Evidence Topic: SuperAgent Manual XML Run Bypassed MCP

Metadata

Date: 2026-07-29
Status: Historical evidence; production requirement superseded by ADR-002
Scope: Manual SuperAgent XML test versus the accepted Web → OSS → Agent → MCP → PostgreSQL flow
Confidence: Fact for the exported run; strong inference for the published-Prompt mismatch
Source: User-exported XML File Analysis (2).md
Last verified: 2026-07-29 19:53 +08:00
Stale trigger: None; retain as historical evidence and interpret through ADR-002

Question

Did the exported SuperAgent run exercise the accepted ARR database-ingestion path?

Requirement Correction

The user confirmed that this Agent is dedicated to a fixed business-system entrypoint whose PROGRAM_INPUT is already constrained in code. Direct SuperAgent chat uploads are outside the production contract. Therefore these logs remain factual execution evidence but do not justify input-validation gates in Main Prompt. ADR-002 is the current authority.

Evidence

The 249-line export covers a manual XML conversation from 19:13:23 to 19:14:37.
The deterministic daily processor succeeded for business date 2026-07-21; it reported 135 source records and 119 retained output rows.
Tool-name counts in the complete export were: read_file=10, present_files=1, fetch_oss_file=0, and arr_submit_processing_result=0.
The export contains no PROGRAM_INPUT, submission_grant, job_id/attempt submission identity, MCP receipt, or enterprise_mcp_transport_unavailable event.
The Agent accepted a chat-uploaded XML, processed a local upload path, and presented generated files. The accepted Main Prompt explicitly rejects chat uploads and forbids present_files on the direct-ingestion path.
The Agent's own reasoning says a “main agent prompt file” at a local user path was inaccessible. This is consistent with a Profile containing a file-path reference or an old prompt rather than the full contents of prompts/arr_opera_daily_main_agent_prompt.md.
A second 95-line export from 19:46 shows the compact Prompt recognized that direct 0722.XML upload lacked PROGRAM_INPUT. It did not call the Skill, fetch_oss_file, arr_submit_processing_result, or present_files.
That run still called read_file once for 20.44 seconds and ask_clarification once before stopping, and it invented the field name fetch_strategy instead of attachment_fetch_policy.
A third 376-line export from 20:22 processed the chat path /mnt/user-data/uploads/0721.XML directly with shell tools and then called present_files. It contained zero fetch_oss_file calls, zero arr_submit_processing_result calls, no submission grant and no committed receipt. The Skill succeeded, but no OSS/MCP/database path ran.
The third run's reasoning still describes the superseded “validate PROGRAM_INPUT” Prompt and its present_files behavior violates the final controlled Prompt. That session therefore does not prove the latest Profile text was saved/published and selected.
The intermediate 3,095-character defensive Prompt was superseded after the user's boundary clarification. The final source is a 1,321-character controlled orchestrator with no duplicated input gates; a regression test caps it below 1,800 characters and preserves one fetch/Skill/MCP plus receipt boundaries. All 12 targeted tests pass. This source change is not evidence that SuperAgent has published it.

Finding

The Skill and its deterministic processor worked, but this run did not fetch the source from ARR-controlled OSS, did not receive an attempt-bound submission grant, did not call ARR MCP, and did not write or prove any database facts. It is a processor-only manual test, not an end-to-end ARR test.

The runs do not prove production Profile correctness because they bypassed the supported entrypoint. A valid E2E must begin with ARR-generated PROGRAM_INPUT and then show fetch_oss_file, the Skill, the MCP submission and a committed database result.

Impact

Do not use manual SuperAgent chat uploads as production acceptance tests.
Paste and publish the final controlled-orchestration Prompt with the MCP tool loaded.
Test through ARR Web so the backend supplies the validated PROGRAM_INPUT and grant.
Accept only committed/already_committed plus matching PostgreSQL facts.

4.3 KiB Raw Blame History