserve current defaults and real safety limits. ### Impact / unknowns NOT_ENOUGH_INFO: natural timeout frequency, large-target performance and affected releases for the remaining owners are unmeasured. The rows above are source observations and proposed checks, not claims of real-provider reproduction. This is not an exhaustive inventory of every REA timeout or limit.

bsakaguchi commented

2026-10-31 00:41:23 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 21, 2026):

The per-owner table is the right structure for this audit — separating "real adjustable budget" from "fixed ceiling with honest refusal" prevents exactly the failure mode where a client bumps a deadline to paper over a fixed representation limit. A few observations: (1) the firmware row is the one most worth prioritizing, because analysis vs publication timeouts are easily conflated and a caller will try publication_timeout_ms for an analysis-phase timeout; making that mismatch explicit in FirmwareFailures.ts guidance is cheap and high-value. (2) For JavaScript analysis, "summary changes delivery, not analysis work" is an important distinction — a partial-summary recovery must not be advertised as a larger analysis budget. (3) The Ghidra/Hopper row's "verify exact launch/restart/close semantics rather than replacing them with a per-call fiction" is the right call; env-var startup timeouts already exist, so the deliverable there is verification, not new knobs. Overall this reads as a well-bounded tracker, and the fail-before/pass-after guard per owner is the right acceptance bar.

@XinwangTao commented on GitHub (Oct 21, 2026): The per-owner table is the right structure for this audit — separating "real adjustable budget" from "fixed ceiling with honest refusal" prevents exactly the failure mode where a client bumps a deadline to paper over a fixed representation limit. A few observations: (1) the firmware row is the one most worth prioritizing, because analysis vs publication timeouts are easily conflated and a caller will try publication_timeout_ms for an analysis-phase timeout; making that mismatch explicit in FirmwareFailures.ts guidance is cheap and high-value. (2) For JavaScript analysis, "summary changes delivery, not analysis work" is an important distinction — a partial-summary recovery must not be advertised as a larger analysis budget. (3) The Ghidra/Hopper row's "verify exact launch/restart/close semantics rather than replacing them with a per-call fiction" is the right call; env-var startup timeouts already exist, so the deliverable there is verification, not new knobs. Overall this reads as a well-bounded tracker, and the fail-before/pass-after guard per owner is the right acceptance bar.

bsakaguchi commented

2026-10-31 00:41:23 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 21, 2026):

SQLite focused follow-up #5812 / #5818 now has 13 actual Codex CLI sessions and final local evidence: https://github.com/morluto/rea/issues/5812#issuecomment-6311506440 . Four deliberately tight worker deadlines recovered by selecting the named real budget; fixed value/input limits did not become adjustable. Three pre-dispatch sessions reported unavailable tools without any REA call or transport error captured; root cause (model discovery, host routing/registration or prompt constraints) is not established and these are not counted as recovery passes. Keep that discovery question separate from tool/provider timeout repair. Remaining firmware/startup/other-provider rows in this tracker are not claimed complete. A pre-existing WABT CLI test-oracle failure is separately recorded as #5845.

@gensokyo-dev commented on GitHub (Oct 21, 2026): SQLite focused follow-up #5812 / #5818 now has 13 actual Codex CLI sessions and final local evidence: https://github.com/morluto/rea/issues/5812#issuecomment-6311506440 . Four deliberately tight worker deadlines recovered by selecting the named real budget; fixed value/input limits did not become adjustable. Three pre-dispatch sessions reported unavailable tools without any REA call or transport error captured; root cause (model discovery, host routing/registration or prompt constraints) is not established and these are not counted as recovery passes. Keep that discovery question separate from tool/provider timeout repair. Remaining firmware/startup/other-provider rows in this tracker are not claimed complete. A pre-existing WABT CLI test-oracle failure is separately recorded as #5845.

bsakaguchi commented

2026-10-31 00:41:23 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 21, 2026):

Firmware follow-up #5851 / PR #5863 now exposes one selectable analysis deadline through CLI/MCP, independent extraction publication recovery, retained actual settings and typed cleanup history. Executed final-head checks: 393 passed / 3 platform skips; 18 actual Codex qualification attempts (16 reached REA: 10 corrected successes, 6 accurate blockers; two zero-call reports not counted). Full evidence, whole-session cost and real-provider limits: https://github.com/morluto/rea/issues/5851#issuecomment-6313469058. Real Binwalk report-missing intermittency was reproduced on pre-PR f801b2fb and separately recorded as #5876; it is not claimed fixed. Other provider rows remain open; merge/review/CI still being monitored.

@gensokyo-dev commented on GitHub (Oct 21, 2026): Firmware follow-up #5851 / PR #5863 now exposes one selectable analysis deadline through CLI/MCP, independent extraction publication recovery, retained actual settings and typed cleanup history. Executed final-head checks: 393 passed / 3 platform skips; 18 actual Codex qualification attempts (16 reached REA: 10 corrected successes, 6 accurate blockers; two zero-call reports not counted). Full evidence, whole-session cost and real-provider limits: https://github.com/morluto/rea/issues/5851#issuecomment-6313469058. Real Binwalk report-missing intermittency was reproduced on pre-PR f801b2fb and separately recorded as #5876; it is not claimed fixed. Other provider rows remain open; merge/review/CI still being monitored.

bsakaguchi commented

2026-10-31 00:41:23 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 21, 2026):

Firmware analysis-budget follow-up #5851 is now merged via #5863 (aa53c06538). Shared CLI/MCP per-call analysis_timeout_ms, phase-specific recovery, preserved fixed safety limits and typed interruption/capture ownership are implemented. Actual-merge verification includes a fresh pinned build, nine synthetic CLI/MCP pairs, three official OpenWrt-image pairs and an actual Codex timeout-to-success session with final facts checked against Evidence. Qualification now totals 19 attempts: 11 corrected successes, 6 correct blockers, 2 zero-call reports not counted as passes. Details and full-session costs: https://github.com/morluto/rea/issues/5851#issuecomment-6314954956. Remaining provider timeout/limit audit stays open here; #5876/#5889 remain explicitly unresolved.

@gensokyo-dev commented on GitHub (Oct 21, 2026): Firmware analysis-budget follow-up #5851 is now merged via #5863 (aa53c065387c58b4189d82c47f1f3445fc505e30). Shared CLI/MCP per-call analysis_timeout_ms, phase-specific recovery, preserved fixed safety limits and typed interruption/capture ownership are implemented. Actual-merge verification includes a fresh pinned build, nine synthetic CLI/MCP pairs, three official OpenWrt-image pairs and an actual Codex timeout-to-success session with final facts checked against Evidence. Qualification now totals 19 attempts: 11 corrected successes, 6 correct blockers, 2 zero-call reports not counted as passes. Details and full-session costs: https://github.com/morluto/rea/issues/5851#issuecomment-6314954956. Remaining provider timeout/limit audit stays open here; #5876/#5889 remain explicitly unresolved.

bsakaguchi referenced this issue

2026-10-31 01:09:29 +00:00

[PR #3514] [CLOSED] fix(javascript): preserve HTML URL path identity #5794

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3514

No description provided.

Rows
Columns