morluto/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00
Code Issues 1.3k Projects Packages Wiki Activity

[PR #7052] [MERGED] feat(binary-layout): admit ELF32 i386, ARM and MIPS layout profiles #7607

New issue
Closed
opened 2026-11-03 13:39:04 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-11-03 13:39:04 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7052
Author: @salmanalmutairi1
Created: 10/25/2026
Status: ✅ Merged
Merged: 10/25/2026
Merged by: @morluto

Base: main ← Head: feat/elf32-binary-layout

📝 Commits (4)

  • ebaf7a4 feat(binary-layout): admit ELF32 i386, ARM and MIPS layout profiles
  • b8426c9 ci(binary-layout): install target libc headers for ELF32 fixtures
  • 1443a20 fix(binary-layout): size the minimum symbol entry by ELF class
  • 27dc69f test(binary-layout): compare ELF32 symbols and relocations with readelf

📊 Changes

10 files changed (+291 additions, -25 deletions)

View changed files

📝 .github/workflows/real-binary-layout.yml (+6 -0)
📝 bridge/pwntools/layout_impl.py (+18 -10)
📝 docs/binary-diagnostics.md (+6 -3)
📝 docs/testing.md (+6 -2)
📝 scripts/verify-binary-layout.mjs (+175 -2)
📝 src/application/binaryDiagnostics/BinaryLayoutService.test.ts (+22 -0)
📝 src/application/binaryDiagnostics/BinaryLayoutService.ts (+7 -1)
📝 src/contracts/native/binaryDiagnosticsToolContracts.ts (+1 -1)
📝 src/domain/native/binaryLayout.test.ts (+30 -0)
📝 src/domain/native/binaryLayout.ts (+20 -6)

📄 Description

Summary

Fixes #6934.

inspect_binary_layout refused every ELF32 object with unsupported_target, so ARM32 and MIPS32 router/IoT firmware got no layout facts. It now admits EXEC/DYN/REL objects in these profiles: ELF64 x86-64 (unchanged), ELF32 i386, ELF32 little-endian ARM and ELF32 little- or big-endian MIPS. Other machines, classes and byte orders still return unsupported_target, and the message names the admitted profiles.

Problem and expected behavior

bridge/pwntools/layout_impl.py accepted only EI_CLASS == ELFCLASS64, EI_DATA == ELFDATA2LSB and e_machine == EM_X86_64, and binaryLayoutSchema pinned architecture to EM_X86_64 / 64 / little. The rest of the adapter already goes through class- and byte-order-aware pyelftools structures (image.structs.Elf_Sym, Elf_Dyn, header sizes), so 32-bit and big-endian layouts need no other parsing change.

Expected: an ELF32 ARM or MIPS executable returns the same layout report as an x86-64 one, with architecture naming its real machine, class and byte order.

Change and scope

  • Bridge. PROFILES maps each admitted (e_machine, class bits, byte order) to the architecture pwntools must also report. The identification fields are read in the declared byte order, ELF32 headers are bounds-checked at 52 bytes, and pwntools' own arch/bits/endian must match the admitted profile after loading.
  • Schema. architecture is a union of the exact admitted combinations, so a report such as EM_386 / 64 or EM_ARM / big still fails validation.
  • Evidence. The subject architecture previously always said x86_64. It now follows the reported machine (x86_64, x86, arm, mips).
  • Verification. verify:binary:layout cross-compiles i386, ARM, MIPS and MIPSel executables and relocatable objects. They are never executed. The verifier compares section names, addresses, offsets and sizes with GNU readelf through both CLI and MCP. It also compares every symbol value/size and every relocation offset, numeric type and symbol table/index reference, retaining table/entry identities and checking the oracle row counts. The real-binary-layout workflow installs the four cross toolchains.

Not included: AArch64, ELF32 big-endian ARM, MIPS64/n32, x32, or any machine outside the list above. GOT/PLT maps and mitigation indicators still come from the unchanged upstream heuristics, and their completeness stays unknown, as before.

Follow the contribution scope. This widens target-format admission of an existing read-only offline operation. It adds no execution, injection or mutation authority. Whether widening architecture needs a maintainer scope decision is asked on #6934 and is still pending.

Contract and boundary impact

  • Semantic owner and earliest changed stage: PwntoolsLayoutProvider's Python adapter (layout_impl.py) owns target admission. binaryLayoutSchema owns the output contract, and BinaryLayoutService composes Evidence. No superseded path remains.
  • Contribution scope fit and linked maintainer decision: existing read-only capability. Question posted on #6934, no decision recorded yet.
  • CLI and MCP/tool-catalog contract: input unchanged. The output architecture field widens from one literal combination to five admitted combinations, and the tool description states the new profile.
  • Provider, bridge, target-format, or platform compatibility: same pinned pwntools 4.15.0 / pyelftools 0.33 / Unicorn 2.1.2 on Linux x64. Existing ELF64 x86-64 reports are unchanged.
  • Evidence, artifact, provenance, or reconstruction contract: the Evidence subject architecture now reflects the target instead of a constant x86_64.
  • Target selection, authority, upstream behavior, and cleanup details: unchanged. The target is never launched, and Unicorn PLT emulation is the existing upstream behavior.
  • Generated metadata, package, or installation impact: none committed. The catalog is regenerated by CI.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated:
    • src/domain/native/binaryLayout.test.ts: admits the four new combinations and rejects mismatched class/machine/byte-order combinations. It also accepts 16-byte Elf32_Sym entries for ELF32 relocations while still refusing undersized ELF32 entries and 16-byte entries in ELF64 reports.
    • src/application/binaryDiagnostics/BinaryLayoutService.test.ts: the Evidence subject names the reported machine.
    • scripts/verify-binary-layout.mjs: real ELF32 cases cross-checked against readelf. The existing AArch64 and core unsupported_target cases are kept.
  • Base reproduction or other evidence: on the base revision, layout_impl.py:119-120 refuses any object with EI_CLASS != 2 before parsing, as quoted in #6934.
  • User-visible CLI/MCP output: the real lane asserts, through both inspect-binary-layout --json and MCP, that each cross-compiled fixture reports architecture {EM_386, 32, little}, {EM_ARM, 32, little}, {EM_MIPS, 32, big} or {EM_MIPS, 32, little} and the expected image_type, and that every section's name, address, offset and size equals GNU readelf -SW. A verbatim report excerpt was not captured from the CI log.
  • Remaining proof gaps: ELF32 big-endian ARM, AArch64 and MIPS64 remain unsupported and unverified. GOT/PLT completeness on ARM/MIPS is reported as unknown and not asserted.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • Review follow-up at 27dc69f93: npm run check, the pre-push npm run check:fast, Node syntax checking and git diff --check passed on macOS (Node 24.22.1, npm 11.16.0). The new ELF32 symbol/relocation comparisons have not been run against the real provider: isolated Linux x64 setup was stopped after sustained dependency-download throttling, and dispatching the fork's Real offline binary layout workflow was denied with HTTP 403. The successful real-provider run below covers the earlier 1443a20 revision.

  • npx tsc -p . --noEmit (Windows 11, Node 24.18.0): passed.

  • npm run test:local -- <17 binary-diagnostics source test files>: 231 passed, 2 skipped, 1 failed. The failure is ByteEntropyService.test.ts "parent directory moves during streaming", which fails identically on the unchanged base on Windows (rename semantics) and is unrelated.

  • npx oxlint on changed files: no new warnings compared with the base files.

  • npm run verify:module-boundaries: passed.

  • Pre-push hook (typecheck, lint): passed.

  • Real offline binary layout workflow on the fork (ubuntu-24.04, pinned pwntools 4.15.0 / pyelftools 0.33 / Unicorn 2.1.2):

    • Run #3 at 1443a20: passed. The verifier step took 232 s, covering the existing ELF64 cases and the eight ELF32 cases.
    • Run #2 at b8426c9: the 20 existing ELF64 cases passed, then the first i686 report was refused as unreadable_output because the relocation check required 24-byte (Elf64_Sym) symbol entries. This was fixed in 1443a20, with regression cases in binaryLayout.test.ts that fail on b8426c9.
    • Run #1 at ebaf7a4: the 20 existing ELF64 cases passed, then the i686 fixture failed to compile because --no-install-recommends skipped the target libc headers. This was fixed in b8426c9.

  • Not run locally: npm run docs:check and boundary tests (test:focused), because the Windows build needs native Windows artifacts absent from a source checkout.

Compatibility, safety, and release

  • Breaking changes or migration steps: none for existing callers. ELF64 x86-64 reports are unchanged. Consumers that assumed architecture was always EM_X86_64 / 64 / little will now also see the ELF32 combinations.
  • Real Hopper/Ghidra, browser, or OS coverage: not applicable. Real pwntools coverage is the workflow above.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no new authority. Targets are still read from an owned snapshot and never executed.

Author readiness

Human owner: @salmanalmutairi1

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7052 **Author:** [@salmanalmutairi1](https://github.com/salmanalmutairi1) **Created:** 10/25/2026 **Status:** ✅ Merged **Merged:** 10/25/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `feat/elf32-binary-layout` --- ### 📝 Commits (4) - [`ebaf7a4`](https://github.com/morluto/rea/commit/ebaf7a470b218308ca0ff605c364be5cb031754e) feat(binary-layout): admit ELF32 i386, ARM and MIPS layout profiles - [`b8426c9`](https://github.com/morluto/rea/commit/b8426c9299607e106f416506a1b7b2a220235267) ci(binary-layout): install target libc headers for ELF32 fixtures - [`1443a20`](https://github.com/morluto/rea/commit/1443a20fb5d337e4903c0b5877ffcbd6d87fa6c7) fix(binary-layout): size the minimum symbol entry by ELF class - [`27dc69f`](https://github.com/morluto/rea/commit/27dc69f93543feca314e07d882d6dc9cee9678bc) test(binary-layout): compare ELF32 symbols and relocations with readelf ### 📊 Changes **10 files changed** (+291 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/real-binary-layout.yml` (+6 -0) 📝 `bridge/pwntools/layout_impl.py` (+18 -10) 📝 `docs/binary-diagnostics.md` (+6 -3) 📝 `docs/testing.md` (+6 -2) 📝 `scripts/verify-binary-layout.mjs` (+175 -2) 📝 `src/application/binaryDiagnostics/BinaryLayoutService.test.ts` (+22 -0) 📝 `src/application/binaryDiagnostics/BinaryLayoutService.ts` (+7 -1) 📝 `src/contracts/native/binaryDiagnosticsToolContracts.ts` (+1 -1) 📝 `src/domain/native/binaryLayout.test.ts` (+30 -0) 📝 `src/domain/native/binaryLayout.ts` (+20 -6) </details> ### 📄 Description <!-- PR title: feat(binary-layout): admit ELF32 i386, ARM and MIPS layout profiles --> ## Summary Fixes #6934. `inspect_binary_layout` refused every ELF32 object with `unsupported_target`, so ARM32 and MIPS32 router/IoT firmware got no layout facts. It now admits EXEC/DYN/REL objects in these profiles: ELF64 x86-64 (unchanged), ELF32 i386, ELF32 little-endian ARM and ELF32 little- or big-endian MIPS. Other machines, classes and byte orders still return `unsupported_target`, and the message names the admitted profiles. ## Problem and expected behavior `bridge/pwntools/layout_impl.py` accepted only `EI_CLASS == ELFCLASS64`, `EI_DATA == ELFDATA2LSB` and `e_machine == EM_X86_64`, and `binaryLayoutSchema` pinned `architecture` to `EM_X86_64` / 64 / little. The rest of the adapter already goes through class- and byte-order-aware pyelftools structures (`image.structs.Elf_Sym`, `Elf_Dyn`, header sizes), so 32-bit and big-endian layouts need no other parsing change. Expected: an ELF32 ARM or MIPS executable returns the same layout report as an x86-64 one, with `architecture` naming its real machine, class and byte order. ## Change and scope - **Bridge.** `PROFILES` maps each admitted `(e_machine, class bits, byte order)` to the architecture pwntools must also report. The identification fields are read in the declared byte order, ELF32 headers are bounds-checked at 52 bytes, and pwntools' own `arch`/`bits`/`endian` must match the admitted profile after loading. - **Schema.** `architecture` is a union of the exact admitted combinations, so a report such as `EM_386` / 64 or `EM_ARM` / big still fails validation. - **Evidence.** The subject architecture previously always said `x86_64`. It now follows the reported machine (`x86_64`, `x86`, `arm`, `mips`). - **Verification.** `verify:binary:layout` cross-compiles i386, ARM, MIPS and MIPSel executables and relocatable objects. They are never executed. The verifier compares section names, addresses, offsets and sizes with GNU `readelf` through both CLI and MCP. It also compares every symbol value/size and every relocation offset, numeric type and symbol table/index reference, retaining table/entry identities and checking the oracle row counts. The `real-binary-layout` workflow installs the four cross toolchains. Not included: AArch64, ELF32 big-endian ARM, MIPS64/n32, x32, or any machine outside the list above. GOT/PLT maps and mitigation indicators still come from the unchanged upstream heuristics, and their completeness stays `unknown`, as before. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). This widens target-format admission of an existing read-only offline operation. It adds no execution, injection or mutation authority. Whether widening `architecture` needs a maintainer scope decision is asked on #6934 and is still pending. ## Contract and boundary impact - Semantic owner and earliest changed stage: `PwntoolsLayoutProvider`'s Python adapter (`layout_impl.py`) owns target admission. `binaryLayoutSchema` owns the output contract, and `BinaryLayoutService` composes Evidence. No superseded path remains. - Contribution scope fit and linked maintainer decision: existing read-only capability. Question posted on #6934, no decision recorded yet. - CLI and MCP/tool-catalog contract: input unchanged. The output `architecture` field widens from one literal combination to five admitted combinations, and the tool description states the new profile. - Provider, bridge, target-format, or platform compatibility: same pinned pwntools 4.15.0 / pyelftools 0.33 / Unicorn 2.1.2 on Linux x64. Existing ELF64 x86-64 reports are unchanged. - Evidence, artifact, provenance, or reconstruction contract: the Evidence subject architecture now reflects the target instead of a constant `x86_64`. - Target selection, authority, upstream behavior, and cleanup details: unchanged. The target is never launched, and Unicorn PLT emulation is the existing upstream behavior. - Generated metadata, package, or installation impact: none committed. The catalog is regenerated by CI. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: - `src/domain/native/binaryLayout.test.ts`: admits the four new combinations and rejects mismatched class/machine/byte-order combinations. It also accepts 16-byte `Elf32_Sym` entries for ELF32 relocations while still refusing undersized ELF32 entries and 16-byte entries in ELF64 reports. - `src/application/binaryDiagnostics/BinaryLayoutService.test.ts`: the Evidence subject names the reported machine. - `scripts/verify-binary-layout.mjs`: real ELF32 cases cross-checked against `readelf`. The existing AArch64 and core `unsupported_target` cases are kept. - Base reproduction or other evidence: on the base revision, `layout_impl.py:119-120` refuses any object with `EI_CLASS != 2` before parsing, as quoted in #6934. - User-visible CLI/MCP output: the real lane asserts, through both `inspect-binary-layout --json` and MCP, that each cross-compiled fixture reports `architecture` `{EM_386, 32, little}`, `{EM_ARM, 32, little}`, `{EM_MIPS, 32, big}` or `{EM_MIPS, 32, little}` and the expected `image_type`, and that every section's name, address, offset and size equals GNU `readelf -SW`. A verbatim report excerpt was not captured from the CI log. - Remaining proof gaps: ELF32 big-endian ARM, AArch64 and MIPS64 remain unsupported and unverified. GOT/PLT completeness on ARM/MIPS is reported as `unknown` and not asserted. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - Review follow-up at `27dc69f93`: `npm run check`, the pre-push `npm run check:fast`, Node syntax checking and `git diff --check` passed on macOS (Node 24.22.1, npm 11.16.0). The new ELF32 symbol/relocation comparisons have **not** been run against the real provider: isolated Linux x64 setup was stopped after sustained dependency-download throttling, and dispatching the fork's `Real offline binary layout` workflow was denied with HTTP 403. The successful real-provider run below covers the earlier `1443a20` revision. - `npx tsc -p . --noEmit` (Windows 11, Node 24.18.0): passed. - `npm run test:local -- <17 binary-diagnostics source test files>`: 231 passed, 2 skipped, 1 failed. The failure is `ByteEntropyService.test.ts` "parent directory moves during streaming", which fails identically on the unchanged base on Windows (rename semantics) and is unrelated. - `npx oxlint` on changed files: no new warnings compared with the base files. - `npm run verify:module-boundaries`: passed. - Pre-push hook (`typecheck`, `lint`): passed. - `Real offline binary layout` workflow on the fork (ubuntu-24.04, pinned pwntools 4.15.0 / pyelftools 0.33 / Unicorn 2.1.2): - [Run #3](https://github.com/salmanalmutairi1/rea/actions/runs/40146961060) at `1443a20`: **passed**. The verifier step took 232 s, covering the existing ELF64 cases and the eight ELF32 cases. - [Run #2](https://github.com/salmanalmutairi1/rea/actions/runs/40146442134) at `b8426c9`: the 20 existing ELF64 cases passed, then the first i686 report was refused as `unreadable_output` because the relocation check required 24-byte (`Elf64_Sym`) symbol entries. This was fixed in `1443a20`, with regression cases in `binaryLayout.test.ts` that fail on `b8426c9`. - [Run #1](https://github.com/salmanalmutairi1/rea/actions/runs/40144681350) at `ebaf7a4`: the 20 existing ELF64 cases passed, then the i686 fixture failed to compile because `--no-install-recommends` skipped the target libc headers. This was fixed in `b8426c9`. - Not run locally: `npm run docs:check` and boundary tests (`test:focused`), because the Windows build needs native Windows artifacts absent from a source checkout. ## Compatibility, safety, and release - Breaking changes or migration steps: none for existing callers. ELF64 x86-64 reports are unchanged. Consumers that assumed `architecture` was always `EM_X86_64` / 64 / little will now also see the ELF32 combinations. - Real Hopper/Ghidra, browser, or OS coverage: not applicable. Real pwntools coverage is the workflow above. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no new authority. Targets are still read from an owned snapshot and never executed. ## Author readiness Human owner: @salmanalmutairi1 - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-03 13:39:04 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
release-please--branches--main--components--rea-agents
release-please--branches--main--components--rea-agents--release-notes
codex/procedure-reference-stacked
codex/kuna-independent-retry
codex/byte-search-overlay-coverage
codex/open-failure-target-receipt
codex/kuna-xref-evidence
codex/ghidra-ambiguous-procedure-recovery
codex/function-source-bundle
codex/trace-function-integration-prototype
codex/snapshot-source-closure
codex/recorded-evidence-array-pages
codex/evidence-recovery-redesign
codex/trace-feature-address-scope
codex/call-discovery-scope
codex/ghidra-literal-candidate-evidence
codex/decompile-directory-independent-retry
codex/retry-provenance-base
codex/value-flow-capability-experiment
codex/ghidra-containing-instruction
cursor/readme-discord-button-ef9f
dependabot/github_actions/actions/setup-node-7.1.0
dependabot/github_actions/actions/upload-artifact-7.0.2
dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df
codex/kuna-1989
fix/8559-native-ui-fixture-ownership
fix/8555-go-verifier-mcp-ownership
codex/provider-capability-recovery
fix/8642-rizin-target-stdin
codex/ghidra-memory-effect-scope
codex/ghidra-annotation-entry-selector
codex/ghidra-readonly-recovery
codex/ghidra-regex-verifier-recovery
codex/evidence-discovery-view-guidance
fix/8545-bulk-append-overflow
fix/8428-navigation-refusal-alternatives
codex/address-context-recovery
codex/matching-member-limitations
codex/unknown-scope-contract
codex/evidence-view-guidance
feat/8373-native-trace-views
codex/ghidra-snapshot-verifier-binding
codex/elf-export-visibility
codex/evidence-view-recovery
codex/native-reference-cli-help
codex/provider-candidate-observation-scope
codex/kuna-session-verification
codex/ghidra-switch-lifetime-guidance
codex/pseudocode-paging-discovery
codex/clarify-evidence-view-support
codex/kuna-xrefs-selector-recovery
codex/context-capacity-recovery
codex/evidence-closure-large-links
codex/same-function-evidence-identity
codex/ghidra-verifier-inspected-jdk
codex/audit-guided-workflows
codex/crash-prompt-retained-dossiers
codex/analysis-view-error-recovery
codex/kuna-verifier-target-selection
codex/ghidra-selected-project-call-coverage
codex/docs-native-analysis-scope
codex/ghidra-java-socket-boundary
codex/ghidra-retained-snapshot-verifier
codex/ghidra-search-inventory-facts
fix/8284-zero-argument-parameter-bindings
fix/8198-ui-action-handler-offset
fix/8257-elf-entry-label-identity
fix/8304-deferred-output-schema-projection
fix/8277-call-path-computed-target-uncertainty
fix/pr-8089-conflicts
fix/ci-static-duplicate-export
dependabot/npm_and_yarn/lint-staged-17.6.0
dependabot/github_actions/actions/download-artifact-8.0.2
dependabot/npm_and_yarn/write-file-atomic-8.0.0
dependabot/npm_and_yarn/canonicalize-5.1.0
dependabot/github_actions/actions/cache/restore-6.1.0
dependabot/npm_and_yarn/toon-format/toon-4.4.0
dependabot/github_actions/actions/deploy-pages-5.0.1
codex/review-fixes-pr-2403
codex/review-fixes-pr-2400
codex/process-terminal-width
codex/test-brittleness-cleanup
verify/7167-browser-connect-macos
fix/7167-browser-connect
feat/native-matching-allowance-setting
feat/browser-scenario-dry-run
test/managed-caller-parameters-20261024
codex/parser-fortythird-boundaries
fix/6926-pinvoke-platform-decorations-20261023
fix/6889-har-body-encoding-20261023
fix/6888-sqlite-schema-budget-20261023
fix/dependency-security-gates-6708
cursor/evidence-overwrite-rebase-b4ac
feat/4057-verify-native-exports
fix/windows-acl-observer-overhead-20261022
cursor/erlang-beam-restack-4476
cursor/pe-certificate-review-bf32
fix/6116-javascript-application-fs-errors
fix/6061-unmapped-runtime-script-unknown
feat/browser-scenario-summary
fix/pe-certificates
codex/verify-3407
cursor/rebase-5699
cursor/rebase-5352
cursor/rebase-5600
cursor/fix-cli-schema-omission-10a8
codex/audit-hopper-shutdown-reasons-20261021
fix/demangle-swift-omitted-record
fix/nib-boolean-value-types
cursor/cancellation-partial-observation-a5ac
fix/ib-object-limit-reasons
fix/electron-fuse-limit-advice
fix/kuna-doctor-dangling-cache
fix/fixed-budget-refusal-advice
fix/js-ipc-listener-dedup
fix/js-return-member-provenance
fix/dmg-integrity-retry-advice
fix/ida-doctor-readiness
fix/kuna-version-probe-output-drain
fix/legacy-swift-runtime-name-matching
fix/dylib-lazy-load-commands
fix/browser-scenario-startup-cancel
fix/swift-nested-punycode-classification
fix/compare-unselected-scopes
fix/objc-method-budget-coverage
fix/dmg-mounted-root-observations
audit/ci-tests-20261019-round2
release/6.7.0
fix/wabt-cleanup-retry-resolution
fix/electron-fuse-elf-pe-architecture
fix/native-plist-descriptor-ownership
fix/kuna-caller-cleanup-ownership
experiment/atomic-codemode-20261016
review/first-contributor-3776
fix/call-resolution-full-read-cycles
fix/member-mutation-selection-repeat
experiment/atomic-re-tools-20261015
perf/member-mutation-lazy-origins
perf/static-network-mutation-index
fix/hopper-startup-lifecycle
audit/3050-windows-proof-20261015
feat/windows-window-capture-2183
audit/3049-windows-proof-20261015
audit/3735-macos-fixtures-20261015
fix/batch-decompile-null-pseudocode
fix/kuna-inventory-honors-jobs
experiment/browser-codemode-tool-design-20261015
fix/hopper-clean-runtime-argv
codex/review-2049-27f1b367
review-fixes/pr-2787-routing
fix/3360-scoped-this-emitters
fix/3367-replaced-global-effects
fix/3838-compact-any-value-items
test/hopper-download-probe-20261015
codex/windows-runtime-creation-red-green-20261015
codex/windows-readonly-root-red-green-20261015
codex/windows-root-share-red-green-20261015
codex/exp-1685-win-mcp-startup
codex/bug-sweep-20261015
investigate/2190-windows-package-phases
investigate/3543-macos-cli-deadline
perf/3281-reverse-tools-feedback-quality
fix/3406-hopper-doctor-fixture
fix/3341-wrapper-require-test-context
fix/3301-owned-uninstall-fixtures
fix/3164-compiler-input-ownership
fix/pcap-cleanup-stdout-newline-20261014
perf/interface-builder-summary
codex/review-fixes-pr-1977
fix/ghidra-effective-jvm-platform
fix/docs-turkish-rust-link-20261013
fix/main-maintenance-ci-20261010
fix/recover-binary-session-process-effects
codex/review-fixes-pr-2457
codex/ci-required-cancellation-gate
fix/main-format-baseline-20261013
fix/setup-preserve-entry-fields
cursor/restore-main-checks-1ffc
fix/ghidra-bridge-hashmap-import
codex/shared-ci-jadx-json-default-20261013
codex/shared-ci-ghidra-test-groups-20261013
codex/shared-ci-java-fixture-format-20261013
codex/fix-intrinsic-invocation-boundaries
test/release-preflight-reusable-jobs
test/js-parameter-provenance-expectation
fix/linux-hopper-verification-current
test/2419-ghidra-elf-probe-size
followup/pr-1544-native-ida
codex/fold-pr-2230-contribution
docs/readme-responsible-use
fix/issue-2064
fix/issue-2050
fix/issue-2053
fix/issue-1968
fix/issue-1945
experiment/codemode-bridge-20261011
fix/tool-effects-negative-wording-1904-20261012
fix/1842-electron-interop-provenance
feat/recover-javascript-multi-input
refactor/website-i18n-prep
fix/nativeaot-pe-virtual-extent
fix/browser-verifier-ci-hang
fix/pe-resources-input-selection
docs/beginner-friendly-guides
docs/beginner-setup-guide
fix/javascript-analysis-worker-1563
fix/1649-ghidra-duplicate-names
fix/javascript-export-keys-integration-1369
test/maintenance-boundary-contracts-20261011
review/javascript-export-keys-1369
review/process-live-progress-1483
test/javascript-1495-growth-ratio
fix/ci-escape-timing
docs/normalized-terminal-geometry-1450
release/6.3.0
archive/release-6.3.0-pr1381
release/6.2.0
fix/electron-preload-dynamic-override
fix/javascript-self-referential-bundler-edges
release/6.1.0
cursor/grok-client-cherry-pick-0b56
feat/signature-posture
feat/dyld-shared-cache
feat/artifact-integrity-policy
feat/pkg-inventory
release/6.0.0
chore/sync-release-5.0.0
release/5.0.0
cursor/cloud-agent-node-787e
fix/javascript-xhr-open-endpoints
review/pr-711-realpath-fallback-wording
cleanup/replay-confinement
codex/test-suite-performance
codex/issue-foundations
codex/address-open-issues-2026-07-20
agent/javascript-vite-rollup-esbuild-adapters
agent/process-cleanup
agent/triage-integration
agent/unknown-commands-registry
feat/mcp-identity-metadata
morlvps/issue_cleanup
codex/installer-redesign
morl/roadmap-investigation-core
morl/roadmap-investigation-docs
release-please--branches--main--components--rea
rea-agents-6.8.0
rea-agents-6.7.0
rea-agents-6.6.0
experiment/atomic-codemode-wait-runtime-20261016
rea-agents-6.5.0
rea-agents-6.4.0
rea-agents-6.3.0
rea-agents-6.2.0
rea-agents-6.1.0
rea-agents-6.0.0
rea-agents-5.0.0
rea-agents-4.1.0
rea-agents-4.0.1
rea-agents-4.0.0
rea-agents-3.2.1
rea-agents-3.2.0
rea-agents-3.1.0
rea-agents-3.0.0
rea-agents-2.7.0
rea-agents-2.6.0
rea-agents-2.5.1
rea-agents-2.5.0
rea-agents-2.4.0
rea-agents-2.3.0
rea-agents-2.2.0
rea-agents-2.1.0
rea-agents-2.0.0
rea-agents-1.7.0
rea-agents-1.6.0
rea-agents-1.5.0
rea-agents-1.4.0
rea-agents-1.3.0
rea-agents-1.2.0
rea-agents-1.1.0
rea-agents-1.0.0
rea-agents-0.5.0
rea-agents-0.4.0
rea-agents-0.3.0
rea-0.2.1
rea-0.2.0
Labels
Clear labels   
area: bridge

   
area: bridge

   
area: build

   
area: build

   
area: build

   
area: cli

   
area: domain

   
area: evidence

   
area: mcp

   
area: native

   
area: providers

   
area: runtime

   
area: server

   
area: setup

   
area: tests

   
bug

   
design

   
documentation

   
enhancement

   
enhancement

   
enhancement

   
experiment

   
help wanted

   
i18n

   
invalid

   
P0: critical

   
P1: high

   
P2: medium

   
P2: medium

   
P2: medium

   
P3: low

   
performance

   
provider-request

   
pull-request
Mirrored from GitHub Pull Request

  
question

   
roadmap

   
triage
No labels
area: bridge
area: bridge
area: build
area: build
area: build
area: cli
area: domain
area: evidence
area: mcp
area: native
area: providers
area: runtime
area: server
area: setup
area: tests
bug
design
documentation
enhancement
enhancement
enhancement
experiment
help wanted
i18n
invalid
P0: critical
P1: high
P2: medium
P2: medium
P2: medium
P3: low
performance
provider-request
pull-request
question
roadmap
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7607
No description provided.