morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8098] [Bug] Analysis views of inferred Evidence are sealed as derived, so the view reports more confidence than its parent #4671

New issue

Closed

opened 2026-10-31 00:52:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:52:16 +00:00

Owner

Originally created by @kaoru0822-kitauji on GitHub (Oct 30, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8098

Originally assigned to: @kaoru0822-kitauji on GitHub.

Before submitting

I searched the open and closed issues for a related report. I found none for analysis-view confidence.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction (inspect_analysis_view and detail: "summary" / view delivery, shared by CLI and MCP)

Observed behavior

When the parent Evidence has confidence: "inferred", every analysis view projected from it is sealed as confidence: "derived". The view keeps the parent's authority and links to the parent, but it reports stronger confidence than the facts it projects.

createAnalysisViewEvidence (src/application/analysisView/AnalysisViewService.ts) sets confidence only from the view result kind: inferred for environment-state, environment-coverage, and templated api-surface/manifest views, and derived for everything else. It never reads parent.confidence. The CLI (inspect-analysis-view, --detail summary) and MCP (inspect_analysis_view, detail/view on producer tools) both seal views through this function.

Parents that are inferred and have views include compare_source_to_bundle (always), inspect_evm_interface (always), and inspect_il2cpp_metadata (when binary fields are unresolved).

Reproduction

Run on main 317bf3fe2, built with npm run build:cached, using the public CLI. It reproduced on every run.

mkdir -p old/src && cd old
printf 'export const greet = (n) => "hi " + n;\n' > src/greet.js
printf 'import { greet } from "./greet.js";\nconsole.log(greet("x"));\n' > src/main.js
printf '{"name":"demo","version":"1.0.0","main":"src/main.js"}\n' > package.json
cd .. && cp -R old app && printf 'export const greet = (n) => "hello " + n;\n' > app/src/greet.js

rea import-reference-source "$PWD/old" --format json > ref.json
rea analyze-javascript-application "$PWD/app" --format json > app.json
node -e 'const fs=require("fs");fs.writeFileSync("cmp-input.json",JSON.stringify({reference:{kind:"file",path:process.argv[1]},application:JSON.parse(fs.readFileSync("app.json","utf8"))}))' "$PWD/ref.json"
rea compare-source-to-bundle cmp-input.json --format json > cmp.json
rea inspect-analysis-view "{\"source\":{\"kind\":\"evidence-file\",\"path\":\"$PWD/cmp.json\"},\"view\":{\"kind\":\"summary\"}}" \
  --filter-output confidence,authority,evidence_links

Observed:

cmp.json (parent): operation: compare_source_to_bundle, confidence: inferred, authority: analyst-inference.
Summary view: confidence: derived, authority: analyst-inference, evidence_links: [<parent id>].
The page view {"kind":"source-to-bundle","collection":"mappings","offset":0,"limit":1} also returns confidence: derived for the inferred src/greet.js → modified mapping.

The same function seals MCP views. The existing in-memory MCP workflow in tests/boundary/mcp/sourceToBundleViewsMcp.test.ts (compare_source_to_bundle with view: {kind: "summary"}, then inspect_analysis_view on the retained parent) returns confidence: "derived" for those views too.

Expected behavior

A view is a projection of its parent, and a projection cannot make facts more certain. An inferred parent should produce inferred views. Parents that are observed or derived keep today's behavior (derived, or inferred for the view kinds above). This follows the AGENTS.md rule to distinguish observations, derivations, inferences, and unknowns and to preserve that status across boundaries.

Impact and scope

The following is source-derived and was not exercised end to end. Downstream checks gate on Evidence confidence. In reconstructionVerification, structural-function claims reject only inferred sources. reconstructionCoverageEvidence.hasComparableEvidence accepts shipped-artifact authority with derived confidence. An inspect_evm_interface parent has shipped-artifact authority with inferred confidence, so its parent is rejected but its retained summary view, at derived, is accepted.

Changing the confidence of these views changes their Evidence IDs, because confidence is part of the semantic content. Views of observed and derived parents keep the same IDs.

REA version

6.8.0 (main 317bf3fe2)

Runtime and platform

Node.js 26.5.0, macOS 26 arm64

Interface

CLI and MCP

Earliest failure stage

Artifact or evidence registration (view Evidence sealing)

Analysis or suspected cause

View confidence already follows the certainty of the facts on the page. docs/mcp-contracts.md says an api-surface page is "inferred Evidence whenever any group is templated". The rule just doesn't include the parent's own confidence. One existing assertion pins the current behavior: tests/boundary/mcp/evmInterfaceMcp.test.ts expects derived for the EVM summary of an inferred parent, and docs/evm-bytecode.md calls that summary "derived Evidence". The candidates stay inferred only inside the payload (evidence_kind), and consumers that read Evidence.confidence don't see that.

Originally created by @kaoru0822-kitauji on GitHub (Oct 30, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8098 Originally assigned to: @kaoru0822-kitauji on GitHub. ### Before submitting - [x] I searched the open and closed issues for a related report. I found none for analysis-view confidence. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction (`inspect_analysis_view` and `detail: "summary"` / `view` delivery, shared by CLI and MCP) ### Observed behavior When the parent Evidence has `confidence: "inferred"`, every analysis view projected from it is sealed as `confidence: "derived"`. The view keeps the parent's `authority` and links to the parent, but it reports stronger confidence than the facts it projects. `createAnalysisViewEvidence` (`src/application/analysisView/AnalysisViewService.ts`) sets confidence only from the view result kind: `inferred` for environment-state, environment-coverage, and templated api-surface/manifest views, and `derived` for everything else. It never reads `parent.confidence`. The CLI (`inspect-analysis-view`, `--detail summary`) and MCP (`inspect_analysis_view`, `detail`/`view` on producer tools) both seal views through this function. Parents that are `inferred` and have views include `compare_source_to_bundle` (always), `inspect_evm_interface` (always), and `inspect_il2cpp_metadata` (when binary fields are unresolved). ### Reproduction Run on main `317bf3fe2`, built with `npm run build:cached`, using the public CLI. It reproduced on every run. ```bash mkdir -p old/src && cd old printf 'export const greet = (n) => "hi " + n;\n' > src/greet.js printf 'import { greet } from "./greet.js";\nconsole.log(greet("x"));\n' > src/main.js printf '{"name":"demo","version":"1.0.0","main":"src/main.js"}\n' > package.json cd .. && cp -R old app && printf 'export const greet = (n) => "hello " + n;\n' > app/src/greet.js rea import-reference-source "$PWD/old" --format json > ref.json rea analyze-javascript-application "$PWD/app" --format json > app.json node -e 'const fs=require("fs");fs.writeFileSync("cmp-input.json",JSON.stringify({reference:{kind:"file",path:process.argv[1]},application:JSON.parse(fs.readFileSync("app.json","utf8"))}))' "$PWD/ref.json" rea compare-source-to-bundle cmp-input.json --format json > cmp.json rea inspect-analysis-view "{\"source\":{\"kind\":\"evidence-file\",\"path\":\"$PWD/cmp.json\"},\"view\":{\"kind\":\"summary\"}}" \ --filter-output confidence,authority,evidence_links ``` Observed: - `cmp.json` (parent): `operation: compare_source_to_bundle`, `confidence: inferred`, `authority: analyst-inference`. - Summary view: `confidence: derived`, `authority: analyst-inference`, `evidence_links: [<parent id>]`. - The page view `{"kind":"source-to-bundle","collection":"mappings","offset":0,"limit":1}` also returns `confidence: derived` for the inferred `src/greet.js → modified` mapping. The same function seals MCP views. The existing in-memory MCP workflow in `tests/boundary/mcp/sourceToBundleViewsMcp.test.ts` (`compare_source_to_bundle` with `view: {kind: "summary"}`, then `inspect_analysis_view` on the retained parent) returns `confidence: "derived"` for those views too. ### Expected behavior A view is a projection of its parent, and a projection cannot make facts more certain. An `inferred` parent should produce `inferred` views. Parents that are `observed` or `derived` keep today's behavior (`derived`, or `inferred` for the view kinds above). This follows the AGENTS.md rule to distinguish observations, derivations, inferences, and unknowns and to preserve that status across boundaries. ### Impact and scope The following is source-derived and was not exercised end to end. Downstream checks gate on Evidence confidence. In `reconstructionVerification`, structural-function claims reject only `inferred` sources. `reconstructionCoverageEvidence.hasComparableEvidence` accepts `shipped-artifact` authority with `derived` confidence. An `inspect_evm_interface` parent has `shipped-artifact` authority with `inferred` confidence, so its parent is rejected but its retained summary view, at `derived`, is accepted. Changing the confidence of these views changes their Evidence IDs, because confidence is part of the semantic content. Views of `observed` and `derived` parents keep the same IDs. ### REA version 6.8.0 (main `317bf3fe2`) ### Runtime and platform Node.js 26.5.0, macOS 26 arm64 ### Interface CLI and MCP ### Earliest failure stage Artifact or evidence registration (view Evidence sealing) ### Analysis or suspected cause View confidence already follows the certainty of the facts on the page. `docs/mcp-contracts.md` says an api-surface page is "inferred Evidence whenever any group is templated". The rule just doesn't include the parent's own confidence. One existing assertion pins the current behavior: `tests/boundary/mcp/evmInterfaceMcp.test.ts` expects `derived` for the EVM summary of an `inferred` parent, and `docs/evm-bytecode.md` calls that summary "derived Evidence". The candidates stay `inferred` only inside the payload (`evidence_kind`), and consumers that read `Evidence.confidence` don't see that.

bsakaguchi

2026-10-31 00:52:16 +00:00

closed this issue
added the
bug
label

bsakaguchi referenced this issue

2026-10-31 01:13:48 +00:00

[PR #4671] [CLOSED] fix(ghidra): try keg-only Homebrew JDK when PATH java cannot run #6355

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4671

No description provided.

Rows
Columns