morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8433] [Design] Clarify inline analysis view parent ownership and session handoff #6605

New issue

Open

opened 2026-11-01 21:12:37 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-11-01 21:12:37 +00:00

Owner

Originally created by @morluto on GitHub (Nov 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8433

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

A successful inspect_analysis_view call with a complete inline observation retained the resulting view in the session but did not retain the observation that the view identifies as its parent. Looking up that parent as retained Evidence then failed with evidence_integrity_mismatch, reason missing, even though the caller had just supplied it. The caller still has its original inline copy.

Reproduction

Obtain complete authenticated procedure_address Evidence. In the original run this was a real Kuna 1.986 observation of _evaluate in a self-built Mach-O. The original run deliberately configured a zero-byte Evidence ledger to obtain an inline unretained observation from the experimental recovery work in #8426; that configuration is not needed to pass existing inline Evidence to the view.
In a fresh REA MCP session with no active target or providers, supply that record as source: {kind: "inline", evidence: ...} to inspect_analysis_view with view: {kind: "summary"}. On main, the view succeeded and linked the parent ID in both evidence_links and normalized_result.parent_evidence_id.
get_evidence_bundle returned one record, the view, and no parent. The same inspection using source: {kind: "retained-evidence", evidence_id: <parent ID>} failed as missing.
As a control, build a canonical single-record bundle for the original parent using REA's internal test helper and import it with import_evidence_bundle. The same retained-reference request then succeeded and returned the same normalized view; the session contained both records. No target was opened and no provider was rerun during steps 2–4.

Observed once on main with the captured real Kuna observation; the original end-to-end probe also showed the missing parent on the experimental branch. This is an in-memory MCP transport exercise, not a stdio or CLI test.

Expected behavior

Decide whether the session should retain an authenticated inline parent or clearly communicate that it remains caller-owned and provide a usable handoff when the caller needs a retained reference. The tool-design guidance discusses retaining completed caller-owned sources when a recorder is available, but whether that guidance applies to this projection requires a design decision. Fixed-port callers without a recorder should remain usable. This does not assert that every deliberately partial Evidence bundle must include its entire transitive closure.

Impact and scope

An agent can successfully create and retain a view, then be unable to follow its parent_evidence_id in that same session unless it separately retains/imports the source. The original inline record remains available to the caller; no corruption of that record was observed. Other view types, CLI, capacity refusal, and cancellation are not tested here.

REA version

6e9ee97a69cb16c7150d8b550e705cba055ee4f0 (source, main). The provider record was captured using experimental branch 458674fba8bc5adc7873adb99b5256ed0e16fc30 and then accepted by main in a fresh target-free session.

Runtime and platform

Node 24.22.1; macOS arm64; Kuna 1.986 for the original observation. MCP SDK in-memory transport.

Target and artifact context

Self-built arm64 Mach-O, SHA-256 ffad1b70c6a5a7ef3f7c3f59126be516520210777d949b35e97c9067f272aa2d. Statically analyzed, not executed; digest unchanged after the provider run.

Interface

MCP

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

The main-revision probe observed initialCount: 1, parentRetained: false, viewRetained: true, errorCode: evidence_integrity_mismatch, reason: missing; after source import afterCount: 2, recovered: true, activeTarget: false. The linked source ID was ev_3465d864a401b3aa26878cc66ba03aefee474ecc2bc0bd1ef1bb8e491a2d6f02 in this fixture.

Analysis or suspected cause

Source-derived: inspectAnalysisViewValidated resolves and projects the inline parent but returns only the view. registerAnalysisViewTool uses a generic handler, and deliverEvidenceResult records that returned view. This appears consistent with an explicit existing choice, not a simple missing test: an MCP test asserts the inline parent remains unretained and, for omitted limitations, tells the caller to consult its own copy or its retaining session. Other tests pre-retain their parent before comparing inline and retained views. Assess whether the resulting handoff is sufficiently discoverable and usable for agents before changing ownership; account for authenticated source identity, repeated inputs, resource refusal and cancellation.

Additional context

Related to #8427, which addresses recovery of unretained inline observations. This issue concerns the design of a separate successful view call that accepts an inline source but does not make that source available through its retained parent reference. The current behavior is explicitly tested; this report asks whether its agent UX should change rather than claiming an accidental regression.

cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

Originally created by @morluto on GitHub (Nov 1, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8433 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior A successful `inspect_analysis_view` call with a complete inline observation retained the resulting view in the session but did not retain the observation that the view identifies as its parent. Looking up that parent as retained Evidence then failed with `evidence_integrity_mismatch`, reason `missing`, even though the caller had just supplied it. The caller still has its original inline copy. ### Reproduction 1. Obtain complete authenticated `procedure_address` Evidence. In the original run this was a real Kuna 1.986 observation of `_evaluate` in a self-built Mach-O. The original run deliberately configured a zero-byte Evidence ledger to obtain an inline unretained observation from the experimental recovery work in #8426; that configuration is not needed to pass existing inline Evidence to the view. 2. In a fresh REA MCP session with no active target or providers, supply that record as `source: {kind: "inline", evidence: ...}` to `inspect_analysis_view` with `view: {kind: "summary"}`. On main, the view succeeded and linked the parent ID in both `evidence_links` and `normalized_result.parent_evidence_id`. 3. `get_evidence_bundle` returned one record, the view, and no parent. The same inspection using `source: {kind: "retained-evidence", evidence_id: <parent ID>}` failed as missing. 4. As a control, build a canonical single-record bundle for the original parent using REA's internal test helper and import it with `import_evidence_bundle`. The same retained-reference request then succeeded and returned the same normalized view; the session contained both records. No target was opened and no provider was rerun during steps 2–4. Observed once on main with the captured real Kuna observation; the original end-to-end probe also showed the missing parent on the experimental branch. This is an in-memory MCP transport exercise, not a stdio or CLI test. ### Expected behavior Decide whether the session should retain an authenticated inline parent or clearly communicate that it remains caller-owned and provide a usable handoff when the caller needs a retained reference. The [tool-design guidance](https://github.com/morluto/rea/blob/6e9ee97a69cb16c7150d8b550e705cba055ee4f0/docs/tool-design.md#L160-L172) discusses retaining completed caller-owned sources when a recorder is available, but whether that guidance applies to this projection requires a design decision. Fixed-port callers without a recorder should remain usable. This does not assert that every deliberately partial Evidence bundle must include its entire transitive closure. ### Impact and scope An agent can successfully create and retain a view, then be unable to follow its `parent_evidence_id` in that same session unless it separately retains/imports the source. The original inline record remains available to the caller; no corruption of that record was observed. Other view types, CLI, capacity refusal, and cancellation are not tested here. ### REA version `6e9ee97a69cb16c7150d8b550e705cba055ee4f0` (source, main). The provider record was captured using experimental branch `458674fba8bc5adc7873adb99b5256ed0e16fc30` and then accepted by main in a fresh target-free session. ### Runtime and platform Node 24.22.1; macOS arm64; Kuna 1.986 for the original observation. MCP SDK in-memory transport. ### Target and artifact context Self-built arm64 Mach-O, SHA-256 `ffad1b70c6a5a7ef3f7c3f59126be516520210777d949b35e97c9067f272aa2d`. Statically analyzed, not executed; digest unchanged after the provider run. ### Interface MCP ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence The main-revision probe observed `initialCount: 1`, `parentRetained: false`, `viewRetained: true`, `errorCode: evidence_integrity_mismatch`, `reason: missing`; after source import `afterCount: 2`, `recovered: true`, `activeTarget: false`. The linked source ID was `ev_3465d864a401b3aa26878cc66ba03aefee474ecc2bc0bd1ef1bb8e491a2d6f02` in this fixture. ### Analysis or suspected cause Source-derived: [`inspectAnalysisViewValidated`](https://github.com/morluto/rea/blob/6e9ee97a69cb16c7150d8b550e705cba055ee4f0/src/application/analysisView/AnalysisViewService.ts#L200-L258) resolves and projects the inline parent but returns only the view. [`registerAnalysisViewTool`](https://github.com/morluto/rea/blob/6e9ee97a69cb16c7150d8b550e705cba055ee4f0/src/server/registerAnalysisViewTool.ts) uses a generic handler, and [`deliverEvidenceResult`](https://github.com/morluto/rea/blob/6e9ee97a69cb16c7150d8b550e705cba055ee4f0/src/server/contractToolHandler.ts#L41-L55) records that returned view. This appears consistent with an explicit existing choice, not a simple missing test: [an MCP test](https://github.com/morluto/rea/blob/6e9ee97a69cb16c7150d8b550e705cba055ee4f0/tests/boundary/mcp/analysisViewMcp.test.ts#L603-L634) asserts the inline parent remains unretained and, for omitted limitations, tells the caller to consult its own copy or its retaining session. Other tests pre-retain their parent before comparing inline and retained views. Assess whether the resulting handoff is sufficiently discoverable and usable for agents before changing ownership; account for authenticated source identity, repeated inputs, resource refusal and cancellation. ### Additional context Related to #8427, which addresses recovery of unretained inline observations. This issue concerns the design of a separate successful view call that accepts an inline source but does not make that source available through its retained parent reference. The current behavior is explicitly tested; this report asks whether its agent UX should change rather than claiming an accidental regression. cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

bsakaguchi added the

triage

label

2026-11-01 21:12:37 +00:00

bsakaguchi commented

2026-11-01 21:12:38 +00:00

Author

Owner

@morluto commented on GitHub (Nov 1, 2026):

A practical existing alternative for view-only handoff: on main 6e9ee97a, I saved the actual single Kuna procedure_address Evidence record as JSON (not a bundle), then selected source: {kind: "evidence-file", path: <absolute path>} with view: {kind: "summary"}. A target-free, provider-free in-memory MCP session returned the same view on two calls; the public CLI inspect-analysis-view returned the same Evidence ID and normalized result. The input file was unchanged, and changing the record's normalized result without updating its authenticated identity was rejected. This test reused the captured real observation; it did not rerun Kuna.

The MCP session still retained only the view, not the parent, so this does not make a retained-reference lookup or an exported view-only bundle resolve the parent. It does avoid reconstructing a canonical bundle when repeatedly inspecting this single record, provided the caller can save it and the downstream tool explicitly accepts an Evidence-file selector. One source/view and one host were tested; not all Evidence consumers advertise this selector.

@morluto commented on GitHub (Nov 1, 2026): A practical existing alternative for **view-only** handoff: on main `6e9ee97a`, I saved the actual single Kuna `procedure_address` Evidence record as JSON (not a bundle), then selected `source: {kind: "evidence-file", path: <absolute path>}` with `view: {kind: "summary"}`. A target-free, provider-free in-memory MCP session returned the same view on two calls; the public CLI `inspect-analysis-view` returned the same Evidence ID and normalized result. The input file was unchanged, and changing the record's normalized result without updating its authenticated identity was rejected. This test reused the captured real observation; it did not rerun Kuna. The MCP session still retained only the view, not the parent, so this does **not** make a retained-reference lookup or an exported view-only bundle resolve the parent. It does avoid reconstructing a canonical bundle when repeatedly inspecting this single record, provided the caller can save it and the downstream tool explicitly accepts an Evidence-file selector. One source/view and one host were tested; not all Evidence consumers advertise this selector.

bsakaguchi referenced this issue

2026-11-01 21:47:27 +00:00

[PR #6628] [CLOSED] fix(python): classify negative marshal string sizes as malformed #7383

bsakaguchi referenced this issue

2026-11-01 21:47:29 +00:00

[PR #6633] [CLOSED] fix(python): classify negative marshal string lengths as malformed input #7386