[GH-ISSUE #6003] [Bug] Binary-layout analysis views discard malformed parent field diagnostics #3672

New issue

Closed

opened 2026-10-31 00:42:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:42:55 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6003

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

inspect-analysis-view discards the owning binary-layout schema's field diagnostics when authenticated inline Evidence contains a malformed layout result. A layout with exactly one bad field, artifact.bytes set to a string, produces one generic issue at ["source"] with reason invalid_value. The owning schema identifies ["artifact","bytes"] and invalid_type. The same synthetic layout with a numeric byte count succeeds.

Reproduction

From a built checkout on Node 26, generate digest-valid synthetic Evidence using the repository's minimal layout fixture. No provider is needed. These cases were executed through the built CLI:

node --input-type=module <<'JS'
import { writeFileSync } from 'node:fs';
import { createEvidence } from './dist/domain/evidence.js';
import { binaryLayoutSchema } from './dist/domain/native/binaryLayout.js';
import { binaryLayoutFixture } from './tests/fixtures/binaryDiagnostics/layout.ts';
for (const [name, result] of Object.entries({
  valid: binaryLayoutFixture('fixture.elf'),
  malformed: {
    ...binaryLayoutFixture('fixture.elf'),
    artifact: {path:'fixture.elf', sha256:'a'.repeat(64), bytes:'bad'}
  },
  empty: {}
})) {
  const parsed = binaryLayoutSchema.safeParse(result);
  console.log(name, parsed.success ? 'valid' : parsed.error.issues);
  const evidence = createEvidence(
    {path:'fixture.elf', format:'elf', sha256:'a'.repeat(64)},
    {id:'fixture', name:'Fixture', version:'1'},
    {operation:'inspect_binary_layout', parameters:{}, result}
  );
  writeFileSync(name + '.json', JSON.stringify({
    source: {kind:'inline', evidence}, view: {kind:'summary'}
  }));
}
JS
node scripts/rea.mjs inspect-analysis-view valid.json --json
node scripts/rea.mjs inspect-analysis-view malformed.json --json
node scripts/rea.mjs inspect-analysis-view empty.json --json

The valid request exits 0 with summary Evidence. Both malformed requests exit 1 with empty stderr and the same single generic source issue. Each ran once. These are synthetic layout results exercising the actual CLI, Evidence authentication and production parser; no pwntools or native engine was run.

Expected behavior

Preserve the owning schema's issues under the existing analysis-view convention ["source","normalized_result",...issue.path], including the field and safe type/value reason. For the single malformed field, identify source.normalized_result.artifact.bytes with reason invalid_type.

The shared parent parser explicitly implements this convention, as does the sibling native-function branch. This logical correction-path convention omits the inline transport's evidence wrapper; no new path convention is proposed.

Impact and scope

P3: lost correction detail for rejected parent data. Validation still fails closed, error classification remains correct, and valid synthetic layout data succeeds. A caller can separately validate the parent with the owning schema or regenerate the layout, but the returned diagnostic does not identify the rejected field. No valid-input failure, incorrect layout facts, data loss or actual downstream recovery failure was observed. Production frequency is unknown.

Executed scope is CLI with synthetic inline inspect_binary_layout Evidence. No claim is made that the real layout producer emits these malformed results.

REA version

rea-agents 6.7.0; source revision 5241597594.

Runtime and platform

Node.js v26.12.0; macOS 27.0.1 arm64; existing built runtime and locked dependencies.

Target and artifact context

Digest-valid synthetic inspect_binary_layout Evidence. The complete control fixture models a minimal ELF; malformed variants use a string byte count or an empty result. No actual binary file or external analysis engine is accessed.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

The direct owning-schema check for the otherwise-valid malformed layout returned exactly one issue:

{"expected":"number","code":"invalid_type","path":["artifact","bytes"],"message":"Invalid input: expected number, received string"}

Relevant fields from actual CLI stdout:

{
  "code": "invalid_request",
  "category": "invalid_input",
  "retryable": false,
  "details": {
    "operation": "inspect_analysis_view",
    "issues": [{
      "path": ["source"],
      "reason": "invalid_value",
      "message": "Parent Evidence result does not match inspect_binary_layout."
    }]
  }
}

The empty result produced sixteen owning-schema issues, then the same one generic public issue. The valid fixture produced inspect_analysis_view summary Evidence.

Typed outcome or recovery expected

Keep invalid_request / invalid_input, retryable:false, and inspect_input_contract recovery. Return the safe schema issue details, preserving field paths and reasons. Do not accept malformed layout facts or change Evidence authentication.

Analysis or suspected cause

Source-derived: safeParseOwnedBinaryLayout returns schema errors, but the dispatcher replaces them with a fixed issue rather than mapping layout.error.issues. The information is discarded at that branch, before CLI error serialization.

Additional context

PR #3122 was checked by reading its body, diff and discussion. It corrects pcap schema issue prefixes and shares the existing web-network parser; it does not touch this binary-layout branch. Its application would leave this reproduction unchanged. PR #4859 explicitly preserves the layout error projection while changing caching. PR #1089 concerns separate managed/reconstruction handlers; #2589 / #3065 concern executable inline representations. #5950, #5971 and #5980 affect separate native-matching, Android and Kuna producers.

Fetched upstream main c538a843cb retains the relevant binary-layout rejection and shared parent parser unchanged. That later source was inspected, not executed. MCP uses the same production service by source inspection but was not separately exercised.

Originally created by @coygeek on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6003 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `inspect-analysis-view` discards the owning binary-layout schema's field diagnostics when authenticated inline Evidence contains a malformed layout result. A layout with exactly one bad field, artifact.bytes set to a string, produces one generic issue at `["source"]` with reason invalid_value. The owning schema identifies `["artifact","bytes"]` and invalid_type. The same synthetic layout with a numeric byte count succeeds. ### Reproduction From a built checkout on Node 26, generate digest-valid synthetic Evidence using the repository's minimal layout fixture. No provider is needed. These cases were executed through the built CLI: ```sh node --input-type=module <<'JS' import { writeFileSync } from 'node:fs'; import { createEvidence } from './dist/domain/evidence.js'; import { binaryLayoutSchema } from './dist/domain/native/binaryLayout.js'; import { binaryLayoutFixture } from './tests/fixtures/binaryDiagnostics/layout.ts'; for (const [name, result] of Object.entries({ valid: binaryLayoutFixture('fixture.elf'), malformed: { ...binaryLayoutFixture('fixture.elf'), artifact: {path:'fixture.elf', sha256:'a'.repeat(64), bytes:'bad'} }, empty: {} })) { const parsed = binaryLayoutSchema.safeParse(result); console.log(name, parsed.success ? 'valid' : parsed.error.issues); const evidence = createEvidence( {path:'fixture.elf', format:'elf', sha256:'a'.repeat(64)}, {id:'fixture', name:'Fixture', version:'1'}, {operation:'inspect_binary_layout', parameters:{}, result} ); writeFileSync(name + '.json', JSON.stringify({ source: {kind:'inline', evidence}, view: {kind:'summary'} })); } JS node scripts/rea.mjs inspect-analysis-view valid.json --json node scripts/rea.mjs inspect-analysis-view malformed.json --json node scripts/rea.mjs inspect-analysis-view empty.json --json ``` The valid request exits 0 with summary Evidence. Both malformed requests exit 1 with empty stderr and the same single generic source issue. Each ran once. These are synthetic layout results exercising the actual CLI, Evidence authentication and production parser; no pwntools or native engine was run. ### Expected behavior Preserve the owning schema's issues under the existing analysis-view convention `["source","normalized_result",...issue.path]`, including the field and safe type/value reason. For the single malformed field, identify source.normalized_result.artifact.bytes with reason invalid_type. [The shared parent parser](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisView/analysisViewParent.ts#L7-L25) explicitly implements this convention, as does [the sibling native-function branch](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisView/analysisView.ts#L1096-L1111). This logical correction-path convention omits the inline transport's evidence wrapper; no new path convention is proposed. ### Impact and scope P3: lost correction detail for rejected parent data. Validation still fails closed, error classification remains correct, and valid synthetic layout data succeeds. A caller can separately validate the parent with the owning schema or regenerate the layout, but the returned diagnostic does not identify the rejected field. No valid-input failure, incorrect layout facts, data loss or actual downstream recovery failure was observed. Production frequency is unknown. Executed scope is CLI with synthetic inline inspect_binary_layout Evidence. No claim is made that the real layout producer emits these malformed results. ### REA version rea-agents 6.7.0; source revision 52415975942a4b9c53a817915b313ccc404f280e. ### Runtime and platform Node.js v26.12.0; macOS 27.0.1 arm64; existing built runtime and locked dependencies. ### Target and artifact context Digest-valid synthetic inspect_binary_layout Evidence. The complete control fixture models a minimal ELF; malformed variants use a string byte count or an empty result. No actual binary file or external analysis engine is accessed. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence The direct owning-schema check for the otherwise-valid malformed layout returned exactly one issue: ```json {"expected":"number","code":"invalid_type","path":["artifact","bytes"],"message":"Invalid input: expected number, received string"} ``` Relevant fields from actual CLI stdout: ```json { "code": "invalid_request", "category": "invalid_input", "retryable": false, "details": { "operation": "inspect_analysis_view", "issues": [{ "path": ["source"], "reason": "invalid_value", "message": "Parent Evidence result does not match inspect_binary_layout." }] } } ``` The empty result produced sixteen owning-schema issues, then the same one generic public issue. The valid fixture produced inspect_analysis_view summary Evidence. ### Typed outcome or recovery expected Keep invalid_request / invalid_input, retryable:false, and inspect_input_contract recovery. Return the safe schema issue details, preserving field paths and reasons. Do not accept malformed layout facts or change Evidence authentication. ### Analysis or suspected cause Source-derived: [safeParseOwnedBinaryLayout](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/native/binaryLayout.ts#L323-L339) returns schema errors, but [the dispatcher](https://github.com/morluto/rea/blob/52415975942a4b9c53a817915b313ccc404f280e/src/domain/analysisView/analysisView.ts#L1070-L1082) replaces them with a fixed issue rather than mapping layout.error.issues. The information is discarded at that branch, before CLI error serialization. ### Additional context PR #3122 was checked by reading its body, diff and discussion. It corrects pcap schema issue prefixes and shares the existing web-network parser; it does not touch this binary-layout branch. Its application would leave this reproduction unchanged. PR #4859 explicitly preserves the layout error projection while changing caching. PR #1089 concerns separate managed/reconstruction handlers; #2589 / #3065 concern executable inline representations. #5950, #5971 and #5980 affect separate native-matching, Android and Kuna producers. Fetched upstream main c538a843cb49f7156f86beb3b21501e03255af9a retains the relevant binary-layout rejection and shared parent parser unchanged. That later source was inspected, not executed. MCP uses the same production service by source inspection but was not separately exercised.

bsakaguchi closed this issue

2026-10-31 00:42:55 +00:00

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471