# Evidence Topic: SuperAgent Manual XML Run Bypassed MCP

## Metadata

- Date: 2026-07-29
- Status: Historical evidence; production requirement superseded by ADR-002
- Scope: Manual SuperAgent XML test versus the accepted Web → OSS → Agent → MCP → PostgreSQL flow
- Confidence: Fact for the exported run; strong inference for the published-Prompt mismatch
- Source: User-exported `XML File Analysis (2).md`
- Last verified: 2026-07-29 19:53 +08:00
- Stale trigger: None; retain as historical evidence and interpret through ADR-002

## Question

Did the exported SuperAgent run exercise the accepted ARR database-ingestion path?

## Requirement Correction

The user confirmed that this Agent is dedicated to a fixed business-system entrypoint whose PROGRAM_INPUT is
already constrained in code. Direct SuperAgent chat uploads are outside the production contract. Therefore these
logs remain factual execution evidence but do not justify input-validation gates in Main Prompt. ADR-002 is the
current authority.

## Evidence

- The 249-line export covers a manual XML conversation from 19:13:23 to 19:14:37.
- The deterministic daily processor succeeded for business date `2026-07-21`; it reported 135 source records and 119 retained output rows.
- Tool-name counts in the complete export were: `read_file=10`, `present_files=1`, `fetch_oss_file=0`, and `arr_submit_processing_result=0`.
- The export contains no `PROGRAM_INPUT`, `submission_grant`, `job_id`/attempt submission identity, MCP receipt, or `enterprise_mcp_transport_unavailable` event.
- The Agent accepted a chat-uploaded XML, processed a local upload path, and presented generated files. The accepted Main Prompt explicitly rejects chat uploads and forbids `present_files` on the direct-ingestion path.
- The Agent's own reasoning says a “main agent prompt file” at a local user path was inaccessible. This is consistent with a Profile containing a file-path reference or an old prompt rather than the full contents of `prompts/arr_opera_daily_main_agent_prompt.md`.
- A second 95-line export from 19:46 shows the compact Prompt recognized that direct `0722.XML` upload lacked PROGRAM_INPUT. It did not call the Skill, `fetch_oss_file`, `arr_submit_processing_result`, or `present_files`.
- That run still called `read_file` once for 20.44 seconds and `ask_clarification` once before stopping, and it invented the field name `fetch_strategy` instead of `attachment_fetch_policy`.
- A third 376-line export from 20:22 processed the chat path `/mnt/user-data/uploads/0721.XML` directly with shell tools and then called `present_files`. It contained zero `fetch_oss_file` calls, zero `arr_submit_processing_result` calls, no submission grant and no committed receipt. The Skill succeeded, but no OSS/MCP/database path ran.
- The third run's reasoning still describes the superseded “validate PROGRAM_INPUT” Prompt and its `present_files` behavior violates the final controlled Prompt. That session therefore does not prove the latest Profile text was saved/published and selected.
- The intermediate 3,095-character defensive Prompt was superseded after the user's boundary clarification. The final source is a 1,321-character controlled orchestrator with no duplicated input gates; a regression test caps it below 1,800 characters and preserves one fetch/Skill/MCP plus receipt boundaries. All 12 targeted tests pass. This source change is not evidence that SuperAgent has published it.

## Finding

The Skill and its deterministic processor worked, but this run did not fetch the source from ARR-controlled OSS, did not receive an attempt-bound submission grant, did not call ARR MCP, and did not write or prove any database facts. It is a processor-only manual test, not an end-to-end ARR test.

The runs do not prove production Profile correctness because they bypassed the supported entrypoint. A valid E2E
must begin with ARR-generated PROGRAM_INPUT and then show `fetch_oss_file`, the Skill, the MCP submission and a
committed database result.

## Impact

- Do not use manual SuperAgent chat uploads as production acceptance tests.
- Paste and publish the final controlled-orchestration Prompt with the MCP tool loaded.
- Test through ARR Web so the backend supplies the validated PROGRAM_INPUT and grant.
- Accept only `committed`/`already_committed` plus matching PostgreSQL facts.