[PR #79] [MERGED] Add evidence-backed investigation workflows #1817

New issue

Closed

opened 2026-10-16 21:11:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:11:20 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/79
Author: @morluto
Created: 7/12/2026
Status: ✅ Merged
Merged: 7/12/2026
Merged by: @morluto

Base: main ← Head: morl/roadmap-investigation-core

📝 Commits (9)

4ff4c11 Add evidence-backed investigation workflows
567ddc3 Refresh completion metadata
77278e5 Align completion metadata with the canonical skill
7a964be Refresh canonical skill hash
329477e Merge remote-tracking branch 'origin/main' into morl/roadmap-investigation-core
babe8b9 Refresh metadata after main merge
77db2ec Document the 68-tool contract
fbe8ec1 Expose historical source import through CLI
293cea7 Simplify and harden investigation workflows

📊 Changes

183 files changed (+26045 additions, -1276 deletions)

View changed files

📝 README.md (+54 -11)
📝 README_ar.md (+7 -5)
📝 README_ja.md (+10 -8)
📝 README_ko.md (+10 -8)
📝 README_zh.md (+10 -8)
📝 bridge/hopper_bridge.py (+141 -13)
📝 package-lock.json (+1146 -70)
📝 package.json (+13 -0)
📝 scripts/rea.mjs (+1 -1)
📝 scripts/verify-package.mjs (+182 -46)
📝 scripts/verify-real-hopper.mjs (+182 -147)
📝 skills/rea-analysis/SKILL.md (+75 -0)
📝 src/application/AnalysisProvider.ts (+68 -10)
➕ src/application/ArtifactExtraction.ts (+316 -0)
➕ src/application/ArtifactGraphConstruction.ts (+359 -0)
➕ src/application/ArtifactInventory.ts (+415 -0)
📝 src/application/BinarySession.ts (+277 -21)
➕ src/application/CompositeProvider.ts (+96 -0)
📝 src/application/DirectAnalysis.ts (+52 -12)
📝 src/application/EnhancedTools.ts (+25 -10)

...and 80 more files

📄 Description

TL;DR

Implements the evidence-backed roadmap foundation and hardens issue #37: provider-neutral analysis, native/artifact inspection, bounded process fidelity, evidence bundles and residual unknowns, comparisons, call-path/static-runtime correlation, reconstruction verification, and a policy-gated historical source import CLI for #66.

Closes #32.
Addresses #37.
Closes #66.

Review order

Provider, Evidence v2, and bounded adapters.
Artifact/native/process capture surfaces.
Comparison and investigation workflows.
Historical source graph/import security boundaries.
Tests and completion metadata.

Safety and compatibility

Preserves the documented 68-tool inventory.
Parses unknown data at boundaries and uses tagged Result failures.
No source execution or network access in reference import.
Uses Babel, ignore, isomorphic-git, graphology, official ASAR, and zip.js instead of hand-rolled equivalents.
Filesystem traversal is bounded and symlink-safe; process ownership is token-validated.

Verification

npm run check (289 tests)
npm run knip
npm run jscpd
npm run scan:todos
npm run verify:package (68 tools)

Real Hopper verification was not run because this environment is Linux and Hopper is macOS-only.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/79 **Author:** [@morluto](https://github.com/morluto) **Created:** 7/12/2026 **Status:** ✅ Merged **Merged:** 7/12/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `morl/roadmap-investigation-core` --- ### 📝 Commits (9) - [`4ff4c11`](https://github.com/morluto/rea/commit/4ff4c11a00c4ed32618d51e22dd176a646035a87) Add evidence-backed investigation workflows - [`567ddc3`](https://github.com/morluto/rea/commit/567ddc3f4d02e283bb62f2e3a52b1232f4be4a66) Refresh completion metadata - [`77278e5`](https://github.com/morluto/rea/commit/77278e5e56f7f5b68839abe0846cbba373f6d7ed) Align completion metadata with the canonical skill - [`7a964be`](https://github.com/morluto/rea/commit/7a964bee64cfc1221d2edf7bf20832b359bb35d0) Refresh canonical skill hash - [`329477e`](https://github.com/morluto/rea/commit/329477e4bc678fbc90acd56b89047be40c5cd15d) Merge remote-tracking branch 'origin/main' into morl/roadmap-investigation-core - [`babe8b9`](https://github.com/morluto/rea/commit/babe8b9e3be152d1b58bfa899505c35fd67df043) Refresh metadata after main merge - [`77db2ec`](https://github.com/morluto/rea/commit/77db2ecc1c812a0f814135afceaeb0e99a9053ce) Document the 68-tool contract - [`fbe8ec1`](https://github.com/morluto/rea/commit/fbe8ec1f13f864c46f75c30cc4c5b41dd754eefe) Expose historical source import through CLI - [`293cea7`](https://github.com/morluto/rea/commit/293cea772334724275185918fdfb96ec012e2688) Simplify and harden investigation workflows ### 📊 Changes **183 files changed** (+26045 additions, -1276 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+54 -11) 📝 `README_ar.md` (+7 -5) 📝 `README_ja.md` (+10 -8) 📝 `README_ko.md` (+10 -8) 📝 `README_zh.md` (+10 -8) 📝 `bridge/hopper_bridge.py` (+141 -13) 📝 `package-lock.json` (+1146 -70) 📝 `package.json` (+13 -0) 📝 `scripts/rea.mjs` (+1 -1) 📝 `scripts/verify-package.mjs` (+182 -46) 📝 `scripts/verify-real-hopper.mjs` (+182 -147) 📝 `skills/rea-analysis/SKILL.md` (+75 -0) 📝 `src/application/AnalysisProvider.ts` (+68 -10) ➕ `src/application/ArtifactExtraction.ts` (+316 -0) ➕ `src/application/ArtifactGraphConstruction.ts` (+359 -0) ➕ `src/application/ArtifactInventory.ts` (+415 -0) 📝 `src/application/BinarySession.ts` (+277 -21) ➕ `src/application/CompositeProvider.ts` (+96 -0) 📝 `src/application/DirectAnalysis.ts` (+52 -12) 📝 `src/application/EnhancedTools.ts` (+25 -10) _...and 80 more files_ </details> ### 📄 Description ## TL;DR Implements the evidence-backed roadmap foundation and hardens issue #37: provider-neutral analysis, native/artifact inspection, bounded process fidelity, evidence bundles and residual unknowns, comparisons, call-path/static-runtime correlation, reconstruction verification, and a policy-gated historical source import CLI for #66. Closes #32. Addresses #37. Closes #66. ## Review order 1. Provider, Evidence v2, and bounded adapters. 2. Artifact/native/process capture surfaces. 3. Comparison and investigation workflows. 4. Historical source graph/import security boundaries. 5. Tests and completion metadata. ## Safety and compatibility - Preserves the documented 68-tool inventory. - Parses unknown data at boundaries and uses tagged Result failures. - No source execution or network access in reference import. - Uses Babel, ignore, isomorphic-git, graphology, official ASAR, and zip.js instead of hand-rolled equivalents. - Filesystem traversal is bounded and symlink-safe; process ownership is token-validated. ## Verification - npm run check (289 tests) - npm run knip - npm run jscpd - npm run scan:todos - npm run verify:package (68 tools) Real Hopper verification was not run because this environment is Linux and Hopper is macOS-only. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:11:20 +00:00