[PR #3225] [CLOSED] fix(managed): report InitLocals comparison changes #5655

New issue

Closed

opened 2026-10-31 01:08:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:08:18 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3225
Author: @Aurantium-47
Created: 10/14/2026
Status: ❌ Closed

Base: main ← Head: codex/rea-managed-init-locals

📝 Commits (2)

4452adc fix(managed): report InitLocals comparison changes
1c2a6e0 Merge remote-tracking branch 'origin/main' into HEAD

📊 Changes

3 files changed (+90 additions, -5 deletions)

View changed files

📝 docs/managed-code-analysis.md (+2 -1)
📝 src/domain/managed/managedMemberComparisonItems.ts (+10 -4)
📝 tests/boundary/providers/managed/managedMemberComparisonFromMetadata.test.ts (+78 -0)

📄 Description

Superseded by #3814 (merged). Current main now compares observed method-header differences, including init_locals. The three original regression cases from this PR pass against main 9eb829aca34be36ff112826337996f6139f82eff together with the existing focused suite (69 tests passed). Closing this older overlapping PR.

Summary

Report a managed method's InitLocals change in the existing metadata comparison dimension. Identical CIL and signatures currently allow such methods to be reported as unchanged.

Problem and expected behavior

Clearing only the fat-header initialization bit in a method containing localloc leaves its instruction bytes intact. The flag controls whether the allocated memory is zero-initialized (Microsoft reference). Preserve the matched pair while reporting the observed metadata difference.

Before: status: "unchanged", dimensions: []. After: status: "changed", dimensions: ["metadata"].

This was found by inspecting the comparison owner; no existing issue or overlapping repair was found.

Change and scope

Compare init_locals when both method bodies are completely inspected. Keep incomplete bodies unknown, reuse the current metadata dimension, and update its documentation. The CIL fingerprints, pairing rules, local-signature tokens and MaxStack handling are unchanged.

Contract and boundary impact

Semantic owner and earliest changed stage: methodDimensions in managedMemberComparisonItems.ts.
Contribution scope and maintainer decision: routine correction to existing offline comparison; no advance capability decision required.
CLI/MCP/tool catalog: no schema or argument changes; affected matched methods and summary counts now reflect the metadata change.
Provider, bridge and platform compatibility: comparison of existing observations only; no provider changes.
Evidence/provenance: preserve input evidence links and identities; report a static metadata difference, not an observed runtime outcome.
Target authority, cleanup and generated/package metadata: unchanged.

Expected effects:

Read existing files or captured data.

No target execution, injection, mutation, network contact or protection recovery is added.

Evidence and regression coverage

Two new byte-built PE regressions exercise both flag-change directions and equal-flag controls. Both change cases fail on the unmodified comparison owner.
An additional regression feeds a malformed header through the actual inspector. Comparing its unknown initialization flag with a complete body's false value remains unknown in both directions, with body-coverage rather than an invented metadata difference.
A small C# fixture compiled locally reproduces the same problem: one header byte changes, raw CIL hashes stay equal, and the repaired comparison reports changed / metadata. The DLL was inspected, not executed.
Observed, derived and inferred claims remain distinguishable.
Evidence identity and incomplete outcomes remain preserved.

Validation performed

On Windows x64 with pinned Node 24.18.0 and npm 11.16.0, in an isolated branch:

npm run test:focused -- tests/boundary/providers/managed/managedMemberComparisonFromMetadata.test.ts tests/boundary/providers/managed/managedMemberComparisonPartialBodies.test.ts tests/boundary/providers/managed/managedMemberComparison.test.ts — 60 passed.
npm run check — passed, including typecheck, build, lint, formatting, unused-code/metadata checks, module boundaries and architecture guards. Lint has no errors; this guard adds a complexity warning for methodDimensions (23 against a warning threshold of 20).
npm run docs:check — passed, including the five README consistency tests.
git diff --check — passed.

Compatibility, safety and release

No migration, new field, dependency or provider permission. Verification covers production static inspection/comparison and the compiled local fixture; no CLR execution or real analysis-engine run is claimed. No generated outputs or fixture binaries are included.

AI assistance: OpenAI Codex was used for investigation, implementation, tests and independent code review.

Before merge

Concrete problem, focused outcome and Conventional Commit title.
Scope and authority resolved for an existing static workflow.
Regression and unknown-data controls cover the changed behavior.
Owning documentation updated; no generated contract change required.
Final diff checked for unrelated changes, secrets and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3225 **Author:** [@Aurantium-47](https://github.com/Aurantium-47) **Created:** 10/14/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `codex/rea-managed-init-locals` --- ### 📝 Commits (2) - [`4452adc`](https://github.com/morluto/rea/commit/4452adc2a3436543229c339588486cb88c1a5d79) fix(managed): report InitLocals comparison changes - [`1c2a6e0`](https://github.com/morluto/rea/commit/1c2a6e00274df4acaf10ce00201806db64b4b236) Merge remote-tracking branch 'origin/main' into HEAD ### 📊 Changes **3 files changed** (+90 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `docs/managed-code-analysis.md` (+2 -1) 📝 `src/domain/managed/managedMemberComparisonItems.ts` (+10 -4) 📝 `tests/boundary/providers/managed/managedMemberComparisonFromMetadata.test.ts` (+78 -0) </details> ### 📄 Description **Superseded by #3814 (merged).** Current main now compares observed method-header differences, including `init_locals`. The three original regression cases from this PR pass against main `9eb829aca34be36ff112826337996f6139f82eff` together with the existing focused suite (69 tests passed). Closing this older overlapping PR. --- ## Summary Report a managed method's `InitLocals` change in the existing `metadata` comparison dimension. Identical CIL and signatures currently allow such methods to be reported as unchanged. ## Problem and expected behavior Clearing only the fat-header initialization bit in a method containing `localloc` leaves its instruction bytes intact. The flag controls whether the allocated memory is zero-initialized ([Microsoft reference](https://learn.microsoft.com/en-us/dotnet/api/system.reflection.emit.opcodes.localloc)). Preserve the matched pair while reporting the observed metadata difference. Before: `status: "unchanged", dimensions: []`. After: `status: "changed", dimensions: ["metadata"]`. This was found by inspecting the comparison owner; no existing issue or overlapping repair was found. ## Change and scope Compare `init_locals` when both method bodies are completely inspected. Keep incomplete bodies unknown, reuse the current metadata dimension, and update its documentation. The CIL fingerprints, pairing rules, local-signature tokens and MaxStack handling are unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: `methodDimensions` in `managedMemberComparisonItems.ts`. - Contribution scope and maintainer decision: routine correction to existing offline comparison; no advance capability decision required. - CLI/MCP/tool catalog: no schema or argument changes; affected matched methods and summary counts now reflect the metadata change. - Provider, bridge and platform compatibility: comparison of existing observations only; no provider changes. - Evidence/provenance: preserve input evidence links and identities; report a static metadata difference, not an observed runtime outcome. - Target authority, cleanup and generated/package metadata: unchanged. Expected effects: - [x] Read existing files or captured data. No target execution, injection, mutation, network contact or protection recovery is added. ## Evidence and regression coverage - Two new byte-built PE regressions exercise both flag-change directions and equal-flag controls. Both change cases fail on the unmodified comparison owner. - An additional regression feeds a malformed header through the actual inspector. Comparing its unknown initialization flag with a complete body's `false` value remains `unknown` in both directions, with `body-coverage` rather than an invented metadata difference. - A small C# fixture compiled locally reproduces the same problem: one header byte changes, raw CIL hashes stay equal, and the repaired comparison reports `changed` / `metadata`. The DLL was inspected, not executed. - [x] Observed, derived and inferred claims remain distinguishable. - [x] Evidence identity and incomplete outcomes remain preserved. ## Validation performed On Windows x64 with pinned Node 24.18.0 and npm 11.16.0, in an isolated branch: - `npm run test:focused -- tests/boundary/providers/managed/managedMemberComparisonFromMetadata.test.ts tests/boundary/providers/managed/managedMemberComparisonPartialBodies.test.ts tests/boundary/providers/managed/managedMemberComparison.test.ts` — 60 passed. - `npm run check` — passed, including typecheck, build, lint, formatting, unused-code/metadata checks, module boundaries and architecture guards. Lint has no errors; this guard adds a complexity warning for `methodDimensions` (23 against a warning threshold of 20). - `npm run docs:check` — passed, including the five README consistency tests. - `git diff --check` — passed. ## Compatibility, safety and release No migration, new field, dependency or provider permission. Verification covers production static inspection/comparison and the compiled local fixture; no CLR execution or real analysis-engine run is claimed. No generated outputs or fixture binaries are included. AI assistance: OpenAI Codex was used for investigation, implementation, tests and independent code review. ## Before merge - [x] Concrete problem, focused outcome and Conventional Commit title. - [x] Scope and authority resolved for an existing static workflow. - [x] Regression and unknown-data controls cover the changed behavior. - [x] Owning documentation updated; no generated contract change required. - [x] Final diff checked for unrelated changes, secrets and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:08:18 +00:00