morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #32] Roadmap: evolve REA into an agent-first multi-tool reverse-engineering platform #20

New issue

Open

opened 2026-10-15 18:20:01 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-15 18:20:01 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/32

Outcome

REA is an evidence-backed reverse-engineering platform exposed through equivalent CLI and MCP tools. Agents choose the target and compose investigations using inspection, capture, tracing, and comparison results.

Current direction

Merged #555 removes REA permission grants, scope ceilings, project grant storage, elicitation, and repeated approval fields. Merged #572 removes the controlled JavaScript replay sandbox, Node characterization prepare/execute flow, finite replay machines, process replay orchestration, and plan-only managed runtime correlation.

Agents compose experiments with commands, scripts, and local fixture servers. A new orchestration abstraction needs an observed requirement that direct tools cannot satisfy. Local operations use the current user's OS permissions; setup remains a separately disclosed and approved installation workflow.

The replay-sandbox decision in #543 is completed. Replay fidelity work in #564 and grant-system work in #96/#388 are superseded, not unimplemented blockers for this roadmap. Earlier phase lists and comments describing those systems as required or shipped are historical.

Preserve the foundations

Keep dependencies flowing inward, parse unknown values at each boundary, and use typed failures that preserve the actual cause. Tool results must distinguish observations, inferences, and unknowns, with target identity, source locations, and relevant limitations.

CLI and MCP must share workflows and contracts. Bind handlers to named contracts rather than catalog positions. Preserve target-free startup, cancellation, timeouts, serialized target switching, failed-switch restoration, owned-resource cleanup, additive setup with backups, and verification of packaged artifacts.

Stored evidence authority labels remain valid provenance; they do not imply that REA still provides a replay executor. A missing or partial observation cannot establish equivalence.

Remaining workstreams

Evidence and boundary composition: #551 covers inline Evidence that cannot be fed directly into comparisons; #553 covers managed CLI/MCP routing and value-based seed lookup; #558 covers conclusions drawn from partially observed data; #565 covers adapter parity and failure classification. General rule ownership and remaining error-handling work remain under #544 and #562.

Process and Hopper fidelity: #48 tracks direct process capture and real-provider proof. Event-complete process observation remains under #59/#333. Native PTY diagnostics remain under #568. Full Hopper dossier and semantic conformance coverage remain under #31/#54 and #25/#55, with focused proof issues #339–#344. A passing narrower provider lane does not close those broader claims.

Browser and Electron: #39 tracks observation, shipped-code analysis, and comparison; #64/#375 cover remaining Electron shell and process-lifecycle instrumentation. Active capture uses explicit URLs and actions without a duplicate origin permission gate. Fixture servers and experiment sequencing belong to the agent.

Windows provider execution: #527 remains open. Job Object ownership (#287/#288 and their implementation children), private runtime storage/DACLs (#290), and handle-based path admission (#289) are provider requirements independent of the removed grant system. Target-free package tests do not establish usable Windows Ghidra sessions.

Environment evidence and optional test infrastructure remain under #69/#381/#382. They must serve concrete provider or reproducibility needs rather than becoming prerequisites for ordinary local tool use. Any native runtime observation under #71/#385 needs a concrete tool contract and real provider verification.

Completion

Keep this roadmap open until the remaining capability and proof issues are resolved or explicitly superseded. Each workstream must establish the behavior it claims through public CLI/MCP contracts, appropriate real-provider lanes, and packaged-artifact checks. Documentation and the installed skill must match the current catalog. Unsupported and unverified coverage must remain explicit.

The repository roadmap is docs/roadmap.md.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/32 ## Outcome REA is an evidence-backed reverse-engineering platform exposed through equivalent CLI and MCP tools. Agents choose the target and compose investigations using inspection, capture, tracing, and comparison results. ## Current direction Merged #555 removes REA permission grants, scope ceilings, project grant storage, elicitation, and repeated approval fields. Merged #572 removes the controlled JavaScript replay sandbox, Node characterization prepare/execute flow, finite replay machines, process replay orchestration, and plan-only managed runtime correlation. Agents compose experiments with commands, scripts, and local fixture servers. A new orchestration abstraction needs an observed requirement that direct tools cannot satisfy. Local operations use the current user's OS permissions; setup remains a separately disclosed and approved installation workflow. The replay-sandbox decision in #543 is completed. Replay fidelity work in #564 and grant-system work in #96/#388 are superseded, not unimplemented blockers for this roadmap. Earlier phase lists and comments describing those systems as required or shipped are historical. ## Preserve the foundations Keep dependencies flowing inward, parse unknown values at each boundary, and use typed failures that preserve the actual cause. Tool results must distinguish observations, inferences, and unknowns, with target identity, source locations, and relevant limitations. CLI and MCP must share workflows and contracts. Bind handlers to named contracts rather than catalog positions. Preserve target-free startup, cancellation, timeouts, serialized target switching, failed-switch restoration, owned-resource cleanup, additive setup with backups, and verification of packaged artifacts. Stored evidence authority labels remain valid provenance; they do not imply that REA still provides a replay executor. A missing or partial observation cannot establish equivalence. ## Remaining workstreams Evidence and boundary composition: #551 covers inline Evidence that cannot be fed directly into comparisons; #553 covers managed CLI/MCP routing and value-based seed lookup; #558 covers conclusions drawn from partially observed data; #565 covers adapter parity and failure classification. General rule ownership and remaining error-handling work remain under #544 and #562. Process and Hopper fidelity: #48 tracks direct process capture and real-provider proof. Event-complete process observation remains under #59/#333. Native PTY diagnostics remain under #568. Full Hopper dossier and semantic conformance coverage remain under #31/#54 and #25/#55, with focused proof issues #339–#344. A passing narrower provider lane does not close those broader claims. Browser and Electron: #39 tracks observation, shipped-code analysis, and comparison; #64/#375 cover remaining Electron shell and process-lifecycle instrumentation. Active capture uses explicit URLs and actions without a duplicate origin permission gate. Fixture servers and experiment sequencing belong to the agent. Windows provider execution: #527 remains open. Job Object ownership (#287/#288 and their implementation children), private runtime storage/DACLs (#290), and handle-based path admission (#289) are provider requirements independent of the removed grant system. Target-free package tests do not establish usable Windows Ghidra sessions. Environment evidence and optional test infrastructure remain under #69/#381/#382. They must serve concrete provider or reproducibility needs rather than becoming prerequisites for ordinary local tool use. Any native runtime observation under #71/#385 needs a concrete tool contract and real provider verification. ## Completion Keep this roadmap open until the remaining capability and proof issues are resolved or explicitly superseded. Each workstream must establish the behavior it claims through public CLI/MCP contracts, appropriate real-provider lanes, and packaged-artifact checks. Documentation and the installed skill must match the current catalog. Unsupported and unverified coverage must remain explicit. The repository roadmap is [docs/roadmap.md](https://github.com/morluto/rea/blob/main/docs/roadmap.md).

bsakaguchi added the

labels

2026-10-15 18:20:01 +00:00

bsakaguchi commented

2026-10-15 18:20:02 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Roadmap status: provider-neutral routing, Ghidra on Linux and Windows P0, Evidence v2, artifact graphs, process capture, passive browser/Electron observation, controlled JavaScript replay, managed PE inspection, and several comparison workflows are now shipped. Keep this as the roadmap tracker, but treat its older phase checklists as stale and order remaining work through focused dependencies such as #287–#290, #60→#57→#61→#62, #63→#64/#65, and #68→#67.

@morluto commented on GitHub (Jul 17, 2026): Roadmap status: provider-neutral routing, Ghidra on Linux and Windows P0, Evidence v2, artifact graphs, process capture, passive browser/Electron observation, controlled JavaScript replay, managed PE inspection, and several comparison workflows are now shipped. Keep this as the roadmap tracker, but treat its older phase checklists as stale and order remaining work through focused dependencies such as #287–#290, #60→#57→#61→#62, #63→#64/#65, and #68→#67.

bsakaguchi commented

2026-10-15 18:20:02 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

The roadmap is now split into focused workstreams:

Windows native authority: #287 (children #318–#319), #288 (#320–#323), #289 (#324–#326), #290 (#327–#329), and broader Windows artifact support #38 (#362–#363)
Process capture / replay / conformance: #48 (children tracked in #48 comment)
Active browser/Electron/web comparison: #39 (children tracked in #39 comment)
Provider breadth: #42 (#367), #44 (#370), #41 (#366), #40 (#364–#365), #45 (#371–#372)
JavaScript/source mapping: #35 (#356–#357), #67 (#379–#380), #68 and #117 (completed)
MCP/dynamic tooling: #96 (#388–#389), #97 (#390–#391), #101 (#392–#393)
Investigation workflows: #17 (#345–#346), #18 (#347–#349)
Hopper hardening: #19 (#350–#351), #22 (#352–#353), and conformance children under #48
Verification/ledger: #72 (#386–#387)
Test environments: #69 (#381–#382), #70 (#383–#384)
Technical debt: #151 (#394), #172 (#395–#396)

@morluto commented on GitHub (Jul 20, 2026): The roadmap is now split into focused workstreams: - Windows native authority: #287 (children #318–#319), #288 (#320–#323), #289 (#324–#326), #290 (#327–#329), and broader Windows artifact support #38 (#362–#363) - Process capture / replay / conformance: #48 (children tracked in #48 comment) - Active browser/Electron/web comparison: #39 (children tracked in #39 comment) - Provider breadth: #42 (#367), #44 (#370), #41 (#366), #40 (#364–#365), #45 (#371–#372) - JavaScript/source mapping: #35 (#356–#357), #67 (#379–#380), #68 and #117 (completed) - MCP/dynamic tooling: #96 (#388–#389), #97 (#390–#391), #101 (#392–#393) - Investigation workflows: #17 (#345–#346), #18 (#347–#349) - Hopper hardening: #19 (#350–#351), #22 (#352–#353), and conformance children under #48 - Verification/ledger: #72 (#386–#387) - Test environments: #69 (#381–#382), #70 (#383–#384) - Technical debt: #151 (#394), #172 (#395–#396)

bsakaguchi commented

2026-10-15 18:20:03 +00:00

Author

Owner

@morluto commented on GitHub (Jul 22, 2026):

Cross-cutting conformance gate: #406 validates that discovery, environment/version diagnosis, scoped grants, provider routing, static/runtime evidence, reactive capture, concurrent comparison, contradiction handling, and reconstruction closure compose through public CLI and MCP contracts.

@morluto commented on GitHub (Jul 22, 2026): Cross-cutting conformance gate: #406 validates that discovery, environment/version diagnosis, scoped grants, provider routing, static/runtime evidence, reactive capture, concurrent comparison, contradiction handling, and reconstruction closure compose through public CLI and MCP contracts.

bsakaguchi referenced this issue

2026-10-15 18:23:56 +00:00

[GH-ISSUE #740] [Design] Roadmap: clarify investigation ownership and modularize REA capability integration #329

bsakaguchi referenced this issue

2026-10-15 18:28:06 +00:00

[GH-ISSUE #2300] [Feature] Show one function's pseudocode from several decompiler providers in one call #764

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:11:17 +00:00

[PR #46] [MERGED] Evolve REA into an evidence-backed analysis platform #1811