A secret's redaction spellings include the one a URL's query parser gives
the percent-encoded value (`'` as `%27`), so a saved secret sent in a query
is redacted from captured URLs.
Saved values fill at most 4,000,000 characters into what one step sends,
counted before each fill is built (percent-encoded in a path or goto URL, as
text in a header or JSON body), so a value referenced many times fails the
step instead of multiplying.
A create whose slug the held entities' `&` spellings refuse keeps the
recorded slug, so it now accepts the member slugged only as recorded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep missing or ambiguous scenario request durations unknown, retain learned clock rules, and withhold plans that cannot generate an observed clock. Refuse such writes in older imported states before changing state or generators.
BREAKING CHANGE: The write-plan reason can now be unknown-clock; strict clients must accept the new output value.
Validated state, CLI and advertised MCP workflows, documentation, and focused clock and cleanup regressions.
The collection-paging paragraph says complete Evidence stays accessible through
`get_evidence`, but no tool by that name exists. The session family registers
`get_evidence_bundle`, which is the only name the catalog, the contracts and the
CLI equivalents use.
Every other page already uses the full name, so this was the only place a reader
or agent would look for a tool that cannot be called.
A saving response is decoded as fatal UTF-8 in both the request step and a UI
step's save_response, so a malformed byte fails the step instead of saving
U+FFFD in its place.
A secret save first counts a lower bound on its redaction spellings from the
value alone (it and its longer percent-encoded spelling), and refuses there
when that cannot fit, before any spelling is built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Admit same-major Ghidra releases at or above the verified minor through the existing compatible/unverified policy. Preserve the observed version, verified12.1.4 pin, installation-declared Java floor and separate NativeAOT verification gate.
367 targeted tests/static/docs, all10 real Java bridge-source compilation, and actual Linux12.2/JDK25 CLI/MCP queries and cleanup pass. JDK21 remains refused for12.2. Exact-main controls reproduce all3 unrelated CI assertions; canceled shards and an apt-blocked binary-layout lane remain unverified.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
- A saved number whose JSON spelling names another decimal than the
parsed value, such as `1e-400` (parsed to 0) or `1.0000000000000001`,
fails the step that saves it, checked against the number's source
text through the `JSON.parse` reviver.
- An update plan's slug rule takes the spelling of `&` that the entity's
earlier value and the type's other entities show, as a create's does,
and held entities that spell it both ways leave no slug rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A UI step reads a saved response only once its decoded size is bounded
before reading: the bytes received, or the declared length of one
served from cache, times DEFLATE's 1,032 maximum expansion for gzip or
deflate, must stay within 12,000,000 bytes. Another content coding
(br, zstd) or an unknown size fails the step without reading.
- The saved-value cap counts the redaction spellings a secret save
actually adds, its trimmed spelling included and an already held one
not again, so re-saving the same secret does not grow the total.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Page retained web-bundle endpoint observations and inferences through shared CLI/MCP projections, preserving source identities, scoped unknowns, coverage and complete Evidence access.
Based on HarsH’s original implementation in #7213 (6b1d5d42). Real Chromium/CLI/SDK verification and whole-task cost limits are recorded in docs/verification/web-bundle-paging-2026-10-26.md.
Explicit user authorization permits leaving human-readiness declarations unchecked and bypassing reproduced main failures (ADB listing fixture, package catalog expectation, untouched APK verifier formatting). No human-review attestation is made.
Co-authored-by: HarsH <harshasalkar7@gmail.com>
A scenario keeps at most 4,000,000 characters of saved values at once,
counting the current value of each name and the redaction spellings
secret saves keep, and a save that would exceed it fails its step before
anything is kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A later update whose slug slugs no `&` keeps the plan's `and`
spelling; only a later rule that spells `&` as the word where the plan
drops it is rechecked against earlier calls.
- A later create whose response leaves out a `composed` or `template`
field the plan rebuilds is withheld as `unexplained-change`, since
serving would add the field; an omitted reference still passes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A later update whose slug spells `&` as the word refines a slug rule an
earlier update learned from a name without `&`, as creates do, unless an
accepted call or a held entity dropped it. Every earlier retained update
is rechecked under the refined rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A saved number that is not finite, such as `1e400`, fails the step that
saves it, since a later step would send it as null in JSON and as
Infinity in a path or header.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retain authenticated provider source records independently of snapshot replay eligibility and return them explicitly to plain application callers, including late cancellation. CLI/MCP commit source records before delivering links; function dossiers share the canonical Evidence constructor. Keep directory replies compact and preserve successful retry verification.
Real Ghidra CLI/MCP investigations verify 652-function ls, historical report provenance, cross-session resume, unchanged source/project content and complete offline Evidence. Final full 14,338-function libcrypto comparison matches all metadata/pseudocode facts and independent fresh-import observations: 14,194 written, 143 external, one recorded deadline; 494.03 s, 445.63 CPU s, 1.584 GiB sampled family peak under 2-CPU/8-GiB guards, with no OOM or cleanup failure.
144 focused tests and static/docs/site checks pass; latest-main integration passes 289 cases plus typecheck/lint and actual CLI snapshot source retrieval. Final CI source/static/build/docs/quality/package checks pass. Four ADB shard failures also occur in main CI 40349559391; cancelled coverage remains unverified and author declarations stay unchecked under the user's explicit bypass authorization. No human-review attestation is made.
Distinguish local provider readiness failures from target-support refusals in shared CLI/MCP diagnostics, preserving original codes and evidence. Avoid claiming configured providers are unconfigured.
120 focused tests, static/docs checks and real ELF CLI/MCP verification pass. Hosted CI has the same four ADB failures as exact main d9908fd7a; three canceled shards remain unverified. Merge uses the user's explicit authorization to bypass proven main failures. Fresh Codex and Greptile reviews are clear.
Fixes#7214
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Each filled path segment is checked after substitution, so a saved `.`
that a literal dot or `%2e` beside it turns into `..` fails the step in a
request path and a goto URL, before URL parsing drops it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Each read of a saved response (the wait, sizes() and text()) races the
step's deadline and abort signal, so a body still arriving when the
step times out or is cancelled saves nothing, and the watcher detaches
at once.
- A UI step keeps the 4,000,000-character cap and refuses before reading
only a response received as more than 12,000,000 bytes, three per
character; the decoded text is then held to the character cap.
- A Basic username with a colon fails the step before anything is sent.
- A saved `.` or `..` that fills a whole URL path segment fails the
step, since the URL would drop it.
- Held entities that spell `&` both ways leave a create without `&` no
slug rule.
- The saved-values example in the browser scenario contract is a whole
scenario, as the catalog test reads every documented example.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Require operator-declared hostnames before serving MCP HTTP outside loopback, preserving Host/Origin gates. Parse hostname identities once, share typed startup recovery across CLI/MCP, and announce an admitted client URL. Generated AgentEnv bundles declare their client/service names and validate DNS/HTTP name identity before export.
Validated through real packaged HTTP requests, direct SDK connection, compiled export refusals, 184 focused tests, static and documentation checks on the refreshed main integration. Final CI and review evidence is recorded in the PR body.
BREAKING CHANGE: non-loopback deployments require MCP_ALLOWED_HOSTS or rea mcp --http --allowed-hosts; bundle names must be unchanged HTTP hostnames within the 63-octet DNS label bound.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
- a saved integer past 2^53, which JSON parsing would round to another id,
fails the step that saves it
- request paths and JSON strings read only `{saved:name}` as written; the
percent-encoded spelling is read only in a goto URL, whose parsed form
spells braces that way
- a held slug that neither `&` spelling gives counts as unknown: a create
whose slug spells `&` learns no slug rule beside it, and no later create
widens the spelling
- `save_response.path` takes the request path's portable pattern, shared as
START_ORIGIN_PATH, so JSON Schema clients compiling it with the `v` flag
read it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reuse selected Ghidra projects through verified private read-only copies, with shared CLI/MCP configuration, committed project identity, import-SHA verification and explicit historical/unknown analysis semantics. Preserve exact cancellation and platform capability boundaries.
Actual Ghidra 12.1.4/JDK21 Linux CLI/MCP investigations matched fresh import on 652-function ls and 14,338-function libcrypto inventories and pseudocode; authenticated complete Evidence, mismatch/staleness refusal, saved historical reports and shared /tmp projects verified. 958 focused tests passed with four platform skips; build/static/docs/format passed. Real macOS/Windows reuse remains unverified; Windows reuse is unavailable. See PR verification for measured whole-task costs and final CI attribution.
Co-authored-by: akushonkamen <akushonkamen@163.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Preserve XML, OpenStep and binary dictionary keys at their format owners. Share validated binary reference facts with materialization while retaining scalar precision, UID identity and bounded expansion. Migrate archive, Interface Builder, native and app-bundle consumers, then remove obsolete key-omission accounting and schema copies.
Validated source regressions and compiled CLI/MCP workflows, including native plist fidelity and archive identity. Typecheck, lint, docs and test discovery pass. No performance benchmarks were required.
Preserve observed failed-response HTTP status through Linux Hopper setup diagnostics without changing download rejection, retry, or installation policy. Independently validated on latest main through red/green regressions, actual TLS sockets, focused checks and CI. Closes#7182.
Keep binary_session available when Linux owned-child probes lack procps ps. Preserve typed ownership-prerequisite failures in direct execution and report per-provider readiness in status. Independently validated on latest main through real stdio MCP plus focused regression, static and documentation checks. Closes#7164.
Upgrade Zod to 4.6.6 and refresh locked license inventories. Preserve REA's established timestamp spellings through one shared UTC/offset grammar, including completion-verifier consumers. Size the stdin resource regression from the child's actual heap capacity.
Fixes#7173
Includes the dependency and inventory changes proposed in #7184.
Co-authored-by: tijo95 <georgesarmede@gmail.com>
Scope MCP discovery, setup, doctor, status and recovery guidance by selected tool families using one contract inventory and shared catalog identity. Preserve default discovery, canonical validation and complete Evidence.
Fixes#3246. Builds on #3026. Real libcrypto workflow verifies all 5,367 exports and identical complete Evidence. Static/source/build/docs/Windows/package/Greptile checks pass; ten assertions reproduced identically on clean main and feature across Node 24/22, with cancelled coverage explicitly unverified. Merge uses the user-authorized bypass for baseline failures and unchecked human-readiness declarations, without attesting human review.
Co-authored-by: 0xLLVEL <fakhrezan1@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add opt-in bounded output-schema advertisements while preserving the full default, canonical server validation and complete structured content. Verify real stdio discovery under a 1 MiB receive cap, all 5,367 libcrypto export coordinates, complete Evidence parity, whole-task serialization estimates and resource bounds.
Fixes#2512. Integrates #7054 by Akshad Jogi with original authorship retained.
Co-authored-by: Akshad Jogi <akshadjogi@gmail.com>
- Basic credentials and values saved with `secret: true` are redacted however
short, as declared secrets are; page values keep the 8-character floor
- a literal Basic password other than empty is refused, since Evidence
records literals as written
- `save_response` takes only a request the step starts, so an earlier
autosave cannot answer it, matches its path as the browser spells it, and
stops watching requests when the step ends
- saving reads are bounded: a request step streams its answer up to
4,000,000 characters; a UI step refuses a larger received size unread
- goto placeholders fill the destination URL before structured query values
join it
- reading a composed string stops at the reading cap before comparing or
allocating more
- a slug's `&` spelling follows every create the plan accepted and every held
entity; direct slug rules and composed strings take it from held entities
when the create slugs none, and a slug rule they contradict is not learned
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The skill asks agents to delete what an earlier attempt created before
recording again, since the environment holds a leftover as seeded data
(EspoCRM's fresh run). The spec and verification record the write-model
fixes, the same recordings rebuilt before and after them, and a fresh
recording of every application.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Recording through the UI let Grafana generate folder uids, and three write
model gaps then served folders whose address kept the first folder's slug:
- a template around a generated value won over a composed string that also
reads the title's slug; the composed string now wins when it reads a field
besides the template's value
- later creates checked composed strings against their own answers, but not
templates, so coverage served a template a later folder contradicted; a
template is now checked the same way
- a slug dropped `&`, which Grafana's Go slugs spell as the word; a slug rule
or part learns `ampersand: "and"` from the call that shows it, and calls
that slugged no `&` agree with either spelling
An address whose uid equals its title's slug could come from either field.
The entities the type holds now pick the one reading they share, and when
they cannot, a later create that tells the fields apart lends its composed
rule to the first create, whose body contract is learned again with it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Outcome, plan, tasks and verification for saved values, save_response
and Basic credentials, with the agent-built comparison against main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Allow native matching representation budgets to be selected at runtime or launch while retaining the 96 MiB default and main shared-provenance accounting. Preserve actionable configuration recovery through the setting owner and verify complete CLI/MCP matches for 20k/50k synthetic inventories and real stripped LLVM 14/15 inventories.
Fixes#6406.
Based on #7112 by Kaoru0822; original authorship and co-author credit retained.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Edgar Arakelyan