A four-line patch fixes a large semantic leak.
REA revision 8fc2043eb8bcedbf34dce064f977e455438635d6 changes one production line and adds three test lines. When an MCP operation fails after producing a retained partial observation, the delivery path now receives the tool contract's returnsTargetContent flag.[1]
The test covers cancellation and cleanup failure. In both cases the response remains an error, the completed evidence remains available by ID, and the MCP metadata marks the content as untrusted with source analysis_target.[1]
The valuable fix is not keeping more data. It is keeping the right warning attached to that data.
Run status and evidence status are different fields.
A cleanup failure can happen after useful packets, instructions, or runtime events were collected. Calling the whole run successful hides the cleanup problem. Calling the whole record empty destroys observations that may explain the problem.
Use two statements. First, state whether the operation completed. Second, state what evidence was retained and which limits apply. A retained record can be complete for one bounded observation while the surrounding operation still failed.
OPERATION_STATUS=CANCELLED | CLEANUP_FAILED | COMPLETE
RETAINED_EVIDENCE_ID=[REQUIRED_IF_PRESENT]
TARGET_CONTENT=UNTRUSTED
SOURCE=ANALYSIS_TARGET
LIMITS_AND_UNKNOWN=[REQUIRED]
REVIEW_STATUS=[REQUIRED]Origin labels need to survive the unhappy path.
Target-derived text can contain misleading names, crafted strings, hostile markup, or prompt-like instructions. The source label is part of the evidence contract. It must not disappear because the transport chose an error envelope.
REA's evidence guide already separates operation data, limitations, coverage, unknowns, and stable evidence IDs. It also states that incomplete source evidence cannot prove absence. The latest patch closes one delivery gap for retained error results.[2]
A capture is still not a cage.
REA's process-capture guide says the selected command runs with the current user's permissions. Observation paths choose what gets recorded. They do not restrict what the process can read or write. The inherited environment can affect the run without being recorded.[3]
That warning belongs beside every retained result from a failed runtime operation. Evidence custody does not create isolation. Use a separate sandbox, narrow account, network rule, and cleanup check when the target is untrusted.
Review techniques with their limits attached.
NIST SP 800-115 describes security testing as a planned process that includes analysis and mitigation. It also asks readers to account for the benefits and limitations of each technique. It does not claim to define a complete testing program.[4]
That is the right shape for agent-assisted analysis. Preserve the observation. Preserve the failure. Preserve target origin. Then name the next independent check before anyone acts on the finding.