[GH-ISSUE #8682] [Design] Preserve investigation records in scoped MCP connections #7509

New issue

Open

opened 2026-11-03 00:30:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 00:30:22 +00:00

Owner

Originally created by @morluto on GitHub (Nov 2, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8682

Before submitting

I searched the open and closed issues and pull requests for a related discussion.
I understand the contribution scope must be reviewed before integration; open questions are welcome here.
This discussion does not include credentials, private samples, or sensitive target data.

Decision needed

How can a scoped MCP connection discover and preserve automatically recorded Unknowns and retained Evidence without enabling the full session family or silently changing its registration?

Context and evidence

On REA PR #8659 head 91aa0e150, Node 24.22.1 and macOS arm64, a stdio connection scoped to direct,electron,application analyzed two self-authored JavaScript fixtures and returned a partial compare_javascript_export_shapes result. list_unknowns and export_evidence_bundle were disabled, and the comparison Evidence did not contain the Unknown ID. The server did not advertise the MCP resources capability.

A separate in-process MCP control used those same real producer Evidence records with the production registration and inspected its session owner: the partial comparison had recorded one Unknown linked to the comparison Evidence. A session-enabled stdio control also listed that Unknown. These are controlled observations, not an autonomous-agent study. A scoped client cannot use the session-only listing or export tools to inspect that record; this finding is independent of the missing-target recovery in #8657.

The retained Evidence restart loss was separately reproduced in #8657. One stable ELF parent could be retrieved again by rerunning its producer with complete detail and manually writing the result to a file; that does not recover the distinct Unknown record or guarantee a general solution for mutable/large inputs.

Expected interaction with targets

Inspect or export already-retained investigation records with caller-selected scope and paths. No target execution, provider switching, automatic registration change, or network access is proposed.

Boundary details (optional)

Preserve the Unknown's identity, revision history, links to supporting Evidence, and explicit uncertainty; do not conflate a comparison's partial coverage with the registry record. Scope is a caller choice. Any file export must remain explicit and honor existing output and capacity rules; retain existing session isolation and complete Evidence access. Avoid implying a retained ID survives a process restart unless it was saved and restored.

Options and tradeoffs

Compare a separately selectable investigation-record family, a bounded record/evidence view in an already-scoped application workflow, or explicit guidance to include session up front. Reuse existing record semantics rather than adding a provider wrapper. In one local catalog measurement, adding session to direct,electron,application added 24 advertised tools: compact tools/list JSON grew from 167,856 to 224,188 UTF-8 bytes, and full output-schema profile from 1,574,624 to 1,844,484 bytes. These are serialized response sizes for one configuration, not token, time, CPU, memory, or agent-selection measurements. Requiring session remains a workable choice before work starts but cannot recover state after an already-scoped server restarts.

Verification available so far

I have observed results. Test lifecycle and export behavior with scoped and unscoped registrations, existing Unknown revisions and Evidence links, partial/capacity refusals, clients without local file access, both schema profiles, and cleanup. The in-process owner control used real producer Evidence but did not observe the hidden record through external stdio.

Success criteria and open questions

A caller can discover whether retained Unknowns exist and preserve the ones needed, or receives a truthful limitation and a usable up-front configuration path. No automatic scope expansion; no unsupported claim that a restart retains history. Assess schema size and completed-task costs before selecting a new surface.

References

Related: #8657 (scoped no-target recovery), #8388 (scoped catalog discoverability), #8565 (provider recovery), and #4809 (opt-in investigation journal).

@gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

Originally created by @morluto on GitHub (Nov 2, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8682 ### Before submitting - [x] I searched the open and closed issues and pull requests for a related discussion. - [x] I understand the contribution scope must be reviewed before integration; open questions are welcome here. - [x] This discussion does not include credentials, private samples, or sensitive target data. ### Decision needed How can a scoped MCP connection discover and preserve automatically recorded Unknowns and retained Evidence without enabling the full session family or silently changing its registration? ### Context and evidence On REA PR #8659 head `91aa0e150`, Node 24.22.1 and macOS arm64, a stdio connection scoped to `direct,electron,application` analyzed two self-authored JavaScript fixtures and returned a partial `compare_javascript_export_shapes` result. `list_unknowns` and `export_evidence_bundle` were disabled, and the comparison Evidence did not contain the Unknown ID. The server did not advertise the MCP resources capability. A separate in-process MCP control used those same real producer Evidence records with the production registration and inspected its session owner: the partial comparison had recorded one Unknown linked to the comparison Evidence. A session-enabled stdio control also listed that Unknown. These are controlled observations, not an autonomous-agent study. A scoped client cannot use the session-only listing or export tools to inspect that record; this finding is independent of the missing-target recovery in #8657. The retained Evidence restart loss was separately reproduced in #8657. One stable ELF parent could be retrieved again by rerunning its producer with complete detail and manually writing the result to a file; that does not recover the distinct Unknown record or guarantee a general solution for mutable/large inputs. ### Expected interaction with targets Inspect or export already-retained investigation records with caller-selected scope and paths. No target execution, provider switching, automatic registration change, or network access is proposed. ### Boundary details (optional) Preserve the Unknown's identity, revision history, links to supporting Evidence, and explicit uncertainty; do not conflate a comparison's partial coverage with the registry record. Scope is a caller choice. Any file export must remain explicit and honor existing output and capacity rules; retain existing session isolation and complete Evidence access. Avoid implying a retained ID survives a process restart unless it was saved and restored. ### Options and tradeoffs Compare a separately selectable investigation-record family, a bounded record/evidence view in an already-scoped application workflow, or explicit guidance to include `session` up front. Reuse existing record semantics rather than adding a provider wrapper. In one local catalog measurement, adding `session` to `direct,electron,application` added 24 advertised tools: compact `tools/list` JSON grew from 167,856 to 224,188 UTF-8 bytes, and full output-schema profile from 1,574,624 to 1,844,484 bytes. These are serialized response sizes for one configuration, not token, time, CPU, memory, or agent-selection measurements. Requiring `session` remains a workable choice before work starts but cannot recover state after an already-scoped server restarts. ### Verification available so far I have observed results. Test lifecycle and export behavior with scoped and unscoped registrations, existing Unknown revisions and Evidence links, partial/capacity refusals, clients without local file access, both schema profiles, and cleanup. The in-process owner control used real producer Evidence but did not observe the hidden record through external stdio. ### Success criteria and open questions A caller can discover whether retained Unknowns exist and preserve the ones needed, or receives a truthful limitation and a usable up-front configuration path. No automatic scope expansion; no unsupported claim that a restart retains history. Assess schema size and completed-task costs before selecting a new surface. ### References Related: #8657 (scoped no-target recovery), #8388 (scoped catalog discoverability), #8565 (provider recovery), and #4809 (opt-in investigation journal). @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7509

No description provided.

Rows
Columns