* feat(evidence)!: give Evidence bundles a format revision owned by one module
`src/domain/evidenceFormat.ts` owns Evidence format evolution. Bundles now
carry `evidence_format: 1`; every bundle reader admits only the current
revision and refuses an unmarked or other-revision bundle once, with the
single recreate-observations guidance, instead of admitting earlier shapes
one optional field at a time.
The 6.7-era artifact inventory summary identities are no longer rebuilt:
compare_artifacts checks the current projection only and reports a mismatch
with the owner's guidance. The pre-6.6 identity diagnosis uses the same
guidance. SQLite `worker_timeout_ms` and Dart AOT `string_pool.policy`,
optional only for historical Evidence, are now required.
BREAKING CHANGE: Evidence bundles written by REA 6.x (no `evidence_format`)
are refused by import, comparison, reconstruction and analysis-snapshot
readers as an integrity mismatch telling the caller to recreate the
observations; re-exporting an earlier bundle does not update its format or
identities. Bundles constructed by hand must include `"evidence_format": 1`.
6.7-era artifact summaries are refused by compare_artifacts, and SQLite and
Dart AOT Evidence without the newly required fields fails validation.
* fix(evidence): let the ledger application admit its bundle's format
build_reconstruction_obligation_ledger registered the full bundle schema with the SDK, so an unmarked or other-revision bundle was refused as invalid_request before the format owner ran. Register it like coverage: the application parses the request envelope and admits the bundle.
* feat(pcap)!: read capture Evidence through the current result schema only (#10879)
Delete the pcap read-compatibility schema that defaulted executable identity for historical capture Evidence, and require query_labels_hex (null when unknown) now that every producer writes it. Evidence from an earlier format is refused at the bundle format owner; a record that omits these fields is reported as malformed instead of defaulted.
BREAKING CHANGE: inspect_pcap_capture results always carry query_labels_hex, and analysis views no longer default missing tshark/capinfos identity fields.
* feat(desktop)!: require the effective view policy in desktop state Evidence (#10886)
inspect_desktop_application_state always records the complete policy it used, including sqlite_view_bytes. Drop the optional historical shape and the task draft's absent-policy branch.
BREAKING CHANGE: desktop application state results without effective_view_policy, or with a policy missing sqlite_view_bytes, are refused as malformed.
* feat(android)!: require component declaration facets and reference aggregates in Android Evidence (#10904)
* feat(android)!: require component declaration facets and reference aggregates in Android Evidence
The JADX producers always write the manifest component projection with every declaration facet, target_definition and direct_invokes_coverage. Require them, delete the duplicate observed component schema, drop the unknown declaration coverage that only described historical omission, and give manifest view results their explicit facet.
BREAKING CHANGE: Android package, component and reference results missing these fields are refused as malformed; component declaration_coverage and its summary counts no longer include unknown; manifest view results always carry facet manifest.
* refactor(android): parse package results with the domain schema directly
* feat(browser)!: require the DOM length unit and redirect-scoped prior-hop facts (#10897)
* feat(browser)!: require the DOM length unit and redirect-scoped prior-hop facts
Both CDP producers always declare node_value_length_unit, and the observation session writes redirect_response on every redirect event and no other. Require the unit, drop the diff's absent-unit branch, and admit redirect_response exactly on redirect rows.
BREAKING CHANGE: DOM snapshots without node_value_length_unit and redirect timeline rows without redirect_response are refused as malformed, including inline inspections passed to compare_web_captures.
* docs(browser): drop the historical redirect_response omission note
* feat(native)!: require native Evidence fields that were optional only for historical Evidence (#10946)
Mach-O encryption, slice malformed cause, symbol runtime names and import
facts; ELF export encoding facts and visibility; value-flow limits; load-image
permissions and relocation symbols; Swift type-reference kind and GPU AMD
target metadata are required. Legacy enum values (unrecorded, unknown
visibility, undecodable, modinfo_field_exceeds_limit) and the retained
schemas, view defaults and reinterpretations that served historical Evidence
are deleted.
BREAKING CHANGE: native records missing these fields are refused as
malformed; recreate the observation.
* fix(artifacts): report ZIP bytes the central directory does not account for
* fix(artifacts): validate ZIP accounting and join traversal
* fix(artifacts): match an unsigned ZIP data descriptor whose CRC equals the signature
The optional descriptor signature only adds a candidate layout; both layouts are checked against the recorded CRC and sizes.
* fix(artifacts): keep ZIP close observable and account AES data descriptors
Close joins running traversal steps instead of returning the traversal, so a caller's next step after close still rejects as unavailable. Member accounting reads through BinaryReader, and a data descriptor whose directory reports no CRC (AE-2) is matched on its sizes.
* fix(artifacts): honor record-and-continue for lipo and FAT slice disagreement
* fix(artifacts): keep recovered slice names distinct, lipo field evidence, and unknown coverage without a FAT parse
* fix(artifacts): keep lipo's unnormalized CPU declarations when FAT ranges are authoritative
A successful batch_decompile item carried no item-level provenance:
only the batch Evidence aggregated limitations, so when a provider such
as Kuna answered repeated selectors from different sources, the caveat
did not say which occurrence it applied to. Successful items now keep
their own observation's limitations (exactOptional, so retained records
still parse), and the retained items view projects them.
The batch unavailable item also dropped the provider's typed
pseudocodeAbsence reason; it now carries pseudocode_absence.
Fixes#8350
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
A cursor for another target, profile, pattern, mask, bounds, or document
was reported as invalid input and pointed at schema repair. Name the
binding, attribute the issue to the cursor, and leave the differing
component unknown.
Fixes#8366
Supersedes #8420
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
* fix(call-path): keep computed-call targets out of complete callee coverage
Ghidra reported complete callee coverage when a computed call had one
ReferenceManager target, so trace_call_path, build_call_path and the
function comparisons turned the static candidate into a definite negative.
The bridge now keeps those targets as observed callees and marks callee
coverage partial, naming the computed call sites. IDA callee reads cannot
classify their call sites, so their callee coverage is partial too. The
Ghidra call-coverage profile revision refuses older snapshots.
A source-owned x86-64 bridge probe in the ghidra-bridge-sources job checks
the slot, register and direct-call controls against real Ghidra.
Fixes#8277
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ci): match the observed call coverage probe marker
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(objdump): reflect observed launch failure in discovery availability
Distinguish a statically registered standalone command from an executable
whose launch has failed in the active server session. Discovery leaves
unprobed commands optimistically available, reports an observed launch
failure as provider_unavailable with the command remediation, keeps the
tool callable for retries, and clears the failure after a subsequent
successful launch.
Fixes#8826.
* test(reverse): verify overlapping command launch dispatch ordering
* test(reverse): unblock gated test workers before awaiting service closure
* test(reverse): bound lifecycle acknowledgement and join launched workers
* fix(reverse): distinguish host capacity exhaustion from command launch failures
* fix(reverse): preserve host capacity across Linux process ownership preparation
* fix(reverse): exclude process ownership admission failures from command launch state
* fix(reverse): preserve Darwin process ownership preparation error across command launch
* fix(reverse): disambiguate cleanup declaration in provider observation
* fix(reverse): preserve command deadline timeout during Darwin ownership preparation
* fix(reverse): isolate Darwin baseline ps errors and provide platform-aware admission guidance
* fix(reverse): rely on typed baseline admission failures and use owning repair formatter in tests
* test(reverse): use owning formatters for process ownership remediation assertions
* fix(reverse): restrict Linux ownership prerequisite remediation to missing ps and preserve system error codes
* fix(reverse): retain typed process ownership prerequisite with preserved error codes
* fix(reverse): remove unvalidated error label fallbacks and keep admission tags out of system_code
* fix(reverse): keep Windows native runner failures out of command-launch state
* fix(process): preserve current_process_unreported refusal in Linux provider readiness
* fix(process): distinguish no-code ps failure from missing ps and cover rizin launch failure
* fix(windows): classify process_spawn host-control rejections as RuntimeControlUnavailableError
* fix(native)!: preserve value-flow absence semantics
* fix(mcp): report native value flow support in session status
* test(mcp): share schema validation and assert status facts
* chore: preserve unrelated main imports
* feat(mcp): report provider release verification in session
* test(kuna): verify release guidance at its owner
* fix(kuna): verify release against reported version
* test(mcp): keep temporary fixture cleanup with its owner
* docs(mcp): clarify retained evidence view support
* docs(mcp): describe pageable pseudocode alternative
* docs(mcp): page retained procedure pseudocode in place
procedure_pseudo_code Evidence already supports summary and native
pseudocode views of the original observation. The guide no longer says
that paging requires a new analyze_function dossier.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* docs: organize canonical documentation layout (URGENTE)
Group all existing authored guides by domain and ownership, expose complete navigation, and preserve their public routes. Update physical path consumers and release configuration while retaining historical records. Document domain-based specs and ADR slugs without global numbering.
Co-Authored-By: Codex <noreply@openai.com>
* fix(docs): honor home layout in all-page route verification
* style: format reviewed source changes
* fix(docs): preserve routes and navigation cache inputs
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(docs): update links after guide relocation
* docs: correct verified documentation route counts
* fix(docs): update browser capture guide link after move (#2820)
Refresh gettext protected-link comments alongside the authored href.
Co-authored-by: Codex <noreply@openai.com>
* fix(docs): include http3 lab in stable routes
* fix(docs): preserve historical release evidence and links
* fix(ghidra): restore Windows verifier identity import
* docs(wakaru): preserve pinned upstream policy link
* docs(index): retain recently added guide links
* docs(mcp): preserve parent retention clarification
* fix(cli): preserve standalone import guidance
* fix(test): preserve translated guide link drift coverage
---------
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: morluto <17176810+morluto@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
morluto