morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8590] [Design] Preserve source availability in one-shot analysis #6662

New issue

Open

opened 2026-11-01 21:13:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:13:01 +00:00

Owner

Originally created by @morluto on GitHub (Nov 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8590

Before submitting

I searched open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The default one-shot rea trace ... --json succeeded with an Evidence record linking to the Ghidra project's historical-analysis health Evidence. The CLI returned the linked ID once, but did not return the linked record, save a bundle, or explain that the source was no longer retained after exit.

Reproduction

On source revision 85013da0cec7b854f51e47de77fd24391c8fd8ed, configure a caller-owned existing Ghidra project containing an analysis-history report. Run rea trace <Mach-O> goal --provider ghidra --json. The stock command returned trace ev_44e6f4f1b47f0dbeea8b907fda9ffcb94b5b5da9a8429885f502f41d34622d06 linking ev_bd8f42f000d2c1f6f9e24e412d5303b694a5dc2b286d3193b73e000e8ebb60a8, with no source record. The target SHA-256 remained unchanged.

On draft #8585 head 2a0415cd5, the default command had the same source-availability behavior in a registered-command control. Its new --detail summary --evidence_output <new-file> option worked through the stock CLI: the saved bundle contained both exact IDs and operations (trace_feature, health).

Expected behavior

Design the default one-shot handoff so callers can understand whether cited sources remain available, and discover an actionable way to preserve exact linked sources when they need them. Consider the full-output and bundle choices together; avoid silently writing files or implying that repeating analysis will reproduce historical Evidence. This is a proposed UX and provenance expectation, not a claim that existing documentation promises inline sources.

Impact and scope

The returned link identifies a source but the standalone output cannot reconstruct that record. A new run may see a different project state. This control covered one real Ghidra project and trace only; other commands, providers, failure paths, and agent behavior were not independently exercised.

REA version

Source 85013da0cec7b854f51e47de77fd24391c8fd8ed; #8585 2a0415cd5 for the bundle control.

Runtime and platform

macOS arm64, Node 24.22.1, Ghidra 12.1.4, JDK 21.

Target and artifact context

Source-built Mach-O; SHA-256 ce8582268988e3efe7441bdf87c69626be149ff5cb5ddf99b20f5d90d0f6b4d6. Target was not executed.

Interface

CLI

Earliest failure stage

One-shot delivery and session close.

Relevant output or evidence

The default JSON was 66,453 bytes and contained the linked health ID exactly once, in the trace's links. The #8585 saved bundle contained the trace and health records. See #8285 for a different command lacking an export option and #8589 for cancellation after source capture. The latter remains separate: even with an output path, cancellation prevents normal publication.

Typed outcome or recovery expected

NOT_ENOUGH_INFO: choose an appropriately bounded, discoverable delivery contract after comparing existing CLI Evidence conventions and consumers. Verify successful default output, explicit bundle handoff, late cancellation, and cleanup failure without changing Evidence identity or weakening caller-selected output semantics.

Analysis or suspected cause

Source inspection at 85013da shows trace returns one projected result and releases the one-shot session. #8585 captures source closure for explicit Evidence output; it does not do so for the default complete result.

Additional context

cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

Direct decompile control

This also affects a direct command, not only composed traces. On #8444 head 6fd318a99, real Ghidra 12.1.4/JDK 21 and Node 24.22.1 on macOS arm64, a disposable saved project with a deliberately synthetic historical-analyzer report was used with rea decompile <owned-Mach-O> 0x1000003e0 --provider ghidra --format json --full-output. The successful one-shot output contained a health Evidence link but not the source record or the report, and did not identify the source as unavailable after the session closed. With caller-selected --snapshot <new-path>, the saved snapshot's Evidence bundle contained both the decompile record and the linked historical source. The source binary was not executed.

A separate, unmerged Kuna pointer-paging experiment showed why the contract matters for future tools: if typed pointer rows live only in a session-linked source, default one-shot xrefs returns a link without the typed rows. An experimental version kept the rows in the primary raw Evidence and separately indexed them for paging, but on one real 24,000-pointer fixture increased median first-call time from 723 ms to 1,044 ms and repeated-call time from 339 ms to 581 ms (three alternating runs per variant on one host); it is not proposed as a finished fix. A correct common one-shot source handoff should preserve source identity and caller choice without silently writing a file or requiring that provider-specific duplication. See #8510 and #8444.

Snapshot import recovery

A fresh real Ghidra 12.1.4 snapshot on the current REA checkout could be reopened with open_binary and snapshot_path; both MCP profiles recovered the linked synthetic health source. Passing that snapshot to import_evidence_bundle instead returned evidence_integrity_mismatch and advised recreating observations. Draft #8867 changes that error for snapshot-shaped inputs to conditional recovery guidance, without validating the snapshot or solving this issue's default one-shot source handoff. A snapshot made under a different analysis profile was correctly refused on reopen. The selected snapshot, target and project descriptor were unchanged during the reads.

Originally created by @morluto on GitHub (Nov 1, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8590 ### Before submitting - [x] I searched open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior The default one-shot `rea trace ... --json` succeeded with an Evidence record linking to the Ghidra project's historical-analysis `health` Evidence. The CLI returned the linked ID once, but did not return the linked record, save a bundle, or explain that the source was no longer retained after exit. ### Reproduction On source revision `85013da0cec7b854f51e47de77fd24391c8fd8ed`, configure a caller-owned existing Ghidra project containing an analysis-history report. Run `rea trace <Mach-O> goal --provider ghidra --json`. The stock command returned trace `ev_44e6f4f1b47f0dbeea8b907fda9ffcb94b5b5da9a8429885f502f41d34622d06` linking `ev_bd8f42f000d2c1f6f9e24e412d5303b694a5dc2b286d3193b73e000e8ebb60a8`, with no source record. The target SHA-256 remained unchanged. On draft #8585 head `2a0415cd5`, the default command had the same source-availability behavior in a registered-command control. Its new `--detail summary --evidence_output <new-file>` option worked through the stock CLI: the saved bundle contained both exact IDs and operations (`trace_feature`, `health`). ### Expected behavior Design the default one-shot handoff so callers can understand whether cited sources remain available, and discover an actionable way to preserve exact linked sources when they need them. Consider the full-output and bundle choices together; avoid silently writing files or implying that repeating analysis will reproduce historical Evidence. This is a proposed UX and provenance expectation, not a claim that existing documentation promises inline sources. ### Impact and scope The returned link identifies a source but the standalone output cannot reconstruct that record. A new run may see a different project state. This control covered one real Ghidra project and `trace` only; other commands, providers, failure paths, and agent behavior were not independently exercised. ### REA version Source `85013da0cec7b854f51e47de77fd24391c8fd8ed`; #8585 `2a0415cd5` for the bundle control. ### Runtime and platform macOS arm64, Node 24.22.1, Ghidra 12.1.4, JDK 21. ### Target and artifact context Source-built Mach-O; SHA-256 `ce8582268988e3efe7441bdf87c69626be149ff5cb5ddf99b20f5d90d0f6b4d6`. Target was not executed. ### Interface CLI ### Earliest failure stage One-shot delivery and session close. ### Relevant output or evidence The default JSON was 66,453 bytes and contained the linked health ID exactly once, in the trace's links. The #8585 saved bundle contained the trace and health records. See #8285 for a different command lacking an export option and #8589 for cancellation after source capture. The latter remains separate: even with an output path, cancellation prevents normal publication. ### Typed outcome or recovery expected NOT_ENOUGH_INFO: choose an appropriately bounded, discoverable delivery contract after comparing existing CLI Evidence conventions and consumers. Verify successful default output, explicit bundle handoff, late cancellation, and cleanup failure without changing Evidence identity or weakening caller-selected output semantics. ### Analysis or suspected cause Source inspection at `85013da` shows `trace` returns one projected result and releases the one-shot session. #8585 captures source closure for explicit Evidence output; it does not do so for the default complete result. ### Additional context cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0 ### Direct decompile control This also affects a direct command, not only composed traces. On #8444 head `6fd318a99`, real Ghidra 12.1.4/JDK 21 and Node 24.22.1 on macOS arm64, a disposable saved project with a deliberately synthetic historical-analyzer report was used with `rea decompile <owned-Mach-O> 0x1000003e0 --provider ghidra --format json --full-output`. The successful one-shot output contained a `health` Evidence link but not the source record or the report, and did not identify the source as unavailable after the session closed. With caller-selected `--snapshot <new-path>`, the saved snapshot's Evidence bundle contained both the decompile record and the linked historical source. The source binary was not executed. A separate, unmerged Kuna pointer-paging experiment showed why the contract matters for future tools: if typed pointer rows live only in a session-linked source, default one-shot `xrefs` returns a link without the typed rows. An experimental version kept the rows in the primary raw Evidence and separately indexed them for paging, but on one real 24,000-pointer fixture increased median first-call time from 723 ms to 1,044 ms and repeated-call time from 339 ms to 581 ms (three alternating runs per variant on one host); it is not proposed as a finished fix. A correct common one-shot source handoff should preserve source identity and caller choice without silently writing a file or requiring that provider-specific duplication. See #8510 and #8444. ### Snapshot import recovery A fresh real Ghidra 12.1.4 snapshot on the current REA checkout could be reopened with `open_binary` and `snapshot_path`; both MCP profiles recovered the linked synthetic `health` source. Passing that snapshot to `import_evidence_bundle` instead returned `evidence_integrity_mismatch` and advised recreating observations. Draft #8867 changes that error for snapshot-shaped inputs to conditional recovery guidance, without validating the snapshot or solving this issue's default one-shot source handoff. A snapshot made under a different analysis profile was correctly refused on reopen. The selected snapshot, target and project descriptor were unchanged during the reads.

bsakaguchi added the

bug

triage

labels

2026-11-01 21:13:01 +00:00

bsakaguchi changed title from ~~[GH-ISSUE #8590] [Design] Make one-shot trace source availability discoverable~~ to [GH-ISSUE #8590] [Design] Preserve source availability in one-shot analysis

2026-11-04 04:56:16 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6662

No description provided.

Rows
Columns