mirror of
https://github.com/morluto/rea.git
synced 2026-11-05 06:45:22 +00:00
[GH-ISSUE #8471] [Design] Distinguish local value flow from call-resolution availability #6618
Open
opened 2026-11-01 21:12:43 +00:00 by bsakaguchi
·
0 comments
No Branch/Tag specified
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
Mirrored from GitHub Pull Request
question
roadmap
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set.
Reference
morluto/rea#6618
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @morluto on GitHub (Nov 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8471
Before submitting
Decision needed
How should
binary_session.tool_availabilitydistinguish a missing native def-use model from missing call-target resolution, while accurately reporting useful local-only value tracing?Context and evidence
On REA main
a6caa79bf4f393c02601fbf2f6df246eae0b1558, Node 24.22.1 and macOS arm64, I opened a source-owned x86-64 Mach-O through Kuna 1.986. Public stdio MCPbinary_session({detail:"complete"})reportedtrace_native_valuesunavailable,reason: "provider_missing", with remediationConfigure a provider for required operation resolve_native_call_targets.The same actual call totrace_native_valuessucceeded, with zero nodes/edges, one procedure and the explicit unknownProvider has no native def-use model; its sourceanalyze_functiondossier hadnative_value_flow: null. Both full and compact advertised schema profiles produced those facts.On the same unchanged, unexecuted target in a fresh Ghidra 12.1.4/JDK 21 session, availability was true, the dossier had an available value-flow model, and the trace returned 39 nodes and 46 edges. Compact advertised-schema validation passed. This is one selected procedure on one host, not an agent-selection study or a general provider comparison. The Kuna result does not establish useful value tracing; its unknown correctly qualifies the empty graph. On a separate source-owned arm64 import fixture with Ghidra marked available, directly tracing
EXTERNAL:0x1returned an explicit no-HighFunction-model unknown and no nodes. Provider-level support therefore cannot guarantee that every selected function has a value model; see #8476 for the separate thunk-boundary issue.In a separate public MCP controlled-provider experiment, the provider declared
analyze_functionbut no call-target resolver and supplied captured real Ghidra dossiers. Full and compact profiles both reported the workflow unavailable. The call-containing dossier still returned 4 local nodes and 3 edges with one explicit call-resolution unknown. A second captured no-call leaf returned 7 nodes and 5 edges with no unknowns; no call resolver was needed for that selected procedure. Both outputs passed their fetched advertised schemas. This is a simulated provider using real captured input, not evidence that another real provider offers that capability. It demonstrates that local value flow and cross-function resolution can be distinct outcomes.Source-derived explanation:
CapabilityInventory.tsdeclaresanalyze_functionandresolve_native_call_targetsas requirements.NativeValueTrace.tsinspects the dossier's optional value flow, emits an unknown and continues without resolving calls when the model is absent; call resolution only occurs for retained call operations. Thus the reported missing resolver is true but does not identify the earlier missing value model. The MCP contract asks callers to use availability to choose operations, while separately noting that discovery need not block qualified direct invocation.Expected interaction with targets
No target interaction for the discovery-design question. The controls read the local fixture and launched existing headless providers; the target was not executed or modified.
Boundary details
Keep provider selection explicit. Preserve the observed graph, source identity and unknowns. Distinguish a callable qualified result, lack of the core value-flow facet, and optional cross-function call-target coverage. Do not infer zero dependencies from zero nodes or claim that installing a call-target resolver alone supplies a def-use model.
Options and tradeoffs
The best representation and whether the extra distinction justifies schema/context cost are open questions; no implementation is proposed as proven here.
Verification available so far
I have observed results.
Success criteria and open questions
Test both current-provider capabilities and actual public calls, including Ghidra with value flow, Kuna with no model, a value model without call-target resolution (the public MCP experiment above is not yet a committed regression), and a per-function failure or empty model. Verify summary and complete discovery, full/compact schemas, unchanged target selection, and unknown/provenance retention. Determine whether these statuses express callability, useful partial operation, or complete prerequisites; do not silently alter existing callers' interpretation.
References
Related to #8322 (different target-specific discovery mismatch), #8358 (call-argument coverage) and #8282 (source Evidence closure). @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0
Current Kuna 1.989 and explicit facet-unavailability control
On #8785 head
465e8b1e0with the same self-built, unexecuted arm64 Mach-O used in #8783, I calledbinary_session(detail: complete)and thentrace_native_valuesfor the same procedure in real stdio MCP sessions, with compact and full input/output profiles. Kuna 1.989 discovery still reportedavailable: false,reason: provider_missing, and remediation to configureresolve_native_call_targets. The direct trace succeeded with no nodes and an explicit unknown:REA's Kuna provider does not report native def-use observations.Real Ghidra 12.1.4 discovery on the same fixture was available and its direct trace returned nine nodes and no unknowns. The target SHA-256 stayedc244f7d7d9fa9b7f4cfcb1f69d69cc1f83ad98fe38b0293b223b3ca7d9076363.The provider-specific dossier fix improves the result's explanation but does not change discovery:
CapabilityInventorystill composes operation requirements and does not express whether ananalyze_functiondossier supplies value flow. Do not infer provider-level support from a single dossier or claim that the optional call resolver alone would provide a value model. This is one target and host, not a completeness or agent-selection measurement.Capability ownership and projection boundary
Source inspection on #8785
465e8b1e0:CapabilityDescriptordeclares an operation, readiness, effects and limitations, but no typed declaration for a dossier facet.BinarySessionStatus.providerCapabilitySetsgroups those facts for session output, andexpandProviderCapabilitiesreconstructs operation descriptors beforeCapabilityInventoryevaluates the required operations. The existingtrace_native_valuescomposition therefore cannot distinguish ananalyze_functionimplementation that can supply a value-flow model from one that does not, except by interpreting prose or executing a function. #8785's explicit per-dossier unavailability fixes the returned observation, not this static capability boundary.A candidate design should put any declared support/absence at the provider capability owner, preserve it through grouped status serialization and expansion, and use an explicit unknown when a provider does not declare the facet. “Provider can supply value flow” must mean the operation may produce it, not that every selected function will have a model: the real Ghidra external-function control in #8785 returns an explicit function-specific unavailable reason. Model local value flow separately from optional cross-function call resolution; preserve the current direct-call unknowns and target/provider selection. This is a proposed direction, not a validated schema or implementation. Verify full and compact SDK catalogs, grouping/ungrouping, provider readiness failures, unknown third-party capabilities, and the existing captured-dossier local-only controls before changing the meaning of
available.Summary discovery control
The same real-provider control was repeated using
binary_session(detail: summary)rather than complete discovery. In compact and full MCP input/output profiles, Kuna 1.989 still reportedtrace_native_valuesunavailable with remediation to configureresolve_native_call_targets; the actual trace returned zero nodes and the explicit REA Kuna value-flow-unavailable unknown. Ghidra 12.1.4 summary reported available and the same requested trace returned nine nodes with no unknowns. The unexecuted target SHA-256 remainedc244f7d7d9fa9b7f4cfcb1f69d69cc1f83ad98fe38b0293b223b3ca7d9076363. Thus this is visible on both session detail levels for this fixture, not only in the complete inventory. It does not establish general graph completeness or measure an agent's tool selection.Existing mode contract and local-trace boundary
Source inspection at #8785
465e8b1e0adds two constraints to a possible implementation. First,toolAvailabilityModerequiresavailable: falseto carry at least onemissing_operationsentry, while an available mode requires that list to be empty; it has no unknown state or typed missing-facet field. Encoding a missing value-flow facet as a made-up operation would misrepresent the provider contract. Any schema change needs to preserve the distinction between absent declaration, explicitly unavailable facet, and an unhealthy or missing operation through compact/full status grouping and SDK conversion.Second,
trace_native_valueshas no explicit local-only mode. Itsmax_depth: 0limits expansion into callees, but the workflow still attemptsresolve_native_call_targetsfor retained CALL/CALLIND operations before applying the depth check. Without that operation it can still return the already collected local graph plus a call-resolution unknown, as shown by the captured-dossier control above. That is a partial outcome, not proof that the caller selected a standalone local-only mode. A discovery redesign should describe that actual behavior or deliberately add and verify a distinct caller choice; it should not labelmax_depth: 0as suppressing call resolution.Real depth-zero call-resolution control
With real Ghidra 12.1.4 on an unexecuted arm64 Mach-O,
trace_native_valuesfor_audit_callerwithmax_depth: 0andmax_functions: 1returned five local nodes plus adirectcall edge from0x1000003f4to_audit_leafat0x1000003c0. It separately reported the call-depth budget and unavailable callee parameter bindings as unknowns. Both compact and full stdio MCP profiles produced this result, and target SHA-256 remained510a23fc3c152175b9977130b3b1711d580e47d22a085cdee6a4e0c9dea2c51a. This real control supports the source-derived distinction above: zero depth prevents callee expansion but does not suppress call-target resolution. It is one function and host, not a completeness or runtime execution claim.Unmerged provider-declaration prototype
In an isolated, uncommitted checkout based on #8785
465e8b1e0, I prototyped a typedanalyze_functionvalue-flow declaration (supported,unavailablewith reason, or undeclared), preserved it through provider-capability grouping/expansion, and exposed a separatevalue_flow_supportfact on the trace's availability group. Undeclared providers projectedunknown; it did not fabricate a missing operation or expose a local-only mode. The prototype left the existing top-levelavailabledecision and remediation unchanged.Real stdio MCP against the unexecuted arm64 Mach-O above returned
unavailablewith the REA Kuna reason for Kuna 1.989, andsupportedfor Ghidra 12.1.4, in summary status in both compact and full input/output profiles. Fetchedbinary_sessionoutput schemas declared JSON Schema 2020-12; Ajv 2020 with strict and format checks disabled accepted the schemas and actual responses. Existing session-status and capability-inventory source tests passed (69 tests), andcheck:ci:fastpassed. The target digest remained unchanged. This checks one fixture and host, not per-function capability or agent selection.A separate synthetic provider with both required operations showed why the prototype is incomplete: when it declared value flow unavailable, the existing top-level availability still reported
available: truewith no remediation while the new fact said unavailable. With no facet declaration it also reported top-level available and the new fact unknown. For real Kuna, the old call-resolver remediation persisted alongside the new unavailable fact. A final design must decide and document whether top-level availability means operation callability or useful prerequisites, make its remediation consistent with that meaning, and avoid interpreting a provider's declared potential as a guarantee for every function. It also needs real local-without-resolver behavior, runtime/readiness and schema/client checks beyond this experiment. No production change or merge is proposed from this prototype alone.Revised, still-unmerged availability experiment
I extended the isolated prototype to use the provider's typed declaration in the existing availability decision. A declared-unavailable value-flow facet now makes this workflow unavailable with the provider's reason and guidance to select a provider that can supply value flow; it separately notes that cross-function tracing needs call-target resolution. If value flow is declared supported but the resolver is missing, the explanation says a direct trace may still return local observations with call-resolution unknowns, without advertising a fictitious local-only mode. Undeclared facet support remains
unknown. When the resolver is unhealthy, its owner-provided repair instruction remains present, including when value flow is also unavailable.A synthetic nine-case capability matrix covered supported/unavailable/undeclared facet declarations crossed with present/missing/unhealthy resolver operations, including grouped summary and complete status expansion. Real Kuna 1.989 and Ghidra 12.1.4
binary_sessionsummary controls in both schema profiles produced the intended facet states and more relevant Kuna remediation; their fetched 2020-12 output schemas and actual responses validated with Ajv 2020 (strict and format checks disabled). A real Ghidra external-function control still returned its function-specific no-HighFunction reason despite the provider's general ability to produce value flow. Existing capability/status source tests (69) andcheck:ci:fastpassed.This remains a prototype, not a production change: the boolean top-level
availableremains true when operation prerequisites are present but value-flow support is undeclared, with the separateunknownfield qualifying it. Whether that accurately conveys the public contract needs review; so do descriptor scoping, mixed-provider routes, failure precedence, serialized context cost, actual partial local-flow behavior without a resolver and client compatibility. The typed declaration describes a provider's ability for some functions, never a guarantee for a particular function. No agent-selection or performance measurement was made.