chore(main): release rea-agents 4.1.0 (#635 )

* chore(main): release rea-agents 4.1.0 * chore: normalize release product catalog --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
feat(ida): add read-only GUI and headless MCP providers (#754 )
2026-10-07 01:57:26 +08:00 · 2026-10-07 01:47:05 +08:00 · 2026-10-07 01:46:52 +08:00 · 2026-10-07 01:24:22 +08:00 · 2026-10-07 01:03:55 +08:00 · 2026-10-07 00:57:08 +08:00
243 changed files with 17995 additions and 442 deletions
@@ -365,6 +365,8 @@ jobs:
        run: >-
          npx vitest run --coverage.enabled=false
          tests/boundary/filesystem/binaryTarget.test.ts
+          tests/boundary/filesystem/safeOutputTree.test.ts
+          tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts
          tests/boundary/filesystem/setupUnavailableProvider.test.ts
          tests/boundary/filesystem/asarInventoryFreshness.test.ts
          tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts
@@ -0,0 +1,44 @@
+name: Source-built NativeAOT fixtures
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "bridge/ghidra/extensions/nativeaot/**"
+      - "scripts/generate-nativeaot-fixtures.mjs"
+      - "tests/fixtures/nativeaot/**"
+      - ".github/workflows/nativeaot-fixtures.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  windows-fixture:
+    name: Build Windows x64 NativeAOT fixture
+    # .NET 8.0.22's bundled linker discovery supports VS 2019/2022.
+    runs-on: windows-2022
+    timeout-minutes: 15
+    env:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_PROCESSOR_COUNT: "1"
+      COMPlus_GCHeapHardLimit: "30000000"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.416"
+      - name: Build benign fixture and independent byte oracle
+        run: node scripts/generate-nativeaot-fixtures.mjs
+      - uses: actions/upload-artifact@v4
+        with:
+          name: nativeaot-win-x64-${{ github.event.pull_request.head.sha || github.sha }}
+          path: |
+            _reference/nativeaot-integration/generated/win-x64/symbols/NativeAotFixture.exe
+            _reference/nativeaot-integration/generated/win-x64/NativeAotFixture.map
+            _reference/nativeaot-integration/generated/win-x64/symbols.txt
+            _reference/nativeaot-integration/generated/win-x64/oracle.json
+          if-no-files-found: error
+          retention-days: 7
@@ -0,0 +1,12 @@
+[submodule "third_party/jadx-headless-mcp"]
+	path = third_party/jadx-headless-mcp
+	url = https://github.com/1013503897/jadx-headless-mcp.git
+[submodule "third_party/binwalk"]
+	path = third_party/binwalk
+	url = https://github.com/ReFirmLabs/binwalk.git
+[submodule "third_party/unblob"]
+	path = third_party/unblob
+	url = https://github.com/onekey-sec/unblob.git
+[submodule "third_party/ghidra-nativeaot"]
+	path = third_party/ghidra-nativeaot
+	url = https://github.com/Washi1337/ghidra-nativeaot.git
@@ -9,6 +9,7 @@
    ".codex/**",
    ".devin/**",
    "tests/fixtures/**",
+    "third_party/**",
    "tests/conformance/**/*.c",
    "tests/conformance/**/*.m",
    "tests/conformance/**/*.swift",
@@ -10,6 +10,7 @@
    "node_modules/**",
    "CHANGELOG.md",
    "package-lock.json",
-    "_reference/**"
+    "_reference/**",
+    "third_party/**"
  ]
 }
@@ -38,7 +38,7 @@
          {
            "patterns": [
              {
-                "group": ["**/ghidra/**", "**/hopper/**"],
+                "group": ["**/ghidra/**", "**/hopper/**", "**/ida/**"],
                "message": "Deep-provider imports belong behind adapters or in the application composition root."
              }
            ]
@@ -71,6 +71,7 @@
                  "**/browser/**",
                  "**/ghidra/**",
                  "**/hopper/**",
+                  "**/ida/**",
                  "**/replay/**",
                  "**/cli.*",
                  "**/main.*"
@@ -139,6 +140,7 @@
    ".cache",
    ".codex",
    ".devin",
-    ".factory"
+    ".factory",
+    "third_party"
  ]
 }
@@ -1,3 +1,3 @@
 {
-  ".": "4.0.1"
+  ".": "4.1.0"
 }
@@ -2,7 +2,7 @@

 ## Product Direction

-REA exposes reverse-engineering tools through a CLI and MCP server. Hopper and the bring-your-own Ghidra adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. Keep provider-specific code out of the domain and application layers.
+REA exposes reverse-engineering tools through a CLI and MCP server. Hopper, the bring-your-own Ghidra adapter, and the bring-your-own IDA MCP adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. IDA adapts upstream legacy attached GUI and modern headless database-supervisor profiles for live read-only analysis; initial real verification covers Windows, and an attached GUI database is never saved or closed. Keep provider-specific code out of the domain and application layers.

 Prioritize:

@@ -20,7 +20,7 @@ REA is a local-only tool. Preserve caller-selected inputs, captured output, URLs
 REA is a layered ESM TypeScript application. Dependencies flow inward from pure domain logic through contracts, providers, application workflows, and CLI/MCP adapters. See [docs/architecture.mermaid](docs/architecture.mermaid) for the component map.

 - `src/domain/` owns pure provider-neutral semantics; `src/contracts/` owns caller-visible schemas and the canonical tool inventory.
- `src/hopper/`, `src/ghidra/`, `src/browser/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
+- `src/hopper/`, `src/ghidra/`, `src/ida/`, `src/browser/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
 - `src/application/` composes shared CLI/MCP workflows; `src/server/` translates MCP requests; `src/cli.ts` and `src/main.ts` are the CLI and MCP entry points.
 - `src/process/` owns shared process lifecycle primitives, not provider wire protocols. `bridge/` contains provider-side adapters.
 - `tests/` contains unit, composition, boundary, acceptance, and conformance tests. `scripts/verify-*` contains real-toolchain checks.
@@ -1,5 +1,134 @@
 # Changelog

+## [4.1.0](https://github.com/morluto/rea/compare/rea-agents-4.0.1...rea-agents-4.1.0) (2026-10-06)
+
+
+### Features
+
+* **android:** integrate static APK analysis with headless JADX ([#738](https://github.com/morluto/rea/issues/738)) ([904d03e](https://github.com/morluto/rea/commit/904d03e987a6c498561b314a266202dee84b13ab))
+* **evidence:** accept exact retained application references ([#734](https://github.com/morluto/rea/issues/734)) ([d0f3480](https://github.com/morluto/rea/commit/d0f3480a3cb9887499c2b188c783dd1c4db09787))
+* **firmware:** integrate Binwalk and Unblob analysis ([5a7c769](https://github.com/morluto/rea/commit/5a7c769692c21efc4cc0e5ebf06a9f2534dc75ed))
+* **ghidra:** add atomic function annotation edits ([#709](https://github.com/morluto/rea/issues/709)) ([9bab553](https://github.com/morluto/rea/commit/9bab55337ab10616be6929afddb08fb19fbb8ab7))
+* **ghidra:** admit explicit DOS COM analysis ([#702](https://github.com/morluto/rea/issues/702)) ([5bcb664](https://github.com/morluto/rea/commit/5bcb6645b561e666b7e07dd8f38d2296fa7cbba8))
+* **ghidra:** enable Windows x64 read-only analysis ([#699](https://github.com/morluto/rea/issues/699)) ([26881da](https://github.com/morluto/rea/commit/26881da76aa320c8529fcc741df0fc9898d97bdc))
+* **ghidra:** integrate optional NativeAOT metadata recovery ([#748](https://github.com/morluto/rea/issues/748)) ([fb679b6](https://github.com/morluto/rea/commit/fb679b63c27e6c5f137532953cfa24a2ffb1aaf2))
+* **ghidra:** verify DOS load images and expose memory evidence ([#697](https://github.com/morluto/rea/issues/697)) ([a6a8f67](https://github.com/morluto/rea/commit/a6a8f67649cab558b0de11601e65425f280c7170))
+* **ida:** add read-only GUI and headless MCP providers ([#754](https://github.com/morluto/rea/issues/754)) ([8238232](https://github.com/morluto/rea/commit/82382324855a3a4ed51d2cdc3b2b455c9e8419e2))
+* **setup:** support Command Code MCP registration ([#645](https://github.com/morluto/rea/issues/645)) ([7f1ae42](https://github.com/morluto/rea/commit/7f1ae42f71ce85547d317eed5e62fa330d9876bb))
+
+
+### Bug Fixes
+
+* **android:** validate explicit Java runtime ([#742](https://github.com/morluto/rea/issues/742)) ([7390390](https://github.com/morluto/rea/commit/739039092f98c67e8e6ccfb1f8445e8f13ac8f15))
+* **artifacts:** make extraction output tree work on Windows ([#753](https://github.com/morluto/rea/issues/753)) ([c8e66c7](https://github.com/morluto/rea/commit/c8e66c704a70f5133922aa1bd1a3ba42959093ba))
+* **browser:** classify CSP host sources by their own origin ([#707](https://github.com/morluto/rea/issues/707)) ([1d15bcb](https://github.com/morluto/rea/commit/1d15bcb9ecd7efa487a8fd3f0d9755bd60051722))
+* **browser:** keep bare module locations unresolved ([#676](https://github.com/morluto/rea/issues/676)) ([8189081](https://github.com/morluto/rea/commit/8189081511441f0e3909b21b80c21c658ec9a453))
+* **ci:** upload Vitest blob reports from current path ([77799e6](https://github.com/morluto/rea/commit/77799e6c90ce36cd52e45b62c9cba2d46641c4cf))
+* **cli:** disable unmanaged skill synchronization ([433ebda](https://github.com/morluto/rea/commit/433ebda8b492f388faf6e6cac63ccc6f9c2d8d7e))
+* **cli:** disable unmanaged skill synchronization ([2c1bf92](https://github.com/morluto/rea/commit/2c1bf9201040ed3d60f475af9129b7bf85a508fa))
+* **cli:** fail when JSON input files cannot be parsed ([18c1829](https://github.com/morluto/rea/commit/18c18290d048b78a435f6864dfc778a9fea0af2e))
+* **cli:** fail when JSON input files cannot be parsed ([3201f05](https://github.com/morluto/rea/commit/3201f0538dc88e54bce00decf689bf9b5603bfd3))
+* **cli:** include build step in missing-runtime recovery ([6a37346](https://github.com/morluto/rea/commit/6a37346acb9829acaab0e2042624e6ea0d03e2a9))
+* **cli:** include build step in missing-runtime recovery ([ae72abd](https://github.com/morluto/rea/commit/ae72abd019b25347bfc7593b5dcadc5a2cbc3786))
+* **cli:** report reference-source import failures ([00eb03d](https://github.com/morluto/rea/commit/00eb03d0f2247da95dfa7bda0f41a0f366a25dd9))
+* **cli:** report reference-source import failures ([431e8eb](https://github.com/morluto/rea/commit/431e8ebfcfba2925904c0deb4888bbd3755b17bf))
+* **comparison:** break function collection collation ties ([c3d013b](https://github.com/morluto/rea/commit/c3d013b2fd5c3a32dfa73ef40dafdaeaf935f37e))
+* **comparison:** break function collection collation ties ([3aaf7e2](https://github.com/morluto/rea/commit/3aaf7e2c54029a456145d6e3287fd9122f3abbe3))
+* **comparison:** break JSON shape collation ties ([217e8cf](https://github.com/morluto/rea/commit/217e8cf59f49e2f68b394fbcbc87f914dbee97ee))
+* **comparison:** break JSON shape collation ties ([805c338](https://github.com/morluto/rea/commit/805c338f360184d73ae335a723fca656830d6328))
+* **comparison:** retain container-only export shape paths ([a55b5bb](https://github.com/morluto/rea/commit/a55b5bb8ee400ef5565954d57916e8aae7dac760))
+* **comparison:** retain container-only export shape paths ([7864d66](https://github.com/morluto/rea/commit/7864d665e15edec29ade0f3fb7ac374b8579c2c0))
+* **dotnet:** preserve leading Unicode content in metadata strings ([#667](https://github.com/morluto/rea/issues/667)) ([ddea063](https://github.com/morluto/rea/commit/ddea06360a09508a0ff695ab6e141eff19534619))
+* **electron:** respect computed option keys and overrides ([af48fe8](https://github.com/morluto/rea/commit/af48fe879161ee749692751b3e29ba06b63b7409))
+* **electron:** respect computed option keys and overrides ([98de338](https://github.com/morluto/rea/commit/98de3380e3062cb25778263bfea07b215a09b39c))
+* **evidence:** admit current process provider identity ([ab5a1c6](https://github.com/morluto/rea/commit/ab5a1c61b12475c554a5e4d60b48b642b2464bbb))
+* **evidence:** admit current process provider identity ([d311940](https://github.com/morluto/rea/commit/d311940f2414fe5cceb750de4464b681bb44ae1e))
+* **firmware:** validate configured executables ([#751](https://github.com/morluto/rea/issues/751)) ([9a4e6da](https://github.com/morluto/rea/commit/9a4e6da5a96ed2708a0f628b436dcd7415999327))
+* **ghidra:** preserve request and shutdown failure diagnostics ([#647](https://github.com/morluto/rea/issues/647)) ([19f8cdd](https://github.com/morluto/rea/commit/19f8cddfd6f283188567b8ff1e49b810d79952ee))
+* **ghidra:** refuse ambiguous universal Mach-O imports ([b1b687f](https://github.com/morluto/rea/commit/b1b687fb75325c0275a0cf161843fc5969ba1d47))
+* **ghidra:** refuse ambiguous universal Mach-O imports ([6582b24](https://github.com/morluto/rea/commit/6582b2433a955167e33246ad07de1a40bcb20144))
+* **hopper:** retain shutdown request diagnostics ([8d7071d](https://github.com/morluto/rea/commit/8d7071da4c61c5cfb4894be6536405affd90f276))
+* **hopper:** retain shutdown request diagnostics ([7254871](https://github.com/morluto/rea/commit/72548712fea972b920834663a5e2ceea4738ce1e))
+* integrate 14 approved fix PRs (668,671,673,675,678-681,685-690) ([#705](https://github.com/morluto/rea/issues/705)) ([cf06115](https://github.com/morluto/rea/commit/cf061159ab69a746675e48896fa953d6990c05f9))
+* **javascript:** count all source line terminators ([e60aa11](https://github.com/morluto/rea/commit/e60aa1110800e1309b482e7a44ecd1762bade992))
+* **javascript:** count all source line terminators ([03bc6d3](https://github.com/morluto/rea/commit/03bc6d36db94e70c709557cb7302d40af9e99e6b))
+* **javascript:** expose result schema failures ([6d1f39b](https://github.com/morluto/rea/commit/6d1f39b250f8a1c6f924b1a6b9d26d56dff4beee))
+* **javascript:** expose result schema failures ([99263a7](https://github.com/morluto/rea/commit/99263a720d7106aff059ad7fa43849151a94c963))
+* **javascript:** hash graph and evidence JSON incrementally ([#646](https://github.com/morluto/rea/issues/646)) ([9f42495](https://github.com/morluto/rea/commit/9f42495d11100adc8646de5c8b62762ab9715ae6))
+* **javascript:** preserve path.resolve reset semantics ([863ed47](https://github.com/morluto/rea/commit/863ed47de2e35ef9b734e45e3bb44ea9e9dc8ff6))
+* **javascript:** preserve path.resolve reset semantics ([4177377](https://github.com/morluto/rea/commit/417737748aa96ba38ced7b0b22dbb972187f2ee0))
+* **javascript:** preserve primitive addition coercion ([#666](https://github.com/morluto/rea/issues/666)) ([94cc847](https://github.com/morluto/rea/commit/94cc8475e0e9e24cd2e8345bd36a743a979e3620))
+* **javascript:** preserve unknown branches in primitive unions ([75a75cb](https://github.com/morluto/rea/commit/75a75cbb20aa9b2148f9fd0547f613eadda68edd))
+* **javascript:** preserve unknown branches in primitive unions ([9a2f395](https://github.com/morluto/rea/commit/9a2f3950286a01922be0b07b29c4aefee466ec1e))
+* **javascript:** read source-map directives only from comments ([#672](https://github.com/morluto/rea/issues/672)) ([7f1fa64](https://github.com/morluto/rea/commit/7f1fa64019e01a654ad0eb80b47d268a58f04e57))
+* **javascript:** scope candidate ambiguity to query traversal ([6ad62ce](https://github.com/morluto/rea/commit/6ad62cec6abf182a52cf9844145e147fb6399c8e))
+* **javascript:** scope candidate ambiguity to query traversal ([f94fc79](https://github.com/morluto/rea/commit/f94fc7967b2e5604c144d3638515caad6273a0c6))
+* **mcp:** retain shutdown failure diagnostics ([09c249d](https://github.com/morluto/rea/commit/09c249deb86068503611fc474e76018d5c2a4d0b))
+* **mcp:** retain shutdown failure diagnostics ([fd008cd](https://github.com/morluto/rea/commit/fd008cd8e0b8277e691efd8e69dc96ac8e188d9e))
+* **native:** inspect mixed-signature Mach-O slices ([1dccd0d](https://github.com/morluto/rea/commit/1dccd0dee04abfdc80e8b48e3f05fa39cccf0feb))
+* **native:** inspect mixed-signature Mach-O slices ([66f3cfa](https://github.com/morluto/rea/commit/66f3cfa594a86cbf1f21fc6d2eca1a82e236c896))
+* **native:** retain spaced symbols in dyld inventory ([#669](https://github.com/morluto/rea/issues/669)) ([fa02df9](https://github.com/morluto/rea/commit/fa02df9ad3bc3139ef10422dedffac88c4d51d36))
+* **native:** select concrete arm64e Mach-O slices ([f04445c](https://github.com/morluto/rea/commit/f04445c57c597a8312211139b75da706cb0c2a96))
+* **native:** select concrete arm64e Mach-O slices ([fd3282a](https://github.com/morluto/rea/commit/fd3282a87e40417cf3d7d6211743809f9bad2dc8))
+* **process:** honor disabled PID normalization in samples ([44b3627](https://github.com/morluto/rea/commit/44b3627ab0b32c42e545dd2fd095006d249a77f6))
+* **process:** honor disabled PID normalization in samples ([a4e5736](https://github.com/morluto/rea/commit/a4e57366dd75077bde07f25c7966204cedad929e))
+* **process:** scope comparison unknowns to their evidence ([#732](https://github.com/morluto/rea/issues/732)) ([9dd6cef](https://github.com/morluto/rea/commit/9dd6cef90abf89f9191bce942e31900870231968))
+* **reconstruction:** accept function comparison source parameters ([c3bc38b](https://github.com/morluto/rea/commit/c3bc38bf6c74d2175a4680530dcadd6cab0e7791))
+* **reconstruction:** accept function comparison source parameters ([7a96391](https://github.com/morluto/rea/commit/7a96391001780012f704f4ef5cb6597baa590b7d))
+* **reference:** bound Dockerfile language detection ([132a3a4](https://github.com/morluto/rea/commit/132a3a46be648b036ed36372a50d6e32a9e7f2e5))
+* **reference:** bound Dockerfile language detection ([53fa559](https://github.com/morluto/rea/commit/53fa55937f241fc9ef3091eb22314cc370c749b9))
+* **reference:** classify test suffixes before extensions ([e828acc](https://github.com/morluto/rea/commit/e828acce0e0bf3808773590cf2dbb0bc8227df7b))
+* **reference:** classify test suffixes before extensions ([8b228ae](https://github.com/morluto/rea/commit/8b228ae7010144b69a243c9682aeb0a1dc4249a3))
+* **reference:** distinguish computed require member names ([ba35b55](https://github.com/morluto/rea/commit/ba35b5509db60c18dd43e350e0dd4a0b5f229c69))
+* **reference:** distinguish computed require member names ([df6e476](https://github.com/morluto/rea/commit/df6e476d67b2719c4b998daa3e9ad8a4b157ace2))
+* **reference:** preserve unresolved absolute module specifiers ([#670](https://github.com/morluto/rea/issues/670)) ([c8aed47](https://github.com/morluto/rea/commit/c8aed4740d52b1eecaa93b3a527e8b3814dc88a4))
+* **reference:** read linked worktree commit provenance ([#677](https://github.com/morluto/rea/issues/677)) ([d565ecd](https://github.com/morluto/rea/commit/d565ecdc257514f5d0c5a412081e322fc66d4215))
+* **reference:** recognize CMake build manifests ([#665](https://github.com/morluto/rea/issues/665)) ([1a24be5](https://github.com/morluto/rea/commit/1a24be574d1860931ff8d4c8ec07f3968fff9fd5))
+* **reference:** retain dynamic import relationships ([a5d2986](https://github.com/morluto/rea/commit/a5d2986b1e517b71a1ed51be433c95e975eafe32))
+* **reference:** retain dynamic import relationships ([b89de8f](https://github.com/morluto/rea/commit/b89de8feab389477a468f0b89b8dfa35d7ddc102))
+* **reference:** retain recovered parser diagnostics ([11d0ef2](https://github.com/morluto/rea/commit/11d0ef2e09308ac06889865b3fcf356b8ffa647f))
+* **reference:** retain recovered parser diagnostics ([ed3a7f0](https://github.com/morluto/rea/commit/ed3a7f070cf0793e22b9a0bbfd1f2ebe9dabcfd0))
+* **setup:** accept leading BOM in JSON client configs ([a5b970c](https://github.com/morluto/rea/commit/a5b970c6bf6848145a82de51c001410aa4d50f6f))
+* **setup:** accept leading BOM in JSON client configs ([fe843ec](https://github.com/morluto/rea/commit/fe843ec0b101544e22d7599d93b36377d3e3bc34))
+* **setup:** align Node runtime checks with package engines ([5802ef8](https://github.com/morluto/rea/commit/5802ef8746412649bb641332f2fa7e69bb1a86a3))
+* **setup:** align Node runtime checks with package engines ([ea0b733](https://github.com/morluto/rea/commit/ea0b733687582d6cc28b42beaf2fc7a48be07b6a))
+* **target:** explain the JavaScript directory analysis route ([#733](https://github.com/morluto/rea/issues/733)) ([8d44b3e](https://github.com/morluto/rea/commit/8d44b3edd36b528c308e32328552ca386dc43e91))
+* **trace:** match typed seeds against member arrays ([65c8797](https://github.com/morluto/rea/commit/65c879757ea09fabc5fc036d6e3395fd2939995c))
+* **trace:** match typed seeds against member arrays ([38ebd54](https://github.com/morluto/rea/commit/38ebd54776d661ced2e6cc2c5e4b260653a086d9))
+
+
+### Code Refactoring
+
+* **app:** split Setup and ProcessOwnership modules ([#628](https://github.com/morluto/rea/issues/628)) ([3c84080](https://github.com/morluto/rea/commit/3c84080aab5e5aa6c9fc14bafa07c635b537b64d))
+* **cli:** collapse duplicate CLI layer into src/cli ([#630](https://github.com/morluto/rea/issues/630)) ([494d4db](https://github.com/morluto/rea/commit/494d4db6d9d519f9258a25504cf29b07d61fbb9f))
+* **contracts:** split tool contracts by family ([#634](https://github.com/morluto/rea/issues/634)) ([5295d56](https://github.com/morluto/rea/commit/5295d56b105074b290e0d881df43cd13e34a2f8b))
+* **domain:** consolidate canonical ordering and digest helpers ([#624](https://github.com/morluto/rea/issues/624)) ([ba3869c](https://github.com/morluto/rea/commit/ba3869c597133b63fdcc0077c558923ae2e17a3f))
+* **domain:** split error taxonomy into thematic modules ([#636](https://github.com/morluto/rea/issues/636)) ([735c100](https://github.com/morluto/rea/commit/735c10059ca161967d71ccf8fa3f62011d2a22ca))
+* **native:** extract FAT header format switch in Mach-O slice selection ([#632](https://github.com/morluto/rea/issues/632)) ([38b2933](https://github.com/morluto/rea/commit/38b293329ca06c424a58bb59a28728f19015ce22))
+* **runtime:** centralize safe JSON parsing and preserve error causes ([#629](https://github.com/morluto/rea/issues/629)) ([e7f54b3](https://github.com/morluto/rea/commit/e7f54b3310b7f45af11c1754e468d4d3804191db))
+* **runtime:** name all silent catch causes without changing diagnostics ([#637](https://github.com/morluto/rea/issues/637)) ([5f27e02](https://github.com/morluto/rea/commit/5f27e02fae670774667de3618c88ba2ab0e7b661))
+
+
+### Documentation
+
+* add the official Trendshift badge to README headers ([b6c21b1](https://github.com/morluto/rea/commit/b6c21b1db5d4ff4be0968aa26693916537622a06))
+* add the official Trendshift badge to README headers ([7d4ed59](https://github.com/morluto/rea/commit/7d4ed59816388409885310f40c12dfdcdd2d9246))
+* align MCP discovery and skill guidance with the stable catalog ([#664](https://github.com/morluto/rea/issues/664)) ([39db9fe](https://github.com/morluto/rea/commit/39db9fe4245cc8142f57f4feeadaff64cb894e31))
+* **browser:** add an interaction example that captures the visible result ([#750](https://github.com/morluto/rea/issues/750)) ([91daaa6](https://github.com/morluto/rea/commit/91daaa68aea3bbee02b837ac64d3ad13127d601e))
+* clarify onboarding and align provider guidance ([#745](https://github.com/morluto/rea/issues/745)) ([5af1699](https://github.com/morluto/rea/commit/5af169910391f6b95492865247fabf3c4735a9d6))
+* correct CLI examples and documentation checks ([#655](https://github.com/morluto/rea/issues/655)) ([fc80ea8](https://github.com/morluto/rea/commit/fc80ea88dfb7bde43e89db0f341c99d7b53c1a7c))
+* fix architecture diagram and pretty-print tool catalog ([#626](https://github.com/morluto/rea/issues/626)) ([5e7f35c](https://github.com/morluto/rea/commit/5e7f35c7c3ea8d504421a2623eafd1d73fea08a0))
+* **ghidra:** explain first-query deadlines and recovery ([#736](https://github.com/morluto/rea/issues/736)) ([e2c23f3](https://github.com/morluto/rea/commit/e2c23f3640f83c13587603c763dbd7b5ef1bbbb0))
+* **hopper:** document HopperTargetLease realpath fallback ([#711](https://github.com/morluto/rea/issues/711)) ([d3f498c](https://github.com/morluto/rea/commit/d3f498ceec65e4f61f39036ab943ace7ef1b9de5))
+* **installation:** pin manual MCP registration to the release version ([#658](https://github.com/morluto/rea/issues/658)) ([8dd1d84](https://github.com/morluto/rea/commit/8dd1d8447146b9962ec7ab2f245b0fe47d3ddf44))
+* update Trendshift repository badge ([3f6d6dc](https://github.com/morluto/rea/commit/3f6d6dc756d99ca6e7cdc1737522842fcbaee839))
+
+
+### Tests
+
+* extract shared fixtures, drop knip carve-outs ([#627](https://github.com/morluto/rea/issues/627)) ([55e5eb0](https://github.com/morluto/rea/commit/55e5eb090bb3d6cf347d7cc2f8f028b35b7461ba))
+* **hopper:** synchronize startup cancellation with launcher readiness ([#662](https://github.com/morluto/rea/issues/662)) ([88a3c3f](https://github.com/morluto/rea/commit/88a3c3f8a4bf5cb31f60bca4696431c4e4512b30))
+
 ## [4.0.1](https://github.com/morluto/rea/compare/rea-agents-4.0.0...rea-agents-4.0.1) (2026-10-05)


@@ -4,7 +4,7 @@

 # REA: Reverse Engineer Anything

-### Reverse engineer anything with agents, from app behavior down to native binaries.
+### One MCP for reverse engineering across binaries, applications, and runtime behavior.

 **See a feature you like. Understand how it works, down to the binary level.**

@@ -15,7 +15,7 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)

-<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>

 [Quick start](#quick-start) · [Current status](#current-status) · [Investigation model](#the-investigation-model) · [Tool catalog](#tool-catalog-for-investigation) · [Roadmap](#roadmap) · [How it works](#how-it-works)

@@ -49,7 +49,7 @@ See a feature in an app that you want in your own product? Ask your agent to inv

 REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, and websites. You can also use the same tools from your terminal. Analysis runs locally, and results include the evidence and limitations behind each conclusion.

-Setup configures your agent and connects it to Hopper or Ghidra. If you need an analysis tool, setup can install Hopper for you.
+Setup registers REA with your agent and installs matching workflow instructions. Native analysis can use an existing Hopper or Ghidra installation; setup can optionally install Hopper with approval. Static JavaScript analysis needs neither engine.

 ## Just ask your agent

@@ -114,15 +114,34 @@ After setup, restart your agent and [describe the app or feature](#just-ask-your

 REA supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, and VS Code. Existing REA registrations are selected by default during setup; other detected agents remain unselected until chosen. Other agents can use the [manual MCP configuration](#manual-mcp-configuration).

-### From the terminal with npx
-
-After setup, run:
+### Install the skill separately

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+This installs agent instructions, not MCP registration or analysis engines.
+Follow the skill's [conditional connection guide](skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed):
+prepare a scoped `npx rea-agents setup` plan if registration is missing, review
+and approve its actual changes, then restart/reconnect and verify the tools.
+Guided setup above installs a version-matched skill by default. The skills.sh
+route uses repository instructions, which can be ahead of the released server;
+see [released package and main](docs/installation.md#released-package-and-main).
+
+### First result from the terminal
+
+For your extracted JavaScript/Electron application tree or ASAR, run:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Replace the path with your target (for example, `"D:/apps/example"` on Windows).
+This returns inline Evidence, recovered graph, limitations, and unknowns without
+MCP setup, Hopper, Ghidra, or executing the application. For a native app, configure
+its engine first, then use `analyze` with that app's path. Run `doctor` when you
+need diagnosis; it is not a prerequisite for each analysis.
+
 ### Install the rea command

 Install the command-line interface:
@@ -144,14 +163,22 @@ Update either installation with `rea update`.

 ### Requirements

+Static JavaScript inspection requires the Node/npm runtime only. Host and
+external-tool prerequisites depend on the selected workflow; the native
+provider guides describe their supported platforms.
+
 - macOS 12 or newer
 - Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
 - Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+
 - npm; REA does not require or install a particular npm version

-Native binary analysis requires [Hopper](https://www.hopperapp.com/) or [Ghidra](#ghidra-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. REA can use Ghidra that you have already installed.
+Deep native binary analysis requires [Hopper](https://www.hopperapp.com/), [Ghidra](#ghidra-analysis-provider), or [IDA Pro](#ida-pro-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. Ghidra and IDA are bring-your-own providers.

-Windows Ghidra support is experimental for native x86-64 PE applications on local NTFS. The package bundles native Job Object, private-DACL, and path-admission controls. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for prerequisites and verified scope.
+Firmware region inspection and explicit extraction use caller-supplied Binwalk and Unblob on Linux. See [Firmware analysis](docs/firmware-analysis.md) for setup, provenance, resource limits and native handoff.
+
+Static APK analysis uses a separately supplied headless JADX JAR and Java, with no emulator or APK execution. See [Android analysis](docs/android-analysis.md) for setup, CLI/MCP operations, coverage and public test fixtures.
+
+Repository main includes experimental Windows x64 Ghidra support for native x86-64 PE applications on local NTFS, with bundled Job Object, private-DACL, and path-admission controls. Check the [release boundary](docs/installation.md#released-package-and-main) before expecting this from an npm package. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for prerequisites and verified scope.

 If something is not working, run:

@@ -202,9 +229,13 @@ Setup checks the installations and saves their paths in your selected agents' co

 The adapter exposes inventory, function, memory and load-image inspection, plus atomic function annotation edits on Linux and macOS. `annotate_native_function` edits names and entry comments in the session database and returns a refreshed function dossier; executable bytes stay unchanged. Ghidra does not provide GUI controls through REA.

+Opening a Ghidra target selects its provider; the first analysis query starts import and auto-analysis. That query can take longer than a client's default request deadline. See [first-query deadlines and recovery](docs/mcp-contracts.md#ghidra-first-query-deadlines-and-recovery) for an SDK example and cancellation recovery.
+
 REA analyzes a temporary copy of the target and removes the temporary project when the session closes. Results identify what Ghidra observed and what it could not resolve. Decompilation produces pseudocode rather than the original source.

 Ghidra also imports DOS MZ executables with an explicit 16-bit x86 real-mode profile. Function results include complete observed body ranges, distinguishing owned bytes from the enclosing span. See the [DOS analysis guide](docs/ghidra-dos.md) for addresses, packing, and verification boundaries.
+See [optional NativeAOT metadata recovery](docs/ghidra-nativeaot.md) for the pinned
+headless adapter, supported layout and existing native-tool workflow.

 Windows Ghidra P0 uses bundled native controls for its read-only native x86-64 PE boundary on local NTFS; see the [Windows Ghidra P0 guide](docs/windows-ghidra-p0.md). See [Ghidra installation](docs/installation.md#ghidra), [provider evaluation](docs/provider-evaluation.md), and [testing](docs/testing.md) for configuration details, coverage, and real-provider verification.

@@ -217,6 +248,19 @@ rea uninstall --purge-data # also removes only ~/.rea/cache and ~/.rea/state

 Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills, and other MCP servers. It refuses malformed client configuration and never follows purge-data symlinks.

+### IDA Pro analysis provider
+
+Already have [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) working? REA can reuse its MCP registration for read-only analysis of the current GUI target, or use its database supervisor to open and analyze a supplied binary headlessly.
+
+```bash
+export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
+rea function /absolute/path/to/program main --provider ida --json
+```
+
+The registration selects `attached` (default, legacy 1.4 tools) or `headless` (modern database supervisor). Setup can preserve this file reference in your selected agent's REA registration. REA adapts existing analysis contracts and manages its own headless database; it leaves an attached GUI database open and never saves it. Results stay live because external IDA database changes are not immutable snapshots.
+
+See the [IDA provider guide](docs/ida-provider.md) for upstream installation links, exact configuration examples, Windows-native headless operation, lifecycle cleanup, and coverage. The initial real workflows cover a Windows GUI and Windows x64 headless IDA 9.3; other engine/platform combinations remain unverified. Use a package version that includes this adapter; repository main can lead the npm release.
+
 ### CLI or agent?

 | If you want to…                                                  | Use                                                                 |
@@ -312,6 +356,8 @@ See [native investigation](docs/native-investigation.md) for keyed archives, ins
 | Native macOS utilities    |     7 | Mach-O metadata, code signatures, plists, architectures, and Swift demangling without launching Hopper                                                    |
 | Artifact graph            |     5 | directory and package inventories, compiled Interface Builder files, Apple asset catalogs, and extraction                                                 |
 | Managed PE/CLI            |     7 | .NET identity, metadata, CIL instructions, native dependencies, reconstruction imports, and build comparisons                                             |
+| Firmware                  |     2 | Linux firmware region inspection and explicit extraction                                                                                                  |
+| Android APK               |     5 | package and manifest declarations, class search, member inventories, method decompilation, and incoming static references                                 |
 | Browser observation       |     9 | page structure, network metadata, scripts, source maps, WebMCP discovery, screenshots, and capture comparisons                                            |
 | Electron analysis         |     5 | renderer observation, static app mapping, and static/runtime reconciliation                                                                               |
 | JavaScript runtime        |     2 | Node/Electron Inspector target discovery, script locations, and execution-context events                                                                  |
@@ -322,9 +368,11 @@ The public interface describes what the agent is trying to learn. Providers deci

 ## Current status

-REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites; use `rea capabilities` to check what is available on your host.
+REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites. `rea capabilities` and `rea providers` describe the binary-session providers and auxiliary operations; they are not an inventory of every browser, Android, or application workflow. Use the connected MCP tool list and `binary_session` tool availability for the full MCP surface, and the relevant guide for each tool's prerequisites. Repository main can be ahead of [the npm release](docs/installation.md#released-package-and-main).

- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through Hopper or Ghidra. Inspect functions, strings, assembly, decompilation, calls, and references. Hopper also accepts `.hop` databases and supports annotations.
+Static Android APK inspection is verified on Linux with headless JADX; see [Android analysis](docs/android-analysis.md) for its separate prerequisites and coverage.
+
+- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through a selected deep provider. Hopper and Ghidra cover broad inventory and function analysis; the IDA adapter supplies its documented read-only function/string operations. Hopper also accepts `.hop` databases and supports annotations.
 - **Packages and resources:** Inspect directories, ZIP, APK, IPA, ASAR, plists, compiled Interface Builder files, and Apple asset catalogs. Artifact requests name the input and requested extraction or traversal directly; macOS DMG traversal also requires the host's native mounting support.
 - **JavaScript and Electron:** Map modules, imports, source maps, routes, IPC channels, storage, and native add-ons without running the app. Compare builds and trace a feature across the recovered graph. Dynamic and ambiguous relationships remain unresolved. See [JavaScript application workflows](docs/javascript-application-workflows.md).
 - **Websites:** Inspect a selected page in an existing Chrome-family browser. Capture page structure, network metadata, script evidence, and screenshots requested by the call. Passive observation does not navigate or execute page JavaScript. See [browser observation](docs/browser-observation.md).
@@ -335,7 +383,7 @@ REA supports native application, JavaScript, Electron, .NET, and browser investi
 - **Open questions:** Track unresolved findings, contradictions, and follow-up probes. Reconstruction checks report pass, fail, or unknown rather than treating missing evidence as a pass.
 - **Guided workflows:** Start six [MCP investigation workflows](docs/mcp-prompts.md) with suggestions based on your current session.

-Windows Ghidra P0 supports the read-only native x86-64 PE boundary on local NTFS. Hopper-only features, such as GUI controls and annotations, are not available through Ghidra.
+Windows x64 Ghidra P0 supports native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS with 25 read-only operations. Linux/macOS Ghidra additionally supports atomic session-scoped function names and entry comments. Ghidra has no GUI controls; Windows P0 has no mutation authority.

 ### Website observation with CDP

@@ -365,8 +413,12 @@ the launched browser. Connect mode accepts one exact loopback CDP target and
 disconnects without closing the external browser. The request supplies the
 selected executable or endpoint, actions, and any origin or environment
 selections needed by the scenario. Scenario JSON contains secret references and
-environment-variable names, never secret values. See the
-[browser scenario contract](docs/browser-scenario-contract.md).
+environment-variable names, never secret values. The default capture retains
+only the final URL; request `dom`, `accessibility`, or `screenshot` when an
+interaction changes the page without navigating. For asynchronous updates,
+wait for a page-specific result-ready condition before capture. See the
+[browser scenario contract](docs/browser-scenario-contract.md), including its
+interaction example.

 ### Node and Electron V8 Inspector observation

@@ -424,7 +476,7 @@ Setup offers supported agent integrations for selection. Existing REA registrati
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -454,11 +506,18 @@ flowchart LR
    Session --> Registry["Deep-provider registry<br/>deterministic selection"]
    Registry --> Hopper["Hopper provider"]
    Registry --> Ghidra["Ghidra provider<br/>inventory + function analysis + annotations"]
+    Registry --> Ida["IDA MCP provider<br/>attached GUI or owned headless database"]
    Hopper --> Runtime["Owned provider runtime<br/>deadline + bounded diagnostics + cleanup"]
    Ghidra --> Runtime
+    Ida --> IdaRuntime["Upstream MCP lifecycle<br/>live observations + owned database cleanup"]
+    IdaRuntime --> Target
    Session --> Native["Native macOS provider"]
    Session --> Artifact["Artifact graph provider"]
    REA --> Browser["Browser CDP provider"]
+    REA --> Android["Android static provider<br/>headless JADX adapter"]
+    Android --> Runtime
+    REA --> Firmware["Firmware providers<br/>Binwalk / Unblob adapters"]
+    Firmware --> Runtime
    REA --> Process["Process capture provider"]
    Runtime --> Target["Target software"]
    Process --> Target
@@ -518,7 +577,7 @@ For MCP, pass the optional selector on `open_binary`:
 }
 ```

-Use `--provider`, or `provider_id` in MCP, to choose Hopper or Ghidra for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.
+Use `--provider`, or `provider_id` in MCP, to choose Hopper, Ghidra, or IDA for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.

 With `auto`, REA selects the only available tool that supports the target. If both are available, specify one before opening the target. The session keeps that choice until you explicitly switch or close it; a failure never silently switches tools. Artifact-only analysis can work without a native analysis tool.

@@ -596,7 +655,7 @@ verified or absent.

 ## Security model

-Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets. Your agent or model provider has its own data policy.
+Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets and with IDA through its configured local MCP registration. Your agent or model provider has its own data policy.

 Runtime requests act on the declared target and lifecycle. Analysis tools and launched targets run with your user permissions, and native UI capture still depends on macOS Accessibility and Screen Recording access. Static JavaScript analysis does not execute extracted modules; use direct browser, Electron, or process capture when runtime behavior is needed.

@@ -98,15 +98,29 @@ npx rea-agents setup

 يمكن تشغيل Hopper في الوضع التجريبي. إذا ظهرت رسالة عند التشغيل الأول، فاختر التجربة أو أدخل ترخيصًا موجودًا.

-### الاستخدام من الطرفية
-
-بعد الإعداد، شغّل:
+### Skill instructions and a first CLI result

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+This installs instructions, not MCP registration or analysis engines. Follow the
+[conditional connection guide](skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+`npx rea-agents setup` installs a matching skill and registers selected clients
+only after showing the plan and receiving approval. Restart/reconnect after
+registration, then verify REA tools in the active session. Repository skills can
+be ahead of the [released package](docs/installation.md#released-package-and-main).
+
+For your extracted JavaScript/Electron tree or ASAR, no MCP setup or native
+engine is required:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Replace the path with your target; Windows paths such as `"D:/apps/example"`
+are supported by this static workflow. Native analysis requires its own engine.
+
 ### تثبيت أمر rea

 ثبت واجهة سطر الأوامر:
@@ -136,7 +150,7 @@ rea setup

 يستطيع Setup التحقق من التثبيت وحفظ المسارات؛ ولا يثبت أو يحدّث Ghidra أو Java أو Node.js أو npm أو Homebrew.

-تحليل Ghidra على Windows غير متاح. لم تُنفذ بعد ضوابط ملكية العمليات وأذونات المجلدات الخاصة والتحقق الآمن من المسارات. حتى التثبيت الصحيح لـ Ghidra وJava لا يفعّل التحليل. راجع [Windows Ghidra P0](docs/windows-ghidra-p0.md).
+Repository main includes experimental Windows x64 Ghidra P0 for native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS. The native controls are implemented; npm 4.0.1 does not contain them. See the [release boundary](docs/installation.md#released-package-and-main) and [Windows Ghidra P0](docs/windows-ghidra-p0.md).

 ### تشخيص المشكلات

@@ -152,12 +166,21 @@ rea setup

 ## حالة الدعم

-يوفر REA عبر CLI وMCP تحليل الملفات التنفيذية الأصلية وتطبيقات JavaScript وElectron وتجميعات .NET والمواقع. تعتمد العمليات المتاحة على الجهاز والهدف وأداة التحليل المختارة.
+The current repository capabilities and platform requirements are described in
+[the English support guide](README.md#current-status). Main can be ahead of the
+[npm release](docs/installation.md#released-package-and-main).

- يدعم Hopper التحليل الأصلي والتعليقات؛ ويختلف سلوك واجهته الرسومية حسب المنصة.
- يقدم Ghidra على Linux x64 وmacOS x64/arm64 عددًا قدره 22 عملية للقراءة فقط: الجرد والبحث وفك الترجمة والتعليمات والاستدعاءات والمراجع والأنواع. لا يقدم عمليات واجهة رسومية أو تعديل.
- لسير عمل المتصفح وElectron وتشغيل العمليات متطلبات مستقلة للإعداد والموافقة وإدارة دورة الحياة. راجع [English README](README.md#current-status) للتفاصيل الكاملة.
- تحليل Ghidra على Windows غير مفعّل. تابع التقدم في [#527](https://github.com/morluto/rea/issues/527).
+- Ghidra provides 25 read-only operations on Linux x64, macOS x64/arm64, and the
+  experimental Windows x64 P0 boundary. Linux/macOS additionally supports atomic
+  session function annotations. Windows P0 is read-only; Ghidra has no GUI controls.
+- Static Android inspection has separate bring-your-own JADX/Java prerequisites;
+  real-provider verification covers Linux. See [Android analysis](docs/android-analysis.md).
+- Browser, Electron, and process requests specify their target, actions, and
+  lifecycle directly. They require the host's actual access, without separate
+  REA permission grants. Setup configuration writes and Hopper installation
+  still require approval of their exact plan.
+- `rea capabilities` describes binary-session operations rather than every
+  application/runtime tool. Consult the full MCP tool list and relevant guide.

 ## استقصاء كامل بطلب واحد

@@ -209,6 +232,8 @@ rea setup
 | أدوات macOS الأصلية    |     7 | بيانات Mach-O والتوقيعات وplist والمعماريات واستعادة أسماء Swift                       |
 | الملفات والحزم        |     5 | فحص الدلائل والحزم وInterface Builder وموارد Apple والاستخراج                            |
 | .NET PE/CLI           |     7 | هوية التجميع والبيانات الوصفية وCIL والاستدعاءات الأصلية والمقارنة واستيراد إعادة البناء |
+| البرامج الثابتة       |     2 | فحص مناطق البرامج الثابتة واستخراجها الصريح على Linux                                  |
+| Android APK           |     5 | بيانات الحزمة وmanifest والبحث عن الأصناف والأعضاء وفك ترجمة الأساليب والمراجع الثابتة    |
 | مراقبة المتصفح        |     9 | الصفحات والبرامج النصية وخرائط المصدر وWebMCP والصور ومقارنة الالتقاط                   |
 | تحليل Electron        |     5 | مراقبة الصفحات وبنية التطبيق وربط النتائج الثابتة بنتائج التشغيل                       |
 | وقت تشغيل JavaScript  |     2 | الاتصال بهدف Node/Electron Inspector موجود لمراقبة البرامج وسياقات التنفيذ              |
@@ -230,7 +255,7 @@ rea setup
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -98,15 +98,29 @@ Setup は最初に連携するエージェントを複数選択できるよう

 Hopper はデモモードで使えます。初回起動の画面ではデモを選択するか、既存のライセンスを入力してください。

-### ターミナルで使う
-
-設定後に実行します：
+### Skill instructions and a first CLI result

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+This installs instructions, not MCP registration or analysis engines. Follow the
+[conditional connection guide](skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+`npx rea-agents setup` installs a matching skill and registers selected clients
+only after showing the plan and receiving approval. Restart/reconnect after
+registration, then verify REA tools in the active session. Repository skills can
+be ahead of the [released package](docs/installation.md#released-package-and-main).
+
+For your extracted JavaScript/Electron tree or ASAR, no MCP setup or native
+engine is required:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Replace the path with your target; Windows paths such as `"D:/apps/example"`
+are supported by this static workflow. Native analysis requires its own engine.
+
 ### rea コマンドをインストール

 コマンドラインツールをインストールします：
@@ -136,7 +150,7 @@ Ghidra は Linux x64 と macOS x64/arm64 に対応します。Ghidra 12.1.4 と

 Setup はインストールを確認し、パスを保存できます。Ghidra、Java、Node.js、npm、Homebrew のインストールや更新は行いません。

-Windows の Ghidra 解析は利用できません。プロセスの所有権、プライベートディレクトリの権限、安全なパス検証が未実装のため、Ghidra と Java を正しくインストールしても有効になりません。[Windows Ghidra P0](docs/windows-ghidra-p0.md)を参照してください。
+Repository main includes experimental Windows x64 Ghidra P0 for native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS. The native controls are implemented; npm 4.0.1 does not contain them. See the [release boundary](docs/installation.md#released-package-and-main) and [Windows Ghidra P0](docs/windows-ghidra-p0.md).

 ### トラブルシューティング

@@ -152,12 +166,21 @@ Linux の既定ランチャーは `/opt/hopper/bin/Hopper` です。別の場所

 ## 現在の対応状況

-REA は CLI と MCP からネイティブバイナリ、JavaScript/Electron アプリ、.NET アセンブリ、Web サイトを解析できます。使える操作はホスト、対象、選択した解析ツールによって異なります。
+The current repository capabilities and platform requirements are described in
+[the English support guide](README.md#current-status). Main can be ahead of the
+[npm release](docs/installation.md#released-package-and-main).

- Hopper はネイティブ解析と注釈操作に対応します。GUI の動作はプラットフォームによって異なります。
- Ghidra は Linux x64 と macOS x64/arm64 で、一覧、検索、逆コンパイル、アセンブリ、呼び出し、参照、命令、型の検査など 22 の読み取り専用操作を提供します。GUI 操作や変更操作はありません。
- ブラウザー、Electron、プロセスの実行時ワークフローには、それぞれ設定、承認、終了処理の要件があります。詳細は [English README](README.md#current-status) を参照してください。
- Windows の Ghidra 解析は未対応です。進捗は [#527](https://github.com/morluto/rea/issues/527) で確認できます。
+- Ghidra provides 25 read-only operations on Linux x64, macOS x64/arm64, and the
+  experimental Windows x64 P0 boundary. Linux/macOS additionally supports atomic
+  session function annotations. Windows P0 is read-only; Ghidra has no GUI controls.
+- Static Android inspection has separate bring-your-own JADX/Java prerequisites;
+  real-provider verification covers Linux. See [Android analysis](docs/android-analysis.md).
+- Browser, Electron, and process requests specify their target, actions, and
+  lifecycle directly. They require the host's actual access, without separate
+  REA permission grants. Setup configuration writes and Hopper installation
+  still require approval of their exact plan.
+- `rea capabilities` describes binary-session operations rather than every
+  application/runtime tool. Consult the full MCP tool list and relevant guide.

 ## ひとつのプロンプトで調査を完結

@@ -191,18 +214,20 @@ REA は手順 1〜5 のバイナリ解析を処理し、手順 6 はエージェ

 ## 調査ツールカタログ

-| ツール分類           |  数 | 用途                                                                        |
-| -------------------- | --: | --------------------------------------------------------------------------- |
-| バイナリ検査         |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、参照、注釈                  |
-| 組み合わせた解析     |  14 | 概要、関数解析、一括逆コンパイル、呼び出しグラフ、Swift と ObjC             |
-| macOS ネイティブ     |   7 | Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元              |
-| ファイルとパッケージ |   5 | ディレクトリとパッケージ、Interface Builder、Apple リソース、抽出           |
-| .NET PE/CLI          |   7 | アセンブリ識別、メタデータ、CIL、ネイティブ呼び出し、比較、再構築の取り込み |
-| ブラウザー観察       |   9 | ページ、スクリプト、ソースマップ、WebMCP、スクリーンショット、比較          |
-| Electron 解析        |   5 | ページ観察、アプリ構造、静的・実行時結果の対応付け                          |
-| JavaScript 実行時    |   2 | 既存の Node/Electron Inspector に接続し、スクリプトと実行コンテキストを観察 |
-| アプリのワークフロー |   7 | 機能追跡、バージョン比較、戻り値構造の比較、再実装の検証                    |
-| バイナリセッション   |  21 | 対象切り替え、根拠の保存、プロセス・関数比較、未解決事項の記録              |
+| ツール分類           |  数 | 用途                                                                            |
+| -------------------- | --: | ------------------------------------------------------------------------------- |
+| バイナリ検査         |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、参照、注釈                      |
+| 組み合わせた解析     |  14 | 概要、関数解析、一括逆コンパイル、呼び出しグラフ、Swift と ObjC                 |
+| macOS ネイティブ     |   7 | Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元                  |
+| ファイルとパッケージ |   5 | ディレクトリとパッケージ、Interface Builder、Apple リソース、抽出               |
+| .NET PE/CLI          |   7 | アセンブリ識別、メタデータ、CIL、ネイティブ呼び出し、比較、再構築の取り込み     |
+| ファームウェア       |   2 | Linux の領域検査と明示的な展開                                                  |
+| Android APK          |   5 | パッケージと manifest、クラス検索、メンバー一覧、メソッド逆コンパイル、静的参照 |
+| ブラウザー観察       |   9 | ページ、スクリプト、ソースマップ、WebMCP、スクリーンショット、比較              |
+| Electron 解析        |   5 | ページ観察、アプリ構造、静的・実行時結果の対応付け                              |
+| JavaScript 実行時    |   2 | 既存の Node/Electron Inspector に接続し、スクリプトと実行コンテキストを観察     |
+| アプリのワークフロー |   7 | 機能追跡、バージョン比較、戻り値構造の比較、再実装の検証                        |
+| バイナリセッション   |  21 | 対象切り替え、根拠の保存、プロセス・関数比較、未解決事項の記録                  |

 ## ロードマップ

@@ -219,7 +244,7 @@ Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -99,15 +99,29 @@ Setup은 먼저 연결할 에이전트를 여러 개 선택하도록 안내합

 Hopper는 데모 모드로 사용할 수 있습니다. 첫 실행 안내가 나오면 데모를 선택하거나 기존 라이선스를 입력하세요.

-### 터미널에서 실행하기
-
-설정 후 실행하세요.
+### Skill instructions and a first CLI result

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+This installs instructions, not MCP registration or analysis engines. Follow the
+[conditional connection guide](skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+`npx rea-agents setup` installs a matching skill and registers selected clients
+only after showing the plan and receiving approval. Restart/reconnect after
+registration, then verify REA tools in the active session. Repository skills can
+be ahead of the [released package](docs/installation.md#released-package-and-main).
+
+For your extracted JavaScript/Electron tree or ASAR, no MCP setup or native
+engine is required:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Replace the path with your target; Windows paths such as `"D:/apps/example"`
+are supported by this static workflow. Native analysis requires its own engine.
+
 ### rea 명령 설치하기

 명령줄 도구를 설치하세요.
@@ -137,7 +151,7 @@ Ghidra는 Linux x64와 macOS x64/arm64를 지원합니다. Ghidra 12.1.4와 완

 Setup은 설치를 확인하고 경로를 저장할 수 있습니다. Ghidra, Java, Node.js, npm, Homebrew를 설치하거나 업데이트하지 않습니다.

-Windows Ghidra 분석은 사용할 수 없습니다. 프로세스 소유권, 비공개 디렉터리 권한, 안전한 경로 검사가 구현되지 않았으므로 Ghidra와 Java를 올바르게 설치해도 분석을 활성화할 수 없습니다. [Windows Ghidra P0](docs/windows-ghidra-p0.md)를 참고하세요.
+Repository main includes experimental Windows x64 Ghidra P0 for native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS. The native controls are implemented; npm 4.0.1 does not contain them. See the [release boundary](docs/installation.md#released-package-and-main) and [Windows Ghidra P0](docs/windows-ghidra-p0.md).

 ### 문제 해결

@@ -153,12 +167,21 @@ Linux의 기본 Hopper 실행 파일은 `/opt/hopper/bin/Hopper`입니다. 다

 ## 현재 지원 범위

-REA는 CLI와 MCP로 네이티브 바이너리, JavaScript/Electron 앱, .NET 어셈블리, 웹사이트를 분석합니다. 사용할 수 있는 작업은 호스트, 대상, 선택한 분석 도구에 따라 다릅니다.
+The current repository capabilities and platform requirements are described in
+[the English support guide](README.md#current-status). Main can be ahead of the
+[npm release](docs/installation.md#released-package-and-main).

- Hopper는 네이티브 분석과 주석 작업을 지원합니다. GUI 동작은 플랫폼에 따라 다릅니다.
- Ghidra는 Linux x64와 macOS x64/arm64에서 목록, 검색, 디컴파일, 어셈블리, 호출, 참조, 명령어, 타입 검사 등 읽기 전용 작업 22개를 제공합니다. GUI나 변경 작업은 제공하지 않습니다.
- 브라우저, Electron, 프로세스 런타임 워크플로에는 각각 설정, 승인, 종료 처리 요구 사항이 있습니다. 자세한 내용은 [English README](README.md#current-status)를 참고하세요.
- Windows Ghidra 분석은 아직 사용할 수 없습니다. 진행 상황은 [#527](https://github.com/morluto/rea/issues/527)에서 확인하세요.
+- Ghidra provides 25 read-only operations on Linux x64, macOS x64/arm64, and the
+  experimental Windows x64 P0 boundary. Linux/macOS additionally supports atomic
+  session function annotations. Windows P0 is read-only; Ghidra has no GUI controls.
+- Static Android inspection has separate bring-your-own JADX/Java prerequisites;
+  real-provider verification covers Linux. See [Android analysis](docs/android-analysis.md).
+- Browser, Electron, and process requests specify their target, actions, and
+  lifecycle directly. They require the host's actual access, without separate
+  REA permission grants. Setup configuration writes and Hopper installation
+  still require approval of their exact plan.
+- `rea capabilities` describes binary-session operations rather than every
+  application/runtime tool. Consult the full MCP tool list and relevant guide.

 ## 하나의 프롬프트로 전체 조사

@@ -192,18 +215,20 @@ REA는 1–5단계의 바이너리 분석을 처리합니다. 6단계는 에이

 ## 조사 도구 카탈로그

-| 도구 분류         |  수 | 용도                                                                 |
-| ----------------- | --: | -------------------------------------------------------------------- |
-| 바이너리 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 참조, 주석                  |
-| 결합 분석         |  14 | 개요, 함수 분석, 일괄 디컴파일, 호출 그래프, Swift와 ObjC 검사       |
-| macOS 네이티브    |   7 | Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원            |
-| 파일과 패키지     |   5 | 디렉터리와 패키지 검사, Interface Builder, Apple 리소스, 추출        |
-| .NET PE/CLI       |   7 | 어셈블리 식별, 메타데이터, CIL, 네이티브 호출, 비교, 재구성 가져오기 |
-| 브라우저 관찰     |   9 | 페이지, 스크립트, 소스 맵, WebMCP, 스크린샷, 캡처 비교               |
-| Electron 분석     |   5 | 페이지 관찰, 앱 구조, 정적·런타임 결과 연결                          |
-| JavaScript 런타임 |   2 | 기존 Node/Electron Inspector에 연결해 스크립트와 실행 컨텍스트 관찰  |
-| 앱 워크플로       |   7 | 기능 추적, 버전 비교, 반환 구조 비교, 재구현 검증                    |
-| 바이너리 세션     |  21 | 대상 전환, 근거 저장, 프로세스·함수 비교, 미해결 항목 기록           |
+| 도구 분류         |  수 | 용도                                                                  |
+| ----------------- | --: | --------------------------------------------------------------------- |
+| 바이너리 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 참조, 주석                   |
+| 결합 분석         |  14 | 개요, 함수 분석, 일괄 디컴파일, 호출 그래프, Swift와 ObjC 검사        |
+| macOS 네이티브    |   7 | Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원             |
+| 파일과 패키지     |   5 | 디렉터리와 패키지 검사, Interface Builder, Apple 리소스, 추출         |
+| .NET PE/CLI       |   7 | 어셈블리 식별, 메타데이터, CIL, 네이티브 호출, 비교, 재구성 가져오기  |
+| 펌웨어            |   2 | Linux 펌웨어 영역 검사 및 명시적 추출                                 |
+| Android APK       |   5 | 패키지와 manifest, 클래스 검색, 멤버 목록, 메서드 디컴파일, 정적 참조 |
+| 브라우저 관찰     |   9 | 페이지, 스크립트, 소스 맵, WebMCP, 스크린샷, 캡처 비교                |
+| Electron 분석     |   5 | 페이지 관찰, 앱 구조, 정적·런타임 결과 연결                           |
+| JavaScript 런타임 |   2 | 기존 Node/Electron Inspector에 연결해 스크립트와 실행 컨텍스트 관찰   |
+| 앱 워크플로       |   7 | 기능 추적, 버전 비교, 반환 구조 비교, 재구현 검증                     |
+| 바이너리 세션     |  21 | 대상 전환, 근거 저장, 프로세스·함수 비교, 미해결 항목 기록            |

 ## 로드맵

@@ -220,7 +245,7 @@ Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -98,15 +98,29 @@ Setup 会先展示变更并备份已有配置。要求与更多选项见[安装

 Hopper 支持演示模式。如果首次启动时出现提示，选择演示模式或输入已有许可证。

-### 从终端运行
-
-设置完成后：
+### Skill instructions and a first CLI result

 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```

+This installs instructions, not MCP registration or analysis engines. Follow the
+[conditional connection guide](skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+`npx rea-agents setup` installs a matching skill and registers selected clients
+only after showing the plan and receiving approval. Restart/reconnect after
+registration, then verify REA tools in the active session. Repository skills can
+be ahead of the [released package](docs/installation.md#released-package-and-main).
+
+For your extracted JavaScript/Electron tree or ASAR, no MCP setup or native
+engine is required:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+Replace the path with your target; Windows paths such as `"D:/apps/example"`
+are supported by this static workflow. Native analysis requires its own engine.
+
 ### 安装 rea 命令

 安装命令行工具：
@@ -136,7 +150,7 @@ Ghidra 支持 Linux x64 和 macOS x64/arm64。单独安装 Ghidra 12.1.4 和完

 Setup 可以验证安装并保存路径，不会安装或升级 Ghidra、Java、Node.js、npm 或 Homebrew。

-Windows Ghidra 分析目前不可用。进程归属、私有目录权限和安全路径检查尚未实现，正确安装 Ghidra 和 Java 也不能启用分析。详见 [Windows Ghidra P0](docs/windows-ghidra-p0.md)。
+Repository main includes experimental Windows x64 Ghidra P0 for native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS. The native controls are implemented; npm 4.0.1 does not contain them. See the [release boundary](docs/installation.md#released-package-and-main) and [Windows Ghidra P0](docs/windows-ghidra-p0.md).

 ### 故障排查

@@ -152,12 +166,21 @@ Linux 上的默认 Hopper 启动器为 `/opt/hopper/bin/Hopper`。其他路径

 ## 当前状态

-REA 可以通过 CLI 和 MCP 分析原生二进制、JavaScript/Electron 应用、.NET 程序集和网站。具体操作取决于主机、目标和所选分析工具。
+The current repository capabilities and platform requirements are described in
+[the English support guide](README.md#current-status). Main can be ahead of the
+[npm release](docs/installation.md#released-package-and-main).

- Hopper 支持原生分析和注释操作；GUI 行为取决于平台。
- Ghidra 在 Linux x64 和 macOS x64/arm64 上提供 22 项只读操作，包括清单、搜索、反编译、汇编、调用关系、引用、指令与类型检查。它不提供 GUI 或修改操作。
- 浏览器、Electron 和进程运行时工作流有独立的配置、批准和生命周期要求。详见 [English README](README.md#current-status) 中的完整状态说明。
- Windows Ghidra 分析尚未启用，跟踪进展见 [#527](https://github.com/morluto/rea/issues/527)。
+- Ghidra provides 25 read-only operations on Linux x64, macOS x64/arm64, and the
+  experimental Windows x64 P0 boundary. Linux/macOS additionally supports atomic
+  session function annotations. Windows P0 is read-only; Ghidra has no GUI controls.
+- Static Android inspection has separate bring-your-own JADX/Java prerequisites;
+  real-provider verification covers Linux. See [Android analysis](docs/android-analysis.md).
+- Browser, Electron, and process requests specify their target, actions, and
+  lifecycle directly. They require the host's actual access, without separate
+  REA permission grants. Setup configuration writes and Hopper installation
+  still require approval of their exact plan.
+- `rea capabilities` describes binary-session operations rather than every
+  application/runtime tool. Consult the full MCP tool list and relevant guide.

 ## 一个提示词，完成一次完整调查

@@ -191,18 +214,20 @@ REA 负责第 1–5 步中的二进制分析。第 6 步由智能体使用其常

 ## 调查工具目录

-| 工具类别          | 数量 | 用途                                                      |
-| ----------------- | ---: | --------------------------------------------------------- |
-| 二进制检查        |   41 | 函数、伪代码、汇编、字符串、符号、段、引用与注释          |
-| 组合分析          |   14 | 概览、函数分析、批量反编译、调用图、Swift 与 ObjC 检查    |
-| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原     |
-| 制品检查          |    5 | 目录与软件包检查、Interface Builder、Apple 资源目录与提取 |
-| .NET PE/CLI       |    7 | 程序集身份、元数据、CIL、原生调用声明、成员比较与重建导入 |
-| 浏览器观察        |    9 | 页面、脚本、来源映射、WebMCP 工具、截图与捕获比较         |
-| Electron 分析     |    5 | 页面观察、应用结构与静态/运行时结果关联                   |
-| JavaScript 运行时 |    2 | 连接现有 Node/Electron Inspector，观察脚本与执行上下文    |
-| 应用工作流        |    7 | 功能追踪、版本比较、返回结构比较与重建验证                |
-| 二进制会话        |   21 | 目标切换、证据包、进程与函数比较、待解决问题记录          |
+| 工具类别          | 数量 | 用途                                                           |
+| ----------------- | ---: | -------------------------------------------------------------- |
+| 二进制检查        |   41 | 函数、伪代码、汇编、字符串、符号、段、引用与注释               |
+| 组合分析          |   14 | 概览、函数分析、批量反编译、调用图、Swift 与 ObjC 检查         |
+| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原          |
+| 制品检查          |    5 | 目录与软件包检查、Interface Builder、Apple 资源目录与提取      |
+| .NET PE/CLI       |    7 | 程序集身份、元数据、CIL、原生调用声明、成员比较与重建导入      |
+| 韧体              |    2 | Linux 韧体区域识别与显式解包                                   |
+| Android APK       |    5 | 包与 manifest 声明、class 搜索、成员清单、方法反编译与静态引用 |
+| 浏览器观察        |    9 | 页面、脚本、来源映射、WebMCP 工具、截图与捕获比较              |
+| Electron 分析     |    5 | 页面观察、应用结构与静态/运行时结果关联                        |
+| JavaScript 运行时 |    2 | 连接现有 Node/Electron Inspector，观察脚本与执行上下文         |
+| 应用工作流        |    7 | 功能追踪、版本比较、返回结构比较与重建验证                     |
+| 二进制会话        |   21 | 目标切换、证据包、进程与函数比较、待解决问题记录               |

 ## 路线图

@@ -219,7 +244,7 @@ Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsu
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -151,6 +151,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
    private List<FunctionEntry> procedureInventory;
    private List<InventoryItem> stringInventory;
    private DecompInterface decompiler;
+    private final ReaGhidraExtensions analysisExtensions = new ReaGhidraExtensions();
    private static AddressSpace sessionDefaultAddressSpace;

    @Override
@@ -196,6 +197,9 @@ public final class ReaGhidraBridge extends HeadlessScript {
        // each edit owns a real outer transaction and can roll back immediately.
        end(true);
        try {
+            if (!descriptor.transport.equals("unix-socket") && descriptor.analysisExtensions.size() > 0)
+                throw new IOException("Windows Ghidra P0 does not admit metadata recovery or database mutation.");
+            analysisExtensions.analyze(descriptor.analysisExtensions, currentProgram, monitor);
            initializeDecompiler();
            serve(descriptor);
        }
@@ -204,6 +208,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
                decompiler.dispose();
                decompiler = null;
            }
+            analysisExtensions.close();
        }
    }

@@ -414,6 +419,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
                .toArray(String[]::new)
        ));
        result.add("target", target);
+        JsonArray extensions = analysisExtensions.reports();
+        if (extensions.size() > 0) result.add("analysis_extensions", extensions);
        return result;
    }

@@ -454,6 +461,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
    private JsonObject inspectNativeLoadImage(JsonObject params) throws Exception {
        requireKeys(params, Set.of());
        JsonObject result = new JsonObject();
+        JsonArray recovery = analysisExtensions.inspectImage();
+        if (recovery.size() > 0) result.add("metadata_recovery", recovery);
        result.addProperty("executable_format", currentProgram.getExecutableFormat());
        result.addProperty("language_id", currentProgram.getLanguageID().getIdAsString());
        result.addProperty("compiler_spec_id", currentProgram.getCompilerSpec().getCompilerSpecID().getIdAsString());
@@ -822,6 +831,10 @@ public final class ReaGhidraBridge extends HeadlessScript {
        result.addProperty("total_fields", totalFields);
        result.addProperty("truncated", totalFields > 20_000);
        result.add("limitations", GSON.toJsonTree(List.of("Layouts are Ghidra data-type database observations; original debug/source authority and flexible-tail semantics are not inferred. Nested and recursive types retain category-path identities for separate inspection.", "At most 20000 fields or enum members are serialized per type to bound provider output. total_fields and truncated report omissions. Enum values preserve Ghidra's signed long representation.")));
+        if (type != null) {
+            JsonObject metadata = analysisExtensions.inspectDataType(currentProgram, type, address, monitor);
+            if (metadata != null) result.add("metadata_recovery", metadata);
+        }
        return result;
    }

@@ -3051,10 +3064,11 @@ public final class ReaGhidraBridge extends HeadlessScript {
        if (!Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS)) {
            throw new IllegalArgumentException("REA session descriptor is invalid");
        }
-        JsonObject object = requireObject(
-            JsonParser.parseString(Files.readString(path, StandardCharsets.UTF_8)),
-            DESCRIPTOR_KEYS
-        );
+        JsonElement parsed = JsonParser.parseString(Files.readString(path, StandardCharsets.UTF_8));
+        Set<String> keys = new HashSet<>(DESCRIPTOR_KEYS);
+        if (parsed.isJsonObject() && parsed.getAsJsonObject().has("analysis_extensions"))
+            keys.add("analysis_extensions");
+        JsonObject object = requireObject(parsed, keys);
        return new SessionDescriptor(
            requireString(object, "transport"),
            requireString(object, "endpoint_path"),
@@ -3062,7 +3076,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
            requireString(object, "run_id"),
            requireSha256(object, "target_sha256"),
            requireString(object, "provider_version"),
-            requireString(object, "profile_digest")
+            requireString(object, "profile_digest"),
+            object.has("analysis_extensions") ? object.getAsJsonArray("analysis_extensions") : new JsonArray()
        );
    }

@@ -3246,7 +3261,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
        String runId,
        String targetSha256,
        String providerVersion,
-        String profileDigest
+        String profileDigest,
+        JsonArray analysisExtensions
    ) {}
    private record Request(int id, String method, JsonObject params) {}

@@ -0,0 +1,113 @@
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.exception.CancelledException;
+import ghidra.util.task.TaskMonitor;
+import java.lang.reflect.InvocationTargetException;
+import java.net.URLClassLoader;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.List;
+
+/** Session-owned extension loading; analyzer algorithms stay behind each adapter ABI. */
+final class ReaGhidraExtensions implements AutoCloseable {
+    private record Loaded(URLClassLoader loader, Object instance, String sha256) {}
+    private final List<Loaded> loaded = new ArrayList<>();
+    private final JsonArray reports = new JsonArray();
+
+    void analyze(JsonArray descriptors, Program program, TaskMonitor monitor) throws Exception {
+        for (var item : descriptors) {
+            monitor.checkCancelled();
+            JsonObject descriptor = item.getAsJsonObject();
+            String id = descriptor.get("id").getAsString();
+            String entry = descriptor.get("entry_class").getAsString();
+            String digest = descriptor.get("sha256").getAsString();
+            JsonObject report = new JsonObject();
+            report.addProperty("id", id);
+            report.addProperty("sha256", digest);
+            URLClassLoader loader = null;
+            try {
+                if (!id.equals("nativeaot") || !entry.equals("rea.extensions.nativeaot.NativeAotExtension") ||
+                    descriptor.get("integration_api").getAsInt() != 1)
+                    throw new IllegalArgumentException("Unregistered Ghidra extension ABI: " + id);
+                Path path = Path.of(descriptor.get("path").getAsString());
+                if (!path.isAbsolute() || !Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS) || Files.size(path) > 8 * 1024 * 1024)
+                    throw new IllegalArgumentException("Invalid private extension artifact: " + path);
+                String measured = java.util.HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(Files.readAllBytes(path)));
+                if (!measured.equals(digest)) throw new IllegalArgumentException("Private extension digest mismatch: " + id);
+                loader = new URLClassLoader(new java.net.URL[] { path.toUri().toURL() }, getClass().getClassLoader());
+                Class<?> type = Class.forName(entry, true, loader);
+                Object instance = type.getConstructor().newInstance();
+                Object response = type.getMethod("analyze", Program.class, TaskMonitor.class).invoke(instance, program, monitor);
+                if (!(response instanceof JsonObject result)) throw new IllegalArgumentException("Invalid Ghidra extension result: " + id);
+                report.addProperty("status", result.get("status").getAsString());
+                report.add("reason", result.get("reason").deepCopy());
+                report.add("result", result);
+                loaded.add(new Loaded(loader, instance, digest));
+                loader = null;
+            } catch (InvocationTargetException ex) {
+                if (ex.getCause() instanceof CancelledException cancelled) throw cancelled;
+                failure(report, ex.getCause());
+            } catch (Exception | LinkageError ex) {
+                failure(report, ex);
+            } finally {
+                if (loader != null) loader.close();
+            }
+            reports.add(report);
+        }
+    }
+
+    JsonArray reports() { return reports.deepCopy(); }
+
+    JsonArray inspectImage() throws Exception {
+        JsonArray summaries = new JsonArray();
+        for (Loaded extension : loaded) {
+            Object response = extension.instance.getClass().getMethod("inspectImage").invoke(extension.instance);
+            if (!(response instanceof JsonObject summary)) throw new IllegalArgumentException("Invalid extension image summary");
+            summary.addProperty("analysis_artifact_sha256", extension.sha256);
+            summaries.add(summary);
+        }
+        return summaries;
+    }
+
+    JsonObject inspectDataType(Program program, DataType type, Address address, TaskMonitor monitor) throws Exception {
+        for (Loaded extension : loaded) {
+            try {
+                Object response = extension.instance.getClass().getMethod("inspectDataType", Program.class, DataType.class, Address.class, TaskMonitor.class)
+                    .invoke(extension.instance, program, type, address, monitor);
+                if (response instanceof JsonObject result) return result;
+                if (response != null) throw new IllegalArgumentException("Invalid extension type metadata result");
+            } catch (InvocationTargetException ex) {
+                if (ex.getCause() instanceof CancelledException cancelled) throw cancelled;
+                throw new IllegalStateException("Ghidra extension type inspection failed: " + ex.getCause(), ex.getCause());
+            }
+        }
+        return null;
+    }
+
+    private static void failure(JsonObject report, Throwable ex) {
+        String reason = "Extension loading/analysis failed: " + ex;
+        if (ex.getCause() != null) reason += "; caused by " + ex.getCause();
+        report.addProperty("status", "failed");
+        report.addProperty("reason", reason);
+        JsonObject result = new JsonObject();
+        result.addProperty("loader_failure", reason);
+        report.add("result", result);
+    }
+
+    @Override public void close() throws Exception {
+        Exception failure = null;
+        for (Loaded extension : loaded) {
+            try { extension.loader.close(); }
+            catch (Exception ex) { if (failure == null) failure = ex; else failure.addSuppressed(ex); }
+        }
+        loaded.clear();
+        if (failure != null) throw failure;
+    }
+}
@@ -0,0 +1,70 @@
+package rea.extensions.nativeaot;
+
+import ghidra.app.util.importer.MessageLog;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import java.util.LinkedHashSet;
+import nativeaot.rtr.ReadyToRunDirectory;
+import nativeaot.rtr.ReadyToRunSection;
+import nativeaot.rtr.SignatureReadyToRunLocator;
+import nativeaot.rtr.SymbolReadyToRunLocator;
+
+/** Validate the producer's NativeAOT row layout before database mutation. */
+final class NativeAotDirectory {
+    record Located(Address address, ReadyToRunDirectory directory, String discovery) {}
+
+    static Located locate(Program program, TaskMonitor monitor, MessageLog log) throws Exception {
+        Address[] symbols = SymbolReadyToRunLocator.instance.locateModules(program, monitor, log);
+        String discovery = symbols.length == 0 ? "signature-heuristic" : "symbol";
+        Address[] found = symbols.length == 0
+            ? SignatureReadyToRunLocator.instance.locateModules(program, monitor, log) : symbols;
+        var candidates = new LinkedHashSet<Address>();
+        for (Address address : found) if (address.getOffset() != 0) candidates.add(address);
+        if (candidates.isEmpty()) return null;
+        if (candidates.size() != 1)
+            throw new UnsupportedOperationException("Ambiguous NativeAOT directory candidates: " + candidates);
+        Address address = candidates.iterator().next();
+        var memory = program.getMemory();
+        byte[] header = new byte[16];
+        if (memory.getBytes(address, header) != header.length)
+            throw new IllegalArgumentException("Incomplete NativeAOT header at " + address);
+        int count = Short.toUnsignedInt(memory.getShort(address.add(12)));
+        if (count < 1 || count > 80 || Byte.toUnsignedInt(header[14]) != 24 || header[15] != 1)
+            throw new UnsupportedOperationException("Unsupported NativeAOT row layout at " + address +
+                ": sections=" + count + ", entry_size=" + Byte.toUnsignedInt(header[14]) + ", entry_type=" + Byte.toUnsignedInt(header[15]));
+        byte[] rows = new byte[count * 24];
+        if (memory.getBytes(address.add(16), rows) != rows.length)
+            throw new IllegalArgumentException("Incomplete NativeAOT directory rows at " + address);
+        ReadyToRunDirectory directory = ReadyToRunDirectory.readAtAddress(program, address);
+        if (directory.getMajorVersion() != 9 || directory.getMinorVersion() != 1)
+            throw new UnsupportedOperationException("Unsupported NativeAOT RTR format " +
+                directory.getMajorVersion() + "." + directory.getMinorVersion() + " at " + address + "; verified format is 9.1 (.NET 8.0.22 Linux x64 fixture).");
+        var types = new LinkedHashSet<Integer>();
+        for (ReadyToRunSection section : directory.getSections()) {
+            monitor.checkCancelled();
+            if (!types.add(section.getType())) throw new IllegalArgumentException("Duplicate NativeAOT section " + section.getType() + " at " + address);
+            // ModuleInfoRow flags bit 0 declares an end pointer. ThreadStaticIndex
+            // (204) is a single-address entry with flags=0 and an absent end.
+            if (section.getFlags() != 0 && section.getFlags() != 1)
+                throw new UnsupportedOperationException("Unsupported NativeAOT section flags " + section.getFlags() + " for section " + section.getType());
+            boolean hasEnd = section.getFlags() == 1;
+            if (!hasEnd && section.getEnd() != 0)
+                throw new IllegalArgumentException("NativeAOT single-address section " + section.getType() + " reports an unexpected end");
+            if (hasEnd && Long.compareUnsigned(section.getStart(), section.getEnd()) > 0)
+                throw new IllegalArgumentException("Reversed NativeAOT section " + section.getType() + " at " + address);
+            if (section.getStart() != 0 && (!hasEnd || section.getStart() != section.getEnd()) &&
+                (!memory.contains(address.getNewAddress(section.getStart())) ||
+                 (hasEnd && !memory.contains(address.getNewAddress(section.getEnd() - 1)))))
+                throw new IllegalArgumentException("Unmapped NativeAOT section " + section.getType() + " at " + address);
+        }
+        if (directory.getSectionByType(ReadyToRunSection.DEHYDRATED_DATA) == null)
+            throw new UnsupportedOperationException("NativeAOT directory at " + address + " has no DEHYDRATED_DATA; non-dehydrated layouts are not verified.");
+        for (int type : new int[] { ReadyToRunSection.DEHYDRATED_DATA, ReadyToRunSection.FROZEN_OBJECT_REGION }) {
+            ReadyToRunSection section = directory.getSectionByType(type);
+            if (section != null && section.getFlags() != 1)
+                throw new IllegalArgumentException("NativeAOT section " + type + " requires an end pointer");
+        }
+        return new Located(address, directory, discovery);
+    }
+}
@@ -0,0 +1,183 @@
+package rea.extensions.nativeaot;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.app.util.importer.MessageLog;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.address.AddressSet;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.exception.CancelledException;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.FrozenObjectAnnotator;
+import nativeaot.objectmodel.MethodTableCrawler;
+import nativeaot.objectmodel.MethodTableManager;
+import nativeaot.rehydration.MetadataRehydratorNet80;
+import nativeaot.rtr.ReadyToRunSection;
+import java.util.ArrayList;
+import java.util.List;
+import java.security.MessageDigest;
+
+/** Optional headless facade over the unchanged upstream analysis primitives. */
+public final class NativeAotExtension {
+    private MethodTableManager manager;
+    private NativeAotDirectory.Located located;
+    private JsonObject report;
+    private final List<String> diagnostics = new ArrayList<>();
+    private JsonObject derivedRange;
+
+    public JsonObject analyze(Program program, TaskMonitor monitor) throws Exception {
+        report = new JsonObject();
+        report.addProperty("id", "nativeaot");
+        report.addProperty("integration_api", 1);
+        report.addProperty("source_revision", "effeb734fc570c32650f88b159608979dc7b423e");
+        report.addProperty("source_revision_authority", "build-reported-unattested");
+        report.addProperty("status", "not_applicable");
+        report.addProperty("reason", "No NativeAOT directory with the supported row layout was found.");
+        report.addProperty("method_tables", 0);
+        if (!program.getLanguageID().getIdAsString().startsWith("x86:LE:64"))
+            return failure("unsupported", "NativeAOT adapter supports x86-64 only.");
+        MessageLog log = new MessageLog();
+        int transaction = program.startTransaction("REA NativeAOT metadata recovery");
+        boolean commit = false;
+        String stage = "directory-discovery";
+        try {
+            located = NativeAotDirectory.locate(program, monitor, log);
+            if (located == null) return finish(log);
+            report.addProperty("header_address", address(located.address()));
+            report.addProperty("discovery", located.discovery());
+            report.addProperty("format_major", located.directory().getMajorVersion());
+            report.addProperty("format_minor", located.directory().getMinorVersion());
+            stage = "metadata-rehydration";
+            var section = located.directory().getSectionByType(ReadyToRunSection.DEHYDRATED_DATA);
+            Address start = located.address().getNewAddress(section.getStart());
+            Address end = located.address().getNewAddress(section.getEnd());
+            if (start.compareTo(end) >= 0) throw new IllegalArgumentException("Empty dehydrated section at " + start);
+            var scan = new MetadataRehydratorNet80().rehydrate(program, new AddressSet(start, end).getFirstRange(), monitor, log);
+            // Upstream reports an inclusive end at base + written length.
+            long writtenLength = scan.getScanningRange().getLength() - 1;
+            derivedRange = new JsonObject();
+            derivedRange.addProperty("address", address(scan.getScanningRange().getMinAddress()));
+            derivedRange.addProperty("size_bytes", writtenLength);
+            derivedRange.addProperty("sha256", hashMemory(program, scan.getScanningRange().getMinAddress(), writtenLength, monitor));
+            derivedRange.add("file_offset", JsonNull.INSTANCE);
+            stage = "method-table-recovery";
+            manager = MethodTableManager.createForDirectory(program, located.directory());
+            var conventions = NativeAotMethodConventions.capture(program, monitor);
+            new MethodTableCrawler(manager, program, scan).analyze(monitor, log);
+            stage = "calling-convention-preservation";
+            NativeAotMethodConventions.restore(program, manager, conventions, monitor);
+            log.appendMsg("REA", "Preserved pre-recovery calling conventions; new functions use the loaded compiler specification default. Original method signatures remain unknown.");
+            if (manager.getObjectMT() == null || manager.getMethodTableCount() == 0)
+                throw new UnsupportedOperationException("No unambiguous System.Object method table was recovered at header " + located.address());
+            stage = "frozen-object-annotation";
+            if (manager.getStringMT() == null || scan.getPointerLocations().length == 0) {
+                diagnostics.add("Frozen-object annotation unavailable: System.String table or pointer locations were not recovered.");
+            } else {
+                new FrozenObjectAnnotator(program, manager).analyze(located.directory(), scan.getPointerLocations(), monitor, log);
+            }
+            monitor.checkCancelled();
+            report.addProperty("method_tables", manager.getMethodTableCount());
+            JsonObject coverage = auditFrozenObjects(program, scan.getPointerLocations(), monitor);
+            report.add("coverage", coverage);
+            if (coverage.get("frozen_objects_annotated").getAsInt() != coverage.get("frozen_object_candidates").getAsInt())
+                diagnostics.add("Some frozen-object candidates lack committed instance annotations; inspect coverage counts and Ghidra diagnostics.");
+            report.addProperty("status", diagnostics.isEmpty() ? "complete" : "partial");
+            report.add("reason", JsonNull.INSTANCE);
+            report.add("derived_memory", derivedRange.deepCopy());
+            JsonArray tables = new JsonArray();
+            for (var mt : manager.getMethodTables()) {
+                monitor.checkCancelled();
+                JsonObject identity = new JsonObject();
+                identity.addProperty("address", address(mt.getAddress()));
+                identity.addProperty("type", mt.getMTType().getPathName());
+                tables.add(identity);
+            }
+            report.add("types", tables);
+            commit = true;
+            return finish(log);
+        } catch (CancelledException ex) {
+            manager = null;
+            throw ex;
+        } catch (Exception ex) {
+            manager = null;
+            diagnostics.add(stage + ": " + ex.getClass().getSimpleName() + ": " + ex.getMessage());
+            report.addProperty("status", ex instanceof UnsupportedOperationException ? "unsupported" : "failed");
+            report.addProperty("reason", stage + ": " + ex.getMessage());
+            return finish(log);
+        } finally {
+            program.endTransaction(transaction, commit);
+        }
+    }
+
+    /** Inline discovery for the existing loaded-image inspection. */
+    public JsonObject inspectImage() {
+        JsonObject summary = new JsonObject();
+        summary.addProperty("format", "dotnet-nativeaot");
+        for (String key : new String[] { "status", "reason", "header_address", "discovery", "format_major", "format_minor", "method_tables", "derived_memory", "coverage", "diagnostics" })
+            summary.add(key, report.has(key) ? report.get(key).deepCopy() : JsonNull.INSTANCE);
+        summary.add("types", report.has("types") ? report.get("types").deepCopy() : new JsonArray());
+        JsonArray limitations = new JsonArray();
+        limitations.add("Recovery covers the reported metadata candidates; it does not reconstruct original C# source, custom field layouts, every runtime object, or execution behavior.");
+        limitations.add("Method prototypes and parameter names remain Ghidra inferences; verify them against instructions and call sites. Pre-recovery conventions are retained rather than universally forcing __thiscall.");
+        limitations.add("NativeAOT type identities and relationships are inferred; generated names are not original names. Derived memory has no original file offsets.");
+        summary.add("limitations", limitations);
+        return summary;
+    }
+
+    /** Read recovered relationships without restoring or mutating database state. */
+    public JsonObject inspectDataType(Program program, DataType type, Address selected, TaskMonitor monitor) throws Exception {
+        if (manager == null) return null;
+        return NativeAotTypeMetadata.describe(program, manager, located, type, report, derivedRange, monitor);
+    }
+
+    private JsonObject auditFrozenObjects(Program program, Address[] pointerLocations, TaskMonitor monitor) throws Exception {
+        JsonObject coverage = new JsonObject();
+        int candidates = 0, annotated = 0;
+        var section = located.directory().getSectionByType(ReadyToRunSection.FROZEN_OBJECT_REGION);
+        if (section != null) for (Address location : section.getPointersInSection(pointerLocations)) {
+            monitor.checkCancelled();
+            var table = manager.getMethodTable(program.getMemory().getLong(location));
+            if (table == null) continue;
+            candidates++;
+            var expected = table.getInstanceType();
+            var actual = program.getListing().getDataAt(location);
+            if (expected != null && actual != null && actual.getDataType().getPathName().equals(expected.getPathName())) annotated++;
+        }
+        coverage.addProperty("frozen_object_candidates", candidates);
+        coverage.addProperty("frozen_objects_annotated", annotated);
+        coverage.addProperty("basis", "rehydrated-pointer-candidates-and-committed-instance-types");
+        return coverage;
+    }
+
+    private JsonObject finish(MessageLog log) {
+        if (!log.toString().isBlank()) diagnostics.add(log.toString());
+        JsonArray messages = new JsonArray();
+        for (String message : diagnostics) messages.add(message);
+        report.add("diagnostics", messages);
+        return report;
+    }
+
+    private JsonObject failure(String status, String reason) {
+        report.addProperty("status", status);
+        report.addProperty("reason", reason);
+        return finish(new MessageLog());
+    }
+
+    static String address(Address value) { return "0x" + Long.toUnsignedString(value.getOffset(), 16); }
+
+    private static String hashMemory(Program program, Address start, long length, TaskMonitor monitor) throws Exception {
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        byte[] buffer = new byte[65536];
+        for (long offset = 0; offset < length;) {
+            monitor.checkCancelled();
+            int count = (int)Math.min(buffer.length, length - offset);
+            if (program.getMemory().getBytes(start.add(offset), buffer, 0, count) != count)
+                throw new IllegalStateException("Incomplete derived-memory read at " + start.add(offset));
+            digest.update(buffer, 0, count);
+            offset += count;
+        }
+        return java.util.HexFormat.of().formatHex(digest.digest());
+    }
+}
@@ -0,0 +1,38 @@
+package rea.extensions.nativeaot;
+
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.MethodTableManager;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+
+/** Keep upstream's unconditional __thiscall assignment out of x64 ABI evidence. */
+final class NativeAotMethodConventions {
+    static Map<Address, String> capture(Program program, TaskMonitor monitor) throws Exception {
+        Map<Address, String> result = new HashMap<>();
+        var functions = program.getFunctionManager().getFunctions(true);
+        while (functions.hasNext()) {
+            monitor.checkCancelled();
+            var function = functions.next();
+            result.put(function.getEntryPoint(), function.getCallingConventionName());
+        }
+        return result;
+    }
+
+    static void restore(Program program, MethodTableManager manager, Map<Address, String> previous, TaskMonitor monitor) throws Exception {
+        var visited = new HashSet<Address>();
+        String defaultConvention = program.getCompilerSpec().getDefaultCallingConvention().getName();
+        for (var table : manager.getMethodTables()) for (long target : table.getVTable()) {
+            monitor.checkCancelled();
+            Address address = table.getAddress().getNewAddress(target);
+            if (!visited.add(address)) continue;
+            var function = program.getFunctionManager().getFunctionAt(address);
+            if (function == null) continue;
+            String convention = previous.containsKey(address) ? previous.get(address) : defaultConvention;
+            if (!java.util.Objects.equals(function.getCallingConventionName(), convention))
+                function.setCallingConvention(convention);
+        }
+    }
+}
@@ -0,0 +1,70 @@
+package rea.extensions.nativeaot;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.MethodTable;
+import nativeaot.objectmodel.MethodTableManager;
+
+/** Translate a selected recovered type into provider-neutral metadata evidence. */
+final class NativeAotTypeMetadata {
+    static JsonObject describe(Program program, MethodTableManager manager, NativeAotDirectory.Located located,
+        DataType type, JsonObject report, JsonObject derivedRange, TaskMonitor monitor) throws Exception {
+        for (MethodTable table : manager.getMethodTables()) {
+            monitor.checkCancelled();
+            boolean sameType = type.getPathName().equals(table.getMTType().getPathName()) ||
+                (table.getInstanceType() != null && type.getPathName().equals(table.getInstanceType().getPathName()));
+            if (!sameType) continue;
+            JsonObject result = new JsonObject();
+            result.addProperty("format", "dotnet-nativeaot");
+            result.addProperty("status", report.get("status").getAsString());
+            result.addProperty("header_address", NativeAotExtension.address(located.address()));
+            result.addProperty("format_major", located.directory().getMajorVersion());
+            result.addProperty("format_minor", located.directory().getMinorVersion());
+            result.addProperty("method_table_address", NativeAotExtension.address(table.getAddress()));
+            result.addProperty("name_origin", table == manager.getObjectMT() || table == manager.getStringMT() ? "inferred" : "generated");
+            result.add("original_name", JsonNull.INSTANCE);
+            result.addProperty("base_size_bytes", table.getBaseSize());
+            result.add("related_type", identity(manager, table.getRelatedTypeAddress()));
+            JsonArray interfaces = new JsonArray();
+            for (long value : table.getInterfaceAddresses()) if (value != 0) interfaces.add(identity(manager, value));
+            result.add("interfaces", interfaces);
+            JsonArray slots = new JsonArray();
+            for (int slot = 0; slot < table.getVTableSlotCount(); slot++) {
+                monitor.checkCancelled();
+                long value = table.getVTableSlot(slot);
+                JsonObject target = new JsonObject();
+                target.addProperty("slot", slot);
+                target.addProperty("slot_address", NativeAotExtension.address(table.getAddress().add(24 + slot * 8L)));
+                target.add("target_address", value == 0 ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive("0x" + Long.toUnsignedString(value, 16)));
+                var function = value == 0 ? null : program.getFunctionManager().getFunctionAt(table.getAddress().getNewAddress(value));
+                target.add("procedure_name", function == null ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive(function.getName(true)));
+                target.addProperty("basis", "method-table-pointer");
+                slots.add(target);
+            }
+            result.add("virtual_slots", slots);
+            result.add("derived_memory", derivedRange.deepCopy());
+            result.add("diagnostics", report.get("diagnostics").deepCopy());
+            JsonArray limitations = new JsonArray();
+            limitations.add("Type identities and relationships are recovered by upstream heuristics. Original source names and custom field layouts are not recovered.");
+            limitations.add("Method prototypes are inferred, not original signatures. REA preserves pre-recovery calling conventions and the loaded compiler default for new functions.");
+            limitations.add("Rehydrated metadata bytes are derived analysis-memory content; their original file offsets and runtime behavior remain unknown.");
+            limitations.add("Verified workflow: .NET 8.0.22 NativeAOT RTR 9.1, Linux x64 ELF / Windows x64 PE on Linux; other runtime layouts and hosts are unverified.");
+            result.add("limitations", limitations);
+            return result;
+        }
+        return null;
+    }
+
+    private static com.google.gson.JsonElement identity(MethodTableManager manager, long value) throws Exception {
+        if (value == 0) return JsonNull.INSTANCE;
+        JsonObject result = new JsonObject();
+        result.addProperty("address", "0x" + Long.toUnsignedString(value, 16));
+        MethodTable table = manager.getMethodTable(value);
+        result.add("type", table == null ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive(table.getMTType().getPathName()));
+        return result;
+    }
+}
@@ -5,9 +5,12 @@
 - Implementation status: The provider registry, deterministic selection,
  target binding, analysis-profile commitment, and snapshot/Evidence migration
  are implemented. Ghidra discovery, target/profile resolution, doctor checks,
-  the private headless-session foundation, ten read-only inventory capabilities,
-  and twelve function-analysis capabilities are implemented with real
-  cross-format conformance.
+  the private headless-session foundation, thirteen read-only inventory/load-image
+  capabilities, and twelve function-analysis capabilities are implemented with
+  real cross-format conformance. Linux/macOS also supports atomic session
+  function annotations; experimental Windows x64 P0 uses bundled native controls
+  and admits only the 25 read-only operations. See the
+  [release boundary](../installation.md#released-package-and-main).

 ## Context

@@ -25,7 +28,7 @@ engine, engine version, or complete analysis configuration. Two analyses of the
 same bytes could therefore disagree because of language, compiler, loader,
 analyzer, or provider-version differences while appearing target-compatible.

-These constraints are embodied in the current
+The decision addressed the earlier representations of
 [`CompositeProvider`](../../src/application/CompositeProvider.ts),
 [runtime composition](../../src/application/runtime.ts),
 [`BinarySession`](../../src/application/BinarySession.ts),
@@ -4,8 +4,8 @@ Accepted decisions describe the architecture that implementation PRs must
 follow. Acceptance does not by itself mean the behavior is shipped; each record
 states its implementation status separately.

-| ADR                                                                                                                | Status               | Implementation                                                                                                               |
-| ------------------------------------------------------------------------------------------------------------------ | -------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted             | Provider selection and 22 Ghidra operations shipped on Linux/macOS; experimental Windows x64 P0 with bundled native controls |
-| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Superseded           | Historical design; the controlled JavaScript replay tool was removed                                                         |
-| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Partially superseded | Seven static managed tools remain; runtime planning removed                                                                  |
+| ADR                                                                                                                | Status               | Implementation                                                                                                                        |
+| ------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted             | Provider selection and 25 read-only Ghidra operations on Linux/macOS and experimental Windows x64 P0; Linux/macOS session annotations |
+| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Superseded           | Historical design; the controlled JavaScript replay tool was removed                                                                  |
+| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Partially superseded | Seven static managed tools remain; runtime planning removed                                                                           |
@@ -0,0 +1,130 @@
+# Static Android APK analysis
+
+REA wraps an existing headless JADX engine through `src/android/`. Its source is
+kept as an unmodified, commit-pinned Git submodule; see
+[upstream provenance](../third_party/README.md). CLI and MCP use the same
+application workflow and return artifact-bound Evidence inline.
+
+This family is present on repository main and absent from npm 4.0.1. Check the
+[released package boundary](installation.md#released-package-and-main) and the
+connected server's tool list before selecting it.
+
+## Supply tools
+
+Use **Java 17 or newer** and **jadx-headless-mcp 0.7.1**. REA does not install Java,
+an Android SDK, JADX, a device service or an emulator. Set the path in the shell
+or MCP server environment:
+
+```sh
+export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar
+# Optional: select an existing JDK rather than java on PATH.
+export JAVA_HOME=/absolute/path/existing-jdk
+```
+
+Linux is verified with the public Appium ApiDemos fixture. The POSIX adapter can
+run on macOS, but that host has not undergone real Android verification.
+Windows is unsupported for this provider's owned stdio process boundary.
+
+## Answer an analyst question
+
+```sh
+rea inspect-android-package /path/Example.apk
+rea search-android-classes /path/Example.apk MainActivity
+rea inspect-android-class /path/Example.apk example.MainActivity
+rea inspect-android-method /path/Example.apk example.MainActivity onCreate
+rea inspect-android-method /path/Example.apk example.MainActivity select --overload-index 1
+rea trace-android-references /path/Example.apk example.MainActivity
+rea trace-android-references /path/Example.apk example.MainActivity --method-name onCreate
+```
+
+Equivalent MCP methods are `inspect_android_package`, `search_android_classes`,
+`inspect_android_class`, `inspect_android_method` and `trace_android_references`.
+Every request includes `path`. Class/method operations use `class_name`,
+`method_name` and optional `overload_index` as applicable. For example:
+
+```json
+{
+  "name": "inspect_android_method",
+  "arguments": {
+    "path": "/path/Example.apk",
+    "class_name": "example.MainActivity",
+    "method_name": "select",
+    "overload_index": 1
+  }
+}
+```
+
+Use `inspect_android_class` to choose an overload. REA rejects an ambiguous
+method request rather than silently selecting the first match. The engine's
+method reference operation cannot select overloads, so REA reports that boundary
+as unsupported when multiple same-name methods exist.
+
+The engine's smali fallback also joins same-name overloads; REA rejects that
+fallback for an overloaded method instead of attributing all bodies to one
+selected overload. Native/abstract methods with no decompiled body report
+`body_status: "not_available"` without inferring which implementation flag caused it.
+
+## Interpret the result
+
+- Package inspection retains decoded manifest XML, summary declarations,
+  permissions and class/resource counts. Summary fields are extracted by the
+  upstream engine and should be checked against the retained XML when needed.
+  Signature verification is explicitly `not_performed`.
+- Class search consumes all pages and checks their counts. An empty `query`
+  inventories all class names; class names are decompiler representations.
+- Class inventories return display signatures, fields and inner class names.
+  Exact DEX descriptors are unknown. Overload indices are tied to this artifact
+  and engine, not stable identities across different builds.
+- Method inspection reports Java or smali, fallback markers and complete/partial
+  returned text. Decompiled source is a derived representation. A complete text
+  result does not establish complete semantics or a byte-identical reconstruction.
+- Reference results are incoming static relationships between provider nodes.
+  Source lines and DEX instruction offsets remain unknown. They are not observed
+  runtime calls.
+- Original requests, APK SHA-256, actual engine JAR SHA-256 and raw producer
+  responses remain in Evidence. Source revision is populated only for bytes
+  matching the audited release JAR.
+
+These operations do not execute the APK or provide split APK/AAB handling,
+signature validation, full resource-table semantics, native-library analysis or
+Android runtime capture. Existing artifact inventory/extraction tools can supply
+archive evidence; `project_android_application_graph` remains a separate,
+execution-free inventory projection.
+
+## Resource and lifecycle limits
+
+Each request creates private, immutable APK and JAR copies. Their workspace and
+owned process group are cleaned on success, failure, timeout and cancellation.
+REA never writes to the original APK or launches target code.
+
+If process cleanup cannot be confirmed, REA retains the workspace and reports its
+location. That provider instance blocks subsequent engine launches until the
+caller resolves the reported resources and starts a fresh instance.
+
+The provider serializes requests within each REA instance, uses one worker and
+sets JVM maximum heap to **512 MiB**. Heap is not a total RSS cap: the JVM also
+uses native memory. Independent REA instances have independent queues. Whole
+operations have a **120-second** execution deadline after reaching the queue's
+front; upstream decompilation is limited to **90 seconds**.
+
+Decoded manifest and method text have a **1 MiB** upstream byte budget and report
+truncation. A protocol frame above **8 MiB**, or cumulative stdout/stderr above
+**32 MiB**, fails with a diagnostic instead of returning an incomplete inventory
+as complete. These are memory-safety boundaries, not undocumented result caps.
+
+## Real verification
+
+Download the explicit public fixtures once; this installs no tools:
+
+```sh
+npm run fixtures:android
+export REA_JADX_MCP_JAR="$PWD/_reference/apk-integration/jadx-headless-mcp-0.7.1-all.jar"
+export REA_ANDROID_TEST_APK="$PWD/_reference/apk-integration/ApiDemos-debug.apk"
+npm run verify:android
+```
+
+The download script verifies fixed SHA-256 values, reuses matching files and
+refuses to overwrite a different existing file. APK/JAR files live under ignored
+`_reference/` and are excluded from package contents. The lane exercises actual
+REA CLI and MCP results with the real engine, separately from synthetic protocol
+regressions. It needs no Gradle build, emulator, Android SDK or Ghidra.
@@ -22,9 +22,13 @@ graph TD
    subgraph "Provider Layers"
        HOPPER["src/hopper/<br/>Hopper launch & Unix-socket protocol<br/>BridgeLauncher, HopperClient, protocol"]
        GHIDRA["src/ghidra/<br/>Ghidra discovery, profile & function analysis<br/>snapshot, Unix/Windows transport, bounded lifecycle"]
+        IDA["src/ida/<br/>Upstream MCP contract adaptation<br/>live GUI binding or owned headless database"]
+        IDA_MCP["External ida-pro-mcp<br/>GUI proxy or database supervisor<br/>upstream installation and engine lifecycle"]
        AUX["src/artifacts/ + src/native/<br/>disjoint artifact and native capabilities"]
        BROWSER["src/browser/<br/>Loopback CDP transport<br/>exact-origin passive observation"]
        DOTNET["src/dotnet/<br/>Managed static metadata provider<br/>PE/CLI metadata inventory, members, IL"]
+        FIRMWARE["src/firmware/<br/>Binwalk / Unblob adapters<br/>owned processes, report normalization, private extraction"]
+        ANDROID["src/android/<br/>Static APK adapter<br/>owned SDK stdio, pinned headless JADX, normalization"]
        REFERENCE["src/reference/<br/>Filesystem reference-source reader<br/>bounded traversal, validation, errors"]
    end

@@ -61,11 +65,22 @@ graph TD
    MAIN --> SERVER
    MAIN --> APP
    CLI --> APP
+    APP --> FIRMWARE
+    FIRMWARE --> PROCESS
+    FIRMWARE --> CONTRACTS
+    APP --> ANDROID
+    ANDROID --> PROCESS
+    ANDROID --> CONTRACTS
+    ANDROID --> DOMAIN
    CLI --> ERRORS
    APP --> SESSION
    SESSION --> REGISTRY
    REGISTRY --> HOPPER
    REGISTRY --> GHIDRA
+    REGISTRY --> IDA
+    IDA --> IDA_MCP
+    IDA --> CONTRACTS
+    IDA --> DOMAIN
    SESSION --> AUX
    APP --> JS_RECON
    APP --> INSTALL
@@ -96,6 +111,7 @@ graph TD
    TESTS -.-> MAIN
    TESTS -.-> HOPPER
    TESTS -.-> GHIDRA
+    TESTS -.-> IDA
    TESTS -.-> PROCESS
    TESTS -.-> BROWSER
    TESTS -.-> EVALUATION
@@ -4,7 +4,7 @@ REA can attach to a user-owned Chrome-family browser through the Chrome DevTools

 ## Shipped surfaces

- `list_browser_targets` / `rea list-browser-targets` discovers page targets at the selected target's current origin by default, with an optional exact-origin filter.
+- `list_browser_targets` / `rea list-browser-targets` discovers all eligible page targets at the endpoint by default, with an optional exact-origin filter.
 - `inspect_web_page` / `rea inspect-web-page` captures DOM structure, accessibility nodes, scripts, resources, safe response/DOM metadata, attach-window network and console metadata, WebSocket frame sizes, workers, quota, and optionally selected storage key names, redacted storage-content fingerprints, or script sources.
 - `analyze_web_bundle` / `rea analyze-web-bundle` parses selected script artifacts without execution and derives chunk edges, route and endpoint candidates, vendor fingerprints, static WebMCP declarations, and optionally source-map/original-source evidence.
 - `observe_web_session` / `rea observe-web-session` arms an observation window of the requested duration for an external user action and records ordered reload, SPA navigation, redirect, failure, lifecycle, and target-termination metadata.
@@ -37,9 +37,9 @@ REA does not launch, own, or terminate this browser. Use a dedicated profile and

 ## Request boundary

-Each request supplies a literal loopback CDP endpoint and target. Target
-discovery uses the selected target's current origin by default; an optional
-exact HTTP(S) origin filter can narrow the result. `localhost`, private-LAN
+Discovery supplies a literal loopback CDP endpoint and returns all eligible
+page targets unless an exact HTTP(S) origin filter narrows the result. Follow-up
+inspection requests select one target; their default scope is its current origin. `localhost`, private-LAN
 addresses, HTTPS CDP endpoints, credentials, paths, queries, fragments, and
 implicit ports are not valid CDP endpoints. Origin filters contain only scheme,
 host, and port; paths, credentials, queries, fragments, and wildcards are not
@@ -21,6 +21,115 @@ Duration, action, and navigation
 timeouts remain fixed provider-owned liveness limits; the request does not
 accept a caller-controlled `limits` object.

+## Minimal launch example
+
+Save this as `browser-scenario.json`, replacing the executable path with an
+already-installed Chrome-family browser and the URL with your running fixture:
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    { "step_id": "settle", "action": "wait_for_timeout", "duration_ms": 100 }
+  ]
+}
+```
+
+```bash
+rea capture-browser-scenario ./browser-scenario.json --json > browser-capture.json
+```
+
+The default capture includes the final URL. Select DOM, screenshots, or events
+only when they help answer the question. REA launches and cleans up the browser
+profile for this request; it does not start your fixture server or install a
+browser. A schema-valid scenario does not prove that the executable or target
+is available on the host.
+
+## Interaction example: capture the visible result
+
+The default final URL answers "where did the page end up?", not "what did the
+page show?". Many interactions, such as a search button that renders results in
+place, change the page without changing the URL. A capture with only the
+default `url` artifact then reports that the click succeeded and the URL is
+unchanged, which cannot tell you whether results appeared.
+
+Request the artifacts that answer your question and wait for the state you want
+to inspect. This scenario clicks a Search button, waits for the current search
+results, and captures the final DOM, accessibility tree, and URL. It assumes the
+local page clears `#results`'s `data-state` while loading and sets it to `ready`
+after rendering the current response. Adapt the selectors and readiness marker
+to your page; an already-visible container or previous results are insufficient.
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    {
+      "step_id": "search",
+      "action": "click",
+      "locator": { "kind": "css", "selector": "#search" },
+      "timeout_ms": 10000
+    },
+    {
+      "step_id": "results-ready",
+      "action": "wait_for",
+      "locator": { "kind": "css", "selector": "#results[data-state='ready']" },
+      "state": "visible",
+      "timeout_ms": 10000
+    }
+  ],
+  "capture": { "at_end": ["dom", "accessibility", "url"] }
+}
+```
+
+Save it as `browser-search.json` and run it the same way as the minimal
+example:
+
+```bash
+rea capture-browser-scenario ./browser-search.json --json > browser-search-capture.json
+```
+
+Through MCP, pass the same object as the `capture_browser_scenario` arguments.
+The final step's DOM and accessibility artifacts retain the page state at that
+capture time inline. REA still launches and cleans up the browser profile.
+
+The click's `timeout_ms` covers the click action. A non-navigating `fetch` or
+delayed render can finish later, so use `wait_for` to observe a page-specific
+ready condition before final capture. A page that updates synchronously can
+omit that wait. REA does not infer application readiness from capture selection.
+
+Choose captures by the question being asked:
+
+- `dom` and `accessibility`: text or structure the page rendered, such as
+  search results, validation messages, or updated lists. The accessibility tree
+  is usually the more compact way to read visible text.
+- `screenshot`: visual layout or styling, or content not exposed as text, such
+  as a canvas.
+- `history` or `storage`: navigation history, or cookies and web storage the
+  interaction wrote. Request them only when that state is the question; they
+  are never captured implicitly.
+- `after_each_step` instead of `at_end`: intermediate state between actions in
+  a multi-step scenario.
+- `events` (`console`, `page-errors`, `network`, and so on): how the page
+  reached its result, such as the request a search issued or an error it
+  logged. Select only the event families you need.
+
+Capture states are reported per artifact. An artifact you did not request is
+`not_requested`, which means REA did not look, not that the page had nothing
+to show. A step's `completeness` of `complete` covers only the sections that
+were requested. A URL-only capture can be `complete` and still be unable to
+answer a question about rendered content, so add the relevant artifact and run
+the scenario again rather than inferring from its absence. Capture completeness
+also does not assert that the page's background work has finished.
+
 The browser boundary is part of the contract. Launch mode requires a
 caller-selected executable and always uses a provider-owned temporary profile
 that is closed and deleted during cleanup. Connect mode accepts only an
@@ -0,0 +1,173 @@
+# Firmware analysis
+
+REA integrates **Binwalk 3.1.0** for region inspection and **Unblob 26.6.4** for
+explicit extraction. This first firmware milestone is verified on Linux x64.
+No device, root privilege, mount, emulation or execution of extracted programs
+is needed. Arbitrary firmware bytes do not pass native executable admission;
+select a returned ELF separately for supported Ghidra analysis.
+
+## Caller-supplied tools
+
+Provide existing tools using absolute executable paths, scoped to your shell:
+
+```sh
+export REA_BINWALK_COMMAND=/absolute/path/to/binwalk
+export REA_UNBLOB_COMMAND=/absolute/path/to/unblob
+```
+
+REA does not install these tools, their dependencies or system packages. It
+checks the actual tool version when executing a request. Inspection and
+extraction have independent prerequisites; one does not require the other.
+Both require util-linux `prlimit`, normally `/usr/bin/prlimit`; override its
+absolute path with `REA_FIRMWARE_PRLIMIT_COMMAND` if needed.
+
+Unblob needs the external extractor for the selected format on its inherited
+`PATH`: for example, `debugfs` for ext2/ext3/ext4. Its default Landlock sandbox
+and skip rules stay enabled. Sandbox startup failures remain actionable errors;
+REA does not retry with `--no-sandbox`. Missing extractors reported in a valid
+analysis report retain partial results and dependency names inline.
+
+Upstream sources are preserved unmodified as optional pinned submodules:
+
+```sh
+git submodule update --init third_party/binwalk third_party/unblob
+```
+
+Normal REA builds and npm packages do not include or build these sources or
+engine binaries. See [upstream provenance](../third_party/README.md).
+
+## CLI and MCP
+
+```sh
+rea inspect-firmware-regions /path/to/firmware.bin
+rea extract-firmware /path/to/firmware.bin /path/to/new-output
+rea extract-firmware /path/to/firmware.bin /path/to/selected-output \
+  --offset 64 --length 4096 --max-depth 3
+```
+
+The corresponding MCP tools accept the same intent:
+
+```json
+{
+  "name": "inspect_firmware_regions",
+  "arguments": { "path": "/path/to/firmware.bin" }
+}
+```
+
+```json
+{
+  "name": "extract_firmware",
+  "arguments": {
+    "path": "/path/to/firmware.bin",
+    "output_directory": "/path/to/new-output",
+    "range": { "offset": 64, "length": 4096 },
+    "max_depth": 3
+  }
+}
+```
+
+Both return Evidence with the original path and SHA-256, raw producer reports,
+actual executable path/digest, version and limitations. Binwalk signature UUIDs
+and Unblob blob IDs are producer-local identities; compare content hashes and
+source ranges across runs. A matching version does not attest an installed
+build's source revision, so that field remains unknown.
+
+### Interpret the results
+
+- Region offsets refer to bytes in the original firmware. `reported_size`
+  preserves Binwalk's output; `size_basis=provider_reported_validation_unknown`
+  reflects that Binwalk can replace unknown lengths with the next signature or
+  EOF before serialization. Neither a signature nor its confidence byte proves
+  a valid partition, encryption or runtime behavior.
+- Extraction returns regular file paths, independently verified SHA-256 values,
+  producer hashes when available, chunks, diagnostics and task derivations.
+  Unblob's task report is unordered; REA resolves relationships by paths and
+  blob IDs. Logical references use `$input`, `$output`, or `$output/<relative-path>`
+  so a real file named `$input` stays distinct from the original input.
+  Chunk offsets belong to the task's input file. Only chunks in the
+  selected input have a known `root_file_range`, adjusted by the selected offset.
+- Decompressed children have unknown original byte ranges and runtime addresses.
+  Task lineage does not establish a byte-for-byte mapping through decompression.
+- `partial` marks unknown/encrypted chunks, reported extraction problems,
+  unpublished links/special files or reached depth limits. `complete` means the
+  engine finished its configured extraction without those reported conditions;
+  default skip rules and format coverage still apply. It does not establish
+  complete firmware reconstruction.
+- The destination must be absent, absolute, with an existing parent. Publication
+  uses exclusive, symlink-resistant writes and durable digest readback. Existing
+  destinations are never overwritten. This is not an atomic directory rename:
+  a new tree can be visible while files are written. Failed uncommitted output
+  is rolled back. Symlinks and special files are recorded without publication;
+  empty directories, ownership and executable permission bits are not reproduced.
+
+Select a verified native child for the existing tools:
+
+```json
+{
+  "name": "open_binary",
+  "arguments": {
+    "path": "/path/from/extraction/usr/bin/program",
+    "provider_id": "ghidra"
+  }
+}
+```
+
+Then use `analyze_function`, `inspect_native_api` or the other native primitives.
+Native architecture and executable validation still apply. This milestone does
+not add MIPS/PPC/RISC-V decompilation, raw flash load profiles, bootloader/device
+tree semantics, vulnerability scanning, emulation or hardware runtime capture.
+
+## Resource and lifecycle policy
+
+- Nonempty regular firmware inputs: at most **128 MiB**, copied and hashed into
+  a private workspace before analysis. No in-place source modification.
+- One queued heavy operation per provider instance; Binwalk one thread and
+  Unblob one worker. No automatic parallel extraction engines.
+- **120-second** deadline; inherited **1 GiB per-process address-space** limit,
+  120 CPU seconds and zero core-dump allowance through `prlimit`.
+- JSON reports: at most **8 MiB**; oversized reports fail without a truncated
+  success. Diagnostic output is bounded with exact captured byte counts.
+- Default staging budget: **256 MiB** and **10,000 entries**, configurable using
+  `max_output_bytes` / `max_output_files` (CLI `--max-output-bytes` /
+  `--max-output-files`). Depth defaults to 3, allowed range 1–10.
+
+Staging budgets are polled and rechecked after exit; short-lived overshoot is
+possible. The inherited file-size limit bounds each file, not total storage;
+address-space limits are per process, not an aggregate memory quota. Worker
+count is not CPU affinity for every external extractor. These limits do not
+claim cgroup/container containment. Cancellation cleans the owned process group
+before removing its workspace; uncertain cleanup retains resources and blocks
+further operations in that provider instance.
+
+## Verification
+
+Generate small public, source-derived fixtures into ignored `_reference/`:
+
+```sh
+npm run fixtures:firmware
+npm run verify:firmware
+```
+
+Fixture generation requires existing Python 3 and a host C compiler (`cc`);
+override with `REA_FIRMWARE_PYTHON` / `REA_FIRMWARE_CC`. The independent oracle
+records gzip offset/length and extracted file hashes. Real verification checks
+CLI/MCP, full-file and selected-range extraction, unknown chunks, depth limits,
+content parity and unchanged source bytes. No binary fixture is committed.
+
+Additional lanes are explicit, so the base lane stays small:
+
+```sh
+# Existing mke2fs and debugfs required; put debugfs on the scoped PATH.
+REA_FIRMWARE_VERIFY_EXT4=1 npm run fixtures:firmware
+REA_FIRMWARE_VERIFY_EXT4=1 npm run verify:firmware
+
+# Existing Ghidra 12.1.4 and Java required.
+REA_FIRMWARE_VERIFY_GHIDRA=1 npm run verify:firmware
+```
+
+`REA_FIRMWARE_MKE2FS_COMMAND` selects the optional ext4 fixture producer.
+`REA_FIRMWARE_FIXTURE_ROOT` selects generated data storage.
+`REA_FIRMWARE_TEST_ENTRYPOINT` can select an isolated installed npm package's
+`scripts/rea.mjs` to verify the packaged CLI/MCP workflow. Real coverage here is
+generated gzip/USTAR/ext4 with a Linux x64 ELF child; SquashFS, UBIFS, proprietary
+firmware, other hosts and architectures remain unverified.
@@ -0,0 +1,99 @@
+# Optional NativeAOT metadata recovery
+
+REA integrates [Washi1337/ghidra-nativeaot](https://github.com/Washi1337/ghidra-nativeaot)
+through an optional headless adapter. The original source is an opt-in submodule,
+pinned to `effeb734fc570c32650f88b159608979dc7b423e`; its MIT license and existing
+source notices are retained. No upstream source or algorithms are rewritten.
+
+The initial tested layout is .NET runtime **8.0.22**, NativeAOT RTR **9.1**,
+x86-64 ELF and native Windows PE **targets analyzed on Linux x64**, using
+Ghidra **12.1.4** and JDK **21**. Other layouts/architectures/hosts are unsupported.
+Windows Ghidra P0 has no database mutation authority. A PE/CLI or ReadyToRun
+assembly should use `inspect_managed_artifact`; it is not NativeAOT.
+
+## Build and configure
+
+Bring your own supported Ghidra/JDK installation. This developer build needs
+existing `git`, `javac` and `jar`; it does not invoke Gradle, download toolchains,
+or change host configuration:
+
+```sh
+git submodule update --init third_party/ghidra-nativeaot
+npm run build:ghidra:nativeaot
+export REA_GHIDRA_NATIVEAOT_JAR="$PWD/_reference/nativeaot-integration/extension/rea-ghidra-nativeaot.jar"
+```
+
+The build requires a clean pinned upstream checkout, compiles unchanged upstream
+Java plus the REA facade, uses a fresh classes directory, and writes the JAR and
+build manifest under ignored `_reference/`. `REA_NATIVEAOT_BUILD_ROOT` can select
+another local output directory; `REA_NATIVEAOT_SOURCE` can select an equivalent
+clean pinned source checkout. Neither output nor compiled fixture belongs in Git
+or the npm package. An installed REA accepts an existing explicitly supplied JAR.
+
+REA commits the actual JAR SHA-256 into the analysis profile, copies identical
+bytes into the owned runtime, rechecks the digest before loading, and closes the
+classloader/project on session close. Profiles cannot enable code absent from
+explicit local configuration. JARs execute within Ghidra; supply a build you trust.
+The producer's reported source revision is build metadata, not an attestation of
+arbitrary caller-supplied bytes. The bounded loader accepts regular JARs up to
+8 MiB to limit startup artifact memory; this does not truncate analysis results.
+
+## Use existing tools
+
+Open the executable with provider `ghidra`. `inspect_native_load_image` returns
+optional `observations.metadata_recovery` inline, including the detected header,
+layout, recovery status, type category paths/addresses, diagnostics, annotation
+coverage and derived-memory SHA. The enclosing `unsupported` load-image status
+for PE/ELF concerns independent DOS loader verification; metadata recovery has
+its own status. It is not a failed import.
+
+Pass one returned type path or its typed address to `inspect_native_data_type`.
+Its optional `metadata_recovery` includes related/base type, implemented
+interfaces and virtual slots with targets and known procedure names. Follow
+these with `analyze_function`, string searches and ordinary cross-references.
+For CLI use:
+
+```sh
+rea inspect-native-load-image ./NativeAotFixture --provider ghidra --json
+rea inspect-native-data-type ./NativeAotFixture --type /NativeAOT/MethodTables/Class_ADDRESS_MT --provider ghidra --json
+rea function ./NativeAotFixture 0xADDRESS --provider ghidra --json
+```
+
+No new MCP workflow or approval flag is required. Configuration opts into the
+adapter; without it ordinary Ghidra profiles/results remain unchanged.
+
+## Evidence boundaries
+
+Discovery prefers an imported RTR symbol, otherwise the upstream initialized,
+non-executable-memory signature heuristic. REA rejects ambiguous candidates,
+unknown layout versions, malformed directory rows, unsupported flags and
+unmapped ranges before recovery. It requires the verified dehydrated layout.
+
+The adapter performs rehydration, method-table recovery and frozen-object
+annotation in one ephemeral Program transaction. Fatal failure/cancellation
+rolls it back. Recovery may change analysis-memory bytes, never the original
+executable file. Derived ranges have a digest and **no original file offset**;
+they are not captured runtime state. Candidate/committed instance annotation
+counts distinguish partial frozen-object coverage. Coverage concerns the
+recovered candidate set, not every possible object or every runtime type.
+
+REA preserves pre-recovery calling conventions and uses the loaded compiler
+specification default for newly created methods. The upstream universal
+`__thiscall` assignment is not treated as x64 ABI authority. Parameters and
+method prototypes remain inferences; verify them against instructions/call sites.
+
+Type relationships and System.Object/System.String identification use upstream
+heuristics. Generated names are explicitly marked; original class/member names
+and custom field layouts remain unknown. Pseudocode is recovered native logic,
+not original C# source. Unsupported recovery reports its stage and reason; it
+does not imply that ordinary native disassembly/decompilation is impossible.
+
+## Verification
+
+See [the dedicated lane](testing.md#optional-nativeaot-ghidra-analysis).
+Fixtures are source-built benign .NET programs with inheritance, an interface,
+virtual dispatch, representative arithmetic and frozen strings. Independent
+compiler/linker symbols and raw directory bytes provide the oracle. Stripped
+fixtures exercise heuristic detection. Tests do not execute the resulting
+NativeAOT binaries. Fixture generation and adapter compilation are optional and
+never prerequisites of ordinary native analysis or setup.
@@ -0,0 +1,111 @@
+# IDA Pro provider
+
+REA adapts an existing [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) server into its native analysis tools. Install and configure IDA, Hex-Rays, Python, and upstream MCP using that repository's instructions. REA does not install, upgrade, activate, or license them, and does not bundle another IDA server.
+
+Choose one lifecycle mode in an upstream MCP JSON registration. Set `REA_IDA_MCP_CONFIG` to that file, then select `ida` once through `REA_ANALYSIS_PROVIDER`, the CLI's `--provider ida`, or MCP's `open_binary.provider_id`. No provider startup occurs during discovery.
+
+## Analyze an already-open GUI target
+
+The attached profile supports upstream **1.4.0 legacy tools**, including `get_metadata`, `list_functions`, and `decompile_function`. Copy the upstream registration's `command`, `args`, and optional `env` into a JSON file. An existing `mcpServers` object with an `ida-pro-mcp` entry is also accepted. For example:
+
+```json
+{
+  "command": "python",
+  "args": [
+    "/absolute/path/to/ida_pro_mcp/server.py",
+    "--ida-rpc",
+    "http://127.0.0.1:13337"
+  ]
+}
+```
+
+Use the executable and arguments from your working upstream registration. The legacy GUI's `/mcp` endpoint is its internal RPC endpoint; connect REA through the upstream stdio proxy rather than treating that URL as Streamable HTTP.
+
+```bash
+export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
+export REA_ANALYSIS_PROVIDER=ida
+rea function /absolute/path/to/program main --json
+rea decompile /absolute/path/to/program main --json
+```
+
+Open the **original input binary** in REA, not an `.idb` or `.i64` database. Its SHA-256 must match IDA's recorded input hash. REA checks the attached identity and image base around each analysis request. A mismatch or target switch fails with recovery guidance. The original input must remain readable by REA; WSL can use its mounted alias while the GUI runs on Windows.
+
+REA's close operation releases its MCP connection or proxy. It never saves or closes the existing GUI database. External edits remain visible because results are live and are not replayed from snapshots. These checks do not lock the GUI or prove that the database is unpatched.
+
+## Give REA a target for headless analysis
+
+The headless profile supports upstream's **database supervisor** API: `idb_open`, `idb_list`, `idb_close`, explicit `database` arguments, and modern analysis tools. Legacy 1.4.0 `idalib-mcp`, which accepts one initial filename and serves SSE, does not implement this profile. Follow the [upstream headless instructions](https://github.com/mrexodia/ida-pro-mcp#headless-idalib-session-model) for an installation with the supervisor API.
+
+```json
+{
+  "command": "idalib-mcp",
+  "args": ["--stdio", "--max-workers", "1"],
+  "mode": "headless"
+}
+```
+
+Use an already-installed executable. When required by your existing idalib installation, include `"env": { "IDADIR": "/absolute/path/to/ida" }`. REA neither edits the global activation configuration nor installs dependencies. A configured local Streamable HTTP supervisor can instead use `"url": "http://127.0.0.1:8745/mcp"` and `"mode": "headless"`.
+
+The same CLI commands work in both modes. For a Windows-native REA process:
+
+```powershell
+$env:REA_IDA_MCP_CONFIG = 'D:\analysis\ida-mcp.json'
+$env:REA_ANALYSIS_PROVIDER = 'ida'
+rea function 'D:\samples\program.exe' main --json
+```
+
+Headless REA and the configured supervisor must share the host filesystem and native path syntax. Run REA on Windows when the supervisor runs on Windows. The attached profile can span WSL and a Windows GUI because it binds recorded input hashes instead of asking the GUI to open a WSL path.
+
+REA copies the admitted binary into a private temporary directory, checks its digest, and requests an owned worker with `force_headless`. POSIX workspaces use mode `0700`; Windows uses the matching package's native private-DACL boundary on a local NTFS temporary directory. It injects the returned database ID into analysis requests. It verifies the active owned worker and input path rather than adopting a user database. On close or failed startup, it releases its session with `save: false`, verifies that it is absent from upstream session discovery, and removes its private input and sidecars. An unverified release retains the workspace and reports incomplete cleanup.
+
+One REA session owns one database. Stdio registrations default `IDA_MCP_MAX_WORKERS` to `1`; the explicit upstream `--max-workers 1` also bounds a supervisor. Database size and engine memory depend on the target and upstream; REA does not impose an engine memory limit. The original binary is never executed or overwritten. Optional `workspaceRoot` selects an existing absolute temporary-directory parent on the REA host. Ensure it has space for the input copy and IDA working files.
+
+Headless cleanup uses the upstream database lifecycle. Abruptly terminating REA, its proxy, or the supervisor does not establish worker release. Prefer `close_binary` for MCP sessions; after an interrupted process, inspect upstream session inventory and retained workspace diagnostics before removing working files. This adapter does not claim Windows Job Object containment for the upstream detached workers.
+
+## Connect an agent once
+
+Add the registration path to the **REA** MCP entry's environment, keeping the upstream registration in its separate JSON file:
+
+```json
+{
+  "mcpServers": {
+    "rea": {
+      "command": "npx",
+      "args": ["-y", "rea-agents@<version-with-ida>", "mcp"],
+      "env": {
+        "REA_ANALYSIS_PROVIDER": "ida",
+        "REA_IDA_MCP_CONFIG": "/absolute/path/to/ida-mcp.json"
+      }
+    }
+  }
+}
+```
+
+Use a package version that actually includes this adapter; repository main can be ahead of the npm release. After reconnecting, call:
+
+```json
+{"name":"open_binary","arguments":{"path":"/absolute/path/to/program","provider_id":"ida"}}
+{"name":"analyze_function","arguments":{"procedure":"main"}}
+{"name":"search_strings","arguments":{"pattern":"license"}}
+{"name":"close_binary","arguments":{}}
+```
+
+Opening an MCP target starts its selected provider session; headless opening waits for auto-analysis. Set the agent's MCP request deadline long enough for the target. The registration's optional `timeoutMs` defaults to 300000 for upstream requests. Cancellation drains the current upstream request before cleanup; it does not force-stop GUI analysis. An open request that times out without a completed response retains the private workspace because worker inventory alone cannot prove the request has stopped. `binary_session` reports actual tool availability. Repeated doctor/setup calls are unnecessary when the registration already works.
+
+For guided registration, set `REA_IDA_MCP_CONFIG` before `rea setup --client <client>`. Setup includes that file reference in its reviewed plan and preserves it after approval; it does not copy upstream credentials into the agent configuration. `rea doctor --provider ida --json` validates the registration without starting IDA and explicitly leaves runtime compatibility and target binding for analysis.
+
+## Coverage and evidence
+
+Both profiles support procedure/string inventory and literal or regex search, procedure resolution, pseudocode, assembly, raw function instructions, resolved callees, incoming address references, and a function dossier. Inventories and modern pseudocode/assembly follow upstream pagination. Upstream limits on modern xrefs and callees are retained as explicit truncation limitations. A transport-level truncated preview is rejected rather than reported as complete evidence; the error preserves upstream retrieval guidance.
+
+The legacy profile additionally supports direct callers. Its producer may report call-site or interior addresses; REA resolves the reported function symbol to its canonical entry. The modern profile does not prove direct callers from its code/data xref labels, so that capability is unavailable and the dossier marks it unknown.
+
+Complete body ranges, typed reference edges, CFG, referenced data, source locals, comment kinds, and database revision are unavailable. Empty unsupported dossier facets mean **unknown**, not observed absence. `binary_overview`, whole-symbol inventory, mutation, debugging, arbitrary Python forwarding, and GUI navigation are outside this adapter's coverage. Check session availability before composing a workflow that needs those facets.
+
+`provider.version` identifies the REA adapter; the profile explicitly records `version_scope: "rea-ida-adapter"`. The MCP handshake's `serverInfo` is separate and does not establish IDA or Python distribution versions. Raw observations preserve producer metadata and output. Attached hashes identify the recorded original input; headless identity uses the digest-verified private copy and observed worker input path. Neither proves source-code recovery or an unmodified analysis database.
+
+## Verification
+
+Run `npm run verify:ida -- --target /absolute/path/to/program --procedure main` with a configured upstream server. It exercises production CLI and MCP tools, validates their output contracts and Evidence, checks original-input preservation and session cleanup, and keeps local target data out of its console summary. Supply `--package-root` to verify an extracted or installed package. See [testing](testing.md) for the distinction between adapter tests and real-provider evidence.
+
+The initial real workflows use stdio registrations for the legacy Windows GUI profile and a Windows x64 headless supervisor with IDA 9.3. Streamable HTTP is tested against a loopback MCP fixture with the pinned client SDK; a real IDA HTTP-supervisor workflow remains unverified. Linux/macOS headless engine operation, other IDA releases, architectures, and modern attached GUI tools require their corresponding real workflows before support is claimed.
@@ -61,6 +61,56 @@ curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh |

 Supported options are `--version <semver>`, `--dry-run`, `--no-setup`, `--no-prompt`, and `--verbose`. Neither `--no-prompt` nor a non-interactive shell grants permission to install external dependencies.

+## Released package and main
+
+Repository main documents its current code and generated catalog. `@latest`
+selects the npm release, and persistent MCP registrations are pinned to the
+version that performed setup. Installing newer instructions does not update a
+running server or its registration.
+
+The release checked on **2026-10-06** was **4.0.1** (116 MCP tools). That artifact
+has static JavaScript inspection and full inline Evidence workflows, but does
+not include main's Windows native control bundle, Android/JADX or firmware
+tools, Ghidra function annotation workflow, or retained application-Evidence
+references.
+Main's catalog describes those additions; a source build or a subsequent
+release containing them is required. Package startup alone does not verify a
+provider's real platform workflow.
+
+To check the published version, run `npm view rea-agents dist-tags.latest`.
+Use the connected server's actual tool list and advertised input schemas for
+feature selection. The same package version string in a development checkout
+does not establish that its bytes match the npm tarball. Update a registration
+through a reviewed, scoped setup plan, then restart/reconnect the agent.
+
+## Skill-only installation
+
+```bash
+npx skills add morluto/rea --skill reverse-engineer-anything
+```
+
+This installs agent instructions and bundled references, not REA MCP
+registration or analysis engines. Follow the skill's
+[conditional connection guide](../skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+Working tools can be used immediately. If tools are missing, inspect the current
+client's registration with `doctor --client codex --json` (substitute its client
+ID), then plan repairs with `setup --client codex --dry-run --json`. Show and
+approve the exact changes before applying that scope. An aligned registration
+with tools absent from the active session needs a restart/reconnection;
+`doctor` checks files and prerequisites, not the live agent connection.
+
+Guided setup installs the package's matching skill by default. The skills.sh
+route can select newer repository instructions, so follow actual server schemas
+and the release boundary above. Static JavaScript CLI inspection can proceed
+while MCP is unavailable:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+It returns the complete Evidence record directly and requires no native engine.
+Provider failures in doctor do not prevent unrelated target-free tools.
+
 ## Supported agents

 Setup can configure these clients for REA's local MCP server:
@@ -277,9 +327,18 @@ macOS use a current-user-only local bridge socket and descriptor. The
 experimental Windows transport uses authenticated IPv4 loopback with a
 private native-owned bearer descriptor and Job Object process ownership.

-Operations begin only after default auto-analysis completes. The provider
-startup deadline fails the open rather than exposing partial analysis. One
-session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
+Operations begin only after default auto-analysis completes. `open_binary`
+selects and validates the target/provider binding; it does not wait for Ghidra
+import and auto-analysis. The first Ghidra-backed query starts that work lazily.
+The provider startup deadline is 330,000 ms for import, analysis, bridge, and
+health readiness; a startup failure is returned by the query that triggered it,
+without exposing partial analysis. This deadline is separate from MCP transport
+initialization and the client's deadline for that individual tool call. A client
+can time out earlier even when Ghidra would complete within its startup deadline.
+See [Ghidra first-query deadlines and recovery](mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
+for client options and the close/reopen recovery flow.
+
+One session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
 `REA_ANALYSIS_PROVIDER=ghidra` when both Hopper and Ghidra support the target.
 One persistent decompiler is owned by the Program, and a serial queue keeps
 Ghidra API calls on the owning Program thread without a fixed queue length.
@@ -310,9 +369,12 @@ host-native Ghidra acceptance lane.
 On a controlled Windows x64 runner, use
 `npm run verify:ghidra:windows`. The verifier generates a deterministic native
 PE fixture from source bytes and requires the Windows native authority before
-opening the provider. This lane remains blocked until those controls are
-implemented; its intended checks include operation coverage, digest identity,
-and complete runtime cleanup.
+opening the provider. The controls are implemented on main; see the
+[release boundary](#released-package-and-main). The lane verifies all 25 admitted
+read-only operations, digest identity, and runtime cleanup. The separate
+`verify:ghidra:windows:package` lane checks the packed CLI/MCP boundary with an
+ordinary user. It requires the built Windows native bundle and an existing
+Ghidra/JDK installation; neither is inferred from startup alone.

 ## Diagnose, update, and remove

@@ -337,7 +399,7 @@ For a client that requires manual configuration, use:
  "mcpServers": {
    "rea": {
      "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
    }
  }
 }
@@ -139,9 +139,34 @@ available browser, Electron, or process workflows.

 ## CLI and verification

-All five CLI commands accept inline JSON or a path to a JSON file. Put the full
-Evidence records in the workflow input, as in the corresponding MCP tool; the
-CLI does not resolve Evidence IDs from a separate bundle.
+All five CLI commands accept inline JSON or a path to a JSON file. The CLI
+returns an Evidence record directly. Put the full records in a later CLI input;
+a separate CLI process has no retained MCP connection state.
+
+For a literal string trace, analyze your supplied tree once, then build the
+input from the saved Evidence (replace the target and seed):
+
+```bash
+rea analyze-javascript-application /absolute/path/to/app --json > application-evidence.json
+node --input-type=module -e '
+import { readFileSync, writeFileSync } from "node:fs";
+const application = JSON.parse(readFileSync("application-evidence.json", "utf8"));
+writeFileSync("trace-input.json", JSON.stringify({
+  application, seed: { kind: "string", value: "search-result" }, direction: "both"
+}));'
+rea trace-application-feature ./trace-input.json --json
+```
+
+MCP analysis returns an envelope containing `result`, `evidence_id`, and full
+`evidence`. If the connected server advertises retained references, reuse its
+exact returned ID as `{"kind":"retained-evidence","evidence_id":"RETURNED_ID"}`
+in `application`, or `left`/`right` for comparisons. `RETURNED_ID` is a template,
+not a literal valid ID. Native Evidence arrays still use complete records.
+References are scoped to one connection; `close_binary` clears them. Export a
+bundle before closing and import it on another connection, or supply the full
+inline Evidence there. npm 4.0.1 accepts full inline Evidence only; installing
+newer skill instructions does not change that schema. See
+[MCP Evidence inputs](mcp-contracts.md#retained-application-evidence-inputs).

 For two operator-provided directories or ASARs, run:

@@ -18,6 +18,24 @@ rea observe-javascript-runtime http://127.0.0.1:9229 TARGET_ID \
  --runtime-kind node --json
 ```

+## Start a caller-owned Node target
+
+Run your selected application with Inspector bound to loopback:
+
+```bash
+node --inspect=127.0.0.1:9229 ./app.mjs
+```
+
+Keep it running while listing targets and observing the selected ID. Use a free
+port and the same literal endpoint in both REA calls. Stop the application
+through its normal lifecycle when finished; REA disconnects but does not own or
+terminate it. Node.js must already be installed.
+
+Use `--inspect` for this passive workflow. `--inspect-brk` pauses before the
+application starts, and REA never resumes it or sends
+`Runtime.runIfWaitingForDebugger`. Resume a paused target with a separate
+caller-owned debugger before requesting application runtime observations.
+
 The caller supplies the literal-loopback HTTP endpoint directly. Selecting an endpoint exposes all targets it serves and their local script locations or renderer origins. A target must match the exact requested target ID and expose a same-port WebSocket reported by that endpoint. Targets already marked attached are rejected rather than displacing another debugger. Local paths are canonicalized after symlink resolution.

 `list_javascript_runtime_targets` returns every available target in one inline
@@ -1,4 +1,4 @@
-# Managed-code analysis plan
+# Managed-code analysis and planned extensions

 REA inspects .NET PE/CLI artifacts without loading or executing their code.
 It can identify an assembly, inspect metadata and CIL, compare members across
@@ -27,6 +27,20 @@ This guide describes the implementation and verification of
 [ADR-0003](adr/0003-managed-code-evidence-and-provider-boundary.md). The canonical
 tool inventory is [`product-catalog.json`](product-catalog.json).

+## Shipped scope
+
+The canonical parser admits PE/CLI bytes and their metadata/CIL without loading
+an assembly. It reports observed implementation markers and unavailable facts;
+it does not unpack .NET single-file hosts, decode IL2CPP metadata, or infer a
+NativeAOT identity from an ordinary native PE. Inputs without admitted CLI
+metadata do not become managed assemblies through naming or routing guesses.
+Inspect separately obtained components explicitly and preserve their identities.
+
+The broader deployment classification and native-body mapping below are design
+goals from ADR-0003, not claims that every row has an implemented parser. A
+valid marker can establish a candidate native boundary, not recovered native
+semantics or runtime behavior.
+
 ## Analysis objective

 REA's managed-code track is intended to answer five different questions without
@@ -43,9 +57,9 @@ collapsing them:
 The ordinary workflow ends at question four. Static analysis never loads or
 executes the target.

-## Classification workflow
+## Planned deployment classification

-Classification proceeds from the outermost authenticated bytes inward:
+The intended extended classifier proceeds from outermost authenticated bytes inward:

 ```text
 source path
@@ -58,7 +72,7 @@ source path
  -> managed-only, native-only, composed, degraded, or unsupported route
 ```

-The result is a vector rather than one label. For example, a single-file modern
+The planned result is a vector rather than one label. For example, a single-file modern
 .NET deployment can contain a native host, ordinary CIL assemblies, and
 ReadyToRun components. Each component receives its own digest, classification,
 coverage, and route while retaining the outer bundle commitment.
@@ -257,17 +271,20 @@ or server-side behavior.
 ## Tool and packaging boundary

 The production parser is REA-owned TypeScript and ships with the existing Node
-application. It is verified against the ECMA-335 format and independent pinned
-oracles but has no runtime dependency on them.
+application. Deterministic conformance uses source-owned byte-built PE/CLI
+fixtures and expected semantic facts. An optional real ILSpy lane runs only when
+its executable is explicitly supplied; the default lane does not establish
+independent pinned-oracle parity. Production inspection needs none of those tools.

- `System.Reflection.Metadata` is the primary independent metadata/CIL oracle.
- `ICSharpCode.Decompiler` and `ilspycmd` are reconstruction and differential
-  oracles. An admitted BYO reconstruction operation records its exact version
+- A pinned `System.Reflection.Metadata` differential oracle is planned; it is
+  not part of the current verifier.
+- `ICSharpCode.Decompiler`/`ilspycmd` can supply reconstruction inference.
+  A BYO reconstruction import records the supplied version
  and remains non-canonical. When `REA_ILSPY_CMD_PATH` points to an absolute
  runnable `ilspycmd`, `verify:managed` runs a source-owned real ILSpy oracle
  and imports its C# output as reconstruction inference against exact static
  member Evidence.
- dnlib and Mono.Cecil may increase differential coverage. Their mutation APIs
+- dnlib and Mono.Cecil are potential future differential oracles. Their mutation APIs
  are not exposed or included in the production parsing boundary.
 - The package contains no .NET runtime, SDK, ILSpy installation, proprietary
  assembly, or compiled conformance fixture.
@@ -288,6 +305,11 @@ by the selected Hopper/Ghidra host and format matrix.

 ## Source-built conformance corpus

+The current lane uses source-owned byte-built fixtures and malformed-input
+regressions, with optional operator-supplied applications and ILSpy verification.
+The table below describes the desired expanded corpus; it is not a report that
+all compiler-generated forms have been independently verified.
+
 Fixture sources are intentionally small and behavior-focused. Build outputs
 are generated outside tracked fixture directories and must not remain after
 verification or packaging.
@@ -57,6 +57,74 @@ CLI calls work without a progress token and translate SIGINT into the same
 AbortSignal used by providers. Existing controlled-process cleanup and provider
 shutdown rules still apply; REA never kills a process it cannot prove it owns.

+## Ghidra first-query deadlines and recovery
+
+A successful MCP initialize handshake establishes the REA connection.
+`open_binary` then selects a target and provider binding; it does not establish
+that Ghidra has finished importing the target. The first Ghidra-backed query,
+such as `binary_overview`, starts the engine and waits for import, default
+auto-analysis, bridge connection, and health readiness before returning analysis.
+
+These deadlines have different owners:
+
+| Deadline             | Owner and effect                                                                                                                                                 |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| MCP initialize       | The client bounds transport/REA connection startup, before any target query.                                                                                     |
+| Ghidra startup       | REA allows 330,000 ms for engine readiness from the first provider query; startup failure is reported by that query.                                             |
+| Individual tool call | The client bounds its wait, including cold engine startup. The pinned client SDK 2.3.1 defaults to 60,000 ms and can cancel earlier than REA's startup deadline. |
+
+For an already connected client using the pinned SDK, request options are the
+**second** argument of `callTool`:
+
+```js
+const overview = await client.callTool(
+  { name: "binary_overview", arguments: {} },
+  {
+    timeout: 240000,
+    onprogress: ({ progress, total, message }) => {
+      console.error({ progress, total, message });
+    },
+  },
+);
+```
+
+The SDK's `onprogress` option supplies a progress token and handles matching
+notifications. A raw MCP client can instead send `_meta.progressToken` in the
+request and handle `notifications/progress`. Progress reports do not establish
+engine readiness or a percentage of Ghidra auto-analysis. A longer server
+startup allowance does not extend the client's deadline; progress also does not
+extend it unless the client explicitly implements that policy.
+
+The 240-second setting is a measured example, not a universal timeout: a
+controlled Linux x64/WSL2 fixture took about 64 seconds for its first overview
+with Ghidra 12.1.4 on a mounted NTFS installation, native JDK 21, two CPUs, and a
+512 MiB Java heap. Target size, storage, and analysis work can change that time.
+Configure the deadline in the caller's existing request settings; it is not a
+tool argument, setup grant, or server-side automatic extension. CLI analysis has
+no MCP client request deadline, but keeps the provider startup deadline and
+SIGINT cancellation.
+
+If the client timed out or cancelled during startup, the pending query may have
+been interrupted. Reissuing `open_binary` for the same active target can reuse
+the current client, so it is not a fresh-start recovery. On the same connection:
+
+1. Keep any useful inline Evidence, or export a bundle before closing if retained
+   records are needed. `binary_session` can show the selected binding and its
+   recorded state; target selection alone does not prove engine readiness.
+2. Call `close_binary` and check its result. It drains owned work, closes the
+   provider, and clears retained session records. A `cleanup_incomplete` result
+   must be addressed according to its reported owned resources before retrying.
+3. Call `open_binary` with the same caller-selected path and
+   `provider_id: "ghidra"`, then retry the first query with an appropriate client
+   deadline. The connection and selected provider do not need to change.
+
+This close/reopen flow was exercised on one real Linux stdio connection after a
+controlled startup timeout, followed by a successful overview and function
+analysis. It is not a Windows/macOS coverage claim. REA cleans only resources it
+owns and never switches to another provider automatically. A provider timeout,
+installation failure, or host permission denial needs its own reported recovery;
+increasing a client deadline alone does not fix those failures.
+
 ## Tool results

 Evidence-producing tools return `{ result, evidence_id, evidence }` in both
@@ -68,6 +136,47 @@ directly to `compare_functions`, and `inspect_artifact` Evidence to
 `compare_artifacts`. Use `get_evidence_bundle` when the task needs broader
 retained session history or an explicit bundle for transfer.

+## Retained application Evidence inputs
+
+`trace_application_feature`, `trace_javascript_semantics`,
+`compare_application_versions`, `compare_source_to_bundle`, and
+`compare_javascript_export_shapes` accept complete inline application Evidence
+or an exact reference to a record already retained by the current connection:
+
+```json
+{
+  "name": "trace_application_feature",
+  "arguments": {
+    "application": {
+      "kind": "retained-evidence",
+      "evidence_id": "ev_<64 lowercase hex characters>"
+    },
+    "seed": { "kind": "module", "value": "search.js", "match": "exact" }
+  }
+}
+```
+
+Use the `evidence_id` returned by `analyze_javascript_application` (or another
+compatible application-graph producer). Comparisons accept this form in `left`
+and `right`; each side can independently be inline or retained. Native
+observation arrays continue to take complete inline Evidence. Results and their
+Evidence remain complete inline, and both input forms pass the same semantic,
+identity, authority, and provenance checks without running the producer again.
+
+References belong to the current connection's Evidence ledger. Opening another
+target preserves retained records; `close_binary` clears them, even when no
+binary is active. A fresh connection has its own ledger. A missing reference
+reports its exact ID and `details.reason: "missing"`; the server cannot infer
+whether it was never recorded, cleared, or retained by another connection.
+Supply complete inline Evidence, repeat its producer, or import an exported
+Evidence bundle before referencing that imported record. Export a bundle before
+closing if the investigation needs it later.
+
+CLI application workflows continue to read portable inline Evidence from files
+and run the same analysis workflows; a standalone CLI invocation cannot resolve
+another MCP connection's retained records. No additional lookup call, provider
+selection, or approval step is required for a same-session follow-up.
+
 ## Aggregate native context

 `get_navigation_context` composes the selected document, current address, and
@@ -25,6 +25,13 @@ Tool results include their Evidence inline. Prompts do not require a bundle or
 resource fetch to read a result; an Evidence ID is only a reference when a
 prompt argument or tool explicitly accepts one.

+For a JavaScript/Electron application directory, `investigate_feature` points
+directly to `analyze_javascript_application` with `input_path`; it does not
+require `open_binary`. The CLI equivalent is `rea analyze <directory>`.
+`open_binary` and the doctor target check admit files and macOS app bundles.
+A directory outside that opening route is reported with an available analysis
+action; this does not establish support for every directory format.
+
 For target paths in `compare_application_versions`, the prompt suggests
 opening each target before calling `inspect_artifact`; inspection operates on
 the active target and returns the graph and findings together inline.
@@ -17,9 +17,12 @@ recorded, so its influence may remain unknown.
 Write a JSON scenario and pass its path to the CLI:

 ```sh
-rea capture-process ./scenario.json > capture.json
+rea capture-process ./scenario.json --json > capture.json
 ```

+`--json` is required when saving input for JSON consumers; the default terminal
+format is TOON. The file contains the complete capture Evidence record.
+
 For example:

 ```json
@@ -1,16 +1,16 @@
 {
  "package": {
    "name": "rea-agents",
-    "version": "4.0.1",
+    "version": "4.1.0",
    "sdk": {
      "server": "2.3.1",
      "client": "2.3.1",
      "core": "2.3.1"
    },
-    "skill_version": "24"
+    "skill_version": "26"
  },
  "tools": {
-    "total": 118,
+    "total": 125,
    "families": [
      {
        "id": "direct",
@@ -121,6 +121,24 @@
          "verify_managed_native_boundaries"
        ]
      },
+      {
+        "id": "firmware",
+        "surface": "firmware-provider",
+        "count": 2,
+        "tools": ["extract_firmware", "inspect_firmware_regions"]
+      },
+      {
+        "id": "android",
+        "surface": "android-provider",
+        "count": 5,
+        "tools": [
+          "inspect_android_class",
+          "inspect_android_method",
+          "inspect_android_package",
+          "search_android_classes",
+          "trace_android_references"
+        ]
+      },
      {
        "id": "browser",
        "surface": "browser-provider",
@@ -203,6 +221,12 @@
    ]
  },
  "providers": [
+    {
+      "id": "binwalk",
+      "name": "Binwalk",
+      "version": "3.1.0",
+      "capabilities": ["inspect_firmware_regions"]
+    },
    {
      "id": "ghidra",
      "name": "Ghidra",
@@ -280,6 +304,37 @@
        "xrefs"
      ]
    },
+    {
+      "id": "ida",
+      "name": "IDA Pro MCP adapter",
+      "version": "1",
+      "capabilities": [
+        "analyze_function",
+        "list_procedures",
+        "list_strings",
+        "procedure_address",
+        "procedure_assembly",
+        "procedure_callees",
+        "procedure_callers",
+        "procedure_pseudo_code",
+        "read_function_instructions",
+        "search_procedures",
+        "search_strings",
+        "xrefs"
+      ]
+    },
+    {
+      "id": "jadx",
+      "name": "JADX headless",
+      "version": "0.7.1",
+      "capabilities": [
+        "inspect_android_class",
+        "inspect_android_method",
+        "inspect_android_package",
+        "search_android_classes",
+        "trace_android_references"
+      ]
+    },
    {
      "id": "native-macos",
      "name": "macOS native inspection utilities",
@@ -394,6 +449,12 @@
        "list_javascript_runtime_targets",
        "observe_javascript_runtime"
      ]
+    },
+    {
+      "id": "unblob",
+      "name": "Unblob",
+      "version": "26.6.4",
+      "capabilities": ["extract_firmware"]
    }
  ],
  "setup_clients": [
@@ -471,7 +532,7 @@
    }
  ],
  "cli": {
-    "primary_count": 73,
+    "primary_count": 80,
    "commands": [
      "address-to-file-offset",
      "analyze",
@@ -502,13 +563,18 @@
      "evidence-export",
      "evidence-import",
      "extract-artifact",
+      "extract-firmware",
      "function",
      "import-managed-reconstruction",
      "import-reference-source",
      "inspect",
+      "inspect-android-class",
+      "inspect-android-method",
+      "inspect-android-package",
      "inspect-artifact",
      "inspect-asset-catalog",
      "inspect-electron-page",
+      "inspect-firmware-regions",
      "inspect-keyed-archive",
      "inspect-macho",
      "inspect-managed-artifact",
@@ -536,8 +602,10 @@
      "reconcile-javascript-runtime",
      "resolve-native-call-targets",
      "search",
+      "search-android-classes",
      "setup",
      "trace",
+      "trace-android-references",
      "trace-application-feature",
      "trace-javascript-semantics",
      "trace-native-ui-action",
@@ -556,15 +624,15 @@
  },
  "runtime_catalog": {
    "counts": {
-      "cli_commands": 73,
-      "mcp_tools": 118,
+      "cli_commands": 80,
+      "mcp_tools": 125,
      "mcp_prompts": 6
    },
    "digests": {
-      "tools_sha256": "bbd9aacf7bb0bc54a8f8743491583482e1176252513d99780a309d0fddeb3df0",
-      "prompts_sha256": "4762db348821fec787a5b8c6423f2c48a71f6f0ec2afee97b16ad69030ec504b",
-      "combined_sha256": "b4f7e5860d90b029876b58fe7cd4a8041fef1f2add23440e37e90827d808e503",
-      "providers_sha256": "e094c361b60ec930a6062a1a90ee05536ce411541dba5b51ace7e2da2ba25af0"
+      "tools_sha256": "eec3abb8fa5b25c6e5d6e361b7ebd157e3599f69b68defda85680dbfe061b3d3",
+      "prompts_sha256": "ef2de8814390b340623c32001610aa2709d90bed51537b6e562ab3abf144ab4d",
+      "combined_sha256": "ed9c36900e9223561d38ba30a44921f4ff101d5eca989920f9edc9dc91df470b",
+      "providers_sha256": "044634314b36b966bd918f99f116f4684108556ac1dabc912e76ccd351d97e3e"
    }
  }
 }
@@ -1,5 +1,7 @@
 # Static-analysis provider evaluation

+This guide describes repository main. Check the [released package boundary](installation.md#released-package-and-main) when using npm.
+
 Ghidra read-only analysis is available on Linux x64 and macOS x64/arm64.
 Install Ghidra 12.1.4 and a full 64-bit JDK 21 separately, then configure REA to
 use them. macOS installations need the matching native decompiler.
@@ -55,8 +57,9 @@ follow.
 optional `JAVA_HOME` must identify a 64-bit full JDK 21, otherwise doctor probes
 `java`/`javac` or `java.exe`/`javac.exe` from `PATH`. Supported Linux and macOS
 hosts accept compatible ELF, PE, and Mach-O executable targets. Host admission
-and target compatibility are separate checks. The intended Windows P0 accepts
-only native x86-64 PE applications; it remains blocked before launch.
+and target compatibility are separate checks. Windows x64 P0 admits only native,
+non-managed, non-DLL x86-64 PE applications on fixed local NTFS, with the packaged
+native authority available before launch.

 The launcher creates one ephemeral runtime root with project,
 home/cache/config/data/temp, logs, descriptor, endpoint, target snapshot, and
@@ -67,18 +70,21 @@ On Linux, the mode-0600 descriptor carries the random token without
 exposing it in argv or environment and the Java bridge binds a mode-restricted
 Unix socket. macOS uses the same local transport. The bridge reports actual
 Ghidra/language/compiler/analysis/import-digest metadata and accepts only
-authenticated `ping`, `shutdown`, ten inventory methods, and twelve
-function-analysis methods. Close, cancellation, timeout, malformed protocol,
+authenticated `ping`, `shutdown`, thirteen read-only inventory/load-image methods,
+and twelve function-analysis methods. Linux/macOS also admits atomic function
+annotation changes in the ephemeral database. Close, cancellation, timeout, malformed protocol,
 or process exit stops the owned process resources, closes the socket, and
 removes the runtime root.

 The experimental Windows transport uses authenticated IPv4 loopback with a
-token-free endpoint record, but cannot start while the native authority is
-unavailable. Its `taskkill` cleanup code does not establish Job Object ownership,
-private DACLs, or reparse-safe paths.
+token-free endpoint record. The bundled native authority establishes Job Object
+ownership, protected runtime DACLs, and handle-based path admission before
+launch. If the bundle or an admission constraint is unavailable, the provider
+remains unavailable; a `taskkill` fallback does not establish that authority.

-The provider catalog lists the 25 Ghidra operations. GUI cursor,
-navigation, and mutation operations remain absent; the router therefore
+The provider catalog lists 25 read-only Ghidra operations and the Linux/macOS
+session annotation operation. GUI cursor/navigation and persistent mutations
+remain unavailable; Windows P0 admits no database mutation. The router therefore
 reports them unavailable instead of borrowing Hopper semantics or inferring
 capability from a successful import.

@@ -144,8 +150,8 @@ request cancellation and lifecycle-deadline cleanup, bounded stdout and stderr r
 exact byte counts, process-exit diagnostics, and bounded TERM-to-KILL shutdown.
 Reusable fixtures exercise exit, timeout, cancellation, graceful termination,
 forced termination, double-close, spawn failure, and resource release. Windows
-process-tree termination code exists, but the missing Job Object and private
-runtime controls prevent it from establishing an available Ghidra session.
+Ghidra uses its native Job Object, private runtime, and path-admission boundary;
+generic process-tree termination alone cannot establish provider availability.

 The foundation does not define a bridge schema, socket framing, health payload,
 analysis model, or shutdown acknowledgement. Hopper keeps its authenticated
@@ -47,7 +47,7 @@ The process-global Vitest configuration contract rejects new direct temporary-ro
 creation outside the workspace seam and its narrowly documented boundary/package
 exceptions.

-Real Hopper, Ghidra, browser, package, and managed-code claims belong to their
+Real Hopper, Ghidra, IDA, browser, package, and managed-code claims belong to their
 explicit `npm run verify:*` lanes. The reconstruction-readiness lane also
 checks deterministic rerun, tamper, and stale-input handling; those checks do
 not execute extracted JavaScript modules. When application runtime behavior is
@@ -148,6 +148,84 @@ the CLI and stdio MCP, including special filenames, unresolved discovery
 locations, and independently resolved loaded scripts. Double-quote filenames
 are tested on POSIX only because Windows does not support them.

+## Android APK analysis
+
+`npm run verify:android` requires an existing Java 17+ and an explicit
+`REA_JADX_MCP_JAR` for jadx-headless-mcp 0.7.1. Set `REA_ANDROID_TEST_APK` to the
+fixed public ApiDemos v6.0.18 fixture. Obtain both with the explicit
+`npm run fixtures:android` command; files are SHA-256 verified and
+kept under ignored `_reference/`. No Gradle build, Android SDK, emulator or
+application execution is required. The lane compares real CLI/MCP package,
+class search, class inventory, method decompilation and incoming references.
+See [Android analysis](android-analysis.md) for boundaries and resource budgets.
+
+Synthetic producer regressions run independently:
+
+```sh
+npm run test:focused -- tests/boundary/android/jadxIntegration.test.ts tests/boundary/mcp/androidAnalysisMcp.test.ts
+```
+
+## Optional NativeAOT Ghidra analysis
+
+This lane is separate from the default native lane. `build:fixtures:nativeaot`
+requires an existing .NET SDK 8.0.416, the platform NativeAOT compiler/linker and
+runtime pack 8.0.22. It builds benign sources into ignored `_reference/` and
+records independent symbol/directory/SHA oracles; it never executes the target.
+Linux also builds stripped, ordinary-native and small malformed/ambiguous/layout
+negative inputs. The optional Windows fixture workflow builds a PE on a Windows
+runner; analyzing that PE on Linux does not verify a Windows Ghidra host.
+
+Build the clean pinned upstream adapter with `build:ghidra:nativeaot`, then set
+`REA_GHIDRA_NATIVEAOT_JAR`. Run `verify:ghidra:nativeaot -- symbols`, `-- stripped`,
+`-- ordinary`, `-- unsupported`, `-- malformed`, `-- ambiguous`, and
+`-- loader-failure`, and `-- default-native` separately. The loader-failure mode source-builds
+a deliberately failing JDK 21 initializer and checks the actual loader cause and
+cleanup. The default-native mode verifies ordinary analysis with the optional
+extension disabled.
+The real MCP lane checks source identity, inline format discovery, metadata
+relationships/slots against independent compiler symbols, frozen strings,
+pseudocode and owned cleanup. Set `REA_NATIVEAOT_PROOF_CLI=1` for one equivalent
+CLI type inspection; this costs an additional full import. Select an unpacked
+installed package with `REA_NATIVEAOT_PROOF_PACKAGE_ROOT`, a fixture directory
+with `REA_NATIVEAOT_PROOF_FIXTURE_ROOT`, and optional evidence capture directory
+with `REA_NATIVEAOT_PROOF_CAPTURE_DIR` (absolute paths).
+
+Keep builds/imports sequential on small hosts; scope `GHIDRA_HEADLESS_MAXMEM`
+(e.g. `768M`) to this command and use CPU affinity if needed. REA does not install
+or upgrade Java, Ghidra, .NET or native toolchains. See
+[the supported layout and provenance](ghidra-nativeaot.md).
+
+## IDA MCP adapter
+
+`npm run verify:ida -- --target /absolute/path/to/program --procedure main`
+uses the existing `REA_IDA_MCP_CONFIG` registration. It installs no engine,
+Python package, or compiler. The target must already be open in the GUI for
+the legacy attached profile; the database-supervisor headless profile opens
+a digest-verified private copy. A caller-supplied fixture keeps prerequisites
+limited to the selected engine and host. `tests/conformance/ida/inventory.c`
+provides an optional small native fixture source with an exported
+`rea_fixture_add` function.
+
+The lane invokes the production CLI dispatcher and connects the pinned MCP
+client SDK to the production REA server. It verifies function Evidence and
+CLI/MCP parity, inventory/search, pseudocode, instructions, xrefs, malformed
+input, original-input preservation, and lifecycle cleanup. For headless
+analysis it confirms that the owned database IDs disappear from upstream
+discovery and private workspaces are removed. For attached analysis it confirms
+the existing GUI target remains reachable with the same input identity.
+`--package-root` selects an installed/extracted REA artifact. `--report` writes
+private local observations with mode `0600`; the console summary contains no
+target paths or upstream output.
+
+Adapter and composition tests cover producer parsing, pagination, canonical
+entries, external callees, target switches, cancellation draining, snapshot
+replay exclusion, ownership failures, and incomplete cleanup. They do not
+establish real IDA operation. The initial real workflows cover legacy upstream
+1.4.0 on a Windows GUI and the modern supervisor at upstream commit
+`c133c3853faa111a9b00ee615c013b720d0c4acd` with Windows x64 IDA 9.3.
+Linux/macOS headless, modern attached GUI tools, other engine versions and
+architectures remain unverified; see the [provider guide](ida-provider.md).
+
 ## DOS Ghidra analysis

 `npm run verify:ghidra:dos` requires the supported Ghidra and JDK installation
@@ -294,3 +372,15 @@ allows a host-permission-boundary-only result and explicitly reports
 Both commands reject a changed executable digest and clean up the fixture
 process and helper. These lanes require an interactive macOS desktop. See [native investigation](native-investigation.md)
 for the exact ABI, authority, graph and observation boundaries.
+
+### Firmware adapters
+
+`npm run fixtures:firmware` uses existing Python 3 and a host C compiler to make
+an ignored gzip/USTAR firmware fixture and independent offset/hash oracle.
+`npm run verify:firmware` requires caller-supplied Binwalk 3.1.0, Unblob 26.6.4
+and util-linux prlimit on Linux. It verifies CLI/MCP parity, selected ranges,
+unknown chunks, depth limits and extracted child digests. The optional
+`REA_FIRMWARE_VERIFY_EXT4=1` lane requires existing mke2fs/debugfs; the separate
+`REA_FIRMWARE_VERIFY_GHIDRA=1` lane checks a selected host ELF through real Ghidra.
+Neither optional toolchain is a base-lane prerequisite. See
+[firmware analysis](firmware-analysis.md) for limits and unverified formats.
@@ -7,7 +7,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 6,src/domain/errors.ts:AnalysisProtocolError,Application protocol fails,Raw constructor message,Can expose protocol internals,"Analysis returned an unreadable result. Retry once; if it continues, run `rea doctor`.",implemented,focused assertions passed; full `npm run check` passed
 7,src/domain/errors.ts:HopperProcessError,Analysis subprocess stops,"Hopper bridge stopped unexpectedly with code {exitCode}",Exposes provider bridge and process code,"Analysis could not start or stopped unexpectedly. Run `rea doctor`, then try again.",implemented,focused assertions passed; full `npm run check` passed
 8,src/domain/errors.ts:HopperStartError,Analysis subprocess cannot start,Hopper application bridge could not be started,Exposes provider and bridge implementation,"Analysis could not start or stopped unexpectedly. Run `rea doctor`, then try again.",implemented,focused assertions passed; full `npm run check` passed
-9,src/domain/errors.ts:BinaryTargetError,Target cannot open,"Cannot open artifact: {reason}",May expose raw reason and lacks checks,"REA could not open that app or binary. Check that the path exists, is readable, and points to a supported file.",implemented,focused assertions passed; full `npm run check` passed
+9,src/domain/errors.ts:BinaryTargetError,Target cannot open,"Cannot open artifact: {reason}",May expose raw reason and lacks checks,"Preserve the target admission reason; directories name analyze_javascript_application and rea analyze as available alternatives.",implemented,focused assertions passed; full `npm run check` passed
 10,src/domain/errors.ts:ConfigurationError,Environment configuration invalid,Raw constructor message,May expose provider-specific variables and lacks recovery,"REA configuration is invalid. Run `rea doctor` and fix the reported setting.",implemented,focused assertions passed; full `npm run check` passed
 11,src/domain/errors.ts:ArtifactOperationError,Artifact inventory or extraction fails,"Artifact {operation} failed: {reason} at {logicalPath} (declared_sha256=...)",Exposes paths hashes and internal reason,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed
 12,src/domain/errors.ts:EvidenceFileError,Evidence file operation fails,"Evidence bundle {operation} failed: {reason}",Internal reason token gives weak recovery,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed
@@ -1,5 +1,5 @@
 {
-  "manifest_id": "ecm_125743de92b0cbb08a3cb11ee0d9305f60e5c4fb81152b8b748d348f91f99ee8",
+  "manifest_id": "ecm_fbd47cbd3815d7e252ebcb60c4d086dcc1fc6b63f020e83513e28bf4d94c732c",
  "verifier": {
    "id": "rea-managed-conformance",
    "version": "1"
@@ -13,7 +13,7 @@
  "skill_digests": [
    {
      "skill_id": "reverse-engineer-anything",
-      "sha256": "26338313efd5c941e1f3e1f1d35e2605d47749f674c359458e76d5a470b0cbb1"
+      "sha256": "b317babebb82157b46b4dff698a170045490bcb21aaf9af582e20908ba2bb998"
    }
  ],
  "claims": [
@@ -1,7 +1,11 @@
 # Windows Ghidra P0

-Status: experimental Windows x64 support for the read-only P0 boundary. The
-published package bundles native process, filesystem, and DACL controls. REA
+This guide describes repository main. npm 4.0.1 does not include the Windows
+native bundle; check the [release boundary](installation.md#released-package-and-main)
+before applying these instructions to a published package.
+
+Status: experimental Windows x64 support for the read-only P0 boundary. Windows
+package builds bundle native process, filesystem, and DACL controls. REA
 uses them automatically when the analyst selects a Ghidra operation; no
 additional permission flag or degraded mode is required.

@@ -1,12 +1,12 @@
 {
  "name": "rea-agents",
-  "version": "4.0.1",
+  "version": "4.1.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "rea-agents",
-      "version": "4.0.1",
+      "version": "4.1.0",
      "license": "MIT",
      "dependencies": {
        "@babel/parser": "8.0.4",
@@ -1,7 +1,7 @@
 {
  "name": "rea-agents",
  "mcpName": "io.github.morluto/rea",
-  "version": "4.0.1",
+  "version": "4.1.0",
  "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
  "license": "MIT",
  "repository": {
@@ -44,6 +44,7 @@
    "bridge/hopper_bridge.py",
    "bridge/native/ReaNativeUI.swift",
    "bridge/ghidra/ReaGhidraBridge.java",
+    "bridge/ghidra/ReaGhidraExtensions.java",
    "bridge/ghidra/ReaGhidraPrepareCom.java",
    "scripts/rea.mjs",
    "scripts/electron-active-hook.cjs",
@@ -122,6 +123,7 @@
    "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
    "verify:keyed-archive": "npm run build:cached && node scripts/verify-keyed-archive.mjs",
    "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
+    "verify:ida": "npm run build:cached && node scripts/verify-real-ida.mjs",
    "verify:ghidra:switch": "npm run build:cached && node scripts/verify-real-ghidra-switch.mjs",
    "verify:ghidra:dos": "npm run build:cached && node scripts/verify-real-ghidra-dos.mjs",
    "verify:ghidra:com": "npm run build:cached && node scripts/verify-real-ghidra-com.mjs",
@@ -136,6 +138,10 @@
    "verify:javascript:digests": "npm run build:cached && node scripts/verify-large-javascript-digests.mjs",
    "verify:application-workflows": "npm run build:cached && node scripts/verify-local-application-workflows.mjs",
    "verify:managed": "npm run build:cached && node scripts/verify-managed-conformance.mjs",
+    "verify:firmware": "npm run build:cached && node scripts/verify-real-firmware.mjs",
+    "fixtures:firmware": "node scripts/generate-firmware-fixtures.mjs",
+    "verify:android": "npm run build:cached && node scripts/verify-real-android.mjs",
+    "fixtures:android": "node scripts/fetch-android-fixtures.mjs",
    "verify:agent": "npm run build:cached && node scripts/verify-agent-experience.mjs",
    "verify:hopper:linux": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper-linux.mjs",
    "verify:setup:linux": "npm run build:cached && node scripts/verify-linux-setup-e2e.mjs",
@@ -164,7 +170,10 @@
    "verify:windows-native:artifact": "node scripts/verify-windows-native-artifact.mjs",
    "prepublishOnly": "npm run verify:windows-native:artifact",
    "verify:windows-native": "node scripts/verify-windows-native.mjs",
-    "verify:ghidra:windows:package": "node scripts/verify-packaged-ghidra-windows.mjs"
+    "verify:ghidra:windows:package": "node scripts/verify-packaged-ghidra-windows.mjs",
+    "build:ghidra:nativeaot": "node scripts/build-ghidra-nativeaot.mjs",
+    "build:fixtures:nativeaot": "node scripts/generate-nativeaot-fixtures.mjs",
+    "verify:ghidra:nativeaot": "npm run build:cached && node scripts/verify-real-ghidra-nativeaot.mjs"
  },
  "lint-staged": {
    "*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}": [
@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const source = resolve(
+  process.env.REA_NATIVEAOT_SOURCE ??
+    join(root, "third_party/ghidra-nativeaot"),
+);
+const install = process.env.GHIDRA_INSTALL_DIR;
+if (!install)
+  throw new Error(
+    "NativeAOT build lane requires existing GHIDRA_INSTALL_DIR (Ghidra 12.1.4).",
+  );
+const properties = await readFile(
+  join(install, "Ghidra/application.properties"),
+  "utf8",
+);
+if (!/^application.version=12\.1\.4\s*$/m.test(properties))
+  throw new Error("NativeAOT build lane requires Ghidra 12.1.4.");
+const output = resolve(
+  process.env.REA_NATIVEAOT_BUILD_ROOT ??
+    join(root, "_reference/nativeaot-integration/extension"),
+);
+const java = process.env.JAVA_HOME ? join(process.env.JAVA_HOME, "bin") : null;
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    encoding: "utf8",
+    timeout: 120_000,
+    maxBuffer: 4 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `NativeAOT build prerequisite/action ${command} failed: ${result.error?.message ?? ""}\n${result.stdout ?? ""}${result.stderr ?? ""}`,
+    );
+  return result.stdout.trim();
+};
+const javac = java ? join(java, "javac") : "javac";
+if (!/^javac 21(?:\.|$)/u.test(run(javac, ["-version"])))
+  throw new Error(
+    "NativeAOT build lane requires an existing JDK 21 javac; REA does not install or upgrade Java.",
+  );
+const revision = run("git", ["-C", source, "rev-parse", "HEAD"]);
+if (
+  revision !== "effeb734fc570c32650f88b159608979dc7b423e" ||
+  run("git", ["-C", source, "status", "--porcelain"])
+)
+  throw new Error(
+    "NativeAOT build requires the clean pinned upstream source; initialize third_party/ghidra-nativeaot.",
+  );
+const files = async (path, extension) => {
+  const result = [];
+  for (const entry of await readdir(path, { withFileTypes: true })) {
+    const child = join(path, entry.name);
+    if (entry.isDirectory()) result.push(...(await files(child, extension)));
+    else if (entry.isFile() && child.endsWith(extension)) result.push(child);
+  }
+  return result.sort();
+};
+await mkdir(output, { recursive: true });
+const classes = await mkdtemp(join(output, "classes-"));
+try {
+  const sources = [
+    ...(await files(join(source, "src/main/java"), ".java")),
+    ...(await files(join(root, "bridge/ghidra/extensions/nativeaot"), ".java")),
+  ];
+  const jars = await files(join(install, "Ghidra"), ".jar");
+  const args = [
+    "-proc:none",
+    "-cp",
+    jars.join(process.platform === "win32" ? ";" : ":"),
+    "-d",
+    classes,
+    ...sources,
+  ];
+  await writeFile(
+    join(output, "javac.args"),
+    args
+      .map((s) => `"${s.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`)
+      .join("\n"),
+  );
+  run(javac, [
+    "-J-Xmx512m",
+    "-J-XX:ActiveProcessorCount=1",
+    `@${join(output, "javac.args")}`,
+  ]);
+  await writeFile(
+    join(classes, "LICENSE-ghidra-nativeaot.md"),
+    await readFile(join(source, "LICENSE.md")),
+  );
+  const jar = join(output, "rea-ghidra-nativeaot.jar");
+  run(java ? join(java, "jar") : "jar", [
+    "--create",
+    "--file",
+    jar,
+    "--date=2025-01-01T00:00:00Z",
+    "-C",
+    classes,
+    ".",
+  ]);
+  const sha256 = createHash("sha256")
+    .update(await readFile(jar))
+    .digest("hex");
+  await writeFile(
+    join(output, "build.json"),
+    JSON.stringify(
+      {
+        jar,
+        sha256,
+        upstream_revision: revision,
+        ghidra_version: "12.1.4",
+        integration_api: 1,
+      },
+      null,
+      2,
+    ) + "\n",
+  );
+  console.log(
+    JSON.stringify({
+      jar,
+      sha256,
+      upstream_revision: revision,
+      ghidra_version: "12.1.4",
+      integration_api: 1,
+    }),
+  );
+} finally {
+  await rm(classes, { recursive: true, force: true });
+}
@@ -0,0 +1,70 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { link, mkdir, open, rm } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { JADX_RELEASE } from "../src/android/JadxRelease.ts";
+import fixture from "./fixtures/android-apidemos.json" with { type: "json" };
+
+const args = process.argv.slice(2);
+if (args.length > 1)
+  throw new Error("Usage: node scripts/fetch-android-fixtures.mjs [DIRECTORY]");
+const directory = resolve(
+  args[0] ??
+    fileURLToPath(new URL("../_reference/apk-integration/", import.meta.url)),
+);
+await mkdir(directory, { recursive: true });
+const hashFile = async (path) => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+};
+for (const item of [
+  {
+    url: JADX_RELEASE.url,
+    sha256: JADX_RELEASE.sha256,
+    filename: "jadx-headless-mcp-0.7.1-all.jar",
+  },
+  fixture,
+]) {
+  const path = join(directory, item.filename);
+  try {
+    const digest = await hashFile(path);
+    if (digest !== item.sha256)
+      throw new Error(
+        `Existing ${path} has a different SHA-256; it was not overwritten`,
+      );
+    console.log(`Verified existing ${path}: ${digest}`);
+    continue;
+  } catch (cause) {
+    if (!(cause instanceof Error && "code" in cause && cause.code === "ENOENT"))
+      throw cause;
+  }
+  const temporary = `${path}.${randomUUID()}.partial`;
+  try {
+    const response = await fetch(item.url, {
+      signal: AbortSignal.timeout(120_000),
+    });
+    if (!response.ok || response.body === null)
+      throw new Error(`Download failed: ${item.url}: HTTP ${response.status}`);
+    const handle = await open(temporary, "wx", 0o600);
+    const hash = createHash("sha256");
+    try {
+      for await (const chunk of response.body) {
+        hash.update(chunk);
+        await handle.writeFile(chunk);
+      }
+    } finally {
+      await handle.close();
+    }
+    const digest = hash.digest("hex");
+    if (digest !== item.sha256)
+      throw new Error(
+        `SHA-256 mismatch for ${item.filename}: expected ${item.sha256}, received ${digest}`,
+      );
+    await link(temporary, path);
+    console.log(`Downloaded and verified ${path}: ${digest}`);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
@@ -0,0 +1,14 @@
+{
+  "name": "Appium ApiDemos",
+  "version": "6.0.18",
+  "source": "https://github.com/appium/android-apidemos",
+  "source_revision": "3e716ee04ef3390284bfab761e28da8c15c08143",
+  "license": "Apache-2.0",
+  "license_url": "https://github.com/appium/android-apidemos/blob/3e716ee04ef3390284bfab761e28da8c15c08143/LICENSE",
+  "url": "https://github.com/appium/android-apidemos/releases/download/v6.0.18/ApiDemos-debug.apk",
+  "filename": "ApiDemos-debug.apk",
+  "sha256": "a9eecf37b26cd084855c530db81c2bb1b91f4c1b095a04f47aa7c20e2791f686",
+  "package": "io.appium.android.apis",
+  "class_name": "io.appium.android.apis.ApiDemos",
+  "method_name": "onCreate"
+}
@@ -0,0 +1,42 @@
+import { execFile } from "node:child_process";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+const exec = promisify(execFile);
+const root = resolve(
+  process.env.REA_FIRMWARE_FIXTURE_ROOT ??
+    "_reference/firmware-integration/generated",
+);
+for (const [command, args, purpose] of [
+  [
+    process.env.REA_FIRMWARE_PYTHON ?? "python3",
+    ["--version"],
+    "Python 3 standard-library fixture generator",
+  ],
+  [
+    process.env.REA_FIRMWARE_CC ?? "cc",
+    ["--version"],
+    "host ELF fixture compiler",
+  ],
+]) {
+  try {
+    await exec(command, args);
+  } catch (cause) {
+    throw new Error(`fixtures:firmware requires ${purpose}: ${command}`, {
+      cause,
+    });
+  }
+}
+const ext4 =
+  process.env.REA_FIRMWARE_VERIFY_EXT4 === "1"
+    ? [process.env.REA_FIRMWARE_MKE2FS_COMMAND ?? "mke2fs"]
+    : [];
+for (const command of ext4) await exec(command, ["-V"]);
+const generated = await exec(process.env.REA_FIRMWARE_PYTHON ?? "python3", [
+  fileURLToPath(new URL("./lib/generate-firmware-fixture.py", import.meta.url)),
+  root,
+  process.env.REA_FIRMWARE_CC ?? "cc",
+  ...ext4,
+]);
+console.log(generated.stdout.trim());
@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+if (process.arch !== "x64" || !["linux", "win32"].includes(process.platform))
+  throw new Error(
+    "NativeAOT fixture lane requires Linux or Windows x64; it does not cross-compile NativeAOT.",
+  );
+const runtime = process.platform === "win32" ? "win-x64" : "linux-x64";
+const directory = resolve(
+  process.env.REA_NATIVEAOT_FIXTURE_ROOT ??
+    join(root, "_reference/nativeaot-integration/generated"),
+);
+const output = join(directory, runtime);
+await mkdir(output, { recursive: true });
+const env = {
+  ...process.env,
+  DOTNET_CLI_HOME: join(output, "cli-home"),
+  DOTNET_CLI_TELEMETRY_OPTOUT: "1",
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1",
+  DOTNET_PROCESSOR_COUNT: "1",
+  COMPlus_GCHeapHardLimit: "30000000",
+  NUGET_PACKAGES: process.env.NUGET_PACKAGES ?? join(directory, "nuget"),
+};
+await writeFile(
+  join(output, "global.json"),
+  JSON.stringify({ sdk: { version: "8.0.416", rollForward: "disable" } }) +
+    "\n",
+);
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: output,
+    env,
+    encoding: "utf8",
+    timeout: 300_000,
+    maxBuffer: 8 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `NativeAOT fixture lane requires/action failed ${command}: ${result.error?.message ?? ""}\n${result.stdout ?? ""}${result.stderr ?? ""}`,
+    );
+  return result.stdout;
+};
+const dotnet = process.env.REA_NATIVEAOT_DOTNET ?? "dotnet";
+if (run(dotnet, ["--version"]).trim() !== "8.0.416")
+  throw new Error(
+    "NativeAOT fixtures require existing .NET SDK 8.0.416; REA does not install SDKs.",
+  );
+if (process.platform === "linux") {
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--version"]);
+  run(process.env.REA_NATIVEAOT_NM ?? "nm", ["--version"]);
+  run(process.env.REA_NATIVEAOT_CC ?? "cc", ["--version"]);
+  run("clang", ["--version"]);
+}
+const map = join(output, "NativeAotFixture.map");
+run(dotnet, [
+  "publish",
+  join(root, "tests/fixtures/nativeaot/NativeAotFixture.csproj"),
+  "-r",
+  runtime,
+  "-c",
+  "Release",
+  "-o",
+  join(output, "symbols"),
+  "--maxcpucount:1",
+  `-p:BaseIntermediateOutputPath=${join(output, "obj")}/`,
+  `-p:BaseOutputPath=${join(output, "bin")}/`,
+  `-p:NativeAotMapPath=${map}`,
+]);
+const name =
+  process.platform === "win32" ? "NativeAotFixture.exe" : "NativeAotFixture";
+const binary = join(output, "symbols", name);
+let symbols = "";
+if (process.platform === "linux") {
+  // Preserve the symbol table as an independent oracle while avoiding a full
+  // runtime DWARF import in this metadata-specific lane.
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--strip-debug", binary]);
+  symbols = run(process.env.REA_NATIVEAOT_NM ?? "nm", ["-n", binary]);
+  await mkdir(join(output, "stripped"), { recursive: true });
+  const stripped = join(output, "stripped", name);
+  await copyFile(binary, stripped);
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--strip-all", stripped]);
+} else {
+  symbols = await readFile(map, "utf8");
+}
+const bytes = await readFile(binary);
+const candidates = [];
+for (let offset = 0; offset <= bytes.length - 16; offset++) {
+  if (
+    bytes.readUInt32LE(offset) !== 0x00525452 ||
+    bytes[offset + 14] !== 24 ||
+    bytes[offset + 15] !== 1
+  )
+    continue;
+  const count = bytes.readUInt16LE(offset + 12);
+  if (count === 0 || count > 80 || offset + 16 + count * 24 > bytes.length)
+    continue;
+  candidates.push({
+    offset,
+    major: bytes.readUInt16LE(offset + 4),
+    minor: bytes.readUInt16LE(offset + 6),
+    sections: Array.from({ length: count }, (_, index) => {
+      const row = offset + 16 + index * 24;
+      return {
+        type: bytes.readUInt32LE(row),
+        flags: bytes.readUInt32LE(row + 4),
+        start: `0x${bytes.readBigUInt64LE(row + 8).toString(16)}`,
+        end: `0x${bytes.readBigUInt64LE(row + 16).toString(16)}`,
+      };
+    }),
+  });
+}
+if (
+  candidates.length !== 1 ||
+  candidates[0].major !== 9 ||
+  candidates[0].minor !== 1
+)
+  throw new Error(
+    "NativeAOT fixture did not produce exactly one independent RTR 9.1 directory.",
+  );
+const sha256 = createHash("sha256").update(bytes).digest("hex");
+await writeFile(join(output, "symbols.txt"), symbols);
+await writeFile(
+  join(output, "oracle.json"),
+  JSON.stringify(
+    {
+      sdk: "8.0.416",
+      runtime_version: "8.0.22",
+      runtime,
+      binary,
+      sha256,
+      headers: candidates,
+      expected_strings: [
+        "REA_NATIVEAOT_FROZEN",
+        "REA_NATIVEAOT_BASE",
+        "REA_NATIVEAOT_DERIVED",
+      ],
+    },
+    null,
+    2,
+  ) + "\n",
+);
+// A source-built negative input, not a downloaded third-party target.
+if (process.platform === "linux") {
+  const source = join(output, "ordinary.c");
+  await writeFile(
+    source,
+    "int ordinary_probe(int x) { return x * 3 + 1; }\nint main(void) { return ordinary_probe(1); }\n",
+  );
+  run(process.env.REA_NATIVEAOT_CC ?? "cc", [
+    "-g",
+    "-O0",
+    source,
+    "-o",
+    join(output, "ordinary"),
+  ]);
+  // Small source-built producer regressions run in seconds: no executable
+  // patching, large runtime import, or downloaded opaque negative inputs.
+  const row = "struct Row { unsigned type, flags; const char *start, *end; };";
+  const header =
+    "struct Header { unsigned signature; unsigned short major, minor; unsigned flags; unsigned short count; unsigned char size, type; struct Row row; };";
+  for (const kind of ["unsupported", "malformed", "ambiguous"]) {
+    const major = kind === "unsupported" ? 99 : 9;
+    const declaration = `const struct Header __attribute__((aligned(8))) probe = {0x00525452, ${major}, 1, 0, 1, 24, 1, {207, 1, data + 8, data}};`;
+    const extra =
+      kind === "ambiguous" ? declaration.replace("probe", "second_probe") : "";
+    const negative = join(output, `${kind}.c`);
+    await writeFile(
+      negative,
+      `${row}\n${header}\nconst char data[16] = {0};\n${declaration}\n${extra}\nint main(void) { return 0; }\n`,
+    );
+    run(process.env.REA_NATIVEAOT_CC ?? "cc", [
+      "-O0",
+      "-fno-pie",
+      "-no-pie",
+      negative,
+      "-o",
+      join(output, kind),
+    ]);
+  }
+}
+console.log(
+  `PASS source-built ${runtime} NativeAOT fixture, independent RTR 9.1 oracle and SHA-256 ${sha256}; no target execution`,
+);
@@ -0,0 +1,120 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import {
+  cleanupOwnedProcessGroup,
+  readProcessRunId,
+} from "../../dist/process/ProcessOwnership.js";
+
+/** Exercise a real CLI signal while the owned Java engine is still running. */
+export const verifyAndroidCliCancellation = async ({
+  entrypoint,
+  environment,
+  path,
+  repository,
+  execute,
+}) => {
+  const child = spawn(
+    process.execPath,
+    [entrypoint, "inspect-android-package", path, "--format", "json"],
+    { cwd: repository, env: environment, stdio: ["ignore", "pipe", "pipe"] },
+  );
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk.toString();
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  const exited = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve({ code, signal }));
+  });
+  let group;
+  let ownership;
+  try {
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+      const table = (
+        await execute("ps", ["-eo", "pid=,ppid=,pgid=,args="], {
+          timeout: 5_000,
+          maxBuffer: 2 * 1024 * 1024,
+        })
+      ).stdout;
+      for (const row of table.split("\n")) {
+        const entry = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/u.exec(row);
+        if (
+          entry !== null &&
+          Number(entry[2]) === child.pid &&
+          entry[4].includes("engine.jar") &&
+          entry[4].includes("-Xmx512m")
+        ) {
+          group = Number(entry[3]);
+          const runId = await readProcessRunId(Number(entry[1]));
+          assert.ok(
+            runId !== undefined,
+            "Owned Java process did not carry an identity token",
+          );
+          ownership = {
+            runId,
+            leaderPid: Number(entry[1]),
+            processGroupId: group,
+          };
+        }
+      }
+      if (group !== undefined) break;
+      if (child.exitCode !== null || child.signalCode !== null)
+        throw new Error(
+          `CLI exited before acquiring JADX: ${stdout}\n${stderr}`,
+        );
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    assert.ok(
+      group !== undefined,
+      "CLI did not acquire the expected owned Java group",
+    );
+    child.kill("SIGTERM");
+    let timer;
+    const result = await Promise.race([
+      exited,
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("CLI cancellation did not finish cleanup")),
+          10_000,
+        );
+      }),
+    ]).finally(() => clearTimeout(timer));
+    assert.equal(result.code, 143, `${stdout}\n${stderr}`);
+    assert.equal(result.signal, null);
+    assert.equal(JSON.parse(stdout).code, "cancelled");
+    assert.throws(() => process.kill(-group, 0), { code: "ESRCH" });
+    console.log(
+      "PASS real CLI SIGTERM cancellation and owned Java group cleanup",
+    );
+  } finally {
+    await cleanupCancellation(child, exited, ownership);
+  }
+};
+
+const cleanupCancellation = async (child, exited, ownership) => {
+  if (child.exitCode === null && child.signalCode === null) {
+    child.kill("SIGTERM");
+    let timer;
+    await Promise.race([
+      exited,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, 2_000);
+      }),
+    ]).finally(() => clearTimeout(timer));
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill("SIGKILL");
+      await exited;
+    }
+  }
+  if (ownership !== undefined)
+    assert.equal(
+      (await cleanupOwnedProcessGroup(ownership)).cleaned,
+      true,
+      "Verifier could not confirm its owned Java group cleanup",
+    );
+};
@@ -31,6 +31,16 @@ export const toolFamilyCatalog = (sources) => {
        ...sources.managedWorkflowContracts.MANAGED_WORKFLOW_TOOL_CONTRACTS,
      ],
    },
+    {
+      id: "firmware",
+      surface: "firmware-provider",
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS,
+    },
+    {
+      id: "android",
+      surface: "android-provider",
+      contracts: sources.androidContracts.ANDROID_TOOL_CONTRACTS,
+    },
    {
      id: "browser",
      surface: "browser-provider",
@@ -96,6 +106,10 @@ export const providerCatalog = (sources) => {
      identity: sources.ghidraProvider.GHIDRA_PROVIDER_IDENTITY,
      contracts: sources.ghidraProvider.GHIDRA_PROVIDER_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.idaProvider.IDA_PROVIDER_IDENTITY,
+      contracts: sources.idaProvider.IDA_PROVIDER_TOOL_CONTRACTS,
+    },
    {
      identity: sources.nativeProvider.NATIVE_MACOS_PROVIDER_IDENTITY,
      contracts: sources.nativeContracts.NATIVE_TOOL_CONTRACTS,
@@ -113,6 +127,22 @@ export const providerCatalog = (sources) => {
      contracts:
        sources.managedWorkflowContracts.MANAGED_WORKFLOW_TOOL_CONTRACTS,
    },
+    {
+      identity: sources.firmwareProvider.BINWALK_PROVIDER_IDENTITY,
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS.filter(
+        ({ name }) => name === "inspect_firmware_regions",
+      ),
+    },
+    {
+      identity: sources.firmwareProvider.UNBLOB_PROVIDER_IDENTITY,
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS.filter(
+        ({ name }) => name === "extract_firmware",
+      ),
+    },
+    {
+      identity: sources.androidProvider.JADX_PROVIDER_IDENTITY,
+      contracts: sources.androidContracts.ANDROID_TOOL_CONTRACTS,
+    },
    {
      identity: sources.browserProvider.CDP_BROWSER_PROVIDER_IDENTITY,
      contracts: sources.browserContracts.BROWSER_TOOL_CONTRACTS,
@@ -43,6 +43,10 @@ const SOURCE_PATHS = {
  nativeContracts: "dist/contracts/nativeToolContracts.js",
  artifactContracts: "dist/contracts/artifactToolContracts.js",
  managedContracts: "dist/contracts/managedToolContracts.js",
+  firmwareContracts: "dist/contracts/firmwareToolContracts.js",
+  firmwareProvider: "dist/firmware/FirmwareRelease.js",
+  androidContracts: "dist/contracts/androidToolContracts.js",
+  androidProvider: "dist/android/JadxRelease.js",
  managedWorkflowContracts: "dist/contracts/managedWorkflowToolContracts.js",
  browserContracts: "dist/contracts/browserToolContracts.js",
  browserScenarioContracts: "dist/contracts/browserScenarioToolContracts.js",
@@ -53,6 +57,7 @@ const SOURCE_PATHS = {
  supportedClients: "dist/application/SupportedClients.js",
  hopperProvider: "dist/hopper/HopperProvider.js",
  ghidraProvider: "dist/ghidra/GhidraProvider.js",
+  idaProvider: "dist/ida/IdaProviderCapabilities.js",
  nativeProvider: "dist/native/NativeMacOSProvider.js",
  artifactProviders: "dist/application/InvestigationProviders.js",
  browserProvider: "dist/browser/CdpBrowserProvider.js",
@@ -1,5 +1,9 @@
 import type { ProductCatalog } from "./product-catalog.mjs";

+export function skillReferenceIssues(
+  skillRoot: string,
+): Promise<readonly string[]>;
+
 export function documentationFactIssues(
  root: string,
  catalog: ProductCatalog,
@@ -1,5 +1,5 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

 const README_PATHS = [
  "README.md",
@@ -28,9 +28,49 @@ const requireText = (issues, path, content, expected) => {
  if (!content.includes(expected)) issues.push(`${path}: missing ${expected}`);
 };

+/** Check that local Markdown references travel with an installed skill bundle. */
+export const skillReferenceIssues = async (skillRoot) => {
+  const issues = [];
+  const paths = (await readdir(skillRoot, { recursive: true }))
+    .filter((path) => path.endsWith(".md"))
+    .sort();
+  for (const path of paths) {
+    const content = await readFile(join(skillRoot, path), "utf8");
+    for (const match of content.matchAll(/\[[^\]\n]*\]\(([^)\s]+)\)/gu)) {
+      const destination = match[1];
+      if (/^(?:https?:\/\/|mailto:|#)/u.test(destination)) continue;
+      const target = resolve(
+        dirname(join(skillRoot, path)),
+        destination.split("#")[0],
+      );
+      const withinBundle = relative(resolve(skillRoot), target);
+      if (
+        withinBundle === ".." ||
+        withinBundle.startsWith(`..${sep}`) ||
+        isAbsolute(withinBundle)
+      ) {
+        issues.push(
+          `${path}: reference escapes installed skill bundle: ${destination}`,
+        );
+        continue;
+      }
+      try {
+        if (!(await stat(target)).isFile())
+          issues.push(`${path}: reference is not a file: ${destination}`);
+      } catch (cause) {
+        if (cause?.code !== "ENOENT") throw cause;
+        issues.push(`${path}: missing skill reference: ${destination}`);
+      }
+    }
+  }
+  return issues;
+};
+
 /** Return every caller-visible documentation mismatch against canonical facts. */
 export const documentationFactIssues = async (root, catalog) => {
-  const issues = [];
+  const issues = await skillReferenceIssues(
+    join(root, "skills/reverse-engineer-anything"),
+  );
  const expectedCounts = catalog.tools.families.map(({ count }) => count);
  for (const path of README_PATHS) {
    const content = await readFile(join(root, path), "utf8");
@@ -0,0 +1,43 @@
+"""Generate firmware bytes using standard format producers, with an independent oracle."""
+import gzip
+import hashlib
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+
+root = Path(sys.argv[1]).resolve()
+root.mkdir(parents=True, exist_ok=True)
+source = root / "probe.c"
+source.write_text("int firmware_probe(int x){return x*7+3;} int main(void){return firmware_probe(4);}\n")
+subprocess.run([sys.argv[2], "-O0", "-g", "-fno-inline", str(source), "-o", str(root / "probe")], check=True)
+payloads = {"etc/rea.conf": b"rea_fixture=true\n", "usr/bin/probe": (root / "probe").read_bytes()}
+buffer = io.BytesIO()
+with tarfile.open(fileobj=buffer, mode="w", format=tarfile.USTAR_FORMAT) as archive:
+    for name, data in payloads.items():
+        info = tarfile.TarInfo(name)
+        info.size = len(data)
+        info.mode = 0o644
+        info.mtime = 0
+        archive.addfile(info, io.BytesIO(data))
+compressed = gzip.compress(buffer.getvalue(), mtime=0)
+image = b"REA firmware fixture\n".ljust(64, b"\xff") + compressed + b"\x00" * 128
+(root / "firmware.bin").write_bytes(image)
+(root / "oracle.json").write_text(json.dumps({
+    "generator": "Python tarfile USTAR + gzip; host cc; no target execution",
+    "offset": 64, "length": len(compressed), "size": len(image),
+    "sha256": hashlib.sha256(image).hexdigest(),
+    "files": {name: {"sha256": hashlib.sha256(data).hexdigest(), "size": len(data)} for name, data in payloads.items()},
+}, indent=2) + "\n")
+print(root)
+
+if len(sys.argv) > 3:
+    tree = root / "ext4-root"
+    tree.mkdir(exist_ok=True)
+    for name, data in payloads.items():
+        target = tree / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(data)
+    subprocess.run([sys.argv[3], "-q", "-t", "ext4", "-F", "-d", str(tree), str(root / "ext4.bin"), "8192"], check=True)
@@ -2,11 +2,12 @@ import {
  lstat,
  mkdir,
  readFile,
+  readdir,
  rm,
  symlink,
  writeFile,
 } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";

 import { spawn } from "@lydell/node-pty";

@@ -19,6 +20,7 @@ import {
  runWithStatus,
 } from "./lib/verify-package-core.mjs";
 import { parse as parseJsonc } from "jsonc-parser";
+import { skillReferenceIssues } from "./lib/docs-facts.mjs";

 const OPENCODE_ORIGINAL = `{
  // OpenCode preferences must survive setup.
@@ -473,19 +475,23 @@ const assertSkill = async ({ skillPath, siblingSkillPath, root }) => {
  );
  if (skill !== canonicalSkill)
    throw new Error("packaged skill did not match its canonical source");
-  const installedReference = await readFile(
-    join(skillPath, "..", "references/javascript-applications.md"),
-    "utf8",
-  );
-  const canonicalReference = await readFile(
-    join(
-      root,
-      "skills/reverse-engineer-anything/references/javascript-applications.md",
-    ),
-    "utf8",
-  );
-  if (installedReference !== canonicalReference)
-    throw new Error("packaged skill references did not match canonical source");
+  const canonicalRoot = join(root, "skills/reverse-engineer-anything");
+  for (const reference of await readdir(join(canonicalRoot, "references"))) {
+    const installed = await readFile(
+      join(dirname(skillPath), "references", reference),
+      "utf8",
+    );
+    const canonical = await readFile(
+      join(canonicalRoot, "references", reference),
+      "utf8",
+    );
+    if (installed !== canonical)
+      throw new Error(
+        `packaged skill reference did not match canonical source: ${reference}`,
+      );
+  }
+  const issues = await skillReferenceIssues(dirname(skillPath));
+  if (issues.length > 0) throw new Error(issues.join("\n"));
  if ((await readFile(siblingSkillPath, "utf8")) !== "unrelated skill\n")
    throw new Error("packaged skill installation modified a sibling skill");
 };
@@ -0,0 +1,221 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { access, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { hashAndroidFile } from "../dist/android/AndroidTargetSnapshot.js";
+import { JADX_RELEASE } from "../dist/android/JadxRelease.js";
+import fixture from "./fixtures/android-apidemos.json" with { type: "json" };
+import { verifyAndroidCliCancellation } from "./lib/android-cli-cancellation.mjs";
+
+const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const apk = process.env.REA_ANDROID_TEST_APK;
+const jar = process.env.REA_JADX_MCP_JAR;
+if (apk === undefined || jar === undefined)
+  throw new Error(
+    "verify:android requires REA_ANDROID_TEST_APK and REA_JADX_MCP_JAR. Run node scripts/fetch-android-fixtures.mjs and select the downloaded files; see docs/android-analysis.md.",
+  );
+await access(apk);
+await access(jar);
+assert.equal(
+  await hashAndroidFile(apk),
+  fixture.sha256,
+  "Real Android lane requires the fixed ApiDemos release fixture",
+);
+assert.equal(
+  await hashAndroidFile(jar),
+  JADX_RELEASE.sha256,
+  "Real Android lane requires the audited headless JADX release JAR",
+);
+const java =
+  process.env.JAVA_HOME === undefined
+    ? "java"
+    : resolve(process.env.JAVA_HOME, "bin/java");
+const execute = promisify(execFile);
+await execute(java, ["-version"], { timeout: 10_000 });
+const entrypoint =
+  process.env.REA_ANDROID_ENTRYPOINT ?? resolve(repository, "scripts/rea.mjs");
+const environment = { ...process.env, REA_JADX_MCP_JAR: resolve(jar) };
+const path = resolve(apk);
+const tasks = [
+  {
+    name: "inspect_android_package",
+    args: ["inspect-android-package", path],
+    input: { path },
+  },
+  {
+    name: "search_android_classes",
+    args: ["search-android-classes", path, "ApiDemos"],
+    input: { path, query: "ApiDemos" },
+  },
+  {
+    name: "inspect_android_class",
+    args: ["inspect-android-class", path, fixture.class_name],
+    input: { path, class_name: fixture.class_name },
+  },
+  {
+    name: "inspect_android_method",
+    args: [
+      "inspect-android-method",
+      path,
+      fixture.class_name,
+      fixture.method_name,
+    ],
+    input: {
+      path,
+      class_name: fixture.class_name,
+      method_name: fixture.method_name,
+    },
+  },
+  {
+    name: "trace_android_references",
+    args: [
+      "trace-android-references",
+      path,
+      fixture.class_name,
+      "--method-name",
+      "activityIntent",
+    ],
+    input: {
+      path,
+      class_name: fixture.class_name,
+      method_name: "activityIntent",
+    },
+  },
+];
+const cliResults = new Map();
+for (const task of tasks) {
+  const response = await execute(
+    process.execPath,
+    [entrypoint, ...task.args, "--format", "json"],
+    {
+      cwd: repository,
+      env: environment,
+      timeout: 150_000,
+      maxBuffer: 8 * 1024 * 1024,
+    },
+  );
+  const evidence = parseEvidence(JSON.parse(response.stdout));
+  assert.equal(evidence.subject?.digest.sha256, fixture.sha256);
+  assert.equal(evidence.operation, task.name);
+  cliResults.set(task.name, evidence);
+  console.log(`PASS CLI ${task.name}`);
+}
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [entrypoint, "mcp"],
+  cwd: repository,
+  env: environment,
+  stderr: "pipe",
+});
+let stderr = "";
+transport.stderr?.on("data", (chunk) => {
+  stderr += chunk.toString();
+});
+const client = new Client({ name: "rea-real-android-verifier", version: "1" });
+try {
+  await client.connect(transport, { timeout: 30_000 });
+  for (const task of tasks) {
+    const response = await client.callTool(
+      { name: task.name, arguments: task.input },
+      { timeout: 150_000 },
+    );
+    assert.notEqual(response.isError, true, JSON.stringify(response));
+    const structured = response.structuredContent;
+    assert.ok(structured !== undefined && structured.evidence !== undefined);
+    const evidence = parseEvidence(structured.evidence);
+    assert.deepEqual(
+      evidence.normalized_result,
+      cliResults.get(task.name).normalized_result,
+    );
+    // Raw observations retain different workspace paths and load durations.
+    // Validate each evidence ID independently; compare portable results/intent.
+    assert.equal(structured.evidence_id, evidence.evidence_id);
+    assert.deepEqual(evidence.parameters, cliResults.get(task.name).parameters);
+    assert.deepEqual(evidence.provider, cliResults.get(task.name).provider);
+    assert.deepEqual(
+      evidence.subject.digest,
+      cliResults.get(task.name).subject.digest,
+    );
+    assert.deepEqual(
+      evidence.limitations,
+      cliResults.get(task.name).limitations,
+    );
+    assert.equal(evidence.confidence, cliResults.get(task.name).confidence);
+    assert.deepEqual(structured.result, evidence.normalized_result);
+    console.log(`PASS MCP/CLI parity ${task.name}`);
+  }
+} catch (cause) {
+  process.stderr.write(stderr);
+  throw cause;
+} finally {
+  await client.close();
+}
+const packageResult = cliResults.get(
+  "inspect_android_package",
+).normalized_result;
+assert.equal(packageResult.package_name, fixture.package);
+assert.equal(packageResult.version_name, fixture.version);
+assert.equal(packageResult.min_sdk, "26");
+assert.equal(packageResult.target_sdk, "33");
+assert.equal(packageResult.manifest.status, "complete");
+assert.ok(packageResult.manifest.text.includes(fixture.package));
+assert.ok(packageResult.permissions.includes("android.permission.INTERNET"));
+assert.equal(packageResult.signature_verification, "not_performed");
+assert.ok(
+  cliResults
+    .get("search_android_classes")
+    .normalized_result.matches.includes(fixture.class_name),
+);
+const classResult = cliResults.get("inspect_android_class").normalized_result;
+assert.ok(
+  classResult.methods.some((method) => method.name === fixture.method_name),
+);
+const method = cliResults.get("inspect_android_method").normalized_result;
+assert.equal(method.representation, "java");
+assert.equal(method.body_status, "available");
+assert.equal(method.source.status, "complete");
+assert.ok(method.source.text.includes("getIntent()"));
+assert.ok(method.source.text.includes("setListAdapter"));
+assert.equal(method.method.dex_descriptor, null);
+const references = cliResults.get("trace_android_references").normalized_result;
+assert.ok(references.total > 0);
+assert.ok(
+  references.references.every(
+    (reference) =>
+      reference.dex_offset === null && reference.source_line === null,
+  ),
+);
+await verifyAndroidCliCancellation({
+  entrypoint,
+  environment,
+  path,
+  repository,
+  execute,
+});
+assert.equal(
+  await hashAndroidFile(apk),
+  fixture.sha256,
+  "Original APK must remain unchanged",
+);
+const report = {
+  lane: "real-android",
+  platform: process.platform,
+  fixture: { version: fixture.version, sha256: fixture.sha256 },
+  engine: packageResult.engine,
+  operations: tasks.map((task) => task.name),
+  cli_mcp_parity: true,
+  original_apk_unchanged: true,
+  apk_executed: false,
+  cli_sigterm_cleanup: true,
+};
+if (process.env.REA_ANDROID_REPORT !== undefined)
+  await writeFile(
+    process.env.REA_ANDROID_REPORT,
+    JSON.stringify(report, null, 2) + "\n",
+  );
+console.log(JSON.stringify(report, null, 2));
@@ -0,0 +1,254 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import {
+  access,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  symlink,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { firmwareResultSchemas } from "../dist/domain/firmwareAnalysis.js";
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { hashFirmwareFile } from "../dist/firmware/FirmwareFiles.js";
+
+const exec = promisify(execFile);
+const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const entrypoint = resolve(
+  process.env.REA_FIRMWARE_TEST_ENTRYPOINT ??
+    join(repository, "scripts/rea.mjs"),
+);
+if (process.platform !== "linux")
+  throw new Error(
+    "verify:firmware requires Linux; other hosts are not verified",
+  );
+for (const variable of ["REA_BINWALK_COMMAND", "REA_UNBLOB_COMMAND"]) {
+  const path = process.env[variable];
+  if (path === undefined)
+    throw new Error(
+      `verify:firmware requires ${variable}; see docs/firmware-analysis.md`,
+    );
+  await access(path);
+}
+const fixtureRoot = resolve(
+  process.env.REA_FIRMWARE_FIXTURE_ROOT ??
+    join(repository, "_reference/firmware-integration/generated"),
+);
+await access(join(fixtureRoot, "oracle.json")).catch((cause) => {
+  throw new Error(
+    "verify:firmware requires generated fixtures; run npm run fixtures:firmware",
+    { cause },
+  );
+});
+const oracle = JSON.parse(
+  await readFile(join(fixtureRoot, "oracle.json"), "utf8"),
+);
+const path = join(fixtureRoot, "firmware.bin");
+assert.equal(await hashFirmwareFile(path), oracle.sha256);
+const root = await mkdtemp(join(tmpdir(), "rea-real-firmware-"));
+const environment = Object.fromEntries(
+  Object.entries(process.env).filter(([, value]) => value !== undefined),
+);
+const client = new Client({ name: "rea-real-firmware-verifier", version: "1" });
+const cli = async (args, env = environment) => {
+  const response = await exec(
+    process.execPath,
+    [entrypoint, ...args, "--format", "json"],
+    {
+      env,
+      cwd: repository,
+      timeout: 150_000,
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  );
+  return parseEvidence(JSON.parse(response.stdout));
+};
+const call = async (name, args) => {
+  const response = await client.callTool(
+    { name, arguments: args },
+    { timeout: 150_000 },
+  );
+  assert.notEqual(response.isError, true, JSON.stringify(response));
+  assert.ok(response.structuredContent !== undefined);
+  return response.structuredContent;
+};
+const verifyRegions = (evidence) => {
+  assert.equal(evidence.subject.digest.sha256, oracle.sha256);
+  const result = firmwareResultSchemas.inspect_firmware_regions.parse(
+    evidence.normalized_result,
+  );
+  const gzip = result.regions.find(
+    (region) => region.signature === "gzip" && region.offset === oracle.offset,
+  );
+  assert.ok(
+    gzip !== undefined,
+    "Binwalk must find the independently generated gzip offset",
+  );
+  assert.equal(gzip.reported_size, oracle.length);
+  assert.equal(gzip.size_basis, "provider_reported_validation_unknown");
+  return result.regions.map(({ provider_id, ...region }) => region);
+};
+const verifyFiles = async (evidence) => {
+  const result = firmwareResultSchemas.extract_firmware.parse(
+    evidence.normalized_result,
+  );
+  assert.ok(result.chunks.some((chunk) => chunk.handler === "gzip"));
+  for (const [suffix, expected] of Object.entries(oracle.files)) {
+    const file = result.files.find((candidate) =>
+      candidate.relative_path.endsWith(`/${suffix}`),
+    );
+    assert.ok(file !== undefined, `Missing extracted ${suffix}`);
+    assert.equal(file.sha256, expected.sha256);
+    assert.equal(file.size, expected.size);
+    assert.equal(await hashFirmwareFile(file.path), expected.sha256);
+    assert.equal(file.original_file_range, null);
+    assert.equal(file.runtime_address, null);
+  }
+  return result;
+};
+try {
+  const inspected = await cli(["inspect-firmware-regions", path]);
+  const cliRegions = verifyRegions(inspected);
+  const extracted = await cli([
+    "extract-firmware",
+    path,
+    join(root, "cli-output"),
+  ]);
+  const cliFiles = await verifyFiles(extracted);
+  assert.equal(cliFiles.coverage, "partial");
+  assert.ok(
+    cliFiles.chunks.some(
+      (chunk) =>
+        chunk.handler === null &&
+        chunk.range.offset === 0 &&
+        chunk.range.length === 64,
+    ),
+  );
+  await client.connect(
+    new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      cwd: repository,
+      env: environment,
+      stderr: "pipe",
+    }),
+    { timeout: 30_000 },
+  );
+  const inspectedMcp = await call("inspect_firmware_regions", { path });
+  const mcpEvidence = parseEvidence(inspectedMcp.evidence);
+  assert.deepEqual(verifyRegions(mcpEvidence), cliRegions);
+  const extractedMcp = await call("extract_firmware", {
+    path,
+    output_directory: join(root, "mcp-output"),
+  });
+  const mcpFiles = await verifyFiles(parseEvidence(extractedMcp.evidence));
+  const contentIdentity = (result) =>
+    result.files.map(({ relative_path, sha256, size }) => ({
+      relative_path,
+      sha256,
+      size,
+    }));
+  assert.deepEqual(contentIdentity(mcpFiles), contentIdentity(cliFiles));
+  const selected = await call("extract_firmware", {
+    path,
+    output_directory: join(root, "selected-output"),
+    range: { offset: oracle.offset, length: oracle.length },
+  });
+  const selectedFiles = await verifyFiles(parseEvidence(selected.evidence));
+  assert.equal(selectedFiles.selection.offset, oracle.offset);
+  assert.equal(selectedFiles.selection.length, oracle.length);
+  const depth = await call("extract_firmware", {
+    path,
+    output_directory: join(root, "depth-output"),
+    max_depth: 1,
+  });
+  const depthResult = firmwareResultSchemas.extract_firmware.parse(
+    depth.result,
+  );
+  assert.equal(depthResult.coverage, "partial");
+  assert.ok(depthResult.depth_limited_paths.length > 0);
+  console.log(
+    "PASS real Binwalk/Unblob: CLI, MCP, independent offsets/digests, range extraction, unknown chunks and depth limits",
+  );
+  if (process.env.REA_FIRMWARE_VERIFY_EXT4 === "1") {
+    const ext4 = join(fixtureRoot, "ext4.bin");
+    await access(ext4);
+    const response = await call("extract_firmware", {
+      path: ext4,
+      output_directory: join(root, "ext4-output"),
+    });
+    const result = firmwareResultSchemas.extract_firmware.parse(
+      response.result,
+    );
+    assert.ok(result.chunks.some((chunk) => chunk.handler === "extfs"));
+    assert.equal(result.coverage, "complete");
+    for (const [suffix, expected] of Object.entries(oracle.files))
+      assert.equal(
+        result.files.find((file) => file.relative_path.endsWith(`/${suffix}`))
+          ?.sha256,
+        expected.sha256,
+      );
+    console.log("PASS real ext4 extraction with debugfs; no mounts");
+    // Preserve the process-ownership utility while withholding all extractors.
+    const withoutExtractors = join(root, "without-extractors");
+    await access("/bin/ps");
+    await mkdir(withoutExtractors);
+    await symlink("/bin/ps", join(withoutExtractors, "ps"));
+    const missing = await cli(
+      ["extract-firmware", ext4, join(root, "missing-extractor-output")],
+      { ...environment, PATH: withoutExtractors },
+    );
+    const partial = firmwareResultSchemas.extract_firmware.parse(
+      missing.normalized_result,
+    );
+    assert.equal(partial.coverage, "partial");
+    assert.ok(JSON.stringify(partial.diagnostics).includes("debugfs"));
+    console.log(
+      "PASS real missing-extractor diagnostics retained despite Unblob exit 1",
+    );
+  }
+  if (process.env.REA_FIRMWARE_VERIFY_GHIDRA === "1") {
+    if (process.env.GHIDRA_INSTALL_DIR === undefined)
+      throw new Error(
+        "Firmware Ghidra handoff requires GHIDRA_INSTALL_DIR and Java; see docs/ghidra.md",
+      );
+    const child = mcpFiles.files.find((file) =>
+      file.relative_path.endsWith("/usr/bin/probe"),
+    );
+    assert.ok(child !== undefined);
+    await call("open_binary", { path: child.path, provider_id: "ghidra" });
+    const dossier = await call("analyze_function", {
+      procedure: "firmware_probe",
+    });
+    const evidence = parseEvidence(dossier.evidence);
+    assert.equal(
+      evidence.subject.digest.sha256,
+      oracle.files["usr/bin/probe"].sha256,
+    );
+    const pseudocode = await call("procedure_pseudo_code", {
+      procedure: "firmware_probe",
+    });
+    assert.equal(parseEvidence(pseudocode.evidence).provider.id, "ghidra");
+    assert.ok(
+      JSON.stringify(evidence.normalized_result).includes("firmware_probe"),
+    );
+    await call("close_binary", {});
+    console.log(
+      "PASS real Ghidra handoff of the selected extracted host ELF, bound to its digest",
+    );
+  }
+  assert.equal(
+    await hashFirmwareFile(path),
+    oracle.sha256,
+    "Original firmware bytes must remain unchanged",
+  );
+} finally {
+  await client.close();
+  await rm(root, { recursive: true, force: true });
+}
@@ -0,0 +1,403 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  mkdtemp,
+  mkdir,
+  readFile,
+  readdir,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { nativeDataTypeSchema } from "../dist/domain/nativeDataType.js";
+import { nativeLoadImageSchema } from "../dist/domain/nativeLoadImage.js";
+
+const mode = process.argv[2] ?? "symbols";
+if (
+  ![
+    "symbols",
+    "stripped",
+    "ordinary",
+    "unsupported",
+    "malformed",
+    "ambiguous",
+    "loader-failure",
+    "default-native",
+  ].includes(mode) ||
+  process.argv.length > 3
+)
+  throw new Error(
+    "Usage: verify-real-ghidra-nativeaot.mjs [symbols|stripped|ordinary|unsupported|malformed|ambiguous|loader-failure|default-native]",
+  );
+if (process.platform !== "linux" || process.arch !== "x64")
+  throw new Error(
+    "verify:ghidra:nativeaot requires a Linux x64 host; Windows host mutation is not supported.",
+  );
+for (const key of ["loader-failure", "default-native"].includes(mode)
+  ? ["GHIDRA_INSTALL_DIR"]
+  : ["GHIDRA_INSTALL_DIR", "REA_GHIDRA_NATIVEAOT_JAR"])
+  if (!process.env[key] || !isAbsolute(process.env[key]))
+    throw new Error(
+      `verify:ghidra:nativeaot prerequisite missing: absolute ${key}`,
+    );
+const fixtureRoot = resolve(
+  process.env.REA_NATIVEAOT_PROOF_FIXTURE_ROOT ??
+    "_reference/nativeaot-integration/generated/linux-x64",
+);
+const oracle = JSON.parse(
+  await readFile(join(fixtureRoot, "oracle.json"), "utf8"),
+);
+const symbolTarget = join(
+  fixtureRoot,
+  "symbols",
+  oracle.runtime === "win-x64" ? "NativeAotFixture.exe" : "NativeAotFixture",
+);
+const target =
+  mode === "stripped"
+    ? join(fixtureRoot, "stripped", basename(symbolTarget))
+    : [
+          "ordinary",
+          "unsupported",
+          "malformed",
+          "ambiguous",
+          "loader-failure",
+          "default-native",
+        ].includes(mode)
+      ? join(
+          fixtureRoot,
+          ["loader-failure", "default-native"].includes(mode)
+            ? "ordinary"
+            : mode,
+        )
+      : symbolTarget;
+const bytes = await readFile(target);
+const sha256 = hash(bytes);
+const workspace = await mkdtemp(join(tmpdir(), "rea-nativeaot-proof-"));
+const runtime = join(workspace, "runtime");
+await mkdir(runtime);
+const packageRoot = process.env.REA_NATIVEAOT_PROOF_PACKAGE_ROOT;
+if (packageRoot !== undefined && !isAbsolute(packageRoot))
+  throw new Error("REA_NATIVEAOT_PROOF_PACKAGE_ROOT must be absolute");
+const entrypoint =
+  packageRoot === undefined
+    ? fileURLToPath(new URL("./rea.mjs", import.meta.url))
+    : join(packageRoot, "scripts/rea.mjs");
+const env = {
+  PATH: process.env.PATH ?? "/usr/bin:/bin",
+  TMPDIR: runtime,
+  REA_LOG_LEVEL: "silent",
+  REA_ANALYSIS_PROVIDER: "ghidra",
+  GHIDRA_INSTALL_DIR: process.env.GHIDRA_INSTALL_DIR,
+  REA_GHIDRA_NATIVEAOT_JAR: process.env.REA_GHIDRA_NATIVEAOT_JAR,
+  GHIDRA_HEADLESS_MAXMEM: process.env.GHIDRA_HEADLESS_MAXMEM ?? "768M",
+  ...(process.env.JAVA_HOME === undefined
+    ? {}
+    : { JAVA_HOME: process.env.JAVA_HOME }),
+};
+if (mode === "default-native") delete env.REA_GHIDRA_NATIVEAOT_JAR;
+// Source-built linkage failure exercises the actual JVM loader boundary, not
+// a simulated producer report. Its class/JAR exist only in the owned workspace.
+if (mode === "loader-failure")
+  env.REA_GHIDRA_NATIVEAOT_JAR = join(workspace, "bad-extension.jar");
+async function prepareLoaderFailure() {
+  const source = join(workspace, "NativeAotExtension.java");
+  const classes = join(workspace, "classes");
+  await mkdir(classes);
+  await writeFile(
+    source,
+    `package rea.extensions.nativeaot;
+public final class NativeAotExtension {
+  static { fail(); }
+  private static void fail() { throw new IllegalStateException("REA_INITIALIZER_FIXTURE"); }
+  public NativeAotExtension() {}
+}
+`,
+  );
+  const command = (name) =>
+    process.env.JAVA_HOME === undefined
+      ? name
+      : join(process.env.JAVA_HOME, "bin", name);
+  await promisify(execFile)(
+    command("javac"),
+    ["-J-Xmx512m", "-J-XX:ActiveProcessorCount=1", "-d", classes, source],
+    { timeout: 60000 },
+  );
+  await promisify(execFile)(
+    command("jar"),
+    ["--create", "--file", env.REA_GHIDRA_NATIVEAOT_JAR, "-C", classes, "."],
+    { timeout: 60000 },
+  );
+}
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [entrypoint, "mcp"],
+  env,
+  stderr: "pipe",
+});
+const client = new Client({ name: "rea-nativeaot-proof", version: "1" });
+let stderr = "";
+transport.stderr?.on("data", (chunk) => {
+  stderr = (stderr + chunk.toString()).slice(-65536);
+});
+let opened = false;
+let report;
+try {
+  if (mode === "loader-failure") await prepareLoaderFailure();
+  await client.connect(transport);
+  const response = await client.callTool(
+    { name: "open_binary", arguments: { path: target, provider_id: "ghidra" } },
+    { timeout: 360000 },
+  );
+  if (
+    ["unsupported", "malformed", "ambiguous", "loader-failure"].includes(mode)
+  ) {
+    // MCP open binds a lazy session; the first inspection starts import.
+    let failure = response;
+    if (failure.isError !== true) {
+      opened = true;
+      failure = await client.callTool(
+        { name: "inspect_native_load_image", arguments: {} },
+        { timeout: 360000 },
+      );
+    }
+    assert.equal(failure.isError, true, JSON.stringify(failure));
+    const diagnostic = JSON.stringify(failure);
+    assert.match(
+      diagnostic,
+      mode === "unsupported"
+        ? /Unsupported NativeAOT RTR format/
+        : mode === "malformed"
+          ? /Reversed NativeAOT section/
+          : mode === "loader-failure"
+            ? /ExceptionInInitializerError.*REA_INITIALIZER_FIXTURE/
+            : /Ambiguous NativeAOT directory candidates/,
+    );
+    report = { mode, target, sha256, typed_failure: failure };
+  } else if (mode === "default-native") {
+    assert.notEqual(response.isError, true, JSON.stringify(response));
+    opened = true;
+    const image = nativeLoadImageSchema.parse(
+      await call("inspect_native_load_image"),
+    );
+    assert.equal(image.observations.metadata_recovery, undefined);
+    report = { mode, target, sha256, image };
+  } else {
+    assert.notEqual(response.isError, true, JSON.stringify(response));
+    opened = true;
+    const image = nativeLoadImageSchema.parse(
+      await call("inspect_native_load_image"),
+    );
+    const summary = image.observations.metadata_recovery?.[0];
+    assert.ok(
+      summary,
+      "Loaded-image inspection omitted inline runtime-format discovery",
+    );
+    assert.equal(summary.format, "dotnet-nativeaot");
+    assert.equal(
+      summary.analysis_artifact_sha256,
+      hash(await readFile(env.REA_GHIDRA_NATIVEAOT_JAR)),
+    );
+    if (mode === "ordinary") {
+      assert.equal(summary.status, "not_applicable");
+      assert.equal(summary.method_tables, 0);
+      assert.deepEqual(summary.types, []);
+      report = { mode, target, sha256, summary };
+    } else {
+      assert.ok(["complete", "partial"].includes(summary.status));
+      assert.equal(summary.format_major, 9);
+      assert.equal(summary.format_minor, 1);
+      assert.equal(summary.types.length, summary.method_tables);
+      assert.ok(summary.method_tables > 0);
+      assert.equal(
+        summary.discovery,
+        mode === "stripped" || oracle.runtime === "win-x64"
+          ? "signature-heuristic"
+          : "symbol",
+      );
+      assert.equal(summary.derived_memory.file_offset, null);
+      assert.ok(summary.coverage.frozen_objects_annotated > 0);
+      // Independent compiler/linker symbols identify fixture classes. Recovered
+      // Class_address names are never treated as the original source identities.
+      const symbols = await readFile(join(fixtureRoot, "symbols.txt"), "utf8");
+      const bias =
+        oracle.runtime === "linux-x64"
+          ? BigInt(image.observations.image_base)
+          : 0n;
+      const addressOf = (name) => {
+        const line = symbols
+          .split(/\r?\n/u)
+          .find((line) => line.split(/\s+/u).includes(name));
+        assert.ok(line, `Independent symbol missing: ${name}`);
+        const match =
+          oracle.runtime === "linux-x64"
+            ? line.match(/^([a-f0-9]+)\s/iu)
+            : line.match(/\s([a-f0-9]{16})\s/iu);
+        assert.ok(match, `Unrecognized independent symbol line: ${line}`);
+        return `0x${(BigInt(`0x${match[1]}`) + bias).toString(16)}`;
+      };
+      const fixtureSymbols =
+        oracle.symbols ??
+        (oracle.runtime === "win-x64"
+          ? {
+              base: "??_7NativeAotFixture_BaseProbe@@6B@",
+              derived: "??_7NativeAotFixture_DerivedProbe@@6B@",
+              interface: "??_7NativeAotFixture_IProbe@@6B@",
+              compute: "NativeAotFixture_DerivedProbe__Compute",
+              dispatch: "NativeAotFixture_Program__Dispatch",
+            }
+          : {
+              base: "_ZTV26NativeAotFixture_BaseProbe",
+              derived: "_ZTV29NativeAotFixture_DerivedProbe",
+              interface: "_ZTV23NativeAotFixture_IProbe",
+              compute: "NativeAotFixture_DerivedProbe__Compute",
+              dispatch: "NativeAotFixture_Program__Dispatch",
+            });
+      const lookup = (address) => {
+        const identity = summary.types.find((type) => type.address === address);
+        assert.ok(identity?.type, `Recovered identity missing at ${address}`);
+        return identity.type;
+      };
+      const derivedAddress = addressOf(fixtureSymbols.derived);
+      const baseAddress = addressOf(fixtureSymbols.base);
+      const interfaceAddress = addressOf(fixtureSymbols.interface);
+      const derived = nativeDataTypeSchema.parse(
+        await call("inspect_native_data_type", {
+          type: lookup(derivedAddress),
+        }),
+      );
+      const metadata = derived.metadata_recovery;
+      assert.ok(metadata);
+      assert.equal(metadata.original_name, null);
+      assert.equal(metadata.name_origin, "generated");
+      assert.equal(metadata.method_table_address, derivedAddress);
+      assert.equal(metadata.related_type.address, baseAddress);
+      assert.ok(
+        metadata.interfaces.some((type) => type.address === interfaceAddress),
+      );
+      assert.ok(
+        metadata.virtual_slots.some(
+          (slot) => slot.target_address === addressOf(fixtureSymbols.compute),
+        ),
+      );
+      const compute = await call("analyze_function", {
+        procedure: addressOf(fixtureSymbols.compute),
+      });
+      assert.ok(compute.pseudocode.trim());
+      assert.doesNotMatch(
+        compute.pseudocode,
+        /\b__thiscall\b/u,
+        "Upstream x64 calling-convention rewrite leaked into recovered pseudocode",
+      );
+      assert.match(compute.pseudocode, /(?:0xb|\b11\b|<<)/u);
+      const dispatch = await call("analyze_function", {
+        procedure: addressOf(fixtureSymbols.dispatch),
+      });
+      assert.ok(dispatch.pseudocode.trim());
+      for (const literal of oracle.expected_strings)
+        assert.ok(
+          (await call("search_strings", { pattern: literal })).length > 0,
+          `Frozen string missing: ${literal}`,
+        );
+      const observed = await call("read_bytes", {
+        address: metadata.virtual_slots[0].slot_address,
+        length: 8,
+      });
+      assert.equal(observed.complete, true);
+      assert.equal(
+        `0x${Buffer.from(observed.bytes_hex, "hex").readBigUInt64LE().toString(16)}`,
+        metadata.virtual_slots[0].target_address,
+      );
+      report = { mode, target, sha256, summary, derived, compute, dispatch };
+      await call("close_binary");
+      opened = false;
+      // One representative CLI boundary, selected explicitly to avoid repeated
+      // full NativeAOT auto-analysis during each focused iteration.
+      if (process.env.REA_NATIVEAOT_PROOF_CLI === "1") {
+        const { stdout } = await promisify(execFile)(
+          process.execPath,
+          [
+            entrypoint,
+            "inspect-native-data-type",
+            target,
+            "--type",
+            lookup(derivedAddress),
+            "--provider",
+            "ghidra",
+            "--json",
+          ],
+          { env, timeout: 360000, maxBuffer: 16 * 1024 * 1024 },
+        );
+        const evidence = parseEvidence(JSON.parse(stdout));
+        assert.equal(evidence.subject.digest.sha256, sha256);
+        assert.deepEqual(
+          evidence.normalized_result.metadata_recovery,
+          metadata,
+        );
+        report.cli_metadata = evidence.normalized_result.metadata_recovery;
+      }
+    }
+  }
+  assert.equal(
+    hash(await readFile(target)),
+    sha256,
+    "Input executable changed",
+  );
+  if (opened) {
+    await call("close_binary");
+    opened = false;
+  }
+  await client.close();
+  assert.deepEqual(
+    await readdir(runtime),
+    [],
+    "Owned runtime/project/extension files leaked after close",
+  );
+  const capture = process.env.REA_NATIVEAOT_PROOF_CAPTURE_DIR;
+  if (capture !== undefined) {
+    assert.ok(isAbsolute(capture));
+    await mkdir(capture, { recursive: true });
+    await writeFile(
+      join(capture, `${oracle.runtime}-${mode}.json`),
+      JSON.stringify(report, null, 2) + "\n",
+    );
+  }
+  console.log(
+    `PASS real Ghidra NativeAOT ${oracle.runtime}/${mode}: MCP metadata, source identity and owned cleanup${report?.compute ? ", independent type/slot oracle and pseudocode" : ""}${report?.cli_metadata ? ", equivalent CLI" : ""}`,
+  );
+} catch (error) {
+  console.error(stderr);
+  throw error;
+} finally {
+  if (opened)
+    await client
+      .callTool({ name: "close_binary", arguments: {} })
+      .catch(() => {});
+  await client.close().catch(() => {});
+  await rm(workspace, { recursive: true, force: true });
+}
+function hash(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+async function call(name, args = {}) {
+  const response = await client.callTool(
+    { name, arguments: args },
+    { timeout: 360000 },
+  );
+  assert.notEqual(response.isError, true, JSON.stringify(response));
+  if (name === "close_binary") return response.structuredContent;
+  const evidence = parseEvidence(response.structuredContent.evidence);
+  assert.equal(evidence.subject.digest.sha256, sha256);
+  assert.deepEqual(
+    evidence.normalized_result,
+    response.structuredContent.result,
+  );
+  return response.structuredContent.result;
+}
@@ -0,0 +1,256 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { access, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { parseArgs, promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+const { values } = parseArgs({
+  options: {
+    target: { type: "string" },
+    procedure: { type: "string", default: "rea_fixture_add" },
+    "package-root": { type: "string" },
+    report: { type: "string" },
+  },
+});
+if (values.target === undefined || process.env.REA_IDA_MCP_CONFIG === undefined)
+  throw new Error(
+    "IDA verification requires --target and REA_IDA_MCP_CONFIG; see docs/ida-provider.md. No toolchain is installed by this lane.",
+  );
+const packageRoot = resolve(
+  values["package-root"] ?? fileURLToPath(new URL("..", import.meta.url)),
+);
+const target = resolve(values.target);
+const entry = join(packageRoot, "scripts", "rea.mjs");
+const importBuilt = (path) =>
+  import(pathToFileURL(join(packageRoot, "dist", path)).href);
+const [
+  { toolContract },
+  { evidenceSchema },
+  { functionDossierSchema },
+  { readIdaConfiguration },
+  { createIdaMcpConnection },
+] = await Promise.all([
+  importBuilt("contracts/toolContracts.js"),
+  importBuilt("domain/evidence.js"),
+  importBuilt("domain/hopperValues.js"),
+  importBuilt("ida/IdaConfiguration.js"),
+  importBuilt("ida/IdaMcpConnection.js"),
+]);
+const registration = readIdaConfiguration(process.env.REA_IDA_MCP_CONFIG);
+if (!registration.ok) throw registration.error;
+const config = registration.value;
+const environment = Object.fromEntries(
+  Object.entries({
+    ...process.env,
+    REA_ANALYSIS_PROVIDER: "ida",
+    REA_LOG_LEVEL: "error",
+  }).filter(([, value]) => value !== undefined),
+);
+const report = {
+  passed: false,
+  mode: config.mode,
+  checks: [],
+  observations: [],
+};
+let phase = "target admission";
+const workspaces = new Set();
+const databases = new Set();
+const digest = async () => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(target)) hash.update(chunk);
+  return hash.digest("hex");
+};
+const observe = (input) => {
+  const evidence = evidenceSchema.parse(input);
+  assert.equal(evidence.provider.id, "ida");
+  assert.equal(evidence.provider.version, "1");
+  assert.equal(evidence.analysis_profile.parameters.cache_policy, "live");
+  assert.equal(evidence.analysis_profile.parameters.engine_version, null);
+  assert.ok(evidence.limitations.length > 0);
+  assert.ok(
+    evidence.locations.some((location) => location.kind === "artifact-path"),
+  );
+  if (config.mode === "headless") {
+    assert.notEqual(evidence.raw_result.metadata_before.input_path, target);
+    workspaces.add(dirname(evidence.raw_result.metadata_before.input_path));
+    for (const observation of evidence.raw_result.observations) {
+      assert.equal(typeof observation.arguments.database, "string");
+      databases.add(observation.arguments.database);
+    }
+  }
+  report.observations.push(evidence);
+  return evidence.normalized_result;
+};
+const cli = async () => {
+  phase = "production CLI function analysis";
+  const { stdout } = await promisify(execFile)(
+    process.execPath,
+    [
+      entry,
+      "function",
+      target,
+      values.procedure,
+      "--provider",
+      "ida",
+      "--json",
+    ],
+    {
+      env: environment,
+      timeout: config.timeoutMs * 3,
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  ).catch((cause) => {
+    report.failed_cli = { stdout: cause.stdout, stderr: cause.stderr };
+    throw cause;
+  });
+  const dossier = functionDossierSchema.parse(observe(JSON.parse(stdout)));
+  assert.ok(dossier.pseudocode.length > 0);
+  assert.ok(dossier.assembly.length > 0);
+  assert.equal(dossier.procedure.body.available, false);
+  report.checks.push("production CLI and complete function Evidence");
+  return dossier;
+};
+const mcp = async (cliDossier) => {
+  const client = new Client({ name: "rea-real-ida-verifier", version: "1" });
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entry, "mcp"],
+    env: environment,
+    stderr: "pipe",
+  });
+  transport.stderr?.on("data", () => undefined);
+  const call = async (name, args) => {
+    phase = `production MCP ${name}`;
+    const result = await client.callTool(
+      { name, arguments: args },
+      { timeout: config.timeoutMs * 2 },
+    );
+    if (result.isError === true) report.failed_tool_result = result;
+    assert.notEqual(result.isError, true);
+    return toolContract(name).outputSchema.parse(result.structuredContent);
+  };
+  let opened = false;
+  try {
+    await client.connect(transport, { timeout: config.timeoutMs });
+    await call("open_binary", { path: target, provider_id: "ida" });
+    opened = true;
+    const analyzed = await call("analyze_function", {
+      procedure: values.procedure,
+    });
+    const dossier = functionDossierSchema.parse(observe(analyzed.evidence));
+    assert.deepEqual(dossier.procedure, cliDossier.procedure);
+    assert.equal(dossier.pseudocode, cliDossier.pseudocode);
+    assert.deepEqual(dossier.assembly, cliDossier.assembly);
+    assert.equal(analyzed.evidence_id, analyzed.evidence.evidence_id);
+    for (const [name, args] of [
+      ["list_procedures", {}],
+      ["list_strings", {}],
+      ["procedure_address", { procedure: dossier.procedure.name }],
+      ["procedure_assembly", { procedure: dossier.procedure.address }],
+      ["procedure_callees", { procedure: dossier.procedure.address }],
+      ...(config.mode === "attached"
+        ? [["procedure_callers", { procedure: dossier.procedure.address }]]
+        : []),
+      ["search_procedures", { pattern: dossier.procedure.name }],
+      ["procedure_pseudo_code", { procedure: dossier.procedure.address }],
+      ["read_function_instructions", { procedure: dossier.procedure.address }],
+      ["search_strings", { pattern: "a.b", mode: "literal" }],
+      ["xrefs", { address: dossier.procedure.address }],
+    ]) {
+      const result = await call(name, args);
+      observe(result.evidence);
+    }
+    const invalid = await client.callTool({
+      name: "xrefs",
+      arguments: { address: "not-an-address" },
+    });
+    assert.equal(invalid.isError, true);
+    assert.equal(invalid.structuredContent.error.code, "invalid_request");
+    await call("close_binary", {});
+    opened = false;
+    report.checks.push(
+      "one MCP connection, target selection, analysis/search/xrefs, invalid input, and close",
+    );
+    report.checks.push(
+      "CLI/MCP function identity, pseudocode, assembly, and raw Evidence parity",
+    );
+  } finally {
+    const completedPhase = phase;
+    if (opened) await call("close_binary", {});
+    await client.close();
+    phase = completedPhase;
+  }
+};
+const cleanup = async () => {
+  phase = "upstream lifecycle verification";
+  const upstream = createIdaMcpConnection(config);
+  try {
+    await upstream.connect();
+    if (config.mode === "attached") {
+      const metadata = await upstream.call("get_metadata", {});
+      assert.equal(metadata.sha256.toLowerCase(), await digest());
+      report.checks.push(
+        "existing GUI target remains open with the original input identity",
+      );
+    } else {
+      const inventory = await upstream.call("idb_list", {});
+      assert.ok(
+        inventory.sessions.every(
+          (session) => !databases.has(session.session_id),
+        ),
+      );
+      for (const workspace of workspaces)
+        await assert.rejects(access(workspace), { code: "ENOENT" });
+      report.checks.push(
+        "owned database IDs absent from upstream discovery and private workspaces removed",
+      );
+    }
+  } finally {
+    await upstream.close();
+  }
+};
+try {
+  const before = await digest();
+  await mcp(await cli());
+  await cleanup();
+  assert.equal(await digest(), before);
+  report.checks.push("original binary unchanged and never executed");
+  report.passed = true;
+} catch (cause) {
+  report.failure = {
+    phase,
+    message: cause instanceof Error ? cause.message : String(cause),
+  };
+  process.exitCode = 1;
+} finally {
+  if (values.report !== undefined)
+    await writeFile(
+      resolve(values.report),
+      `${JSON.stringify(report, null, 2)}\n`,
+      { mode: 0o600 },
+    );
+  console.log(
+    JSON.stringify(
+      {
+        passed: report.passed,
+        mode: report.mode,
+        checks: report.checks,
+        ...(report.passed
+          ? {}
+          : {
+              failed_phase: phase,
+              detail: "Use --report for private local diagnostics.",
+            }),
+      },
+      null,
+      2,
+    ),
+  );
+}
@@ -8,13 +8,13 @@
    "url": "https://github.com/morluto/rea",
    "source": "github"
  },
-  "version": "4.0.1",
+  "version": "4.1.0",
  "packages": [
    {
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "identifier": "rea-agents",
-      "version": "4.0.1",
+      "version": "4.1.0",
      "runtimeHint": "npx",
      "transport": {
        "type": "stdio"
@@ -1,10 +1,10 @@
 ---
 name: reverse-engineer-anything
-description: Reverse engineer native, managed, Electron/JavaScript, packaged, and browser applications with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
+description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "24"
-  tool_count: 118
-  catalog_digest: "b4f7e5860d90b029876b58fe7cd4a8041fef1f2add23440e37e90827d808e503"
+  version: "26"
+  tool_count: 125
+  catalog_digest: "ed9c36900e9223561d38ba30a44921f4ff101d5eca989920f9edc9dc91df470b"
 ---

 # REA
@@ -15,32 +15,110 @@ behavior not established by available source. For ordinary analysis of a
 complete source repository, use normal repository tools and do not run REA
 readiness or provider commands.

+## Connect only when needed
+
+Installing this skill supplies instructions; it does not register the REA MCP
+server, install analysis engines, or add tools to an already-running agent.
+
+If REA tools are available and their registration is not known to be stale,
+proceed directly to the target. Do not run diagnostics or setup before every
+investigation. Use the connected server's actual tool list and input schemas;
+a skill installed from repository main may describe capabilities absent from
+an older npm release. Keep complete inline Evidence when that server does not
+advertise retained references.
+
+When tools are absent or registration is stale:
+
+1. Diagnose without changing files. For Codex, run
+   `npx -y rea-agents@latest doctor --client codex --json`. Substitute the current
+   supported client: `claude_code`, `claude_desktop`, `codex`, `cursor`,
+   `gemini_cli`, `windsurf`, `devin`, `opencode`, `antigravity`, `copilot_cli`,
+   `commandcode`, or `vscode`. If the client is unknown, use `doctor --json` and
+   inspect its registration results before choosing a setup scope.
+2. Distinguish the reason. Missing, malformed, or stale registration needs a
+   scoped configuration repair. An aligned registration with no tools in the
+   active session needs a restart/reconnection; doctor cannot prove that the
+   current agent has connected. A missing provider affects only tasks requiring
+   that provider: static JavaScript inspection needs neither Hopper nor Ghidra,
+   and Android inspection has separate bring-your-own JADX/Java prerequisites.
+3. For a configuration repair, prepare the read-only plan:
+   `npx -y rea-agents@latest setup --client codex --dry-run --json`.
+   Use the current client's ID, show its exact proposed paths, backups, and
+   changes, and obtain approval before setup writes configuration or installs
+   Hopper. Setup normally installs the matching bundled skill too; include that
+   replacement in the reviewed plan. After approval, apply the same scope with
+   `npx -y rea-agents@latest setup --client codex --yes`. Add `--install-hopper`
+   only if that separate installation was needed and explicitly approved.
+4. Restart/reconnect the affected agent. Verify that REA tools actually appear
+   in the session, then resume the original investigation. If they remain
+   absent, inspect the client's MCP launch error rather than repeating setup.
+
+REA setup never installs or upgrades Node.js, npm, Homebrew, Java, Ghidra, IDA,
+JADX, Binwalk, or Unblob. Use existing prerequisites; do not install unrelated
+software to repair
+MCP registration. For an unsupported client, use manual stdio registration
+with a version-pinned `rea-agents` package or continue through the CLI.
+
+A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+No MCP registration or native engine is required. Read the returned Evidence,
+graph, limitations, and unknowns with the same care as an MCP result; the CLI
+returns the Evidence record directly. This fallback does not establish that
+MCP is configured. Native CLI tasks still require their selected engine.
+
 ## Route the target first

-Choose the first tool from the target the user supplied. Do not call
-`open_binary` unless the target is native or an analysis database.
+Choose the first tool from the target the user supplied. Use `open_binary` for
+active-target native or archive workflows; target-free tools take their own
+explicit path or endpoint and do not need it.

 - ASAR or extracted JavaScript/Electron tree:
  `analyze_javascript_application`.
- Archive, application package, ZIP/APK/IPA/MSIX/AppX, or DMG:
+- Archive/package member inventory (ZIP/APK/IPA/MSIX/AppX or DMG):
  `open_binary` with the supplied local path; use `inspect_artifact` when its
  graph and findings help answer the question.
+- Android APK code, classes, methods, or incoming references:
+  `inspect_android_package`, then focused Android tools when advertised.
+  Archive member inventory still uses the archive route above.
 - Managed PE/CLI assembly: `inspect_managed_artifact`.
+- Firmware image: `inspect_firmware_regions` when advertised. Use
+  `extract_firmware` when extraction is requested, with a caller-selected new
+  absolute output directory. These tools use caller-supplied Binwalk/Unblob on
+  Linux; see the [firmware guide](https://github.com/morluto/rea/blob/main/docs/firmware-analysis.md).
+- .NET NativeAOT PE/ELF: native Ghidra analysis. Native code can yield pseudocode;
+  consult the NativeAOT workflow in `references/native-and-artifacts.md` for
+  optional metadata recovery and its supported host/layout boundary.
 - User-owned browser page already open: `list_browser_targets`.
 - User-owned Electron runtime already open: `list_electron_targets`.
 - Native executable, library, or analysis database: `open_binary`, then
  use focused analysis tools directly; call `binary_overview` when metadata or
-  inventory context is useful.
+  inventory context is useful and available from the selected provider.
+
+For an existing IDA MCP configuration, use `open_binary` with the original
+input binary and `provider_id: "ida"`; do not pass an `.idb` or `.i64` database.
+The legacy attached profile binds the already-open GUI input by SHA-256 and
+leaves its database open. The modern headless profile creates and closes an
+owned private database without saving. Installation and registration reuse
+[mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp); see the
+[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/ida-provider.md).
+Proceed directly to `analyze_function`, pseudocode, or function/string searches
+after opening; IDA does not supply `binary_overview`. Consult session availability
+when composing broader workflows. Modern direct callers and unsupported dossier
+facets remain unknown; live IDA results are not replayed from snapshots.

 If the app is missing, ask which app to inspect. Resolve a human-readable app
 name to one clear installed artifact when possible; ask only when matches are
 ambiguous. Never choose an example app on the user's behalf.

 In a target-free session, use `open_binary` to bind any archive/package or
-native target whose analysis tool operates on the active target. Do not call a
-tool hidden from `tools/list`; inspect `binary_session` with
-`detail: "capabilities"` for the exact remediation when a desired capability
-is unavailable.
+native target whose analysis tool operates on the active target. Do not call an
+unadvertised tool; inspect `binary_session` with `{}` and its
+`result.tool_availability` for availability reasons and remediation. The tool
+list stays complete; availability depends on the operation, target, and host.

 ## Work summary-first

@@ -98,23 +176,13 @@ as complete while required questions remain open.
  [references/native-and-artifacts.md](references/native-and-artifacts.md)
 - ASARs, extracted JavaScript, feature tracing, and version comparison:
  [references/javascript-applications.md](references/javascript-applications.md)
+- Android APK declarations, classes, methods, and static references:
+  [references/android-applications.md](references/android-applications.md)
 - Passive browser/Electron observation and static/runtime reconciliation:
  [references/runtime-observation.md](references/runtime-observation.md)
 - Evidence paging, comparisons, residual unknowns, and verification:
  [references/evidence-workflows.md](references/evidence-workflows.md)

-## Readiness and setup
-
-The readiness rule is conditional: when REA tools are available and their
-registration is not known to be stale, proceed directly; do not run `doctor`
-before every task. Run `npx -y rea-agents@latest doctor` when the MCP server or
-required provider is unavailable, registration is reported stale, or the user
-asks for an environment diagnosis. Propose
-`npx -y rea-agents@latest setup` only when doctor identifies an alignment or
-provider problem. Show the exact plan and obtain approval before setup writes
-configuration or installs Hopper. Restart the agent after MCP registration
-changes; direct CLI commands remain available immediately.
-
 ## Finish the task

 Explain findings in plain language and tie them to returned evidence. When the
@@ -0,0 +1,31 @@
+# Android application artifacts
+
+Use the connected server's advertised Android tools. Repository main includes
+this family; npm 4.0.1 does not. A skill installation alone cannot add it to an
+older server.
+
+Start with `inspect_android_package` on the caller's APK path for package
+identity, manifest declarations, coverage, and inline Evidence. Use
+`search_android_classes` to find candidates, `inspect_android_class` for one
+class's members, `inspect_android_method` for decompilation, and
+`trace_android_references` for incoming static references. Each call takes its
+own APK path and explicit selectors; do not open a native session first.
+Choose an `overload_index` from the class inventory when methods are ambiguous
+instead of guessing.
+
+The provider requires a separately supplied headless JADX MCP JAR 0.7.1 and
+Java 17 or newer. `REA_JADX_MCP_JAR` selects the absolute JAR path; `JAVA_HOME`
+can select Java. REA setup does not install or configure that JAR, and doctor
+provider scopes cover Hopper/Ghidra rather than JADX. Use existing tools and
+report missing prerequisites for the Android task specifically.
+
+Real verification covers Linux. macOS has the POSIX launch boundary but no
+claimed real-provider verification; Windows is unsupported. Calls use one
+worker, a bounded JVM heap, and provider deadlines. The APK is never launched,
+and no emulator is required.
+
+Manifest entries and decompiled text are static observations, not execution or
+policy enforcement. Incoming references are recovered static relationships;
+reflection, dynamic loading, and unresolved calls remain unknown. Preserve
+artifact digests, locations, diagnostics, and incomplete coverage. For archive
+members rather than code analysis, use `open_binary` and `inspect_artifact`.
@@ -15,7 +15,9 @@ registration, defaults, or policy enforcement from static analysis.

 Use `trace_application_feature` on existing application Evidence for one
 literal node ID, route, string, API, IPC channel, module, or native export.
-Choose a direction and include the complete application Evidence inline. Include
+Choose a direction and reuse the returned application Evidence ID when the
+connected server advertises retained references, or supply complete Evidence
+inline. Include
 Hopper or Ghidra Evidence only when its artifact digest matches exactly.

 For version comparison, analyze each version once, then call
@@ -27,10 +29,25 @@ opposite-side coverage; otherwise report unknown.
 When the question asks how one exact exported callable's returned object shape
 changed, analyze each version once and then call
 `compare_javascript_export_shapes` with explicit module paths and export names.
-Include the complete Evidence records from both analysis calls. Accept variant
+Use the returned IDs on the same connection, or complete inline Evidence
+records, from both analysis calls. Accept variant
 pairing only through the tool's unique exact literal discriminant. Cite the
 comparison Evidence and report JSON Pointer changes; dynamic values, ambiguous
 variants, and incomplete parent-property coverage stay unknown. This is static
 inference, not runtime behavior. When runtime semantics are needed, run
 behavioral probes against the relevant application versions and capture them
 through the available browser, Electron, or process workflows.
+
+## Reusing application Evidence
+
+When advertised by the connected server, application trace and compare tools
+accept complete inline Evidence or
+`{"kind":"retained-evidence","evidence_id":"ev_<64 lowercase hex characters>"}`
+for their application input (`application`, or `left`/`right`). This notation is
+a template: replace it with the actual returned ID. npm 4.0.1 accepts only full
+inline Evidence. Use the exact ID
+returned by the producer on the same MCP connection. Resolution does not run
+analysis or select a provider; findings remain inline. Native observation
+arrays still take full Evidence. `close_binary` clears retained references;
+export a bundle before closing, or supply portable inline Evidence in another
+connection. A missing reference includes its ID and recovery guidance.
@@ -37,6 +37,30 @@ assembly. Keep managed/native boundaries and unavailable reconstruction facts
 explicit. A bring-your-own reconstruction oracle is separate from the canonical
 parser and must not become an implicit setup dependency.

+## .NET NativeAOT
+
+A NativeAOT PE/ELF contains native code. Absence of PE/CLI metadata does not mean
+analysis must stop at assembly. Use native function analysis for recovered
+pseudocode; it is not reconstructed original C#.
+
+With an explicitly configured NativeAOT Ghidra adapter, call
+`inspect_native_load_image` after opening the target. Its optional
+`observations.metadata_recovery` returns the format, positive header evidence,
+coverage, derived-memory identity and type addresses/category paths inline.
+Then inspect a reported type with `inspect_native_data_type`, follow its
+`metadata_recovery.related_type`, interfaces and virtual slot addresses, and use
+`analyze_function` plus string/xref searches for implementation evidence. Keep
+`not_applicable`, partial recovery and unsupported layouts explicit. Generated
+`Class_address` names and inferred System.Object/String identities are not
+original names; custom field layouts remain unknown.
+
+Recovery modifies an ephemeral analysis database and may replace loaded metadata
+bytes with derived content. Original executable files remain unchanged. Distinguish
+original file offsets from derived analysis memory. Windows x64 PE **targets**
+can be analyzed on a supported Linux host; Windows **host** P0 does not admit
+this database recovery. See the [NativeAOT guide](https://github.com/morluto/rea/blob/main/docs/ghidra-nativeaot.md)
+for the tested layout and optional bring-your-own adapter build.
+
 ## Packages and extraction

 Use `inspect_artifact` for application bundles, archives, ZIP/APK/IPA/MSIX/AppX,
@@ -59,7 +83,7 @@ separate filesystem-writing operation.
 For headerless DOS COM, explicitly open with `format: "dos-com"` (CLI
 `--target-format dos-com`). Inspect the load image before trusting function
 analysis: the entry is `0x10100`, file offset zero, with imposed real-mode segment
-context. PSP/stack/device state remains unmodeled. See [DOS guide](../../../docs/ghidra-dos.md).
+context. PSP/stack/device state remains unmodeled. See [DOS guide](https://github.com/morluto/rea/blob/main/docs/ghidra-dos.md).

 ### Function annotations in Ghidra

@@ -0,0 +1,46 @@
+import { constants, createReadStream } from "node:fs";
+import { chmod, copyFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import type { AndroidOperation } from "../domain/androidAnalysis.js";
+
+/** Stream a local file digest without retaining the APK or JAR in memory. */
+export const hashAndroidFile = async (path: string): Promise<string> => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+};
+
+/** Bind decompiler input to the admitted artifact, even if the original changes. */
+export const snapshotAndroidTarget = async (
+  path: string,
+  sha256: string,
+  root: string,
+  operation: AndroidOperation,
+): Promise<string> => {
+  const snapshot = join(root, "target.apk");
+  await copyFile(path, snapshot, constants.COPYFILE_EXCL);
+  await chmod(snapshot, 0o400);
+  if ((await hashAndroidFile(snapshot)) !== sha256)
+    throw new AnalysisInputError(operation, undefined, [
+      {
+        path: ["path"],
+        reason: "invalid_value",
+        message:
+          "APK bytes changed after admission; retry against a stable file.",
+      },
+    ]);
+  return snapshot;
+};
+
+/** Fingerprint the actual immutable engine bytes executed for this observation. */
+export const snapshotAndroidEngine = async (
+  source: string,
+  root: string,
+): Promise<{ path: string; sha256: string }> => {
+  const path = join(root, "engine.jar");
+  await copyFile(source, path, constants.COPYFILE_EXCL);
+  await chmod(path, 0o400);
+  return { path, sha256: await hashAndroidFile(path) };
+};
@@ -0,0 +1,351 @@
+import type { z } from "zod";
+import type { AndroidRequest } from "../domain/androidAnalysis.js";
+import { androidResultSchemas } from "../domain/androidAnalysis.js";
+import {
+  AnalysisCapabilityUnavailableError,
+  AnalysisInputError,
+  AnalysisOutputError,
+} from "../domain/analysisErrorCore.js";
+import type { JsonValue } from "../domain/jsonValue.js";
+import {
+  jadxAppSchema,
+  jadxClassPageSchema,
+  jadxClassSchema,
+  jadxLoadSchema,
+  jadxMethodSchema,
+  jadxXrefsSchema,
+  normalizeJadxText,
+} from "./JadxProtocol.js";
+
+/** The adapter consumes tool payloads, never provider RPC details outside this layer. */
+export interface JadxToolPort {
+  json(
+    name: string,
+    input: Readonly<Record<string, JsonValue>>,
+  ): Promise<JsonValue>;
+  text(
+    name: string,
+    input: Readonly<Record<string, JsonValue>>,
+  ): Promise<string>;
+}
+
+type Engine = z.infer<
+  typeof androidResultSchemas.inspect_android_package
+>["engine"];
+type ClassSummary = z.infer<typeof jadxClassSchema>;
+
+const methodsOf = (summary: ClassSummary) => {
+  const seen = new Map<string, number>();
+  return summary.methods.map((method) => {
+    const index = seen.get(method.name) ?? 0;
+    seen.set(method.name, index + 1);
+    return {
+      name: method.name,
+      reported_signature: method.signature,
+      overload_index: index,
+      is_constructor: method.is_constructor,
+      dex_descriptor: null,
+    };
+  });
+};
+
+const inputFailure = (
+  request: AndroidRequest,
+  field: string,
+  message: string,
+): never => {
+  throw new AnalysisInputError(request.operation, undefined, [
+    { path: [field], reason: "invalid_value", message },
+  ]);
+};
+
+const classSummary = async (
+  tools: JadxToolPort,
+  request: Exclude<
+    AndroidRequest,
+    { operation: "inspect_android_package" | "search_android_classes" }
+  >,
+): Promise<ClassSummary> => {
+  const raw = await tools.json("get_class_summary", {
+    class_name: request.input.class_name,
+  });
+  if (
+    raw !== null &&
+    typeof raw === "object" &&
+    !Array.isArray(raw) &&
+    typeof raw.error === "string"
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      `JADX class summary failed: ${raw.error}`,
+    );
+  const summary = jadxClassSchema.safeParse(raw);
+  if (!summary.success)
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX class summary failed or was malformed; negative counts are not an empty class",
+      { cause: summary.error },
+    );
+  const value = summary.data;
+  if (value.full_name !== request.input.class_name)
+    inputFailure(
+      request,
+      "class_name",
+      `Exact class ${request.input.class_name} resolved to ${value.full_name}; use the fully qualified class name from search_android_classes.`,
+    );
+  if (
+    value.method_count !== value.methods.length ||
+    value.field_count !== value.fields.length ||
+    value.inner_class_count !== value.inner_classes.length
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX class member counts do not match the returned inventory",
+    );
+  return value;
+};
+
+const inspectPackage = async (
+  tools: JadxToolPort,
+  loaded: z.infer<typeof jadxLoadSchema>,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const app = jadxAppSchema.parse(await tools.json("get_app_info", {}));
+  const manifest = normalizeJadxText(
+    await tools.text("get_android_manifest", {}),
+  );
+  return androidResultSchemas.inspect_android_package.parse({
+    engine,
+    package_name: app.package || null,
+    version_name: app.version_name || null,
+    version_code: app.version_code || null,
+    min_sdk: app.min_sdk || null,
+    target_sdk: app.target_sdk || null,
+    permissions: app.permissions,
+    manifest,
+    class_count: loaded.class_count,
+    resource_count: loaded.resource_count,
+    signature_verification: "not_performed",
+  });
+};
+
+const searchClasses = async (
+  tools: JadxToolPort,
+  request: Extract<AndroidRequest, { operation: "search_android_classes" }>,
+  loaded: z.infer<typeof jadxLoadSchema>,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const classes: string[] = [];
+  let total: number | undefined;
+  do {
+    const page = jadxClassPageSchema.parse(
+      await tools.json("list_classes", {
+        offset: classes.length,
+        limit: 200,
+      }),
+    );
+    if (
+      (total !== undefined && total !== page.total) ||
+      page.offset !== classes.length ||
+      page.limit !== 200 ||
+      page.items.length > 200
+    )
+      throw new AnalysisOutputError(
+        request.operation,
+        "JADX class pagination changed identity or counts",
+      );
+    total = page.total;
+    classes.push(...page.items);
+    if (
+      classes.length > total ||
+      (page.items.length === 0 && classes.length < total)
+    )
+      throw new AnalysisOutputError(
+        request.operation,
+        "JADX class pagination is incomplete",
+      );
+  } while (classes.length < total);
+  if (new Set(classes).size !== classes.length || total !== loaded.class_count)
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX class inventory is duplicated or differs from the loaded class count",
+    );
+  return androidResultSchemas.search_android_classes.parse({
+    engine,
+    query: request.input.query,
+    total_classes: total,
+    matches: classes.filter((name) => name.includes(request.input.query)),
+    coverage: "complete",
+  });
+};
+
+const matchingMethods = (
+  summary: ClassSummary,
+  request: Extract<
+    AndroidRequest,
+    { operation: "inspect_android_method" | "trace_android_references" }
+  >,
+) => {
+  const candidates = methodsOf(summary).filter(
+    (method) => method.name === request.input.method_name,
+  );
+  if (request.input.method_name !== undefined && candidates.length === 0)
+    inputFailure(
+      request,
+      "method_name",
+      `Method ${summary.full_name}.${request.input.method_name} was not found; inspect_android_class lists available methods.`,
+    );
+  return candidates;
+};
+
+const inspectMethod = async (
+  tools: JadxToolPort,
+  request: Extract<AndroidRequest, { operation: "inspect_android_method" }>,
+  summary: ClassSummary,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const candidates = matchingMethods(summary, request);
+  if (candidates.length > 1 && request.input.overload_index === undefined)
+    inputFailure(
+      request,
+      "overload_index",
+      `Select one of ${candidates.length} overloads: ${candidates.map((method) => `${method.overload_index}: ${method.reported_signature}`).join("; ")}`,
+    );
+  const index = request.input.overload_index ?? 0;
+  const selected = candidates[index];
+  if (selected === undefined)
+    inputFailure(
+      request,
+      "overload_index",
+      `Index ${index} is outside the ${candidates.length} matching overloads.`,
+    );
+  const body = jadxMethodSchema.parse(
+    await tools.json("get_method_body", {
+      class_name: summary.full_name,
+      method_name: request.input.method_name,
+      overload_index: index,
+      smali_fallback: true,
+    }),
+  );
+  if (
+    body.class_name !== summary.full_name ||
+    body.method_name !== request.input.method_name ||
+    body.overload_index !== index ||
+    body.overload_count !== candidates.length
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX returned a different method or overload inventory",
+    );
+  if (body.body.startsWith("// ERROR:"))
+    throw new AnalysisOutputError(
+      request.operation,
+      `JADX did not produce method source: ${body.body}`,
+    );
+  if (body.mode === "smali" && candidates.length > 1)
+    throw new AnalysisCapabilityUnavailableError(
+      "jadx",
+      request.operation,
+      `JADX 0.7.1 smali fallback joins all same-name overloads for ${summary.full_name}.${request.input.method_name}; it cannot establish source for only overload ${index}.`,
+    );
+  return androidResultSchemas.inspect_android_method.parse({
+    engine,
+    class_name: summary.full_name,
+    method: selected,
+    overload_count: candidates.length,
+    representation: body.mode,
+    body_status:
+      body.body.length === 0 ||
+      body.body ===
+        "// method exists but has no decompiled body (native/abstract)"
+        ? "not_available"
+        : "available",
+    fell_back: body.fell_back,
+    markers: body.markers,
+    source: normalizeJadxText(body.body),
+  });
+};
+
+/** Normalize only the selected analyst outcome and reject ambiguous engine selectors. */
+export const analyzeJadxRequest = async (
+  tools: JadxToolPort,
+  request: AndroidRequest,
+  loaded: z.infer<typeof jadxLoadSchema>,
+  engine: Engine,
+): Promise<JsonValue> => {
+  if (request.operation === "inspect_android_package")
+    return inspectPackage(tools, loaded, engine);
+  if (request.operation === "search_android_classes")
+    return searchClasses(tools, request, loaded, engine);
+  const summary = await classSummary(tools, request);
+  if (request.operation === "inspect_android_class")
+    return androidResultSchemas.inspect_android_class.parse({
+      engine,
+      class_name: summary.full_name,
+      methods: methodsOf(summary),
+      fields: summary.fields.map((field) => ({
+        name: field.name,
+        reported_type: field.type,
+      })),
+      inner_classes: summary.inner_classes,
+    });
+  if (request.operation === "inspect_android_method")
+    return inspectMethod(tools, request, summary, engine);
+  return traceReferences(tools, request, summary, engine);
+};
+
+const traceReferences = async (
+  tools: JadxToolPort,
+  request: Extract<AndroidRequest, { operation: "trace_android_references" }>,
+  summary: ClassSummary,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const methodName = request.input.method_name;
+  const candidates = matchingMethods(summary, request);
+  if (candidates.length > 1)
+    throw new AnalysisCapabilityUnavailableError(
+      "jadx",
+      request.operation,
+      `JADX 0.7.1 references select the first same-name method; ${summary.full_name}.${methodName} has ${candidates.length} overloads. No unambiguous reference result is available.`,
+    );
+  const expectedTarget =
+    methodName === undefined
+      ? summary.full_name
+      : `${summary.full_name}.${methodName}`;
+  const xrefs = jadxXrefsSchema.parse(
+    await tools.json(
+      methodName === undefined ? "get_xrefs_to_class" : "get_xrefs_to_method",
+      {
+        class_name: summary.full_name,
+        ...(methodName === undefined ? {} : { method_name: methodName }),
+        limit: 2_147_483_647,
+        resolve_line: false,
+      },
+    ),
+  );
+  if (
+    xrefs.target !== expectedTarget ||
+    xrefs.total !== xrefs.count ||
+    xrefs.count !== xrefs.items.length
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX references are incomplete or refer to another target",
+    );
+  return androidResultSchemas.trace_android_references.parse({
+    engine,
+    class_name: summary.full_name,
+    method_name: methodName ?? null,
+    total: xrefs.total,
+    references: xrefs.items.map((reference) => ({
+      kind: reference.kind,
+      name: reference.name,
+      reported_full_name: reference.full_name,
+      containing_class: reference.containing_class,
+      top_class: reference.top_class,
+      source_line: null,
+      dex_offset: null,
+    })),
+    coverage: "complete",
+  });
+};
@@ -0,0 +1,60 @@
+import { access, realpath, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import type { AndroidOperation } from "../domain/androidAnalysis.js";
+
+/** Caller-supplied tools, resolved only when an Android operation is selected. */
+export interface JadxConfiguration {
+  readonly jar: string;
+  readonly java: string;
+}
+
+/** Admit explicit local tooling without installing or changing host configuration. */
+export const resolveJadxConfiguration = async (
+  environment: Readonly<Record<string, string | undefined>>,
+  operation: AndroidOperation,
+): Promise<JadxConfiguration> => {
+  const unavailable = (reason: string) =>
+    new AnalysisCapabilityUnavailableError("jadx", operation, reason);
+  if (process.platform !== "linux" && process.platform !== "darwin")
+    throw unavailable(
+      `Android JADX subprocess ownership is unsupported on ${process.platform}; use Linux or macOS. Only Linux has real-provider verification.`,
+    );
+  const jar = environment.REA_JADX_MCP_JAR;
+  if (environment.JAVA_HOME !== undefined && !isAbsolute(environment.JAVA_HOME))
+    throw unavailable(
+      "JAVA_HOME must select an existing JDK by absolute path; omit it to use java on PATH.",
+    );
+  if (jar === undefined || !isAbsolute(jar))
+    throw unavailable(
+      "Set REA_JADX_MCP_JAR to the absolute path of a caller-supplied jadx-headless-mcp 0.7.1 JAR. REA does not download or install it.",
+    );
+  const java =
+    environment.JAVA_HOME === undefined
+      ? "java"
+      : join(environment.JAVA_HOME, "bin", "java");
+  try {
+    await access(jar, constants.R_OK);
+    if (!(await stat(jar)).isFile())
+      throw unavailable(`REA_JADX_MCP_JAR is not a regular file: ${jar}`);
+  } catch (cause) {
+    if (cause instanceof AnalysisCapabilityUnavailableError) throw cause;
+    throw unavailable(
+      `Cannot read REA_JADX_MCP_JAR ${jar}: ${cause instanceof Error ? cause.message : String(cause)}`,
+    );
+  }
+  if (environment.JAVA_HOME !== undefined) {
+    try {
+      await access(java, constants.R_OK | constants.X_OK);
+      if (!(await stat(java)).isFile())
+        throw unavailable(`JAVA_HOME java is not a regular file: ${java}`);
+    } catch (cause) {
+      if (cause instanceof AnalysisCapabilityUnavailableError) throw cause;
+      throw unavailable(
+        `Cannot execute JAVA_HOME java ${java}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      );
+    }
+  }
+  return { jar: await realpath(jar), java };
+};
@@ -0,0 +1,183 @@
+import {
+  deserializeMessage,
+  serializeMessage,
+  type JSONRPCMessage,
+  type Transport,
+} from "@modelcontextprotocol/client";
+import { randomUUID } from "node:crypto";
+import type {
+  OwnedProviderProcessSpawnOptions,
+  SpawnedOwnedProviderProcess,
+} from "../process/ProviderProcess.js";
+import {
+  ProviderProcessSupervisor,
+  spawnOwnedProviderProcess,
+} from "../process/ProviderProcess.js";
+import { cleanupOwnedProcessGroup } from "../process/ProcessOwnership.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+
+const MAX_FRAME_BYTES = 8 * 1024 * 1024;
+const MAX_SESSION_BYTES = 32 * 1024 * 1024;
+
+/** Injectable process acquisition seam; the production launcher owns a POSIX group. */
+export type JadxLauncher = (
+  options: OwnedProviderProcessSpawnOptions,
+) => Promise<SpawnedOwnedProviderProcess>;
+
+/** SDK-framed stdio with REA-owned process cleanup rather than an unowned child. */
+export class JadxMcpTransport implements Transport {
+  onclose: Transport["onclose"];
+  onerror: Transport["onerror"];
+  onmessage: Transport["onmessage"];
+  readonly runId = randomUUID();
+  #spawned: SpawnedOwnedProviderProcess | undefined;
+  #supervisor: ProviderProcessSupervisor | undefined;
+  #buffer = Buffer.alloc(0);
+  #bytes = 0;
+  #started = false;
+  #closed = false;
+  #closePromise: Promise<void> | undefined;
+  #starting: Promise<void> | undefined;
+  #failure: string | null = null;
+
+  constructor(
+    readonly options: Omit<OwnedProviderProcessSpawnOptions, "runId" | "stdin">,
+    readonly launcher: JadxLauncher = spawnOwnedProviderProcess,
+  ) {}
+
+  /** Acquires exactly one protocol process after the SDK installs callbacks. */
+  start(): Promise<void> {
+    if (this.#started || this.#closed)
+      throw new Error("JADX transport cannot be restarted");
+    this.#started = true;
+    this.#starting = this.#acquire();
+    return this.#starting;
+  }
+
+  async #acquire(): Promise<void> {
+    const spawned = await this.launcher({
+      ...this.options,
+      runId: this.runId,
+      stdin: "pipe",
+    });
+    this.#spawned = spawned;
+    this.#supervisor = new ProviderProcessSupervisor({
+      ...spawned,
+      ownsProcessLifetime: true,
+      cleanup:
+        spawned.cleanup ?? (() => cleanupOwnedProcessGroup(spawned.ownership)),
+    });
+    if (
+      spawned.process.stdin === undefined ||
+      spawned.process.stdin === null ||
+      spawned.process.stdout === null
+    )
+      throw new Error("JADX launcher did not supply protocol stdin/stdout");
+    spawned.process.stdout.on("data", this.#read);
+    spawned.process.stderr?.on("data", this.#countStderr);
+    spawned.process.on("error", this.#error);
+    spawned.process.once("exit", this.#exit);
+    spawned.process.stdin.on("error", this.#error);
+    if (this.#closed) throw new Error("JADX transport closed during startup");
+  }
+
+  /** Writes SDK-serialized messages and observes stream backpressure. */
+  async send(message: JSONRPCMessage): Promise<void> {
+    const input = this.#spawned?.process.stdin;
+    if (this.#closed || input === undefined || input === null)
+      throw new Error("JADX protocol process is not writable");
+    await new Promise<void>((resolve, reject) => {
+      input.write(serializeMessage(message), (cause) =>
+        cause === null || cause === undefined ? resolve() : reject(cause),
+      );
+    });
+  }
+
+  /** Verifies owned process exit before declaring the transport closed. */
+  close(): Promise<void> {
+    this.#closePromise ??= this.#stop();
+    return this.#closePromise;
+  }
+
+  /** Captured provider stderr without persisting inherited environment values. */
+  diagnostics(): string {
+    return this.#supervisor?.snapshot().stderr.text ?? "";
+  }
+
+  /** Preserve the failed protocol/resource constraint after the SDK closes requests. */
+  failureReason(): string | null {
+    return this.#failure;
+  }
+
+  async #stop(): Promise<void> {
+    this.#closed = true;
+    // A cancellation may race acquisition. Join it before inspecting ownership.
+    await this.#starting?.catch(() => undefined);
+    const process = this.#spawned?.process;
+    process?.stdout?.off("data", this.#read);
+    process?.stderr?.off("data", this.#countStderr);
+    process?.off("error", this.#error);
+    process?.off("exit", this.#exit);
+    process?.stdin?.off("error", this.#error);
+    const stopped = await this.#supervisor?.stop();
+    this.onclose?.();
+    if (stopped?.status === "incomplete")
+      throw new ProviderCleanupError("jadx", [this.runId], {
+        reason: stopped.reason,
+        stderr: this.diagnostics(),
+      });
+  }
+
+  readonly #error = (error: Error): void => {
+    this.onerror?.(error);
+  };
+  readonly #exit = (): void => {
+    this.onclose?.();
+  };
+  readonly #countStderr = (chunk: Buffer | string): void => {
+    this.#bytes += Buffer.byteLength(chunk);
+    if (this.#bytes > MAX_SESSION_BYTES)
+      this.#fail(
+        new Error(
+          `JADX session output exceeds ${MAX_SESSION_BYTES} bytes; no complete result is available`,
+        ),
+      );
+  };
+  readonly #read = (chunk: Buffer | string): void => {
+    if (this.#closed) return;
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    this.#bytes += bytes.length;
+    if (this.#bytes > MAX_SESSION_BYTES) {
+      this.#fail(
+        new Error(
+          `JADX session output exceeds ${MAX_SESSION_BYTES} bytes; no complete result is available`,
+        ),
+      );
+      return;
+    }
+    this.#buffer = Buffer.concat([this.#buffer, bytes]);
+    try {
+      let newline: number;
+      while ((newline = this.#buffer.indexOf(10)) !== -1) {
+        if (newline > MAX_FRAME_BYTES)
+          throw new Error(`JADX MCP frame exceeds ${MAX_FRAME_BYTES} bytes`);
+        const line = this.#buffer.subarray(0, newline).toString("utf8");
+        this.#buffer = this.#buffer.subarray(newline + 1);
+        this.onmessage?.(deserializeMessage(line));
+      }
+      if (this.#buffer.length > MAX_FRAME_BYTES)
+        throw new Error(`JADX MCP frame exceeds ${MAX_FRAME_BYTES} bytes`);
+    } catch (cause) {
+      this.#fail(cause instanceof Error ? cause : new Error(String(cause)));
+    }
+  };
+  #fail(error: Error): void {
+    this.#failure ??= error.message;
+    this.onerror?.(error);
+    // Closing immediately rejects the SDK's outstanding request. The owner
+    // awaits close again and retains a cleanup failure in the returned Result.
+    void this.close().catch((cause: unknown) =>
+      this.onerror?.(cause instanceof Error ? cause : new Error(String(cause))),
+    );
+  }
+}
@@ -0,0 +1,134 @@
+import { z } from "zod";
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import type { AndroidOperation } from "../domain/androidAnalysis.js";
+
+const count = z.number().int().nonnegative();
+export const jadxLoadSchema = z.object({
+  state: z.literal("LOADED"),
+  apk_path: z.string(),
+  class_count: count,
+  resource_count: count,
+  threads: z.literal(1),
+  resources: z.literal("full"),
+});
+export const jadxAppSchema = z.object({
+  package: z.string(),
+  version_name: z.string(),
+  version_code: z.string(),
+  min_sdk: z.string(),
+  target_sdk: z.string(),
+  permissions: z.array(z.string()),
+});
+export const jadxClassPageSchema = z.object({
+  total: count,
+  offset: count,
+  limit: count,
+  items: z.array(z.string()),
+});
+export const jadxClassSchema = z.object({
+  full_name: z.string(),
+  name: z.string(),
+  method_count: count,
+  field_count: count,
+  inner_class_count: count,
+  methods: z.array(
+    z.object({
+      name: z.string(),
+      signature: z.string(),
+      is_constructor: z.boolean(),
+      def_pos: z.number().int(),
+    }),
+  ),
+  fields: z.array(
+    z.object({ name: z.string(), type: z.string(), def_pos: z.number().int() }),
+  ),
+  inner_classes: z.array(z.string()),
+});
+export const jadxMethodSchema = z.object({
+  class_name: z.string(),
+  method_name: z.string(),
+  full_name: z.string(),
+  overload_index: count,
+  overload_count: count,
+  mode: z.enum(["java", "smali"]),
+  fell_back: z.boolean(),
+  markers: z.array(z.string()),
+  body: z.string(),
+});
+export const jadxXrefsSchema = z.object({
+  target: z.string(),
+  total: count,
+  count,
+  resolve_line: z.literal(false),
+  items: z.array(
+    z.object({
+      kind: z.string(),
+      name: z.string(),
+      full_name: z.string(),
+      containing_class: z.string(),
+      top_class: z.string(),
+      def_pos: z.number().int(),
+    }),
+  ),
+});
+const toolResponse = z.object({
+  content: z
+    .array(z.object({ type: z.literal("text"), text: z.string() }))
+    .length(1),
+  isError: z.boolean().optional(),
+});
+
+/** Parse the upstream text-only envelope, preserving errors at the producing boundary. */
+export const parseJadxEnvelope = (
+  response: unknown,
+  operation: AndroidOperation,
+): { text: string; failed: boolean } => {
+  const parsed = toolResponse.safeParse(response);
+  if (!parsed.success || parsed.data.content[0] === undefined)
+    throw new AnalysisOutputError(
+      operation,
+      "JADX returned an unsupported MCP content envelope",
+    );
+  return {
+    text: parsed.data.content[0].text,
+    failed: parsed.data.isError === true,
+  };
+};
+
+/** Decode an upstream JSON text payload without trusting its contents. */
+export const parseJadxJson = (
+  text: string,
+  operation: AndroidOperation,
+): z.infer<typeof jsonValueSchema> => {
+  try {
+    return jsonValueSchema.parse(JSON.parse(text));
+  } catch (cause) {
+    throw new AnalysisOutputError(
+      operation,
+      "JADX returned malformed JSON text",
+      { cause },
+    );
+  }
+};
+
+/** Upstream byte truncation is reported rather than promoted to a complete source. */
+export const normalizeJadxText = (
+  text: string,
+): {
+  status: "complete" | "partial";
+  text: string;
+  reported_total_bytes: number | null;
+} => {
+  const marker =
+    /\n\n\.\.\. \[truncated: exceeds (\d+) bytes, total (\d+) bytes\]$/u.exec(
+      text,
+    );
+  const total = marker?.[2] === undefined ? null : Number(marker[2]);
+  return {
+    status: marker === null ? "complete" : "partial",
+    text,
+    reported_total_bytes:
+      total !== null && Number.isSafeInteger(total) ? total : null,
+  };
+};
@@ -0,0 +1,245 @@
+import { z } from "zod";
+import type { AndroidAnalysisPort } from "../application/AndroidAnalysisPort.js";
+import type { ExecutionOptions } from "../application/AnalysisProvider.js";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import {
+  AnalysisCancelledError,
+  AnalysisCapabilityUnavailableError,
+  AnalysisOutputError,
+  AnalysisTimeoutError,
+} from "../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+import type { AndroidRequest } from "../domain/androidAnalysis.js";
+import type { BinaryTarget } from "../domain/binaryTarget.js";
+import { err, ok } from "../domain/result.js";
+import { PrivateRuntimeRoot } from "../process/PrivateRuntimeRoot.js";
+import {
+  snapshotAndroidEngine,
+  snapshotAndroidTarget,
+} from "./AndroidTargetSnapshot.js";
+import { resolveJadxConfiguration } from "./JadxConfiguration.js";
+import type { JadxLauncher } from "./JadxMcpTransport.js";
+import { JadxSession } from "./JadxSession.js";
+
+const OPERATION_TIMEOUT_MS = 120_000;
+type Outcome = Awaited<ReturnType<AndroidAnalysisPort["execute"]>>;
+
+const waitForTurn = (
+  predecessor: Promise<void>,
+  request: AndroidRequest,
+  signal?: AbortSignal,
+): Promise<void> =>
+  new Promise((resolve, reject) => {
+    const abort = () => reject(new AnalysisCancelledError(request.operation));
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted === true) abort();
+    void predecessor.then(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    });
+  });
+
+const executionError = (context: {
+  cause: unknown;
+  request: AndroidRequest;
+  timeout: AbortSignal;
+  signal: AbortSignal | undefined;
+  session: JadxSession | undefined;
+}): AnalysisError => {
+  const { cause, request, timeout, signal, session } = context;
+  if (signal?.aborted === true)
+    return new AnalysisCancelledError(request.operation);
+  if (timeout.aborted)
+    return new AnalysisTimeoutError(request.operation, OPERATION_TIMEOUT_MS);
+  if (cause instanceof AnalysisError) return cause;
+  const protocolFailure = session?.transport.failureReason();
+  if (protocolFailure !== undefined && protocolFailure !== null)
+    return new AnalysisOutputError(request.operation, protocolFailure, {
+      cause,
+    });
+  if (cause instanceof z.ZodError)
+    return new AnalysisOutputError(
+      request.operation,
+      "JADX response violated the pinned upstream protocol",
+      { cause },
+    );
+  return new ProviderAdapterError("jadx", request.operation, {
+    cause,
+    diagnostics: {
+      reason: cause instanceof Error ? cause.message : String(cause),
+      stderr: session?.transport.diagnostics() ?? "",
+    },
+  });
+};
+
+const cleanup = async (
+  session: JadxSession | undefined,
+  root: PrivateRuntimeRoot | undefined,
+  previous: Outcome,
+): Promise<Outcome> => {
+  const diagnostics = {
+    previous_error: previous.ok
+      ? null
+      : { tag: previous.error._tag, message: previous.error.message },
+  };
+  try {
+    await session?.close();
+  } catch (cause) {
+    // Retain an uncertain workspace until the caller can resolve process ownership.
+    return err(
+      new ProviderCleanupError(
+        "jadx",
+        [
+          session?.transport.runId ?? "unknown",
+          ...(root === undefined ? [] : [root.path]),
+        ],
+        {
+          ...diagnostics,
+          reason: cause instanceof Error ? cause.message : String(cause),
+          provider_cleanup:
+            cause instanceof ProviderCleanupError
+              ? (cause.diagnostics ?? null)
+              : null,
+        },
+        { cause },
+      ),
+    );
+  }
+  try {
+    await root?.close();
+  } catch (cause) {
+    return err(
+      new ProviderCleanupError(
+        "jadx",
+        [root?.path ?? "unknown"],
+        {
+          ...diagnostics,
+          reason: cause instanceof Error ? cause.message : String(cause),
+        },
+        { cause },
+      ),
+    );
+  }
+  return previous;
+};
+
+/** One queued engine per REA instance, with a fresh owned workspace for every request. */
+export class JadxProvider implements AndroidAnalysisPort {
+  #tail: Promise<void> = Promise.resolve();
+  #cleanupFailure: AnalysisError | undefined;
+  constructor(
+    readonly environment: Readonly<
+      Record<string, string | undefined>
+    > = process.env,
+    readonly launcher?: JadxLauncher,
+  ) {}
+
+  /** Serialize expensive work and bind both raw and normalized results to the APK. */
+  async execute(
+    target: BinaryTarget,
+    request: AndroidRequest,
+    options?: ExecutionOptions,
+  ): Promise<Outcome> {
+    const predecessor = this.#tail;
+    let release: () => void = () => {};
+    this.#tail = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    try {
+      await waitForTurn(predecessor, request, options?.signal);
+    } catch {
+      void predecessor.then(release);
+      return err(new AnalysisCancelledError(request.operation));
+    }
+    try {
+      if (options?.signal?.aborted === true)
+        return err(new AnalysisCancelledError(request.operation));
+      if (this.#cleanupFailure !== undefined) return err(this.#cleanupFailure);
+      const outcome = await this.#execute(target, request, options);
+      if (!outcome.ok && outcome.error.cleanupIncomplete)
+        this.#cleanupFailure = outcome.error;
+      return outcome;
+    } finally {
+      release();
+    }
+  }
+
+  async #execute(
+    target: BinaryTarget,
+    request: AndroidRequest,
+    options?: ExecutionOptions,
+  ): Promise<Outcome> {
+    const timeout = AbortSignal.timeout(OPERATION_TIMEOUT_MS);
+    const signal =
+      options?.signal === undefined
+        ? timeout
+        : AbortSignal.any([options.signal, timeout]);
+    let root: PrivateRuntimeRoot | undefined;
+    let session: JadxSession | undefined;
+    let outcome: Outcome;
+    try {
+      if (target.format !== "apk")
+        throw new AnalysisCapabilityUnavailableError(
+          "jadx",
+          request.operation,
+          `Target ${target.path} is ${target.format}; provide one standalone APK.`,
+        );
+      const configuration = await resolveJadxConfiguration(
+        this.environment,
+        request.operation,
+      );
+      signal.throwIfAborted();
+      root = await PrivateRuntimeRoot.create({ prefix: "rea-android-" });
+      const engine = await snapshotAndroidEngine(configuration.jar, root.path);
+      const snapshot = await snapshotAndroidTarget(
+        target.path,
+        target.sha256,
+        root.path,
+        request.operation,
+      );
+      signal.throwIfAborted();
+      session = new JadxSession(
+        {
+          command: configuration.java,
+          arguments: [
+            "-Xmx512m",
+            "-XX:ActiveProcessorCount=1",
+            "-jar",
+            engine.path,
+            "--threads",
+            "1",
+            "--max-source-bytes",
+            "1048576",
+            "--decompile-timeout-ms",
+            "90000",
+          ],
+          cwd: root.path,
+          hostEnvironment: this.environment,
+          env: { _JAVA_OPTIONS: "-Xmx512m -XX:ActiveProcessorCount=1" },
+        },
+        this.launcher,
+      );
+      outcome = ok(
+        await session.execute({
+          request,
+          target,
+          snapshot,
+          jarHash: engine.sha256,
+          signal,
+        }),
+      );
+    } catch (cause) {
+      outcome = err(
+        executionError({
+          cause,
+          request,
+          timeout,
+          signal: options?.signal,
+          session,
+        }),
+      );
+    }
+    return cleanup(session, root, outcome);
+  }
+}
@@ -0,0 +1,21 @@
+/** Audited upstream release; source remains unmodified in the Git submodule. */
+export const JADX_RELEASE = Object.freeze({
+  version: "0.7.1",
+  revision: "5844800a486d2248fa949b74c9896285f5b54de2",
+  sha256: "6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75",
+  url: "https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar",
+});
+
+/** Producing engine identity used by Evidence and the generated product catalog. */
+export const JADX_PROVIDER_IDENTITY = Object.freeze({
+  id: "jadx",
+  name: "JADX headless",
+  version: JADX_RELEASE.version,
+});
+
+/** Audited engine coverage, kept outside portable Android semantics. */
+export const JADX_LIMITATIONS = [
+  "Static decompiler observations do not establish runtime behavior; the APK is never executed.",
+  "Method signatures use provider display types; exact DEX descriptors and instruction offsets are unavailable. Overload indices are local to this engine and artifact.",
+  "Manifest summary fields are extracted by the upstream engine; decoded XML is retained for verification. APK signatures, split APKs, native libraries and Android runtime capture are not verified by this provider.",
+] as const;
@@ -0,0 +1,150 @@
+import { Client } from "@modelcontextprotocol/client";
+import {
+  createAnalysisExecution,
+  type AnalysisExecution,
+} from "../application/AnalysisProvider.js";
+import type { AndroidRequest } from "../domain/androidAnalysis.js";
+import {
+  AnalysisCapabilityUnavailableError,
+  AnalysisOutputError,
+} from "../domain/analysisErrorCore.js";
+import type { BinaryTarget } from "../domain/binaryTarget.js";
+import { jsonValueSchema, type JsonValue } from "../domain/jsonValue.js";
+import { ProviderAdapterError } from "../domain/providerAdapterError.js";
+import type { OwnedProviderProcessSpawnOptions } from "../process/ProviderProcess.js";
+import { analyzeJadxRequest, type JadxToolPort } from "./JadxAnalysis.js";
+import { JadxMcpTransport, type JadxLauncher } from "./JadxMcpTransport.js";
+import {
+  jadxLoadSchema,
+  parseJadxEnvelope,
+  parseJadxJson,
+} from "./JadxProtocol.js";
+import {
+  JADX_RELEASE,
+  JADX_PROVIDER_IDENTITY,
+  JADX_LIMITATIONS,
+} from "./JadxRelease.js";
+
+/** One owned engine connection; its wire protocol stays inside the Android adapter. */
+export class JadxSession {
+  readonly transport: JadxMcpTransport;
+  readonly #client = new Client({ name: "rea-android-adapter", version: "1" });
+  readonly #raw: JsonValue[] = [];
+
+  constructor(
+    options: Omit<OwnedProviderProcessSpawnOptions, "runId" | "stdin">,
+    launcher?: JadxLauncher,
+  ) {
+    this.transport = new JadxMcpTransport(options, launcher);
+  }
+
+  /** Analyze one admitted immutable APK, checking producer identity and selectors. */
+  async execute(context: {
+    readonly request: AndroidRequest;
+    readonly target: BinaryTarget;
+    readonly snapshot: string;
+    readonly jarHash: string;
+    readonly signal: AbortSignal;
+  }): Promise<AnalysisExecution> {
+    const { request, target, snapshot, jarHash, signal } = context;
+    const abort = () => {
+      void this.transport.close().catch(() => undefined);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    try {
+      signal.throwIfAborted();
+      await this.#client.connect(this.transport, { timeout: 30_000 });
+      const server = this.#client.getServerVersion();
+      if (
+        server?.name !== "jadx-headless-mcp" ||
+        server.version !== JADX_RELEASE.version
+      )
+        throw new AnalysisCapabilityUnavailableError(
+          "jadx",
+          request.operation,
+          `Expected jadx-headless-mcp ${JADX_RELEASE.version}; server reported ${server?.name ?? "unknown"} ${server?.version ?? "unknown"}.`,
+        );
+      const tools = this.#tools(request, target, signal);
+      const loaded = jadxLoadSchema.parse(
+        await tools.json("load_apk", {
+          path: snapshot,
+          threads: 1,
+          resources: "full",
+        }),
+      );
+      if (loaded.apk_path !== snapshot)
+        throw new AnalysisOutputError(
+          request.operation,
+          "JADX loaded a different APK path than the admitted snapshot",
+        );
+      const engine = {
+        name: "jadx-headless-mcp",
+        version: "0.7.1",
+        artifact_sha256: jarHash,
+        source_revision:
+          jarHash === JADX_RELEASE.sha256 ? JADX_RELEASE.revision : null,
+        worker_count: 1,
+        heap_limit_mib: 512,
+      } as const;
+      const result = await analyzeJadxRequest(tools, request, loaded, engine);
+      return createAnalysisExecution(result, JADX_PROVIDER_IDENTITY, {
+        rawResult: { server, jar_sha256: jarHash, calls: this.#raw },
+        subject: target,
+        limitations: JADX_LIMITATIONS,
+        locations:
+          request.operation === "inspect_android_package"
+            ? [{ kind: "artifact-path", path: "AndroidManifest.xml" }]
+            : [],
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+  }
+
+  /** Join owned cleanup even if SDK connection teardown itself fails. */
+  async close(): Promise<void> {
+    try {
+      await this.#client.close();
+    } finally {
+      await this.transport.close();
+    }
+  }
+
+  #tools(
+    request: AndroidRequest,
+    target: BinaryTarget,
+    signal: AbortSignal,
+  ): JadxToolPort {
+    const call = async (
+      name: string,
+      input: Readonly<Record<string, JsonValue>>,
+    ): Promise<string> => {
+      signal.throwIfAborted();
+      const response = await this.#client.callTool(
+        { name, arguments: input },
+        { timeout: 120_000, signal },
+      );
+      const envelope = parseJadxEnvelope(response, request.operation);
+      this.#raw.push({
+        operation: name,
+        input,
+        response: jsonValueSchema.parse(response),
+      });
+      if (envelope.failed)
+        throw new ProviderAdapterError("jadx", request.operation, {
+          diagnostics: {
+            upstream_operation: name,
+            reason: envelope.text,
+            target_path: target.path,
+            target_sha256: target.sha256,
+          },
+        });
+      return envelope.text;
+    };
+    return {
+      text: call,
+      json: async (name, input) =>
+        parseJadxJson(await call(name, input), request.operation),
+    };
+  }
+}
@@ -159,6 +159,8 @@ type CapabilityAvailability =
    };

 export type CapabilityDescriptor = CapabilityAvailability & {
+  /** Live external state must be re-observed, including after snapshot import. */
+  readonly cachePolicy?: "snapshot" | "live";
  readonly provider: ProviderIdentity;
  readonly operation: Exclude<AnalysisOperation, "health">;
  readonly effects: CapabilityEffects;
@@ -68,6 +68,7 @@ export const isSnapshotCacheable = (
  (!CURSOR_DEFAULT_OPERATIONS.has(operation) ||
    typeof parameters.address === "string") &&
  descriptor?.effects.mutatesArtifact === false &&
+  descriptor.cachePolicy !== "live" &&
  descriptor.effects.mayWriteFilesystem === false &&
  descriptor.effects.changesPermissions === false;

@@ -0,0 +1,17 @@
+import type {
+  AnalysisExecution,
+  ExecutionOptions,
+} from "./AnalysisProvider.js";
+import type { AndroidRequest } from "../domain/androidAnalysis.js";
+import type { BinaryTarget } from "../domain/binaryTarget.js";
+import type { AnalysisError } from "../domain/analysisErrorBase.js";
+import type { Result } from "../domain/result.js";
+
+/** Static Android inspection boundary; implementation details belong to the provider. */
+export interface AndroidAnalysisPort {
+  execute(
+    target: BinaryTarget,
+    request: AndroidRequest,
+    options?: ExecutionOptions,
+  ): Promise<Result<AnalysisExecution, AnalysisError>>;
+}
@@ -0,0 +1,54 @@
+import type { AndroidAnalysisPort } from "./AndroidAnalysisPort.js";
+import type { ExecutionOptions } from "./AnalysisProvider.js";
+import { parseBinaryTarget } from "./BinaryTargetResolver.js";
+import {
+  androidRequestSchema,
+  type AndroidOperation,
+} from "../domain/androidAnalysis.js";
+import {
+  AnalysisCancelledError,
+  AnalysisInputError,
+} from "../domain/analysisErrorCore.js";
+import type { AnalysisError } from "../domain/analysisErrorBase.js";
+import { createEvidence, type Evidence } from "../domain/evidence.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok, type Result } from "../domain/result.js";
+
+/** Shared CLI/MCP admission, execution and Evidence composition for Android. */
+export class AndroidAnalysisService {
+  constructor(readonly provider: AndroidAnalysisPort) {}
+
+  /** Inspect a caller-selected APK and retain producing-provider provenance inline. */
+  async execute(
+    operation: AndroidOperation,
+    input: unknown,
+    options?: ExecutionOptions,
+  ): Promise<Result<Evidence, AnalysisError>> {
+    if (options?.signal?.aborted === true)
+      return err(new AnalysisCancelledError(operation));
+    const request = androidRequestSchema.safeParse({ operation, input });
+    if (!request.success)
+      return err(new AnalysisInputError(operation, { cause: request.error }));
+    const target = await parseBinaryTarget(request.data.input.path);
+    if (!target.ok) return target;
+    const executed = await this.provider.execute(
+      target.value,
+      request.data,
+      options,
+    );
+    if (!executed.ok) return executed;
+    const execution = executed.value;
+    return ok(
+      createEvidence(execution.subject ?? target.value, execution.provider, {
+        operation,
+        parameters: jsonObjectSchema.parse(request.data.input),
+        result: execution.result,
+        rawResult: execution.rawResult,
+        limitations: execution.limitations,
+        locations: execution.locations,
+        confidence:
+          operation === "inspect_android_method" ? "derived" : "observed",
+      }),
+    );
+  }
+}
@@ -114,6 +114,16 @@ export class BinarySession
    );
  }

+  /** External live state cannot be replayed by a direct or composed CLI workflow. */
+  allowsSnapshotReplay(operation: AnalysisOperation): boolean {
+    const capabilities = this.#active?.route.capabilities;
+    const descriptor = capabilities?.get(operation);
+    if (descriptor !== undefined) return descriptor.cachePolicy !== "live";
+    return ![...(capabilities?.values() ?? [])].some(
+      ({ cachePolicy }) => cachePolicy === "live",
+    );
+  }
+
  /** Return the selected immutable profile, optionally scoped to an operation. */
  analysisProfile(
    operation?: AnalysisOperation,
@@ -217,7 +217,15 @@ const resolveAppBundle = async (
  const metadata = await stat(path);
  if (!metadata.isDirectory()) return ok(path);
  if (extname(path).toLowerCase() !== ".app")
-    return err(new BinaryTargetError(path, "target is not an app or file"));
+    return err(
+      new BinaryTargetError(
+        path,
+        "this opening route requires a file or macOS app bundle",
+        {
+          constraint: "directory_requires_file",
+        },
+      ),
+    );
  const plistPath = join(path, "Contents", "Info.plist");
  let name: string;
  try {
@@ -55,6 +55,48 @@ const entry = (
 };

 describe("capability inventory: provider status", () => {
+  it("reports firmware inspection and extraction prerequisites independently", () => {
+    const policy = {
+      processCaptureEnabled: true,
+      firmwareInspectionEnabled: true,
+    };
+    expect(entry("inspect_firmware_regions", status(), policy)).toMatchObject({
+      available: true,
+      surface: "firmware-provider",
+    });
+    expect(entry("extract_firmware", status(), policy)).toMatchObject({
+      available: false,
+      reason: "provider_missing",
+      remediation: expect.stringContaining("REA_UNBLOB_COMMAND"),
+    });
+    expect(
+      entry("extract_firmware", status(), {
+        processCaptureEnabled: true,
+        firmwareExtractionEnabled: true,
+      }),
+    ).toMatchObject({ available: true });
+  });
+  it("keeps Android APK operations target-free and reports their explicit engine prerequisite", () => {
+    expect(
+      entry("inspect_android_package", status(), {
+        processCaptureEnabled: true,
+        androidAnalysisEnabled: true,
+      }),
+    ).toMatchObject({
+      available: true,
+      surface: "android-provider",
+      reason: "available",
+    });
+    expect(
+      entry("inspect_android_package", status(), {
+        processCaptureEnabled: true,
+      }),
+    ).toMatchObject({
+      available: false,
+      reason: "provider_missing",
+      remediation: expect.stringContaining("REA_JADX_MCP_JAR"),
+    });
+  });
  it.each([
    {
      label: "requires a target",
@@ -28,6 +28,9 @@ type ToolAvailabilityReason = "available" | ToolUnavailabilityReason;
 type ProviderDescriptor = ProviderCapability;
 export type AvailabilityPolicy = {
  readonly processCaptureEnabled: boolean;
+  readonly firmwareInspectionEnabled?: boolean;
+  readonly firmwareExtractionEnabled?: boolean;
+  readonly androidAnalysisEnabled?: boolean;
  readonly browserObservationEnabled?: boolean;
  readonly browserScenarioEnabled?: boolean;
  readonly electronObservationEnabled?: boolean;
@@ -205,6 +208,27 @@ const workflowAvailabilityFor = ({
  kind,
  policy,
 }: AvailabilityContext): Availability | null => {
+  if (kind === "firmware-provider") {
+    const enabled =
+      name === "inspect_firmware_regions"
+        ? policy.firmwareInspectionEnabled
+        : policy.firmwareExtractionEnabled;
+    return enabled === true
+      ? { reason: "available", remediation: null }
+      : {
+          reason: "provider_missing",
+          remediation:
+            "On Linux, provide an absolute REA_BINWALK_COMMAND (Binwalk 3.1.0) or REA_UNBLOB_COMMAND (Unblob 26.6.4) path and util-linux prlimit. Extraction also requires the selected format’s external extractor.",
+        };
+  }
+  if (kind === "android-provider")
+    return policy.androidAnalysisEnabled === true
+      ? { reason: "available", remediation: null }
+      : {
+          reason: "provider_missing",
+          remediation:
+            "Set REA_JADX_MCP_JAR to a caller-supplied jadx-headless-mcp 0.7.1 JAR and provide Java on Linux or macOS. Only Linux has real-provider verification.",
+        };
  const browser = browserProviderAvailability(name, kind, policy);
  if (browser !== null) return browser;
  if (name === "capture_process_scenario" && !policy.processCaptureEnabled)
@@ -0,0 +1,105 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  clientConfigurationServersKey,
+  clientRegistrationEntry,
+  parseClientConfiguration,
+  serializeClientConfiguration,
+} from "./ClientConfigurationDocument.js";
+
+describe.each([
+  "json",
+  "vscode",
+  "copilot_cli",
+  "opencode",
+  "commandcode",
+] as const)("%s client configuration BOM handling", (format) => {
+  const serversKey = clientConfigurationServersKey(format);
+
+  it.each(["", "\uFEFF"])("parses a document with prefix %j", (bom) => {
+    const registration = clientRegistrationEntry(format, ["rea", "mcp"], {});
+    const document = { [serversKey]: { rea: registration } };
+
+    expect(
+      parseClientConfiguration(`${bom}${JSON.stringify(document)}`, format),
+    ).toEqual({ document, servers: document[serversKey], serversKey });
+  });
+
+  it.each(["", "\uFEFF"])(
+    "reports malformed JSON at the original offset with prefix %j",
+    (bom) => {
+      const text = `${bom}{\r\n  "${serversKey}": {"rea": @}\r\n}`;
+
+      expect(() => parseClientConfiguration(text, format)).toThrow(
+        new SyntaxError(
+          `Invalid JSON/JSONC at offset ${text.indexOf("@")}: InvalidSymbol`,
+        ),
+      );
+    },
+  );
+
+  it.each([
+    ["\uFEFF\uFEFF{}", 1],
+    [" \uFEFF{}", 1],
+    ['{"setting":\uFEFFtrue}', 11],
+    ['\uFEFF{"setting":\uFEFFtrue}', 12],
+  ] as const)("rejects a nonleading BOM in %j", (text, offset) => {
+    expect(() => parseClientConfiguration(text, format)).toThrow(
+      new SyntaxError(`Invalid JSON/JSONC at offset ${offset}: InvalidSymbol`),
+    );
+  });
+
+  it.each(["", "\uFEFF"])(
+    "preserves prefix %j and unrelated bytes across add, update, and removal",
+    (bom) => {
+      const prefix = `${bom}{\r\n  // Keep \uFEFF in comments.\r\n  "label": "left\uFEFFright",\r\n  "${serversKey}": {\r\n    // Other server.\r\n    "other": {\r\n      "command": "other\uFEFFtool"\r\n    },\r\n`;
+      const suffix = '  },\r\n  "theme": "dark",\r\n}\r\n';
+      const original = `${prefix}${suffix}`;
+      let text = original;
+
+      for (const registration of [
+        clientRegistrationEntry(format, ["rea", "mcp"], {}),
+        clientRegistrationEntry(format, ["rea-next", "mcp"], {
+          LABEL: "left\uFEFFright",
+        }),
+        undefined,
+      ]) {
+        const parsed = parseClientConfiguration(text, format);
+        const servers = { ...parsed.servers };
+        if (registration === undefined) delete servers.rea;
+        else servers.rea = registration;
+        const document = { ...parsed.document, [serversKey]: servers };
+
+        text = serializeClientConfiguration(document, format, text, "rea");
+
+        expect(parseClientConfiguration(text, format)).toEqual({
+          document,
+          servers,
+          serversKey,
+        });
+        expect(Buffer.from(text.slice(0, prefix.length))).toEqual(
+          Buffer.from(prefix),
+        );
+        expect(Buffer.from(text.slice(-suffix.length))).toEqual(
+          Buffer.from(suffix),
+        );
+        expect(text.replaceAll("\r\n", "")).not.toContain("\n");
+      }
+
+      expect(text).toBe(original);
+    },
+  );
+});
+
+describe("TOML client configuration BOM handling", () => {
+  it("retains the TOML parser's existing leading-BOM rejection", () => {
+    const text = '[mcp_servers.rea]\ncommand = "rea"\n';
+
+    expect(parseClientConfiguration(text, "toml").servers).toEqual({
+      rea: { command: "rea" },
+    });
+    expect(() => parseClientConfiguration(`\uFEFF${text}`, "toml")).toThrow(
+      "Invalid TOML document",
+    );
+  });
+});
@@ -66,7 +66,9 @@ const parseDocument = (
 ): Record<string, unknown> => {
  if (format === "toml") return objectSchema.parse(parseToml(text));
  const errors: ParseError[] = [];
-  const document = parseJsonc(text, errors, { allowTrailingComma: true });
+  // Accept a UTF-8 BOM without shifting diagnostics or editing the original text.
+  const jsonText = text.startsWith("\uFEFF") ? ` ${text.slice(1)}` : text;
+  const document = parseJsonc(jsonText, errors, { allowTrailingComma: true });
  const firstError = errors[0];
  if (firstError !== undefined)
    throw new SyntaxError(
@@ -2,6 +2,7 @@ import type { ExecutableFormatHint } from "../domain/dosCom.js";
 import { parseConfig } from "../config.js";
 import type { JsonValue } from "../domain/jsonValue.js";
 import { EnhancedTools } from "./EnhancedTools.js";
+import { executeFunctionAnalysisEvidence } from "./FunctionAnalysisEvidence.js";
 import { createBinarySession, createManagedBinarySession } from "./runtime.js";
 import { silentLogger, type Logger } from "../logger.js";
 import { createEvidence } from "../domain/evidence.js";
@@ -201,7 +202,7 @@ const runAnalysis = async (
    const evidenceProfile = analysisProfileForEvidence(session, tool);
    const bindingProfile = session.analysisProfile();
    if (
-      tool !== "trace_native_ui_action" &&
+      canReplayDirectTool(session, tool) &&
      snapshot !== undefined &&
      evidenceProfile !== undefined &&
      bindingProfile !== undefined
@@ -245,6 +246,12 @@ const runAnalysis = async (
  }
 };

+const canReplayDirectTool = (
+  session: ReturnType<typeof createBinarySession>,
+  tool: Parameters<typeof runAnalysis>[1],
+): boolean =>
+  tool !== "trace_native_ui_action" && session.allowsSnapshotReplay(tool);
+
 const executeAnalysisTool = async (input: {
  readonly session: ReturnType<typeof createBinarySession>;
  readonly openedTarget: BinaryTarget;
@@ -258,9 +265,19 @@ const executeAnalysisTool = async (input: {
  readonly evidenceProfile: AnalysisProfileCommitment | undefined;
 }): Promise<{ readonly output: JsonValue; readonly evidence?: Evidence }> => {
  const { session, tool, signal, evidenceProfile } = input;
+  if (tool === "analyze_function") {
+    const result = await executeFunctionAnalysisEvidence(
+      session,
+      input.arguments,
+      input.openedTarget,
+      { signal },
+    );
+    return result.ok
+      ? { output: result.value, evidence: result.value }
+      : { output: cliError(result.error) };
+  }
  if (
    tool === "binary_overview" ||
-    tool === "analyze_function" ||
    tool === "inspect_native_api" ||
    tool === "inspect_native_dispatch_metadata" ||
    tool === "trace_feature" ||
@@ -273,22 +290,16 @@ const executeAnalysisTool = async (input: {
      signal,
    );
    if (!result.ok) return { output: cliError(result.error) };
-    const evidence = createEvidence(
-      input.openedTarget,
-      tool === "analyze_function"
-        ? session.providerIdentity(tool)
-        : REA_WORKFLOW_PROVIDER,
-      {
-        operation: tool,
-        parameters: input.arguments,
-        result: result.value,
-        ...(evidenceProfile === undefined
-          ? {}
-          : { analysisProfile: evidenceProfile }),
-        confidence: "derived",
-        limitations: ["Derived by an REA composed workflow."],
-      },
-    );
+    const evidence = createEvidence(input.openedTarget, REA_WORKFLOW_PROVIDER, {
+      operation: tool,
+      parameters: input.arguments,
+      result: result.value,
+      ...(evidenceProfile === undefined
+        ? {}
+        : { analysisProfile: evidenceProfile }),
+      confidence: "derived",
+      limitations: ["Derived by an REA composed workflow."],
+    });
    return { output: evidence, evidence };
  }
  const result = await session.execute(tool, input.arguments, { signal });
@@ -24,13 +24,13 @@ const runSessionStatus = async (
  }
 };

-/** List complete provider identities, capabilities, and availability. */
+/** List binary-session provider candidates and auxiliary operation availability. */
 export const runProviderStatus = (
  logger: Logger = silentLogger,
  environment: Readonly<Record<string, string | undefined>> = process.env,
 ) => runSessionStatus(logger, environment);

-/** List complete operation descriptors and availability. */
+/** List binary-session operation descriptors; this is not the full MCP catalog. */
 export const runCapabilityStatus = (
  logger: Logger = silentLogger,
  environment: Readonly<Record<string, string | undefined>> = process.env,
@@ -500,3 +500,25 @@ describe("doctor Linux and Hopper discovery", () => {
    );
  });
 });
+
+describe("doctor target admission diagnostics", () => {
+  it("preserves route-specific target diagnostics from the host", async () => {
+    const targetCheck = {
+      name: "target",
+      ok: false,
+      classification: "unsupported_target" as const,
+      detail: "/fixture/javascript-app",
+      remediation: "Use analyze_javascript_application with input_path.",
+    };
+    const result = await runDoctor(
+      targetCheck.detail,
+      host({
+        inspectTarget: () => Promise.resolve(targetCheck),
+        validTarget: () => {
+          throw new Error("the detailed target check should be used");
+        },
+      }),
+    );
+    expect(result.checks).toContainEqual(targetCheck);
+  });
+});
@@ -3,6 +3,7 @@ import { access, readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";

+import { analysisErrorRemediationAction } from "../domain/analysisErrorPresentation.js";
 import { parseBinaryTarget } from "./BinaryTargetResolver.js";
 import { execFileOutput } from "../process/ExecFileOutput.js";
 import type { JsonValue } from "../domain/jsonValue.js";
@@ -31,7 +32,7 @@ import {
 } from "./DoctorScope.js";

 /** Deep provider IDs whose readiness can be selected explicitly by doctor. */
-export const DOCTOR_PROVIDER_IDS = ["hopper", "ghidra"] as const;
+export const DOCTOR_PROVIDER_IDS = ["hopper", "ghidra", "ida"] as const;
 /** One actionable environment diagnostic. */
 export interface DoctorCheck {
  readonly name: string;
@@ -40,6 +41,7 @@ export interface DoctorCheck {
    | "healthy"
    | "missing_dependency"
    | "unsupported_host"
+    | "unsupported_target"
    | "missing_analysis_engine"
    | "config_drift";
  readonly detail?: string;
@@ -79,6 +81,8 @@ export interface DoctorHost {
  macosVersion(): Promise<string | undefined>;
  linuxDistribution(): Promise<LinuxDistribution | undefined>;
  validTarget(path: string): Promise<boolean>;
+  /** Route-specific target admission details, when supplied by the host. */
+  inspectTarget?(path: string): Promise<DoctorCheck>;
  executable(path: string): Promise<boolean>;
  supportedLinuxHopper(path: string): Promise<boolean>;
  linuxDemoRuntimeCheck(): Promise<DoctorCheck>;
@@ -333,6 +337,33 @@ export const systemDoctorHost = (
    async validTarget(path) {
      return (await parseBinaryTarget(path, process.cwd(), architecture)).ok;
    },
+    async inspectTarget(path) {
+      const result = await parseBinaryTarget(path, process.cwd(), architecture);
+      if (result.ok)
+        return {
+          name: "target",
+          ok: true,
+          classification: "healthy",
+          detail: path,
+        };
+      const error = result.error;
+      return {
+        name: "target",
+        ok: false,
+        classification:
+          error.constraint === "directory_requires_file"
+            ? "unsupported_target"
+            : "config_drift",
+        detail: path,
+        details: {
+          reason: error.reason,
+          ...(error.constraint === undefined
+            ? {}
+            : { constraint: error.constraint }),
+        },
+        remediation: analysisErrorRemediationAction(error),
+      };
+    },
    executable: (path) =>
      executableAvailable(
        path,
@@ -217,10 +217,12 @@ const optionalTargetCheck = async (
 ): Promise<DoctorCheck | undefined> =>
  target === undefined
    ? undefined
-    : check("target", await host.validTarget(target), target, {
-        remediation: "Supply a readable local app or program path.",
-        classification: "config_drift",
-      });
+    : host.inspectTarget !== undefined
+      ? host.inspectTarget(target)
+      : check("target", await host.validTarget(target), target, {
+          remediation: "Supply a readable local app or program path.",
+          classification: "config_drift",
+        });

 const check = (
  name: string,
@@ -0,0 +1,80 @@
+import { describe, expect, it } from "vitest";
+import { evidenceInputSchema } from "../contracts/evidenceInputContracts.js";
+import { JAVASCRIPT_FEATURE_TRACE_EXAMPLE } from "../contracts/javascriptApplicationWorkflowExamples.js";
+import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { EvidenceLedger } from "./EvidenceLedger.js";
+import { resolveEvidenceInput } from "./EvidenceInputResolver.js";
+
+const evidence = JAVASCRIPT_FEATURE_TRACE_EXAMPLE.application;
+const reference = {
+  kind: "retained-evidence" as const,
+  evidence_id: evidence.evidence_id,
+};
+
+describe("exact Evidence input resolution", () => {
+  it("uses the session's detached canonical record without modifying it", () => {
+    const ledger = new EvidenceLedger();
+    expect(ledger.record(evidence).ok).toBe(true);
+    const result = resolveEvidenceInput(reference, (id) => ledger.get(id));
+    if (!result.ok) throw result.error;
+    expect(result.value).toEqual(evidence);
+    result.value.limitations.push("caller-owned change");
+    expect(ledger.get(evidence.evidence_id)).toEqual(evidence);
+  });
+
+  it("leaves portable inline inputs independent of session lookup", () => {
+    expect(
+      resolveEvidenceInput(evidence, () => {
+        throw new Error("unexpected lookup");
+      }),
+    ).toEqual({ ok: true, value: evidence });
+  });
+
+  it("reports a missing reference and an available recovery", () => {
+    for (const lookup of [undefined, () => undefined]) {
+      const result = resolveEvidenceInput(reference, lookup);
+      if (result.ok) throw new Error("unknown reference was resolved");
+      const projected = projectAnalysisError(result.error);
+      expect(projected).toMatchObject({
+        details: {
+          evidence_id: reference.evidence_id,
+          reason: "missing",
+          actual: null,
+        },
+      });
+      expect(projected.message).toContain("not retained in this session");
+      expect(projected.remediation.action).toContain(
+        "complete inline Evidence",
+      );
+    }
+  });
+
+  it("rejects a lookup returning another record rather than guessing identity", () => {
+    const otherId = `ev_${"f".repeat(64)}`;
+    const result = resolveEvidenceInput(
+      { ...reference, evidence_id: otherId },
+      () => evidence,
+    );
+    if (result.ok) throw new Error("mismatched reference was resolved");
+    expect(projectAnalysisError(result.error)).toMatchObject({
+      details: {
+        reason: "identity_mismatch",
+        expected: otherId,
+        actual: evidence.evidence_id,
+      },
+    });
+  });
+
+  it("parses only complete inline records or strict exact references", () => {
+    expect(evidenceInputSchema.safeParse(reference).success).toBe(true);
+    expect(evidenceInputSchema.safeParse(evidence).success).toBe(true);
+    for (const invalid of [
+      { evidence_id: evidence.evidence_id },
+      { ...reference, kind: "another-session" },
+      { ...reference, evidence_id: "ev_short" },
+      { ...reference, session_id: "foreign" },
+      { ...reference, normalized_result: {} },
+    ])
+      expect(evidenceInputSchema.safeParse(invalid).success).toBe(false);
+  });
+});
@@ -0,0 +1,70 @@
+import type { EvidenceInput } from "../contracts/evidenceInputContracts.js";
+import type { Evidence } from "../domain/evidence.js";
+import { EvidenceReferenceError } from "../domain/evidenceErrors.js";
+import { err, ok, type Result } from "../domain/result.js";
+
+/** Read-only lookup supplied by the current investigation's Evidence ledger. */
+export type EvidenceLookup = (evidenceId: string) => Evidence | undefined;
+
+/** Resolve an exact reference without selecting a target or running analysis. */
+export const resolveEvidenceInput = (
+  input: EvidenceInput,
+  lookup: EvidenceLookup | undefined,
+): Result<Evidence, EvidenceReferenceError> => {
+  if (!("kind" in input)) return ok(input);
+  const record = lookup?.(input.evidence_id);
+  if (record === undefined)
+    return err(
+      new EvidenceReferenceError(
+        input.evidence_id,
+        "missing",
+        "Evidence retained in this session",
+        null,
+      ),
+    );
+  if (record.evidence_id !== input.evidence_id)
+    return err(
+      new EvidenceReferenceError(
+        input.evidence_id,
+        "identity_mismatch",
+        input.evidence_id,
+        record.evidence_id,
+      ),
+    );
+  return ok(record);
+};
+
+/** Resolve an application's Evidence before its existing semantic validation. */
+export const resolveApplicationEvidenceRequest = <
+  T extends { readonly application: EvidenceInput },
+>(
+  input: T,
+  lookup: EvidenceLookup | undefined,
+): Result<
+  Omit<T, "application"> & { readonly application: Evidence },
+  EvidenceReferenceError
+> => {
+  const application = resolveEvidenceInput(input.application, lookup);
+  if (!application.ok) return application;
+  return ok({ ...input, application: application.value });
+};
+
+/** Resolve explicitly paired Evidence without guessing another session's record. */
+export const resolvePairedEvidenceRequest = <
+  T extends { readonly left: EvidenceInput; readonly right: EvidenceInput },
+>(
+  input: T,
+  lookup: EvidenceLookup | undefined,
+): Result<
+  Omit<T, "left" | "right"> & {
+    readonly left: Evidence;
+    readonly right: Evidence;
+  },
+  EvidenceReferenceError
+> => {
+  const left = resolveEvidenceInput(input.left, lookup);
+  if (!left.ok) return left;
+  const right = resolveEvidenceInput(input.right, lookup);
+  if (!right.ok) return right;
+  return ok({ ...input, left: left.value, right: right.value });
+};
@@ -0,0 +1,15 @@
+import type {
+  AnalysisExecution,
+  ExecutionOptions,
+} from "./AnalysisProvider.js";
+import type { FirmwareRequest } from "../domain/firmwareAnalysis.js";
+import type { AnalysisError } from "../domain/analysisErrorBase.js";
+import type { Result } from "../domain/result.js";
+
+/** File-oriented firmware engines; executable admission remains a separate operation. */
+export interface FirmwareAnalysisPort {
+  execute(
+    request: FirmwareRequest,
+    options?: ExecutionOptions,
+  ): Promise<Result<AnalysisExecution, AnalysisError>>;
+}
@@ -0,0 +1,54 @@
+import type { ExecutionOptions } from "./AnalysisProvider.js";
+import type { FirmwareAnalysisPort } from "./FirmwareAnalysisPort.js";
+import {
+  firmwareRequestSchema,
+  type FirmwareOperation,
+} from "../domain/firmwareAnalysis.js";
+import {
+  AnalysisCancelledError,
+  AnalysisInputError,
+  AnalysisOutputError,
+} from "../domain/analysisErrorCore.js";
+import type { AnalysisError } from "../domain/analysisErrorBase.js";
+import { createEvidence, type Evidence } from "../domain/evidence.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok, type Result } from "../domain/result.js";
+
+/** Shared CLI/MCP validation and Evidence composition for arbitrary firmware files. */
+export class FirmwareAnalysisService {
+  constructor(readonly provider: FirmwareAnalysisPort) {}
+
+  /** Execute an explicit inspection or extraction and preserve its producing identity. */
+  async execute(
+    operation: FirmwareOperation,
+    input: unknown,
+    options?: ExecutionOptions,
+  ): Promise<Result<Evidence, AnalysisError>> {
+    if (options?.signal?.aborted === true)
+      return err(new AnalysisCancelledError(operation));
+    const parsed = firmwareRequestSchema.safeParse({ operation, input });
+    if (!parsed.success)
+      return err(new AnalysisInputError(operation, { cause: parsed.error }));
+    const executed = await this.provider.execute(parsed.data, options);
+    if (!executed.ok) return executed;
+    const execution = executed.value;
+    if (execution.subject === null)
+      return err(
+        new AnalysisOutputError(
+          operation,
+          "Firmware execution did not bind its source artifact",
+        ),
+      );
+    return ok(
+      createEvidence(execution.subject, execution.provider, {
+        operation,
+        parameters: jsonObjectSchema.parse(parsed.data.input),
+        result: execution.result,
+        rawResult: execution.rawResult,
+        locations: execution.locations,
+        limitations: execution.limitations,
+        confidence: "observed",
+      }),
+    );
+  }
+}
@@ -0,0 +1,54 @@
+import type {
+  AnalysisOperationPort,
+  ExecutionOptions,
+} from "./AnalysisProvider.js";
+import { toolContract } from "../contracts/toolContracts.js";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import type { BinaryTarget } from "../domain/binaryTarget.js";
+import { createEvidence } from "../domain/evidence.js";
+import { parseFunctionDossier } from "../domain/hopperValues.js";
+import { jsonObjectSchema, type JsonValue } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+
+/** Preserve the provider's observations when presenting a validated function dossier. */
+export const executeFunctionAnalysisEvidence = async (
+  analysis: AnalysisOperationPort,
+  parameters: Readonly<Record<string, JsonValue>>,
+  target: BinaryTarget | undefined,
+  options?: ExecutionOptions,
+) => {
+  const input =
+    toolContract("analyze_function").inputSchema.safeParse(parameters);
+  if (!input.success)
+    return err(
+      new AnalysisInputError(
+        "analyze_function",
+        { cause: input.error },
+        projectInputIssues(input.error.issues, parameters),
+      ),
+    );
+  const arguments_ = jsonObjectSchema.parse(input.data);
+  const execution = await analysis.execute(
+    "analyze_function",
+    arguments_,
+    options,
+  );
+  if (!execution.ok) return execution;
+  const dossier = parseFunctionDossier(execution.value.result);
+  if (!dossier.ok) return dossier;
+  const observation = execution.value;
+  return ok(
+    createEvidence(observation.subject ?? target, observation.provider, {
+      operation: "analyze_function",
+      parameters: arguments_,
+      result: dossier.value,
+      rawResult: observation.rawResult,
+      limitations: observation.limitations,
+      locations: observation.locations,
+      ...(observation.analysisProfile === undefined
+        ? {}
+        : { analysisProfile: observation.analysisProfile }),
+    }),
+  );
+};
@@ -2,12 +2,47 @@ import { writeFile } from "node:fs/promises";
 import { join } from "node:path";

 import { describe, expect, it } from "vitest";
+import { z } from "zod";

 import { createTestTempDirectory } from "../../tests/fixtures/temporaryDirectory.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import { analyzeJavaScriptApplication } from "./JavaScriptApplicationService.js";

 describe("JavaScript application failure diagnostics", () => {
+  it("identifies the rejected result field in caller-visible diagnostics", async () => {
+    const inputPath = await createTestTempDirectory("rea-js-schema-failure-");
+    await writeFile(join(inputPath, "main.js"), "export const value = 1;\n");
+    const cause = new z.ZodError([
+      {
+        code: "custom",
+        path: ["semantic_graph", "nodes", 42, "application_node_ids", 0],
+        message: "Semantic node references an absent application node",
+      },
+    ]);
+    const result = await analyzeJavaScriptApplication(
+      { input_path: inputPath, format: "directory" },
+      {
+        progress: {
+          report: async (event) => {
+            if (event.terminal) throw cause;
+          },
+        },
+      },
+    );
+
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("Expected analysis failure");
+    expect(result.error.cause).toBe(cause);
+    expect(projectAnalysisError(result.error)).toMatchObject({
+      code: "unreadable_output",
+      details: {
+        operation: "analyze_javascript_application",
+        reason:
+          "Result schema rejected 1 issue at /semantic_graph/nodes/42/application_node_ids/0 (custom)",
+      },
+    });
+  });
+
  it("retains unexpected failures and their input identity in caller-visible diagnostics", async () => {
    const inputPath = await createTestTempDirectory("rea-js-failure-");
    await writeFile(join(inputPath, "main.js"), "export const value = 1;\n");
@@ -7,7 +7,7 @@ import {
 } from "../domain/javascriptApplicationAnalysis.js";
 import {
  AnalysisInputError,
-  AnalysisProtocolError,
+  AnalysisOutputError,
 } from "../domain/analysisErrorCore.js";
 import { ArtifactOperationError } from "../domain/artifactOperationError.js";
 import { type AnalysisError } from "../domain/analysisErrorBase.js";
@@ -79,10 +79,9 @@ export const analyzeJavaScriptApplicationValidated = async (
      );
    if (cause instanceof z.ZodError)
      return err(
-        new AnalysisProtocolError(
-          "JavaScript application analysis produced an invalid result",
-          { cause },
-        ),
+        new AnalysisOutputError(OPERATION, describeResultSchemaFailure(cause), {
+          cause,
+        }),
      );
    if (
      cause instanceof Error &&
@@ -109,6 +108,22 @@ export const analyzeJavaScriptApplicationValidated = async (
  }
 };

+const describeResultSchemaFailure = (cause: z.ZodError): string => {
+  const issue = cause.issues[0];
+  if (issue === undefined) return "Result schema rejected an unknown issue";
+  const path = issue.path.flatMap((part) =>
+    typeof part === "string" || typeof part === "number" ? [part] : [],
+  );
+  const pointer =
+    path.length === 0
+      ? "/"
+      : `/${path.map((part) => escapePointerPart(String(part))).join("/")}`;
+  return `Result schema rejected ${String(cause.issues.length)} ${cause.issues.length === 1 ? "issue" : "issues"} at ${pointer} (${issue.code})`;
+};
+
+const escapePointerPart = (part: string): string =>
+  part.replaceAll("~", "~0").replaceAll("/", "~1");
+
 const FILESYSTEM_ERROR_CODES = new Set([
  "ENOENT",
  "EACCES",
@@ -474,7 +474,7 @@ describe("contextual JavaScript module identity", () => {
    const analysis = analyzeJavaScriptStaticSource(
      `
        new BrowserWindow({ webPreferences: {
-          preload: path.resolve(__dirname, "preload.cjs")
+          preload: path.resolve("ignored", __dirname, "preload.cjs")
        }});
        new BrowserWindow({ webPreferences: {
          preload: fileURLToPath(new URL("./preload.mjs", import.meta.url))
@@ -482,6 +482,15 @@ describe("contextual JavaScript module identity", () => {
        new BrowserWindow({ webPreferences: {
          preload: path.join(path.dirname(__filename), "legacy-preload.js")
        }});
+        new BrowserWindow({ webPreferences: {
+          preload: path.posix.resolve("/ignored", dirname(fileURLToPath(import.meta.url)), "esm-preload.js")
+        }});
+        new BrowserWindow({ webPreferences: {
+          preload: path.posix.resolve(__dirname, "/shared", "absolute-preload.js/")
+        }});
+        new BrowserWindow({ webPreferences: {
+          preload: path.posix.resolve(\`/templates\`, "template-preload.js")
+        }});
        new BrowserWindow({ webPreferences: {
          preload: new URL("./remote-base.js", location.href)
        }});
@@ -503,6 +512,18 @@ describe("contextual JavaScript module identity", () => {
          path: "legacy-preload.js",
          resolution_context: "filesystem-expression",
        }),
+        expect.objectContaining({
+          path: "esm-preload.js",
+          resolution_context: "filesystem-expression",
+        }),
+        expect.objectContaining({
+          path: "/shared/absolute-preload.js",
+          resolution_context: "filesystem-expression",
+        }),
+        expect.objectContaining({
+          path: "/templates/template-preload.js",
+          resolution_context: "filesystem-expression",
+        }),
        expect.objectContaining({
          path: "file:///renderer/index.html",
          resolution_context: "module-specifier",
@@ -519,6 +540,18 @@ describe("contextual JavaScript module identity", () => {
          preload_path: "./preload.mjs",
          preload_resolution_context: "filesystem-expression",
        }),
+        expect.objectContaining({
+          preload_path: "esm-preload.js",
+          preload_resolution_context: "filesystem-expression",
+        }),
+        expect.objectContaining({
+          preload_path: "/shared/absolute-preload.js",
+          preload_resolution_context: "filesystem-expression",
+        }),
+        expect.objectContaining({
+          preload_path: "/templates/template-preload.js",
+          preload_resolution_context: "filesystem-expression",
+        }),
      ]),
    );
    expect(analysis.role_paths).not.toEqual(
@@ -0,0 +1,166 @@
+import { describe, expect, it } from "vitest";
+
+import { analyzeJavaScriptSemantics } from "../domain/javascriptSemanticAnalysis.js";
+import { completeApplicationCoverage } from "../domain/javascriptApplicationEvidenceSchemas.js";
+import { projectJavaScriptExportReturnShapes } from "./JavaScriptReturnShapeProjection.js";
+
+const projectReturns = (body: string) => {
+  const ir = analyzeJavaScriptSemantics(`export function result() { ${body} }`);
+  const link = ir.moduleLinks.find(
+    ({ exportedName }) => exportedName === "result",
+  );
+  if (link === undefined) throw new Error("Expected the result export");
+  const projected = projectJavaScriptExportReturnShapes({
+    ir,
+    link,
+    modulePath: "fixture.js",
+    baseCoverage: completeApplicationCoverage(),
+  });
+  if (projected === null) throw new Error("Expected exported return shapes");
+  return projected;
+};
+
+const unknownBranchField = {
+  path: "",
+  state: "unknown",
+  value: null,
+  reason: "Branches have incompatible values.",
+};
+
+describe("exported primitive union return shapes", () => {
+  const conditionalCases = [
+    "missing",
+    "unsupported()",
+    '({ key: "value" })',
+    '["value"]',
+    '+"invalid"',
+  ].flatMap((other) => [
+    `condition ? (choice ? "one" : "two") : ${other}`,
+    `condition ? ${other} : (choice ? "one" : "two")`,
+  ]);
+  const logicalCases = [
+    { operator: "||", known: '(choice ? "" : "one")' },
+    { operator: "&&", known: '(choice ? 0 : "one")' },
+    { operator: "??", known: '(choice ? null : "one")' },
+  ].flatMap(({ operator, known }) => [
+    `${known} ${operator} missing`,
+    `missing ${operator} ${known}`,
+  ]);
+
+  it.each([...conditionalCases, ...logicalCases])(
+    "projects an unknown field instead of a definite union for %s",
+    (expression) => {
+      const projected = projectReturns(`return ${expression};`);
+
+      expect(projected.properties.static_return_shapes).toEqual([
+        {
+          source_range: expect.any(Object),
+          value_status: "ambiguous",
+          fields: [unknownBranchField],
+          property_coverage: [],
+        },
+      ]);
+      // Complete return-site collection does not make its values known.
+      expect(projected.properties.return_shape_coverage).toEqual({
+        status: "complete",
+        retained_return_sites: 1,
+        omitted_return_sites: 0,
+        omitted_fields: 0,
+        omitted_property_coverage: 0,
+        projection_complete: true,
+      });
+      expect(projected.coverage).toEqual(completeApplicationCoverage());
+      expect(projected.limitations).toContain(
+        "Return shapes are inferred from inert syntax and do not prove runtime behavior.",
+      );
+    },
+  );
+
+  it("keeps an incompatible object field unknown beside a known literal", () => {
+    const projected = projectReturns(`
+      return {
+        kind: "result",
+        value: condition ? (choice ? "one" : "two") : missing,
+      };
+    `);
+    expect(projected.properties.static_return_shapes).toEqual([
+      {
+        source_range: expect.any(Object),
+        value_status: "object",
+        fields: [
+          { path: "/kind", state: "literal", value: "result", reason: null },
+          { ...unknownBranchField, path: "/value" },
+        ],
+        property_coverage: [{ path: "", status: "complete", omitted: 0 }],
+      },
+    ]);
+  });
+
+  it("retains valid nested unions, duplicates, and null alternatives", () => {
+    const projected = projectReturns(`
+      return condition
+        ? (choice ? "two" : "one")
+        : (other ? "one" : null);
+    `);
+    expect(projected.properties.static_return_shapes).toEqual([
+      {
+        source_range: expect.any(Object),
+        value_status: "union",
+        fields: [
+          {
+            path: "",
+            state: "union",
+            value: [null, "one", "two"],
+            reason: null,
+          },
+        ],
+        property_coverage: [],
+      },
+    ]);
+  });
+
+  it("preserves three independent direct returns without merging their values", () => {
+    const projected = projectReturns(`
+      if (condition) return choice ? "one" : "two";
+      if (other) return missing;
+      return { kind: "object" };
+    `);
+    expect(projected.properties.static_return_shapes).toEqual([
+      {
+        source_range: expect.any(Object),
+        value_status: "union",
+        fields: [
+          { path: "", state: "union", value: ["one", "two"], reason: null },
+        ],
+        property_coverage: [],
+      },
+      {
+        source_range: expect.any(Object),
+        value_status: "unknown",
+        fields: [
+          {
+            path: "",
+            state: "unknown",
+            value: null,
+            reason: "Unbound identifier missing.",
+          },
+        ],
+        property_coverage: [],
+      },
+      {
+        source_range: expect.any(Object),
+        value_status: "object",
+        fields: [
+          { path: "/kind", state: "literal", value: "object", reason: null },
+        ],
+        property_coverage: [{ path: "", status: "complete", omitted: 0 }],
+      },
+    ]);
+    expect(projected.properties.return_shape_coverage).toMatchObject({
+      status: "complete",
+      retained_return_sites: 3,
+      omitted_return_sites: 0,
+      projection_complete: true,
+    });
+  });
+});
@@ -8,6 +8,7 @@ const SKILL_FILES = [
  "SKILL.md",
  "references/native-and-artifacts.md",
  "references/javascript-applications.md",
+  "references/android-applications.md",
  "references/runtime-observation.md",
  "references/evidence-workflows.md",
 ] as const;
@@ -2,6 +2,7 @@ import type { AppConfig } from "../config.js";
 import type { BinarySession } from "./BinarySession.js";
 import { HopperProvider } from "../hopper/HopperProvider.js";
 import { GhidraProvider } from "../ghidra/GhidraProvider.js";
+import { IdaProvider } from "../ida/IdaProvider.js";
 import { silentLogger, type Logger } from "../logger.js";
 import { GENERATED_AUXILIARY_PROVIDERS } from "../generatedMcpToolCatalog.js";
 import { AnalysisProviderRegistry } from "./AnalysisProviderRegistry.js";
@@ -22,6 +23,7 @@ export const createBinarySession = (
 ): BinarySession => {
  const hopper = new HopperProvider(config, logger);
  const ghidra = new GhidraProvider(config, logger);
+  const ida = new IdaProvider(config);
  const auxiliary = new Map(
    GENERATED_AUXILIARY_PROVIDERS.map((provider) => [
      provider.identity.id,
@@ -42,7 +44,10 @@ export const createBinarySession = (
    });
  };
  return composeBinarySession(
-    new AnalysisProviderRegistry([hopper, ghidra], config.analysisProvider),
+    new AnalysisProviderRegistry(
+      [hopper, ghidra, ida],
+      config.analysisProvider,
+    ),
    [
      lazyProvider("rea-artifact-graph", async () => {
        const { ArtifactProvider } =
@@ -43,12 +43,24 @@ export class SafeOutputTree {
    status: "not-required",
  };

-  private constructor(outputRoot: string) {
+  private constructor(
+    outputRoot: string,
+    private readonly platform: NodeJS.Platform,
+  ) {
    this.#outputRoot = outputRoot;
  }

-  /** Exclusively create the absent destination as this operation's owned tree. */
-  static async create(outputRoot: string): Promise<SafeOutputTree> {
+  /**
+   * Exclusively create the absent destination as this operation's owned tree.
+   *
+   * POSIX mode bits and directory `fchmod`/`fsync` have no Windows equivalent:
+   * `mkdir` already applies the requested mode, so the redundant handle
+   * `chmod` is skipped there to avoid an `EPERM` on the directory descriptor.
+   */
+  static async create(
+    outputRoot: string,
+    platform: NodeJS.Platform = process.platform,
+  ): Promise<SafeOutputTree> {
    if (!isAbsolute(outputRoot))
      throw new ArtifactReaderFailure(
        "path",
@@ -78,16 +90,18 @@ export class SafeOutputTree {
      throw cause;
    });
    try {
-      const stagingHandle = await open(
-        canonicalOutput,
-        constants.O_RDONLY | constants.O_DIRECTORY,
-      );
-      try {
-        await stagingHandle.chmod(0o700);
-      } finally {
-        await stagingHandle.close();
+      if (platform !== "win32") {
+        const stagingHandle = await open(
+          canonicalOutput,
+          constants.O_RDONLY | constants.O_DIRECTORY,
+        );
+        try {
+          await stagingHandle.chmod(0o700);
+        } finally {
+          await stagingHandle.close();
+        }
      }
-      return new SafeOutputTree(canonicalOutput);
+      return new SafeOutputTree(canonicalOutput, platform);
    } catch (cause: unknown) {
      await rm(canonicalOutput, { recursive: true, force: true });
      throw cause;
@@ -162,6 +176,11 @@ export class SafeOutputTree {
  /** Sync the owned output tree and prevent further writes through this instance. */
  async commit(): Promise<void> {
    this.#assertWritable();
+    // Windows has no directory fsync; file contents are already synced in write().
+    if (this.platform === "win32") {
+      this.#published = true;
+      return;
+    }
    const parent = await open(
      dirname(this.#outputRoot),
      constants.O_RDONLY | constants.O_DIRECTORY,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
github-actions[bot]GitHubgithub-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	9622b4b4cf	chore(main): release rea-agents 4.1.0 (#635 ) * chore(main): release rea-agents 4.1.0 * chore: normalize release product catalog --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-10-07 01:57:26 +08:00
N0zoM1z0andGitHub	8238232485	feat(ida): add read-only GUI and headless MCP providers (#754 )	2026-10-07 01:47:05 +08:00
Dery FerdikaandGitHub	c8e66c704a	fix(artifacts): make extraction output tree work on Windows (#753 ) SafeOutputTree.create() called fchmod(0o700) on a directory handle and commit() fsynced a directory handle. Both are POSIX-only: Windows rejects them with EPERM ("operation not permitted, fchmod"/"fsync"), so every extract_artifact call failed with a generic io error and produced no output. Skip the redundant directory chmod and directory fsync on Windows. mkdir already applies the requested mode, and file contents are synced in write(). Add a Windows regression test and run it, plus the archive-safety test, in the curated Windows CI lane so the behavior is covered.	2026-10-07 01:46:52 +08:00
Tufail Akram GitHub Cursor N0zoM1z0	91daaa68ae	docs(browser): add an interaction example that captures the visible result (#750 ) * docs(browser): add an interaction example that captures the visible result Fixes #728 Co-authored-by: Cursor <cursoragent@cursor.com> * docs(browser): wait for asynchronous search results before capture --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: N0zoM1z0 <1705004398@qq.com>	2026-10-07 01:24:22 +08:00
Kaoru0822andGitHub	9a4e6da5a9	fix(firmware): validate configured executables (#751 )	2026-10-07 01:03:55 +08:00
N0zoM1z0andGitHub	fb679b63c2	feat(ghidra): integrate optional NativeAOT metadata recovery (#748 ) * feat(ghidra): integrate optional NativeAOT metadata recovery * fix(ghidra): bind extension snapshots to configured artifacts * test(ghidra): verify lazy NativeAOT startup failures * fix(ghidra): preserve NativeAOT failure reasons and coverage * fix(ghidra): preserve NativeAOT x64 calling conventions * test(ghidra): guard recovered NativeAOT method conventions * fix(ghidra): reject blocking extension file inputs * fix(ghidra): diagnose incompatible NativeAOT extension classes * test(ghidra): verify real extension initialization failures * fix(ghidra): keep extension descriptor fields optional	2026-10-07 00:57:08 +08:00
Kaoru0822andGitHub	6d1f39b250	Merge pull request #749 from kaoru0822-kitauji/fix/javascript-schema-diagnostics fix(javascript): expose result schema failures	2026-10-06 09:01:33 -07:00
Kaoru0822	99263a720d	fix(javascript): expose result schema failures	2026-10-06 08:52:29 -07:00
N0zoM1z0andGitHub	5af1699103	docs: clarify onboarding and align provider guidance (#745 )	2026-10-06 22:57:36 +08:00
Vinay Prasad GitHub morluto	d3f498ceec	docs(hopper): document HopperTargetLease realpath fallback (#711 ) * docs(hopper): document HopperTargetLease realpath fallback Closes #642 * docs(hopper): clarify realpath fallback errors --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-10-06 22:27:57 +08:00
Dery Ferdika GitHub morluto	1d15bcb9ec	fix(browser): classify CSP host sources by their own origin (#707 ) * fix(browser): classify CSP host sources by their own origin A Content-Security-Policy host-source without a scheme (for example `cdn.example.com` or `.trusted.test`) was resolved with `new URL(token, baseUrl)`, so it became a page-relative path and was reported as the observed page's own origin. Third-party script, style, and connect sources were therefore misreported as approved origins, and a bare `` wildcard collapsed to the page origin as well. Resolve host-sources per CSP3 \u00a72.3.1: a scheme-less source inherits the protected resource's scheme, wildcard host/port sources stay classified as a set of origins, and non-host tokens remain `other`. Keyword and scheme sources are unchanged. Adds boundary coverage for scheme-less host sources, wildcards, and scheme inheritance against the approved-origin set. * fix(browser): validate CSP host source syntax --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-10-06 22:26:57 +08:00
Kaoru0822andGitHub	739039092f	fix(android): validate explicit Java runtime (#742 )	2026-10-06 22:25:54 +08:00
morluto	3f6d6dc756	docs: update Trendshift repository badge	2026-10-06 22:18:21 +08:00
N0zoM1z0andGitHub	5a7c769692	feat(firmware): integrate Binwalk and Unblob analysis * feat(firmware): integrate Binwalk and Unblob analysis * fix(firmware): verify published files and namespace source references * test(firmware): isolate extractor dependency failure from process cleanup * fix(firmware): retain actionable report and cleanup diagnostics * test: assert retained batch output failure diagnostics	2026-10-06 14:16:04 +00:00
Kaoru0822andGitHub	8d7071da4c	Merge pull request #739 from kaoru0822-kitauji/fix/hopper-shutdown-request-diagnostics fix(hopper): retain shutdown request diagnostics	2026-10-06 06:19:07 -07:00
Kaoru0822	72548712fe	fix(hopper): retain shutdown request diagnostics	2026-10-06 05:49:26 -07:00
N0zoM1z0andGitHub	904d03e987	feat(android): integrate static APK analysis with headless JADX (#738 ) * feat(android): integrate static APK analysis with headless JADX * test(android): include APK tools in explicit effects audit	2026-10-06 12:46:48 +00:00
N0zoM1z0andGitHub	d0f3480a3c	feat(evidence): accept exact retained application references (#734 )	2026-10-06 20:17:59 +08:00
Kaoru0822andGitHub	00eb03d0f2	Merge pull request #735 from kaoru0822-kitauji/fix/reference-import-cli-failure-status fix(cli): report reference-source import failures	2026-10-06 05:09:11 -07:00
Kaoru0822andGitHub	75a75cbb20	Merge pull request #731 from kaoru0822-kitauji/fix/semantic-union-unknown-branches fix(javascript): preserve unknown branches in primitive unions	2026-10-06 05:08:54 -07:00
Kaoru0822andGitHub	09c249deb8	Merge pull request #729 from kaoru0822-kitauji/fix/mcp-shutdown-diagnostics fix(mcp): retain shutdown failure diagnostics	2026-10-06 05:08:40 -07:00
Kaoru0822andGitHub	a5b970c6bf	Merge pull request #716 from kaoru0822-kitauji/fix/client-configuration-leading-bom fix(setup): accept leading BOM in JSON client configs	2026-10-06 05:08:25 -07:00
Kaoru0822andGitHub	65c879757e	Merge pull request #715 from kaoru0822-kitauji/fix/typed-seed-array-members fix(trace): match typed seeds against member arrays	2026-10-06 05:08:12 -07:00
Kaoru0822andGitHub	18c18290d0	Merge pull request #714 from kaoru0822-kitauji/fix/cli-json-file-failure-status fix(cli): fail when JSON input files cannot be parsed	2026-10-06 05:07:58 -07:00
Kaoru0822andGitHub	b1b687fb75	Merge pull request #713 from kaoru0822-kitauji/fix/ghidra-universal-macho-refusal fix(ghidra): refuse ambiguous universal Mach-O imports	2026-10-06 05:07:38 -07:00
Kaoru0822andGitHub	863ed47de2	Merge pull request #712 from kaoru0822-kitauji/fix/javascript-resolve-path-semantics fix(javascript): preserve path.resolve reset semantics	2026-10-06 05:07:23 -07:00
Kaoru0822andGitHub	1dccd0dee0	Merge pull request #701 from kaoru0822-kitauji/fix/mixed-signature-slices fix(native): inspect mixed-signature Mach-O slices	2026-10-06 05:07:08 -07:00
Kaoru0822	6582b2433a	fix(ghidra): refuse ambiguous universal Mach-O imports	2026-10-06 05:00:53 -07:00
Kaoru0822	66f3cfa594	fix(native): inspect mixed-signature Mach-O slices	2026-10-06 04:59:15 -07:00
N0zoM1z0andGitHub	e2c23f3640	docs(ghidra): explain first-query deadlines and recovery (#736 )	2026-10-06 19:53:44 +08:00
N0zoM1z0andGitHub	8d44b3edd3	fix(target): explain the JavaScript directory analysis route (#733 )	2026-10-06 19:53:08 +08:00
Kaoru0822	431e8ebfcf	fix(cli): report reference-source import failures	2026-10-06 04:27:34 -07:00
N0zoM1z0andGitHub	9dd6cef90a	fix(process): scope comparison unknowns to their evidence (#732 )	2026-10-06 19:16:49 +08:00
Kaoru0822	9a2f395028	fix(javascript): preserve unknown branches in primitive unions	2026-10-06 04:06:11 -07:00
Kaoru0822	fd008cd8e0	fix(mcp): retain shutdown failure diagnostics	2026-10-06 03:58:12 -07:00
Kaoru0822	fe843ec0b1	fix(setup): accept leading BOM in JSON client configs	2026-10-06 03:40:42 -07:00
Kaoru0822	38ebd54776	fix(trace): match typed seeds against member arrays	2026-10-06 03:24:18 -07:00
Kaoru0822	3201f0538d	fix(cli): fail when JSON input files cannot be parsed	2026-10-06 03:02:22 -07:00
Kaoru0822andGitHub	af48fe8791	Merge pull request #710 from kaoru0822-kitauji/fix/electron-option-property-keys fix(electron): respect computed option keys and overrides	2026-10-06 02:44:14 -07:00
Kaoru0822	417737748a	fix(javascript): preserve path.resolve reset semantics	2026-10-06 02:42:16 -07:00
Kaoru0822	98de3380e3	fix(electron): respect computed option keys and overrides	2026-10-06 02:26:28 -07:00