morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5499] [Feature] Query retained Go build metadata without full raw replies #3346

New issue

Closed

opened 2026-10-31 00:39:24 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:39:24 +00:00

Owner

Originally created by @gensokyo-dev on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5499

Before submitting

Searched open/closed issues and pull requests; #3604 and #3976 address other Go reader work.
Reviewed contribution scope: this proposes projections of existing read-only metadata, with no execution or new target authority.
Only public release artifacts and local source-built verification data are referenced.

Area

Evidence, artifacts, or reconstruction; MCP or agent integration.

Current limitation

At main@ee12d517a25d34853d40e31fc039c7d1576c60e1, inspect_go_binary accepts only path. Reading GitHub CLI v2.102.0's Linux amd64 release returns 63,544 bytes of compact Evidence, including raw framed bytes, module text and all 165 dependency records. Even a question about the compiler, main module and one dependency requires that whole reply. inspect_analysis_view does not support this parent operation.

Use cases

Identify compiler/main-module provenance and query selected embedded dependency versions or build settings while retaining exact bytes and source ranges. The downloaded binary is 42,086,560 bytes, SHA-256 7469124f706944133d6a169691dd1c6c3511b12e85878d255e044e2948df4c9b; its archive digest matches the official release asset. It was never executed.

Desired outcome and success criteria

Opt-in summary delivery through both CLI and MCP, using the shared application and retained-view layer. Keep complete delivery compatible. Allow exact filtering, field selection and paging of retained dependency/settings rows; each row retains its original ordinal and parent Evidence identity. Missing build metadata and runtime dependency completeness remain unknown. Raw bytes and complete Evidence remain accessible.

Expected interaction with targets

Read existing files or captured data. No new target effects are proposed.

Target and scope details

Existing in-process ELF/PE/thin Mach-O Go metadata reader. No target execution, disassembler, process attachment, network acquisition or protection recovery is added. No parser changes or live-result cache are proposed.

Verification available so far

Observed results. Actual public stdio MCP discovery → two identical reads for five Go/Rust binaries → Evidence export completed in 5.660 s wall / 5.444 s CPU / 608.0 MiB kernel family peak, under a one-CPU, 4 GiB hard/3 GiB early, no-swap guard. Payload exit and cleanup verified; no observed resource stops/OOM; final whole-scope counters unavailable. Go module text and all 165 dependency identities match native go version -m. Rust's independent .dep-v0 verification also passed (42 packages, 88 indexed edges). These are baseline observations; no optimization benefit has been measured yet.

The 11-call mixed task's input-schema + arguments + text-reply estimate is 277,915 cl100k_base tokens (tiktoken 0.12.0); actual model usage is unknown. This is a serialization proxy, not a host-injection or billing claim. Fresh sessions used unflushed OS caches. An initial attempt selected the /usr/bin/go symlink and was correctly refused; qualification explicitly selects its regular target.

Alternatives considered

Full replies preserve useful evidence but require unnecessary raw encodings/context for selected facts. Client-side slicing pays the full transport/context cost. Existing retained views cover many other parents and should own this projection too. Repeated metadata reads are already fast; an additional filesystem cache is not justified by these measurements.

Possible direction

Add a compatible detail: summary option, preserve the complete parent before projection, and extend inspect_analysis_view for Go dependencies/settings. Measure an equivalent completed provenance query before/after including catalog changes, extra calls, complete Evidence access, CPU and family memory; cover malformed parents, identity conflicts, missing metadata, duplicate module paths, exact empty selections and pagination.

References

Related owner refactor #3604, opt-in function-table work #3976. Current experiments do not integrate either PR. Cross-platform real-provider verification beyond the measured Linux ELF artifacts is NOT_ENOUGH_INFO; no such claim is made.

Originally created by @gensokyo-dev on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5499 ### Before submitting - [x] Searched open/closed issues and pull requests; #3604 and #3976 address other Go reader work. - [x] Reviewed contribution scope: this proposes projections of existing read-only metadata, with no execution or new target authority. - [x] Only public release artifacts and local source-built verification data are referenced. ### Area Evidence, artifacts, or reconstruction; MCP or agent integration. ### Current limitation At `main@ee12d517a25d34853d40e31fc039c7d1576c60e1`, `inspect_go_binary` accepts only `path`. Reading [GitHub CLI v2.102.0](https://github.com/cli/cli/releases/tag/v2.102.0)'s Linux amd64 release returns 63,544 bytes of compact Evidence, including raw framed bytes, module text and all 165 dependency records. Even a question about the compiler, main module and one dependency requires that whole reply. `inspect_analysis_view` does not support this parent operation. ### Use cases Identify compiler/main-module provenance and query selected embedded dependency versions or build settings while retaining exact bytes and source ranges. The downloaded binary is 42,086,560 bytes, SHA-256 `7469124f706944133d6a169691dd1c6c3511b12e85878d255e044e2948df4c9b`; its archive digest matches the official release asset. It was never executed. ### Desired outcome and success criteria Opt-in summary delivery through both CLI and MCP, using the shared application and retained-view layer. Keep complete delivery compatible. Allow exact filtering, field selection and paging of retained dependency/settings rows; each row retains its original ordinal and parent Evidence identity. Missing build metadata and runtime dependency completeness remain unknown. Raw bytes and complete Evidence remain accessible. ### Expected interaction with targets Read existing files or captured data. No new target effects are proposed. ### Target and scope details Existing in-process ELF/PE/thin Mach-O Go metadata reader. No target execution, disassembler, process attachment, network acquisition or protection recovery is added. No parser changes or live-result cache are proposed. ### Verification available so far Observed results. Actual public stdio MCP discovery → two identical reads for five Go/Rust binaries → Evidence export completed in 5.660 s wall / 5.444 s CPU / 608.0 MiB kernel family peak, under a one-CPU, 4 GiB hard/3 GiB early, no-swap guard. Payload exit and cleanup verified; no observed resource stops/OOM; final whole-scope counters unavailable. Go module text and all 165 dependency identities match native `go version -m`. Rust's independent `.dep-v0` verification also passed (42 packages, 88 indexed edges). These are baseline observations; no optimization benefit has been measured yet. The 11-call mixed task's input-schema + arguments + text-reply estimate is 277,915 `cl100k_base` tokens (`tiktoken 0.12.0`); actual model usage is unknown. This is a serialization proxy, not a host-injection or billing claim. Fresh sessions used unflushed OS caches. An initial attempt selected the `/usr/bin/go` symlink and was correctly refused; qualification explicitly selects its regular target. ### Alternatives considered Full replies preserve useful evidence but require unnecessary raw encodings/context for selected facts. Client-side slicing pays the full transport/context cost. Existing retained views cover many other parents and should own this projection too. Repeated metadata reads are already fast; an additional filesystem cache is not justified by these measurements. ### Possible direction Add a compatible `detail: summary` option, preserve the complete parent before projection, and extend `inspect_analysis_view` for Go dependencies/settings. Measure an equivalent completed provenance query before/after including catalog changes, extra calls, complete Evidence access, CPU and family memory; cover malformed parents, identity conflicts, missing metadata, duplicate module paths, exact empty selections and pagination. ### References [Related owner refactor #3604](https://github.com/morluto/rea/pull/3604), [opt-in function-table work #3976](https://github.com/morluto/rea/pull/3976). Current experiments do not integrate either PR. Cross-platform real-provider verification beyond the measured Linux ELF artifacts is `NOT_ENOUGH_INFO`; no such claim is made.

bsakaguchi

2026-10-31 00:39:24 +00:00

closed this issue
added the
enhancement
label

bsakaguchi referenced this issue

2026-10-31 01:10:42 +00:00

[PR #3859] [MERGED] fix(flutter): check section-backed symbol tables against PT_LOAD #5954

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3346

No description provided.

Rows
Columns