morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #7565] [Bug] Built verification summaries return 404 for their JSON evidence links #4506

New issue

Open

opened 2026-10-31 00:50:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:50:21 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7565

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

After running npx vitepress build docs, I opened the generated documentation with the installed VitePress preview. Eleven verification summaries loaded successfully, but requesting each summary's linked JSON evidence returned HTTP 404. The build exited successfully and did not flag those destinations.

For example, the APK signature summary returns HTTP 200 at /rea/verification/apk-signature-2026-10-22.html, while its JSON record link resolves to /rea/verification/apk-signature-2026-10-22.json and returns HTTP 404. The JSON record exists in the source checkout.

Reproduction

Use the baseline below with its installed locked dependencies and Node 24.22.1. Run npx vitepress build docs. I ran one fresh build; it exited 0.

Inspect the actual HTML destinations and compare them with source/output files:

python3 - <<'PY'
from pathlib import Path
import re
dist = Path('docs/.vitepress/dist')
count = 0
for page in sorted((dist / 'verification').glob('*.html')):
    for href in re.findall(r'href="([^"?#]+\.json)"', page.read_text()):
        if '://' in href or href.startswith('/'):
            continue
        source = Path('docs/verification') / href
        target = page.parent / href
        print(page.name, href, source.is_file(), target.is_file())
        count += 1
print('relative JSON links:', count)
PY

All eleven rows print True False: the input record exists and the built target does not. The count is 11.

Preview the same output with node node_modules/vitepress/bin/vitepress.js preview docs --host 127.0.0.1 --port 4173. Request a page and its record:

python3 - <<'PY'
from urllib.request import urlopen
from urllib.error import HTTPError
base = 'http://127.0.0.1:4173/rea/verification/'
for name in ['apk-signature-2026-10-22.html', 'apk-signature-2026-10-22.json']:
    try:
        with urlopen(base + name) as response:
            print(name, response.status)
    except HTTPError as error:
        print(name, error.code)
PY

The page returns 200 and the record returns 404. In my verification I used an available loopback port and requested all eleven pairs; every HTML page returned 200 and every JSON target returned 404. Stop the preview when finished.

Expected behavior

A verification summary that presents a JSON evidence record should let readers open that record in the supported documentation preview. The build should emit the linked evidence or the summary should point to an accessible repository/archive URL.

The documented VitePress build and preview workflow applies to these Markdown summaries. They remain included in the build despite not appearing individually in the sidebar. The source locations establishing that scope are listed below.

Impact and scope

Readers of the VitePress preview cannot retrieve the evidence offered by eleven summaries at this baseline. The summaries themselves remain readable, and the records can be obtained from the repository, so the failure has a practical workaround and does not block REA analysis.

This is a local documentation build/preview finding. I did not establish a failure on the public rea.tools website. The manual documentation workflow builds this tree without publishing it; the public website uses a separate source tree.

REA version

node scripts/rea.mjs --version printed exactly:

6.8.0

Source commit: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1, Darwin 27.0.0, arm64; locked VitePress 1.6.4.

Target and artifact context

Unmodified source checkout; generated VitePress HTML and JSON evidence links. No external target, native provider, or REA session is required.

Interface

Other

Earliest failure stage

Unknown

Relevant output or evidence

The fresh build printed vitepress v1.6.4 and build complete in 8.32s. with exit 0.
The reproduction's HTML inspection found exactly eleven page-relative JSON links with an existing source record and absent output record. Preview HTTP requests confirmed all eleven page/record pairs as 200/404.
The affected JSON basenames are apk-signature-2026-10-22.json, electron-cancellation-2026-10-16.json, electron-ipc-listeners-2026-10-16.json, gpu-code-objects-2026-10-21.json, javascript-analysis-effects-2026-10-15.json, javascript-interruption-applicability-2026-10-15.json, javascript-literal-byte-budget-2026-10-15.json, javascript-module-references-2026-10-15.json, javascript-native-handoff-identity-2026-10-15.json, javascript-route-inventory-2026-10-21.json, and javascript-window-options-2026-10-16.json.
Example source link: docs/verification/apk-signature-2026-10-22.md:95. Its built HTML retains href="apk-signature-2026-10-22.json"; the corresponding built JSON file is absent.
docs/.vitepress/config.ts:8-9 sets /rea/ as the base and excludes only readme/**, leaving verification/ included. The emitted pages and successful HTTP requests confirm actual reachability.
CONTRIBUTING.md:283-298 documents the VitePress production build/local preview and distinguishes this manual build from the separate public website. Its full-GitHub-URL requirement specifically concerns repository files outside docs/; these JSON files are inside docs/.
.github/workflows/pages.yml:3-30 has a manual trigger and build steps without publication. .github/workflows/ci.yml:959-975 already runs npm run docs:build for selected documentation changes.

Analysis or suspected cause

The generated pages retain direct JSON hrefs, while their targets are absent from the output. The source evidence is present, so this concerns documentation asset delivery rather than missing verification records. The successful VitePress build does not prove that these non-Markdown destinations resolve.

Additional context

Closed #7517 and merged #7519 archive older payloads and replace the route-inventory link with an immutable archive URL after this baseline. That fixes one member of the eleven-link set; it does not address the other ten links or exclude their summaries. Preserve that later archive repair when addressing the remaining links.

Closed #5030 concerns adding the VitePress build to CI. That build is already present at this baseline and succeeds despite the JSON 404s. This is not a report that CI fails to invoke VitePress.

The out-of-tree source-link repairs discussed in #4769 and #5028 concern different destinations; publishing these JSON records does not repair a relative TypeScript source link outside the docs tree.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Eleven evidence downloads fail in the documented local VitePress preview, although the corresponding summaries remain available and REA runtime analysis is unaffected.
Workaround status: available
Workaround basis: All eleven linked records exist as tracked files at the verified source revision and can be read directly from that checkout or its repository snapshot.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7565 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Documentation ### Observed behavior After running `npx vitepress build docs`, I opened the generated documentation with the installed VitePress preview. Eleven verification summaries loaded successfully, but requesting each summary's linked JSON evidence returned HTTP 404. The build exited successfully and did not flag those destinations. For example, the APK signature summary returns HTTP 200 at `/rea/verification/apk-signature-2026-10-22.html`, while its JSON record link resolves to `/rea/verification/apk-signature-2026-10-22.json` and returns HTTP 404. The JSON record exists in the source checkout. ### Reproduction 1. Use the baseline below with its installed locked dependencies and Node 24.22.1. Run `npx vitepress build docs`. I ran one fresh build; it exited 0. 2. Inspect the actual HTML destinations and compare them with source/output files: ```sh python3 - <<'PY' from pathlib import Path import re dist = Path('docs/.vitepress/dist') count = 0 for page in sorted((dist / 'verification').glob('*.html')): for href in re.findall(r'href="([^"?#]+\.json)"', page.read_text()): if '://' in href or href.startswith('/'): continue source = Path('docs/verification') / href target = page.parent / href print(page.name, href, source.is_file(), target.is_file()) count += 1 print('relative JSON links:', count) PY ``` All eleven rows print `True False`: the input record exists and the built target does not. The count is 11. 3. Preview the same output with `node node_modules/vitepress/bin/vitepress.js preview docs --host 127.0.0.1 --port 4173`. Request a page and its record: ```sh python3 - <<'PY' from urllib.request import urlopen from urllib.error import HTTPError base = 'http://127.0.0.1:4173/rea/verification/' for name in ['apk-signature-2026-10-22.html', 'apk-signature-2026-10-22.json']: try: with urlopen(base + name) as response: print(name, response.status) except HTTPError as error: print(name, error.code) PY ``` The page returns 200 and the record returns 404. In my verification I used an available loopback port and requested all eleven pairs; every HTML page returned 200 and every JSON target returned 404. Stop the preview when finished. ### Expected behavior A verification summary that presents a JSON evidence record should let readers open that record in the supported documentation preview. The build should emit the linked evidence or the summary should point to an accessible repository/archive URL. The documented VitePress build and preview workflow applies to these Markdown summaries. They remain included in the build despite not appearing individually in the sidebar. The source locations establishing that scope are listed below. ### Impact and scope Readers of the VitePress preview cannot retrieve the evidence offered by eleven summaries at this baseline. The summaries themselves remain readable, and the records can be obtained from the repository, so the failure has a practical workaround and does not block REA analysis. This is a local documentation build/preview finding. I did not establish a failure on the public rea.tools website. The manual documentation workflow builds this tree without publishing it; the public website uses a separate source tree. ### REA version `node scripts/rea.mjs --version` printed exactly: ```text 6.8.0 ``` Source commit: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1, Darwin 27.0.0, arm64; locked VitePress 1.6.4. ### Target and artifact context Unmodified source checkout; generated VitePress HTML and JSON evidence links. No external target, native provider, or REA session is required. ### Interface Other ### Earliest failure stage Unknown ### Relevant output or evidence - The fresh build printed `vitepress v1.6.4` and `build complete in 8.32s.` with exit 0. - The reproduction's HTML inspection found exactly eleven page-relative JSON links with an existing source record and absent output record. Preview HTTP requests confirmed all eleven page/record pairs as 200/404. - The affected JSON basenames are `apk-signature-2026-10-22.json`, `electron-cancellation-2026-10-16.json`, `electron-ipc-listeners-2026-10-16.json`, `gpu-code-objects-2026-10-21.json`, `javascript-analysis-effects-2026-10-15.json`, `javascript-interruption-applicability-2026-10-15.json`, `javascript-literal-byte-budget-2026-10-15.json`, `javascript-module-references-2026-10-15.json`, `javascript-native-handoff-identity-2026-10-15.json`, `javascript-route-inventory-2026-10-21.json`, and `javascript-window-options-2026-10-16.json`. - Example source link: `docs/verification/apk-signature-2026-10-22.md:95`. Its built HTML retains `href="apk-signature-2026-10-22.json"`; the corresponding built JSON file is absent. - `docs/.vitepress/config.ts:8-9` sets `/rea/` as the base and excludes only `readme/**`, leaving `verification/` included. The emitted pages and successful HTTP requests confirm actual reachability. - `CONTRIBUTING.md:283-298` documents the VitePress production build/local preview and distinguishes this manual build from the separate public website. Its full-GitHub-URL requirement specifically concerns repository files outside `docs/`; these JSON files are inside `docs/`. - `.github/workflows/pages.yml:3-30` has a manual trigger and build steps without publication. `.github/workflows/ci.yml:959-975` already runs `npm run docs:build` for selected documentation changes. ### Analysis or suspected cause The generated pages retain direct JSON hrefs, while their targets are absent from the output. The source evidence is present, so this concerns documentation asset delivery rather than missing verification records. The successful VitePress build does not prove that these non-Markdown destinations resolve. ### Additional context Closed [#7517](https://github.com/morluto/rea/issues/7517) and merged [#7519](https://github.com/morluto/rea/pull/7519) archive older payloads and replace the route-inventory link with an immutable archive URL after this baseline. That fixes one member of the eleven-link set; it does not address the other ten links or exclude their summaries. Preserve that later archive repair when addressing the remaining links. Closed [#5030](https://github.com/morluto/rea/issues/5030) concerns adding the VitePress build to CI. That build is already present at this baseline and succeeds despite the JSON 404s. This is not a report that CI fails to invoke VitePress. The out-of-tree source-link repairs discussed in [#4769](https://github.com/morluto/rea/pull/4769) and [#5028](https://github.com/morluto/rea/pull/5028) concern different destinations; publishing these JSON records does not repair a relative TypeScript source link outside the docs tree. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Eleven evidence downloads fail in the documented local VitePress preview, although the corresponding summaries remain available and REA runtime analysis is unaffected. - Workaround status: available - Workaround basis: All eleven linked records exist as tracked files at the verified source revision and can be read directly from that checkout or its repository snapshot.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4506

No description provided.

Rows
Columns