242e2b0001
* fix(ghidra): preserve observed function facet and call coverage Declare successful query availability in the Java producer, including explicit unavailable pseudocode reasons. Carry observed static call-set coverage through the parsed provider result and Evidence without inventing facts for legacy omissions. Use Ghidra indexed comment addresses over the function body and entry, retaining cancellation checks and sparse collection. Closes #2951 Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): retain unresolved call coverage in observations Share decoded unresolved-call facts between dossiers, callee coverage and reference observations. Combine terminal and unresolved observations in one instruction traversal and retain site records only when requested. Keep missing procedure identities incomplete and validate unresolved locations at the provider boundary. Bind snapshots to the corrected call coverage profile so older complete claims cannot replay under the new semantics. Add real public MCP callback trace/comparison regressions. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): separate reference targets from callee coverage Reuse containing-function ownership for resolved reference identities and independently compare those identities with the actual returned callee set. Keep known interior routes out of unresolved site records while retaining partial inventory coverage. Advance the coverage profile to v3 and reject interim v2 cache bindings. Add a real Ghidra producer regression with restored reference metadata; the previous bridge fails the known-route assertion. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): measure incoming call coverage across function bodies Compare incoming reference source identities across the owned function body and entry with the actual returned caller set. Stream caller-only checks and reuse dossier reference observations. Combine caller/callee coverage from observed counts without reinterpreting serialized metadata, and share the body scope owner with comments and references. Bind snapshots to function-body coverage semantics v4 and preserve the real off-entry caller regression. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): preserve whole-scope directional call coverage Check body-and-entry call references independently of decoded instruction flow. Reuse collected dossier references and stream inventory-only coverage checks. Keep caller-only gaps distinct from incomplete outgoing coverage in offline path reconstruction, and invalidate prior snapshot profiles. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(mcp): retain compact Evidence field types Share optional diagnostics across the three tagged relationship coverage states instead of advertising duplicate branches. Preserve coverage validation while keeping compact Evidence properties within the existing reference expansion budget. Verify invalid direction cardinalities against the actual SDK-advertised schema. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> --------- Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Ghidra conformance corpus
These source-owned fixtures are compiled at verification time; generated binaries and Ghidra projects are never committed.
-
../c/riscv.candriscv-probe.Sproduce source-owned RV32/RV64 ELF images with double-float ABI declarations and an independently known instruction.npm run verify:ghidra:riscvexercises real CLI/MCP discovery, decompilation, output schemas, profile and snapshot identity, refusal diagnostics, immutable source bytes, and owned cleanup. It requires BYO Ghidra 12.1.4/JDK 21+ and RISC-V Clang/LLD/LLVM readelf;REA_RISCV_CLANG,REA_RISCV_LLDandREA_RISCV_READELFselect existing tool commands. -
inventory.cproduces separate x86-64 debug and stripped ELF executables. It covers imports, an externalputsfunction, linker thunks, source symbols, direct calls, a targetless callback call, two referenced strings, and a multi-block branch. -
entry-aliases.cpreserves secondary imported entry labels, a bare-hex alias, and an interior label. The native CLI/MCP lane verifies entry selection, annotation, interior-label rejection, and unchanged source bytes. -
cross-format.cis freestanding so the verifier can produce AArch64 ELF, x86-64 PE, and x86-64 Mach-O targets from the same semantics. It preserves an exported entry, direct and indirect calls, a volatile string reference, and a multi-block branch across loaders. -
no-return.candReaNoReturnProbe.javainject incorrect import flags into a real ELF or Mach-O analysis database, verify caller recovery, propagated flag repair and signature preservation, and retain genuine/unknown no-return calls and independently identified entries. Runnpm run build:cached, thennode scripts/verify-real-ghidra-noreturn.mjswith the Ghidra/JDK environment below on Linux or macOS x64/arm64. On Linux, use a procps-compatible process table that exposes REA's current process for owned cleanup. It also checks named limitations through the real read-only TCP bridge and provider Evidence projection; default Unix-socket transport, Windows, and the reported Amethyst artifact need separate verification. Fixture target code is never executed.
scripts/verify-real-ghidra.mjs uses cc, clang, and lld-link by default;
REA_CC, REA_CLANG, and REA_LLD_LINK can select alternate commands. The
verifier requires the verified bring-your-own Ghidra 12.1.4 installation through
GHIDRA_INSTALL_DIR and validates header classification before starting the
provider. Provider admission accepts the rest of the 12.1.x line; this lane does
not.
Conformance compares semantic facts: provider/profile identity, function classification, resolved call edges, typed references, strings/xrefs, and CFG topology. It only requires provider pseudocode and assembly to be non-empty, bounded, and address-bearing; it never compares their text with Hopper. The callback fixture also proves that an unresolved targetless flow is not silently promoted to a direct callee. Every target runs in a separate owned project and must leave no process, socket, project, or runtime root after close.
relative-switch-signed.S covers signed halfword offsets, the CBZ zero-entry
route, and selector biases of 0, 2 and 10 in the AArch64 jump-table lane. The
nonzero biases exercise overlapping and disjoint typed label/index ranges. REA
retains Ghidra's typed labels when the compared selector has an earlier register
definition; additional labels remain unknown until their relationship to the
typed switch selector can be proved. The oracle rejects extra numeric labels
and verifies each retained target against the source instruction immediate.