[GH-ISSUE #40] Add protocol and distributed-client investigation workflows #28

New issue

Closed

opened 2026-10-15 18:20:11 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:20:11 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/40

Goal

Reverse engineer how desktop, mobile, browser, and CLI clients communicate with services while preserving a reproducible evidence trail.

Scope

HTTP and REST
WebSocket and Server-Sent Events
GraphQL
JSON-RPC and MessagePack
gRPC and Protocol Buffers
custom TCP and UDP framing
local IPC, Unix sockets, named pipes, and XPC
authentication flows and token lifecycle metadata with secret redaction

Capabilities

capture_protocol_session
infer_message_schema
correlate_request_to_callsite
compare_protocol_versions
generate_replay_fixture
identify_state_machine
export_sanitized_transcript

Requirements

Separate raw observations, decoded fields, inferred schemas, and hypotheses.
Preserve timing, direction, process identity, endpoint, and source-code correlations.
Require policy approval for active replay, mutation, interception, or certificate changes.
Never persist credentials by default.
Support offline import from standard capture formats.

Acceptance criteria

A fixture client session yields a typed message timeline and inferred state machine.
Static callsites can be correlated with runtime messages.
Unknown fields remain unknown rather than receiving guessed meanings.
Sanitized evidence can reproduce parsing and comparison without live credentials.

Roadmap expansion

Child work

Loopback replay binds locally, captures bounded request/response and reconnect timelines, denies external network by default, and redacts secrets. Active interception, certificate changes, production traffic, and arbitrary external replay remain separately approval-gated.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/40 ## Goal Reverse engineer how desktop, mobile, browser, and CLI clients communicate with services while preserving a reproducible evidence trail. ## Scope - HTTP and REST - WebSocket and Server-Sent Events - GraphQL - JSON-RPC and MessagePack - gRPC and Protocol Buffers - custom TCP and UDP framing - local IPC, Unix sockets, named pipes, and XPC - authentication flows and token lifecycle metadata with secret redaction ## Capabilities - capture_protocol_session - infer_message_schema - correlate_request_to_callsite - compare_protocol_versions - generate_replay_fixture - identify_state_machine - export_sanitized_transcript ## Requirements - Separate raw observations, decoded fields, inferred schemas, and hypotheses. - Preserve timing, direction, process identity, endpoint, and source-code correlations. - Require policy approval for active replay, mutation, interception, or certificate changes. - Never persist credentials by default. - Support offline import from standard capture formats. ## Acceptance criteria - A fixture client session yields a typed message timeline and inferred state machine. - Static callsites can be correlated with runtime messages. - Unknown fields remain unknown rather than receiving guessed meanings. - Sanitized evidence can reproduce parsing and comparison without live credentials. ## Roadmap expansion ### Child work - [x] #60 - [x] #70 Loopback replay binds locally, captures bounded request/response and reconnect timelines, denies external network by default, and redacts secrets. Active interception, certificate changes, production traffic, and arbitrary external replay remain separately approval-gated.

bsakaguchi

2026-10-15 18:20:11 +00:00

closed this issue
added the
area: server

P1: high

area: domain

roadmap

enhancement
labels

bsakaguchi commented

2026-10-15 18:20:13 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Current main delivers bounded loopback HTTP/WebSocket replay, but not generalized protocol capture/import and stateful investigation across gRPC, custom IPC, or distributed-client call sites. Keep this umbrella focused on those residual workflows and coordinate its environment requirements with #60 and #70.

@morluto commented on GitHub (Jul 17, 2026): Current main delivers bounded loopback HTTP/WebSocket replay, but not generalized protocol capture/import and stateful investigation across gRPC, custom IPC, or distributed-client call sites. Keep this umbrella focused on those residual workflows and coordinate its environment requirements with #60 and #70.

bsakaguchi commented

2026-10-15 18:20:13 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#364
#365

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #364 - [ ] #365 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:11:17 +00:00

[PR #46] [MERGED] Evolve REA into an evidence-backed analysis platform #1811

bsakaguchi referenced this issue

2026-10-16 21:11:25 +00:00

[PR #85] [MERGED] feat(analysis): harden agent workflows and evidence boundaries #1823

bsakaguchi added

enhancement

and removed