[PR #2636] [CLOSED] feat(harness): add a build-free REA bundle and guarded distribution #5296

New issue

Closed

opened 2026-10-31 01:05:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:05:32 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2636
Author: @xxxxxwater
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: main

📄 Description

Summary

Provide a build-free Harness/Cordis bundle for the pinned rea-agents@6.4.0 MCP server. Real Harness qualification found that the launcher froze its environment record, while Harness's actual Schemastery configuration normalizer requires that record to be writable: configuration was rejected and REA tools never registered despite a successful direct MCP handshake. The launcher now transfers a fresh writable environment snapshot to that owner.

This revision integrates the original candidate on current main, preserves its authorship, and addresses the remaining configuration, path and documentation findings. Plugin version remains the unpublished 0.2.1 candidate; canonical REA core release metadata is unchanged.

Change and scope

Preserve caller-selected documented JVM controls and schema/deadline settings. Host input remains unchanged; no unrelated ambient variables are added to the generated environment.
Resolve local entrypoints with native filesystem semantics before Node normalizes its script argument. Symlink/.. cannot select a different checkout. Compare Electron aliases by device/inode identity; unknown identity fails rather than authorizing the application executable as standalone Node.
One packed home resolver serves both activation and download helpers, matching actual Harness blank-value, tilde, relative-path and meaningful-space semantics.
Retain read-only status, explicit activation, exact backups, idempotence, malformed-patch and symlink rejection. Improve checksum tests so valid manifest / corrupt archive is actually exercised separately from invalid manifests.
Include the helper in npm and standalone Git trees. Lock bundle dependencies and use npm ci in compatibility CI.
Strengthen the real Harness smoke from discovery to an actual bounded JS analysis plus one retained module page. Update translated README links without changing the consistency gate.
Publication now requires a manual workflow_dispatch with publish_plugin=true, canonical main/repository and REA_DSH_PUBLISH=true. Merging or pushing main never publishes this candidate.

No new analysis provider, target capability, schema owner or mutation authority. This adapter reuses REA's existing local MCP workflows and authority checks. Additional scope approval for a new target capability is not applicable.

Executed evidence

Linux; Node24.18.0/npm11.16.0; actual Harness source 571902028a75c64c1d767f4ae5fd099485f0ddf0, its pinned pnpm11.28.5; actual npm REA6.4.0 and Electron44.7.0 RunAsNode.

Original 19 bundle tests passed. New caller-control/home regressions produced 5 failures / 20 passes before fixes; original download helper also failed the added path assertions. Two additional identity regressions failed before the launcher fix; the positive path test now executes the selected Node program.
Final bundle suite: 37 passed. Manifest/patch/packlist verification passed; standalone Git tree has all nine installable files and no build hooks.
Actual Harness installed the local tarball through dsh plugin --profile web add. Initial real Loader boot failed configuration validation. Actual Schemastery experiments isolated frozen env as the cause; frozen args are accepted. After the owning snapshot fix, Loader boot, namespace discovery, real tools.execute analysis, retained module pagination and shutdown all passed without an API key. Local tarball revisions use unique SHA filenames to avoid pnpm reusing older same-version bytes; installed launcher contents were checked.
Actual Electron44.7.0 host used an explicit standalone Node, booted the same real Harness Loader/MCP bridge and completed analysis successfully. This is Electron host evidence, not native Desktop GUI acceptance.
Actual public http-server@14.1.1 source: 16 relevant files, 103,144 bytes, 12 parsed JS files, 5,308 AST nodes. Both compact/full profiles completed through the real registry/bridge, preserving partial/unknown semantic coverage rather than claiming full understanding.
Default maximum client deadline completed real analysis; explicit 1ms deadline returned Request timed out and cleaned up. No 25-day elapsed-time experiment is claimed; the documented maximum-budget-plus-cleanup limitation remains explicit.
npm run check: all six tasks and architecture guards passed. Docs checks and five README consistency tests passed; discovery found all 1,290 root test files exactly once. After synchronization with main fffb0741936067530d1ce9777461cd53e87398c2, check:fast and docs checks passed again. The bundle/workflow bytes stayed identical across that synchronization.

Validated preceding head: e81f342f6438dbdefc720bfa2b5cca7a6f7d4d99. The runtime is unchanged from the verified real-Harness integration. Current-head remote bundle contract, actual Harness/packaged MCP analysis and Desktop Git URL installation jobs all passed; publication was skipped. The direct-Git gate now runs on PR/manual workflows, allowing validation before publication.

Two preceding CI failures were attributable to this PR: pnpm setup read the root npm package manager, and bundle JavaScript was missing from lint cache inputs. Both are fixed at their producing configuration. The unchanged cache-inventory boundary test reproduced 1 failure / 7 passes before the fix and passes all 8 after it. The exact pinned pnpm action reproduced the version conflict, then successfully installed pnpm11.0.0 with the bundle manifest. check:fast, formatting and workflow ownership/manual-publication checks passed. An independent empty-profile installation of the actual CI merge URL (b2982a8d06c2c15ed9542fbab5e4790e7d3a037c) passed, with exact launcher/helper bytes and prebuilt runtime resolution (11.43s, 443MiB). At that preceding head all 35 core CI jobs passed. Current head 9967f8a7294102a319d593e34707c15143073625 additionally fixes the review-confirmed P1: plugin release creation and existing-draft publication explicitly opt out of GitHub Latest selection, preserving the default REA installer's core-tag contract. Two tests execute the actual shell branches with a recording publication boundary (no GitHub publication), fail on the preceding workflow, and pass after the fix. All 37 bundle tests, eight cache-inventory boundary tests, check:fast and formatting passed. At current head 9967f8a7294102a319d593e34707c15143073625, core CI 38643447038 passed all 35 jobs, Harness compatibility 38643446906 passed all three validation jobs, and publication was skipped. Latest Greptile review is 5/5 on that exact head with zero unresolved threads. Native Desktop GUI qualification remains pending; this draft is held from final integration.

npm run verify:package completed all real packaged install/update/CLI/MCP/Evidence/setup/uninstall and cleanup stages on the preceding runtime-identical head (248.43s, 1,224MiB). Root npm pack --dry-run --json --ignore-scripts passed after that verifier prepared and packed the runtime; the Harness integration is excluded from the root npm archive.

Performance and remaining qualification

Actual Harness model-facing schemas: compact 254,673 bytes, full 436,594 bytes (170 tools), about 42% fewer schema bytes with the existing compact default. Agent tokens were not measured. The http-server summary's model-facing content was 10,477 bytes in both modes; raw execution JSON was 30,948 bytes because the Harness record also holds structured value data. Analysis calls took 3.65/3.71s; complete boot/call/disposal 9.77/9.55s, sampled family RSS 748/745MiB. Selected views reuse retained Evidence; no mutable-input cache or duplicate analysis schema is introduced.

Heavy work ran serially on two CPUs with an 8GiB guard and host-memory floor. Harness's seven artifact build gates passed in 184s, peak 4,216MiB; root checks peaked at 6,827MiB. No guard stop or OOM.

Native Windows/macOS Desktop GUI installation/effective composition remains unqualified. Official Desktop build targets exclude Linux; no platform gate was bypassed. Source/profile files and Node/Electron host tests do not establish GUI acceptance. Native provider and live paid/model API lanes were not run. Candidate publication stays closed; supported Desktop installation recommendations must wait for that qualification. This PR is held from final integration while its required native Desktop qualification remains unresolved.

Author readiness

Human owner: @N0zoM1z0

The following declarations are recorded from the owner's explicit standing instruction for the approved queue. The agent performed the technical review and executed evidence above; the named human retains responsibility. These declarations do not replace the remaining technical integration gate.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2636 **Author:** [@xxxxxwater](https://github.com/xxxxxwater) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `main` --- ### 📄 Description ## Summary Provide a build-free Harness/Cordis bundle for the pinned `rea-agents@6.4.0` MCP server. Real Harness qualification found that the launcher froze its environment record, while Harness's actual Schemastery configuration normalizer requires that record to be writable: configuration was rejected and REA tools never registered despite a successful direct MCP handshake. The launcher now transfers a fresh writable environment snapshot to that owner. This revision integrates the original candidate on current main, preserves its authorship, and addresses the remaining configuration, path and documentation findings. Plugin version remains the unpublished 0.2.1 candidate; canonical REA core release metadata is unchanged. ## Change and scope - Preserve caller-selected documented JVM controls and schema/deadline settings. Host input remains unchanged; no unrelated ambient variables are added to the generated environment. - Resolve local entrypoints with native filesystem semantics before Node normalizes its script argument. Symlink/`..` cannot select a different checkout. Compare Electron aliases by device/inode identity; unknown identity fails rather than authorizing the application executable as standalone Node. - One packed home resolver serves both activation and download helpers, matching actual Harness blank-value, tilde, relative-path and meaningful-space semantics. - Retain read-only status, explicit activation, exact backups, idempotence, malformed-patch and symlink rejection. Improve checksum tests so valid manifest / corrupt archive is actually exercised separately from invalid manifests. - Include the helper in npm and standalone Git trees. Lock bundle dependencies and use `npm ci` in compatibility CI. - Strengthen the real Harness smoke from discovery to an actual bounded JS analysis plus one retained module page. Update translated README links without changing the consistency gate. - Publication now requires a manual `workflow_dispatch` with `publish_plugin=true`, canonical main/repository and `REA_DSH_PUBLISH=true`. Merging or pushing main never publishes this candidate. No new analysis provider, target capability, schema owner or mutation authority. This adapter reuses REA's existing local MCP workflows and authority checks. Additional scope approval for a new target capability is not applicable. ## Executed evidence Linux; Node24.18.0/npm11.16.0; actual Harness source `571902028a75c64c1d767f4ae5fd099485f0ddf0`, its pinned pnpm11.28.5; actual npm REA6.4.0 and Electron44.7.0 RunAsNode. - Original 19 bundle tests passed. New caller-control/home regressions produced **5 failures / 20 passes** before fixes; original download helper also failed the added path assertions. Two additional identity regressions failed before the launcher fix; the positive path test now executes the selected Node program. - Final bundle suite: **37 passed**. Manifest/patch/packlist verification passed; standalone Git tree has all nine installable files and no build hooks. - Actual Harness installed the local tarball through `dsh plugin --profile web add`. Initial real Loader boot failed configuration validation. Actual Schemastery experiments isolated frozen `env` as the cause; frozen `args` are accepted. After the owning snapshot fix, Loader boot, namespace discovery, real `tools.execute` analysis, retained module pagination and shutdown all passed without an API key. Local tarball revisions use unique SHA filenames to avoid pnpm reusing older same-version bytes; installed launcher contents were checked. - Actual Electron44.7.0 host used an explicit standalone Node, booted the same real Harness Loader/MCP bridge and completed analysis successfully. This is **Electron host evidence, not native Desktop GUI acceptance**. - Actual public `http-server@14.1.1` source: 16 relevant files, 103,144 bytes, 12 parsed JS files, 5,308 AST nodes. Both compact/full profiles completed through the real registry/bridge, preserving partial/unknown semantic coverage rather than claiming full understanding. - Default maximum client deadline completed real analysis; explicit 1ms deadline returned `Request timed out` and cleaned up. No 25-day elapsed-time experiment is claimed; the documented maximum-budget-plus-cleanup limitation remains explicit. - `npm run check`: all six tasks and architecture guards passed. Docs checks and five README consistency tests passed; discovery found all 1,290 root test files exactly once. After synchronization with main `fffb0741936067530d1ce9777461cd53e87398c2`, `check:fast` and docs checks passed again. The bundle/workflow bytes stayed identical across that synchronization. Validated preceding head: `e81f342f6438dbdefc720bfa2b5cca7a6f7d4d99`. The runtime is unchanged from the verified real-Harness integration. Current-head remote bundle contract, actual Harness/packaged MCP analysis and Desktop Git URL installation jobs all passed; publication was skipped. The direct-Git gate now runs on PR/manual workflows, allowing validation before publication. Two preceding CI failures were attributable to this PR: pnpm setup read the root npm package manager, and bundle JavaScript was missing from lint cache inputs. Both are fixed at their producing configuration. The unchanged cache-inventory boundary test reproduced 1 failure / 7 passes before the fix and passes all 8 after it. The exact pinned pnpm action reproduced the version conflict, then successfully installed pnpm11.0.0 with the bundle manifest. `check:fast`, formatting and workflow ownership/manual-publication checks passed. An independent empty-profile installation of the actual CI merge URL (`b2982a8d06c2c15ed9542fbab5e4790e7d3a037c`) passed, with exact launcher/helper bytes and prebuilt runtime resolution (11.43s, 443MiB). At that preceding head all **35 core CI jobs passed**. Current head `9967f8a7294102a319d593e34707c15143073625` additionally fixes the review-confirmed P1: plugin release creation and existing-draft publication explicitly opt out of GitHub Latest selection, preserving the default REA installer's core-tag contract. Two tests execute the actual shell branches with a recording publication boundary (no GitHub publication), fail on the preceding workflow, and pass after the fix. All 37 bundle tests, eight cache-inventory boundary tests, `check:fast` and formatting passed. At current head `9967f8a7294102a319d593e34707c15143073625`, core CI **38643447038 passed all 35 jobs**, Harness compatibility **38643446906 passed all three validation jobs**, and publication was skipped. Latest Greptile review is **5/5** on that exact head with zero unresolved threads. Native Desktop GUI qualification remains pending; this draft is held from final integration. `npm run verify:package` completed all real packaged install/update/CLI/MCP/Evidence/setup/uninstall and cleanup stages on the preceding runtime-identical head (248.43s, 1,224MiB). Root `npm pack --dry-run --json --ignore-scripts` passed after that verifier prepared and packed the runtime; the Harness integration is excluded from the root npm archive. ## Performance and remaining qualification Actual Harness model-facing schemas: compact **254,673 bytes**, full **436,594 bytes** (170 tools), about 42% fewer schema bytes with the existing compact default. Agent tokens were not measured. The http-server summary's model-facing content was **10,477 bytes** in both modes; raw execution JSON was 30,948 bytes because the Harness record also holds structured value data. Analysis calls took 3.65/3.71s; complete boot/call/disposal 9.77/9.55s, sampled family RSS 748/745MiB. Selected views reuse retained Evidence; no mutable-input cache or duplicate analysis schema is introduced. Heavy work ran serially on two CPUs with an 8GiB guard and host-memory floor. Harness's seven artifact build gates passed in 184s, peak 4,216MiB; root checks peaked at 6,827MiB. No guard stop or OOM. **Native Windows/macOS Desktop GUI installation/effective composition remains unqualified.** Official Desktop build targets exclude Linux; no platform gate was bypassed. Source/profile files and Node/Electron host tests do not establish GUI acceptance. Native provider and live paid/model API lanes were not run. Candidate publication stays closed; supported Desktop installation recommendations must wait for that qualification. This PR is held from final integration while its required native Desktop qualification remains unresolved. ## Author readiness Human owner: @N0zoM1z0 The following declarations are recorded from the owner's explicit standing instruction for the approved queue. The agent performed the technical review and executed evidence above; the named human retains responsibility. These declarations do not replace the remaining technical integration gate. - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:05:32 +00:00