[GH-ISSUE #2617] fix(verify): managed manifest selection includes unrequested methods #933

New issue

Closed

opened 2026-10-15 18:29:41 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:29:41 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2617

Summary

The operator-manifest verifier promises to inspect a declared method by its metadata row and construct its graph from a single selected member page. Its selection options currently leave every method in the result, so the graph receives unrequested methods while its input Evidence records a one-method limit and row offset.

Steps to reproduce

With the locked dependencies installed, create a disposable source test named src/dotnet/ManagedManifestPage.probe.test.ts containing the following. It uses the verifier's PE builder and the same member-selection option shape as the manifest path.

import { expect, it } from "vitest";
import { inspectManagedMembersBytes } from "./ManagedMemberInspector.js";
import { managedPeFixtureTarget } from "./ManagedPe.fixture.js";
import { buildManagedPeFixture } from "../../scripts/fixtures/managed/pe.mjs";

it("selects the second method for manifest verification", () => {
  const bytes = buildManagedPeFixture({
    methods: ["First", "Second", "Third"].map(name => ({
      name, body: Buffer.from([0x2a])
    }))
  });
  const options = {
    methodOffset: 1, methodLimit: 1, typeLimit: 1,
    fieldLimit: 1, memberRefLimit: 1, edgeLimit: 1
  };
  const result = inspectManagedMembersBytes(bytes, managedPeFixtureTarget(bytes), options);
  expect(result.methods.map(method => method.name)).toEqual(["Second"]);
});

Run npm run test:focused -- src/dotnet/ManagedManifestPage.probe.test.ts, then remove the disposable test. To examine the source-established graph consequence, follow the manifest verifier's second-row selection into its member Evidence and graph projection. The compiled full manifest lane was not run.

Expected behavior

For a manifest selecting the second MethodDef row, the selected member result and the graph input should contain that method rather than every method in the assembly. Recorded selection parameters should describe the operation that actually produced the Evidence.

Actual behavior

The focused source test returned ["First","Second","Third"] and failed the Second-only assertion. All three method bodies were present. Source inspection establishes that the verifier records offset 1 and limit 1 on this unsliced result and passes it into graph projection. Its later token lookup finds Second correctly, but leaves the extra methods in the graph input.

Evidence

Expected source: docs/managed-code-analysis.md:435-449 explicitly promises per-row selection and a graph from the single selected member page.
Failure source: scripts/verify/managed/manifest.mjs:322-328 sends the ignored selection options; src/dotnet/ManagedMemberInspector.ts:154 accepts only typeNames; scripts/verify/managed/manifest.mjs:269-283 records these options and projects the full result.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The focused probe establishes the unsliced result. The graph and Evidence consequence is established from the current source, with manifest identity, body and method-digest validation retained. The inspector's independent resource budgets still apply; this report does not establish unlimited decoding or measure large-assembly costs.

Restoration check

Repeat the three-method selection and observe only Second. An offset-zero control should select only First. With a valid manifest and matching commitments for Second, verify that the graph input excludes First and Third and that recorded parameters accurately describe its selection. Preserve rejection of target identity and method commitment mismatches.

Runtime or environment

Source revision 8b181716ac with locked dependencies, Node.js v26.10.0 and npm 11.19.1.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The manifest verifier breaks its bounded member-selection contract and describes an unapplied selection in Evidence. Wrong method identity was not observed because the subsequent token lookup still finds the declared method.
Workaround status: none
Workaround basis: The manifest entrypoint exposes no alternative setting that turns its requested metadata-row selection into an applied member selection.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2617 ## Summary The operator-manifest verifier promises to inspect a declared method by its metadata row and construct its graph from a single selected member page. Its selection options currently leave every method in the result, so the graph receives unrequested methods while its input Evidence records a one-method limit and row offset. ## Steps to reproduce With the locked dependencies installed, create a disposable source test named `src/dotnet/ManagedManifestPage.probe.test.ts` containing the following. It uses the verifier's PE builder and the same member-selection option shape as the manifest path. ```ts import { expect, it } from "vitest"; import { inspectManagedMembersBytes } from "./ManagedMemberInspector.js"; import { managedPeFixtureTarget } from "./ManagedPe.fixture.js"; import { buildManagedPeFixture } from "../../scripts/fixtures/managed/pe.mjs"; it("selects the second method for manifest verification", () => { const bytes = buildManagedPeFixture({ methods: ["First", "Second", "Third"].map(name => ({ name, body: Buffer.from([0x2a]) })) }); const options = { methodOffset: 1, methodLimit: 1, typeLimit: 1, fieldLimit: 1, memberRefLimit: 1, edgeLimit: 1 }; const result = inspectManagedMembersBytes(bytes, managedPeFixtureTarget(bytes), options); expect(result.methods.map(method => method.name)).toEqual(["Second"]); }); ``` Run `npm run test:focused -- src/dotnet/ManagedManifestPage.probe.test.ts`, then remove the disposable test. To examine the source-established graph consequence, follow the manifest verifier's second-row selection into its member Evidence and graph projection. The compiled full manifest lane was not run. ## Expected behavior For a manifest selecting the second MethodDef row, the selected member result and the graph input should contain that method rather than every method in the assembly. Recorded selection parameters should describe the operation that actually produced the Evidence. ## Actual behavior The focused source test returned ["First","Second","Third"] and failed the Second-only assertion. All three method bodies were present. Source inspection establishes that the verifier records offset 1 and limit 1 on this unsliced result and passes it into graph projection. Its later token lookup finds Second correctly, but leaves the extra methods in the graph input. ## Evidence - Expected source: docs/managed-code-analysis.md:435-449 explicitly promises per-row selection and a graph from the single selected member page. - Failure source: scripts/verify/managed/manifest.mjs:322-328 sends the ignored selection options; src/dotnet/ManagedMemberInspector.ts:154 accepts only typeNames; scripts/verify/managed/manifest.mjs:269-283 records these options and projects the full result. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The focused probe establishes the unsliced result. The graph and Evidence consequence is established from the current source, with manifest identity, body and method-digest validation retained. The inspector's independent resource budgets still apply; this report does not establish unlimited decoding or measure large-assembly costs. ## Restoration check Repeat the three-method selection and observe only Second. An offset-zero control should select only First. With a valid manifest and matching commitments for Second, verify that the graph input excludes First and Third and that recorded parameters accurately describe its selection. Preserve rejection of target identity and method commitment mismatches. ## Runtime or environment Source revision 8b181716aca2cb467be499cba226abfb5ae19141 with locked dependencies, Node.js v26.10.0 and npm 11.19.1. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The manifest verifier breaks its bounded member-selection contract and describes an unapplied selection in Evidence. Wrong method identity was not observed because the subsequent token lookup still finds the declared method. - Workaround status: none - Workaround basis: The manifest entrypoint exposes no alternative setting that turns its requested metadata-row selection into an applied member selection.

bsakaguchi

2026-10-15 18:29:41 +00:00

closed this issue
added the
area: domain

bug
labels

bsakaguchi commented

2026-10-15 18:29:42 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in 9fe54c4073056587d4cdddd4ade06b993dc833d4.

Managed MethodDef row selections honor offset and limit without additive safe-integer overflow. Cross-reference names remain retained independently of requested output rows.

Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit.

Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [9fe54c4073056587d4cdddd4ade06b993dc833d4](https://github.com/morluto/rea/commit/9fe54c4073056587d4cdddd4ade06b993dc833d4). Managed MethodDef row selections honor offset and limit without additive safe-integer overflow. Cross-reference names remain retained independently of requested output rows. Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

bsakaguchi referenced this issue

2026-10-17 21:07:00 +00:00

[PR #933] [MERGED] fix(setup): accept the pinned Hopper RPM launcher #2510

bsakaguchi referenced this issue

2026-10-31 00:48:18 +00:00

[GH-ISSUE #7077] Linux Hopper setup fails for current vendor release: fixed 120 s download deadline exceeded and feed main_exe_hash does not match the published launcher #4266

bsakaguchi referenced this issue

2026-10-31 00:48:19 +00:00

[GH-ISSUE #7077] Linux Hopper setup fails for current vendor release: fixed 120 s download deadline exceeded and feed main_exe_hash does not match the published launcher #4266