[PR #6971] [MERGED] fix(firmware): stop recommending a raise at the staging budget ceiling #7484

Closed
opened 2026-11-01 21:48:09 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6971
Author: @XiaoBinGan
Created: 10/24/2026
Status: ✅ Merged
Merged: 10/24/2026
Merged by: @baron

Base: main ← Head: fix/firmware-staging-ceiling


📝 Commits (1)

  • 4c89ef5 fix(firmware): stop recommending a raise at the staging budget ceiling

📊 Changes

3 files changed (+90 additions, -3 deletions)

View changed files

📝 src/domain/firmware/firmwareAnalysis.ts (+6 -2)
📝 src/firmware/FirmwareFiles.ts (+26 -1)
➕ src/firmware/FirmwareStagingBudget.test.ts (+58 -0)

📄 Description

Summary

The firmware staging-budget refusal told callers to raise max_output_bytes or max_output_files
"within its schema maximum". At the schema ceiling that recovery does not exist, so the one case
where the selected value cannot grow received advice that cannot be followed.

Part of the contract described in #5846, which already returns a nonretryable resource constraint
naming the selected limit. This change only corrects the recovery text at the ceiling and pins the
schema maxima to named constants.

Problem and expected behavior

Smallest trigger: extract_firmware with max_output_files at its schema maximum (100000) on a
staging tree that still exceeds it, or max_output_bytes at 536870912. Both refusals keep their
resource_constraint / capacity classification and reported_limits, but the remediation says
"Increase max_output_files within its schema maximum if the larger extraction is required" — and no
larger value is accepted.

Expected: below the ceiling the remediation names the remaining room and the control to change. At
the ceiling it states that a further raise is not supported and points at a smaller firmware byte
range, which is the recovery that actually exists.

Change and scope

  • src/domain/firmware/firmwareAnalysis.ts: the two schema maxima become MAX_FIRMWARE_STAGING_BYTES
    and MAX_FIRMWARE_STAGING_ENTRIES, and the schema's .max() calls use them, so the accepted range
    and the advice cannot drift apart.
  • src/firmware/FirmwareFiles.ts: firmwareStagingBudgetRemediation selects the below-ceiling or
    at-ceiling wording from the selected value; firmwareStagingLimit uses it.

Intentionally not included: the classification itself (resource_constraint, capacity,
reported_limits, retryable: false) is unchanged — it is already correct on the base revision. No
budget default, extraction behavior, Unblob invocation or deadline path changes.

Follow the contribution scope.
Unresolved scope, authority, side effects, or required verification block integration. Link the
required maintainer scope decision for new providers or capabilities involving target execution,
injection, mutation, or protection recovery; ordinary fixes within existing boundaries may state
"not applicable".

Not applicable — this is an ordinary fix inside the existing firmware admission boundary.

Contract and boundary impact

  • Semantic owner and earliest changed stage: firmware staging-budget enforcement in
    inventoryFirmwareOutput; the earliest changed stage is the refusal's remediation text, not the
    refusal.
  • Contribution scope fit and linked maintainer decision: ordinary fix within existing boundaries; not
    applicable.
  • CLI and MCP/tool-catalog contract: unchanged schemas, codes, categories and reported_limits. Only
    the remediation.action string for this refusal changes, which is the reported defect.
  • Provider, bridge, target-format, or platform compatibility: none; the same helper serves the
    provider path and the command deadline path.
  • Evidence, artifact, provenance, or reconstruction contract: no extraction output is published when
    a budget is exceeded, as before.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): unchanged; no
    extra process is launched and workspace cleanup keeps its existing path.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI
    generates and validates ignored catalogs and skills/; edit authored instructions in
    .agents/skills/reverse-engineer-anything/ and never commit build outputs): none.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: src/firmware/FirmwareStagingBudget.test.ts — a budget below its ceiling
    offers the room and the control, both budgets at their ceilings state that a further raise is not
    supported and point at a smaller range, and the selected value and ceiling are named in both cases.
  • Base reproduction or other evidence: on the base revision firmwareStagingBudgetRemediation does
    not exist and the single-form remediation says "Increase within its schema maximum" for
    every selected value. Verified red → green: restoring that single form makes all four new cases
    fail; the change makes them pass.
  • User-visible CLI/MCP output (if applicable): for extract_firmware at the entry ceiling the
    remediation.action now reads "The staging entry budget, which counts extracted directories and
    links, reached its supported maximum (max_output_files=100000; maximum 100000). Raising
    max_output_files further is not supported. Select a smaller firmware byte range or analyze a
    smaller image. analysis_timeout_ms does not raise this staging allowance." Below the ceiling it
    reads "…was exceeded (max_output_files=1; supported maximum 100000). Increase max_output_files up to
    100000 if the larger extraction is required, or select a materially narrower firmware byte range."
  • Remaining proof gaps: the remediation strings are covered by module tests, not by an end-to-end
    extract_firmware MCP call. The 39 firmware integration cases are skipped by host configuration on
    this machine, and no real Unblob extraction was run.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • node node_modules/vitest/vitest.mjs run src/firmware tests/boundary/firmware --maxWorkers=1 — 81
    passed, 52 skipped (10 files; the skips are host-gated firmware integration and workspace recovery).
  • npx tsc --noEmit -p . — no errors.
  • npx oxfmt <changed files> — formatted.
  • npm run verify:module-boundaries — 2898 source files checked, no violations.
  • Red → green on src/firmware/FirmwareStagingBudget.test.ts: 4 failed with the previous single-form
    remediation, 4 passed with the change.

Compatibility, safety, and release

  • Breaking changes or migration steps: none. The failure classification and reported_limits are
    unchanged; only the recovery sentence changes, and only where the previous sentence recommended an
    unsupported value.
  • Real Hopper/Ghidra, browser, or OS coverage: no analysis engine involved.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no target execution and no new data exposure.

Author readiness

Human owner: @XiaoBinGan

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6971 **Author:** [@XiaoBinGan](https://github.com/XiaoBinGan) **Created:** 10/24/2026 **Status:** ✅ Merged **Merged:** 10/24/2026 **Merged by:** [@baron](https://github.com/baron) **Base:** `main` ← **Head:** `fix/firmware-staging-ceiling` --- ### 📝 Commits (1) - [`4c89ef5`](https://github.com/morluto/rea/commit/4c89ef55dcf92bcf6f2ed1f992c278d6eba67c35) fix(firmware): stop recommending a raise at the staging budget ceiling ### 📊 Changes **3 files changed** (+90 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/firmware/firmwareAnalysis.ts` (+6 -2) 📝 `src/firmware/FirmwareFiles.ts` (+26 -1) ➕ `src/firmware/FirmwareStagingBudget.test.ts` (+58 -0) </details> ### 📄 Description ## Summary The firmware staging-budget refusal told callers to raise `max_output_bytes` or `max_output_files` "within its schema maximum". At the schema ceiling that recovery does not exist, so the one case where the selected value cannot grow received advice that cannot be followed. Part of the contract described in #5846, which already returns a nonretryable resource constraint naming the selected limit. This change only corrects the recovery text at the ceiling and pins the schema maxima to named constants. ## Problem and expected behavior Smallest trigger: `extract_firmware` with `max_output_files` at its schema maximum (`100000`) on a staging tree that still exceeds it, or `max_output_bytes` at `536870912`. Both refusals keep their `resource_constraint` / `capacity` classification and `reported_limits`, but the remediation says "Increase max_output_files within its schema maximum if the larger extraction is required" — and no larger value is accepted. Expected: below the ceiling the remediation names the remaining room and the control to change. At the ceiling it states that a further raise is not supported and points at a smaller firmware byte range, which is the recovery that actually exists. ## Change and scope - `src/domain/firmware/firmwareAnalysis.ts`: the two schema maxima become `MAX_FIRMWARE_STAGING_BYTES` and `MAX_FIRMWARE_STAGING_ENTRIES`, and the schema's `.max()` calls use them, so the accepted range and the advice cannot drift apart. - `src/firmware/FirmwareFiles.ts`: `firmwareStagingBudgetRemediation` selects the below-ceiling or at-ceiling wording from the selected value; `firmwareStagingLimit` uses it. Intentionally not included: the classification itself (`resource_constraint`, `capacity`, `reported_limits`, `retryable: false`) is unchanged — it is already correct on the base revision. No budget default, extraction behavior, Unblob invocation or deadline path changes. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Unresolved scope, authority, side effects, or required verification block integration. Link the required maintainer scope decision for new providers or capabilities involving target execution, injection, mutation, or protection recovery; ordinary fixes within existing boundaries may state "not applicable". Not applicable — this is an ordinary fix inside the existing firmware admission boundary. ## Contract and boundary impact - Semantic owner and earliest changed stage: firmware staging-budget enforcement in `inventoryFirmwareOutput`; the earliest changed stage is the refusal's remediation text, not the refusal. - Contribution scope fit and linked maintainer decision: ordinary fix within existing boundaries; not applicable. - CLI and MCP/tool-catalog contract: unchanged schemas, codes, categories and `reported_limits`. Only the `remediation.action` string for this refusal changes, which is the reported defect. - Provider, bridge, target-format, or platform compatibility: none; the same helper serves the provider path and the command deadline path. - Evidence, artifact, provenance, or reconstruction contract: no extraction output is published when a budget is exceeded, as before. - Target selection, authority, upstream behavior, and cleanup details (if applicable): unchanged; no extra process is launched and workspace cleanup keeps its existing path. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): none. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/firmware/FirmwareStagingBudget.test.ts` — a budget below its ceiling offers the room and the control, both budgets at their ceilings state that a further raise is not supported and point at a smaller range, and the selected value and ceiling are named in both cases. - Base reproduction or other evidence: on the base revision `firmwareStagingBudgetRemediation` does not exist and the single-form remediation says "Increase <budget> within its schema maximum" for every selected value. Verified red → green: restoring that single form makes all four new cases fail; the change makes them pass. - User-visible CLI/MCP output (if applicable): for `extract_firmware` at the entry ceiling the `remediation.action` now reads "The staging entry budget, which counts extracted directories and links, reached its supported maximum (max_output_files=100000; maximum 100000). Raising max_output_files further is not supported. Select a smaller firmware byte range or analyze a smaller image. analysis_timeout_ms does not raise this staging allowance." Below the ceiling it reads "…was exceeded (max_output_files=1; supported maximum 100000). Increase max_output_files up to 100000 if the larger extraction is required, or select a materially narrower firmware byte range." - Remaining proof gaps: the remediation strings are covered by module tests, not by an end-to-end `extract_firmware` MCP call. The 39 firmware integration cases are skipped by host configuration on this machine, and no real Unblob extraction was run. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `node node_modules/vitest/vitest.mjs run src/firmware tests/boundary/firmware --maxWorkers=1` — 81 passed, 52 skipped (10 files; the skips are host-gated firmware integration and workspace recovery). - `npx tsc --noEmit -p .` — no errors. - `npx oxfmt <changed files>` — formatted. - `npm run verify:module-boundaries` — 2898 source files checked, no violations. - Red → green on `src/firmware/FirmwareStagingBudget.test.ts`: 4 failed with the previous single-form remediation, 4 passed with the change. ## Compatibility, safety, and release - Breaking changes or migration steps: none. The failure classification and `reported_limits` are unchanged; only the recovery sentence changes, and only where the previous sentence recommended an unsupported value. - Real Hopper/Ghidra, browser, or OS coverage: no analysis engine involved. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no target execution and no new data exposure. ## Author readiness Human owner: @XiaoBinGan - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-01 21:48:09 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7484
No description provided.