morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2478] [MERGED] fix: align MCP archive contracts and documentation #5259

New issue

Closed

opened 2026-10-31 01:05:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:05:13 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2478
Author: @N0zoM1z0
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/docs-and-mcp-drift-20261013

📝 Commits (1)

5da0c4e fix: align MCP archive contracts and documentation

📊 Changes

28 files changed (+2798 additions, -71 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+3 -2)
📝 .gitattributes (+3 -0)
📝 SECURITY.md (+6 -3)
📝 THIRD_PARTY_NOTICES.md (+7 -0)
📝 docs/adb-device-analysis.md (+2 -2)
📝 docs/client-configuration.md (+5 -0)
📝 docs/ghidra-riscv.md (+10 -10)
📝 docs/installation.md (+5 -7)
📝 docs/javascript-runtime-reconciliation.md (+11 -8)
📝 docs/managed-code-analysis.md (+3 -1)
📝 docs/raw-binary.md (+1 -1)
📝 docs/releasing.md (+9 -0)
➕ licenses/LGPL-2.0.txt (+480 -0)
📝 licenses/README.md (+27 -13)
➕ licenses/frida-17.23.2-COPYING.txt (+50 -0)
📝 licenses/npm-dependencies.txt (+127 -2)
📝 licenses/npm-runtime-notices.txt (+1588 -1)
📝 licenses/upstream-sources.json (+10 -0)
📝 package.json (+4 -2)
➕ scripts/generate-third-party-inventory.mjs (+120 -0)

...and 8 more files

📄 Description

Summary

Fixes #2454: correct the 12 confirmed documentation/behavior inconsistencies, including the Harmony MCP output-schema defect.

Problem and expected behavior

The domain accepted .hap, .hsp and .app/app-pack, but session output schemas omitted those formats. Real open_binary failed output validation after activating the target; binary_session failed too. Native view descriptions also recommended an unsupported summary request. Other audited guides, dependency notices and the release synchronization prerequisite had drifted.

Change and scope

Reuse ZIP_PACKAGE_FORMATS for domain archive typing and session output schemas. Add a production CLI/SDK-connected stdio lifecycle regression for all three Harmony formats, and extend the real HAP verifier through open/status/inventory/projection/close.
State the supported native view recipe and verify it alongside summary rejection and retained native reads.
Correct skill-root guidance, Windows PE DLL/transport scope, accepted reconciliation Evidence, extraction arguments, ADB lifecycle wording, RVE register count and the managed guide's stable anchor. Keep skill-root details in the client guide, including the existing Antigravity exception.
Regenerate the 586-entry locked inventory, cover all 174 runtime entries and retain all 149 original notice sections unchanged. Collect missing notices from integrity-verified npm archives; document Frida's missing standalone notice with explicitly scoped licensing supplements and pinned digests.
Add inventory/notice/provenance checks to docs:check, with negative regression coverage and complete licenses/ cache inputs. Preserve original upstream whitespace via one scoped Git attribute.
Make the ancestry-preserving release merge prerequisite explicit when GitHub merge commits are disabled. Repository merge settings are unchanged.

Root READMEs/translations, website/, ambiguous Hopper shutdown wording and the unverified macOS sleigh prerequisite are outside this change.

Contribution scope: ordinary fixes within existing tool and authority boundaries; no new provider, execution, injection, target mutation or protection-recovery capability. Additional maintainer scope decision is not applicable.

Contract and boundary impact

Owning boundary: existing domain ZIP formats now supply archive typing and shared lifecycle output schemas.
CLI/MCP: existing requests, provider choices and complete defaults remain; admitted Harmony results now validate. Native summary remains unsupported and guidance names the supported native kind/facets.
Evidence: identities, source bytes, retained originals, coverage and provenance are preserved.
Generated catalogs/skills: regenerated and checked; ignored outputs are not committed.
Package: updated distributed notices and supplemental texts; no dependency/toolchain changes or unrelated installation.

Evidence and regression coverage

The base public stdio regression reproduced Harmony output validation failures for the recognized formats; one initial harness attempt and a shared-host timeout were retained separately from product findings.
The fixed acceptance journey checks CLI/MCP normalized inventory parity, correct open/status formats and digests, graph components, closed state and unchanged bytes.
Real pinned Harmony HAP verification checks the same standard MCP opener/status journey and CLI/projection parity.
Native view SDK checks cover the advertised recipe, unsupported summary and healthy retained facets. A current stdio run using authentic earlier Ghidra Evidence separately confirms dispatch/guidance; it is not a fresh engine run.
Notice checks reject missing/duplicate entries, altered metadata/fingerprint and changed preserved texts. All newly collected original license texts and old notice sections are retained exactly. This is record/provenance validation, not proof of complete upstream legal attribution.

Validation performed

npm run test:focused -- tests/acceptance/harmonyArtifactJourney.test.ts tests/boundary/filesystem/thirdPartyInventory.test.ts tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/filesystem/harmony/application.test.ts — 31 passed.
npm run verify:harmony with the pinned public HAP — passed; standard SDK stdio open/status/inventory/projection/close, CLI parity and unchanged bytes.
npm run check:fast — typecheck/lint passed.
npm run docs:check, npm run docs:build, npm run licenses:check — passed.
Installed VitePress link/anchor check — 1,126 local links and 894 fragments, no errors.
Public stdio native guidance/retained-view probe and literal JSON tool-example schema check — passed; intentional Evidence placeholders are not executable examples.

Checks run with bounded CPU/memory and isolated runtime configuration. Detailed private receipts remain outside Git. npm run verify:package also passed: isolated pack/install, CLI/MCP discovery and workflows, setup/backup/recovery/skill checks, Evidence/lifecycle and verified empty verifier descendants. Latest integration onto 172407787 preserves the upstream qlog, Flutter and Windows updates: six focused files passed (38 tests passed, one optional qlog oracle skipped), including real CLI/stdio qlog acceptance, bounded decoder-heap failure recovery and the new Dart AOT MCP coverage. Fresh typecheck/lint, docs check/build, real HAP/native SDK probes, links and format checks also passed. A separate cache experiment changed only the notice fingerprint: the previously successful docs task missed its cache and rejected the change; restoring the exact original bytes passed again.

Compatibility, safety, and release

No breaking request behavior or expanded target authority. Windows/macOS engines, GUI/database ownership and live ADB/device behavior were not newly reverified. Existing semantic, malformed-input, cancellation and cleanup coverage is retained. Frida's standalone binding/prebuild attribution gap is explicit; no copyright holder/year or complete legal coverage is inferred.

Before merge

Concrete problem and linked issue.
Scope/authority resolved within existing boundaries.
Owning docs/contracts and generated metadata updated.
Relevant production workflow and negative regression coverage.
Relevant rebased integration tests, fresh typecheck/lint, docs check/build, real HAP/native SDK workflows, links and full format check passed.
CI green: all 39 checks succeeded on 5da0c4e2042665cb5d32456a90a0680344f8a513; CI run 38344019129.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2478 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/docs-and-mcp-drift-20261013` --- ### 📝 Commits (1) - [`5da0c4e`](https://github.com/morluto/rea/commit/5da0c4e2042665cb5d32456a90a0680344f8a513) fix: align MCP archive contracts and documentation ### 📊 Changes **28 files changed** (+2798 additions, -71 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+3 -2) 📝 `.gitattributes` (+3 -0) 📝 `SECURITY.md` (+6 -3) 📝 `THIRD_PARTY_NOTICES.md` (+7 -0) 📝 `docs/adb-device-analysis.md` (+2 -2) 📝 `docs/client-configuration.md` (+5 -0) 📝 `docs/ghidra-riscv.md` (+10 -10) 📝 `docs/installation.md` (+5 -7) 📝 `docs/javascript-runtime-reconciliation.md` (+11 -8) 📝 `docs/managed-code-analysis.md` (+3 -1) 📝 `docs/raw-binary.md` (+1 -1) 📝 `docs/releasing.md` (+9 -0) ➕ `licenses/LGPL-2.0.txt` (+480 -0) 📝 `licenses/README.md` (+27 -13) ➕ `licenses/frida-17.23.2-COPYING.txt` (+50 -0) 📝 `licenses/npm-dependencies.txt` (+127 -2) 📝 `licenses/npm-runtime-notices.txt` (+1588 -1) 📝 `licenses/upstream-sources.json` (+10 -0) 📝 `package.json` (+4 -2) ➕ `scripts/generate-third-party-inventory.mjs` (+120 -0) _...and 8 more files_ </details> ### 📄 Description ## Summary Fixes #2454: correct the 12 confirmed documentation/behavior inconsistencies, including the Harmony MCP output-schema defect. ## Problem and expected behavior The domain accepted `.hap`, `.hsp` and `.app`/`app-pack`, but session output schemas omitted those formats. Real `open_binary` failed output validation after activating the target; `binary_session` failed too. Native view descriptions also recommended an unsupported summary request. Other audited guides, dependency notices and the release synchronization prerequisite had drifted. ## Change and scope - Reuse `ZIP_PACKAGE_FORMATS` for domain archive typing and session output schemas. Add a production CLI/SDK-connected stdio lifecycle regression for all three Harmony formats, and extend the real HAP verifier through open/status/inventory/projection/close. - State the supported native view recipe and verify it alongside summary rejection and retained native reads. - Correct skill-root guidance, Windows PE DLL/transport scope, accepted reconciliation Evidence, extraction arguments, ADB lifecycle wording, RVE register count and the managed guide's stable anchor. Keep skill-root details in the client guide, including the existing Antigravity exception. - Regenerate the 586-entry locked inventory, cover all 174 runtime entries and retain all 149 original notice sections unchanged. Collect missing notices from integrity-verified npm archives; document Frida's missing standalone notice with explicitly scoped licensing supplements and pinned digests. - Add inventory/notice/provenance checks to `docs:check`, with negative regression coverage and complete `licenses/` cache inputs. Preserve original upstream whitespace via one scoped Git attribute. - Make the ancestry-preserving release merge prerequisite explicit when GitHub merge commits are disabled. Repository merge settings are unchanged. Root READMEs/translations, `website/`, ambiguous Hopper shutdown wording and the unverified macOS `sleigh` prerequisite are outside this change. Contribution scope: ordinary fixes within existing tool and authority boundaries; no new provider, execution, injection, target mutation or protection-recovery capability. Additional maintainer scope decision is not applicable. ## Contract and boundary impact - Owning boundary: existing domain ZIP formats now supply archive typing and shared lifecycle output schemas. - CLI/MCP: existing requests, provider choices and complete defaults remain; admitted Harmony results now validate. Native summary remains unsupported and guidance names the supported native kind/facets. - Evidence: identities, source bytes, retained originals, coverage and provenance are preserved. - Generated catalogs/skills: regenerated and checked; ignored outputs are not committed. - Package: updated distributed notices and supplemental texts; no dependency/toolchain changes or unrelated installation. ## Evidence and regression coverage - The base public stdio regression reproduced Harmony output validation failures for the recognized formats; one initial harness attempt and a shared-host timeout were retained separately from product findings. - The fixed acceptance journey checks CLI/MCP normalized inventory parity, correct open/status formats and digests, graph components, closed state and unchanged bytes. - Real pinned Harmony HAP verification checks the same standard MCP opener/status journey and CLI/projection parity. - Native view SDK checks cover the advertised recipe, unsupported summary and healthy retained facets. A current stdio run using authentic earlier Ghidra Evidence separately confirms dispatch/guidance; it is not a fresh engine run. - Notice checks reject missing/duplicate entries, altered metadata/fingerprint and changed preserved texts. All newly collected original license texts and old notice sections are retained exactly. This is record/provenance validation, not proof of complete upstream legal attribution. ## Validation performed - `npm run test:focused -- tests/acceptance/harmonyArtifactJourney.test.ts tests/boundary/filesystem/thirdPartyInventory.test.ts tests/boundary/mcp/analysisViewMcp.test.ts tests/boundary/filesystem/harmony/application.test.ts` — 31 passed. - `npm run verify:harmony` with the pinned public HAP — passed; standard SDK stdio open/status/inventory/projection/close, CLI parity and unchanged bytes. - `npm run check:fast` — typecheck/lint passed. - `npm run docs:check`, `npm run docs:build`, `npm run licenses:check` — passed. - Installed VitePress link/anchor check — 1,126 local links and 894 fragments, no errors. - Public stdio native guidance/retained-view probe and literal JSON tool-example schema check — passed; intentional Evidence placeholders are not executable examples. Checks run with bounded CPU/memory and isolated runtime configuration. Detailed private receipts remain outside Git. `npm run verify:package` also passed: isolated pack/install, CLI/MCP discovery and workflows, setup/backup/recovery/skill checks, Evidence/lifecycle and verified empty verifier descendants. Latest integration onto `172407787` preserves the upstream qlog, Flutter and Windows updates: six focused files passed (38 tests passed, one optional qlog oracle skipped), including real CLI/stdio qlog acceptance, bounded decoder-heap failure recovery and the new Dart AOT MCP coverage. Fresh typecheck/lint, docs check/build, real HAP/native SDK probes, links and format checks also passed. A separate cache experiment changed only the notice fingerprint: the previously successful docs task missed its cache and rejected the change; restoring the exact original bytes passed again. ## Compatibility, safety, and release No breaking request behavior or expanded target authority. Windows/macOS engines, GUI/database ownership and live ADB/device behavior were not newly reverified. Existing semantic, malformed-input, cancellation and cleanup coverage is retained. Frida's standalone binding/prebuild attribution gap is explicit; no copyright holder/year or complete legal coverage is inferred. ## Before merge - [x] Concrete problem and linked issue. - [x] Scope/authority resolved within existing boundaries. - [x] Owning docs/contracts and generated metadata updated. - [x] Relevant production workflow and negative regression coverage. - [x] Relevant rebased integration tests, fresh typecheck/lint, docs check/build, real HAP/native SDK workflows, links and full format check passed. - [x] CI green: all 39 checks succeeded on `5da0c4e2042665cb5d32456a90a0680344f8a513`; CI run [38344019129](https://github.com/morluto/rea/actions/runs/38344019129). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:05:13 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:43:52 +00:00

[PR #5353] [MERGED] docs(installation): document targeted npx dependency recovery #6890

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5259

No description provided.

Rows
Columns