[GH-ISSUE #54] Complete Hopper function dossiers with real references and CFG edges

bsakaguchi commented

2026-10-15 18:20:20 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/54

Problem

analyze_function is honest but incomplete: callers/callees and references are weakly typed, comments are entry-only, strings/names are unavailable, and CFG successors are not populated.

Outcome

Return a complete bounded dossier using Hopper's public APIs without guessing unavailable reference kinds.

Scope

Independent pseudocode, assembly, and collection offsets.
Typed procedure identity, signature, and parsed locals.
Typed caller/callee identities.
Procedure-wide regular and inline comments.
Incoming and outgoing reference edges with endpoint containment.
Referenced strings and names resolved from address-indexed inventories.
Basic blocks with real successor addresses.
Explicit unavailable metadata for unclassified reference kinds.
Strict boundary parsing of the complete response.

Acceptance criteria

Every collection reports total or truthful unknown, returned, truncated, and continuation. Fixture-backed real-Hopper tests prove nonempty comments, strings, call edges, references, and CFG successors. Malformed output becomes AnalysisProtocolError; unsupported data is never an empty placeholder.

Dependencies

Parent: #48. Requires typed provider/error contracts and Evidence v2 locations.

Non-goals

Recovering original source, inferred reference kinds, or dynamic call targets.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/54 ## Problem `analyze_function` is honest but incomplete: callers/callees and references are weakly typed, comments are entry-only, strings/names are unavailable, and CFG successors are not populated. ## Outcome Return a complete bounded dossier using Hopper's public APIs without guessing unavailable reference kinds. ## Scope - Independent pseudocode, assembly, and collection offsets. - Typed procedure identity, signature, and parsed locals. - Typed caller/callee identities. - Procedure-wide regular and inline comments. - Incoming and outgoing reference edges with endpoint containment. - Referenced strings and names resolved from address-indexed inventories. - Basic blocks with real successor addresses. - Explicit unavailable metadata for unclassified reference kinds. - Strict boundary parsing of the complete response. ## Acceptance criteria Every collection reports total or truthful unknown, returned, truncated, and continuation. Fixture-backed real-Hopper tests prove nonempty comments, strings, call edges, references, and CFG successors. Malformed output becomes `AnalysisProtocolError`; unsupported data is never an empty placeholder. ## Dependencies Parent: #48. Requires typed provider/error contracts and Evidence v2 locations. ## Non-goals Recovering original source, inferred reference kinds, or dynamic call targets.

bsakaguchi added the

labels

2026-10-15 18:20:20 +00:00

bsakaguchi commented

2026-10-15 18:20:22 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Closure proof audit: implementation fields are present, but recorded real-Hopper evidence does not yet satisfy the positive semantic acceptance. PR #74 ran two real Mach-O targets, yet its verifier only checked collection shapes/totals and that successors was an array; empty comments, strings, call edges, references, blocks, and successor sets could still pass. Current real-Hopper workflows have no recorded runs. Keep open until the verifier drives named source-owned fixture oracles with required nonempty facts and a real Hopper run is recorded.

@morluto commented on GitHub (Jul 17, 2026): Closure proof audit: implementation fields are present, but recorded real-Hopper evidence does not yet satisfy the positive semantic acceptance. PR #74 ran two real Mach-O targets, yet its verifier only checked collection shapes/totals and that successors was an array; empty comments, strings, call edges, references, blocks, and successor sets could still pass. Current real-Hopper workflows have no recorded runs. Keep open until the verifier drives named source-owned fixture oracles with required nonempty facts and a real Hopper run is recorded.

bsakaguchi commented

2026-10-15 18:20:23 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Implementation progress on the current working tree: real-Hopper semantic verification is now manifest-bound to source-owned C and version-v2 artifacts with canonical path and SHA-256 checks. The workflow builds those fixtures instead of accepting arbitrary operator paths. It selects named rea_entry/rea_branch/rea_leaf procedures, writes and reads back a deterministic comment, then requires the exact REA_C_ENTRY string, expected callee/reference targets, and a nonempty CFG successor. Regression tests individually prove empty comments, callees, references, strings, and successors cannot satisfy the fixture oracle. Typecheck, focused lint, and 12 focused verifier/fixture tests pass. This issue remains open until the revised workflow completes successfully on the licensed real-Hopper macOS runner; that platform proof has not been run locally.

@morluto commented on GitHub (Jul 17, 2026): Implementation progress on the current working tree: real-Hopper semantic verification is now manifest-bound to source-owned C and version-v2 artifacts with canonical path and SHA-256 checks. The workflow builds those fixtures instead of accepting arbitrary operator paths. It selects named rea_entry/rea_branch/rea_leaf procedures, writes and reads back a deterministic comment, then requires the exact REA_C_ENTRY string, expected callee/reference targets, and a nonempty CFG successor. Regression tests individually prove empty comments, callees, references, strings, and successors cannot satisfy the fixture oracle. Typecheck, focused lint, and 12 focused verifier/fixture tests pass. This issue remains open until the revised workflow completes successfully on the licensed real-Hopper macOS runner; that platform proof has not been run locally.

bsakaguchi commented

2026-10-15 18:20:23 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

The current branch strengthens the real-Hopper function-dossier proof with source-built C semantics: caller/callee chains across main, entry, branch, and leaf; CFG successor evidence; nonempty assembly; exact strings and comments; and a global-name reference bound to the queried procedure address. The assertion layer now rejects value-only reference matches from another procedure. npm run check passes. This remains open pending the licensed real-Hopper verifier run and any provider defects that run exposes.

@morluto commented on GitHub (Jul 17, 2026): The current branch strengthens the real-Hopper function-dossier proof with source-built C semantics: caller/callee chains across main, entry, branch, and leaf; CFG successor evidence; nonempty assembly; exact strings and comments; and a global-name reference bound to the queried procedure address. The assertion layer now rejects value-only reference matches from another procedure. npm run check passes. This remains open pending the licensed real-Hopper verifier run and any provider defects that run exposes.

bsakaguchi commented

2026-10-15 18:20:23 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#342
#343

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #342 - [ ] #343 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi commented

2026-10-15 18:20:23 +00:00

Author

Owner

@gifts-lb-hamsa commented on GitHub (Oct 10, 2026):

Strongly support this enhancement. Populate CFG successors and properly typed references will make a huge difference. Looking forward to seeing this implemented

@gifts-lb-hamsa commented on GitHub (Oct 10, 2026): Strongly support this enhancement. Populate CFG successors and properly typed references will make a huge difference. Looking forward to seeing this implemented

bsakaguchi referenced this issue

2026-10-15 18:20:35 +00:00

[GH-ISSUE #68] Add native JavaScript bundle indexing and semantic queries #55

bsakaguchi referenced this issue

2026-10-15 18:20:50 +00:00

[GH-ISSUE #117] Add semantic analysis for JavaScript and packaged application bundles #74

bsakaguchi referenced this issue

2026-10-15 18:21:45 +00:00

[GH-ISSUE #267] Add approval-gated managed-runtime characterization #156

bsakaguchi referenced this issue

2026-10-15 18:22:32 +00:00

[GH-ISSUE #367] Add JVM and Python bytecode providers #215