{"record":{"id":"6c1906b2cc720313","repo":"affaan-m/ECC","slug":"kind-references-exceed-bounded-limits","errorCode":null,"errorMessage":"{kind} references exceed bounded limits","messagePattern":"(.+?) references exceed bounded limits","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ecc2/src/harness_eval.rs","lineNumber":264,"sourceCode":"            self.evidence_refs.clone(),\n        )?\n        .id)\n    }\n}\n\n#[derive(Serialize)]\nstruct CanonicalCandidateArtifact<'a> {\n    config: Value,\n    trace_refs: &'a [String],\n    evidence_refs: &'a [String],\n}\n\nfn normalize_refs(kind: &str, refs: Vec<String>) -> Result<Vec<String>> {\n    if refs.is_empty() || refs.iter().any(|reference| reference.trim().is_empty()) {\n        bail!(\"at least one non-empty {kind} reference is required\");\n    }\n    if refs.len() > 100 || refs.iter().any(|reference| reference.len() > 4096) {\n        bail!(\"{kind} references exceed bounded limits\");\n    }\n    let mut normalized = refs\n        .into_iter()\n        .map(|reference| reference.trim().to_string())\n        .collect::<Vec<_>>();\n    normalized.sort();\n    normalized.dedup();\n    Ok(normalized)\n}\n\nfn sha256_hex(bytes: &[u8]) -> String {\n    Sha256::digest(bytes)\n        .iter()\n        .map(|byte| format!(\"{byte:02x}\"))\n        .collect()\n}\n\nfn canonicalize(value: Value) -> Value {","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/affaan-m/ECC/blob/8321021c54d670126ce3b2969d5deb880b4b0c2a/ecc2/src/harness_eval.rs#L246-L282","documentation":"normalize_refs enforces bounded limits on trace_refs/evidence_refs: at most 100 references total, and each reference at most 4096 bytes. This protects the content-addressed candidate id from unbounded growth. Exceeding either bound throws this error with {kind} naming the offending parameter.","triggerScenarios":"HarnessCandidate::new called with more than 100 entries in trace_refs or evidence_refs; any single reference string longer than 4096 bytes (e.g. an embedded blob or a very long path/URL).","commonSituations":"Accidentally passing all historical traces instead of the current batch; a ref string that accidentally embeds a whole JSON payload or a data: URI; concatenating ref lists from multiple runs without deduplication.","solutions":["Deduplicate and trim the refs list, then cap it at 100 entries before calling new.","Shorten each reference to a stable short form (commit sha, artifact id, or relative path) instead of a full URL/blob.","Batch large evidence sets into multiple candidates, each with its own bounded refs list.","Add a pre-call assertion so oversized input fails at the producer with a clear message."],"exampleFix":"// before\nlet candidate = HarnessCandidate::new(all_traces /* 3,000 entries */, evidence_refs)?;\n\n// after\nlet mut trace_refs: Vec<&String> = all_traces.iter().collect();\ntrace_refs.sort();\ntrace_refs.dedup();\nlet trace_refs: Vec<String> = trace_refs.into_iter().take(100).cloned().collect();\nlet candidate = HarnessCandidate::new(trace_refs, evidence_refs)?;","handlingStrategy":"validation","validationCode":"fn refs_within_bounds(refs: &[String]) -> bool {\n    refs.len() <= 100 && refs.iter().all(|r| r.len() <= 4096)\n}","typeGuard":"fn bounded_refs(refs: Vec<String>, max: usize) -> Result<Vec<String>, String> {\n    if refs.len() > max || refs.iter().any(|r| r.len() > 4096) {\n        return Err(\"refs exceed bounded limits\".into());\n    }\n    Ok(refs)\n}","tryCatchPattern":"match HarnessCandidate::new(trace_refs, evidence_refs) {\n    Ok(c) => proceed(c),\n    Err(e) if e.to_string().contains(\"bounded limits\") => proceed(batch_into_multiple_candidates(trace_refs, evidence_refs)?),\n    Err(e) => return Err(e),\n}","preventionTips":["Deduplicate and sort-dedup ref lists before submission to stay under 100 entries.","Use short stable identifiers (sha, artifact id) as refs, never URLs or embedded payloads.","Split oversized evidence sets into multiple candidates at the producer."],"tags":["validation","limits","arguments"],"backgroundTag":"value-out-of-range","analyzedSha":"8321021c54d670126ce3b2969d5deb880b4b0c2a","analyzedAt":"2026-09-16T10:08:13.343Z","contentChangedAt":"2026-09-16T10:08:13.343Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}