morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7695] [Bug] Retained analysis-view guidance omits working view families and selectors #4617

New issue

Open

opened 2026-10-31 00:51:23 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:51:23 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7695

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

MCP or agent integration

Observed behavior

After initialize, notifications/initialized, and tools/list against node scripts/rea.mjs mcp, I observed that the inspect_analysis_view description names none of these supported view kinds: android-jni, devicetree, function-matches, gpu-code-objects, native-context, native-observation, and source-to-bundle.

The default compact profile advertises the tool's view input as exactly {"type":"object"}. Selecting REA_MCP_INPUT_SCHEMA_PROFILE=full advertises 45 distinct view kinds, including those seven, beside exactly the same description. The description directs callers to choose a compatible parent operation described below, then gives extensive family-specific instructions while leaving these families out.

Two omitted kinds worked through that same public interface. I called inspect_gpu_code_objects({path, detail:"summary"}) on a small CUBIN fixture, deleted the file, then called inspect_analysis_view with its returned parent_evidence_id and view:{kind:"gpu-code-objects",collection:"targets",offset:0,limit:5}. It returned one target row. The corresponding inspect_devicetree summary and view:{kind:"devicetree",collection:"nodes",offset:0,limit:5} returned two node rows after that fixture was deleted. Both retained workflows succeeded with default and full profiles.

The same guidance also omits two accepted Android facets (components and component-summary) and four selector names (entry_kinds, storage_validation, query_labels_hex, and query_index). These are further examples of the description's incomplete guidance, included in this single report. I checked their advertised schemas and source wiring, but did not execute those projections.

Reproduction

Use the already-built baseline below, its locked dependencies, and Node.js v24.22.1 on PATH. From the checkout root, run the following Python script. It uses only production stdio MCP, creates the two encoded fixture files inline, isolates HOME/XDG/temp state, and puts refusing package-runner fixtures first on each server's PATH. It deletes all generated fixture/state files when each server finishes.

python3 -I - <<'PY'
import base64, json, pathlib, selectors, subprocess, tempfile
node = subprocess.check_output(['node', '-p', 'process.execPath'], text=True).strip()
assert subprocess.check_output([node, '--version'], text=True).strip() == 'v24.22.1'
fixtures = [
    ('inspect_gpu_code_objects', 'gpu-code-objects', 'targets', 'sample.cubin', 'f0VMRgIBATMAAAAAAAAAAAIAvgCBAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAUAVQAEAAAAAAAEAAAwABAAAuc2hzdHJ0YWIALnRleHQucHJvYmUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAFwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAALAAAAAQAAAAYAAAAAAAAAAAAAAAAAAABYAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA'),
    ('inspect_devicetree', 'devicetree', 'nodes', 'sample.dtb', '0A3+7QAAAIMAAAA4AAAAeAAAACgAAAARAAAAEAAAAAAAAAALAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAMAAAALAAAAAHRlc3QsYm9hcmQAAAAAAAFtZW1vcnlAODAwMDAwMDAAAAAAAgAAAAIAAAAJY29tcGF0aWJsZQA='),
]
for profile in ('default', 'full'):
    with tempfile.TemporaryDirectory() as trial:
        root = pathlib.Path(trial)
        for part in ('home', 'config', 'cache', 'data', 'state', 'bin', 'tmp'):
            (root / part).mkdir()
        for runner in ('npx', 'npm', 'bun'):
            stub = root / 'bin' / runner
            stub.write_text('#!/bin/sh\nprintf "unexpected package runner\\n" >&2\nexit 127\n')
            stub.chmod(0o755)
        env = {'HOME': str(root / 'home'), 'TMPDIR': str(root / 'tmp'),
               'PATH': str(root / 'bin') + ':' + str(pathlib.Path(node).parent) + ':/usr/bin:/bin:/usr/sbin:/sbin',
               'NO_COLOR': '1', 'npm_config_prefix': str(root / 'prefix')}
        for key, part in (('XDG_CONFIG_HOME', 'config'), ('XDG_CACHE_HOME', 'cache'),
                          ('XDG_DATA_HOME', 'data'), ('XDG_STATE_HOME', 'state')):
            env[key] = str(root / part)
        if profile == 'full': env['REA_MCP_INPUT_SCHEMA_PROFILE'] = 'full'
        print('REA:', subprocess.check_output([node, 'scripts/rea.mjs', '--version'], env=env, text=True).strip())
        with (root / 'stderr').open('w+') as err:
            p = subprocess.Popen([node, 'scripts/rea.mjs', 'mcp'], env=env, text=True,
                                 stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=err)
            sequence = 0
            def rpc(method, params=None):
                global sequence
                sequence += 1
                msg = {'jsonrpc': '2.0', 'id': sequence, 'method': method}
                if params is not None: msg['params'] = params
                p.stdin.write(json.dumps(msg) + '\n'); p.stdin.flush()
                with selectors.DefaultSelector() as selector:
                    selector.register(p.stdout, selectors.EVENT_READ)
                    while True:
                        assert selector.select(40), 'response timeout'
                        line = p.stdout.readline(); assert line, 'server exited'
                        reply = json.loads(line)
                        if reply.get('id') == sequence:
                            assert 'error' not in reply, reply
                            return reply['result']
            def call(name, arguments):
                result = rpc('tools/call', {'name': name, 'arguments': arguments})
                assert not result.get('isError'), result
                return result['structuredContent']['normalized_result']
            try:
                rpc('initialize', {'protocolVersion': '2025-06-18', 'capabilities': {},
                    'clientInfo': {'name': 'view-description-probe', 'version': '1'}})
                p.stdin.write(json.dumps({'jsonrpc': '2.0', 'method': 'notifications/initialized'}) + '\n'); p.stdin.flush()
                tools = rpc('tools/list')['tools']
                tool = next(t for t in tools if t['name'] == 'inspect_analysis_view')
                schema, description = tool['inputSchema']['properties']['view'], tool['description']
                branches = []
                def walk(value):
                    if isinstance(value, list):
                        for child in value: walk(child)
                    elif isinstance(value, dict):
                        props = value.get('properties', {})
                        if 'const' in props.get('kind', {}): branches.append(props)
                        for child in value.values(): walk(child)
                walk(schema)
                kinds = sorted({b['kind']['const'] for b in branches})
                print(profile, 'view schema:', 'full' if kinds else schema)
                print('unique kinds:', len(kinds), 'absent:', [k for k in kinds if k not in description])
                print('android facets:', [b.get('facet') for b in branches if b['kind']['const'] == 'android'])
                for kind, selector, value in [('inventory', 'collection', 'occurrences'),
                                               ('model-artifact', 'collection', 'tensors'),
                                               ('pcap', 'facet', 'dns-addresses')]:
                    for b in branches:
                        if b['kind']['const'] == kind and b.get(selector, {}).get('const') == value:
                            print(kind, value, 'fields:', sorted(b))
                print('selector words in description:', {key: key in description for key in
                      ('entry_kinds', 'storage_validation', 'query_labels_hex', 'query_index')})
                for producer, kind, collection, name, encoded in fixtures:
                    path = root / name; path.write_bytes(base64.b64decode(encoded))
                    parent = call(producer, {'path': str(path), 'detail': 'summary'})
                    path.unlink()
                    page = call('inspect_analysis_view', {
                        'source': {'kind': 'retained-evidence', 'evidence_id': parent['parent_evidence_id']},
                        'view': {'kind': kind, 'collection': collection, 'offset': 0, 'limit': 5}})
                    print(kind, 'rows:', len(page['items']), 'coverage:', page['coverage'])
                p.stdin.close(); p.wait(timeout=20)
                err.seek(0); logs = err.read().splitlines()
                assert p.returncode == 0 and all(json.loads(line).get('status') == 'ok' for line in logs)
                print('exit:', p.returncode, 'successful tool logs:', len(logs))
            finally:
                if p.poll() is None: p.terminate(); p.wait(timeout=20)
PY

Compare the full profile's view-kind literals and selector fields with the description. The default profile cannot enumerate the missing kinds because it advertises only the view's object type. Check that both omitted-kind controls nevertheless return retained pages after source deletion.

The discovery mismatch and both retained workflows reproduced in three completed default/full probe pairs, including one execution of this exact script. Every completed server exited 0; each emitted four ordinary successful-tool JSON logs on stderr.

Expected behavior

The view tool should accurately guide callers to the documented retained continuations that its producers advertise. Correct the incomplete family, facet, and selector guidance, or provide accurate general guidance that routes callers to the authoritative descriptions. Preserve the working views and their accepted inputs.

An exhaustive prose inventory is not required. The compact-profile documentation explains reduced schema presentation and retained root-schema guidance; it does not explicitly require the separate MCP tool description to name every kind or selector. The reported discrepancy is the incomplete detailed guidance relative to the supported continuations, not a request to make compact input schemas exhaustive.

Impact and scope

P3 wording and capability-discovery defect. The view tool's own instructions understate the available continuations, particularly when the compact profile removes nested input guidance. Other producer descriptions and guides provide information today, and the full profile exposes the canonical selector structure. The two exercised projections work correctly. No lost Evidence, wrong analysis fact, failed projection, or blocked core workflow was observed.

The five other missing kinds, Android component facets, and four selectors were not runtime-replayed. Actual model tool-selection behavior and the frequency of callers being misled are unknown. Successful static CUBIN inventory does not establish GPU execution, kernel decoding, or runtime compatibility.

REA version

Exact node scripts/rea.mjs --version output:

6.8.0

Source baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; Darwin arm64. Verification used the assignment's prepared build and dependencies. No dependency installation, analysis engine, GUI, live service, or target execution was required. The tools inspected local synthetic fixture artifacts.

Target and artifact context

A 288-byte synthetic ELF64 little-endian CUDA CUBIN containing a section-name table and one text section, used for inventory only. A 131-byte synthetic FDT v17 blob with one compatible property, a root node, and a child named memory@80000000. The reproduction embeds both fixtures as Base64 and deletes each before reading its retained view. No compiler, GPU, external decoder, or acquisition is needed.

Interface

MCP

Earliest failure stage

Transport or result projection

Relevant output or evidence

Selected output from the exact script above:

REA: 6.8.0
default view schema: {'type': 'object'}
unique kinds: 0 absent: []
gpu-code-objects rows: 1 coverage: {'status': 'page', 'examined': 1, 'total': 1, 'next_offset': None, 'exhausted': True}
devicetree rows: 2 coverage: {'status': 'page', 'examined': 2, 'total': 2, 'next_offset': None, 'exhausted': True}
exit: 0 successful tool logs: 4
REA: 6.8.0
full view schema: full
unique kinds: 45 absent: ['android-jni', 'devicetree', 'function-matches', 'gpu-code-objects', 'native-context', 'native-observation', 'source-to-bundle']
android facets: [{'type': 'string', 'const': 'manifest'}, {'type': 'string', 'const': 'components'}, {'type': 'string', 'const': 'component-summary'}]
selector words in description: {'entry_kinds': False, 'storage_validation': False, 'query_labels_hex': False, 'query_index': False}
gpu-code-objects rows: 1 coverage: {'status': 'page', 'examined': 1, 'total': 1, 'next_offset': None, 'exhausted': True}
devicetree rows: 2 coverage: {'status': 'page', 'examined': 2, 'total': 2, 'next_offset': None, 'exhausted': True}
exit: 0 successful tool logs: 4

The default unique kinds: 0 means the reduced schema contains no kind literals; it does not mean the server accepts no views. An explicit check of the seven strings against the captured default description also found none. The descriptions captured from both profiles were byte-for-byte equal. The raw successful pages identified the original producer operations, returned target sm_80 for the CUBIN, and returned paths / and /memory@80000000 for the DTB.

The full schema's inventory/occurrences branch included entry_kinds; its model-artifact/tensors branch included storage_validation; and its pcap/dns-addresses branch included query_labels_hex and query_index. The reproduction prints those property lists. Their absence from this description is a schema/prose observation, not a claim that their runtime behavior failed.

Supporting source at the baseline:

src/contracts/analysisViewToolContracts.ts:16-22 owns the description and binds the shared input/output contracts. src/server/toolRegistrationOptions.ts:18-32 copies the description into registration, and src/server/registerAnalysisViewTool.ts:23-41 registers the named public handler.
src/domain/analysisView/analysisView.ts:1604-1642 registers the retained projectors for these families. src/domain/analysisView/gpuCodeObjectsView.ts:32-48 defines the GPU collection union. src/domain/analysisView/devicetreeView.ts:19-29 defines DTB views and the exact node-path requirement for property pages.
src/contracts/gpu/gpuToolContracts.ts:20 and src/contracts/native/binaryDiagnosticsToolContracts.ts:78 provide the GPU and DTB producer handoffs. src/contracts/android/androidToolContracts.ts:29, src/contracts/applicationToolContracts.ts:148, and src/contracts/sessionToolContracts.ts:113 provide the JNI, source-comparison and function-matching handoffs. src/contracts/officialToolContracts.ts:165-215 and src/contracts/enhancedToolContracts.ts:60 describe the native observation/context continuations.
docs/mcp-contracts.md:254-266 documents native-observation/native-context paging. Lines 468-475 document source-to-bundle retained continuation. Lines 1314-1326 establish compact as the default and full as opt-in. Lines 1361-1386 describe compact input presentation; “root description” there refers to JSON Schema guidance, not an explicit exhaustive-list requirement for the tool description.
src/domain/analysisView/artifactInventoryView.ts:50-70 and :461-504, src/domain/model/modelArtifactQuery.ts:19-27, and src/domain/analysisView/pcapCaptureView.ts:38-51 and :224-238 define or consume the four selector spellings. src/domain/analysisView/androidPackageView.ts:201-313 implements component selection and summary projection. These locators corroborate intended selectors; the additional projections were not executed in this verification.
docs/tool-design.md:327-332 calls for updating canonical contracts and relevant documentation together. Lines 353-357 caution that schema validity and keyword checks do not establish successful agent tool selection; this report makes no such claim.

Typed outcome or recovery expected

Keep both successful retained controls and all other supported view contracts. Make the discovery instructions accurate without disabling views or promising complete source coverage from an exhausted page.

Analysis or suspected cause

Source-derived: the tool stores one long description independently of the canonical view union and family request schemas. That representation permits accepted inputs to grow while the detailed prose remains incomplete. This verification did not establish which individual changes introduced the omissions.

Possible corrections include adding only the missing family paragraphs, reconciling all detailed lists, or using accurate general wording with authoritative family-specific routing. General routing is the preferred approach because it follows the existing incomplete-list fixes and avoids requiring another exhaustive list to stay synchronized. The desired closure includes the facets and selectors above as part of this same guidance correction.

Additional context

Live duplicate searches covered open/closed issues, issue comments, and open/closed/merged PRs using inspect_analysis_view, description, omits, view kinds, gpu-code-objects, devicetree, android-jni, native-context, source-to-bundle, function-matches, and analysisViewToolContracts. No existing report with this closure condition was found.

Open #7646 concerns the separate inspect_desktop_application producer description omitting the omissions collection. Its report explicitly notes that the consumer description already names that collection. Correcting that producer does not supply this report's missing consumer guidance, and correcting this consumer does not repair that producer list.

Closed #5733 concerned opening supported-parent and refusal lists omitting pcap. Its closure comment confirms those lists were replaced with general wording; the present baseline retains the pcap paragraph. This report does not allege that the pcap fix regressed. Closed #6225 concerned independently stored CLI help and likewise accepted general wording. PRs #6246, #6248 and #6351 were superseded rather than fixes for the current missing MCP guidance. #7388/PR #7446 concern a prefix-variance limit; #7612 concerns an Evidence-ID typo in a DTB guide; #1695 concerns selector validation parity. Their restoration checks differ.

Related omissions in the same description (verified separately; they share one closure, a corrected inspect_analysis_view description or a reliable route to its guidance): the Android guidance names the manifest facet but not components or component-summary, which inspect_android_package and docs/android-analysis.md document; and the selector guidance does not name entry_kinds, storage_validation, query_labels_hex or query_index. In a default-profile stdio session, entry_kinds on a retained ZIP inventory selected the file-only and directory-only occurrences, and storage_validation on a retained safetensors inspection selected only the consistent or only the unknown-dtype tensor; empty arrays selected nothing. The DNS selectors were confirmed in the full schema and source-checked only, and the Android projections were not executed because the JADX/JDK setup was unavailable.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The verified discrepancy is incomplete discovery wording; both exercised static retained projections succeeded, and no consequential analysis failure was observed.
Workaround status: available
Workaround basis: Existing producer descriptions and documented retained-view shapes provide the missing family handoffs; both direct retained requests succeeded. The full-profile catalog also exposes the accepted selector structure.

Originally created by @coygeek on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7695 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area MCP or agent integration ### Observed behavior After `initialize`, `notifications/initialized`, and `tools/list` against `node scripts/rea.mjs mcp`, I observed that the `inspect_analysis_view` description names none of these supported view kinds: `android-jni`, `devicetree`, `function-matches`, `gpu-code-objects`, `native-context`, `native-observation`, and `source-to-bundle`. The default compact profile advertises the tool's `view` input as exactly `{"type":"object"}`. Selecting `REA_MCP_INPUT_SCHEMA_PROFILE=full` advertises 45 distinct view kinds, including those seven, beside exactly the same description. The description directs callers to choose a compatible parent operation described below, then gives extensive family-specific instructions while leaving these families out. Two omitted kinds worked through that same public interface. I called `inspect_gpu_code_objects({path, detail:"summary"})` on a small CUBIN fixture, deleted the file, then called `inspect_analysis_view` with its returned `parent_evidence_id` and `view:{kind:"gpu-code-objects",collection:"targets",offset:0,limit:5}`. It returned one target row. The corresponding `inspect_devicetree` summary and `view:{kind:"devicetree",collection:"nodes",offset:0,limit:5}` returned two node rows after that fixture was deleted. Both retained workflows succeeded with default and full profiles. The same guidance also omits two accepted Android facets (`components` and `component-summary`) and four selector names (`entry_kinds`, `storage_validation`, `query_labels_hex`, and `query_index`). These are further examples of the description's incomplete guidance, included in this single report. I checked their advertised schemas and source wiring, but did not execute those projections. ### Reproduction 1. Use the already-built baseline below, its locked dependencies, and Node.js v24.22.1 on PATH. From the checkout root, run the following Python script. It uses only production stdio MCP, creates the two encoded fixture files inline, isolates HOME/XDG/temp state, and puts refusing package-runner fixtures first on each server's PATH. It deletes all generated fixture/state files when each server finishes. ```sh python3 -I - <<'PY' import base64, json, pathlib, selectors, subprocess, tempfile node = subprocess.check_output(['node', '-p', 'process.execPath'], text=True).strip() assert subprocess.check_output([node, '--version'], text=True).strip() == 'v24.22.1' fixtures = [ ('inspect_gpu_code_objects', 'gpu-code-objects', 'targets', 'sample.cubin', 'f0VMRgIBATMAAAAAAAAAAAIAvgCBAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAUAVQAEAAAAAAAEAAAwABAAAuc2hzdHJ0YWIALnRleHQucHJvYmUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAFwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAALAAAAAQAAAAYAAAAAAAAAAAAAAAAAAABYAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA'), ('inspect_devicetree', 'devicetree', 'nodes', 'sample.dtb', '0A3+7QAAAIMAAAA4AAAAeAAAACgAAAARAAAAEAAAAAAAAAALAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAMAAAALAAAAAHRlc3QsYm9hcmQAAAAAAAFtZW1vcnlAODAwMDAwMDAAAAAAAgAAAAIAAAAJY29tcGF0aWJsZQA='), ] for profile in ('default', 'full'): with tempfile.TemporaryDirectory() as trial: root = pathlib.Path(trial) for part in ('home', 'config', 'cache', 'data', 'state', 'bin', 'tmp'): (root / part).mkdir() for runner in ('npx', 'npm', 'bun'): stub = root / 'bin' / runner stub.write_text('#!/bin/sh\nprintf "unexpected package runner\\n" >&2\nexit 127\n') stub.chmod(0o755) env = {'HOME': str(root / 'home'), 'TMPDIR': str(root / 'tmp'), 'PATH': str(root / 'bin') + ':' + str(pathlib.Path(node).parent) + ':/usr/bin:/bin:/usr/sbin:/sbin', 'NO_COLOR': '1', 'npm_config_prefix': str(root / 'prefix')} for key, part in (('XDG_CONFIG_HOME', 'config'), ('XDG_CACHE_HOME', 'cache'), ('XDG_DATA_HOME', 'data'), ('XDG_STATE_HOME', 'state')): env[key] = str(root / part) if profile == 'full': env['REA_MCP_INPUT_SCHEMA_PROFILE'] = 'full' print('REA:', subprocess.check_output([node, 'scripts/rea.mjs', '--version'], env=env, text=True).strip()) with (root / 'stderr').open('w+') as err: p = subprocess.Popen([node, 'scripts/rea.mjs', 'mcp'], env=env, text=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=err) sequence = 0 def rpc(method, params=None): global sequence sequence += 1 msg = {'jsonrpc': '2.0', 'id': sequence, 'method': method} if params is not None: msg['params'] = params p.stdin.write(json.dumps(msg) + '\n'); p.stdin.flush() with selectors.DefaultSelector() as selector: selector.register(p.stdout, selectors.EVENT_READ) while True: assert selector.select(40), 'response timeout' line = p.stdout.readline(); assert line, 'server exited' reply = json.loads(line) if reply.get('id') == sequence: assert 'error' not in reply, reply return reply['result'] def call(name, arguments): result = rpc('tools/call', {'name': name, 'arguments': arguments}) assert not result.get('isError'), result return result['structuredContent']['normalized_result'] try: rpc('initialize', {'protocolVersion': '2025-06-18', 'capabilities': {}, 'clientInfo': {'name': 'view-description-probe', 'version': '1'}}) p.stdin.write(json.dumps({'jsonrpc': '2.0', 'method': 'notifications/initialized'}) + '\n'); p.stdin.flush() tools = rpc('tools/list')['tools'] tool = next(t for t in tools if t['name'] == 'inspect_analysis_view') schema, description = tool['inputSchema']['properties']['view'], tool['description'] branches = [] def walk(value): if isinstance(value, list): for child in value: walk(child) elif isinstance(value, dict): props = value.get('properties', {}) if 'const' in props.get('kind', {}): branches.append(props) for child in value.values(): walk(child) walk(schema) kinds = sorted({b['kind']['const'] for b in branches}) print(profile, 'view schema:', 'full' if kinds else schema) print('unique kinds:', len(kinds), 'absent:', [k for k in kinds if k not in description]) print('android facets:', [b.get('facet') for b in branches if b['kind']['const'] == 'android']) for kind, selector, value in [('inventory', 'collection', 'occurrences'), ('model-artifact', 'collection', 'tensors'), ('pcap', 'facet', 'dns-addresses')]: for b in branches: if b['kind']['const'] == kind and b.get(selector, {}).get('const') == value: print(kind, value, 'fields:', sorted(b)) print('selector words in description:', {key: key in description for key in ('entry_kinds', 'storage_validation', 'query_labels_hex', 'query_index')}) for producer, kind, collection, name, encoded in fixtures: path = root / name; path.write_bytes(base64.b64decode(encoded)) parent = call(producer, {'path': str(path), 'detail': 'summary'}) path.unlink() page = call('inspect_analysis_view', { 'source': {'kind': 'retained-evidence', 'evidence_id': parent['parent_evidence_id']}, 'view': {'kind': kind, 'collection': collection, 'offset': 0, 'limit': 5}}) print(kind, 'rows:', len(page['items']), 'coverage:', page['coverage']) p.stdin.close(); p.wait(timeout=20) err.seek(0); logs = err.read().splitlines() assert p.returncode == 0 and all(json.loads(line).get('status') == 'ok' for line in logs) print('exit:', p.returncode, 'successful tool logs:', len(logs)) finally: if p.poll() is None: p.terminate(); p.wait(timeout=20) PY ``` 2. Compare the full profile's view-kind literals and selector fields with the description. The default profile cannot enumerate the missing kinds because it advertises only the view's object type. Check that both omitted-kind controls nevertheless return retained pages after source deletion. The discovery mismatch and both retained workflows reproduced in three completed default/full probe pairs, including one execution of this exact script. Every completed server exited 0; each emitted four ordinary successful-tool JSON logs on stderr. ### Expected behavior The view tool should accurately guide callers to the documented retained continuations that its producers advertise. Correct the incomplete family, facet, and selector guidance, or provide accurate general guidance that routes callers to the authoritative descriptions. Preserve the working views and their accepted inputs. An exhaustive prose inventory is not required. The compact-profile documentation explains reduced schema presentation and retained root-schema guidance; it does not explicitly require the separate MCP tool description to name every kind or selector. The reported discrepancy is the incomplete detailed guidance relative to the supported continuations, not a request to make compact input schemas exhaustive. ### Impact and scope P3 wording and capability-discovery defect. The view tool's own instructions understate the available continuations, particularly when the compact profile removes nested input guidance. Other producer descriptions and guides provide information today, and the full profile exposes the canonical selector structure. The two exercised projections work correctly. No lost Evidence, wrong analysis fact, failed projection, or blocked core workflow was observed. The five other missing kinds, Android component facets, and four selectors were not runtime-replayed. Actual model tool-selection behavior and the frequency of callers being misled are unknown. Successful static CUBIN inventory does not establish GPU execution, kernel decoding, or runtime compatibility. ### REA version Exact `node scripts/rea.mjs --version` output: ```text 6.8.0 ``` Source baseline: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1; Darwin arm64. Verification used the assignment's prepared build and dependencies. No dependency installation, analysis engine, GUI, live service, or target execution was required. The tools inspected local synthetic fixture artifacts. ### Target and artifact context A 288-byte synthetic ELF64 little-endian CUDA CUBIN containing a section-name table and one text section, used for inventory only. A 131-byte synthetic FDT v17 blob with one compatible property, a root node, and a child named memory@80000000. The reproduction embeds both fixtures as Base64 and deletes each before reading its retained view. No compiler, GPU, external decoder, or acquisition is needed. ### Interface MCP ### Earliest failure stage Transport or result projection ### Relevant output or evidence Selected output from the exact script above: ```text REA: 6.8.0 default view schema: {'type': 'object'} unique kinds: 0 absent: [] gpu-code-objects rows: 1 coverage: {'status': 'page', 'examined': 1, 'total': 1, 'next_offset': None, 'exhausted': True} devicetree rows: 2 coverage: {'status': 'page', 'examined': 2, 'total': 2, 'next_offset': None, 'exhausted': True} exit: 0 successful tool logs: 4 REA: 6.8.0 full view schema: full unique kinds: 45 absent: ['android-jni', 'devicetree', 'function-matches', 'gpu-code-objects', 'native-context', 'native-observation', 'source-to-bundle'] android facets: [{'type': 'string', 'const': 'manifest'}, {'type': 'string', 'const': 'components'}, {'type': 'string', 'const': 'component-summary'}] selector words in description: {'entry_kinds': False, 'storage_validation': False, 'query_labels_hex': False, 'query_index': False} gpu-code-objects rows: 1 coverage: {'status': 'page', 'examined': 1, 'total': 1, 'next_offset': None, 'exhausted': True} devicetree rows: 2 coverage: {'status': 'page', 'examined': 2, 'total': 2, 'next_offset': None, 'exhausted': True} exit: 0 successful tool logs: 4 ``` The default `unique kinds: 0` means the reduced schema contains no kind literals; it does not mean the server accepts no views. An explicit check of the seven strings against the captured default description also found none. The descriptions captured from both profiles were byte-for-byte equal. The raw successful pages identified the original producer operations, returned target `sm_80` for the CUBIN, and returned paths `/` and `/memory@80000000` for the DTB. The full schema's `inventory/occurrences` branch included `entry_kinds`; its `model-artifact/tensors` branch included `storage_validation`; and its `pcap/dns-addresses` branch included `query_labels_hex` and `query_index`. The reproduction prints those property lists. Their absence from this description is a schema/prose observation, not a claim that their runtime behavior failed. Supporting source at the baseline: - `src/contracts/analysisViewToolContracts.ts:16-22` owns the description and binds the shared input/output contracts. `src/server/toolRegistrationOptions.ts:18-32` copies the description into registration, and `src/server/registerAnalysisViewTool.ts:23-41` registers the named public handler. - `src/domain/analysisView/analysisView.ts:1604-1642` registers the retained projectors for these families. `src/domain/analysisView/gpuCodeObjectsView.ts:32-48` defines the GPU collection union. `src/domain/analysisView/devicetreeView.ts:19-29` defines DTB views and the exact node-path requirement for property pages. - `src/contracts/gpu/gpuToolContracts.ts:20` and `src/contracts/native/binaryDiagnosticsToolContracts.ts:78` provide the GPU and DTB producer handoffs. `src/contracts/android/androidToolContracts.ts:29`, `src/contracts/applicationToolContracts.ts:148`, and `src/contracts/sessionToolContracts.ts:113` provide the JNI, source-comparison and function-matching handoffs. `src/contracts/officialToolContracts.ts:165-215` and `src/contracts/enhancedToolContracts.ts:60` describe the native observation/context continuations. - `docs/mcp-contracts.md:254-266` documents native-observation/native-context paging. Lines 468-475 document source-to-bundle retained continuation. Lines 1314-1326 establish compact as the default and full as opt-in. Lines 1361-1386 describe compact input presentation; “root description” there refers to JSON Schema guidance, not an explicit exhaustive-list requirement for the tool description. - `src/domain/analysisView/artifactInventoryView.ts:50-70` and `:461-504`, `src/domain/model/modelArtifactQuery.ts:19-27`, and `src/domain/analysisView/pcapCaptureView.ts:38-51` and `:224-238` define or consume the four selector spellings. `src/domain/analysisView/androidPackageView.ts:201-313` implements component selection and summary projection. These locators corroborate intended selectors; the additional projections were not executed in this verification. - `docs/tool-design.md:327-332` calls for updating canonical contracts and relevant documentation together. Lines 353-357 caution that schema validity and keyword checks do not establish successful agent tool selection; this report makes no such claim. ### Typed outcome or recovery expected Keep both successful retained controls and all other supported view contracts. Make the discovery instructions accurate without disabling views or promising complete source coverage from an exhausted page. ### Analysis or suspected cause Source-derived: the tool stores one long description independently of the canonical view union and family request schemas. That representation permits accepted inputs to grow while the detailed prose remains incomplete. This verification did not establish which individual changes introduced the omissions. Possible corrections include adding only the missing family paragraphs, reconciling all detailed lists, or using accurate general wording with authoritative family-specific routing. General routing is the preferred approach because it follows the existing incomplete-list fixes and avoids requiring another exhaustive list to stay synchronized. The desired closure includes the facets and selectors above as part of this same guidance correction. ### Additional context Live duplicate searches covered open/closed issues, issue comments, and open/closed/merged PRs using inspect_analysis_view, description, omits, view kinds, gpu-code-objects, devicetree, android-jni, native-context, source-to-bundle, function-matches, and analysisViewToolContracts. No existing report with this closure condition was found. [Open #7646](https://github.com/morluto/rea/issues/7646) concerns the separate inspect_desktop_application producer description omitting the omissions collection. Its report explicitly notes that the consumer description already names that collection. Correcting that producer does not supply this report's missing consumer guidance, and correcting this consumer does not repair that producer list. [Closed #5733](https://github.com/morluto/rea/issues/5733) concerned opening supported-parent and refusal lists omitting pcap. Its closure comment confirms those lists were replaced with general wording; the present baseline retains the pcap paragraph. This report does not allege that the pcap fix regressed. [Closed #6225](https://github.com/morluto/rea/issues/6225) concerned independently stored CLI help and likewise accepted general wording. PRs #6246, #6248 and #6351 were superseded rather than fixes for the current missing MCP guidance. #7388/PR #7446 concern a prefix-variance limit; #7612 concerns an Evidence-ID typo in a DTB guide; #1695 concerns selector validation parity. Their restoration checks differ. Related omissions in the same description (verified separately; they share one closure, a corrected `inspect_analysis_view` description or a reliable route to its guidance): the Android guidance names the `manifest` facet but not `components` or `component-summary`, which `inspect_android_package` and `docs/android-analysis.md` document; and the selector guidance does not name `entry_kinds`, `storage_validation`, `query_labels_hex` or `query_index`. In a default-profile stdio session, `entry_kinds` on a retained ZIP inventory selected the file-only and directory-only occurrences, and `storage_validation` on a retained safetensors inspection selected only the consistent or only the unknown-dtype tensor; empty arrays selected nothing. The DNS selectors were confirmed in the full schema and source-checked only, and the Android projections were not executed because the JADX/JDK setup was unavailable. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The verified discrepancy is incomplete discovery wording; both exercised static retained projections succeeded, and no consequential analysis failure was observed. - Workaround status: available - Workaround basis: Existing producer descriptions and documented retained-view shapes provide the missing family handoffs; both direct retained requests succeeded. The full-profile catalog also exposes the accepted selector structure.

bsakaguchi commented

2026-11-01 21:11:13 +00:00

Author

Owner

@morluto commented on GitHub (Oct 31, 2026):

Additional native-provider control: on a self-built Mach-O, real Ghidra 12.1.4 and Kuna 1.986 MCP sessions both successfully used procedure_callees Evidence and get_call_graph Evidence with inspect_analysis_view / native-context / result-limitations. The primitive response correctly retained null plus a not-applicable explanation; graph responses returned provider-specific recorded limitation rows. Neither test establishes that an autonomous agent would select the workflow.

I also inspected tools/list on e6d0618979f0df3f1d5db218b0fc7b5e6a9cf3f9: the compact inspect_analysis_view schema advertises view only as an object, and its description names neither native-context nor native-observation. The procedure_callees and get_call_graph descriptions name the view kinds, while the full input-schema profile exposes the native-context branch. docs/mcp-contracts.md documents the explicit request and facets. This confirms an existing workaround and adds native runtime evidence to this report rather than suggesting a separate wrapper or implying the operations are absent. The target was not executed and its digest was unchanged.

@morluto commented on GitHub (Oct 31, 2026): Additional native-provider control: on a self-built Mach-O, real Ghidra 12.1.4 and Kuna 1.986 MCP sessions both successfully used `procedure_callees` Evidence and `get_call_graph` Evidence with `inspect_analysis_view` / `native-context` / `result-limitations`. The primitive response correctly retained null plus a not-applicable explanation; graph responses returned provider-specific recorded limitation rows. Neither test establishes that an autonomous agent would select the workflow. I also inspected `tools/list` on `e6d0618979f0df3f1d5db218b0fc7b5e6a9cf3f9`: the compact `inspect_analysis_view` schema advertises `view` only as an object, and its description names neither `native-context` nor `native-observation`. The `procedure_callees` and `get_call_graph` descriptions name the view kinds, while the full input-schema profile exposes the `native-context` branch. `docs/mcp-contracts.md` documents the explicit request and facets. This confirms an existing workaround and adds native runtime evidence to this report rather than suggesting a separate wrapper or implying the operations are absent. The target was not executed and its digest was unchanged.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4617

No description provided.

Rows
Columns