🐛 - Bugbot false positive treats JsonDocument.decode object as text and suggests a breaking cast #855

Is there an existing issue for this?

• I searched existing issues for the exact finding ID; no matching report was returned.

Which actions are affected?

Pull Request

Which platforms are affected?

Linux (hosted review); macOS (independent unchanged-source reproduction)

Description

Native Bugbot publishes a high-confidence false positive by treating a project JsonDocument.decode() return value as JSON text instead of the decoded object. The proposed automatic suggestion breaks the working codec.

Consumer: vypdev/domus PR22, exact head 19ff35cb2cb2ceb4a0397901341f1089001cc619.
Finding: relative source cycle cannot be decoded.
Finding ID: sqlite_relative_recurrence_records.py:181:cycle-json-string-double-encoded.
Category correctness, severity medium, confidence99%.

The report states that cycle_document(...).decode() stores a string and that JsonDocument.from_value(row["cycle"]).encoded therefore double-encodes it. This premise is false at the reviewed source:

• JsonDocument.decode, line80 returns JsonObject, implemented as cast(JsonObject, json.loads(self.encoded)).
• cycle_document, line211 returns JsonDocument.from_value({...}), a versioned object.
• _source_value embeds that decoded object.
• _source, line181 correctly serializes the nested object once for the task codec, which expects text.

Runtime inspection confirms type(document.decode()["source"]["cycle"]) is dict, not str. All four combinations of date/instant and ordinary/restricted normalized completion source round-trip unchanged. The existing actual SQLite source-cycle and full checkpoint/restore controls also pass.

Bugbot suggests read_cycle(cast(str, row["cycle"])). A Python type cast does not convert the dictionary into JSON text. Applying exactly that one-expression mutation in an isolated in-memory copy of the reviewed module causes all four previously passing variants to fail with StorageFailure("invalid_recurrence_record"). Production source bytes remain unchanged.

Expected: resolve the callee return contract and nested JSON value before publishing a double-encoding finding; validate that the proposed expression accepts the actual runtime value. Do not suggest replacing a correct object-to-text boundary with an unchecked type cast.

Actual: one false finding is published and blocks the consumer's no-open-findings merge policy, despite existing regression evidence and the reviewed return contract. We are retaining full issue20 scope and will not apply a harmful suggestion to clear the check.

Reproducing the issue

Check out the exact Domus head above with its locked dependencies. Existing regressions:

uv run pytest tests/backend/test_sqlite_relative_recurrence_records.py::test_relative_records_preserve_full_original_initial_and_successor_facts tests/backend/test_sqlite_relative_integrity.py::test_actual_source_cycle_survives_approval_and_closure_without_rewriting_slot_facts tests/backend/test_sqlite_relative_integrity.py::test_real_restore_retains_a_generated_successor_proof_without_recreating_its_task --no-cov

Result on unchanged source:6 passed. These cover four normalized source round-trips, actual source persistence after approval/closure and actual generated-successor restoration with checkpoint verification.

Small executable shape and counterfactual control from the repository root:

import sys
from pathlib import Path
from types import ModuleType

sys.path.insert(0, str(Path("tests/backend").resolve()))
from test_relative_recurrence_records import values
from domus.domain.errors import StorageFailure
from domus.infrastructure.sqlite_relative_recurrence_records import (
    relative_slot_document, read_relative_slot,
)

source = Path("backend/src/domus/infrastructure/sqlite_relative_recurrence_records.py").read_text()
needle = 'read_cycle(JsonDocument.from_value(row["cycle"]).encoded)'
assert source.count(needle) == 1
counterfactual = ModuleType("private_review_suggestion")
exec(compile(source.replace(needle, 'read_cycle(cast(str, row["cycle"]))'),
             "<review-suggestion-only>", "exec"), counterfactual.__dict__)
for timed in (False, True):
    for restricted in (False, True):
        _, _, slot, _ = values(timed, restricted=restricted)
        document = relative_slot_document(slot)
        assert type(document.decode()["source"]["cycle"]) is dict
        assert read_relative_slot(document.encoded) == slot
        try:
            counterfactual.read_relative_slot(document.encoded)
        except StorageFailure as error:
            assert str(error) == "invalid_recurrence_record"
        else:
            raise AssertionError("The proposed mutation unexpectedly passed")

The privately retained reproduction additionally compares every tested module byte with the exact published Git source and verifies no production mutation. Reviewed codec SHA256: adf60c10b464451f05c0f36fd6ae915fd0c773578f4b99908fa15baae43e5e54.

copilot Version

Released vypdev/copilot@v3, resolved pin 3e7ceea08e6131360e026937d1c0cc1b120472e0; native provider codex, model gpt-6-luna, effort smart. No Copilot source, credential, setting, bound or evidence scope was changed.

Relevant Log Output

• Native PR run41442811542/job125268584741.
• Review check125270397194; exact head19ff35cb2cb2ceb4a0397901341f1089001cc619.
• All14/14 code partitions completed,128 diff fragments,102 assigned files.
• candidateFindings=1, publishedFindings=1, open=1, fixed=6, reopened/dismissed/unknown/verification-required=0.
• All six earlier valid consumer findings remain fixed; this report does not invalidate those findings.
• Full local backend:3987 passed,100% supported statement/branch coverage globally and per136 authored modules. Independent coverage audit, strict types and all3 Clean Architecture contracts pass.
• Every applicable current-head productCI suite now passes, including backend125268583180, frontend125268583381, actual amd64/aarch64 images125268583406/125268583447 and aggregate125271140255 in run41442811569.
• Unchanged-source targeted reproduction:6 passed in0.51s; four current object-shape/round-trip controls pass and four exact suggested mutations fail.

Additional context and comments

Native review is separately partial because human-conversation preflight reports8 fetched,6 retained,2 omitted,0 truncated,limitReached=true. Other dimensions separately complete: issue6/6, PR12/12, threads6/6,diff102/102. Telemetry does not identify omitted items or establish absence across every prompt section. Existing human-context accounting is tracked in #843; independent complete-comparison capacity is tracked in #851. This issue concerns the demonstrably wrong return-type premise and harmful suggestion, not either budget limitation.

Please reproduce on exact source and investigate call/return-contract verification and suggestion validation. No production fix or Copilot change has been made to accommodate the finding. The consumer continues authorized implementation; full recurrence and product acceptance remain outstanding.

Consumer disposition: the unchanged-source reproduction and this report are linked in vypdev/domus#22 (comment) . The thread was manually resolved as a false positive after that evidence was posted. Initial native telemetry still records open=1; this is not a native-confirmed code fix, a production patch or evidence of completed feature scope. Please correct the upstream analysis/suggestion behavior.

Follow-up on the next normal consumer feature revisioned7cd14190d750846833cf1bb822988b628560da: native PR run41445912711/job125278815180 / Review125280665009 completes15/15 partitions,133 fragments and105 files with0 candidate/published/open/reopened findings,6 fixed and1 dismissed. The dismissal corresponds to this manually resolved, reproduced false positive; the prior6 valid product fixes remain fixed. The relative codec, task codec and JsonDocument modules are byte-identical to19ff (including codec SHA256adf60c10b464451f05c0f36fd6ae915fd0c773578f4b99908fa15baae43e5e54). No harmful suggestion or production workaround was applied, and this disposition does not prove that upstream return-contract analysis is corrected.

Every applicable current-head productCI suite passes, including both actual CPU images (run41445912990,aggregate125281291351). Full local4031 backend tests/100% supported global and per137-module coverage pass. Human context remains separately partial9 fetched/7 retained/2 omitted/0 truncated/limitReached, while other dimensions complete. No Copilot modification, scope reduction or unchanged-input retry was used; full retained product implementation continues.