[PR #593] [MERGED] fix(comparison): normalize CFG identity by numeric addresses #2093

New issue

Closed

opened 2026-10-16 21:14:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:14:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/593
Author: @rudycelekli
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: campaign/rea-oct5-domain-cfg-addresses

📝 Commits (2)

8f5432e fix(comparison): normalize CFG identity by numeric addresses
8409191 fix(comparison): narrow CFG addresses before building numeric indices

📊 Changes

2 files changed (+67 additions, -18 deletions)

View changed files

📝 src/domain/functionComparison.test.ts (+43 -0)
📝 src/domain/functionComparisonNormalization.ts (+24 -18)

📄 Description

Summary

Equivalent hexadecimal addresses no longer make a valid relocated CFG unknown; duplicate numeric starts are rejected even when spelled differently.

No issue is linked: this is a narrow, reproduced correction to an existing comparison invariant discovered while reviewing current code, with no new feature, architectural change, or public contract requiring a proposal.

Problem and expected behavior

Hexadecimal-equivalent successor 0X01004 did not match block start 0x1004; two numeric-identical starts escaped the raw-string duplicate check. Equivalent spelling must not turn a fully observed graph unknown, and duplicate starts must remain unknown.

Change and scope

Use parsed bigint values for CFG uniqueness and successor lookup. Public Evidence parsing and existing relocation policy remain unchanged.

Contract and boundary impact

Semantic owner and earliest changed stage: Function comparison / numeric CFG projection.
CLI and MCP/tool-catalog contract: same commands, schemas and result fields; corrected existing comparison values only.
Provider, bridge, target-format, or platform compatibility: no provider/bridge changes or new platform support.
Evidence, artifact, provenance, or reconstruction contract: existing content-addressed inputs and provenance preserved; no new artifact identity or authority claim.
Process execution, authorization, cleanup, or containment impact: none in production.
Generated metadata (docs/product-catalog.json), package, or installation impact: none; relevant metadata checks remain enforced.

Evidence and regression coverage

Tests added or updated: 9 focused function comparison tests pass; alias resolution and duplicate block starts are independent regression cases. Combined CFG + generated-name source integration passes 16 tests.
Base reproduction or other evidence: executed production comparison regression fails on unchanged branch base; patched regression passes. No module mocks.
User-visible CLI/MCP output (if applicable): representative selected fields from the executed comparison fixture, not a claimed live CLI/provider session:

{"dimension":"cfg","status":"unchanged"}

Remaining proof gaps: Controlled fully observed dossier Evidence, not an actual Hopper/Ghidra run.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:focused -- src/domain/functionComparison.test.ts — pass: 1 files, 9 tests.
npm run check — pass on final signed head.
Current upstream AGENTS.md/CONTRIBUTING (#599) makes full check:pr optional for narrow fixes. Previous full-suite, check:ci and package evidence remains archived for the pre-repair or pre-rebase head; those counts are not claimed for this head. No packaging/distribution or provider behavior changed.
Initial package smoke failed its prompt-completion lifecycle while the full suite also ran; a sequential retry passes. The failed attempt is preserved.

Existing upstream lint/TypeDoc warnings remain; passing gates are not claimed warning-free.

Compatibility, safety, and release

Breaking changes or migration steps: none; existing comparison result shape preserved.
Real Hopper/Ghidra, browser, or OS coverage: not required for this pure comparison correction; controlled Evidence/fixture coverage described above.
Package or release metadata impact: none.
Security, privacy, process, or containment review: no secrets, production data, new process execution, authorization mechanism, or containment change.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed (no new public contract or metadata change).
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

AI assistance was used for investigation, implementation and testing. The commit is signed and includes DCO sign-off.

Combined integration with the other function-normalization correction passes all 16 tests. The shared test insertion point may need a test-only conflict resolution; preserve both independent regression blocks.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/593 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `campaign/rea-oct5-domain-cfg-addresses` --- ### 📝 Commits (2) - [`8f5432e`](https://github.com/morluto/rea/commit/8f5432e6569bdb065cffcc1b69ff7cd006c4e220) fix(comparison): normalize CFG identity by numeric addresses - [`8409191`](https://github.com/morluto/rea/commit/8409191a8e694a4c5a61ff51f122e8533fc7cb91) fix(comparison): narrow CFG addresses before building numeric indices ### 📊 Changes **2 files changed** (+67 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/functionComparison.test.ts` (+43 -0) 📝 `src/domain/functionComparisonNormalization.ts` (+24 -18) </details> ### 📄 Description ## Summary Equivalent hexadecimal addresses no longer make a valid relocated CFG unknown; duplicate numeric starts are rejected even when spelled differently. No issue is linked: this is a narrow, reproduced correction to an existing comparison invariant discovered while reviewing current code, with no new feature, architectural change, or public contract requiring a proposal. ## Problem and expected behavior Hexadecimal-equivalent successor `0X01004` did not match block start `0x1004`; two numeric-identical starts escaped the raw-string duplicate check. Equivalent spelling must not turn a fully observed graph unknown, and duplicate starts must remain unknown. ## Change and scope Use parsed bigint values for CFG uniqueness and successor lookup. Public Evidence parsing and existing relocation policy remain unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: Function comparison / numeric CFG projection. - CLI and MCP/tool-catalog contract: same commands, schemas and result fields; corrected existing comparison values only. - Provider, bridge, target-format, or platform compatibility: no provider/bridge changes or new platform support. - Evidence, artifact, provenance, or reconstruction contract: existing content-addressed inputs and provenance preserved; no new artifact identity or authority claim. - Process execution, authorization, cleanup, or containment impact: none in production. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: none; relevant metadata checks remain enforced. ## Evidence and regression coverage - Tests added or updated: 9 focused function comparison tests pass; alias resolution and duplicate block starts are independent regression cases. Combined CFG + generated-name source integration passes 16 tests. - Base reproduction or other evidence: executed production comparison regression fails on unchanged branch base; patched regression passes. No module mocks. - User-visible CLI/MCP output (if applicable): representative selected fields from the executed comparison fixture, not a claimed live CLI/provider session: ```json {"dimension":"cfg","status":"unchanged"} ``` - Remaining proof gaps: Controlled fully observed dossier Evidence, not an actual Hopper/Ghidra run. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- src/domain/functionComparison.test.ts` — pass: 1 files, 9 tests. - `npm run check` — pass on final signed head. - Current upstream AGENTS.md/CONTRIBUTING (#599) makes full check:pr optional for narrow fixes. Previous full-suite, check:ci and package evidence remains archived for the pre-repair or pre-rebase head; those counts are not claimed for this head. No packaging/distribution or provider behavior changed. - Initial package smoke failed its prompt-completion lifecycle while the full suite also ran; a sequential retry passes. The failed attempt is preserved. Existing upstream lint/TypeDoc warnings remain; passing gates are not claimed warning-free. ## Compatibility, safety, and release - Breaking changes or migration steps: none; existing comparison result shape preserved. - Real Hopper/Ghidra, browser, or OS coverage: not required for this pure comparison correction; controlled Evidence/fixture coverage described above. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no secrets, production data, new process execution, authorization mechanism, or containment change. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed (no new public contract or metadata change). - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. AI assistance was used for investigation, implementation and testing. The commit is signed and includes DCO sign-off. Combined integration with the other function-normalization correction passes all 16 tests. The shared test insertion point may need a test-only conflict resolution; preserve both independent regression blocks. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:14:09 +00:00