[GH-ISSUE #1245] feat(native): preserve access kind and inference provenance in compact xrefs #442

New issue

Closed

opened 2026-10-15 18:25:06 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:25:06 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1245

Current limitation

xrefs returns bare source-address strings. Distinguishing a comparison of an address constant from a memory read/write requires extra instruction/dossier calls. The compact inspect_native_instruction.references representation also omits primary-reference and source-provenance fields that a full dossier preserves.

Current observation

On the audited x86 PE, inspect_native_instruction at 0x40c577 exposes an indexed byte-memory operand and analyzer WRITE targets including 0x43fb13. Its compact references contain target/type/operand index, but no primary/source fields. Retained full-dossier observations distinguish non-primary analyzer targets; such a target must not be presented as a literal global write. Exact xrefs(0x43f8e4) is empty, which remains a bounded reference result rather than proof of no runtime use.

Required behavior

Offer compact typed incoming references using existing inspection contracts where possible. Preserve source instruction, access/reference kind, operand index, primary status and provider/source provenance, including explicit unknowns. Distinguish literal addressing from analyzer-inferred indexed targets. Keep canonical address-space identities intact.

Test immediate DATA references, literal READ/WRITE, indexed non-primary targets, targetless/indirect references and an empty examined set. Inline facts should support the next producer/consumer question without constructing every full dossier. Do not silently change the meaning of existing bare addresses.

Source and relationship

bridge/ghidra/ReaGhidraBridge.java:962; src/domain/native/nativeInstruction.ts:8; full dossier reference fields in src/domain/hopperValues.ts:270. Related #1065. Region/field aggregation is a distinct broader outcome.

Verification and scope

Bare xrefs and the indexed compact-instruction case were reproduced with real Ghidra on both baselines. Existing full-dossier primary/provenance fields were source-audited. No runtime write to the inferred target was established.

Audit date: 2026-10-09. Latest npm dist-tag verified as rea-agents@6.1.0; current main tested at f4c99ab8a53806dd57dc24b3d5a600905bcb4686. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1245 ### Current limitation `xrefs` returns bare source-address strings. Distinguishing a comparison of an address constant from a memory read/write requires extra instruction/dossier calls. The compact `inspect_native_instruction.references` representation also omits primary-reference and source-provenance fields that a full dossier preserves. ### Current observation On the audited x86 PE, `inspect_native_instruction` at `0x40c577` exposes an indexed byte-memory operand and analyzer WRITE targets including `0x43fb13`. Its compact references contain target/type/operand index, but no primary/source fields. Retained full-dossier observations distinguish non-primary analyzer targets; such a target must not be presented as a literal global write. Exact `xrefs(0x43f8e4)` is empty, which remains a bounded reference result rather than proof of no runtime use. ### Required behavior Offer compact typed incoming references using existing inspection contracts where possible. Preserve source instruction, access/reference kind, operand index, primary status and provider/source provenance, including explicit unknowns. Distinguish literal addressing from analyzer-inferred indexed targets. Keep canonical address-space identities intact. Test immediate DATA references, literal READ/WRITE, indexed non-primary targets, targetless/indirect references and an empty examined set. Inline facts should support the next producer/consumer question without constructing every full dossier. Do not silently change the meaning of existing bare addresses. ### Source and relationship [bridge/ghidra/ReaGhidraBridge.java:962](https://github.com/morluto/rea/blob/f4c99ab8a53806dd57dc24b3d5a600905bcb4686/bridge/ghidra/ReaGhidraBridge.java#L962); [src/domain/native/nativeInstruction.ts:8](https://github.com/morluto/rea/blob/f4c99ab8a53806dd57dc24b3d5a600905bcb4686/src/domain/native/nativeInstruction.ts#L8); full dossier reference fields in [src/domain/hopperValues.ts:270](https://github.com/morluto/rea/blob/f4c99ab8a53806dd57dc24b3d5a600905bcb4686/src/domain/hopperValues.ts#L270). Related #1065. Region/field aggregation is a distinct broader outcome. ### Verification and scope Bare xrefs and the indexed compact-instruction case were reproduced with real Ghidra on both baselines. Existing full-dossier primary/provenance fields were source-audited. No runtime write to the inferred target was established. Audit date: 2026-10-09. Latest npm dist-tag verified as `rea-agents@6.1.0`; current main tested at `f4c99ab8a53806dd57dc24b3d5a600905bcb4686`. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

bsakaguchi

2026-10-15 18:25:06 +00:00

closed this issue
added the
area: mcp

triage

area: domain

enhancement

P2: medium
labels

bsakaguchi commented

2026-10-15 18:25:06 +00:00

Author

Owner

@WODE25500 commented on GitHub (Oct 11, 2026):

Hi — I'd like to take this.

Verification I can offer: Windows 11 x64, rea-agents 6.4.0 + Ghidra 12.1.2 on the Windows Ghidra P0 lane (PE / x86-64, read-only). I confirmed the lane runs end-to-end on this host — a cold xrefs on a real PE returns Ghidra-provided evidence (~3 min import) — so this change can carry real-PE observations rather than simulated ones. No mutation authority is needed.

Plan:

carry access kind (read / write / compare / address-constant) and primary/source provenance into the compact xrefs and inspect_native_instruction.references forms, leaving the full-dossier fields unchanged;
add projection tests for compact vs. dossier, plus regenerate mcp-catalog:check / docs:check;
the audited addresses in this report (0x40c577, 0x43fb13) come from a private image. Unless that binary can be shared, I'll build a PE fixture that reproduces the operand shape: an indexed byte-memory operand plus a non-primary analyzer WRITE target that must not read as a literal global write.

One question before I write code: is the compact form meant to stay minimal, with the detail living in the dossier? If so, I'll keep the defaults unchanged and put the extra fields behind an explicit selector instead. Which shape do you want?

@WODE25500 commented on GitHub (Oct 11, 2026): Hi — I'd like to take this. **Verification I can offer:** Windows 11 x64, rea-agents 6.4.0 + Ghidra 12.1.2 on the Windows Ghidra P0 lane (PE / x86-64, read-only). I confirmed the lane runs end-to-end on this host — a cold `xrefs` on a real PE returns Ghidra-provided evidence (~3 min import) — so this change can carry real-PE observations rather than simulated ones. No mutation authority is needed. Plan: - carry access kind (read / write / compare / address-constant) and primary/source provenance into the compact `xrefs` and `inspect_native_instruction.references` forms, leaving the full-dossier fields unchanged; - add projection tests for compact vs. dossier, plus regenerate `mcp-catalog:check` / `docs:check`; - the audited addresses in this report (0x40c577, 0x43fb13) come from a private image. Unless that binary can be shared, I'll build a PE fixture that reproduces the operand shape: an indexed byte-memory operand plus a non-primary analyzer WRITE target that must not read as a literal global write. **One question before I write code:** is the compact form meant to stay minimal, with the detail living in the dossier? If so, I'll keep the defaults unchanged and put the extra fields behind an explicit selector instead. Which shape do you want?

bsakaguchi referenced this issue

2026-10-16 21:13:08 +00:00

[PR #442] [MERGED] perf(mcp): reduce cold-start work #1989

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:09 +00:00