[GH-ISSUE #6689] [Bug] Bundle-backed Rust feature queries fail for saved Evidence without a features field #4064

New issue

Closed

opened 2026-10-31 00:46:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:46:30 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6689

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

inspect-analysis-view REQUEST --evidence-bundle BUNDLE --json exits 1 with execution_failure when a Rust package page explicitly selects features from an authenticated saved record whose package omits that field. The same bundle imports successfully. The same record queried inline or through a single Evidence file returns the expected features: null; a matched bundle with explicit features: null also succeeds.

These are executed source CLI observations using the production CLI factory and result-output boundary under tsx. The packaged dispatcher and built runtime were not executed.

Reproduction

From the source revision below with its locked dependencies available, run this complete probe with node --import tsx --input-type=module. It creates only synthetic JSON fixtures in a temporary directory. The synthetic artifact path is an identity label and is never opened. No compiler, native analysis provider, or target program runs.

node --import tsx --input-type=module <<'JS'
import { mkdtemp, writeFile } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { Writable } from 'node:stream';
import { createEvidence } from './src/domain/evidence.ts';
import { createEvidenceBundle } from './src/domain/evidenceBundle.ts';
import { createCli, closeCliJavaScriptResources } from './src/cli.ts';
import { createCliResultOutput } from './src/cli/cliResultOutput.ts';
const dir = await mkdtemp(join(process.env.PROBE_ROOT ?? tmpdir(), 'rea-rust-view-'));
const report = {
  artifact: { path: '/artifacts/rust', sha256: 'a'.repeat(64), bytes: 512 },
  format: 'elf', architecture: 'amd64', bits: 64, byte_order: 'little',
  auditable_metadata: {
    section_name: '.dep-v0', file_offset: 32, section_bytes: 64,
    compressed_bytes: 64, uncompressed_bytes: 128, format_version: null,
    packages: [{ name: 'root', version: '1', source: 'local', kind: null,
      root: true, dependencies: [] }],
    root_package_index: 0, dependency_edges: [], cyclic_dependency_indices: []
  },
  rustc_commit: null, limitations: []
};
async function run(label, args) {
  let stdout = '';
  process.exitCode = 0;
  const stream = new Writable({ write(chunk, encoding, done) {
    stdout += chunk.toString(); done();
  }});
  const output = createCliResultOutput(args, stream);
  await createCli({}, output).serve(args, {
    stdout: text => { if (!output?.handled) stdout += text; },
    exit: code => { process.exitCode = code; }
  });
  const value = JSON.parse(stdout);
  console.log(JSON.stringify({ label, status: process.exitCode,
    result: value.normalized_result?.page ?? value }));
  process.exitCode = 0;
}
console.log(JSON.stringify({ node: process.version, platform: process.platform,
  arch: process.arch }));
for (const variant of ['omitted', 'explicit-null']) {
  const result = structuredClone(report);
  if (variant === 'explicit-null') result.auditable_metadata.packages[0].features = null;
  const evidence = createEvidence(
    { path: result.artifact.path, sha256: result.artifact.sha256,
      format: 'elf', architecture: 'x86_64' },
    { id: 'rust-auditable', name: 'Fixture reader', version: '1' },
    { operation: 'inspect_rust_binary', parameters: {}, result }
  );
  const bundle = join(dir, `${variant}.json`);
  await writeFile(bundle, JSON.stringify(createEvidenceBundle([evidence])));
  const view = { kind: 'rust', collection: 'packages', fields: ['features'] };
  if (variant === 'omitted') {
    await run('valid bundle', ['evidence-import', bundle, '--json']);
    await run('inline control', ['inspect-analysis-view',
      JSON.stringify({ source: { kind: 'inline', evidence }, view }), '--json']);
  }
  await run(variant, ['inspect-analysis-view', JSON.stringify({
    source: { kind: 'retained-evidence', evidence_id: evidence.evidence_id }, view
  }), '--evidence-bundle', bundle, '--json']);
}
await closeCliJavaScriptResources();
JS

The complete probe ran once. Separately, each of the same four CLI cases and the single Evidence-file control ran once in fresh source CLI processes; the bundle-backed omitted-field case failed each time it was run. A direct shared-service probe also reproduced the bundle failure and the controls before drafting. The case is self-authored, not an exported real-world Rust binary observation.

Expected behavior

Return a successful package page containing {"index":0,"features":null} for the omitted field, consistently across supported saved-source transports. The Rust package schema explicitly accepts an omitted features property and defaults it to null. The existing legacy-record regression expects precisely that page for saved records from before the field was added. The CLI guide supports resolving the exact retained parent from an authenticated bundle for every supported parent kind.

Impact and scope

A selected fact cannot be queried from an otherwise valid saved Rust bundle, and the diagnostic suggests running doctor although inline delivery of the same observation works. The original data remains intact. The observed scope is the source CLI and its shared service on synthetic saved Evidence with an omitted package field; MCP and the published package runtime were not exercised. Production prevalence is unknown.

A demonstrated workaround is to use the same record inline or as a single evidence-file source instead of a bundle-backed retained reference. Both returned the expected null fact without changing the original Evidence or its identity.

REA version

rea-agents package metadata 6.7.0; executed source revision a7f967cf240eba8309cbf4526b2fc6338a52a617.

Runtime and platform

Node.js v24.22.1; Linux x86_64; tsx 4.23.15. Locked dependencies; no build or full test suite was run.

Target and artifact context

One self-authored, digest-valid inspect_rust_binary Evidence record with a single normalized package and no features property, in a canonical Evidence bundle. It describes a synthetic ELF observation; no ELF file is needed or read. The control differs only by explicitly recording features: null before creating its Evidence identity.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

The recorded inline and fresh-process probes produced the following relevant results; every fresh CLI control had empty stderr:

case                   status  result
valid bundle import    0       imported=1, unknowns_added=0, total=1
inline control         0       rows=[{"features":null,"index":0}]
omitted, bundle        1       execution_failure
explicit-null, bundle  0       rows=[{"features":null,"index":0}]
single Evidence file   0       rows=[{"features":null,"index":0}]

The failing CLI document contained:

{"code":"execution_failure","category":"execution_failure","message":"Analysis could not complete. Run `rea doctor` and review the reported details; repeating the unchanged request is not expected to succeed.","retryable":false,"details":{"provider_id":"rea-analysis-view","operation":"inspect_analysis_view"}}

The direct service call for the same bundle-backed request threw ZodError with {"code":"custom","message":"Invalid JSON value","path":[]}. The owning Rust schema parsed the same report successfully and supplied features: null.

Evidence provenance: observed source CLI and shared-service execution, with source-derived explanation below. Local verification: reproduced. Reproduction completeness: complete for the self-authored saved-Evidence fixture.

Typed outcome or recovery expected

Deliver inspect_analysis_view Evidence whose Rust package page retains the original source index and represents the omitted historical features fact as null. Restoration should preserve the successful inline, single-file, explicit-null, and ordinary bundle-import controls; it should not require altering the saved parent or its evidence ID.

Analysis or suspected cause

Source-derived: bundle view resolution imports an immutable bundle. Rust view parsing validates the report but selects the original sealed object instead of the parsed value. The original lacks the schema's defaulted property. The selected-field projection then emits an undefined features value. This explains the observed JSON-value rejection. No fix was applied or tested.

Additional context

Related closed #6622 concerns raw .dep-v0 input containing a historical features array being rejected during Rust binary inspection. This fixture imports successfully and exercises projection of already normalized saved Evidence lacking the newly added field. Open and closed issue searches for "Rust" "retained", "Rust" "query", "features" "Evidence", and "features" "bundle" did not identify a matching bundle-query report; the parent filing agent will perform the final duplicate check.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A valid saved-Evidence input class fails a documented selected-query workflow with execution_failure; matched source-transport and explicit-null controls succeed, and original data is unchanged.
Workaround status: available
Workaround basis: Querying the same unchanged record inline or through the supported single Evidence-file source returned the expected null fact in executed controls.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6689 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `inspect-analysis-view REQUEST --evidence-bundle BUNDLE --json` exits 1 with `execution_failure` when a Rust package page explicitly selects `features` from an authenticated saved record whose package omits that field. The same bundle imports successfully. The same record queried inline or through a single Evidence file returns the expected `features: null`; a matched bundle with explicit `features: null` also succeeds. These are executed source CLI observations using the production CLI factory and result-output boundary under tsx. The packaged dispatcher and built runtime were not executed. ### Reproduction From the source revision below with its locked dependencies available, run this complete probe with `node --import tsx --input-type=module`. It creates only synthetic JSON fixtures in a temporary directory. The synthetic artifact path is an identity label and is never opened. No compiler, native analysis provider, or target program runs. ```sh node --import tsx --input-type=module <<'JS' import { mkdtemp, writeFile } from 'node:fs/promises'; import { tmpdir } from 'node:os'; import { join } from 'node:path'; import { Writable } from 'node:stream'; import { createEvidence } from './src/domain/evidence.ts'; import { createEvidenceBundle } from './src/domain/evidenceBundle.ts'; import { createCli, closeCliJavaScriptResources } from './src/cli.ts'; import { createCliResultOutput } from './src/cli/cliResultOutput.ts'; const dir = await mkdtemp(join(process.env.PROBE_ROOT ?? tmpdir(), 'rea-rust-view-')); const report = { artifact: { path: '/artifacts/rust', sha256: 'a'.repeat(64), bytes: 512 }, format: 'elf', architecture: 'amd64', bits: 64, byte_order: 'little', auditable_metadata: { section_name: '.dep-v0', file_offset: 32, section_bytes: 64, compressed_bytes: 64, uncompressed_bytes: 128, format_version: null, packages: [{ name: 'root', version: '1', source: 'local', kind: null, root: true, dependencies: [] }], root_package_index: 0, dependency_edges: [], cyclic_dependency_indices: [] }, rustc_commit: null, limitations: [] }; async function run(label, args) { let stdout = ''; process.exitCode = 0; const stream = new Writable({ write(chunk, encoding, done) { stdout += chunk.toString(); done(); }}); const output = createCliResultOutput(args, stream); await createCli({}, output).serve(args, { stdout: text => { if (!output?.handled) stdout += text; }, exit: code => { process.exitCode = code; } }); const value = JSON.parse(stdout); console.log(JSON.stringify({ label, status: process.exitCode, result: value.normalized_result?.page ?? value })); process.exitCode = 0; } console.log(JSON.stringify({ node: process.version, platform: process.platform, arch: process.arch })); for (const variant of ['omitted', 'explicit-null']) { const result = structuredClone(report); if (variant === 'explicit-null') result.auditable_metadata.packages[0].features = null; const evidence = createEvidence( { path: result.artifact.path, sha256: result.artifact.sha256, format: 'elf', architecture: 'x86_64' }, { id: 'rust-auditable', name: 'Fixture reader', version: '1' }, { operation: 'inspect_rust_binary', parameters: {}, result } ); const bundle = join(dir, `${variant}.json`); await writeFile(bundle, JSON.stringify(createEvidenceBundle([evidence]))); const view = { kind: 'rust', collection: 'packages', fields: ['features'] }; if (variant === 'omitted') { await run('valid bundle', ['evidence-import', bundle, '--json']); await run('inline control', ['inspect-analysis-view', JSON.stringify({ source: { kind: 'inline', evidence }, view }), '--json']); } await run(variant, ['inspect-analysis-view', JSON.stringify({ source: { kind: 'retained-evidence', evidence_id: evidence.evidence_id }, view }), '--evidence-bundle', bundle, '--json']); } await closeCliJavaScriptResources(); JS ``` The complete probe ran once. Separately, each of the same four CLI cases and the single Evidence-file control ran once in fresh source CLI processes; the bundle-backed omitted-field case failed each time it was run. A direct shared-service probe also reproduced the bundle failure and the controls before drafting. The case is self-authored, not an exported real-world Rust binary observation. ### Expected behavior Return a successful package page containing `{"index":0,"features":null}` for the omitted field, consistently across supported saved-source transports. The [Rust package schema](https://github.com/morluto/rea/blob/a7f967cf240eba8309cbf4526b2fc6338a52a617/src/domain/rust/rustBinary.ts#L34-L45) explicitly accepts an omitted `features` property and defaults it to null. The [existing legacy-record regression](https://github.com/morluto/rea/blob/a7f967cf240eba8309cbf4526b2fc6338a52a617/src/domain/analysisView/rustBinaryView.test.ts#L80-L108) expects precisely that page for saved records from before the field was added. The [CLI guide](https://github.com/morluto/rea/blob/a7f967cf240eba8309cbf4526b2fc6338a52a617/docs/cli.md#L334-L340) supports resolving the exact retained parent from an authenticated bundle for every supported parent kind. ### Impact and scope A selected fact cannot be queried from an otherwise valid saved Rust bundle, and the diagnostic suggests running doctor although inline delivery of the same observation works. The original data remains intact. The observed scope is the source CLI and its shared service on synthetic saved Evidence with an omitted package field; MCP and the published package runtime were not exercised. Production prevalence is unknown. A demonstrated workaround is to use the same record inline or as a single `evidence-file` source instead of a bundle-backed retained reference. Both returned the expected null fact without changing the original Evidence or its identity. ### REA version `rea-agents` package metadata 6.7.0; executed source revision `a7f967cf240eba8309cbf4526b2fc6338a52a617`. ### Runtime and platform Node.js v24.22.1; Linux x86_64; tsx 4.23.15. Locked dependencies; no build or full test suite was run. ### Target and artifact context One self-authored, digest-valid `inspect_rust_binary` Evidence record with a single normalized package and no `features` property, in a canonical Evidence bundle. It describes a synthetic ELF observation; no ELF file is needed or read. The control differs only by explicitly recording `features: null` before creating its Evidence identity. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence The recorded inline and fresh-process probes produced the following relevant results; every fresh CLI control had empty stderr: ```text case status result valid bundle import 0 imported=1, unknowns_added=0, total=1 inline control 0 rows=[{"features":null,"index":0}] omitted, bundle 1 execution_failure explicit-null, bundle 0 rows=[{"features":null,"index":0}] single Evidence file 0 rows=[{"features":null,"index":0}] ``` The failing CLI document contained: ```json {"code":"execution_failure","category":"execution_failure","message":"Analysis could not complete. Run `rea doctor` and review the reported details; repeating the unchanged request is not expected to succeed.","retryable":false,"details":{"provider_id":"rea-analysis-view","operation":"inspect_analysis_view"}} ``` The direct service call for the same bundle-backed request threw `ZodError` with `{"code":"custom","message":"Invalid JSON value","path":[]}`. The owning Rust schema parsed the same report successfully and supplied `features: null`. Evidence provenance: observed source CLI and shared-service execution, with source-derived explanation below. Local verification: reproduced. Reproduction completeness: complete for the self-authored saved-Evidence fixture. ### Typed outcome or recovery expected Deliver `inspect_analysis_view` Evidence whose Rust package page retains the original source index and represents the omitted historical `features` fact as null. Restoration should preserve the successful inline, single-file, explicit-null, and ordinary bundle-import controls; it should not require altering the saved parent or its evidence ID. ### Analysis or suspected cause Source-derived: [bundle view resolution](https://github.com/morluto/rea/blob/a7f967cf240eba8309cbf4526b2fc6338a52a617/src/application/analysisView/AnalysisViewService.ts#L141-L159) imports an immutable bundle. [Rust view parsing](https://github.com/morluto/rea/blob/a7f967cf240eba8309cbf4526b2fc6338a52a617/src/domain/analysisView/rustBinaryView.ts#L65-L80) validates the report but selects the original sealed object instead of the parsed value. The original lacks the schema's defaulted property. The [selected-field projection](https://github.com/morluto/rea/blob/a7f967cf240eba8309cbf4526b2fc6338a52a617/src/domain/analysisView/rustBinaryView.ts#L222-L234) then emits an undefined `features` value. This explains the observed JSON-value rejection. No fix was applied or tested. ### Additional context Related closed [#6622](https://github.com/morluto/rea/issues/6622) concerns raw `.dep-v0` input containing a historical `features` array being rejected during Rust binary inspection. This fixture imports successfully and exercises projection of already normalized saved Evidence lacking the newly added field. Open and closed issue searches for `"Rust" "retained"`, `"Rust" "query"`, `"features" "Evidence"`, and `"features" "bundle"` did not identify a matching bundle-query report; the parent filing agent will perform the final duplicate check. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A valid saved-Evidence input class fails a documented selected-query workflow with execution_failure; matched source-transport and explicit-null controls succeed, and original data is unchanged. - Workaround status: available - Workaround basis: Querying the same unchanged record inline or through the supported single Evidence-file source returned the expected null fact in executed controls.

bsakaguchi closed this issue

2026-10-31 00:46:30 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:18 +00:00

[PR #4064] [CLOSED] fix(mcp): advertise boolean literals as typed booleans #6029