[PR #4004] [CLOSED] fix(managed): reject runtime locations on managed static evidence #5988

Closed
opened 2026-10-31 01:10:59 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4004
Author: @jackie-cqz
Created: 10/15/2026
Status: ❌ Closed

Base: main ← Head: fix/3955-managed-static-runtime-location


📝 Commits (1)

  • dffa393 fix(managed): reject runtime locations on managed static evidence

📊 Changes

3 files changed (+24 additions, -11 deletions)

View changed files

📝 src/domain/javascript/javascriptApplicationGraph.fixture.ts (+1 -0)
📝 src/domain/javascript/javascriptApplicationGraph.test.ts (+22 -11)
📝 src/domain/javascript/javascriptApplicationGraph.ts (+1 -0)

📄 Description

Summary

Fixes #3955.

Prepared with AI assistance. A human owner reviews the final diff and owns this
PR, per the Author readiness declarations below.

The shared application-graph validator lists the authorities that cannot claim
a runtime location. managed-static-analysis declares that authority in the
evidence schema and is artifact-backed, but the list omitted it.
compare-application-versions therefore accepted a managed static observation
whose location was a runtime capture, while the same shape for
ast-static-analysis was rejected as an invalid input.

Problem and expected behavior

Smallest trigger: validate an application-graph evidence record whose
authority is managed-static-analysis and whose location.value.kind is
runtime.

  • Observed: accepted; the observation is retained with a runtime location.
  • Control: the same record with ast-static-analysis is rejected with
    "Static and native authorities cannot claim a runtime location".
  • Violated invariant: an authority that observes artifact bytes cannot also
    claim to have observed a live runtime location.

Expected: every artifact-backed static authority rejects a runtime location;
passive-cdp-runtime and other runtime authorities keep accepting one.

Change and scope

  • Add managed-static-analysis to the validator's static authority list.
  • Replace the single-authority AST case with a table over every
    artifact-backed static authority the fixture can build, so a new member of
    that list cannot be added without a rejecting case.

Why this fits REA's architecture: the validator is the producing boundary; the
JavaScript application graph and the managed application graph both reuse it, so
one fix covers both callers and no downstream repair is needed. The evidence
schema already declared the authority, so only the duplicate hand-maintained
list had drifted.

Intentionally not included: no new authority, no schema change, and no change to
which authorities may claim a runtime location.

Contract and boundary impact

  • Semantic owner and earliest changed stage: assertApplicationGraphEvidence
    in the JavaScript application graph domain layer; evidence validation stage.
  • Contribution scope fit and linked maintainer decision: not applicable —
    ordinary fix inside existing boundaries.
  • CLI and MCP/tool-catalog contract: none. No tool, schema, or field changes.
  • Provider, bridge, target-format, or platform compatibility: none.
  • Evidence, artifact, provenance, or reconstruction contract: managed static
    observations can no longer carry a runtime location. That is the intended
    contract, not a removal of supported data: a managed observation is
    artifact-backed and its location must stay an artifact location.
  • Target selection, authority, upstream behavior, and cleanup details: not
    applicable; no process, target, or provider is launched.
  • Generated metadata impact: none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

  • Documentation or usability only; no target interaction.
  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated:
    src/domain/javascript/javascriptApplicationGraph.test.ts now runs the
    existing rule over artifact-bytes, ast-static-analysis,
    managed-static-analysis, and native-analysis-provider
    (src/domain/javascript/javascriptApplicationGraph.fixture.ts gained the
    authority in its helper union).
  • Base reproduction: on the base revision the new managed-static-analysis
    case fails with AssertionError: expected [Function] to throw an error while
    the other three authorities pass, which is exactly the reported asymmetry.
  • User-visible CLI/MCP output: not captured. This change was verified at the
    domain validator; see the remaining proof gap.
  • Remaining proof gaps: no end-to-end compare-application-versions CLI/MCP
    call was executed against a full managed-evidence payload. The rule is
    enforced in the shared validator that both the JavaScript and managed graph
    schemas call, and the managed accept path is covered by
    tests/composition/analysis-sessions/managedApplicationGraph.test.ts.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run test:local -- src/domain/javascript/javascriptApplicationGraph.test.ts on the base revision — 1 failed (managed-static-analysis did not throw), 21 passed.
  • npm run test:local -- src/domain/javascript/javascriptApplicationGraph.test.ts after the fix — 22 passed.
  • npm run test:local -- tests/composition/analysis-sessions/managedApplicationGraph.test.ts — 18 passed, confirming legitimate managed evidence with an artifact location is still accepted.
  • npm run check:fast — typecheck and lint including verify:module-boundaries succeeded, 2/2 tasks.
  • Node v22.23.2 on macOS arm64.

Compatibility, safety, and release

  • Breaking changes or migration steps: none. No previously valid canonical
    input becomes invalid; the rejected shape contradicts the authority's own
    definition.
  • Real Hopper/Ghidra, browser, or OS coverage: none; no provider was launched.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: none.

Author readiness

Human owner:

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4004 **Author:** [@jackie-cqz](https://github.com/jackie-cqz) **Created:** 10/15/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/3955-managed-static-runtime-location` --- ### 📝 Commits (1) - [`dffa393`](https://github.com/morluto/rea/commit/dffa393b620ed6984685db7d18c259edb47f811a) fix(managed): reject runtime locations on managed static evidence ### 📊 Changes **3 files changed** (+24 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/javascriptApplicationGraph.fixture.ts` (+1 -0) 📝 `src/domain/javascript/javascriptApplicationGraph.test.ts` (+22 -11) 📝 `src/domain/javascript/javascriptApplicationGraph.ts` (+1 -0) </details> ### 📄 Description ## Summary Fixes #3955. _Prepared with AI assistance. A human owner reviews the final diff and owns this PR, per the Author readiness declarations below._ The shared application-graph validator lists the authorities that cannot claim a runtime location. `managed-static-analysis` declares that authority in the evidence schema and is artifact-backed, but the list omitted it. `compare-application-versions` therefore accepted a managed static observation whose location was a runtime capture, while the same shape for `ast-static-analysis` was rejected as an invalid input. ## Problem and expected behavior Smallest trigger: validate an application-graph evidence record whose `authority` is `managed-static-analysis` and whose `location.value.kind` is `runtime`. - Observed: accepted; the observation is retained with a runtime location. - Control: the same record with `ast-static-analysis` is rejected with "Static and native authorities cannot claim a runtime location". - Violated invariant: an authority that observes artifact bytes cannot also claim to have observed a live runtime location. Expected: every artifact-backed static authority rejects a runtime location; `passive-cdp-runtime` and other runtime authorities keep accepting one. ## Change and scope - Add `managed-static-analysis` to the validator's static authority list. - Replace the single-authority AST case with a table over every artifact-backed static authority the fixture can build, so a new member of that list cannot be added without a rejecting case. Why this fits REA's architecture: the validator is the producing boundary; the JavaScript application graph and the managed application graph both reuse it, so one fix covers both callers and no downstream repair is needed. The evidence schema already declared the authority, so only the duplicate hand-maintained list had drifted. Intentionally not included: no new authority, no schema change, and no change to which authorities may claim a runtime location. ## Contract and boundary impact - Semantic owner and earliest changed stage: `assertApplicationGraphEvidence` in the JavaScript application graph domain layer; evidence validation stage. - Contribution scope fit and linked maintainer decision: not applicable — ordinary fix inside existing boundaries. - CLI and MCP/tool-catalog contract: none. No tool, schema, or field changes. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: managed static observations can no longer carry a runtime location. That is the intended contract, not a removal of supported data: a managed observation is artifact-backed and its location must stay an artifact location. - Target selection, authority, upstream behavior, and cleanup details: not applicable; no process, target, or provider is launched. - Generated metadata impact: none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Documentation or usability only; no target interaction. - [ ] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/domain/javascript/javascriptApplicationGraph.test.ts` now runs the existing rule over `artifact-bytes`, `ast-static-analysis`, `managed-static-analysis`, and `native-analysis-provider` (`src/domain/javascript/javascriptApplicationGraph.fixture.ts` gained the authority in its helper union). - Base reproduction: on the base revision the new `managed-static-analysis` case fails with `AssertionError: expected [Function] to throw an error` while the other three authorities pass, which is exactly the reported asymmetry. - User-visible CLI/MCP output: not captured. This change was verified at the domain validator; see the remaining proof gap. - Remaining proof gaps: no end-to-end `compare-application-versions` CLI/MCP call was executed against a full managed-evidence payload. The rule is enforced in the shared validator that both the JavaScript and managed graph schemas call, and the managed accept path is covered by `tests/composition/analysis-sessions/managedApplicationGraph.test.ts`. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:local -- src/domain/javascript/javascriptApplicationGraph.test.ts` on the base revision — 1 failed (`managed-static-analysis` did not throw), 21 passed. - `npm run test:local -- src/domain/javascript/javascriptApplicationGraph.test.ts` after the fix — 22 passed. - `npm run test:local -- tests/composition/analysis-sessions/managedApplicationGraph.test.ts` — 18 passed, confirming legitimate managed evidence with an artifact location is still accepted. - `npm run check:fast` — typecheck and lint including `verify:module-boundaries` succeeded, 2/2 tasks. - Node v22.23.2 on macOS arm64. ## Compatibility, safety, and release - Breaking changes or migration steps: none. No previously valid canonical input becomes invalid; the rejected shape contradicts the authority's own definition. - Real Hopper/Ghidra, browser, or OS coverage: none; no provider was launched. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none. ## Author readiness Human owner: <!-- @GitHub-handle --> - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 01:10:59 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5988
No description provided.