Occurrence ${occurrence.id} references missing evidence: ${e

Error message

Occurrence ${occurrence.id} references missing evidence: ${evidenceId}

What it means

parseSecurityScanBundle verifies that every evidenceId referenced by an occurrence exists in the finding's evidence array. A missing reference means an occurrence cites evidence that was never recorded (or was removed), so the bundle fails referential-integrity checks before consumers try to resolve it.

Source

Thrown at packages/coding-agent/src/security/contracts/validation.ts:63

		if (!referencedFindingIds.has(findingId))
			throw new Error(`Security scan omits finding from manifest: ${findingId}`);
	}
	for (const finding of bundle.findings) {
		if (finding.scanId !== bundle.scan.id) {
			throw new Error(`Finding ${finding.id} belongs to ${finding.scanId}, expected ${bundle.scan.id}`);
		}
		const evidenceIds = new Set(finding.evidence.map(evidence => evidence.id));
		if (evidenceIds.size !== finding.evidence.length) {
			throw new Error(`Finding ${finding.id} contains duplicate evidence ids`);
		}
		const occurrenceIds = new Set(finding.occurrences.map(occurrence => occurrence.id));
		if (occurrenceIds.size !== finding.occurrences.length) {
			throw new Error(`Finding ${finding.id} contains duplicate occurrence ids`);
		}
		for (const occurrence of finding.occurrences) {
			for (const evidenceId of occurrence.evidenceIds) {
				if (!evidenceIds.has(evidenceId)) {
					throw new Error(`Occurrence ${occurrence.id} references missing evidence: ${evidenceId}`);
				}
			}
		}
	}
	return bundle;
}

View on GitHub (pinned to 9690622007)

Solutions

Add the missing evidence entry with the referenced id, or remove the stale id from occurrence.evidenceIds.
Re-derive evidenceIds from actual evidence ids programmatically rather than maintaining them by hand.
If importing, fix the importer to only reference evidence it actually emits, and emit evidence for every cited location.
Re-run the scan to produce a self-consistent bundle.

Example fix

// before
occurrence.evidenceIds = [...occurrence.evidenceIds, missingId];
// after
const valid = new Set(finding.evidence.map(e => e.id));
occurrence.evidenceIds = occurrence.evidenceIds.filter(id => valid.has(id));

Defensive patterns

Strategy: validation

Validate before calling

for (const f of bundle.findings) {
  const evidenceIds = new Set(f.evidence.map(e => e.id));
  for (const o of f.occurrences) {
    const missing = o.evidenceIds.filter(id => !evidenceIds.has(id));
    if (missing.length) throw new Error(`occurrence ${o.id} missing evidence: ${missing.join(", ")}`);
  }
}

Type guard

function evidenceReferencesResolve(finding: SecurityFinding): boolean {
  const ids = new Set(finding.evidence.map(e => e.id));
  return finding.occurrences.every(o => o.evidenceIds.every(id => ids.has(id)));
}

Try / catch

try {
  const bundle = importSarif(path);
} catch (err) {
  if (err instanceof Error && err.message.includes("references missing evidence")) {
    // re-import with evidence generation enabled or repair the mapping
  } else throw err;
}

Prevention

Derive occurrence.evidenceIds from the evidence array at build time, never in parallel by hand.
If pruning evidence, cascade the prune to occurrences' evidenceIds in the same pass.
Round-trip validate (parse) every bundle produced by an importer before storing it.

When it happens

Trigger: Loading/importing a bundle where occurrence.evidenceIds contains an id absent from finding.evidence — e.g. evidence entries dropped by an importer filter while occurrences were copied verbatim, or a typo'd/hard-deleted evidence id in a hand-edited bundle.

Common situations: SARIF import where result-to-evidence mapping references locations outside the emitted evidence set; pruning evidence to shrink files without updating occurrences.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/e37f783438f08d6e. Report an issue: GitHub.