[PR #2790] [MERGED] feat(evm): inspect lossless Solidity terminal CBOR metadata #5394

New issue

Closed

opened 2026-10-31 01:06:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:06:17 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2790
Author: @morluto
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: codex/review-fixes-pr-2420

📝 Commits (4)

0cf1ceb feat(evm): retain lossless terminal CBOR metadata
6d22ed5 merge: integrate upstream and verify compiled metadata coverage
183d212 merge: integrate current contracts and strengthen metadata verification
c55e59e fix(evm): resolve metadata review findings and integrate main

📊 Changes

24 files changed (+1002 additions, -5 deletions)

View changed files

📝 .github/workflows/real-evm-interface.yml (+2 -0)
📝 docs/evm-bytecode.md (+24 -0)
➕ docs/specs/solidity/cbor-metadata/plan.md (+33 -0)
➕ docs/specs/solidity/cbor-metadata/spec.md (+43 -0)
➕ docs/specs/solidity/cbor-metadata/tasks.md (+8 -0)
➕ docs/specs/solidity/cbor-metadata/verification.md (+43 -0)
📝 licenses/npm-dependencies.txt (+6 -1)
📝 licenses/npm-runtime-notices.txt (+229 -1)
📝 package-lock.json (+10 -0)
📝 package.json (+2 -0)
📝 scripts/ci/scopes.mjs (+1 -0)
📝 scripts/verify-evm-interface.mjs (+20 -0)
➕ scripts/verify-solidity-metadata.mjs (+105 -0)
📝 src/domain/evm/evmInterface.test.ts (+8 -0)
📝 src/domain/evm/evmInterface.ts (+19 -0)
➕ src/domain/evm/solidityMetadata.ts (+89 -0)
📝 src/evm/EvmoleInterfaceProvider.ts (+3 -0)
📝 src/evm/EvmoleInterfaceWorker.ts (+2 -0)
➕ src/evm/SolidityMetadata.test.ts (+96 -0)
➕ src/evm/SolidityMetadata.ts (+158 -0)

...and 4 more files

📄 Description

EVM interface inspection now retains lossless terminal Solidity CBOR metadata from the exact selected bytecode inside the existing owned worker. Typed scalar keys, exact decimal integers, candidate ranges, compiler-version declarations and explicit unavailable interpretations remain available through complete Evidence and selected summaries. Metadata does not authenticate Solidity origin or deployment; this adds no target execution, RPC access or metadata fetching.

This replaces #2420 because its organization-owned fork rejects maintainer pushes with HTTP 403. The original implementation is by @matbrgz (Matheus Breguêz), verified against the original PR author and commit metadata. This branch preserves the original commits and their attribution, including 0cf1ceba1538d779c2b0c1e9cc691da678022abe, 6d22ed57ded343bdff96073808332706e2b9b1ef and 183d21210acda588184dd9a0897047523aa644b2; the work was merged with main rather than rewritten or squashed.

The maintainer follow-up resolves the MCP test conflict while preserving both decoded metadata and the current inspect spy. Warm parser timing now excludes equality assertions, and the verification document corrects the previous warm figure that included assertions. Complete and summary MCP cases share a decoded trailer; historical Evidence explicitly omits the metadata field. The new main dependency inventory and runtime notices include the pinned cborg dependency.

Validation for this follow-up is source inspection and diff checks. Tests, static checks, documentation checks and provider reruns were skipped at the maintainer's explicit request. The original PR documents earlier verification; those runs do not establish correctness of this changed head. Updated decode-only warm timings and full Linux provider/resource/cleanup verification remain unmeasured or unverified.

Refs #2388 and #2383. Supplied metadata JSON commitment binding remains deferred, so this does not close the entire Solidity provenance issue.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2790 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/review-fixes-pr-2420` --- ### 📝 Commits (4) - [`0cf1ceb`](https://github.com/morluto/rea/commit/0cf1ceba1538d779c2b0c1e9cc691da678022abe) feat(evm): retain lossless terminal CBOR metadata - [`6d22ed5`](https://github.com/morluto/rea/commit/6d22ed57ded343bdff96073808332706e2b9b1ef) merge: integrate upstream and verify compiled metadata coverage - [`183d212`](https://github.com/morluto/rea/commit/183d21210acda588184dd9a0897047523aa644b2) merge: integrate current contracts and strengthen metadata verification - [`c55e59e`](https://github.com/morluto/rea/commit/c55e59ee028ae262f0d4595233732609c142cf96) fix(evm): resolve metadata review findings and integrate main ### 📊 Changes **24 files changed** (+1002 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/real-evm-interface.yml` (+2 -0) 📝 `docs/evm-bytecode.md` (+24 -0) ➕ `docs/specs/solidity/cbor-metadata/plan.md` (+33 -0) ➕ `docs/specs/solidity/cbor-metadata/spec.md` (+43 -0) ➕ `docs/specs/solidity/cbor-metadata/tasks.md` (+8 -0) ➕ `docs/specs/solidity/cbor-metadata/verification.md` (+43 -0) 📝 `licenses/npm-dependencies.txt` (+6 -1) 📝 `licenses/npm-runtime-notices.txt` (+229 -1) 📝 `package-lock.json` (+10 -0) 📝 `package.json` (+2 -0) 📝 `scripts/ci/scopes.mjs` (+1 -0) 📝 `scripts/verify-evm-interface.mjs` (+20 -0) ➕ `scripts/verify-solidity-metadata.mjs` (+105 -0) 📝 `src/domain/evm/evmInterface.test.ts` (+8 -0) 📝 `src/domain/evm/evmInterface.ts` (+19 -0) ➕ `src/domain/evm/solidityMetadata.ts` (+89 -0) 📝 `src/evm/EvmoleInterfaceProvider.ts` (+3 -0) 📝 `src/evm/EvmoleInterfaceWorker.ts` (+2 -0) ➕ `src/evm/SolidityMetadata.test.ts` (+96 -0) ➕ `src/evm/SolidityMetadata.ts` (+158 -0) _...and 4 more files_ </details> ### 📄 Description EVM interface inspection now retains lossless terminal Solidity CBOR metadata from the exact selected bytecode inside the existing owned worker. Typed scalar keys, exact decimal integers, candidate ranges, compiler-version declarations and explicit unavailable interpretations remain available through complete Evidence and selected summaries. Metadata does not authenticate Solidity origin or deployment; this adds no target execution, RPC access or metadata fetching. This replaces #2420 because its organization-owned fork rejects maintainer pushes with HTTP 403. The original implementation is by @matbrgz (Matheus Breguêz), verified against the original PR author and commit metadata. This branch preserves the original commits and their attribution, including `0cf1ceba1538d779c2b0c1e9cc691da678022abe`, `6d22ed57ded343bdff96073808332706e2b9b1ef` and `183d21210acda588184dd9a0897047523aa644b2`; the work was merged with main rather than rewritten or squashed. The maintainer follow-up resolves the MCP test conflict while preserving both decoded metadata and the current inspect spy. Warm parser timing now excludes equality assertions, and the verification document corrects the previous warm figure that included assertions. Complete and summary MCP cases share a decoded trailer; historical Evidence explicitly omits the metadata field. The new main dependency inventory and runtime notices include the pinned cborg dependency. Validation for this follow-up is source inspection and diff checks. Tests, static checks, documentation checks and provider reruns were skipped at the maintainer's explicit request. The original PR documents earlier verification; those runs do not establish correctness of this changed head. Updated decode-only warm timings and full Linux provider/resource/cleanup verification remain unmeasured or unverified. Refs #2388 and #2383. Supplied metadata JSON commitment binding remains deferred, so this does not close the entire Solidity provenance issue. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:06:17 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5394

No description provided.

Rows
Columns