morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8367] [Bug] Comparing the same Kuna function Evidence reports ambiguous identity #6568

New issue

Open

opened 2026-11-01 21:12:19 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-11-01 21:12:19 +00:00

Owner

Originally created by @morluto on GitHub (Oct 31, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8367

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

compare_functions reports function_match.status: "ambiguous" when both inputs are the same retained Kuna analyze_function Evidence ID. The identical authenticated record describes the same selected function observation on both sides; unknown symbol origin and missing cross-record coordinate commitments do not make those two references different observations.

Reproduction

Build an owned arm64 Mach-O containing two procedures and do not execute it:

.section __TEXT,__text,regular,pure_instructions
.p2align 2
.globl _main
_main:
  nop
  bl _goal
  ret
.globl _goal
_goal:
  mov w0, #42
  ret

Build with clang -arch arm64 -Wl,-e,_main fixture.s -o fixture. Open it in REA MCP with verified Kuna 1.986.
Call analyze_function({"procedure":"_main","detail":"complete"}). Use its Evidence ID as both left and right retained-evidence inputs to compare_functions.
function_match is {status:"ambiguous",method:"explicit",left_name:"_main",right_name:"_main"} and its identity dimension is unknown. The exact pseudocode and assembly dimensions are unchanged. The comparison cites the same Evidence ID on both sides.
With Ghidra 12.1.4 on the same target, the identical-record comparison reports function_match.status: "matched"; comparing _main with the distinct _goal reports mismatched. With Kuna, comparing the distinct dossiers is also ambiguous, which is a separate uncertainty and should not be resolved by this self-comparison case.

All calls used public stdio MCP and advertised full output schemas with the TypeScript SDK. The target was unchanged and not executed.

Real Kuna 1.988 control on macOS arm64: in both compact and full stdio MCP schema profiles, baseline ae8223cc reports the same retained _main Evidence as ambiguous; #8442 head 8041857a reports matched with same-evidence and an unchanged identity dimension. Comparison with distinct _goal Evidence remains ambiguous. Comments, calls, references, strings/names, and CFG remain unknown; this does not establish behavioral equivalence or complete discovery. Successful outputs validated against the advertised output schemas. The unexecuted fixture SHA-256 266a48ebeff34f2d28a2432dc0cf379872ad73f5212c63aac60ad6fe49033eb5 remained unchanged. The baseline is a separate branch, not the PR's parent; one fixture and host were tested.

Expected behavior

Represent that two references to one authenticated function observation are the same observation. Preserve unknown source-symbol origin, incomplete facets and any unknown overall comparison status; this does not prove that the decompiler correctly identified the real function, that its body is complete, or that two distinct records with equal-looking addresses are the same function. A same-Evidence correspondence may need a distinct match method or another explicit contract choice.

Impact and scope

An agent comparing or deduplicating a retained dossier can be told that the identity of the exact same selected record is ambiguous, even though the comparison itself links both sides to that ID. Reproduced with one Kuna 1.986 Mach-O fixture; Ghidra self and different-entry controls were exercised. Other providers and platforms are unverified.

REA version

d54a4661da

Runtime and platform

Node 24.22.1; macOS 26.3 arm64; Kuna 1.986; Ghidra 12.1.4 / JDK 21; TypeScript MCP SDK 2.3.1.

Target and artifact context

Synthetic unexecuted arm64 Mach-O, SHA-256 266a48ebeff34f2d28a2432dc0cf379872ad73f5212c63aac60ad6fe49033eb5; same target on both sides, unchanged.

Interface

MCP

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Kuna _main record ev_119924bb8d024c7ee665bb5fa48887523b388291f610dccf334ed2949bb53d62 was passed as both inputs; both comparison links refer to that record. Its procedure entry is 0x1000002d8, and the provider profile has no function_coordinate_context. The Ghidra control includes a coordinate commitment and reports a same-entry match. The different Kuna _goal record is at 0x1000002e4 and remains ambiguous under the current rules.

Analysis or suspected cause

Source-derived: functionSnapshotCoordinateContext requires compatible coordinate commitments before same-entry matching; functionMatch then falls back to stable symbol origin, unavailable for this Kuna dossier. The current path does not distinguish equal authenticated Evidence IDs. This is not a request to weaken mapping or symbol safeguards for different records.

Additional context

Related #8173 concerns independent origin evidence for distinct Kuna observations; #8213 fixed same-entry correspondence with compatible Ghidra coordinates. This report is the narrower identical-record case, where a cross-record coordinate inference is unnecessary.

cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

Originally created by @morluto on GitHub (Oct 31, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8367 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `compare_functions` reports `function_match.status: "ambiguous"` when both inputs are the **same retained Kuna `analyze_function` Evidence ID**. The identical authenticated record describes the same selected function observation on both sides; unknown symbol origin and missing cross-record coordinate commitments do not make those two references different observations. ### Reproduction Build an owned arm64 Mach-O containing two procedures and do not execute it: ```asm .section __TEXT,__text,regular,pure_instructions .p2align 2 .globl _main _main: nop bl _goal ret .globl _goal _goal: mov w0, #42 ret ``` 1. Build with `clang -arch arm64 -Wl,-e,_main fixture.s -o fixture`. Open it in REA MCP with verified Kuna 1.986. 2. Call `analyze_function({"procedure":"_main","detail":"complete"})`. Use its Evidence ID as **both** `left` and `right` retained-evidence inputs to `compare_functions`. 3. `function_match` is `{status:"ambiguous",method:"explicit",left_name:"_main",right_name:"_main"}` and its identity dimension is unknown. The exact pseudocode and assembly dimensions are unchanged. The comparison cites the same Evidence ID on both sides. 4. With Ghidra 12.1.4 on the same target, the identical-record comparison reports `function_match.status: "matched"`; comparing `_main` with the distinct `_goal` reports `mismatched`. With Kuna, comparing the distinct dossiers is also ambiguous, which is a separate uncertainty and should not be resolved by this self-comparison case. All calls used public stdio MCP and advertised full output schemas with the TypeScript SDK. The target was unchanged and not executed. Real Kuna 1.988 control on macOS arm64: in both compact and full stdio MCP schema profiles, baseline `ae8223cc` reports the same retained `_main` Evidence as ambiguous; #8442 head `8041857a` reports `matched` with `same-evidence` and an unchanged identity dimension. Comparison with distinct `_goal` Evidence remains ambiguous. Comments, calls, references, strings/names, and CFG remain unknown; this does not establish behavioral equivalence or complete discovery. Successful outputs validated against the advertised output schemas. The unexecuted fixture SHA-256 `266a48ebeff34f2d28a2432dc0cf379872ad73f5212c63aac60ad6fe49033eb5` remained unchanged. The baseline is a separate branch, not the PR's parent; one fixture and host were tested. ### Expected behavior Represent that two references to one authenticated function observation are the same observation. Preserve unknown source-symbol origin, incomplete facets and any unknown overall comparison status; this does **not** prove that the decompiler correctly identified the real function, that its body is complete, or that two distinct records with equal-looking addresses are the same function. A same-Evidence correspondence may need a distinct match method or another explicit contract choice. ### Impact and scope An agent comparing or deduplicating a retained dossier can be told that the identity of the exact same selected record is ambiguous, even though the comparison itself links both sides to that ID. Reproduced with one Kuna 1.986 Mach-O fixture; Ghidra self and different-entry controls were exercised. Other providers and platforms are unverified. ### REA version d54a4661da20382ad8456564a08569fdd24131c5 ### Runtime and platform Node 24.22.1; macOS 26.3 arm64; Kuna 1.986; Ghidra 12.1.4 / JDK 21; TypeScript MCP SDK 2.3.1. ### Target and artifact context Synthetic unexecuted arm64 Mach-O, SHA-256 `266a48ebeff34f2d28a2432dc0cf379872ad73f5212c63aac60ad6fe49033eb5`; same target on both sides, unchanged. ### Interface MCP ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Kuna `_main` record `ev_119924bb8d024c7ee665bb5fa48887523b388291f610dccf334ed2949bb53d62` was passed as both inputs; both comparison links refer to that record. Its procedure entry is `0x1000002d8`, and the provider profile has no `function_coordinate_context`. The Ghidra control includes a coordinate commitment and reports a same-entry match. The different Kuna `_goal` record is at `0x1000002e4` and remains ambiguous under the current rules. ### Analysis or suspected cause Source-derived: [`functionSnapshotCoordinateContext`](https://github.com/morluto/rea/blob/d54a4661da20382ad8456564a08569fdd24131c5/src/domain/functionDossierEvidence.ts#L32-L49) requires compatible coordinate commitments before `same-entry` matching; [`functionMatch`](https://github.com/morluto/rea/blob/d54a4661da20382ad8456564a08569fdd24131c5/src/domain/functionComparisonNormalization.ts#L22-L71) then falls back to stable symbol origin, unavailable for this Kuna dossier. The current path does not distinguish equal authenticated Evidence IDs. This is not a request to weaken mapping or symbol safeguards for different records. ### Additional context Related #8173 concerns independent origin evidence for distinct Kuna observations; #8213 fixed same-entry correspondence with compatible Ghidra coordinates. This report is the narrower identical-record case, where a cross-record coordinate inference is unnecessary. cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

bsakaguchi added the

bug

triage

labels

2026-11-01 21:12:19 +00:00

bsakaguchi commented

2026-11-01 21:12:19 +00:00

Author

Owner

@morluto commented on GitHub (Nov 1, 2026):

Follow-up through the public workflow: I imported the real Kuna 1.986 source bundle from the original reproduction into a fresh, target-free stdio MCP session, then compared the retained _main Evidence with itself and passed the resulting comparison by retained reference to find_changed_behavior. The server reported no open binary; the bundle's SHA-256 was unchanged.

The identical-record comparison remained ambiguous, with two unchanged dimensions and six unknown dimensions. The downstream result reported behavior_status: unknown, no observed changes or static candidates, and six unresolved findings, including the identity finding. A separate _main versus _goal comparison stayed ambiguous and its downstream result listed three static candidates and five unresolved findings; these are differences between the selected records, not observed behavior changes. This was a single existing real-provider fixture replayed offline, not a new live-provider run or autonomous-agent study.

Design detail from the current source: changing only function_match.status would leave the identity dimension unknown, because its owner separately requires sameEntry or stable symbol origins. The relationships comparison also separately requires an established coordinate context. A same-authenticated-observation correspondence could resolve the first without asserting that distinct records share coordinates, that unavailable facets are complete, or that behavior is unchanged. The current public match schema only admits symbol, same-entry, and explicit, so a distinct method would change the advertised full output schema and needs schema/client and historical-Evidence verification. The correct treatment of self-comparison relationship coverage is a separate decision; it should not be silently promoted to complete merely because both inputs are the same.

@morluto commented on GitHub (Nov 1, 2026): Follow-up through the public workflow: I imported the real Kuna 1.986 source bundle from the original reproduction into a fresh, target-free stdio MCP session, then compared the retained `_main` Evidence with itself and passed the resulting comparison by retained reference to `find_changed_behavior`. The server reported no open binary; the bundle's SHA-256 was unchanged. The identical-record comparison remained `ambiguous`, with two unchanged dimensions and six unknown dimensions. The downstream result reported `behavior_status: unknown`, no observed changes or static candidates, and six unresolved findings, including the identity finding. A separate `_main` versus `_goal` comparison stayed ambiguous and its downstream result listed three static candidates and five unresolved findings; these are differences between the selected records, not observed behavior changes. This was a single existing real-provider fixture replayed offline, not a new live-provider run or autonomous-agent study. Design detail from the current source: changing only `function_match.status` would leave the `identity` dimension unknown, because its owner separately requires `sameEntry` or stable symbol origins. The relationships comparison also separately requires an established coordinate context. A same-authenticated-observation correspondence could resolve the first without asserting that distinct records share coordinates, that unavailable facets are complete, or that behavior is unchanged. The current public match schema only admits `symbol`, `same-entry`, and `explicit`, so a distinct method would change the advertised full output schema and needs schema/client and historical-Evidence verification. The correct treatment of self-comparison relationship coverage is a separate decision; it should not be silently promoted to complete merely because both inputs are the same.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6568

No description provided.

Rows
Columns