morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7037] [MERGED] fix(snapshot): decline ambiguous exact evidence replay #7594

New issue

Closed

opened 2026-11-03 13:38:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 13:38:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7037
Author: @WenyuChiou
Created: 10/24/2026
Status: ✅ Merged
Merged: 10/24/2026
Merged by: @morluto

Base: main ← Head: fix/snapshot-evidence-ambiguity-20261024

📝 Commits (2)

da6a902 fix(snapshot): decline ambiguous exact evidence replay
0df2b01 merge: integrate upstream Evidence sealing repair

📊 Changes

3 files changed (+169 additions, -14 deletions)

View changed files

📝 src/domain/analysisSnapshot.test.ts (+45 -0)
📝 src/domain/analysisSnapshot.ts (+25 -14)
📝 tests/boundary/filesystem/composedWorkflowEvidenceLinks.test.ts (+99 -0)

📄 Description

Summary

Decline exact snapshot replay when multiple distinct authenticated Evidence records match the same validated cache entry, rather than choosing provenance by hash order.

This is a residual follow-up to merged #984's exact result-and-provenance contract. It does not change normalized facts or address an authentication bypass.

Problem and expected behavior

A snapshot can legitimately retain historical Evidence with the same query, profile and normalized result but different upstream links. The existing entry match does not uniquely identify every Evidence field. Selecting the first matching record can therefore return historical unlinked provenance instead of the current linked record.

A production DirectAnalysis/session/ledger/snapshot-file regression reproduced this: a profiled binary_overview first returned linked Evidence, and a unique snapshot replay preserved its exact ID and links. Adding an authenticated equivalent historical observation without links caused replay to return the historical ID with empty links. Provider analysis was not called; ordering of the committed IDs determined which provenance survived.

Change and scope

Preserve the existing target/query/provider/profile/result match predicate.
Return an exact replay only when one distinct committed Evidence ID matches.
On a second distinct matching ID, decline exact replay and use the existing session/cache workflow.
Never union links or synthesize an unrecorded Evidence ID.
Keep unique exact replay unchanged. The fallback derives provenance from the atomic observations actually consumed; a refreshed snapshot can then replay that result exactly.

The domain snapshot lookup owns the ambiguity decision. This is a bounded correctness fix within existing analysis behavior, not a new provider or execution capability; a separate advance scope decision is not applicable.

Contract and boundary impact

Public Evidence and persisted snapshot schemas: unchanged.
Provider and target selection: unchanged.
CLI/MCP contracts: unchanged; the existing replay/fallback paths remain in use.
Ambiguous fallback may require session/provider admission even when analysis results reuse the cache. This does not promise that every provider avoids startup.
Dependencies, installation, generated metadata and release behavior: unchanged.
No new process, network, target-mutation or protection-recovery authority.

Evidence and regression coverage

Executed regressions cover historical unlinked observations, repeated imports, canonical ordering, unique exact hits, ambiguous fallback and stable subsequent replay. No authentication rules were bypassed, and no provider-native output was fabricated.

Before the fix, the domain ambiguity case failed while its control passed. Three production DirectAnalysis boundary cases also failed their provenance assertions. After the fix, the fallback preserves the consumed source link without rerunning synthetic provider analysis.

Independent automated static/log review approved the final three-file patch. The reviewer did not independently execute tests or providers; this is not human review.

Validation performed

On pinned base 3f168af2e811441bb48dddb5961041c2c4a04753, checks ran serially with bounded timeouts:

node node_modules/vitest/vitest.mjs run src/domain/analysisSnapshot.test.ts src/application/binary/AnalysisSnapshotCache.test.ts tests/boundary/filesystem/composedWorkflowEvidenceLinks.test.ts tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts tests/boundary/mcp/workflowSnapshotReplayMcp.test.ts --maxWorkers 1 --no-file-parallelism — 81 passed, 2 Windows-only skips, 5 files.
node scripts/run-typescript.mjs --noEmit --checkers 1 --maxMemory 2G — whole-project typecheck passed.
Scoped module boundaries, lint, format and git diff --check — passed.
Four lint warnings remain, including replay-helper complexity 21 against the threshold of 20; no suppression added.

An initial test-placement lint error was corrected by moving a standalone test outside the oversized callback without changing its oracle.

Main 31fc9762a34f30aae1832994bfad6209a023f03e has no overlap with the three changed files and a clean local merge-tree check. That combined tree was not executed; the runtime evidence applies to the pinned-base patch.

Compatibility and limits

Synthetic providers exercised production session, ledger, file and replay owners. No real native engine, newly compiled CLI, full build, full CI/coverage or package qualification ran locally. No performance improvement is claimed. Ambiguous replay falls back conservatively instead of guessing provenance.

The API-published commit differs in metadata from reviewed local commit b573a9b88ab13f3a9bc19ec9f7ab6c6a9ef0dcc3; its complete tree is identical: 021ad8720e8280a172f14e07d27c13082d431fd7. All three public file blob hashes were verified against the reviewed files.

Author readiness

Human owner: @WenyuChiou

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

The human owner confirmed review and authorized recording these declarations.

Before merge

Required current-head checks and relevant verification are satisfied or their gaps are explicitly resolved by maintainers.
The human owner has completed the readiness declarations for this PR.
Material scope and authority questions are resolved.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7037 **Author:** [@WenyuChiou](https://github.com/WenyuChiou) **Created:** 10/24/2026 **Status:** ✅ Merged **Merged:** 10/24/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/snapshot-evidence-ambiguity-20261024` --- ### 📝 Commits (2) - [`da6a902`](https://github.com/morluto/rea/commit/da6a902d55bd820dfd4ad2321272d9a48607ff35) fix(snapshot): decline ambiguous exact evidence replay - [`0df2b01`](https://github.com/morluto/rea/commit/0df2b010427ff8b5b1ad13d949a68f408d4b1cb9) merge: integrate upstream Evidence sealing repair ### 📊 Changes **3 files changed** (+169 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/analysisSnapshot.test.ts` (+45 -0) 📝 `src/domain/analysisSnapshot.ts` (+25 -14) 📝 `tests/boundary/filesystem/composedWorkflowEvidenceLinks.test.ts` (+99 -0) </details> ### 📄 Description ## Summary Decline exact snapshot replay when multiple distinct authenticated Evidence records match the same validated cache entry, rather than choosing provenance by hash order. This is a residual follow-up to merged #984's exact result-and-provenance contract. It does not change normalized facts or address an authentication bypass. ## Problem and expected behavior A snapshot can legitimately retain historical Evidence with the same query, profile and normalized result but different upstream links. The existing entry match does not uniquely identify every Evidence field. Selecting the first matching record can therefore return historical unlinked provenance instead of the current linked record. A production DirectAnalysis/session/ledger/snapshot-file regression reproduced this: a profiled `binary_overview` first returned linked Evidence, and a unique snapshot replay preserved its exact ID and links. Adding an authenticated equivalent historical observation without links caused replay to return the historical ID with empty links. Provider analysis was not called; ordering of the committed IDs determined which provenance survived. ## Change and scope - Preserve the existing target/query/provider/profile/result match predicate. - Return an exact replay only when one distinct committed Evidence ID matches. - On a second distinct matching ID, decline exact replay and use the existing session/cache workflow. - Never union links or synthesize an unrecorded Evidence ID. - Keep unique exact replay unchanged. The fallback derives provenance from the atomic observations actually consumed; a refreshed snapshot can then replay that result exactly. The domain snapshot lookup owns the ambiguity decision. This is a bounded correctness fix within existing analysis behavior, not a new provider or execution capability; a separate advance scope decision is not applicable. ## Contract and boundary impact - Public Evidence and persisted snapshot schemas: unchanged. - Provider and target selection: unchanged. - CLI/MCP contracts: unchanged; the existing replay/fallback paths remain in use. - Ambiguous fallback may require session/provider admission even when analysis results reuse the cache. This does not promise that every provider avoids startup. - Dependencies, installation, generated metadata and release behavior: unchanged. - No new process, network, target-mutation or protection-recovery authority. ## Evidence and regression coverage Executed regressions cover historical unlinked observations, repeated imports, canonical ordering, unique exact hits, ambiguous fallback and stable subsequent replay. No authentication rules were bypassed, and no provider-native output was fabricated. Before the fix, the domain ambiguity case failed while its control passed. Three production DirectAnalysis boundary cases also failed their provenance assertions. After the fix, the fallback preserves the consumed source link without rerunning synthetic provider analysis. Independent automated static/log review approved the final three-file patch. The reviewer did not independently execute tests or providers; this is not human review. ## Validation performed On pinned base `3f168af2e811441bb48dddb5961041c2c4a04753`, checks ran serially with bounded timeouts: - `node node_modules/vitest/vitest.mjs run src/domain/analysisSnapshot.test.ts src/application/binary/AnalysisSnapshotCache.test.ts tests/boundary/filesystem/composedWorkflowEvidenceLinks.test.ts tests/boundary/filesystem/directAnalysisSnapshotReplay.test.ts tests/boundary/mcp/workflowSnapshotReplayMcp.test.ts --maxWorkers 1 --no-file-parallelism` — **81 passed, 2 Windows-only skips, 5 files**. - `node scripts/run-typescript.mjs --noEmit --checkers 1 --maxMemory 2G` — whole-project typecheck passed. - Scoped module boundaries, lint, format and `git diff --check` — passed. - Four lint warnings remain, including replay-helper complexity 21 against the threshold of 20; no suppression added. An initial test-placement lint error was corrected by moving a standalone test outside the oversized callback without changing its oracle. Main `31fc9762a34f30aae1832994bfad6209a023f03e` has no overlap with the three changed files and a clean local merge-tree check. That combined tree was not executed; the runtime evidence applies to the pinned-base patch. ## Compatibility and limits Synthetic providers exercised production session, ledger, file and replay owners. No real native engine, newly compiled CLI, full build, full CI/coverage or package qualification ran locally. No performance improvement is claimed. Ambiguous replay falls back conservatively instead of guessing provenance. The API-published commit differs in metadata from reviewed local commit `b573a9b88ab13f3a9bc19ec9f7ab6c6a9ef0dcc3`; its complete tree is identical: `021ad8720e8280a172f14e07d27c13082d431fd7`. All three public file blob hashes were verified against the reviewed files. ## Author readiness Human owner: @WenyuChiou - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. The human owner confirmed review and authorized recording these declarations. ## Before merge - [ ] Required current-head checks and relevant verification are satisfied or their gaps are explicitly resolved by maintainers. - [ ] The human owner has completed the readiness declarations for this PR. - [ ] Material scope and authority questions are resolved. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-03 13:38:59 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7594

No description provided.

Rows
Columns