mirror of
https://github.com/morluto/rea.git
synced 2026-11-15 19:23:24 +00:00
* feat(evidence)!: give Evidence bundles a format revision owned by one module `src/domain/evidenceFormat.ts` owns Evidence format evolution. Bundles now carry `evidence_format: 1`; every bundle reader admits only the current revision and refuses an unmarked or other-revision bundle once, with the single recreate-observations guidance, instead of admitting earlier shapes one optional field at a time. The 6.7-era artifact inventory summary identities are no longer rebuilt: compare_artifacts checks the current projection only and reports a mismatch with the owner's guidance. The pre-6.6 identity diagnosis uses the same guidance. SQLite `worker_timeout_ms` and Dart AOT `string_pool.policy`, optional only for historical Evidence, are now required. BREAKING CHANGE: Evidence bundles written by REA 6.x (no `evidence_format`) are refused by import, comparison, reconstruction and analysis-snapshot readers as an integrity mismatch telling the caller to recreate the observations; re-exporting an earlier bundle does not update its format or identities. Bundles constructed by hand must include `"evidence_format": 1`. 6.7-era artifact summaries are refused by compare_artifacts, and SQLite and Dart AOT Evidence without the newly required fields fails validation. * fix(evidence): let the ledger application admit its bundle's format build_reconstruction_obligation_ledger registered the full bundle schema with the SDK, so an unmarked or other-revision bundle was refused as invalid_request before the format owner ran. Register it like coverage: the application parses the request envelope and admits the bundle. * feat(pcap)!: read capture Evidence through the current result schema only (#10879) Delete the pcap read-compatibility schema that defaulted executable identity for historical capture Evidence, and require query_labels_hex (null when unknown) now that every producer writes it. Evidence from an earlier format is refused at the bundle format owner; a record that omits these fields is reported as malformed instead of defaulted. BREAKING CHANGE: inspect_pcap_capture results always carry query_labels_hex, and analysis views no longer default missing tshark/capinfos identity fields. * feat(desktop)!: require the effective view policy in desktop state Evidence (#10886) inspect_desktop_application_state always records the complete policy it used, including sqlite_view_bytes. Drop the optional historical shape and the task draft's absent-policy branch. BREAKING CHANGE: desktop application state results without effective_view_policy, or with a policy missing sqlite_view_bytes, are refused as malformed. * feat(android)!: require component declaration facets and reference aggregates in Android Evidence (#10904) * feat(android)!: require component declaration facets and reference aggregates in Android Evidence The JADX producers always write the manifest component projection with every declaration facet, target_definition and direct_invokes_coverage. Require them, delete the duplicate observed component schema, drop the unknown declaration coverage that only described historical omission, and give manifest view results their explicit facet. BREAKING CHANGE: Android package, component and reference results missing these fields are refused as malformed; component declaration_coverage and its summary counts no longer include unknown; manifest view results always carry facet manifest. * refactor(android): parse package results with the domain schema directly * feat(browser)!: require the DOM length unit and redirect-scoped prior-hop facts (#10897) * feat(browser)!: require the DOM length unit and redirect-scoped prior-hop facts Both CDP producers always declare node_value_length_unit, and the observation session writes redirect_response on every redirect event and no other. Require the unit, drop the diff's absent-unit branch, and admit redirect_response exactly on redirect rows. BREAKING CHANGE: DOM snapshots without node_value_length_unit and redirect timeline rows without redirect_response are refused as malformed, including inline inspections passed to compare_web_captures. * docs(browser): drop the historical redirect_response omission note * feat(native)!: require native Evidence fields that were optional only for historical Evidence (#10946) Mach-O encryption, slice malformed cause, symbol runtime names and import facts; ELF export encoding facts and visibility; value-flow limits; load-image permissions and relocation symbols; Swift type-reference kind and GPU AMD target metadata are required. Legacy enum values (unrecorded, unknown visibility, undecodable, modinfo_field_exceeds_limit) and the retained schemas, view defaults and reinterpretations that served historical Evidence are deleted. BREAKING CHANGE: native records missing these fields are refused as malformed; recreate the observation.
147 lines
3.6 KiB
TypeScript
147 lines
3.6 KiB
TypeScript
import type {
|
|
NativeLoadImage,
|
|
NativeLoadImageObservation,
|
|
} from "../../src/domain/native/nativeLoadImage.js";
|
|
|
|
/** Authored domain observations; these projection fixtures run no provider. */
|
|
export const nativeLoadImageObservationFixture =
|
|
(): NativeLoadImageObservation => ({
|
|
executable_format: "Old-style DOS Executable (MZ)",
|
|
language_id: "x86:LE:16:Real Mode",
|
|
compiler_spec_id: "default",
|
|
image_base: "0x0",
|
|
default_address_space: "ram",
|
|
source_files: [
|
|
{
|
|
name: "fixture.exe",
|
|
size: 64,
|
|
original_sha256: "a".repeat(64),
|
|
modified_sha256: "a".repeat(64),
|
|
},
|
|
],
|
|
mappings: [
|
|
{
|
|
block: "module",
|
|
start: "ram:0x0010",
|
|
end: "ram:0x001f",
|
|
address_space: "ram",
|
|
initialized: true,
|
|
loaded: true,
|
|
overlay: false,
|
|
readable: true,
|
|
writable: false,
|
|
executable: true,
|
|
length: 16,
|
|
source_file_index: 0,
|
|
file_offset: 32,
|
|
sha256: "b".repeat(64),
|
|
},
|
|
],
|
|
relocations: [],
|
|
entry_points: ["ram:0x0010"],
|
|
entry_context: [],
|
|
});
|
|
|
|
/** A recorded producer verification claim, not a runtime attestation by this fixture. */
|
|
export const nativeDosLoadImageFixture = (): Extract<
|
|
NativeLoadImage,
|
|
{ format: "dos-mz" | "dos-com" }
|
|
> => ({
|
|
status: "verified",
|
|
format: "dos-mz",
|
|
target_sha256: "a".repeat(64),
|
|
load_segment: 0,
|
|
header_bytes: 32,
|
|
module_bytes: 32,
|
|
overlay_bytes: 0,
|
|
entry: { relative_segment: 0, offset: 16, linear_address: "ram:0x0010" },
|
|
observations: nativeLoadImageObservationFixture(),
|
|
checks: [
|
|
{
|
|
name: "original_file_sha256",
|
|
matched: true,
|
|
expected: "a".repeat(64),
|
|
observed: "a".repeat(64),
|
|
file_offset: null,
|
|
address: null,
|
|
},
|
|
],
|
|
limitations: [],
|
|
});
|
|
|
|
export const nativeRawLoadImageFixture = (): Extract<
|
|
NativeLoadImage,
|
|
{ format: "raw-binary" }
|
|
> => ({
|
|
status: "verified",
|
|
format: "raw-binary",
|
|
target_sha256: "c".repeat(64),
|
|
architecture: "x86_64",
|
|
language_id: "x86:LE:64:default",
|
|
compiler_spec_id: "gcc",
|
|
base_address: "ram:0x00400000",
|
|
file_bytes: 32,
|
|
entry: { address: "ram:0x00400000", file_offset: 0 },
|
|
observations: {
|
|
...nativeLoadImageObservationFixture(),
|
|
executable_format: "Raw Binary",
|
|
language_id: "x86:LE:64:default",
|
|
compiler_spec_id: "gcc",
|
|
image_base: "ram:0x00400000",
|
|
entry_points: ["ram:0x00400000"],
|
|
},
|
|
checks: [],
|
|
limitations: [],
|
|
});
|
|
|
|
export const nativeDolLoadImageFixture = (): Extract<
|
|
NativeLoadImage,
|
|
{ format: "gamecube-dol" }
|
|
> => ({
|
|
status: "mismatch",
|
|
format: "gamecube-dol",
|
|
target_sha256: "d".repeat(64),
|
|
architecture: "powerpc",
|
|
language_id: "PowerPC:BE:32:default",
|
|
compiler_spec_id: "default",
|
|
file_bytes: 288,
|
|
entry: { address: "ram:0x80003100" },
|
|
sections: [
|
|
{
|
|
kind: "text",
|
|
index: 0,
|
|
file_offset: "0x100",
|
|
address: "ram:0x80003100",
|
|
size: "0x10",
|
|
},
|
|
{
|
|
kind: "data",
|
|
index: 0,
|
|
file_offset: "0x110",
|
|
address: "ram:0x80004000",
|
|
size: "0x10",
|
|
},
|
|
],
|
|
bss: { address: "ram:0x80005000", size: "0x20" },
|
|
observations: {
|
|
...nativeLoadImageObservationFixture(),
|
|
executable_format: "Nintendo GameCube DOL",
|
|
language_id: "PowerPC:BE:32:default",
|
|
image_base: "ram:0x80003100",
|
|
entry_points: ["ram:0x80003100"],
|
|
},
|
|
checks: [
|
|
{
|
|
name: "bss",
|
|
matched: false,
|
|
expected: "0x20",
|
|
observed: "0x10",
|
|
file_offset: null,
|
|
address: "ram:0x80005000",
|
|
},
|
|
],
|
|
limitations: [
|
|
"Fixture records a BSS mismatch; this is not runtime coverage.",
|
|
],
|
|
});
|