morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2147] [Follow-up] Existing-project launch path: product wiring, digest binding, docs, and real-provider verification #705

New issue

Open

opened 2026-10-15 18:27:33 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:27:33 +00:00

Owner

Originally created by @akushonkamen on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2147

Follow-up tracking for the first slice of #1048 (existing-project -process launch path with copy-first into an owned runtime root). The slice ships the launcher mechanism only; these items must land before the feature is user-reachable and before any claim of real-provider behavior.

1. Product wiring (profile/CLI/MCP surface)
GhidraHeadlessLauncherOptions.existingProject currently has no production construction site (GhidraProviderClient.ts does not pass it). Add the profile/CLI selection entry so a caller can name an existing project directory and program, following the shared CLI/MCP workflow per the first-slice spec in #1048.

2. Digest binding and stale/mismatch rejection
Bind the opened project to the target artifact digest (the bridge already checks the program SHA-256) and explicitly reject stale or mismatched projects with their actual reasons, per the issue's success criteria and N0zoM1z0's spec (provenance/snapshot-compatibility distinction for existing-project mode).

3. Documentation of provenance and mutation guarantees
Document that existing-project opens are read-only (-readOnly), operate on a copy (original project files untouched), and how provenance marks these runs; keep fresh import as the default.

4. Real-provider verification (not yet run)
The first slice is verified entirely with fixture/simulated tests (argument-shape tests plus a fake spawn seam and a stubbed LaunchSupport helper). Per CONTRIBUTING.md ("provider changes require the matching real-provider lane ... State which host/provider workflows ran") and AGENTS.md ("simulated providers do not establish real-provider behavior"), the real -process -noanalysis -readOnly behavior is unverified. This item tracks real Linux/macOS runs: first and repeated sessions without auto-analysis on a pre-imported project, new-address/tool queries against the same program, mismatch rejection, and owned cleanup — small fixture target first, large-target timing reported separately, Windows P0 boundary untouched.

Related: #1048

Originally created by @akushonkamen on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2147 Follow-up tracking for the first slice of #1048 (existing-project `-process` launch path with copy-first into an owned runtime root). The slice ships the launcher mechanism only; these items must land before the feature is user-reachable and before any claim of real-provider behavior. **1. Product wiring (profile/CLI/MCP surface)** `GhidraHeadlessLauncherOptions.existingProject` currently has no production construction site (`GhidraProviderClient.ts` does not pass it). Add the profile/CLI selection entry so a caller can name an existing project directory and program, following the shared CLI/MCP workflow per the first-slice spec in #1048. **2. Digest binding and stale/mismatch rejection** Bind the opened project to the target artifact digest (the bridge already checks the program SHA-256) and explicitly reject stale or mismatched projects with their actual reasons, per the issue's success criteria and N0zoM1z0's spec (provenance/snapshot-compatibility distinction for existing-project mode). **3. Documentation of provenance and mutation guarantees** Document that existing-project opens are read-only (`-readOnly`), operate on a copy (original project files untouched), and how provenance marks these runs; keep fresh import as the default. **4. Real-provider verification (not yet run)** The first slice is verified entirely with fixture/simulated tests (argument-shape tests plus a fake spawn seam and a stubbed LaunchSupport helper). Per CONTRIBUTING.md ("provider changes require the matching real-provider lane ... State which host/provider workflows ran") and AGENTS.md ("simulated providers do not establish real-provider behavior"), the real `-process -noanalysis -readOnly` behavior is unverified. This item tracks real Linux/macOS runs: first and repeated sessions without auto-analysis on a pre-imported project, new-address/tool queries against the same program, mismatch rejection, and owned cleanup — small fixture target first, large-target timing reported separately, Windows P0 boundary untouched. Related: #1048

bsakaguchi added the

area: providers

enhancement

P2: medium

labels

2026-10-15 18:27:33 +00:00

bsakaguchi commented

2026-10-15 18:27:34 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Implementation & Scope Review

Connecting the pre-imported Ghidra project launch path (-process) to production CLI and MCP endpoints requires strict enforcement of the digest binding:

Safety Boundary: When opening an existing Ghidra project directory, REA must verify that the SHA-256 digest of the analyzed executable matches the target binary digest recorded in the session.
Fail-Closed on Mismatch: If the digests diverge (or the program was recompiled/modified since Ghidra project creation), REA must reject the session with project_digest_mismatch rather than operating on stale decompilation output.
PR #2358 implements part of this wiring.

@matbrgz commented on GitHub (Oct 12, 2026): ### Implementation & Scope Review Connecting the pre-imported Ghidra project launch path (`-process`) to production CLI and MCP endpoints requires strict enforcement of the digest binding: - **Safety Boundary:** When opening an existing Ghidra project directory, REA must verify that the SHA-256 digest of the analyzed executable matches the target binary digest recorded in the session. - **Fail-Closed on Mismatch:** If the digests diverge (or the program was recompiled/modified since Ghidra project creation), REA must reject the session with `project_digest_mismatch` rather than operating on stale decompilation output. - PR #2358 implements part of this wiring.

bsakaguchi referenced this issue

2026-10-16 21:15:24 +00:00

[PR #705] [MERGED] fix: integrate 14 approved fix PRs (668,671,673,675,678-681,685-690) #2185

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:28 +00:00

bsakaguchi commented

2026-10-31 00:29:29 +00:00

Author

Owner

@morluto commented on GitHub (Oct 26, 2026):

The main implementation has advanced substantially: #7236 landed the CLI/MCP selection, verified copy and digest binding, provenance documentation, and real Linux Ghidra checks. I am leaving this follow-up open for its requested macOS real-provider verification; #7236 explicitly records macOS reuse as unverified. Please narrow any further work to that remaining evidence or another concrete gap.

@morluto commented on GitHub (Oct 26, 2026): The main implementation has advanced substantially: #7236 landed the CLI/MCP selection, verified copy and digest binding, provenance documentation, and real Linux Ghidra checks. I am leaving this follow-up open for its requested macOS real-provider verification; #7236 explicitly records macOS reuse as unverified. Please narrow any further work to that remaining evidence or another concrete gap.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#705

No description provided.

Rows
Columns