mirror of
https://github.com/morluto/rea.git
synced 2026-11-05 06:45:22 +00:00
Open
opened 2026-11-01 21:13:00 +00:00 by bsakaguchi
·
0 comments
No Branch/Tag specified
main
codex/procedure-reference-stacked
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
Mirrored from GitHub Pull Request
question
roadmap
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set.
Reference
morluto/rea#6660
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @morluto on GitHub (Nov 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8587
Before submitting
Decision needed
How should an analyst inspect a bounded portion of a completed native
procedure_referencesresult without transferring every row, while preserving reference identity, procedure-body coverage, provider provenance and complete Evidence?Context and evidence
On REA #8585 head
2a0415cd5, real Ghidra 12.1.4/JDK 21 and stdio MCP on macOS arm64, I analyzed two source-built, unexecuted arm64 Mach-O executables. Each has oneaudit_targetand an array of pointers statically initialized to it; the array sizes below deliberately stress output volume.procedure_referenceswithdirection: incomingreturned 3,001 references in a 5,434,853-byte SDK-serialized response. Each row included the target procedure identity.inspect_native_instructionat the entry returned 3,001 typed incoming references in 1,737,893 bytes;xrefsreturned 3,001 addresses in 97,431 bytes.procedure_referencescompleted but exceeded the default 10 MiB MCP response budget, returning the retained Evidence ID. An exact one-recordget_evidence_bundlerequest also exceeded the budget;inspect_analysis_viewrejected that record as an unsupported parent. Exporting the retained bundle succeeded and its 9,061,620-byte JSON contained the procedure-reference record with 8,001 rows.inspect_native_instructionat the entry succeeded with 8,001 incoming rows (4,617,885 serialized SDK bytes), andxrefsreturned 8,001 addresses (247,423 bytes).The instruction alternative is narrower: it reports references to one exact address, while
procedure_referencescovers the complete Ghidra function-body AddressSet and entry. It therefore cannot generally replace the procedure query. An exported file is a working complete-data fallback. SDK-serialized sizes include text and structured representations and are not model-token or latency measurements. These fixtures establish neither typical volume nor general provider completeness. The 8,000-slot target SHA-256206c08b323fb2a97004e13b40121560360b0ea426719a6c41f507142304e4ee1was unchanged; no target was executed.Expected interaction with targets
Read the caller-selected binary, launch the existing Ghidra analysis provider, and optionally write an explicitly selected local Evidence export. A retained view can operate without reopening the target.
Boundary details
Keep the exact parent Evidence ID, direction, source and target addresses, source procedure/unknown state, provider-specific reference kinds, body coverage, source ordering and duplicates. A page does not establish discovery completeness or runtime execution. Preserve full raw Evidence and caller-selected detail.
Options and tradeoffs
Compare a summary and paged
inspect_analysis_viewfor existing retainedprocedure_referenceswith a task-oriented query that can select source/target or kind. Avoid repeating unchanged procedure identity per row in the compact view if it can be represented once without losing identity. Distinguish separately scopedxrefs(#8549) and native feature-trace pages (#8585); neither currently pages this retained procedure result. Account for per-record and allocation bounds, output schemas and offline import/export.Verification available so far
I have a prototype or observed results.
Success criteria and open questions
Exercise empty, multi-range function bodies, interior targets, duplicates, data/instruction/indirect references, exact filters, page boundaries, full and compact MCP profiles, CLI and target-free export/import. Check both existing provider semantics and coverage limitations. The observed large control used one host and both schema profiles; no autonomous agent or latency study was performed.
References
Related #8549 (xrefs view recovery), #8348 and #8510 (Kuna reference provenance), #8373 and #8585 (bounded feature-trace delivery).
cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0
Reversible compact-row experiment
A standalone projection of the real 8,001-row incoming Evidence replaces a row's endpoint procedure with an explicit
selected-procedurereference only when its complete procedure object equals the query's procedure;nulland other procedure objects have distinct representations. All 8,001 rows reconstructed exactly with their original indices, endpoints, kinds and optional fields. All 8,001 target procedures matched the selected procedure; all source procedures were null. For the first 64 rows, minified JSON holding the selected procedure and rows was 54,779 bytes / approximately 17,115 tokenx-estimated tokens with complete endpoint objects versus 28,977 bytes / approximately 8,923 estimated tokens with the explicit references. These are one offline shape comparison, not an MCP task, actual model billing or an elapsed-time/CPU/memory measurement.As an outgoing control, a real Ghidra full-profile MCP query of a separate unexecuted fixture returned five references: every source procedure matched the selected procedure, one target was a different resolved procedure, and the others had no target procedure. The same encode/decode rule reconstructed all five rows, including stack address spaces and static read/write/call kinds. Neither fixture changed. This is not an implemented contract: define explicit null/unknown semantics, multiple collections including
unresolved_calls, filters and page coverage before adoption; compare decoding complexity, full task costs, oversized single rows and source Evidence retention. More providers, complex bodies, duplicate/mixed kinds, and autonomous-agent use remain unverified.Unmerged retained-view prototype
An isolated prototype based on main
6d60db195adds opt-indetail: summarytoprocedure_referencesand retained pages for references and unresolved calls. Endpoint procedures are explicitlyselected-procedure,null, orinline; a row retains its original source index and complete remaining edge fields. In real Ghidra 12.1.4 stdio MCP on the 8,000-slot fixture, both full and compact profiles returned 8,001 as the summary count. The SDK-serialized summary was 10,579 bytes; separate one-row first/last pages were 11,919 and 11,941 bytes, and decoding them matched the respective complete parent rows. Summary and page replies validated against each profile's advertised output schemas (Ajv 2020, strict and formats disabled). The target hash stayed unchanged and the target was not executed.Separately, after importing the previously exported complete Ghidra bundle into fresh target-free servers, both profiles paged and exactly reconstructed all 8,001 original reference rows and reported the empty unresolved-call collection. These observations are from an unmerged local prototype, not shipped support. It currently lacks kind filters, public CLI summary delivery, oversized-row boundary tests, documentation and general provider verification. SDK serialized bytes are not model-token or full-task performance measurements; no latency, CPU or memory comparison is claimed.
The prototype now also accepts exact source and target address filters. In both MCP profiles, an offline page filtered by a real Ghidra source/target pair returned the original source index 4,321. A live Ghidra outgoing control reconstructed all five edges, including one different resolved target. A synthetic public MCP boundary control preserved duplicate indices 0 and 2, paged a nonempty unresolved-call collection, and rejected endpoint filters on that collection. The canonical result schema and full advertised output schema reject a page whose collection and rows disagree; the deliberately reduced compact output advertisement accepts that malformed shape, while server-side canonical validation remains in force. A focused two-profile MCP test covering offline handoff and these distinctions passed. These controls are still from an unmerged prototype; real unresolved computed calls, CLI, large single rows and other providers remain unverified.
One-shot CLI and source closure experiment
A separate unmerged prototype stacked on #8585 adds
rea procedure-references <path> <procedure> --direction incoming|outgoing --detail summary --evidence_output <path>. On a real Ghidra 12.1.4 existing-project fixture, the summary and saved bundle contained five outgoing rows and retained the linked historical-projecthealthEvidence; a later target-free CLIinspect-analysis-viewreturned the first two rows from that bundle. A second invocation using the same snapshot returned the same trace and linked history, but this project produced no snapshot replay entries: it re-observed the provider and is not a replay control. Kuna 1.988 returnedcapability_unavailablefor the same command and did not create an output bundle. The target was not executed.Focused CLI/MCP boundary tests passed for source closure, missing-source refusal without publication, and offline page handoff. The new command reuses #8585's source-closure delivery boundary; it is exploratory and not an independent shipped implementation. CLI command naming/discoverability, large or oversized individual rows, additional provider coverage, complete/summary parity, cancellation/finalization and documentation remain open.
Real noncontiguous body and interior-target control
On the unmerged prototype stacked on #8585, I built an arm64 Mach-O with three pointer slots targeting a function's entry, entry+4 and entry+8. I imported it into a separate test-owned Ghidra 12.1.4 project and used a headless Java script to set that function's body to two disjoint ranges,
0x100000370..373and0x100000378..383. The script modified the test project's analysis database; it did not modify or execute the target binary. In both full and compact real stdio MCP profiles,procedure_references(direction: incoming)returned the entry reference and the entry+8 interior reference, and excluded the entry+4 gap reference. Exactxrefs(0x100000374)independently returned the gap's slot. The filterednative-procedure-referencespage fortarget_address: 0x100000378returned the interior slot with its original source index, and its summary retained both noncontiguous body ranges. The original executable SHA-2568d5c1b54cb27c8ed68ac16feb6ee635244c520ee22433c92f31236dcd91c7ad4was unchanged. This exercises one deliberately edited Ghidra database on one host, not naturally recovered body correctness, all address spaces, or general provider coverage.Real unresolved-call paging control
On the unmerged stacked prototype, real Ghidra 12.1.4 analyzed a source-built arm64 Mach-O whose
audit_indirectcalls two function-pointer arguments. Independentotooldisassembly identifiesblrat0x100000348and0x100000358. In both full and compact stdio MCP profiles, the complete outgoing procedure-reference result reported those two sites as unresolved because its instruction decoder found calls without ReferenceManager call destinations. Opt-in summary preserved the same parent ID and count; one-row unresolved-call pages reconstructed both original addresses and reasons, and the replies validated against the respective advertised output schemas (Ajv 2020, strict and formats disabled). The target was unchanged (SHA-256a34f95f4fdea0952ee60436e7399eb92af79c1a50fdd8552e9dcdab87b3e919d) and not executed.The CLI prototype also saved that result, then
inspect-analysis-viewselected the second unresolved row from its Evidence bundle in a separate process without reopening Ghidra. This is one unexecuted binary on one host; no conclusion about runtime call targets, other indirect-call shapes, or exhaustive unresolved coverage follows.Representative complete task measurement
On the source-built 3,000-slot fixture, real Ghidra 12.1.4 and compact stdio MCP on macOS arm64, I compared selecting the first and last incoming procedure-reference rows from the complete response on #8585
2a0415cd5against one summary plus two one-row pages on the unmerged stacked prototype. The selected original rows reconstructed identically. One cold and one warm measurement were taken per mode in separate sessions, with analysis-server startup and catalog transfer time excluded; the target was unchanged and not executed.The SDK serialization includes both text and structured representations and may double-count content; tokenx is an estimate, not actual model usage or billing. Process-family
pssamples were taken every 100 ms; short-lived peaks can be missed. The one-run samples do not establish general timing, CPU or memory improvement. Both modes still construct and retain the complete source result, and a task that needs every row would incur more calls. The measurement excludes connection startup, catalog transfer time, and unmeasured client costs.Bounded page construction and oversized-row recovery
A synthetic bundle repeated the real 8,001-row Ghidra result three times (24,003 rows). The initial prototype constructed the entire requested page and then received the 10 MiB MCP response error; a one-row retry still worked. A subsequent unmerged revision uses the existing 1,048,576-byte analysis-view projection allowance before adding each row. In full and compact MCP profiles, a request for all rows returned a byte-limited page with
next_offset: 2344andtotal: 24003; eleven pages reconstructed all original rows and indices, with ten byte-limited pages. The first replies validated against each advertised output schema. The fixed projection allowance is separate from the 10 MiB transport limit and has no runtime override; its byte count is for the projection, not the entire SDK response.A second synthetic source used one 1.1-million-character endpoint procedure name. In both profiles, that one-row view returned
resource_constraintwith its parent Evidence ID and the projection allowance, while an unresolved-call page from the same retained parent still succeeded. Focused MCP tests cover continuation and this recovery. These are explicit synthetic resource controls, not claims that Ghidra generated such names or that total process memory is bounded by the page allowance. The parent result and parsing/retention costs remain separate; no performance benchmark was performed for this revision.