[PR #5962] [CLOSED] fix(firmware): report a staging budget refusal as a resource constraint #7111

Closed
opened 2026-11-01 21:45:28 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5962
Author: @XiaoBinGan
Created: 10/21/2026
Status: ❌ Closed

Base: main ← Head: fix/firmware-staging-budget


📝 Commits (5)

  • e0a5874 fix(firmware): report a staging budget refusal as a resource constraint
  • 997a552 fix(firmware): explain staging budget hard ceilings
  • 3a7829b fix(firmware): classify staging bytes as capacity
  • 98b6997 Merge main into firmware staging budget
  • 746a64c chore: integrate firmware staging-budget fix with current main

📊 Changes

3 files changed (+147 additions, -5 deletions)

View changed files

📝 src/domain/firmware/firmwareAnalysis.ts (+4 -2)
➕ src/firmware/FirmwareFiles.test.ts (+100 -0)
📝 src/firmware/FirmwareFiles.ts (+43 -3)

📄 Description

Summary

inventoryFirmwareOutput refused an extraction that exceeded the caller-selected max_output_files or max_output_bytes staging budget with AnalysisOutputError, so an MCP caller received unreadable_output, category: "execution_failure" and rea doctor remediation for a deterministic allowance the caller can raise.

Fixes #5846

Problem and expected behavior

  • Smallest trigger: extract_firmware with max_output_files: 1 over the repository's synthetic Unblob producer, which stages rootfs/config (one directory and one regular file). The inventory counted two entries and threw Invalid analysis output for extract_firmware: Staging entry budget exceeded (1), projected as unreadable_output with doctor guidance.
  • Violated invariant: the firmware policy separates producer-report and staging allowances and documents caller-selected staging budgets; the error algebra classifies a bounded admission refusal as a resource constraint, and output errors describe failed output parsing. This refusal is a valid, deterministic budget decision.
  • Expected: keep refusing, identify the resource, report the exceeded allowance in limit details, and explain the actual recovery - raising that specific budget and rerunning with an absent output destination. details.reason keeps the observed text.

Change and scope

  • src/firmware/FirmwareFiles.ts: both staging overruns now throw AnalysisResourceConstraintError (entries: capacity, bytes: memory) with reported_limits.max_output_files / reported_limits.max_output_bytes, retryable: false, and a remediation that names the control, its supported maximum and the absent-destination retry.
  • src/firmware/FirmwareFiles.test.ts (new): covers both refusals and their projection, including the remediation text.
  • Not included: no change to the budgets themselves, to Unblob invocation, to the FirmwareCommand deadline path or to publication.

Contract and boundary impact

  • Semantic owner and earliest changed stage: firmware staging inventory enforcement.
  • Contribution scope fit and linked maintainer decision: not applicable - an ordinary fix inside an existing boundary.
  • CLI and MCP/tool-catalog contract: a staging-budget refusal now returns resource_constraint with reported_limits instead of unreadable_output; the input schema is unchanged.
  • Provider, bridge, target-format, or platform compatibility: none; the same function serves the provider and the command deadline path.
  • Evidence, artifact, provenance, or reconstruction contract: no extraction output is published when the budget is exceeded, as before.
  • Target selection, authority, upstream behavior, and cleanup details: unchanged; no extra process is launched and workspace cleanup keeps its existing path.
  • Generated metadata, package, or installation impact: none.

Expected effects (check known effects; use documentation-only on its own).

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added: src/firmware/FirmwareFiles.test.ts (2 cases).
  • Base reproduction: before the change both cases fail with Expected a resource constraint, received Error: Invalid analysis output for extract_firmware: Staging entry budget exceeded (1) and the byte equivalent; after the change they pass and project code: "resource_constraint" with details.reported_limits and the budget-specific remediation.
  • User-visible CLI/MCP output: the refusal now names max_output_files / max_output_bytes and the supported maximum instead of recommending rea doctor.
  • Remaining proof gaps: the tests stage a real directory tree but do not run Unblob; the original report exercised a mocked Linux admission on macOS, and no real Unblob or public CLI run is claimed.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npx vitest run src/firmware tests/boundary/firmware - 46 passed, 40 skipped.
  • npm run format:check - all matched files use the correct format.
  • npm run verify:test-discovery - all 1903 test files discovered exactly once.
  • npm run typecheck - no diagnostic in the changed files (the remaining errors in this checkout are pre-existing protobuf-module resolution failures).
  • npm run lint - 0 errors, module boundaries checked.

Compatibility, safety, and release

  • Breaking changes or migration steps: callers that matched unreadable_output for a staging overrun now receive resource_constraint; both keep the same reason text.
  • Real Unblob coverage: none claimed.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: none.

Author readiness

Human owner: @XiaoBinGan

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

Maintainer blocker verification

Both staging refusals use schema-owned maxima and one remediation owner: below the cap callers may increase the selected budget up to the supported maximum; at the cap the message recommends a smaller firmware range/image and a fresh absent output destination. It no longer recommends an impossible increase above the schema ceiling.

Regular-file sizes measure retained staging capacity, not observed process memory. The byte-budget refusal therefore reports capacity, matching entry-budget refusal, with non-retryability and the actual configured limit. Four focused FirmwareFiles tests and npm run check:fast passed on Node 24.18.0/npm 11.16.0, including serialized resource classification and cap-specific recovery guidance. No real Unblob extraction or public CLI was executed in this pass.

Current follow-up evidence

Merged main 82e4e032 to resolve the actual firmware contract conflict, retaining main's staging semantics and the schema-owned capacity/remediation fix. The combined tree passed 4 FirmwareFiles tests, 11 report-file boundary tests and check:fast; the 36 firmware integration cases were skipped by host configuration. No real extraction/provider result is claimed. The fork push was a verified fast-forward; this update establishes local combined-tree checks, not completed hosted CI.


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5962 **Author:** [@XiaoBinGan](https://github.com/XiaoBinGan) **Created:** 10/21/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/firmware-staging-budget` --- ### 📝 Commits (5) - [`e0a5874`](https://github.com/morluto/rea/commit/e0a5874367b505018306e6b165fe0d36c97ed2a9) fix(firmware): report a staging budget refusal as a resource constraint - [`997a552`](https://github.com/morluto/rea/commit/997a55297dc9a0df35da0509e77d0b0c3ebaccae) fix(firmware): explain staging budget hard ceilings - [`3a7829b`](https://github.com/morluto/rea/commit/3a7829bad8c53b2175661be4367450c5e8ac75c3) fix(firmware): classify staging bytes as capacity - [`98b6997`](https://github.com/morluto/rea/commit/98b6997386391dcf923f837bfb7552d9cea0a816) Merge main into firmware staging budget - [`746a64c`](https://github.com/morluto/rea/commit/746a64c9a2a5f2d64430a1dcab7c42663c58bb01) chore: integrate firmware staging-budget fix with current main ### 📊 Changes **3 files changed** (+147 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/firmware/firmwareAnalysis.ts` (+4 -2) ➕ `src/firmware/FirmwareFiles.test.ts` (+100 -0) 📝 `src/firmware/FirmwareFiles.ts` (+43 -3) </details> ### 📄 Description ## Summary `inventoryFirmwareOutput` refused an extraction that exceeded the caller-selected `max_output_files` or `max_output_bytes` staging budget with `AnalysisOutputError`, so an MCP caller received `unreadable_output`, `category: "execution_failure"` and `rea doctor` remediation for a deterministic allowance the caller can raise. Fixes #5846 ## Problem and expected behavior - Smallest trigger: `extract_firmware` with `max_output_files: 1` over the repository's synthetic Unblob producer, which stages `rootfs/config` (one directory and one regular file). The inventory counted two entries and threw `Invalid analysis output for extract_firmware: Staging entry budget exceeded (1)`, projected as `unreadable_output` with doctor guidance. - Violated invariant: the firmware policy separates producer-report and staging allowances and documents caller-selected staging budgets; the error algebra classifies a bounded admission refusal as a resource constraint, and output errors describe failed output parsing. This refusal is a valid, deterministic budget decision. - Expected: keep refusing, identify the resource, report the exceeded allowance in limit details, and explain the actual recovery - raising that specific budget and rerunning with an absent output destination. `details.reason` keeps the observed text. ## Change and scope - `src/firmware/FirmwareFiles.ts`: both staging overruns now throw `AnalysisResourceConstraintError` (entries: `capacity`, bytes: `memory`) with `reported_limits.max_output_files` / `reported_limits.max_output_bytes`, `retryable: false`, and a remediation that names the control, its supported maximum and the absent-destination retry. - `src/firmware/FirmwareFiles.test.ts` (new): covers both refusals and their projection, including the remediation text. - Not included: no change to the budgets themselves, to Unblob invocation, to the `FirmwareCommand` deadline path or to publication. ## Contract and boundary impact - Semantic owner and earliest changed stage: firmware staging inventory enforcement. - Contribution scope fit and linked maintainer decision: not applicable - an ordinary fix inside an existing boundary. - CLI and MCP/tool-catalog contract: a staging-budget refusal now returns `resource_constraint` with `reported_limits` instead of `unreadable_output`; the input schema is unchanged. - Provider, bridge, target-format, or platform compatibility: none; the same function serves the provider and the command deadline path. - Evidence, artifact, provenance, or reconstruction contract: no extraction output is published when the budget is exceeded, as before. - Target selection, authority, upstream behavior, and cleanup details: unchanged; no extra process is launched and workspace cleanup keeps its existing path. - Generated metadata, package, or installation impact: none. Expected effects (check known effects; use documentation-only on its own). - [ ] Read existing files or captured data. - [x] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added: `src/firmware/FirmwareFiles.test.ts` (2 cases). - Base reproduction: before the change both cases fail with `Expected a resource constraint, received Error: Invalid analysis output for extract_firmware: Staging entry budget exceeded (1)` and the byte equivalent; after the change they pass and project `code: "resource_constraint"` with `details.reported_limits` and the budget-specific remediation. - User-visible CLI/MCP output: the refusal now names `max_output_files` / `max_output_bytes` and the supported maximum instead of recommending `rea doctor`. - Remaining proof gaps: the tests stage a real directory tree but do not run Unblob; the original report exercised a mocked Linux admission on macOS, and no real Unblob or public CLI run is claimed. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npx vitest run src/firmware tests/boundary/firmware` - 46 passed, 40 skipped. - `npm run format:check` - all matched files use the correct format. - `npm run verify:test-discovery` - all 1903 test files discovered exactly once. - `npm run typecheck` - no diagnostic in the changed files (the remaining errors in this checkout are pre-existing protobuf-module resolution failures). - `npm run lint` - 0 errors, module boundaries checked. ## Compatibility, safety, and release - Breaking changes or migration steps: callers that matched `unreadable_output` for a staging overrun now receive `resource_constraint`; both keep the same reason text. - Real Unblob coverage: none claimed. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none. ## Author readiness Human owner: @XiaoBinGan - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. <!-- maintainer-blocker-review --> ### Maintainer blocker verification Both staging refusals use schema-owned maxima and one remediation owner: below the cap callers may increase the selected budget up to the supported maximum; at the cap the message recommends a smaller firmware range/image and a fresh absent output destination. It no longer recommends an impossible increase above the schema ceiling. Regular-file sizes measure retained staging capacity, not observed process memory. The byte-budget refusal therefore reports `capacity`, matching entry-budget refusal, with non-retryability and the actual configured limit. Four focused `FirmwareFiles` tests and `npm run check:fast` passed on Node 24.18.0/npm 11.16.0, including serialized resource classification and cap-specific recovery guidance. No real Unblob extraction or public CLI was executed in this pass. <!-- current-blocker-followup --> ### Current follow-up evidence Merged main `82e4e032` to resolve the actual firmware contract conflict, retaining main's staging semantics and the schema-owned capacity/remediation fix. The combined tree passed 4 `FirmwareFiles` tests, 11 report-file boundary tests and `check:fast`; the 36 firmware integration cases were skipped by host configuration. No real extraction/provider result is claimed. The fork push was a verified fast-forward; this update establishes local combined-tree checks, not completed hosted CI. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-01 21:45:28 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7111
No description provided.