morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7664] [Bug] Byte-entropy error catalogue marks unserved recovery wording as implemented #4588

New issue

Closed

opened 2026-10-31 00:51:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:51:02 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7664

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

The error catalogue marks a file/window correction sentence as implemented and verified, but the public byte-entropy command and MCP tool return a different recovery instruction.

On an 11-byte file, node scripts/rea.mjs inspect-byte-entropy ./tiny.bin --offset 999 --json exits 1 with invalid_request, a generic input-validation message, and remediation directing the caller to inspect the input contract and correct the listed fields. The issue correctly identifies offset and says the selected window starts beyond EOF. An overlong length and a missing file return the same generic recovery with their own field-specific reasons. All three cases also behaved this way over stdio MCP.

This establishes a stale catalogue implementation/verification claim. It does not establish that the runtime's generic recovery is incorrect or that the proposed wording must replace it.

Reproduction

Use the built source baseline below with Node.js 24.22.1 selected on PATH. Run this block from the checkout root. It creates the fixture inline and isolates REA state and package runners:

repo_root="$PWD"
work="$(mktemp -d)"
trap 'rm -rf "$work"' EXIT
mkdir -p "$work"/{home,config,cache,data,state,tmp,bin}
for runner in npx npm bun; do
  cat > "$work/bin/$runner" <<'SH'
#!/bin/sh
case "$1" in
  --version|-v) echo 99.0.0; exit 0;;
esac
printf 'blocked fixture invocation: %s\n' "$0" >&2
exit 127
SH
  chmod +x "$work/bin/$runner"
done
printf 'hello world' > "$work/tiny.bin"
(
  export HOME="$work/home" XDG_CONFIG_HOME="$work/config"
  export XDG_CACHE_HOME="$work/cache" XDG_DATA_HOME="$work/data"
  export XDG_STATE_HOME="$work/state" TMPDIR="$work/tmp"
  export PATH="$work/bin:$PATH"
  cd "$work"
  node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./tiny.bin --offset 999 --json
  node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./tiny.bin --offset 10 --length 999 --json
  node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./absent.bin --json
  node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./tiny.bin --offset 10 --length 1 --json
)

Read the catalogue record and search for its proposed replacement:

python3 - <<'PY'
import csv
with open('docs/user-visible-errors.csv', newline='') as stream:
    row = next(row for row in csv.DictReader(stream)
               if row['harm_rank'] == '91')
for field in ['location', 'trigger', 'proposed_replacement',
              'implementation_status', 'verification_result']:
    print(field + ': ' + row[field])
PY
rg -n -F 'Choose a readable regular file and a window within its byte size' src tests docs

Each failing CLI input and the successful control ran once during independent verification. Each also ran once through the production stdio MCP entry point, using absolute fixture paths. The search found the proposed sentence only in the catalogue.

Expected behavior

An inventory entry marked implemented and verified should describe the recovery actually served and the scope of the cited verification. Reconcile its proposed replacement, status and verification attribution with the current diagnostic, or explicitly identify the sentence as a proposal that is not implemented.

The inventory is not sufficient authority to require a runtime wording change. The documented canonical recovery tells callers to inspect the input contract and correct the listed fields; the observed diagnostics preserve those fields and their specific reasons.

Impact and scope

P3 documentation accuracy: readers auditing entropy error handling receive an inaccurate statement about implemented and verified wording. The invalid selections were correctly refused. The control selecting offset 10 and length 1 succeeded in both interfaces, and the failure envelopes retained useful field diagnostics. No wrong entropy result, data loss, downstream repair failure or security-boundary crossing was observed.

Readers can inspect the complete diagnostic and current producer/projector for the served behavior. Runtime verification covers one macOS host and the three selection failures above; other platforms and other error producers were not tested.

REA version

Exact node scripts/rea.mjs --version stdout: 6.8.0 followed by a newline.

Source baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; Darwin arm64. Verification used the existing built runtime and locked dependencies. No analysis-provider session was opened.

Target and artifact context

One regular file containing the 11 bytes hello world, plus an absent filename. The file was read as data.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

The catalogue query printed these fields:

location: src/application/binaryDiagnostics/ByteEntropyService.ts
trigger: Invalid file or window
proposed_replacement: Choose a readable regular file and a window within its byte size
implementation_status: implemented
verification_result: entropy service and MCP boundary tests

The offset-999 CLI output contained:

{
  "code": "invalid_request",
  "category": "invalid_input",
  "message": "Analysis input is invalid. Check the arguments and try again.",
  "remediation": {
    "action": "Read the declared input schema or CLI usage for inspect_byte_entropy; if using MCP and the catalog may be stale, call tools/list. Correct the listed fields, then retry. Do not repeat the unchanged call."
  },
  "details": {
    "operation": "inspect_byte_entropy",
    "issues": [{
      "path": ["offset"],
      "reason": "invalid_value",
      "message": "Selected byte window starts beyond the end of the file."
    }]
  }
}

The other refused inputs named length and path respectively, with reasons explaining an overlong window and a missing file. MCP returned the same diagnostics inside the error member parsed from text content, with isError: true. The successful control returned artifact.bytes: 11 and window: {"offset":10,"length":1} through both interfaces.

Source inspection at the baseline:

docs/user-visible-errors.csv:120 contains entry harm_rank=91; 91 is the entry identifier, not its physical line number.
src/application/binaryDiagnostics/ByteEntropyService.ts:49-53,159-171,209-219 supplies field-specific input issues without a custom recovery sentence.
src/domain/analysisErrorPresentation.ts:170-174 supplies the input-contract remediation when the producer has not defined a different action.
docs/mcp-contracts.md:141-147 describes the canonical envelope and its input-contract recovery.
src/application/binaryDiagnostics/ByteEntropyService.test.ts:159-209 checks input classification, recovery kind and field attribution; it does not assert the proposed catalogue sentence. These tests were inspected, not executed for this report.

Analysis or suspected cause

Source-derived: the catalogue's completion and verification fields do not reflect the current error producer and canonical projector. The producer retains the detailed reason in field issues; it does not supply the catalogue's proposed sentence as a recovery override. No producer-specific recovery was observed being discarded.

Additional context

Open PR #7163 repoints other catalogue locations, explicitly leaves stale replacement wording out of scope, and does not modify entry 91. Closed #5077, #5473, #5742 and #5743 cover different catalogue records; their closures do not reconcile this entry.

Closed #6482 concerned incorrect offset attribution. The current offset diagnostic correctly names that field, so this is not a reproduction of that defect. Open #7376 concerns numeric-token syntax, and open #7537 concerns the advertised absolute-path requirement. Neither supplies a closure for this documentation discrepancy. Bounded searches of issues, PRs and comments found no matching report for entry 91.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The observed defect is inaccurate documentation wording and verification attribution; the refused selections retain specific correction issues and valid selected-window inspection succeeds.
Workaround status: available
Workaround basis: Readers can inspect the complete canonical diagnostic and current source to determine the served recovery; correcting the window to offset 10 and length 1 succeeded through both executed interfaces.

Originally created by @coygeek on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7664 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Documentation ### Observed behavior The error catalogue marks a file/window correction sentence as implemented and verified, but the public byte-entropy command and MCP tool return a different recovery instruction. On an 11-byte file, `node scripts/rea.mjs inspect-byte-entropy ./tiny.bin --offset 999 --json` exits 1 with `invalid_request`, a generic input-validation message, and remediation directing the caller to inspect the input contract and correct the listed fields. The issue correctly identifies `offset` and says the selected window starts beyond EOF. An overlong length and a missing file return the same generic recovery with their own field-specific reasons. All three cases also behaved this way over stdio MCP. This establishes a stale catalogue implementation/verification claim. It does not establish that the runtime's generic recovery is incorrect or that the proposed wording must replace it. ### Reproduction 1. Use the built source baseline below with Node.js 24.22.1 selected on PATH. Run this block from the checkout root. It creates the fixture inline and isolates REA state and package runners: ```sh repo_root="$PWD" work="$(mktemp -d)" trap 'rm -rf "$work"' EXIT mkdir -p "$work"/{home,config,cache,data,state,tmp,bin} for runner in npx npm bun; do cat > "$work/bin/$runner" <<'SH' #!/bin/sh case "$1" in --version|-v) echo 99.0.0; exit 0;; esac printf 'blocked fixture invocation: %s\n' "$0" >&2 exit 127 SH chmod +x "$work/bin/$runner" done printf 'hello world' > "$work/tiny.bin" ( export HOME="$work/home" XDG_CONFIG_HOME="$work/config" export XDG_CACHE_HOME="$work/cache" XDG_DATA_HOME="$work/data" export XDG_STATE_HOME="$work/state" TMPDIR="$work/tmp" export PATH="$work/bin:$PATH" cd "$work" node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./tiny.bin --offset 999 --json node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./tiny.bin --offset 10 --length 999 --json node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./absent.bin --json node "$repo_root/scripts/rea.mjs" inspect-byte-entropy ./tiny.bin --offset 10 --length 1 --json ) ``` 2. Read the catalogue record and search for its proposed replacement: ```sh python3 - <<'PY' import csv with open('docs/user-visible-errors.csv', newline='') as stream: row = next(row for row in csv.DictReader(stream) if row['harm_rank'] == '91') for field in ['location', 'trigger', 'proposed_replacement', 'implementation_status', 'verification_result']: print(field + ': ' + row[field]) PY rg -n -F 'Choose a readable regular file and a window within its byte size' src tests docs ``` Each failing CLI input and the successful control ran once during independent verification. Each also ran once through the production stdio MCP entry point, using absolute fixture paths. The search found the proposed sentence only in the catalogue. ### Expected behavior An inventory entry marked implemented and verified should describe the recovery actually served and the scope of the cited verification. Reconcile its proposed replacement, status and verification attribution with the current diagnostic, or explicitly identify the sentence as a proposal that is not implemented. The inventory is not sufficient authority to require a runtime wording change. The documented canonical recovery tells callers to inspect the input contract and correct the listed fields; the observed diagnostics preserve those fields and their specific reasons. ### Impact and scope P3 documentation accuracy: readers auditing entropy error handling receive an inaccurate statement about implemented and verified wording. The invalid selections were correctly refused. The control selecting offset 10 and length 1 succeeded in both interfaces, and the failure envelopes retained useful field diagnostics. No wrong entropy result, data loss, downstream repair failure or security-boundary crossing was observed. Readers can inspect the complete diagnostic and current producer/projector for the served behavior. Runtime verification covers one macOS host and the three selection failures above; other platforms and other error producers were not tested. ### REA version Exact `node scripts/rea.mjs --version` stdout: `6.8.0` followed by a newline. Source baseline: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js `v24.22.1`; macOS `27.0.1`; Darwin `arm64`. Verification used the existing built runtime and locked dependencies. No analysis-provider session was opened. ### Target and artifact context One regular file containing the 11 bytes `hello world`, plus an absent filename. The file was read as data. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence The catalogue query printed these fields: ```text location: src/application/binaryDiagnostics/ByteEntropyService.ts trigger: Invalid file or window proposed_replacement: Choose a readable regular file and a window within its byte size implementation_status: implemented verification_result: entropy service and MCP boundary tests ``` The offset-999 CLI output contained: ```json { "code": "invalid_request", "category": "invalid_input", "message": "Analysis input is invalid. Check the arguments and try again.", "remediation": { "action": "Read the declared input schema or CLI usage for inspect_byte_entropy; if using MCP and the catalog may be stale, call tools/list. Correct the listed fields, then retry. Do not repeat the unchanged call." }, "details": { "operation": "inspect_byte_entropy", "issues": [{ "path": ["offset"], "reason": "invalid_value", "message": "Selected byte window starts beyond the end of the file." }] } } ``` The other refused inputs named `length` and `path` respectively, with reasons explaining an overlong window and a missing file. MCP returned the same diagnostics inside the `error` member parsed from text content, with `isError: true`. The successful control returned `artifact.bytes: 11` and `window: {"offset":10,"length":1}` through both interfaces. Source inspection at the baseline: - `docs/user-visible-errors.csv:120` contains entry `harm_rank=91`; 91 is the entry identifier, not its physical line number. - `src/application/binaryDiagnostics/ByteEntropyService.ts:49-53,159-171,209-219` supplies field-specific input issues without a custom recovery sentence. - `src/domain/analysisErrorPresentation.ts:170-174` supplies the input-contract remediation when the producer has not defined a different action. - `docs/mcp-contracts.md:141-147` describes the canonical envelope and its input-contract recovery. - `src/application/binaryDiagnostics/ByteEntropyService.test.ts:159-209` checks input classification, recovery kind and field attribution; it does not assert the proposed catalogue sentence. These tests were inspected, not executed for this report. ### Analysis or suspected cause Source-derived: the catalogue's completion and verification fields do not reflect the current error producer and canonical projector. The producer retains the detailed reason in field issues; it does not supply the catalogue's proposed sentence as a recovery override. No producer-specific recovery was observed being discarded. ### Additional context Open [PR #7163](https://github.com/morluto/rea/pull/7163) repoints other catalogue locations, explicitly leaves stale replacement wording out of scope, and does not modify entry 91. Closed [#5077](https://github.com/morluto/rea/issues/5077), [#5473](https://github.com/morluto/rea/issues/5473), [#5742](https://github.com/morluto/rea/issues/5742) and [#5743](https://github.com/morluto/rea/issues/5743) cover different catalogue records; their closures do not reconcile this entry. Closed [#6482](https://github.com/morluto/rea/issues/6482) concerned incorrect offset attribution. The current offset diagnostic correctly names that field, so this is not a reproduction of that defect. Open [#7376](https://github.com/morluto/rea/issues/7376) concerns numeric-token syntax, and open [#7537](https://github.com/morluto/rea/issues/7537) concerns the advertised absolute-path requirement. Neither supplies a closure for this documentation discrepancy. Bounded searches of issues, PRs and comments found no matching report for entry 91. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The observed defect is inaccurate documentation wording and verification attribution; the refused selections retain specific correction issues and valid selected-window inspection succeeds. - Workaround status: available - Workaround basis: Readers can inspect the complete canonical diagnostic and current source to determine the served recovery; correcting the window to offset 10 and length 1 succeeded through both executed interfaces.

bsakaguchi closed this issue

2026-10-31 00:51:03 +00:00

bsakaguchi referenced this issue

2026-10-31 01:13:36 +00:00

[PR #4591] feat(ghidra): select the loopback bridge transport on POSIX hosts #6326

bsakaguchi referenced this issue

2026-11-01 21:11:08 +00:00

[GH-ISSUE #7075] Windows: Ghidra provider fails to start - LaunchSupport cannot write java_home.save (access denied) #4264