[GH-ISSUE #42] Add managed-runtime, bytecode, and package ecosystem providers #31

New issue

Closed

opened 2026-10-15 18:20:14 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:20:14 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/42

Goal

Extend REA beyond native machine code to common managed runtimes and packaged applications.

Initial families

JVM bytecode and JAR/WAR archives
.NET IL, assemblies, NuGet packages, and single-file applications
Python bytecode, wheels, zipapps, and frozen applications
Node.js packages, snapshots, bytecode, Electron bundles, and native addons
WebAssembly modules
Lua and other embedded scripting runtimes

Capabilities

identify_runtime
inventory_package
inspect_bytecode
decompile_managed_function
resolve_dependency_graph
trace_native_bridge
compare_packages
recover_embedded_resources

Requirements

Route semantic requests to runtime-specific providers.
Preserve raw bytecode or IL locations alongside normalized symbols.
Record package-lock and dependency provenance.
Detect generated, vendored, bundled, and application-owned code.
Treat decompiler output as derived evidence rather than original source.

Acceptance criteria

Representative fixtures for each enabled runtime have deterministic inventories.
Managed-to-native boundaries can be followed in both directions.
Package and version comparisons identify ownership and behavioral changes.
Missing runtime tooling is exposed through capability discovery, not runtime surprises.## Focused JavaScript and bundle work

#117 is the focused implementation issue for semantic analysis of JavaScript and packaged application bundles. It covers module/chunk recovery, bundler graphs, source-map validation, package provenance, Electron boundaries, native-addon/WebAssembly edges, deterministic Evidence v2 output, and bundle comparison.

This issue remains the umbrella for managed runtimes and package ecosystems. Work in #117 should establish reusable provider contracts where possible without prematurely generalizing JavaScript-specific parser or bundler behavior into the domain model.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/42 ## Goal Extend REA beyond native machine code to common managed runtimes and packaged applications. ## Initial families - JVM bytecode and JAR/WAR archives - .NET IL, assemblies, NuGet packages, and single-file applications - Python bytecode, wheels, zipapps, and frozen applications - Node.js packages, snapshots, bytecode, Electron bundles, and native addons - WebAssembly modules - Lua and other embedded scripting runtimes ## Capabilities - identify_runtime - inventory_package - inspect_bytecode - decompile_managed_function - resolve_dependency_graph - trace_native_bridge - compare_packages - recover_embedded_resources ## Requirements - Route semantic requests to runtime-specific providers. - Preserve raw bytecode or IL locations alongside normalized symbols. - Record package-lock and dependency provenance. - Detect generated, vendored, bundled, and application-owned code. - Treat decompiler output as derived evidence rather than original source. ## Acceptance criteria - Representative fixtures for each enabled runtime have deterministic inventories. - Managed-to-native boundaries can be followed in both directions. - Package and version comparisons identify ownership and behavioral changes. - Missing runtime tooling is exposed through capability discovery, not runtime surprises.## Focused JavaScript and bundle work #117 is the focused implementation issue for semantic analysis of JavaScript and packaged application bundles. It covers module/chunk recovery, bundler graphs, source-map validation, package provenance, Electron boundaries, native-addon/WebAssembly edges, deterministic Evidence v2 output, and bundle comparison. This issue remains the umbrella for managed runtimes and package ecosystems. Work in #117 should establish reusable provider contracts where possible without prematurely generalizing JavaScript-specific parser or bundler behavior into the domain model.

bsakaguchi

2026-10-15 18:20:14 +00:00

closed this issue
added the
area: domain

roadmap

enhancement

P2: medium
labels

bsakaguchi commented

2026-10-15 18:20:15 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

The .NET execution-free provider and managed workflows are delivered, and JavaScript application/replay support is substantial. Remaining breadth is JVM/Python bytecode, WebAssembly, Lua, additional package ecosystems, and bidirectional native-bridge coverage. Update this umbrella around those residual families rather than describing managed support as absent.

@morluto commented on GitHub (Jul 17, 2026): The .NET execution-free provider and managed workflows are delivered, and JavaScript application/replay support is substantial. Remaining breadth is JVM/Python bytecode, WebAssembly, Lua, additional package ecosystems, and bidirectional native-bridge coverage. Update this umbrella around those residual families rather than describing managed support as absent.

bsakaguchi commented

2026-10-15 18:20:16 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#367

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #367 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:20:18 +00:00

[GH-ISSUE #48] Epic: Evidence v2 and deterministic process fidelity #35

bsakaguchi referenced this issue

2026-10-15 18:22:14 +00:00

[GH-ISSUE #341] Run real-Hopper analyze_function dossier conformance #188

bsakaguchi referenced this issue

2026-10-15 18:23:04 +00:00

[GH-ISSUE #482] [Feature] Trace native state and value dependencies across functions #258

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794