[PR #2859] [CLOSED] fix(qlog): mark records incomplete when a declaration hides the event name #5443

New issue

Closed

opened 2026-10-31 01:06:40 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:06:40 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2859
Author: @Dragolone
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: fix/qlog-hidden-event-name-incomplete

📝 Commits (3)

8bbbaba fix(qlog): mark records incomplete when a declaration hides the event name
eb6d442 Merge upstream main into fix/qlog-hidden-event-name-incomplete
0839e0f Merge upstream main into fix/qlog-hidden-event-name-incomplete

📊 Changes

2 files changed (+43 additions, -2 deletions)

View changed files

📝 src/browser/history/QlogCapture.test.ts (+25 -0)
📝 src/browser/history/QlogCapture.ts (+18 -2)

📄 Description

Summary

When an explicit sensitive value hides a qlog event's name, the decoder drops that record's transport facts without listing it in incomplete_fact_records. The trace then reports streams: [] / loss_declarations: [] with an empty incomplete list, which reads as "nothing recorded".

collectTransportFacts picks loss or packet handling from the redacted visible.name. A declaration such as "sent" hides the value transport:packet_sent (and "name" hides the property itself). The function then returns early before any incomplete-record bookkeeping. A hidden frame_type, frames or STREAM field is already reported as incomplete; a hidden event name was not.

No issue is linked: I searched issues and PRs for "qlog", "incomplete_fact_records", "qlog sensitive" and "qlog incomplete" and found no report. No open PR touches QlogCapture.ts.

Problem and expected behavior

Smallest trigger: decodeQlogCapture(text, ["sent"]) on one transport:packet_sent STREAM event plus one recovery:packet_lost event.

Declaration	Before	After
`"sent"`	streams 0, losses 1, incomplete `[]`	streams 0, losses 1, incomplete `[0]`
`"lost"`	streams 1, losses 0, incomplete `[]`	streams 1, losses 0, incomplete `[1]`
`"name"`	streams 0, losses 0, incomplete `[]`	streams 0, losses 0, incomplete `[0, 1]`
`"stream"` (control: hides `frame_type`)	incomplete `[0]`	unchanged

Violated contract (docs/web-network-captures.md): facts "that cannot be safely shown are omitted with incomplete-record coordinates", and incomplete fact records are "ordinals with omitted/redacted interpretable frame metadata".

Change and scope

collectTransportFacts now receives the validated source event name. If the source event is a loss or packet event and the visible name differs (value redacted or property hidden), the record's ordinal is added to incomplete_fact_records and no facts are derived from it. Events whose source name is not interpretable (for example extension:custom) are not marked; the test covers this. Nothing is revealed: the hidden name is only compared, never projected.

Not included: other qlog behavior.

Contribution scope: an ordinary evidence/redaction correctness fix within existing boundaries; a maintainer scope decision is not applicable.

Contract and boundary impact

Semantic owner and earliest changed stage: collectTransportFacts in src/browser/history/QlogCapture.ts.
Contribution scope fit and linked maintainer decision: in scope (evidence reporting); not applicable.
CLI and MCP/tool-catalog contract: no schema change; incomplete_fact_records now lists records whose interpretable event name was hidden.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: omitted facts become visible as incomplete records instead of silently absent.
Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added or updated: src/browser/history/QlogCapture.test.ts — "lists records whose event name a declaration of $hidden hides as incomplete", parameterized over sent, lost and name. It includes a non-interpretable extension event that must stay unmarked.
Base reproduction: on 94072364c all three cases fail; the incomplete list is [] in each.
User-visible CLI/MCP output: not captured separately. The change is confined to the decoder result asserted above, and the qlog acceptance suite (built CLI and stdio MCP parity) passes.
Remaining proof gaps: none known.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

macOS (Apple silicon), Node 24.19.0.

npx vitest run src/browser/history/QlogCapture.test.ts on the base — the three new cases fail.
npx vitest run src/browser/history/ with the fix — 5 files, 102 tests passed.
npm run build:cached && npx vitest run tests/acceptance/tools/qlogCapture.test.ts — 4 passed, 1 skipped.
npm run typecheck — passed.
npx oxfmt --check and npx oxlint on both changed files — passed, no errors.
npm run verify:module-boundaries — passed.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable.
Package or release metadata impact: none.
Security, privacy, process, or containment review: no hidden value is projected; the source name is only compared with the redacted one.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2859 **Author:** [@Dragolone](https://github.com/Dragolone) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/qlog-hidden-event-name-incomplete` --- ### 📝 Commits (3) - [`8bbbaba`](https://github.com/morluto/rea/commit/8bbbabaa2acacd27d60a208128ae7679aa4c62a9) fix(qlog): mark records incomplete when a declaration hides the event name - [`eb6d442`](https://github.com/morluto/rea/commit/eb6d442982e6d233ad39e738f011da6596d2a2fe) Merge upstream main into fix/qlog-hidden-event-name-incomplete - [`0839e0f`](https://github.com/morluto/rea/commit/0839e0f157aa50666a72c316b2208b6f128023c5) Merge upstream main into fix/qlog-hidden-event-name-incomplete ### 📊 Changes **2 files changed** (+43 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/history/QlogCapture.test.ts` (+25 -0) 📝 `src/browser/history/QlogCapture.ts` (+18 -2) </details> ### 📄 Description ## Summary When an explicit sensitive value hides a qlog event's name, the decoder drops that record's transport facts without listing it in `incomplete_fact_records`. The trace then reports `streams: []` / `loss_declarations: []` with an empty incomplete list, which reads as "nothing recorded". `collectTransportFacts` picks loss or packet handling from the *redacted* `visible.name`. A declaration such as `"sent"` hides the value `transport:packet_sent` (and `"name"` hides the property itself). The function then returns early before any incomplete-record bookkeeping. A hidden `frame_type`, `frames` or STREAM field is already reported as incomplete; a hidden event name was not. No issue is linked: I searched issues and PRs for "qlog", "incomplete_fact_records", "qlog sensitive" and "qlog incomplete" and found no report. No open PR touches `QlogCapture.ts`. ## Problem and expected behavior Smallest trigger: `decodeQlogCapture(text, ["sent"])` on one `transport:packet_sent` STREAM event plus one `recovery:packet_lost` event. | Declaration | Before | After | |---|---|---| | `"sent"` | streams 0, losses 1, incomplete `[]` | streams 0, losses 1, incomplete `[0]` | | `"lost"` | streams 1, losses 0, incomplete `[]` | streams 1, losses 0, incomplete `[1]` | | `"name"` | streams 0, losses 0, incomplete `[]` | streams 0, losses 0, incomplete `[0, 1]` | | `"stream"` (control: hides `frame_type`) | incomplete `[0]` | unchanged | Violated contract (`docs/web-network-captures.md`): facts "that cannot be safely shown are omitted with incomplete-record coordinates", and incomplete fact records are "ordinals with omitted/redacted interpretable frame metadata". ## Change and scope `collectTransportFacts` now receives the validated source event name. If the source event is a loss or packet event and the visible name differs (value redacted or property hidden), the record's ordinal is added to `incomplete_fact_records` and no facts are derived from it. Events whose source name is not interpretable (for example `extension:custom`) are not marked; the test covers this. Nothing is revealed: the hidden name is only compared, never projected. Not included: other qlog behavior. Contribution scope: an ordinary evidence/redaction correctness fix within existing boundaries; a maintainer scope decision is not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: `collectTransportFacts` in `src/browser/history/QlogCapture.ts`. - Contribution scope fit and linked maintainer decision: in scope (evidence reporting); not applicable. - CLI and MCP/tool-catalog contract: no schema change; `incomplete_fact_records` now lists records whose interpretable event name was hidden. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: omitted facts become visible as incomplete records instead of silently absent. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/browser/history/QlogCapture.test.ts` — "lists records whose event name a declaration of $hidden hides as incomplete", parameterized over `sent`, `lost` and `name`. It includes a non-interpretable extension event that must stay unmarked. - Base reproduction: on `94072364c` all three cases fail; the incomplete list is `[]` in each. - User-visible CLI/MCP output: not captured separately. The change is confined to the decoder result asserted above, and the qlog acceptance suite (built CLI and stdio MCP parity) passes. - Remaining proof gaps: none known. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed macOS (Apple silicon), Node 24.19.0. - `npx vitest run src/browser/history/QlogCapture.test.ts` on the base — the three new cases fail. - `npx vitest run src/browser/history/` with the fix — 5 files, 102 tests passed. - `npm run build:cached && npx vitest run tests/acceptance/tools/qlogCapture.test.ts` — 4 passed, 1 skipped. - `npm run typecheck` — passed. - `npx oxfmt --check` and `npx oxlint` on both changed files — passed, no errors. - `npm run verify:module-boundaries` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no hidden value is projected; the source name is only compared with the redacted one. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:06:40 +00:00