OpenSource/reverse-engineering-anything
1
0 Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-12 09:52:27 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
7fe465505fb54ff514b3206d5d97fd643ad1fcda
reverse-engineering-anything/docs/specs/analysis/recoverable-budgets/tasks.md
T
morluto cb4e5cfbff feat(analysis): make resource budgets recoverable across CLI and MCP (#9706) 
* refactor(analysis): centralize resource budgets and recovery facts

* feat(analysis): expose ASAR and Ghidra runtime admission controls

* feat(artifacts): expose reader admission and preserve limited recognition

* feat(javascript): expose recoverable semantic precision budgets

* feat(web): add recoverable source-map budgets and compact retained views

* feat(web): make historical capture decoding budgets recoverable

* fix(desktop): enforce selected view policies across capture and export

* feat(runtime): make Frida and LLDB retention budgets selectable

* feat(native): expose diagnostic budgets and preserve exhaustion causes

* feat(managed): expose recoverable snapshot and representation budgets

* feat(metadata): make Go and Rust inspection budgets recoverable

* feat(wasm): expose representation and producer admissions

* feat(evm): expose per-call worker resource budgets

* feat(android): make resource and string-pool omissions recoverable

* feat(producers): expose command and recorded-capture budgets

* docs(analysis): record recovery contracts and integrated validation

* fix(docs): link calibration oracle from published verification pages

* fix(docs): restore desktop task anchors and receipt links

* test(analysis): align fixtures with selectable budget contracts

* fix(analysis): remove source-location projector dependency cycle

* test(analysis): refresh budget recovery and verifier regressions

* test(analysis): preserve format and publication recovery expectations

* test(windows): align conformance with owned runtime admission

* fix(desktop): preserve selected alias kinds in exported state

* test(analysis): align provider fixtures with recoverable budgets

* test(desktop): validate emitted alias metadata structurally

* fix(ghidra): classify bounded Windows endpoint refusals

* test(cli): assert selectable artifact admission recovery

* fix(cli): preserve capture provenance in environment builds
2026-11-10 05:11:20 -05:00

8.8 KiB
Raw Blame History

Tasks

  • Separate source validity from retained modinfo fields.
  • Preserve GDB exhaustion causes and improve Ghidra value-flow recovery.
  • Consolidate desktop policy with emitted Python and expose caller controls.
  • Make Apktool string omissions reachable through caller selection.
  • Thread JavaScript semantic precision policy through actual evaluators.
  • Coordinate source-map parent, codec and fetch budgets.
  • Coordinate historical-capture parent and decoder budgets.
  • Expose independent artifact/managed admission and preserve partial Rust facts.
  • Expose capture retention policy without changing target authority.
  • Expose producer resource/output controls with exact recovery.
  • Integrate ASAR runtime setting, launch validation and setup forwarding.
  • Complete focused and integrated checks, update product docs and report gaps.
  • Repair reviewed managed CLI decimal parsing and selected-budget provenance.
  • Preserve Go/Rust owner-supplied exhaustion facts through summary views.
  • Preserve selected desktop policy separately from effective policy and bound the emitted reader's initial probe during file growth.
  • Compare representative completed Flutter and source-map tasks before calibrating defaults; retain reproducible inputs, oracles and receipts.
  • Preserve limited Bun recognition through inventory and probe facts.
  • Add per-call artifact admission policies and exact same-artifact recovery.
  • Align shipped desktop seed task admission with generated reader policy.
  • Add retained source-location summaries, paged matches and bounded text.
  • Verify compact point tracing on the pinned public maps and refresh native provider recovery coverage; complete coordinated integration checks.

Validation

Executed with the pinned Node 24.22.1 / npm 11.16.0 toolchain:

  • Runtime build and packaged skill generation through the focused-test prerequisite.
  • npm run check:fast: typecheck, lint and module boundaries pass.
  • npm run format:check: passes.
  • npm run test:python: bridge and analysis-efficiency suites pass.
  • npm run verify:test-discovery: all 3,218 test files discovered exactly once.
  • npm run knip:production: passes; advisory candidates were inspected rather than removed without runtime/verifier ownership evidence.
  • npm run docs:generate and npm run docs:check: pass, including the managed conformance generator and README consistency checks. Removed obsolete ignored managed-verifier argument bags instead of adding permissive budget fallbacks.

Focused tests ran in batches across CLI, MCP, worker, parser, lifecycle and provider boundaries. The primary 28-file run passed 726 tests, with six failures and one host skip. Those failures were repaired and every affected file passed its targeted rerun. The supplementary producer run passed 512 tests with five failures and 120 platform skips; every affected file then passed its rerun. The final capture-only run passed all 45 tests. This is a record of separate executed runs, not an aggregate unique-test count or a claim that check:pr ran.

Recovery checks include the same retained target after raised admission, explicit selection reaching an omitted item, lower-budget cache re-admission, worker-policy changes without stale results, generated Python parity, exact exhaustion causes, and malformed/cancellation/cleanup controls. Integration review also found and fixed XML/JSON view and historical-capture nesting budgets that initially failed to reserve complete Evidence wrapper depth.

The subsequent review fixes passed all 50 tests across six compiled acceptance, CLI, MCP and emitted-Python boundary files. Typecheck and lint also passed after those fixes. Default calibration records its separate measurements and limitations in the Flutter and source-map reports; those measurements are not native-provider verification. The calibrated source-map default and explicit smaller-budget recovery passed all six compiled source-location CLI tests. The final formatting, type/lint, generated-documentation and README consistency checks passed. The observer's completed, timeout, surviving-child and signal-refusal controls retained receipts and confirmed empty process groups.

The final follow-up adds per-call artifact admission, limited recognition, shipped-seed policy agreement, bounded SQLite views and retained source-location delivery. The 12-file compiled CLI/MCP run passed 56 tests and exposed four stale fixed-limit expectations; those owner expectations were updated to structured resource facts and all five rerun files passed 60 tests, including the shared analysis-view integration suite. The SEA MCP matrix separately passed both full and compact schema profiles with same-session lower/raise/lower admission. The final SQLite worker/emitted-reader checks passed all four scenarios. These are separate executed runs, not an aggregate unique-test count.

The source-location delivery qualification retains 18 successful public MCP measurements with matching parent IDs, exact mapping/snippet oracles and process-tree samples. The JavaScript precision calibration retains 12 real CLI runs supporting unchanged numeric defaults for that narrow corpus. Native capture qualification and the live same-Program Ghidra receipt are linked from the runtime verification report. The Python gate passed all 102 tests; architecture guards passed across 2,571 source files. Formatting, type/lint, generated docs, README consistency and production reachability checks passed. Reachability advisory candidates were reviewed without deleting runtime/verifier-owned exports. The complete check:pr gate was not run.

Integration onto current main for the PR

Integrated onto main 8dfc47b107afc0cf4b53322a10b94c666fe9e18b, preserving its new desktop secret isolation, custom task readers, gzip support, Deno recognition, signed bundle validation and chunked I/O. Incomplete Bun/SEA recognition now keeps known native or other confirmed-pack observations with an explicit unknown cause; it never caches unexamined data as absence. Main's malformed-directory validation continues to take precedence over adjustable Godot retention.

The fresh 11-file compiled integration run passed 118 tests with one host skip, covering artifact admission, retained source locations, desktop seed/SQLite/CLI, Go/Rust snapshots, runtime settings and setup forwarding. Separate owner checks passed for new main's desktop secret/custom-reader/gzip and JavaScript enumerable-copy/require-drain behavior. Source-map fetch-budget omission, empty selection and partial selection now also remain distinct in browser Evidence.

On this integrated branch, Python passed 102 tests; discovery found all 3,343 test files exactly once; architecture guards passed across 2,696 source files. The runtime/skill build, type/lint and generated-documentation checks passed. The retained native Ghidra lane was rerun against the integrated code and again confirmed live budget recovery, unchanged target bytes, Program continuity and cleanup; see its integration receipt. Historical calibration and earlier receipts retain their original runtime pins; they are not performance measurements of the integrated head. check:pr was not run.

Verification limits

The follow-up verified all packaged Java sources against installed Ghidra 12.1.4 and exercised live operation/input/edge, native payload and deadline recovery on the same Program with unchanged target bytes. The target was not executed. The dated native receipt records exact versions, observations and verified cleanup; this does not qualify Windows or every public transport/provider combination. Real local Frida and LLDB producer-boundary budget checks also passed with explicitly controlled test processes and confirmed cleanup. Full AgentEnv execution was not exercised; desktop checks ran real SQLite workers and emitted reader helpers. Linux-only native lanes and real Apktool, WABT, pwntools, pwndbg, sigrok and TShark remain unverified. Source-owned codec/worker and simulated checks are labeled separately. No native-provider performance improvement is claimed. Source-owned workflow calibration measures a bounded public-artifact corpus, including complete replies and recovery calls; it does not establish universally optimal defaults. Ghidra function dossiers now reobserve accepted budgets while retaining the native decompiler cache; the native latency cost of that change is unmeasured.

Reference in new issue View Git Blame Copy Permalink