[PR #6219] [MERGED] feat(native): inspect a universal Mach-O slice in Go and Rust metadata readers #7206

New issue

Closed

opened 2026-11-01 21:46:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:46:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6219
Author: @kaoru0822-kitauji
Created: 10/22/2026
Status: ✅ Merged
Merged: 10/22/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: feat/universal-slice-go-rust

📝 Commits (2)

00f1e97 feat(native): inspect a universal Mach-O slice in Go and Rust metadata readers
51c281f fix(native): reject damaged universal files and self-contradicting slice reports

📊 Changes

19 files changed (+902 additions, -35 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+4 -2)
📝 docs/go-binaries.md (+15 -5)
📝 docs/rust-binaries.md (+12 -3)
📝 src/application/go/GoBinaryService.ts (+2 -1)
📝 src/application/rust/RustBinaryService.ts (+4 -2)
📝 src/cli/goCommands.ts (+18 -3)
📝 src/cli/rustCommands.ts (+22 -2)
📝 src/contracts/go/goToolContracts.ts (+1 -1)
📝 src/contracts/rust/rustToolContracts.ts (+1 -1)
📝 src/domain/analysisView/goBinaryView.ts (+6 -2)
📝 src/domain/analysisView/rustBinaryView.ts (+6 -1)
📝 src/domain/apple/machoTargetSelection.ts (+56 -7)
📝 src/domain/go/goBinary.ts (+44 -0)
📝 src/domain/rust/rustBinary.ts (+51 -0)
📝 src/go/GoBinaryProvider.ts (+33 -3)
➕ src/native/metadata/MachoSliceSelection.ts (+149 -0)
📝 src/rust/RustBinaryProvider.ts (+43 -2)
➕ tests/boundary/mcp/universalSliceMcp.test.ts (+373 -0)
➕ tests/fixtures/universalMacho.ts (+62 -0)

📄 Description

What broke: inspect_go_binary / inspect_rust_binary refused every universal (FAT) Mach-O and had no way to select a slice; on hosts without lipo (Linux, the Docker image) such binaries could not be inspected at all.
Fix: an optional architecture input. A shared selector reads REA's own FAT table (no lipo), validates the slice, and the result keeps the universal file as artifact plus selected_slice, with all offsets remaining true file offsets.
Risk: Low. Thin/ELF/PE inputs are unchanged (no new output field); the old universal refusal becomes a correctable invalid_request on architecture that lists the slices.

Summary

Fixes #4102 (option 1 in the issue).

Before: a universal input failed with unsupported_target: Universal/fat Mach-O containers require selecting a thin slice, and the tools had no parameter to select one. After: architecture: "arm64" (CLI --architecture arm64) inspects that slice directly, and provenance stays tied to the universal file.

Problem and expected behavior

Many macOS releases ship only universal binaries. The issue's example was the GitHub CLI's universal pkg; here I used Tor Browser's lyrebird and Cursor's cursor-tunnel. REA already parses FAT tables structurally (readFatContainerHeader, classifyFatContainerIdentity), but these two inspectors only refused. Expected: select a slice by CPU family, record its offset, size and CPU, keep the parent identity, and list the available architectures when the selection is missing or wrong.

Change and scope

src/native/metadata/MachoSliceSelection.ts is the single selector. It parses the FAT table, confirms the slices are Mach-O (JVM class files sharing the magic still pass through to the image reader), and matches the requested CPU family. It then validates the slice's range and alignment, and checks that the slice's own Mach-O header CPU type/subtype agrees with the table. The result is the thin bytes, their file offset, and a macho-selected-image-v1 identity. The identity reuses the existing provider-neutral schema, including container_table_sha256 computed over header plus table as the Hopper path does. Failures are a typed Result: architecture issues (missing, absent, several matches, or given for a non-universal file) versus malformed containers.
Go and Rust providers read the selected image and translate image-relative offsets into file offsets: Go header_offset, version_location, module_location; Rust .dep-v0 file_offset and rustc-path hash offsets. artifact stays the universal file (SHA-256, size). Schemas add optional selected_slice with a refinement that every reported range lies inside the slice. It is optional so previously retained Evidence still parses in inspect_analysis_view.
Vocabulary: architecture is x86 | x86_64 | arm | arm64, REA's BinaryArchitecture names. They now live once in machoTargetSelection.ts (MACHO_CPU_TYPES), which the existing machoTargetSelectionMatchesArchitecture also uses.
The Evidence subject format of a selected slice is mach-o-universal. The services and the retained Go/Rust views each re-derived format === "macho" ? "mach-o" : format, and the views rejected the new value. That mapping now has one owner (metadataReportSubjectFormat), used by all four.
Summary views (detail: "summary") carry selected_slice.
Not included: IL2CPP's private selectImage (binary_architecture: arm64 | amd64, its own public failure codes) could move onto this selector, but that changes its public vocabulary and error codes, so it is left for a follow-up. extract_artifact's lipo dependency (option 2 in the issue) is also unchanged.

Contract and boundary impact

Semantic owner and earliest changed stage: selectNativeImage (before any image parsing); subject format in machoTargetSelection.ts.
Contribution scope fit and linked maintainer decision: static reads only, within existing inspector boundaries; option 1 from the issue.
CLI and MCP/tool-catalog contract: additive optional architecture input on both tools (MCP + CLI --architecture); additive optional selected_slice output; universal inputs now fail as invalid_request on architecture instead of unsupported_target.
Provider, bridge, target-format, or platform compatibility: no external tools; works without lipo.
Evidence, artifact, provenance, or reconstruction contract: artifact identity stays the selected file; source ranges remain file offsets; subject format: mach-o-universal with the slice's architecture.
Target selection, authority, upstream behavior, and cleanup details: not applicable.
Generated metadata, package, or installation impact: tool catalog descriptions/schemas regenerate in CI.

Expected effects:

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added (tests/boundary/mcp/universalSliceMcp.test.ts, through the MCP server):
- Go arm64 selection from a two-slice universal file: artifact is the universal file, selected_slice holds the exact offset/length/CPU and table digest, and ranges are file offsets that slice back to go1.26.1. Subject is mach-o-universal/arm64, parameters record architecture, input and output are validated against the advertised JSON Schemas with Ajv, and detail: "summary" for x86_64 carries selected_slice.
- Refusals: missing selection and an absent CPU, both listing x86_64 (subtype 0x3), arm64 (subtype 0x0); architecture on a thin image; two arm64 slices (ambiguous); and a FAT entry whose CPU disagrees with the slice header (malformed path).
- Rust: the selected slice equals the thin inspection, with .dep-v0 and rustc offsets shifted by the slice offset; a missing selection fails on architecture.
- From review: a damaged universal file (slice running past the file) fails on path with the FAT reason, with or without architecture. Reports whose selected_slice contradicts their own format or CPU (amd64 or elf) are rejected by the Go/Rust schemas through one shared selectedSliceAgreesWithReport check. The CLI --architecture flag is described in help (cliOptionAliases).
- tests/fixtures/universalMacho.ts builds FAT32 fixtures from existing thin fixtures.

Real-binary evidence, executed on macOS arm64 (Node 26.5.0). Baseline = merge-base origin/main build:

Baseline on universal input: inspect-go-binary …/Tor Browser.app/…/lyrebird and inspect-rust-binary …/Cursor.app/…/bin/cursor-tunnel both return unsupported_target … require selecting a thin slice.

This PR with --architecture vs baseline on the lipo -thin-extracted slice. Every field is identical except offsets, which are shifted by exactly selected_slice.offset:

Binary (universal)	Selection	Compared with baseline on thin slice
Tor `lyrebird` (Go 1.22.12, 32 MB)	arm64, x86_64	build_info and identity equal; 61 deps; offsets +17088512 (arm64)
Tor `conjure-client` (Go)	arm64	inspected (11 KB report)
Cursor `cursor-tunnel` (Rust)	arm64	section/rustc offsets shifted; metadata equal
Cursor `@vscode/ripgrep` `rg` (Rust)	arm64	same

Cost: universal-with-selection 0.70–1.14 s wall, 0.93–1.07 s CPU, 354–361 MiB peak RSS (Go, 3 runs). The same branch on the 15 MB thin slice: 0.62 s, 0.94 s CPU, 327 MiB. The extra ~30 MiB is the 32 MB universal file read once; no slice copy is made (subarray). Report size is unchanged apart from the ~10-byte selected_slice (17,370 vs 17,360 bytes); the summary is 4.2 KB.

User-visible output (no selection):

code: invalid_request
details.issues: [{ path: ["architecture"], message: "Universal Mach-O holds x86_64 (subtype 0x3), arm64 (subtype 0x0); select one architecture." }]

Remaining proof gaps: no universal Go/Rust binary with cargo-auditable .dep-v0 data was available locally (both real Rust binaries carry only rustc paths), so the dependency-section shift is covered by the fixture test. Linux/Windows hosts were not run locally (CI).

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:focused -- tests/boundary/mcp/universalSliceMcp.test.ts tests/boundary/mcp/goBinaryMcp.test.ts tests/boundary/mcp/rustBinaryMcp.test.ts tests/boundary/mcp/goBinaryViews.test.ts tests/boundary/go/goBinaryImage.test.ts tests/boundary/rust/rustBinaryImage.test.ts tests/acceptance/goBinaryCli.test.ts tests/acceptance/rustBinaryCli.test.ts tests/acceptance/rustDependencyViews.test.ts src/application/go/GoBinaryService.test.ts src/application/rust/RustBinaryService.test.ts tests/boundary/providers/native/artifactProvider.machOSlices.test.ts tests/boundary/filesystem/binaryTarget.test.ts tests/boundary/mcp/absoluteLocalPathSchema.test.ts tests/process-global/stableArtifactConsumers.test.ts tests/boundary/cli/artifactInputLimits.test.ts — 16 files, 326 tests passed.
After review fixes: npm run test:focused -- tests/boundary/mcp/universalSliceMcp.test.ts tests/boundary/cli/cliOptionAliases.test.ts tests/boundary/mcp/goBinaryMcp.test.ts tests/boundary/mcp/rustBinaryMcp.test.ts tests/boundary/mcp/goBinaryViews.test.ts tests/acceptance/rustDependencyViews.test.ts tests/boundary/go/goBinaryImage.test.ts tests/boundary/rust/rustBinaryImage.test.ts — 8 files, 141 tests passed.
npm run check:fast — passed.
npm run format:check — passed.
npm run docs:check — passed.
Real-binary runs above (npm run build:cached on both trees).

Compatibility, safety, and release

Breaking changes or migration steps: none for valid calls. A universal input without architecture now returns invalid_request (path architecture, slices listed) instead of unsupported_target. That call never succeeded before, and the new error is the actionable one.
Real Hopper/Ghidra, browser, or OS coverage: macOS arm64 with real Tor Browser and Cursor binaries; no deep provider involved.
Package or release metadata impact: none.
Security, privacy, process, or containment review: static reads only; the slice is validated against the table and its own header before parsing; existing 256 MiB input bound unchanged.

Author readiness

Human owner: @kaoru0822-kitauji

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6219 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/22/2026 **Status:** ✅ Merged **Merged:** 10/22/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `feat/universal-slice-go-rust` --- ### 📝 Commits (2) - [`00f1e97`](https://github.com/morluto/rea/commit/00f1e973e0110d0074ae6ab1c3df7ca497290a0e) feat(native): inspect a universal Mach-O slice in Go and Rust metadata readers - [`51c281f`](https://github.com/morluto/rea/commit/51c281f124f62e464839c73d61fefcd11ff8d319) fix(native): reject damaged universal files and self-contradicting slice reports ### 📊 Changes **19 files changed** (+902 additions, -35 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+4 -2) 📝 `docs/go-binaries.md` (+15 -5) 📝 `docs/rust-binaries.md` (+12 -3) 📝 `src/application/go/GoBinaryService.ts` (+2 -1) 📝 `src/application/rust/RustBinaryService.ts` (+4 -2) 📝 `src/cli/goCommands.ts` (+18 -3) 📝 `src/cli/rustCommands.ts` (+22 -2) 📝 `src/contracts/go/goToolContracts.ts` (+1 -1) 📝 `src/contracts/rust/rustToolContracts.ts` (+1 -1) 📝 `src/domain/analysisView/goBinaryView.ts` (+6 -2) 📝 `src/domain/analysisView/rustBinaryView.ts` (+6 -1) 📝 `src/domain/apple/machoTargetSelection.ts` (+56 -7) 📝 `src/domain/go/goBinary.ts` (+44 -0) 📝 `src/domain/rust/rustBinary.ts` (+51 -0) 📝 `src/go/GoBinaryProvider.ts` (+33 -3) ➕ `src/native/metadata/MachoSliceSelection.ts` (+149 -0) 📝 `src/rust/RustBinaryProvider.ts` (+43 -2) ➕ `tests/boundary/mcp/universalSliceMcp.test.ts` (+373 -0) ➕ `tests/fixtures/universalMacho.ts` (+62 -0) </details> ### 📄 Description > **What broke:** `inspect_go_binary` / `inspect_rust_binary` refused every universal (FAT) Mach-O and had no way to select a slice; on hosts without `lipo` (Linux, the Docker image) such binaries could not be inspected at all. > **Fix:** an optional `architecture` input. A shared selector reads REA's own FAT table (no `lipo`), validates the slice, and the result keeps the universal file as `artifact` plus `selected_slice`, with all offsets remaining true file offsets. > **Risk:** Low. Thin/ELF/PE inputs are unchanged (no new output field); the old universal refusal becomes a correctable `invalid_request` on `architecture` that lists the slices. ## Summary Fixes #4102 (option 1 in the issue). Before: a universal input failed with `unsupported_target: Universal/fat Mach-O containers require selecting a thin slice`, and the tools had no parameter to select one. After: `architecture: "arm64"` (CLI `--architecture arm64`) inspects that slice directly, and provenance stays tied to the universal file. ## Problem and expected behavior Many macOS releases ship only universal binaries. The issue's example was the GitHub CLI's universal pkg; here I used Tor Browser's `lyrebird` and Cursor's `cursor-tunnel`. REA already parses FAT tables structurally (`readFatContainerHeader`, `classifyFatContainerIdentity`), but these two inspectors only refused. Expected: select a slice by CPU family, record its offset, size and CPU, keep the parent identity, and list the available architectures when the selection is missing or wrong. ## Change and scope - `src/native/metadata/MachoSliceSelection.ts` is the single selector. It parses the FAT table, confirms the slices are Mach-O (JVM class files sharing the magic still pass through to the image reader), and matches the requested CPU family. It then validates the slice's range and alignment, and checks that the slice's own Mach-O header CPU type/subtype agrees with the table. The result is the thin bytes, their file offset, and a `macho-selected-image-v1` identity. The identity reuses the existing provider-neutral schema, including `container_table_sha256` computed over header plus table as the Hopper path does. Failures are a typed `Result`: `architecture` issues (missing, absent, several matches, or given for a non-universal file) versus `malformed` containers. - Go and Rust providers read the selected image and translate image-relative offsets into file offsets: Go `header_offset`, `version_location`, `module_location`; Rust `.dep-v0` `file_offset` and rustc-path hash offsets. `artifact` stays the universal file (SHA-256, size). Schemas add optional `selected_slice` with a refinement that every reported range lies inside the slice. It is optional so previously retained Evidence still parses in `inspect_analysis_view`. - Vocabulary: `architecture` is `x86 | x86_64 | arm | arm64`, REA's `BinaryArchitecture` names. They now live once in `machoTargetSelection.ts` (`MACHO_CPU_TYPES`), which the existing `machoTargetSelectionMatchesArchitecture` also uses. - The Evidence subject format of a selected slice is `mach-o-universal`. The services and the retained Go/Rust views each re-derived `format === "macho" ? "mach-o" : format`, and the views rejected the new value. That mapping now has one owner (`metadataReportSubjectFormat`), used by all four. - Summary views (`detail: "summary"`) carry `selected_slice`. - Not included: IL2CPP's private `selectImage` (`binary_architecture: arm64 | amd64`, its own public failure codes) could move onto this selector, but that changes its public vocabulary and error codes, so it is left for a follow-up. `extract_artifact`'s `lipo` dependency (option 2 in the issue) is also unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: `selectNativeImage` (before any image parsing); subject format in `machoTargetSelection.ts`. - Contribution scope fit and linked maintainer decision: static reads only, within existing inspector boundaries; option 1 from the issue. - CLI and MCP/tool-catalog contract: additive optional `architecture` input on both tools (MCP + CLI `--architecture`); additive optional `selected_slice` output; universal inputs now fail as `invalid_request` on `architecture` instead of `unsupported_target`. - Provider, bridge, target-format, or platform compatibility: no external tools; works without `lipo`. - Evidence, artifact, provenance, or reconstruction contract: artifact identity stays the selected file; source ranges remain file offsets; subject `format: mach-o-universal` with the slice's `architecture`. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: tool catalog descriptions/schemas regenerate in CI. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added (`tests/boundary/mcp/universalSliceMcp.test.ts`, through the MCP server): - Go arm64 selection from a two-slice universal file: `artifact` is the universal file, `selected_slice` holds the exact offset/length/CPU and table digest, and ranges are file offsets that slice back to `go1.26.1`. Subject is `mach-o-universal`/`arm64`, parameters record `architecture`, input and output are validated against the advertised JSON Schemas with Ajv, and `detail: "summary"` for x86_64 carries `selected_slice`. - Refusals: missing selection and an absent CPU, both listing `x86_64 (subtype 0x3), arm64 (subtype 0x0)`; `architecture` on a thin image; two arm64 slices (ambiguous); and a FAT entry whose CPU disagrees with the slice header (malformed `path`). - Rust: the selected slice equals the thin inspection, with `.dep-v0` and rustc offsets shifted by the slice offset; a missing selection fails on `architecture`. - From review: a damaged universal file (slice running past the file) fails on `path` with the FAT reason, with or without `architecture`. Reports whose `selected_slice` contradicts their own format or CPU (`amd64` or `elf`) are rejected by the Go/Rust schemas through one shared `selectedSliceAgreesWithReport` check. The CLI `--architecture` flag is described in help (`cliOptionAliases`). - `tests/fixtures/universalMacho.ts` builds FAT32 fixtures from existing thin fixtures. - Real-binary evidence, executed on macOS arm64 (Node 26.5.0). Baseline = merge-base `origin/main` build: - Baseline on universal input: `inspect-go-binary …/Tor Browser.app/…/lyrebird` and `inspect-rust-binary …/Cursor.app/…/bin/cursor-tunnel` both return `unsupported_target … require selecting a thin slice`. - This PR with `--architecture` vs baseline on the `lipo -thin`-extracted slice. Every field is identical except offsets, which are shifted by exactly `selected_slice.offset`: | Binary (universal) | Selection | Compared with baseline on thin slice | | --- | --- | --- | | Tor `lyrebird` (Go 1.22.12, 32 MB) | arm64, x86_64 | build_info and identity equal; 61 deps; offsets +17088512 (arm64) | | Tor `conjure-client` (Go) | arm64 | inspected (11 KB report) | | Cursor `cursor-tunnel` (Rust) | arm64 | section/rustc offsets shifted; metadata equal | | Cursor `@vscode/ripgrep` `rg` (Rust) | arm64 | same | - Cost: universal-with-selection 0.70–1.14 s wall, 0.93–1.07 s CPU, 354–361 MiB peak RSS (Go, 3 runs). The same branch on the 15 MB thin slice: 0.62 s, 0.94 s CPU, 327 MiB. The extra ~30 MiB is the 32 MB universal file read once; no slice copy is made (`subarray`). Report size is unchanged apart from the ~10-byte `selected_slice` (17,370 vs 17,360 bytes); the summary is 4.2 KB. - User-visible output (no selection): ``` code: invalid_request details.issues: [{ path: ["architecture"], message: "Universal Mach-O holds x86_64 (subtype 0x3), arm64 (subtype 0x0); select one architecture." }] ``` - Remaining proof gaps: no universal Go/Rust binary with cargo-auditable `.dep-v0` data was available locally (both real Rust binaries carry only rustc paths), so the dependency-section shift is covered by the fixture test. Linux/Windows hosts were not run locally (CI). For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- tests/boundary/mcp/universalSliceMcp.test.ts tests/boundary/mcp/goBinaryMcp.test.ts tests/boundary/mcp/rustBinaryMcp.test.ts tests/boundary/mcp/goBinaryViews.test.ts tests/boundary/go/goBinaryImage.test.ts tests/boundary/rust/rustBinaryImage.test.ts tests/acceptance/goBinaryCli.test.ts tests/acceptance/rustBinaryCli.test.ts tests/acceptance/rustDependencyViews.test.ts src/application/go/GoBinaryService.test.ts src/application/rust/RustBinaryService.test.ts tests/boundary/providers/native/artifactProvider.machOSlices.test.ts tests/boundary/filesystem/binaryTarget.test.ts tests/boundary/mcp/absoluteLocalPathSchema.test.ts tests/process-global/stableArtifactConsumers.test.ts tests/boundary/cli/artifactInputLimits.test.ts` — 16 files, 326 tests passed. - After review fixes: `npm run test:focused -- tests/boundary/mcp/universalSliceMcp.test.ts tests/boundary/cli/cliOptionAliases.test.ts tests/boundary/mcp/goBinaryMcp.test.ts tests/boundary/mcp/rustBinaryMcp.test.ts tests/boundary/mcp/goBinaryViews.test.ts tests/acceptance/rustDependencyViews.test.ts tests/boundary/go/goBinaryImage.test.ts tests/boundary/rust/rustBinaryImage.test.ts` — 8 files, 141 tests passed. - `npm run check:fast` — passed. - `npm run format:check` — passed. - `npm run docs:check` — passed. - Real-binary runs above (`npm run build:cached` on both trees). ## Compatibility, safety, and release - Breaking changes or migration steps: none for valid calls. A universal input without `architecture` now returns `invalid_request` (path `architecture`, slices listed) instead of `unsupported_target`. That call never succeeded before, and the new error is the actionable one. - Real Hopper/Ghidra, browser, or OS coverage: macOS arm64 with real Tor Browser and Cursor binaries; no deep provider involved. - Package or release metadata impact: none. - Security, privacy, process, or containment review: static reads only; the slice is validated against the table and its own header before parsing; existing 256 MiB input bound unchanged. ## Author readiness Human owner: @kaoru0822-kitauji - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:46:09 +00:00