[PR #74] [MERGED] Add Evidence v2 and deterministic process investigations #1813

New issue

Closed

opened 2026-10-16 21:11:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:11:17 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/74
Author: @morluto
Created: 7/12/2026
Status: ✅ Merged
Merged: 7/12/2026
Merged by: @morluto

Base: main ← Head: morl/evidence-v2-process-fidelity

📝 Commits (1)

cc8681a feat: add evidence-backed process investigations

📊 Changes

53 files changed (+2774 additions, -290 deletions)

View changed files

📝 .github/workflows/ci.yml (+9 -8)
📝 .github/workflows/release.yml (+1 -1)
➕ .npmrc (+1 -0)
➕ .nvmrc (+1 -0)
📝 CONTRIBUTING.md (+2 -1)
📝 README.md (+59 -20)
📝 README_ar.md (+6 -6)
📝 README_ja.md (+6 -6)
📝 README_ko.md (+6 -6)
📝 README_zh.md (+6 -6)
📝 bridge/hopper_bridge.py (+112 -32)
📝 package-lock.json (+68 -4)
📝 package.json (+16 -5)
📝 scripts/rea.mjs (+1 -1)
➕ scripts/rebuild-native.mjs (+22 -0)
📝 scripts/verify-package.mjs (+3 -3)
📝 scripts/verify-real-hopper.mjs (+25 -37)
📝 src/application/AnalysisProvider.ts (+22 -1)
📝 src/application/BinarySession.ts (+35 -0)
📝 src/application/DirectAnalysis.ts (+1 -1)

...and 33 more files

📄 Description

Summary

replace the provider-specific evidence envelope with deterministic, provider-neutral Evidence v2 records and a bounded session ledger
add evidence bundle import/export with semantic ID recomputation, tamper rejection, atomic merges, and path-independent deduplication
complete Hopper function dossiers with typed callers and callees, comments, references, strings, names, CFG successors, independent continuation offsets, and strict boundary parsing
add approval-gated PTY/process/filesystem capture with loopback HTTP and WebSocket replay, normalization, secret redaction, and capture comparison
expand the public CLI/MCP inventory to 50 exact contracts and reposition REA as an agent-first reverse-engineering toolkit with Hopper as its first provider
pin Node 24.18.0 and npm 11.16.0, approve only the node-pty lifecycle scripts, and provide a native rebuild command

Contract changes

Evidence v2 is an intentional breaking change. Evidence v1 compatibility is not retained.

The MCP surface now contains 33 direct analysis tools, 10 investigation workflows, and 7 workspace/session tools. New session tools are export_evidence_bundle, import_evidence_bundle, capture_process_scenario, and compare_process_captures.

Dynamic process capture is disabled by default. It requires operator-configured executable, working-directory, and environment allowlists plus approved: true on each call.

Verification

npm run check — 155 tests passed
npm run lint:dead — no unused-code findings
npm run verify:package — packaged CLI and target-free 50-tool MCP server passed
npm run verify:fixtures — seven source-built conformance fixtures passed
npm run verify:hopper with /bin/ls and /usr/bin/true — real Hopper decompilation, dossier analysis, target switching, and clean shutdown passed
Node 24.18.0 native rebuild and live node-pty capture test passed on macOS arm64
pre-commit Prettier, oxlint fixes, and TypeScript typecheck passed

Current limitations

process capture is an observation harness, not an operating-system security sandbox; loopback replay is bounded, but the target is not technically prevented from making unrelated external network connections
process trees are sampled and filesystem behavior uses before/after snapshots, so short-lived descendants and transient filesystem operations may remain unknown
Hopper remains the only full static-analysis provider in this PR; additional providers stay behind the provider/evidence conformance roadmap
node-pty may require npm run rebuild:native when its packaged native binary is incompatible with the host; source builds require the platform compiler toolchain

Real Hopper

Real Hopper verification was performed against two distinct Mach-O binaries. The verifier required nonempty pseudocode, a semantically valid function dossier, a successful target switch, and clean bridge shutdown.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/74 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/12/2026 **Status:** ✅ Merged **Merged:** 7/12/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `morl/evidence-v2-process-fidelity` --- ### 📝 Commits (1) - [`cc8681a`](https://github.com/morluto/rea/commit/cc8681a856dacb296f835112d0a27133d4c05ad1) feat: add evidence-backed process investigations ### 📊 Changes **53 files changed** (+2774 additions, -290 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+9 -8) 📝 `.github/workflows/release.yml` (+1 -1) ➕ `.npmrc` (+1 -0) ➕ `.nvmrc` (+1 -0) 📝 `CONTRIBUTING.md` (+2 -1) 📝 `README.md` (+59 -20) 📝 `README_ar.md` (+6 -6) 📝 `README_ja.md` (+6 -6) 📝 `README_ko.md` (+6 -6) 📝 `README_zh.md` (+6 -6) 📝 `bridge/hopper_bridge.py` (+112 -32) 📝 `package-lock.json` (+68 -4) 📝 `package.json` (+16 -5) 📝 `scripts/rea.mjs` (+1 -1) ➕ `scripts/rebuild-native.mjs` (+22 -0) 📝 `scripts/verify-package.mjs` (+3 -3) 📝 `scripts/verify-real-hopper.mjs` (+25 -37) 📝 `src/application/AnalysisProvider.ts` (+22 -1) 📝 `src/application/BinarySession.ts` (+35 -0) 📝 `src/application/DirectAnalysis.ts` (+1 -1) _...and 33 more files_ </details> ### 📄 Description ## Summary - replace the provider-specific evidence envelope with deterministic, provider-neutral Evidence v2 records and a bounded session ledger - add evidence bundle import/export with semantic ID recomputation, tamper rejection, atomic merges, and path-independent deduplication - complete Hopper function dossiers with typed callers and callees, comments, references, strings, names, CFG successors, independent continuation offsets, and strict boundary parsing - add approval-gated PTY/process/filesystem capture with loopback HTTP and WebSocket replay, normalization, secret redaction, and capture comparison - expand the public CLI/MCP inventory to 50 exact contracts and reposition REA as an agent-first reverse-engineering toolkit with Hopper as its first provider - pin Node 24.18.0 and npm 11.16.0, approve only the node-pty lifecycle scripts, and provide a native rebuild command ## Contract changes Evidence v2 is an intentional breaking change. Evidence v1 compatibility is not retained. The MCP surface now contains 33 direct analysis tools, 10 investigation workflows, and 7 workspace/session tools. New session tools are export_evidence_bundle, import_evidence_bundle, capture_process_scenario, and compare_process_captures. Dynamic process capture is disabled by default. It requires operator-configured executable, working-directory, and environment allowlists plus approved: true on each call. ## Verification - npm run check — 155 tests passed - npm run lint:dead — no unused-code findings - npm run verify:package — packaged CLI and target-free 50-tool MCP server passed - npm run verify:fixtures — seven source-built conformance fixtures passed - npm run verify:hopper with /bin/ls and /usr/bin/true — real Hopper decompilation, dossier analysis, target switching, and clean shutdown passed - Node 24.18.0 native rebuild and live node-pty capture test passed on macOS arm64 - pre-commit Prettier, oxlint fixes, and TypeScript typecheck passed ## Current limitations - process capture is an observation harness, not an operating-system security sandbox; loopback replay is bounded, but the target is not technically prevented from making unrelated external network connections - process trees are sampled and filesystem behavior uses before/after snapshots, so short-lived descendants and transient filesystem operations may remain unknown - Hopper remains the only full static-analysis provider in this PR; additional providers stay behind the provider/evidence conformance roadmap - node-pty may require npm run rebuild:native when its packaged native binary is incompatible with the host; source builds require the platform compiler toolchain ## Real Hopper Real Hopper verification was performed against two distinct Mach-O binaries. The verifier required nonempty pseudocode, a semantically valid function dossier, a successful target switch, and clean bridge shutdown. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:11:17 +00:00