morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8885] [Bug] project-managed-application-graph canonical example claims zero MethodDef rows while containing a method #7782

New issue

Open

opened 2026-11-04 12:09:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-04 12:09:29 +00:00

Owner

Originally created by @coygeek on GitHub (Nov 4, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8885

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Copying the shipped canonical managed graph input into project-managed-application-graph succeeds and returns one method with complete-within-inputs coverage, although that input declares a complete MethodDef table of zero rows. The canonical source contains token 0x06000001 alongside method_rows: {"offset":0,"count":0,"total":0}, selection:null and complete input coverage. The same inline source Evidence is shared by the canonical reconstruction-import example.

This is a consistency defect in the canonical example. I reproduced acceptance through the unmodified CLI and actual stdio MCP on the source revision and published 6.8.0. An ordinary generated PE/CLI inspection control returned consistent row counts, so this report does not establish an inspector-produced contradiction. MCP tools/list did not expose this contradictory inline payload: the source full schema advertised a retained reference, and default examples were omitted.

Reproduction

Use Node.js v24.22.1 and a checkout at the revision below. A fresh checkout needs npm ci and npm run build:cached; verification used the supplied built runtime and did not rerun those preparation commands. From the repository root, run:

node --input-type=module <<'JS'
import assert from 'node:assert/strict';
import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join, resolve } from 'node:path';
import { spawnSync } from 'node:child_process';
import { MANAGED_APPLICATION_GRAPH_EXAMPLE as input } from './dist/contracts/managed/managedWorkflowExamples.js';

const directory = process.env.REPRO_DIR || mkdtempSync(join(tmpdir(), 'rea-example-'));
const home = join(directory, 'home');
mkdirSync(home, { recursive: true });
const file = join(directory, 'graph-input.json');
writeFileSync(file, JSON.stringify(input));
const source = input.managed_members.normalized_result;
const run = spawnSync(process.execPath, [
  'scripts/rea.mjs', 'project-managed-application-graph', file, '--format', 'json',
], { encoding: 'utf8', timeout: 30000, env: {
  PATH: process.env.PATH, HOME: home, TMPDIR: directory,
  XDG_CONFIG_HOME: join(home, 'config'), XDG_CACHE_HOME: join(home, 'cache'),
  XDG_DATA_HOME: join(home, 'data'), XDG_STATE_HOME: join(home, 'state'),
}});
assert.equal(run.status, 0, run.stderr || run.stdout);
const result = JSON.parse(run.stdout).normalized_result;
console.log(JSON.stringify({
  input_method_rows: source.method_rows,
  input_method_tokens: source.methods.map(method => method.token),
  input_coverage: source.coverage,
  input_selection: source.selection,
  graph_types: result.summary.types,
  graph_methods: result.summary.methods,
  graph_coverage: result.coverage,
}, null, 2));
JS

I replayed this code successfully. It reads the canonical example unchanged and invokes the public CLI with a JSON file. It isolates runtime paths and leaves its generated files in the temporary directory. Equivalent CLI calls using the separately installed published package and its own example also returned the contradiction. No managed assembly or native analysis engine is required for this example reproduction.

Expected behavior

The canonical example's row scope should agree with its supplied method: a MethodDef row-1 token requires a full table total of at least one. A complete one-row example can record offset 0, count 1, total 1; if scope is unknown it should record null rather than assert zero. Rebuilding its Evidence commitment is necessary when correcting the payload.

Expected source: the MethodDef interval contract and schema description define count as examined rows and total as the full table size before type selection. The producer derives the total from metadata table 6. The canonical example gives that total as zero before adding the method.

Impact and scope

P3. The demonstrated defect is inconsistent synthetic example data and a misleading complete-inventory example result. No consequential real-target failure was demonstrated. The copied example also produces zero type nodes despite its method naming a declaring type; this is an observation about the same sparse example, not a separate inspector bug.

A generated ordinary one-method PE/CLI control returned method_rows 0/1/1, one type, one method and complete coverage on both runtimes. Projecting its exact Evidence returned five nodes with one type, one method and one field. Using inspection-produced Evidence is therefore a demonstrated alternative for that ordinary fixture. Broader real-world frequency and comparison consequences are NOT_ENOUGH_INFO. No target mutation, execution, data loss or security boundary crossing was observed.

REA version

Source revision c3647ade1e557c4179a8b825a37e0c2193cd2526, package version 6.8.0; separately installed latest published rea-agents 6.8.0. Both CLIs printed 6.8.0; npm view rea-agents version returned 6.8.0.

Runtime and platform

Node.js v24.22.1; macOS, Darwin arm64. No Hopper, Ghidra, CLR or decompiler was used.

Target and artifact context

Shipped synthetic member Evidence for Example.dll, with one method Main, a MethodDef row-1 token, no types, and no artifact bytes. The separate positive control used a generated PE/CLI file with a tiny ret method and was inspected as bytes only.

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

The executed reproduction printed:

{
  "input_method_rows": {
    "offset": 0,
    "count": 0,
    "total": 0
  },
  "input_method_tokens": [
    "0x06000001"
  ],
  "input_coverage": {
    "state": "complete",
    "issues": []
  },
  "input_selection": null,
  "graph_types": 0,
  "graph_methods": 1,
  "graph_coverage": {
    "status": "complete-within-inputs"
  }
}

Both source and published CLI graph calls exited 0. Both real MCP tools/call requests returned graph Evidence with complete-within-inputs coverage. Graph summaries were three nodes, two edges, zero types and one method. The canonical graph and reconstruction contracts share this source Evidence.

Additional CLI controls recreated synthetic Evidence with the production constructor. On the source baseline, an interval of 0/1/1 retained complete-within-inputs, null produced partial coverage with an explicit unknown-scope limitation, and 0/1/2 produced partial coverage with an omitted-row limitation. Published 6.8.0 accepted all three controls with complete-within-inputs: its graph consumer does not yet account for row scope. On both runtimes, modifying a payload without updating its semantic ID correctly returned exit 1 and evidence_integrity_mismatch. These controls are not claims that a real inspector emitted those synthetic records.

The focused command npm run test:focused -- src/contracts/workflowInputContracts.test.ts tests/composition/analysis-sessions/managedApplicationGraph.test.ts passed: two files, 29 tests. No source/test changes were made. These passing checks do not detect the contradictory canonical table count.

Typed outcome or recovery expected

Make the canonical example internally consistent and regenerate its Evidence identity. Preserve the real tools' normal acceptance of consistent inspection Evidence. This report does not require broad schema hardening or claim that accepting arbitrary internally inconsistent synthetic records is a separate defect.

Analysis or suspected cause

Source-derived explanation: runtimeMembers spreads an empty-member result, then adds a method without updating method_rows or types. The empty-member initializer sets a complete zero-row interval. The source graph coverage owner interprets offset 0 and count equal to total as full MethodDef scope. The row payload schema validates scalar fields without proving their consistency with tokens. The public-boundary result above establishes acceptance of this exact shipped fixture; source reasoning explains why it is treated as complete.

The advertisement projection replaces complete Evidence with retained references. That limits exposure: the contradiction is in the canonical inline fixture and executable consumers, rather than inline row data sent by tools/list.

Additional context

Related closed #6822 concerned method-page provenance and false removal claims; its closure names commit 357e354ac7. The canonical example's count is a different residual issue. Closed #4056 and merged #6260 concern omitted call/field relations rather than the example's zero-row declaration. No current open exact duplicate was found.

Fetched origin/main at ebea0f009ffc6353f0ae61254b1d2b5dcc4f08d2 has no changes to the affected example, graph admission or coverage paths relative to the source baseline. Runtime reproduction used the stated baseline and published package; current-main source comparison is not a separate current-main runtime test. Reconstruction-import execution and comparison removal behavior were not tested.

Originally created by @coygeek on GitHub (Nov 4, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8885 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior Copying the shipped canonical managed graph input into `project-managed-application-graph` succeeds and returns one method with `complete-within-inputs` coverage, although that input declares a complete MethodDef table of zero rows. The canonical source contains token `0x06000001` alongside `method_rows: {"offset":0,"count":0,"total":0}`, `selection:null` and complete input coverage. The same inline source Evidence is shared by the canonical reconstruction-import example. This is a consistency defect in the canonical example. I reproduced acceptance through the unmodified CLI and actual stdio MCP on the source revision and published 6.8.0. An ordinary generated PE/CLI inspection control returned consistent row counts, so this report does not establish an inspector-produced contradiction. MCP tools/list did not expose this contradictory inline payload: the source full schema advertised a retained reference, and default examples were omitted. ### Reproduction Use Node.js v24.22.1 and a checkout at the revision below. A fresh checkout needs `npm ci` and `npm run build:cached`; verification used the supplied built runtime and did not rerun those preparation commands. From the repository root, run: ```sh node --input-type=module <<'JS' import assert from 'node:assert/strict'; import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join, resolve } from 'node:path'; import { spawnSync } from 'node:child_process'; import { MANAGED_APPLICATION_GRAPH_EXAMPLE as input } from './dist/contracts/managed/managedWorkflowExamples.js'; const directory = process.env.REPRO_DIR || mkdtempSync(join(tmpdir(), 'rea-example-')); const home = join(directory, 'home'); mkdirSync(home, { recursive: true }); const file = join(directory, 'graph-input.json'); writeFileSync(file, JSON.stringify(input)); const source = input.managed_members.normalized_result; const run = spawnSync(process.execPath, [ 'scripts/rea.mjs', 'project-managed-application-graph', file, '--format', 'json', ], { encoding: 'utf8', timeout: 30000, env: { PATH: process.env.PATH, HOME: home, TMPDIR: directory, XDG_CONFIG_HOME: join(home, 'config'), XDG_CACHE_HOME: join(home, 'cache'), XDG_DATA_HOME: join(home, 'data'), XDG_STATE_HOME: join(home, 'state'), }}); assert.equal(run.status, 0, run.stderr || run.stdout); const result = JSON.parse(run.stdout).normalized_result; console.log(JSON.stringify({ input_method_rows: source.method_rows, input_method_tokens: source.methods.map(method => method.token), input_coverage: source.coverage, input_selection: source.selection, graph_types: result.summary.types, graph_methods: result.summary.methods, graph_coverage: result.coverage, }, null, 2)); JS ``` I replayed this code successfully. It reads the canonical example unchanged and invokes the public CLI with a JSON file. It isolates runtime paths and leaves its generated files in the temporary directory. Equivalent CLI calls using the separately installed published package and its own example also returned the contradiction. No managed assembly or native analysis engine is required for this example reproduction. ### Expected behavior The canonical example's row scope should agree with its supplied method: a MethodDef row-1 token requires a full table total of at least one. A complete one-row example can record offset 0, count 1, total 1; if scope is unknown it should record null rather than assert zero. Rebuilding its Evidence commitment is necessary when correcting the payload. Expected source: the [MethodDef interval contract](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/docs/managed-code-analysis.md#L371-L376) and [schema description](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/domain/managed/managedArtifact.ts#L573-L587) define count as examined rows and total as the full table size before type selection. The [producer](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/dotnet/ManagedMemberInspector.ts#L194-L201) derives the total from metadata table 6. The [canonical example](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/contracts/managed/managedWorkflowExamples.ts#L53) gives that total as zero before adding the method. ### Impact and scope P3. The demonstrated defect is inconsistent synthetic example data and a misleading complete-inventory example result. No consequential real-target failure was demonstrated. The copied example also produces zero type nodes despite its method naming a declaring type; this is an observation about the same sparse example, not a separate inspector bug. A generated ordinary one-method PE/CLI control returned method_rows 0/1/1, one type, one method and complete coverage on both runtimes. Projecting its exact Evidence returned five nodes with one type, one method and one field. Using inspection-produced Evidence is therefore a demonstrated alternative for that ordinary fixture. Broader real-world frequency and comparison consequences are NOT_ENOUGH_INFO. No target mutation, execution, data loss or security boundary crossing was observed. ### REA version Source revision `c3647ade1e557c4179a8b825a37e0c2193cd2526`, package version 6.8.0; separately installed latest published `rea-agents` 6.8.0. Both CLIs printed `6.8.0`; `npm view rea-agents version` returned `6.8.0`. ### Runtime and platform Node.js v24.22.1; macOS, Darwin arm64. No Hopper, Ghidra, CLR or decompiler was used. ### Target and artifact context Shipped synthetic member Evidence for Example.dll, with one method Main, a MethodDef row-1 token, no types, and no artifact bytes. The separate positive control used a generated PE/CLI file with a tiny ret method and was inspected as bytes only. ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence The executed reproduction printed: ```json { "input_method_rows": { "offset": 0, "count": 0, "total": 0 }, "input_method_tokens": [ "0x06000001" ], "input_coverage": { "state": "complete", "issues": [] }, "input_selection": null, "graph_types": 0, "graph_methods": 1, "graph_coverage": { "status": "complete-within-inputs" } } ``` Both source and published CLI graph calls exited 0. Both real MCP tools/call requests returned graph Evidence with complete-within-inputs coverage. Graph summaries were three nodes, two edges, zero types and one method. The [canonical graph and reconstruction contracts](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/contracts/managed/managedWorkflowToolContracts.ts#L75-L110) share this source Evidence. Additional CLI controls recreated synthetic Evidence with the production constructor. On the source baseline, an interval of 0/1/1 retained complete-within-inputs, null produced partial coverage with an explicit unknown-scope limitation, and 0/1/2 produced partial coverage with an omitted-row limitation. Published 6.8.0 accepted all three controls with complete-within-inputs: its graph consumer does not yet account for row scope. On both runtimes, modifying a payload without updating its semantic ID correctly returned exit 1 and evidence_integrity_mismatch. These controls are not claims that a real inspector emitted those synthetic records. The focused command `npm run test:focused -- src/contracts/workflowInputContracts.test.ts tests/composition/analysis-sessions/managedApplicationGraph.test.ts` passed: two files, 29 tests. No source/test changes were made. These passing checks do not detect the contradictory canonical table count. ### Typed outcome or recovery expected Make the canonical example internally consistent and regenerate its Evidence identity. Preserve the real tools' normal acceptance of consistent inspection Evidence. This report does not require broad schema hardening or claim that accepting arbitrary internally inconsistent synthetic records is a separate defect. ### Analysis or suspected cause Source-derived explanation: [runtimeMembers](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/contracts/managed/managedWorkflowExamples.ts#L75-L129) spreads an empty-member result, then adds a method without updating method_rows or types. The [empty-member initializer](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/contracts/managed/managedWorkflowExamples.ts#L23-L65) sets a complete zero-row interval. The [source graph coverage owner](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/domain/managed/managedApplicationGraphCoverage.ts#L112-L122) interprets offset 0 and count equal to total as full MethodDef scope. The row payload schema validates scalar fields without proving their consistency with tokens. The public-boundary result above establishes acceptance of this exact shipped fixture; source reasoning explains why it is treated as complete. The [advertisement projection](https://github.com/morluto/rea/blob/c3647ade1e557c4179a8b825a37e0c2193cd2526/src/contracts/advertisedInputExamples.ts) replaces complete Evidence with retained references. That limits exposure: the contradiction is in the canonical inline fixture and executable consumers, rather than inline row data sent by tools/list. ### Additional context Related closed [#6822](https://github.com/morluto/rea/issues/6822) concerned method-page provenance and false removal claims; its closure names commit 357e354ac7f5aed8e90c209dff30327d6bf212dc. The canonical example's count is a different residual issue. Closed [#4056](https://github.com/morluto/rea/issues/4056) and merged [#6260](https://github.com/morluto/rea/pull/6260) concern omitted call/field relations rather than the example's zero-row declaration. No current open exact duplicate was found. Fetched origin/main at `ebea0f009ffc6353f0ae61254b1d2b5dcc4f08d2` has no changes to the affected example, graph admission or coverage paths relative to the source baseline. Runtime reproduction used the stated baseline and published package; current-main source comparison is not a separate current-main runtime test. Reconstruction-import execution and comparison removal behavior were not tested.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7782

No description provided.

Rows
Columns