morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7304] [Bug] Artifact reconstruction can pass when comparison rows record a change #4340

New issue

Open

opened 2026-10-31 00:49:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:02 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 26, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7304

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Source-confirmed: verify_reconstruction can pass an overall structural-artifact claim when a caller-owned imported comparison has an unchanged aggregate but retains a changed row. The row remains in the comparison, while verification reports the selected observation as unchanged. An independently supplied hunter run reported the same domain-module result; I did not run that probe or an MCP/CLI reproduction.

Reproduction

This is a source-only report; no inconsistent Evidence generator or runtime replay is included. The concrete source case uses the repository's canonical artifact-comparison example: two distinct complete root inventories with observed shipped-artifact authority and non-null file subjects. The selected imported comparison has the required derived/analyst-inference identity, complete source references and valid row citations, but its aggregate disagrees with its retained changed row. There are no residual unknowns. Inspect the production admission and classification path listed below: every existing guard admits these premises, and the artifact branch reads only the aggregate. The supplied domain run reported pass for this case and fail for the consistent changed control. Public MCP execution remains untested.

Expected behavior

A declared structural claim must not pass on a comparison whose own retained row records a change. Verification should withhold pass and explain the inconsistency, or reject the comparison with a typed diagnostic. Preserve pass for consistent complete unchanged comparisons and fail for consistent changed comparisons.

Impact and scope

P2: a bounded caller-owned import workflow can return an incorrect verification result. The in-process artifact comparator derives consistent aggregates, so this report concerns semantic consistency of supplied comparison data. Canonical IDs establish content identity; they do not attest who produced a record. The scoped caller-owned workflow crosses no independent authentication or authorization boundary. Downstream incidents and real-world frequency are unknown. Recomputing the comparison from the retained inventories with compare_artifacts is a source-supported workaround; the supplied honest changed control failed verification as expected.

REA version

Source revision 0d1a454e25.

Runtime and platform

Independent verification used source inspection only. The supplied domain-module observation used prepared compiled output with Node.js 24.22.1 on macOS arm64. No target or provider was run for this report.

Target and artifact context

Caller-owned local Evidence bundle containing two synthetic file inventory observations and one derived artifact comparison. The existing canonical example supplies the unmodified inventory records; no binary execution, extraction or external acquisition is involved.

Interface

MCP

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Expected source: src/contracts/sessionToolContracts.ts:142 limits pass to complete comparable declared claims and says changed claims fail; src/domain/artifactComparison.ts:200 derives native aggregate status from coverage and retained change classifications.
Failure source: src/domain/artifactComparison.ts:80 validates status, summary and rows independently; src/domain/comparisonEvidenceResult.ts:68 checks schema and row citation closure; src/domain/reconstructionVerification.ts:336 selects only the artifact aggregate, and :425 classifies an unchanged observation without blockers as pass.
Evidence provenance: static, independently traced from the public registration through admission, retention, verification and result delivery. The domain-module pass and consistent-control fail are supplied hunter observations, not my executions.
Local verification: static-proof; runtime reproduction was not run. src/server/registerSessionRecordTools.ts:93 reads the local bundle through src/application/EvidenceBundleFiles.ts; src/domain/evidenceBundle.ts:345 checks record identities, canonical manifests and unknown history without artifact aggregate semantics. Session merge passes through src/application/binary/BinarySessionRecords.ts:168 and src/application/investigation/EvidenceLedger.ts:84. src/server/registerInvestigationTools.ts:278 verifies the retained bundle. Comparison identity, source-role equality, inventory commitments, authority/confidence, distinct non-null source subjects and empty unknown history satisfy the verifier guards. Source definitions are in src/contracts/artifactComparisonExample.ts; no unsupported helper-only path is assumed.
Reproduction completeness: complete for the stated supported-path static proof; neither MCP transport nor CLI execution is claimed.

The comparison and verification both retain derived confidence and analyst-inference authority. The source path validates caller-owned data and derives a result within the same session; this report does not assert signed authenticity or protection against malicious producers.

Typed outcome or recovery expected

Restoration check: the stated aggregate/row disagreement must stop supporting pass, with a typed rejection, failed claim, or unknown result that explains the inconsistency. Keep consistent complete unchanged comparisons passing and consistent changed comparisons failing. Preserve imported source Evidence and its citations.

Additional context

The closed process aggregate report and function aggregate fix concern different comparison schemas; their guards are present in this baseline. The artifact schema remains independent. Full-index and paginated live open/closed searches found no exact artifact aggregate/row duplicate. The readiness evaluator documentation is not used as a production contract here.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Complete source tracing establishes a bounded incorrect overall verification result for caller-owned imported artifact comparisons whose aggregate disagrees with a retained change; ordinary native production derives consistent status, and broader frequency is unknown.
Workaround status: available
Workaround basis: The normal public artifact comparator derives status from the retained inventories and rows; recomputing avoids reliance on the inconsistent supplied aggregate. This is supported by source and the supplied honest changed control, without an independent runtime rerun.

Originally created by @coygeek on GitHub (Oct 26, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7304 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior Source-confirmed: `verify_reconstruction` can pass an overall structural-artifact claim when a caller-owned imported comparison has an unchanged aggregate but retains a changed row. The row remains in the comparison, while verification reports the selected observation as unchanged. An independently supplied hunter run reported the same domain-module result; I did not run that probe or an MCP/CLI reproduction. ## Reproduction This is a source-only report; no inconsistent Evidence generator or runtime replay is included. The concrete source case uses the repository's canonical artifact-comparison example: two distinct complete root inventories with observed shipped-artifact authority and non-null file subjects. The selected imported comparison has the required derived/analyst-inference identity, complete source references and valid row citations, but its aggregate disagrees with its retained changed row. There are no residual unknowns. Inspect the production admission and classification path listed below: every existing guard admits these premises, and the artifact branch reads only the aggregate. The supplied domain run reported pass for this case and fail for the consistent changed control. Public MCP execution remains untested. ## Expected behavior A declared structural claim must not pass on a comparison whose own retained row records a change. Verification should withhold pass and explain the inconsistency, or reject the comparison with a typed diagnostic. Preserve pass for consistent complete unchanged comparisons and fail for consistent changed comparisons. ## Impact and scope P2: a bounded caller-owned import workflow can return an incorrect verification result. The in-process artifact comparator derives consistent aggregates, so this report concerns semantic consistency of supplied comparison data. Canonical IDs establish content identity; they do not attest who produced a record. The scoped caller-owned workflow crosses no independent authentication or authorization boundary. Downstream incidents and real-world frequency are unknown. Recomputing the comparison from the retained inventories with `compare_artifacts` is a source-supported workaround; the supplied honest changed control failed verification as expected. ## REA version Source revision 0d1a454e25db825567782e461da21530bad4b158. ## Runtime and platform Independent verification used source inspection only. The supplied domain-module observation used prepared compiled output with Node.js 24.22.1 on macOS arm64. No target or provider was run for this report. ## Target and artifact context Caller-owned local Evidence bundle containing two synthetic file inventory observations and one derived artifact comparison. The existing canonical example supplies the unmodified inventory records; no binary execution, extraction or external acquisition is involved. ## Interface MCP ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence - Expected source: `src/contracts/sessionToolContracts.ts:142` limits pass to complete comparable declared claims and says changed claims fail; `src/domain/artifactComparison.ts:200` derives native aggregate status from coverage and retained change classifications. - Failure source: `src/domain/artifactComparison.ts:80` validates status, summary and rows independently; `src/domain/comparisonEvidenceResult.ts:68` checks schema and row citation closure; `src/domain/reconstructionVerification.ts:336` selects only the artifact aggregate, and `:425` classifies an unchanged observation without blockers as pass. - Evidence provenance: static, independently traced from the public registration through admission, retention, verification and result delivery. The domain-module pass and consistent-control fail are supplied hunter observations, not my executions. - Local verification: static-proof; runtime reproduction was not run. `src/server/registerSessionRecordTools.ts:93` reads the local bundle through `src/application/EvidenceBundleFiles.ts`; `src/domain/evidenceBundle.ts:345` checks record identities, canonical manifests and unknown history without artifact aggregate semantics. Session merge passes through `src/application/binary/BinarySessionRecords.ts:168` and `src/application/investigation/EvidenceLedger.ts:84`. `src/server/registerInvestigationTools.ts:278` verifies the retained bundle. Comparison identity, source-role equality, inventory commitments, authority/confidence, distinct non-null source subjects and empty unknown history satisfy the verifier guards. Source definitions are in `src/contracts/artifactComparisonExample.ts`; no unsupported helper-only path is assumed. - Reproduction completeness: complete for the stated supported-path static proof; neither MCP transport nor CLI execution is claimed. The comparison and verification both retain derived confidence and analyst-inference authority. The source path validates caller-owned data and derives a result within the same session; this report does not assert signed authenticity or protection against malicious producers. ## Typed outcome or recovery expected Restoration check: the stated aggregate/row disagreement must stop supporting pass, with a typed rejection, failed claim, or unknown result that explains the inconsistency. Keep consistent complete unchanged comparisons passing and consistent changed comparisons failing. Preserve imported source Evidence and its citations. ## Additional context The closed [process aggregate report](https://github.com/morluto/rea/issues/6218) and [function aggregate fix](https://github.com/morluto/rea/pull/2798) concern different comparison schemas; their guards are present in this baseline. The artifact schema remains independent. Full-index and paginated live open/closed searches found no exact artifact aggregate/row duplicate. The readiness evaluator documentation is not used as a production contract here. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Complete source tracing establishes a bounded incorrect overall verification result for caller-owned imported artifact comparisons whose aggregate disagrees with a retained change; ordinary native production derives consistent status, and broader frequency is unknown. - Workaround status: available - Workaround basis: The normal public artifact comparator derives status from the retained inventories and rows; recomputing avoids reliance on the inconsistent supplied aggregate. This is supported by source and the supplied honest changed control, without an independent runtime rerun.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4340

No description provided.

Rows
Columns