morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #7611] [Bug] Ghidra guides still describe 26 read-only operations while the Windows verifier expects 27 #4541

New issue

Closed

opened 2026-10-31 00:50:37 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:50:37 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7611

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

The installation, Ghidra provider, and Windows Ghidra guides describe the current read-only operation inventory as 26 operations. The installation guide also divides it into fourteen inventory operations and twelve function operations.

At the source revision below, I ran the inline registry import in the reproduction. It returned 15 read-only inventory operations and 12 read-only function operations, totaling 27. The source Windows verifier derives its expected coverage from those same registries and explicitly invokes the additional overview aggregate. The current guide counts therefore disagree with the verifier they describe.

This is a source/documentation finding. I did not run Ghidra or the Windows verification lane.

Reproduction

Use Node.js 24.22.1 with the baseline checkout and its locked dependencies installed. From the repository root, run:

node --import tsx --input-type=module <<'JS'
import { GHIDRA_INVENTORY_OPERATIONS as inventory } from './src/ghidra/GhidraInventoryValues.ts';
import { GHIDRA_FUNCTION_OPERATIONS as functions } from './src/ghidra/GhidraFunctionValues.ts';
import { GHIDRA_MUTATING_OPERATIONS as mutations } from './src/ghidra/GhidraSessionValues.ts';
const reads = operations => operations.filter(name => !mutations.has(name));
console.log(JSON.stringify({ inventory: reads(inventory).length, functions: reads(functions).length, total: reads([...inventory, ...functions]).length }));
JS

Observed output:

{"inventory":15,"functions":12,"total":27}

Locate the current guide statements:
```
rg -n 'exposes 26|all 26|the 26 read-only' docs/installation.md docs/ghidra-provider.md docs/windows-ghidra-p0.md
```
Observed four matches: the adapter summary, the installation guide's Windows lane description, the provider guide's Windows lane description, and the Windows guide's supported boundary.

The count was checked twice using independent full and reduced registry imports; both returned 27. The documentation lookup returned the four current-scope matches on both inspections.

Expected behavior

Current guide descriptions of the full read-only operation inventory should agree with the source-owned inventory and the verifier's coverage gate at the same revision. That set contains 27 operations, split into 15 inventory operations and 12 function operations. A count-free description would also avoid the incorrect total.

Past verification records should retain the counts established by their original runs; this report does not establish that their historical totals were wrong.

Impact and scope

P3: readers receive an inaccurate description of the current adapter inventory and Windows verification coverage. Following these statements does not establish a runtime failure, missing verifier coverage, or incorrect analysis output. No consequential behavior change was observed.

Readers can derive the current set with the reproduction above. Real Windows execution, published-package behavior, and historical verification receipts remain outside this verification.

REA version

Exact output of node scripts/rea.mjs --version:

6.8.0

Source commit: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; arm64. No Ghidra runtime was used.

Target and artifact context

Source registries, verification script, and authored documentation only; no binary target is required.

Interface

Other

Earliest failure stage

Unknown

Relevant output or evidence

At the stated baseline:

Current claims: docs/installation.md:1015-1016 and 1549-1550; docs/ghidra-provider.md:296-303; docs/windows-ghidra-p0.md:14-22.
Registry import output: {"inventory":15,"functions":12,"total":27}. Inputs are src/ghidra/GhidraInventoryValues.ts:36-54, src/ghidra/GhidraFunctionValues.ts:59-73, and the mutation exclusion at src/ghidra/GhidraSessionValues.ts:24-27.
scripts/verify-real-ghidra-windows.mjs:169-178 invokes and validates the overview aggregate. Lines 271-291 derive the expected read-only set from these registries and reject missing, unexpected, or size-mismatched observations. The prose does not describe a separate 26-operation subset.
Supported caller path: src/cli/coreBinaryCommands.ts:174-187 routes inspect to the overview workflow, and src/application/EnhancedTools.ts:729-735 requests the aggregate. src/ghidra/GhidraProviderCapabilities.ts:25-37 maps its internal name to the public overview name.
I found no test pinning the guide prose to 26. The inspected handshake tests instead derive expected membership/cardinality from the registries: src/ghidra/GhidraSessionValues.test.ts:181-267 and tests/boundary/providers/ghidra/ghidraClient.test.ts:1024-1050.

The focused command npm run test:local -- src/application/BinaryOverview.test.ts src/ghidra/GhidraSessionValues.test.ts passed both files, 32 tests total. These source tests support overview dispatch and handshake semantics; they do not establish real-provider acceptance or validate the prose counts.

Analysis or suspected cause

Source history shows that merged PR #4754, commit ae029fe2f80b171a73df52e57b4a355f32f7c456, added the internal read-only overview aggregate and updated the Windows verifier to exercise it. Its predecessor's inventory lacked that entry. The current guides retain the earlier total and fourteen-operation inventory split.

The extra bridge observation is internal; the public overview workflow already existed. This report concerns the documented adapter/verifier operation count, not a claim that a new public tool was added.

Additional context

Related prior report #2156, item D11, concerned an older 19-versus-25 count in the conformance README. Merged PR #2207 replaced that specific statement with count-free wording, which remains correct at this baseline. The current guide mismatch follows the later aggregate addition and does not require repairing that README occurrence again.

Closed #2903 concerned a verifier omitting byte-search execution when its expected set grew from 25 to 26. The current source verifier includes both byte search and the overview aggregate. This report does not claim that earlier verifier failure recurs.

The separate Windows guide paragraph at docs/windows-ghidra-p0.md:160-168 records prior ARM runs with 26 operations. Those original receipts were not checked, so that historical count is excluded from this finding.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7611 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Documentation ### Observed behavior The installation, Ghidra provider, and Windows Ghidra guides describe the current read-only operation inventory as 26 operations. The installation guide also divides it into fourteen inventory operations and twelve function operations. At the source revision below, I ran the inline registry import in the reproduction. It returned 15 read-only inventory operations and 12 read-only function operations, totaling 27. The source Windows verifier derives its expected coverage from those same registries and explicitly invokes the additional overview aggregate. The current guide counts therefore disagree with the verifier they describe. This is a source/documentation finding. I did not run Ghidra or the Windows verification lane. ### Reproduction 1. Use Node.js 24.22.1 with the baseline checkout and its locked dependencies installed. From the repository root, run: ```sh node --import tsx --input-type=module <<'JS' import { GHIDRA_INVENTORY_OPERATIONS as inventory } from './src/ghidra/GhidraInventoryValues.ts'; import { GHIDRA_FUNCTION_OPERATIONS as functions } from './src/ghidra/GhidraFunctionValues.ts'; import { GHIDRA_MUTATING_OPERATIONS as mutations } from './src/ghidra/GhidraSessionValues.ts'; const reads = operations => operations.filter(name => !mutations.has(name)); console.log(JSON.stringify({ inventory: reads(inventory).length, functions: reads(functions).length, total: reads([...inventory, ...functions]).length })); JS ``` Observed output: ```text {"inventory":15,"functions":12,"total":27} ``` 2. Locate the current guide statements: ```sh rg -n 'exposes 26|all 26|the 26 read-only' docs/installation.md docs/ghidra-provider.md docs/windows-ghidra-p0.md ``` Observed four matches: the adapter summary, the installation guide's Windows lane description, the provider guide's Windows lane description, and the Windows guide's supported boundary. The count was checked twice using independent full and reduced registry imports; both returned 27. The documentation lookup returned the four current-scope matches on both inspections. ### Expected behavior Current guide descriptions of the full read-only operation inventory should agree with the source-owned inventory and the verifier's coverage gate at the same revision. That set contains 27 operations, split into 15 inventory operations and 12 function operations. A count-free description would also avoid the incorrect total. Past verification records should retain the counts established by their original runs; this report does not establish that their historical totals were wrong. ### Impact and scope P3: readers receive an inaccurate description of the current adapter inventory and Windows verification coverage. Following these statements does not establish a runtime failure, missing verifier coverage, or incorrect analysis output. No consequential behavior change was observed. Readers can derive the current set with the reproduction above. Real Windows execution, published-package behavior, and historical verification receipts remain outside this verification. ### REA version Exact output of `node scripts/rea.mjs --version`: ```text 6.8.0 ``` Source commit: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1; arm64. No Ghidra runtime was used. ### Target and artifact context Source registries, verification script, and authored documentation only; no binary target is required. ### Interface Other ### Earliest failure stage Unknown ### Relevant output or evidence At the stated baseline: - Current claims: `docs/installation.md:1015-1016` and `1549-1550`; `docs/ghidra-provider.md:296-303`; `docs/windows-ghidra-p0.md:14-22`. - Registry import output: `{"inventory":15,"functions":12,"total":27}`. Inputs are `src/ghidra/GhidraInventoryValues.ts:36-54`, `src/ghidra/GhidraFunctionValues.ts:59-73`, and the mutation exclusion at `src/ghidra/GhidraSessionValues.ts:24-27`. - `scripts/verify-real-ghidra-windows.mjs:169-178` invokes and validates the overview aggregate. Lines `271-291` derive the expected read-only set from these registries and reject missing, unexpected, or size-mismatched observations. The prose does not describe a separate 26-operation subset. - Supported caller path: `src/cli/coreBinaryCommands.ts:174-187` routes `inspect` to the overview workflow, and `src/application/EnhancedTools.ts:729-735` requests the aggregate. `src/ghidra/GhidraProviderCapabilities.ts:25-37` maps its internal name to the public overview name. - I found no test pinning the guide prose to 26. The inspected handshake tests instead derive expected membership/cardinality from the registries: `src/ghidra/GhidraSessionValues.test.ts:181-267` and `tests/boundary/providers/ghidra/ghidraClient.test.ts:1024-1050`. The focused command `npm run test:local -- src/application/BinaryOverview.test.ts src/ghidra/GhidraSessionValues.test.ts` passed both files, 32 tests total. These source tests support overview dispatch and handshake semantics; they do not establish real-provider acceptance or validate the prose counts. ### Analysis or suspected cause Source history shows that merged [PR #4754](https://github.com/morluto/rea/pull/4754), commit `ae029fe2f80b171a73df52e57b4a355f32f7c456`, added the internal read-only overview aggregate and updated the Windows verifier to exercise it. Its predecessor's inventory lacked that entry. The current guides retain the earlier total and fourteen-operation inventory split. The extra bridge observation is internal; the public overview workflow already existed. This report concerns the documented adapter/verifier operation count, not a claim that a new public tool was added. ### Additional context Related prior report [#2156](https://github.com/morluto/rea/issues/2156), item D11, concerned an older 19-versus-25 count in the conformance README. Merged [PR #2207](https://github.com/morluto/rea/pull/2207) replaced that specific statement with count-free wording, which remains correct at this baseline. The current guide mismatch follows the later aggregate addition and does not require repairing that README occurrence again. Closed [#2903](https://github.com/morluto/rea/issues/2903) concerned a verifier omitting byte-search execution when its expected set grew from 25 to 26. The current source verifier includes both byte search and the overview aggregate. This report does not claim that earlier verifier failure recurs. The separate Windows guide paragraph at `docs/windows-ghidra-p0.md:160-168` records prior ARM runs with 26 operations. Those original receipts were not checked, so that historical count is excluded from this finding.

bsakaguchi closed this issue

2026-10-31 00:50:37 +00:00

bsakaguchi referenced this issue

2026-10-31 01:13:25 +00:00

[PR #4549] [MERGED] fix(objc): isolate empty protocol selectors and category class names #6301