We need to determine whether this completed analysis skipped a required downstream AST consumer. Expected: a valid AST is delivered to each enabled consumer, or the failure identifies the affected input/consumer. Observed: one Failed to deserialize Protobuf message: Protocol message had invalid UTF-8. without file or payload correlation, followed by a successful upload and Quality Gate.
Version/configuration: GitHub ALM, GitHub Actions CI, private repository (no access link supplied); C#, JavaScript/TypeScript, Python and PowerShell. Windows 11 Home build 26200, x64; SonarScanner for .NET 11.3.0, server 8.0.0.109679, SonarJS 14.0.0.46108. Analysis revision 99ee7b7ee82137f205e5ddd8ccdae4939947bef2, CE task AaD8MlT-Ay3xakmEXWQo.
Scanner flow: dotnet sonarscanner begin with project/organization and PR identity, sonar.qualitygate.wait=true, four .NET XML files, one combined JS LCOV, Python Cobertura and PowerShell generic coverage; build/test/collection; dotnet sonarscanner end. Private identity/authentication arguments are omitted here. This describes the actual configuration, not a standalone reproduction of the failure.
All times below are UTC from that same execution, 2026-10-02:
| Event | UTC |
|---|---|
| LCOV import | 10:37:51.1944909 |
| Generic coverage imported for 71 files | 10:37:51.6156471 |
| Invalid UTF-8 AST error | 10:38:16.6015723 |
| 137/137 analyzed; JasminAstConsumer done | 10:38:21.6333988 / 10:38:21.6402325 |
| Report uploaded | 10:39:11.4824520 |
| Quality Gate PASSED | 10:39:26.4571647 |
Source at plugin build 45335eb2d537b26f6497e7eb22ca07e054f63df1 suggests AstProtoUtils.readProtobuf catches InvalidProtocolBufferException and returns null, and WebSensor.acceptAstResponse does not call consumers.accept for a null AST. Metrics/issues are processed separately before this branch; coverage is a separate sensor. We do not infer loss of coverage, nor prove complete downstream security/architecture processing from aggregate counts.
A narrowly scoped synthetic component preflight used the unchanged UTF-8 length/write routine extracted from the version-matching cached plugin bundle. ASCII A, U+00E9 and U+1F600 round-trip through a fatal UTF-8 decoder. An isolated U+D800 produces ED A0 80, rejected by the decoder. Cached JAR SHA256 151150e019176d6e1bcda27174b1cd33a9c17bc7611c8909f2946ff06518c2a4; bundled server SHA256 c163cf7a9bf7331344ba2cfa966af5d4a6b1366d1301ae5c4854a0c6a0291956; extracted routine SHA256 a50a188bd762bb3a04e170221ae92e2c1eb96f2fd8a33dfc85085efee07d3d9b.
This is a codec-component preflight, not an incident reproducer. It does not exercise the full Writer/Buffer/AST path, identify the failed input, or establish the JAR’s runtime hash in that historical execution. An intentional lone-surrogate negative test is only a hypothesis; we have not removed or excluded it. No standalone scanner reproducer has been demonstrated. We will not supply private repository links as reproducible instructions or upload repository archives.
Minimal independent check of the byte rejection (Node.js, no dependencies):
new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.of(0xED, 0xA0, 0x80));
// Throws: invalid UTF-8. This checks bytes only, not SonarJS or the incident.
Later in the same log, JsSecuritySensorV2 reports 77 files for SonarJasmin at 10:38:22.9434848Z and completes at 10:38:48.2402292Z. Architecture JS/TS UDG processing also completes. We do not infer complete per-file AST delivery from those counts.
Questions:
- Can this CE task recover the canonical source identity/hash, failed payload digest/field, loaded codec identity and enabled consumer/accept outcome for the one failed invocation?
- Which enabled consumers and security/architecture checks can be skipped by this exact null-AST branch? Do any still consume an alternate representation for that same input?
- Do the completed rule/metric counts establish the applicable JavaScript security analysis independently of this AST consumer? What retained evidence would prove that distinction?
- If the tuple is not retained, what is the minimum supported acquisition at this boundary for one failed input, without a blanket verbose/scanner rerun?
Attachments: c9-ast-log-excerpt.txt and c9-ast-component-preflight-shareable.json. Both are individually reviewed, with no credential, account email, local installation path, private source, customer data or repository archive. Full private logs and source remain local.
c9-ast-log-excerpt.txt (569 Bytes)
c9-ast-component-preflight-shareable.json (1.4 KB)