chore: add Cloud Agent environment install

Save the tested Node 24.18.0 install so Cloud Agents read it from the repository.

.cursor/cloud-agent-install.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NODE_VERSION="24.18.0"
+NODE_SHA256="55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742"
+export PATH="/usr/local/bin:${PATH}"
+
+if [[ "$(/usr/local/bin/node -v 2>/dev/null || true)" != "v${NODE_VERSION}" ]]; then
+  tmp="$(mktemp -d)"
+  curl -fsSL -o "${tmp}/node.tar.xz" "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
+  echo "${NODE_SHA256}  ${tmp}/node.tar.xz" | sha256sum -c -
+  sudo tar -xJf "${tmp}/node.tar.xz" -C /usr/local --strip-components=1
+  rm -rf "${tmp}"
+fi
+
+hash -r
+
+for cmd in node npm npx corepack; do
+  if [[ -x "/usr/local/bin/${cmd}" ]]; then
+    sudo ln -sfn "/usr/local/bin/${cmd}" "/usr/local/cargo/bin/${cmd}"
+  fi
+done
+
+if [[ -f "${HOME}/.bashrc" ]] && ! grep -qF '# rea-dev-node' "${HOME}/.bashrc"; then
+  printf '\n# rea-dev-node\nexport PATH="/usr/local/bin:$PATH"\n' >> "${HOME}/.bashrc"
+fi
+
+npm ci

.cursor/environment.json

@@ -0,0 +1,4 @@
+{
+  "name": "REA",
+  "install": "bash .cursor/cloud-agent-install.sh"
+}

.github/workflows/ci.yml

@@ -77,6 +77,8 @@ jobs:
       - run: npm ci
       - if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
         run: npm run check:ci
+      - if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
+        run: npm run verify:test-discovery
       - if: github.event_name == 'pull_request' && needs.changes.outputs.code != 'true'
         run: npm run format:check
 
@@ -274,8 +276,12 @@ jobs:
       - run: npm ci
       - run: npm run verify:keyed-archive
       - run: npm run verify:asset-catalog
+      - name: Native compiled NIB hierarchy regressions
+        run: npm run test:focused -- src/application/NibNativeHierarchy.test.ts
       - name: Real binary metadata and Interface Builder integration
         run: npm run verify:apple-dispatch && npm run verify:interface-builder
+      - name: Native plist CLI selection regressions
+        run: npm run test:focused -- tests/boundary/cli/nativePlistCli.test.ts
 
   reconstruction-readiness:
     name: Reconstruction readiness
@@ -365,7 +371,11 @@ jobs:
         run: >-
           npx vitest run --coverage.enabled=false
           tests/boundary/filesystem/binaryTarget.test.ts
+          tests/boundary/filesystem/safeOutputTree.test.ts
+          tests/boundary/providers/native/artifactProvider.archiveSafety.test.ts
           tests/boundary/filesystem/setupUnavailableProvider.test.ts
+          tests/boundary/cli/referenceSourceImportStatus.test.ts
+          src/cliReferenceSourceImportStatus.test.ts
           tests/boundary/filesystem/asarInventoryFreshness.test.ts
           tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts
           tests/conformance/providers/ghidra/windowsCapabilities.test.ts

.github/workflows/nativeaot-fixtures.yml

@@ -0,0 +1,44 @@
+name: Source-built NativeAOT fixtures
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "bridge/ghidra/extensions/nativeaot/**"
+      - "scripts/generate-nativeaot-fixtures.mjs"
+      - "tests/fixtures/nativeaot/**"
+      - ".github/workflows/nativeaot-fixtures.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  windows-fixture:
+    name: Build Windows x64 NativeAOT fixture
+    # .NET 8.0.22's bundled linker discovery supports VS 2019/2022.
+    runs-on: windows-2022
+    timeout-minutes: 15
+    env:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_PROCESSOR_COUNT: "1"
+      COMPlus_GCHeapHardLimit: "30000000"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.416"
+      - name: Build benign fixture and independent byte oracle
+        run: node scripts/generate-nativeaot-fixtures.mjs
+      - uses: actions/upload-artifact@v4
+        with:
+          name: nativeaot-win-x64-${{ github.event.pull_request.head.sha || github.sha }}
+          path: |
+            _reference/nativeaot-integration/generated/win-x64/symbols/NativeAotFixture.exe
+            _reference/nativeaot-integration/generated/win-x64/NativeAotFixture.map
+            _reference/nativeaot-integration/generated/win-x64/symbols.txt
+            _reference/nativeaot-integration/generated/win-x64/oracle.json
+          if-no-files-found: error
+          retention-days: 7

.github/workflows/real-browser.yml

@@ -5,10 +5,20 @@ on:
     paths:
       - ".github/workflows/real-browser.yml"
       - "scripts/verify-real-browser.mjs"
+      - "scripts/verify-browser-network.mjs"
+      - "scripts/verify-browser-scripts.mjs"
+      - "scripts/lib/browser-*.mjs"
+      - "scripts/fixtures/browser-network-site.mjs"
+      - "scripts/fixtures/browser-script-site.mjs"
       - "scripts/fixtures/browser-verifier-site.mjs"
       - "scripts/fixtures/page-cdp-proxy.mjs"
       - "src/browser/**"
       - "src/domain/browser*.ts"
+      - "src/domain/webScript*.ts"
+      - "src/application/WebScriptExportService.ts"
+      - "src/contracts/webScriptToolContracts.ts"
+      - "src/server/registerWebScriptTool.ts"
+      - "src/cli/webScriptCommands.ts"
       - "package.json"
       - "package-lock.json"
   workflow_dispatch:

.gitmodules

@@ -0,0 +1,12 @@
+[submodule "third_party/jadx-headless-mcp"]
+	path = third_party/jadx-headless-mcp
+	url = https://github.com/1013503897/jadx-headless-mcp.git
+[submodule "third_party/binwalk"]
+	path = third_party/binwalk
+	url = https://github.com/ReFirmLabs/binwalk.git
+[submodule "third_party/unblob"]
+	path = third_party/unblob
+	url = https://github.com/onekey-sec/unblob.git
+[submodule "third_party/ghidra-nativeaot"]
+	path = third_party/ghidra-nativeaot
+	url = https://github.com/Washi1337/ghidra-nativeaot.git

.jscpd.json

@@ -9,6 +9,7 @@
     ".codex/**",
     ".devin/**",
     "tests/fixtures/**",
+    "third_party/**",
     "tests/conformance/**/*.c",
     "tests/conformance/**/*.m",
     "tests/conformance/**/*.swift",

.oxfmtrc.json

@@ -10,6 +10,7 @@
     "node_modules/**",
     "CHANGELOG.md",
     "package-lock.json",
-    "_reference/**"
+    "_reference/**",
+    "third_party/**"
   ]
 }

.oxlintrc.json

@@ -6,11 +6,19 @@
     "max-depth": ["warn", 4],
     "max-lines": [
       "warn",
-      { "max": 500, "skipBlankLines": true, "skipComments": true }
+      {
+        "max": 500,
+        "skipBlankLines": true,
+        "skipComments": true
+      }
     ],
     "max-lines-per-function": [
       "warn",
-      { "max": 100, "skipBlankLines": true, "skipComments": true }
+      {
+        "max": 100,
+        "skipBlankLines": true,
+        "skipComments": true
+      }
     ],
     "max-params": ["warn", 4],
     "no-var": "warn",
@@ -38,8 +46,74 @@
           {
             "patterns": [
               {
-                "group": ["**/ghidra/**", "**/hopper/**"],
-                "message": "Deep-provider imports belong behind adapters or in the application composition root."
+                "group": [
+                  "**/ghidra/**",
+                  "**/hopper/**",
+                  "**/ida/**",
+                  "**/android/**",
+                  "**/firmware/**"
+                ],
+                "message": "Provider imports belong behind typed ports or in production composition."
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["src/{contracts,domain}/**/*.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": [
+                  "**/application/**",
+                  "**/server/**",
+                  "**/cli/**",
+                  "**/main/**",
+                  "**/cli.*",
+                  "**/main.*",
+                  "**/android/**",
+                  "**/artifacts/**",
+                  "**/browser/**",
+                  "**/dotnet/**",
+                  "**/firmware/**",
+                  "**/ghidra/**",
+                  "**/hopper/**",
+                  "**/ida/**",
+                  "**/native/**",
+                  "**/process/**",
+                  "**/reference/**",
+                  "**/windows/**",
+                  "**/composition/**"
+                ],
+                "message": "Domain and contracts depend inward; use typed ports for application, caller and provider boundaries."
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "files": ["src/application/**/*.ts"],
+      "excludeFiles": ["src/application/runtime.ts"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": [
+                  "**/ghidra/**",
+                  "**/hopper/**",
+                  "**/ida/**",
+                  "**/android/**",
+                  "**/firmware/**",
+                  "**/composition/**"
+                ],
+                "message": "Application workflows use typed ports; production construction belongs in composition."
               }
             ]
           }
@@ -52,7 +126,11 @@
         "max-lines": "off",
         "max-lines-per-function": [
           "error",
-          { "max": 150, "skipBlankLines": true, "skipComments": true }
+          {
+            "max": 150,
+            "skipBlankLines": true,
+            "skipComments": true
+          }
         ]
       }
     },
@@ -71,9 +149,13 @@
                   "**/browser/**",
                   "**/ghidra/**",
                   "**/hopper/**",
+                  "**/ida/**",
                   "**/replay/**",
                   "**/cli.*",
-                  "**/main.*"
+                  "**/main.*",
+                  "**/composition/**",
+                  "**/android/**",
+                  "**/firmware/**"
                 ],
                 "message": "Domain tests may import only their owning domain and inward dependencies."
               }
@@ -139,6 +221,7 @@
     ".cache",
     ".codex",
     ".devin",
-    ".factory"
+    ".factory",
+    "third_party"
   ]
 }

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "4.0.1"
+  ".": "4.1.0"
 }

AGENTS.md

@@ -2,7 +2,7 @@
 
 ## Product Direction
 
-REA exposes reverse-engineering tools through a CLI and MCP server. Hopper and the bring-your-own Ghidra adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. Keep provider-specific code out of the domain and application layers.
+REA exposes reverse-engineering tools through a CLI and MCP server. Hopper, the bring-your-own Ghidra adapter, and the bring-your-own IDA MCP adapter are operation-capable deep binary-analysis providers. Ghidra is supported on Linux x64 and macOS x64/arm64 with matching native decompiler tools, and has an experimental Windows x64 P0 boundary for approved native x86-64 PE applications; on Linux and macOS it supplies inventory, function analysis, and atomic function annotation edits in an ephemeral database, without modifying executable bytes or controlling a GUI. Windows P0 has no mutation authority. IDA adapts upstream legacy attached GUI and modern headless database-supervisor profiles for live read-only analysis; initial real verification covers Windows, and an attached GUI database is never saved or closed. Keep provider-specific code out of the domain and application layers.
 
 Prioritize:
 
@@ -20,7 +20,7 @@ REA is a local-only tool. Preserve caller-selected inputs, captured output, URLs
 REA is a layered ESM TypeScript application. Dependencies flow inward from pure domain logic through contracts, providers, application workflows, and CLI/MCP adapters. See [docs/architecture.mermaid](docs/architecture.mermaid) for the component map.
 
 - `src/domain/` owns pure provider-neutral semantics; `src/contracts/` owns caller-visible schemas and the canonical tool inventory.
-- `src/hopper/`, `src/ghidra/`, `src/browser/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
+- `src/hopper/`, `src/ghidra/`, `src/ida/`, `src/browser/`, `src/native/`, `src/artifacts/`, and `src/dotnet/` own provider-specific boundaries. Keep provider protocols out of domain and application code.
 - `src/application/` composes shared CLI/MCP workflows; `src/server/` translates MCP requests; `src/cli.ts` and `src/main.ts` are the CLI and MCP entry points.
 - `src/process/` owns shared process lifecycle primitives, not provider wire protocols. `bridge/` contains provider-side adapters.
 - `tests/` contains unit, composition, boundary, acceptance, and conformance tests. `scripts/verify-*` contains real-toolchain checks.
@@ -91,6 +91,12 @@ Name tests `*.test.ts`. Use Vitest and production seams (`tests/fixtures/`) rath
 
 Keep tool catalogs complete and self-describing; prefer capability- and session-scoped availability over schema truncation. Serialized bytes alone do not measure agent usability or model context cost.
 
+## Cursor Cloud specific instructions
+
+Development requires Node.js 24.18.0 and npm 11.16.0 (`.nvmrc` and `packageManager`). The Cloud Agent image places an older `node` on `PATH` ahead of a normal install. `.cursor/cloud-agent-install.sh` installs that toolchain under `/usr/local` and prepends `/usr/local/bin` for login shells. Confirm `node -v` is `v24.18.0` before installing dependencies.
+
+`npm ci` installs locked dependencies. `npm run build:cached` produces the CLI and MCP server. `npm run check:fast` is the pre-push typecheck and lint. Hopper, Ghidra, and IDA are optional bring-your-own providers. JavaScript analysis and the deterministic Vitest suites do not need them. `rea doctor` reports those engines as missing until they are configured.
+
 ## Commit & Pull Request Guidelines
 
 Use Conventional Commit subjects because Release Please derives versions and changelogs from them. Examples: `feat: add historical source import`, `fix(process): stop timers after exit`, and `docs: update architecture`. Use `!` or a `BREAKING CHANGE:` footer for breaking changes. Pull request titles must follow the same format because squash merges use the title as the release commit. Pull requests should describe contract or behavior changes, list verification commands, link issues, and include sanitized MCP examples when schemas change. State whether real Hopper/Ghidra verification was performed. Never commit binaries, Hopper or Ghidra project documents, credentials, `dist/`, `node_modules/`, or local planning artifacts (e.g. `.codex/`).

CHANGELOG.md

@@ -1,5 +1,134 @@
 # Changelog
 
+## [4.1.0](https://github.com/morluto/rea/compare/rea-agents-4.0.1...rea-agents-4.1.0) (2026-10-06)
+
+
+### Features
+
+* **android:** integrate static APK analysis with headless JADX ([#738](https://github.com/morluto/rea/issues/738)) ([904d03e](https://github.com/morluto/rea/commit/904d03e987a6c498561b314a266202dee84b13ab))
+* **evidence:** accept exact retained application references ([#734](https://github.com/morluto/rea/issues/734)) ([d0f3480](https://github.com/morluto/rea/commit/d0f3480a3cb9887499c2b188c783dd1c4db09787))
+* **firmware:** integrate Binwalk and Unblob analysis ([5a7c769](https://github.com/morluto/rea/commit/5a7c769692c21efc4cc0e5ebf06a9f2534dc75ed))
+* **ghidra:** add atomic function annotation edits ([#709](https://github.com/morluto/rea/issues/709)) ([9bab553](https://github.com/morluto/rea/commit/9bab55337ab10616be6929afddb08fb19fbb8ab7))
+* **ghidra:** admit explicit DOS COM analysis ([#702](https://github.com/morluto/rea/issues/702)) ([5bcb664](https://github.com/morluto/rea/commit/5bcb6645b561e666b7e07dd8f38d2296fa7cbba8))
+* **ghidra:** enable Windows x64 read-only analysis ([#699](https://github.com/morluto/rea/issues/699)) ([26881da](https://github.com/morluto/rea/commit/26881da76aa320c8529fcc741df0fc9898d97bdc))
+* **ghidra:** integrate optional NativeAOT metadata recovery ([#748](https://github.com/morluto/rea/issues/748)) ([fb679b6](https://github.com/morluto/rea/commit/fb679b63c27e6c5f137532953cfa24a2ffb1aaf2))
+* **ghidra:** verify DOS load images and expose memory evidence ([#697](https://github.com/morluto/rea/issues/697)) ([a6a8f67](https://github.com/morluto/rea/commit/a6a8f67649cab558b0de11601e65425f280c7170))
+* **ida:** add read-only GUI and headless MCP providers ([#754](https://github.com/morluto/rea/issues/754)) ([8238232](https://github.com/morluto/rea/commit/82382324855a3a4ed51d2cdc3b2b455c9e8419e2))
+* **setup:** support Command Code MCP registration ([#645](https://github.com/morluto/rea/issues/645)) ([7f1ae42](https://github.com/morluto/rea/commit/7f1ae42f71ce85547d317eed5e62fa330d9876bb))
+
+
+### Bug Fixes
+
+* **android:** validate explicit Java runtime ([#742](https://github.com/morluto/rea/issues/742)) ([7390390](https://github.com/morluto/rea/commit/739039092f98c67e8e6ccfb1f8445e8f13ac8f15))
+* **artifacts:** make extraction output tree work on Windows ([#753](https://github.com/morluto/rea/issues/753)) ([c8e66c7](https://github.com/morluto/rea/commit/c8e66c704a70f5133922aa1bd1a3ba42959093ba))
+* **browser:** classify CSP host sources by their own origin ([#707](https://github.com/morluto/rea/issues/707)) ([1d15bcb](https://github.com/morluto/rea/commit/1d15bcb9ecd7efa487a8fd3f0d9755bd60051722))
+* **browser:** keep bare module locations unresolved ([#676](https://github.com/morluto/rea/issues/676)) ([8189081](https://github.com/morluto/rea/commit/8189081511441f0e3909b21b80c21c658ec9a453))
+* **ci:** upload Vitest blob reports from current path ([77799e6](https://github.com/morluto/rea/commit/77799e6c90ce36cd52e45b62c9cba2d46641c4cf))
+* **cli:** disable unmanaged skill synchronization ([433ebda](https://github.com/morluto/rea/commit/433ebda8b492f388faf6e6cac63ccc6f9c2d8d7e))
+* **cli:** disable unmanaged skill synchronization ([2c1bf92](https://github.com/morluto/rea/commit/2c1bf9201040ed3d60f475af9129b7bf85a508fa))
+* **cli:** fail when JSON input files cannot be parsed ([18c1829](https://github.com/morluto/rea/commit/18c18290d048b78a435f6864dfc778a9fea0af2e))
+* **cli:** fail when JSON input files cannot be parsed ([3201f05](https://github.com/morluto/rea/commit/3201f0538dc88e54bce00decf689bf9b5603bfd3))
+* **cli:** include build step in missing-runtime recovery ([6a37346](https://github.com/morluto/rea/commit/6a37346acb9829acaab0e2042624e6ea0d03e2a9))
+* **cli:** include build step in missing-runtime recovery ([ae72abd](https://github.com/morluto/rea/commit/ae72abd019b25347bfc7593b5dcadc5a2cbc3786))
+* **cli:** report reference-source import failures ([00eb03d](https://github.com/morluto/rea/commit/00eb03d0f2247da95dfa7bda0f41a0f366a25dd9))
+* **cli:** report reference-source import failures ([431e8eb](https://github.com/morluto/rea/commit/431e8ebfcfba2925904c0deb4888bbd3755b17bf))
+* **comparison:** break function collection collation ties ([c3d013b](https://github.com/morluto/rea/commit/c3d013b2fd5c3a32dfa73ef40dafdaeaf935f37e))
+* **comparison:** break function collection collation ties ([3aaf7e2](https://github.com/morluto/rea/commit/3aaf7e2c54029a456145d6e3287fd9122f3abbe3))
+* **comparison:** break JSON shape collation ties ([217e8cf](https://github.com/morluto/rea/commit/217e8cf59f49e2f68b394fbcbc87f914dbee97ee))
+* **comparison:** break JSON shape collation ties ([805c338](https://github.com/morluto/rea/commit/805c338f360184d73ae335a723fca656830d6328))
+* **comparison:** retain container-only export shape paths ([a55b5bb](https://github.com/morluto/rea/commit/a55b5bb8ee400ef5565954d57916e8aae7dac760))
+* **comparison:** retain container-only export shape paths ([7864d66](https://github.com/morluto/rea/commit/7864d665e15edec29ade0f3fb7ac374b8579c2c0))
+* **dotnet:** preserve leading Unicode content in metadata strings ([#667](https://github.com/morluto/rea/issues/667)) ([ddea063](https://github.com/morluto/rea/commit/ddea06360a09508a0ff695ab6e141eff19534619))
+* **electron:** respect computed option keys and overrides ([af48fe8](https://github.com/morluto/rea/commit/af48fe879161ee749692751b3e29ba06b63b7409))
+* **electron:** respect computed option keys and overrides ([98de338](https://github.com/morluto/rea/commit/98de3380e3062cb25778263bfea07b215a09b39c))
+* **evidence:** admit current process provider identity ([ab5a1c6](https://github.com/morluto/rea/commit/ab5a1c61b12475c554a5e4d60b48b642b2464bbb))
+* **evidence:** admit current process provider identity ([d311940](https://github.com/morluto/rea/commit/d311940f2414fe5cceb750de4464b681bb44ae1e))
+* **firmware:** validate configured executables ([#751](https://github.com/morluto/rea/issues/751)) ([9a4e6da](https://github.com/morluto/rea/commit/9a4e6da5a96ed2708a0f628b436dcd7415999327))
+* **ghidra:** preserve request and shutdown failure diagnostics ([#647](https://github.com/morluto/rea/issues/647)) ([19f8cdd](https://github.com/morluto/rea/commit/19f8cddfd6f283188567b8ff1e49b810d79952ee))
+* **ghidra:** refuse ambiguous universal Mach-O imports ([b1b687f](https://github.com/morluto/rea/commit/b1b687fb75325c0275a0cf161843fc5969ba1d47))
+* **ghidra:** refuse ambiguous universal Mach-O imports ([6582b24](https://github.com/morluto/rea/commit/6582b2433a955167e33246ad07de1a40bcb20144))
+* **hopper:** retain shutdown request diagnostics ([8d7071d](https://github.com/morluto/rea/commit/8d7071da4c61c5cfb4894be6536405affd90f276))
+* **hopper:** retain shutdown request diagnostics ([7254871](https://github.com/morluto/rea/commit/72548712fea972b920834663a5e2ceea4738ce1e))
+* integrate 14 approved fix PRs (668,671,673,675,678-681,685-690) ([#705](https://github.com/morluto/rea/issues/705)) ([cf06115](https://github.com/morluto/rea/commit/cf061159ab69a746675e48896fa953d6990c05f9))
+* **javascript:** count all source line terminators ([e60aa11](https://github.com/morluto/rea/commit/e60aa1110800e1309b482e7a44ecd1762bade992))
+* **javascript:** count all source line terminators ([03bc6d3](https://github.com/morluto/rea/commit/03bc6d36db94e70c709557cb7302d40af9e99e6b))
+* **javascript:** expose result schema failures ([6d1f39b](https://github.com/morluto/rea/commit/6d1f39b250f8a1c6f924b1a6b9d26d56dff4beee))
+* **javascript:** expose result schema failures ([99263a7](https://github.com/morluto/rea/commit/99263a720d7106aff059ad7fa43849151a94c963))
+* **javascript:** hash graph and evidence JSON incrementally ([#646](https://github.com/morluto/rea/issues/646)) ([9f42495](https://github.com/morluto/rea/commit/9f42495d11100adc8646de5c8b62762ab9715ae6))
+* **javascript:** preserve path.resolve reset semantics ([863ed47](https://github.com/morluto/rea/commit/863ed47de2e35ef9b734e45e3bb44ea9e9dc8ff6))
+* **javascript:** preserve path.resolve reset semantics ([4177377](https://github.com/morluto/rea/commit/417737748aa96ba38ced7b0b22dbb972187f2ee0))
+* **javascript:** preserve primitive addition coercion ([#666](https://github.com/morluto/rea/issues/666)) ([94cc847](https://github.com/morluto/rea/commit/94cc8475e0e9e24cd2e8345bd36a743a979e3620))
+* **javascript:** preserve unknown branches in primitive unions ([75a75cb](https://github.com/morluto/rea/commit/75a75cbb20aa9b2148f9fd0547f613eadda68edd))
+* **javascript:** preserve unknown branches in primitive unions ([9a2f395](https://github.com/morluto/rea/commit/9a2f3950286a01922be0b07b29c4aefee466ec1e))
+* **javascript:** read source-map directives only from comments ([#672](https://github.com/morluto/rea/issues/672)) ([7f1fa64](https://github.com/morluto/rea/commit/7f1fa64019e01a654ad0eb80b47d268a58f04e57))
+* **javascript:** scope candidate ambiguity to query traversal ([6ad62ce](https://github.com/morluto/rea/commit/6ad62cec6abf182a52cf9844145e147fb6399c8e))
+* **javascript:** scope candidate ambiguity to query traversal ([f94fc79](https://github.com/morluto/rea/commit/f94fc7967b2e5604c144d3638515caad6273a0c6))
+* **mcp:** retain shutdown failure diagnostics ([09c249d](https://github.com/morluto/rea/commit/09c249deb86068503611fc474e76018d5c2a4d0b))
+* **mcp:** retain shutdown failure diagnostics ([fd008cd](https://github.com/morluto/rea/commit/fd008cd8e0b8277e691efd8e69dc96ac8e188d9e))
+* **native:** inspect mixed-signature Mach-O slices ([1dccd0d](https://github.com/morluto/rea/commit/1dccd0dee04abfdc80e8b48e3f05fa39cccf0feb))
+* **native:** inspect mixed-signature Mach-O slices ([66f3cfa](https://github.com/morluto/rea/commit/66f3cfa594a86cbf1f21fc6d2eca1a82e236c896))
+* **native:** retain spaced symbols in dyld inventory ([#669](https://github.com/morluto/rea/issues/669)) ([fa02df9](https://github.com/morluto/rea/commit/fa02df9ad3bc3139ef10422dedffac88c4d51d36))
+* **native:** select concrete arm64e Mach-O slices ([f04445c](https://github.com/morluto/rea/commit/f04445c57c597a8312211139b75da706cb0c2a96))
+* **native:** select concrete arm64e Mach-O slices ([fd3282a](https://github.com/morluto/rea/commit/fd3282a87e40417cf3d7d6211743809f9bad2dc8))
+* **process:** honor disabled PID normalization in samples ([44b3627](https://github.com/morluto/rea/commit/44b3627ab0b32c42e545dd2fd095006d249a77f6))
+* **process:** honor disabled PID normalization in samples ([a4e5736](https://github.com/morluto/rea/commit/a4e57366dd75077bde07f25c7966204cedad929e))
+* **process:** scope comparison unknowns to their evidence ([#732](https://github.com/morluto/rea/issues/732)) ([9dd6cef](https://github.com/morluto/rea/commit/9dd6cef90abf89f9191bce942e31900870231968))
+* **reconstruction:** accept function comparison source parameters ([c3bc38b](https://github.com/morluto/rea/commit/c3bc38bf6c74d2175a4680530dcadd6cab0e7791))
+* **reconstruction:** accept function comparison source parameters ([7a96391](https://github.com/morluto/rea/commit/7a96391001780012f704f4ef5cb6597baa590b7d))
+* **reference:** bound Dockerfile language detection ([132a3a4](https://github.com/morluto/rea/commit/132a3a46be648b036ed36372a50d6e32a9e7f2e5))
+* **reference:** bound Dockerfile language detection ([53fa559](https://github.com/morluto/rea/commit/53fa55937f241fc9ef3091eb22314cc370c749b9))
+* **reference:** classify test suffixes before extensions ([e828acc](https://github.com/morluto/rea/commit/e828acce0e0bf3808773590cf2dbb0bc8227df7b))
+* **reference:** classify test suffixes before extensions ([8b228ae](https://github.com/morluto/rea/commit/8b228ae7010144b69a243c9682aeb0a1dc4249a3))
+* **reference:** distinguish computed require member names ([ba35b55](https://github.com/morluto/rea/commit/ba35b5509db60c18dd43e350e0dd4a0b5f229c69))
+* **reference:** distinguish computed require member names ([df6e476](https://github.com/morluto/rea/commit/df6e476d67b2719c4b998daa3e9ad8a4b157ace2))
+* **reference:** preserve unresolved absolute module specifiers ([#670](https://github.com/morluto/rea/issues/670)) ([c8aed47](https://github.com/morluto/rea/commit/c8aed4740d52b1eecaa93b3a527e8b3814dc88a4))
+* **reference:** read linked worktree commit provenance ([#677](https://github.com/morluto/rea/issues/677)) ([d565ecd](https://github.com/morluto/rea/commit/d565ecdc257514f5d0c5a412081e322fc66d4215))
+* **reference:** recognize CMake build manifests ([#665](https://github.com/morluto/rea/issues/665)) ([1a24be5](https://github.com/morluto/rea/commit/1a24be574d1860931ff8d4c8ec07f3968fff9fd5))
+* **reference:** retain dynamic import relationships ([a5d2986](https://github.com/morluto/rea/commit/a5d2986b1e517b71a1ed51be433c95e975eafe32))
+* **reference:** retain dynamic import relationships ([b89de8f](https://github.com/morluto/rea/commit/b89de8feab389477a468f0b89b8dfa35d7ddc102))
+* **reference:** retain recovered parser diagnostics ([11d0ef2](https://github.com/morluto/rea/commit/11d0ef2e09308ac06889865b3fcf356b8ffa647f))
+* **reference:** retain recovered parser diagnostics ([ed3a7f0](https://github.com/morluto/rea/commit/ed3a7f070cf0793e22b9a0bbfd1f2ebe9dabcfd0))
+* **setup:** accept leading BOM in JSON client configs ([a5b970c](https://github.com/morluto/rea/commit/a5b970c6bf6848145a82de51c001410aa4d50f6f))
+* **setup:** accept leading BOM in JSON client configs ([fe843ec](https://github.com/morluto/rea/commit/fe843ec0b101544e22d7599d93b36377d3e3bc34))
+* **setup:** align Node runtime checks with package engines ([5802ef8](https://github.com/morluto/rea/commit/5802ef8746412649bb641332f2fa7e69bb1a86a3))
+* **setup:** align Node runtime checks with package engines ([ea0b733](https://github.com/morluto/rea/commit/ea0b733687582d6cc28b42beaf2fc7a48be07b6a))
+* **target:** explain the JavaScript directory analysis route ([#733](https://github.com/morluto/rea/issues/733)) ([8d44b3e](https://github.com/morluto/rea/commit/8d44b3edd36b528c308e32328552ca386dc43e91))
+* **trace:** match typed seeds against member arrays ([65c8797](https://github.com/morluto/rea/commit/65c879757ea09fabc5fc036d6e3395fd2939995c))
+* **trace:** match typed seeds against member arrays ([38ebd54](https://github.com/morluto/rea/commit/38ebd54776d661ced2e6cc2c5e4b260653a086d9))
+
+
+### Code Refactoring
+
+* **app:** split Setup and ProcessOwnership modules ([#628](https://github.com/morluto/rea/issues/628)) ([3c84080](https://github.com/morluto/rea/commit/3c84080aab5e5aa6c9fc14bafa07c635b537b64d))
+* **cli:** collapse duplicate CLI layer into src/cli ([#630](https://github.com/morluto/rea/issues/630)) ([494d4db](https://github.com/morluto/rea/commit/494d4db6d9d519f9258a25504cf29b07d61fbb9f))
+* **contracts:** split tool contracts by family ([#634](https://github.com/morluto/rea/issues/634)) ([5295d56](https://github.com/morluto/rea/commit/5295d56b105074b290e0d881df43cd13e34a2f8b))
+* **domain:** consolidate canonical ordering and digest helpers ([#624](https://github.com/morluto/rea/issues/624)) ([ba3869c](https://github.com/morluto/rea/commit/ba3869c597133b63fdcc0077c558923ae2e17a3f))
+* **domain:** split error taxonomy into thematic modules ([#636](https://github.com/morluto/rea/issues/636)) ([735c100](https://github.com/morluto/rea/commit/735c10059ca161967d71ccf8fa3f62011d2a22ca))
+* **native:** extract FAT header format switch in Mach-O slice selection ([#632](https://github.com/morluto/rea/issues/632)) ([38b2933](https://github.com/morluto/rea/commit/38b293329ca06c424a58bb59a28728f19015ce22))
+* **runtime:** centralize safe JSON parsing and preserve error causes ([#629](https://github.com/morluto/rea/issues/629)) ([e7f54b3](https://github.com/morluto/rea/commit/e7f54b3310b7f45af11c1754e468d4d3804191db))
+* **runtime:** name all silent catch causes without changing diagnostics ([#637](https://github.com/morluto/rea/issues/637)) ([5f27e02](https://github.com/morluto/rea/commit/5f27e02fae670774667de3618c88ba2ab0e7b661))
+
+
+### Documentation
+
+* add the official Trendshift badge to README headers ([b6c21b1](https://github.com/morluto/rea/commit/b6c21b1db5d4ff4be0968aa26693916537622a06))
+* add the official Trendshift badge to README headers ([7d4ed59](https://github.com/morluto/rea/commit/7d4ed59816388409885310f40c12dfdcdd2d9246))
+* align MCP discovery and skill guidance with the stable catalog ([#664](https://github.com/morluto/rea/issues/664)) ([39db9fe](https://github.com/morluto/rea/commit/39db9fe4245cc8142f57f4feeadaff64cb894e31))
+* **browser:** add an interaction example that captures the visible result ([#750](https://github.com/morluto/rea/issues/750)) ([91daaa6](https://github.com/morluto/rea/commit/91daaa68aea3bbee02b837ac64d3ad13127d601e))
+* clarify onboarding and align provider guidance ([#745](https://github.com/morluto/rea/issues/745)) ([5af1699](https://github.com/morluto/rea/commit/5af169910391f6b95492865247fabf3c4735a9d6))
+* correct CLI examples and documentation checks ([#655](https://github.com/morluto/rea/issues/655)) ([fc80ea8](https://github.com/morluto/rea/commit/fc80ea88dfb7bde43e89db0f341c99d7b53c1a7c))
+* fix architecture diagram and pretty-print tool catalog ([#626](https://github.com/morluto/rea/issues/626)) ([5e7f35c](https://github.com/morluto/rea/commit/5e7f35c7c3ea8d504421a2623eafd1d73fea08a0))
+* **ghidra:** explain first-query deadlines and recovery ([#736](https://github.com/morluto/rea/issues/736)) ([e2c23f3](https://github.com/morluto/rea/commit/e2c23f3640f83c13587603c763dbd7b5ef1bbbb0))
+* **hopper:** document HopperTargetLease realpath fallback ([#711](https://github.com/morluto/rea/issues/711)) ([d3f498c](https://github.com/morluto/rea/commit/d3f498ceec65e4f61f39036ab943ace7ef1b9de5))
+* **installation:** pin manual MCP registration to the release version ([#658](https://github.com/morluto/rea/issues/658)) ([8dd1d84](https://github.com/morluto/rea/commit/8dd1d8447146b9962ec7ab2f245b0fe47d3ddf44))
+* update Trendshift repository badge ([3f6d6dc](https://github.com/morluto/rea/commit/3f6d6dc756d99ca6e7cdc1737522842fcbaee839))
+
+
+### Tests
+
+* extract shared fixtures, drop knip carve-outs ([#627](https://github.com/morluto/rea/issues/627)) ([55e5eb0](https://github.com/morluto/rea/commit/55e5eb090bb3d6cf347d7cc2f8f028b35b7461ba))
+* **hopper:** synchronize startup cancellation with launcher readiness ([#662](https://github.com/morluto/rea/issues/662)) ([88a3c3f](https://github.com/morluto/rea/commit/88a3c3f8a4bf5cb31f60bca4696431c4e4512b30))
+
 ## [4.0.1](https://github.com/morluto/rea/compare/rea-agents-4.0.0...rea-agents-4.0.1) (2026-10-05)
 
 

CONTRIBUTING.md

@@ -2,11 +2,15 @@
 
 REA welcomes focused bug fixes, documentation improvements, tests, and reverse-engineering workflow enhancements. Open an issue before a large contract or architecture change so its scope can be agreed before implementation.
 
+For capability organization and provider composition, follow the incremental
+[migration guide](docs/capability-migration.md). Run `npm run verify:test-discovery`
+after adding or moving tests.
+
 When adding or changing an MCP tool, follow the [tool design guide](docs/tool-design.md) and preserve the canonical contracts and generated catalog.
 
 ## Development setup
 
-REA development requires Node.js 24.18.x and npm 11.16.x. Real-Hopper verification additionally requires either macOS 12+ or an officially supported Linux host (Ubuntu 24.04+, Fedora 41+, or 64-bit Arch) and an installed Hopper application. Linux demo verification uses its own private Xvfb display and does not require a desktop session. Run `nvm use` before installing dependencies.
+REA development requires Node.js 24.18.x and npm 11.16.x (pinned toolchain via `nvm use`; the supported runtime range is Node.js ^22.19 || ^24.11 || >=26, as the README badge states). Real-Hopper verification additionally requires either macOS 12+ or an officially supported Linux host (Ubuntu 24.04+, Fedora 41+, or 64-bit Arch) and an installed Hopper application. Linux demo verification uses its own private Xvfb display and does not require a desktop session. Run `nvm use` before installing dependencies.
 
 ```bash
 npm ci

README.md

@@ -4,7 +4,7 @@
 
 # REA: Reverse Engineer Anything
 
-### Reverse engineer anything with agents, from app behavior down to native binaries.
+### One MCP for reverse engineering across binaries, applications, and runtime behavior.
 
 **See a feature you like. Understand how it works, down to the binary level.**
 
@@ -15,7 +15,7 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
 
 [Quick start](#quick-start) · [Current status](#current-status) · [Investigation model](#the-investigation-model) · [Tool catalog](#tool-catalog-for-investigation) · [Roadmap](#roadmap) · [How it works](#how-it-works)
 
@@ -49,50 +49,7 @@ See a feature in an app that you want in your own product? Ask your agent to inv
 
 REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, and websites. You can also use the same tools from your terminal. Analysis runs locally, and results include the evidence and limitations behind each conclusion.
 
-Setup configures your agent and connects it to Hopper or Ghidra. If you need an analysis tool, setup can install Hopper for you.
-
-## Just ask your agent
-
-After [setup](#quick-start), restart your agent and ask:
-
-```text
-Understand how search works in the Notes app, show me the evidence, and build a
-similar feature for my project.
-```
-
-Replace Notes with the app you want to understand, or ask for an overview first.
-
-## The investigation model
-
-<table>
-<tr>
-<td width="33%" valign="top">
-<strong>Decompile</strong><br /><br />
-Open an app and recover readable code, strings, names, and other clues about how it works.
-</td>
-<td width="33%" valign="top">
-<strong>Understand</strong><br /><br />
-Follow the code from one part of the app to another until the agent can explain how a feature actually works.
-</td>
-<td width="33%" valign="top">
-<strong>Recreate</strong><br /><br />
-Turn what the agent learned into a feature for your own product, adapted to your stack, interface, and requirements.
-</td>
-</tr>
-</table>
-
-REA shows how it reached its conclusions. It does not claim to recover original source code or automatically clone an application.
-
-## Why REA
-
-|                          |                                                                                                       |
-| ------------------------ | ----------------------------------------------------------------------------------------------------- |
-| **Built for agents**     | Ask what an app does and let your agent inspect it instead of guessing.                               |
-| **CLI and MCP**          | Run the same reverse-engineering capabilities from your terminal or agent.                            |
-| **Guided setup**         | Configure your agent, connect an existing analysis tool, or install Hopper with your approval.        |
-| **From insight to code** | Understand a feature, then build your own version in the same coding session.                         |
-| **Local by design**      | Analysis runs on your supported local host. REA does not upload the app to a hosted analysis service. |
-| **Keeps context**        | Investigate several apps without starting over for every question.                                    |
+Setup registers REA with your agent and installs matching workflow instructions. Native analysis can use an existing Hopper or Ghidra installation; setup can optionally install Hopper with approval. Static JavaScript analysis needs neither engine.
 
 ## Quick start
 
@@ -108,21 +65,36 @@ Choose which supported agents should use REA, then review the exact paths and ch
 
 Setup shows its changes before applying them and backs up existing configuration. See [Installation and setup](docs/installation.md) for requirements and setup options.
 
+### AI Coding Assistants (optional)
+
+Add the skill to your AI coding assistant for richer context:
+
+```bash
+npx skills add morluto/rea --skill reverse-engineer-anything
+```
+
+The skill provides REA's investigation workflow. Run setup above to connect REA to your agent and configure analysis tools. Setup already installs a version-matched skill by default; this command installs the repository version.
+
 ### With an agent (recommended)
 
 After setup, restart your agent and [describe the app or feature](#just-ask-your-agent) you want to understand. Hopper can run in demo mode; if it shows a first-run prompt, choose the demo or enter an existing license.
 
 REA supports Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, and VS Code. Existing REA registrations are selected by default during setup; other detected agents remain unselected until chosen. Other agents can use the [manual MCP configuration](#manual-mcp-configuration).
 
-### From the terminal with npx
+### First result from the terminal
 
-After setup, run:
+For your extracted JavaScript/Electron application tree or ASAR, run:
 
 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
 ```
 
+Replace the path with your target (for example, `"D:/apps/example"` on Windows).
+This returns inline Evidence, recovered graph, limitations, and unknowns without
+MCP setup, Hopper, Ghidra, or executing the application. For a native app, configure
+its engine first, then use `analyze` with that app's path. Run `doctor` when you
+need diagnosis; it is not a prerequisite for each analysis.
+
 ### Install the rea command
 
 Install the command-line interface:
@@ -144,14 +116,22 @@ Update either installation with `rea update`.
 
 ### Requirements
 
+Static JavaScript inspection requires the Node/npm runtime only. Host and
+external-tool prerequisites depend on the selected workflow; the native
+provider guides describe their supported platforms.
+
 - macOS 12 or newer
 - Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
 - Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+
 - npm; REA does not require or install a particular npm version
 
-Native binary analysis requires [Hopper](https://www.hopperapp.com/) or [Ghidra](#ghidra-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. REA can use Ghidra that you have already installed.
+Deep native binary analysis requires [Hopper](https://www.hopperapp.com/), [Ghidra](#ghidra-analysis-provider), or [IDA Pro](#ida-pro-analysis-provider). Hopper is separate software with its own license; its demo supports analysis with vendor-defined limits. Ghidra and IDA are bring-your-own providers.
 
-Windows Ghidra support is experimental for native x86-64 PE applications on local NTFS. The package bundles native Job Object, private-DACL, and path-admission controls. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for prerequisites and verified scope.
+Firmware region inspection and explicit extraction use caller-supplied Binwalk and Unblob on Linux. See [Firmware analysis](docs/firmware-analysis.md) for setup, provenance, resource limits and native handoff.
+
+Static APK analysis uses a separately supplied headless JADX JAR and Java, with no emulator or APK execution. See [Android analysis](docs/android-analysis.md) for setup, CLI/MCP operations, coverage and public test fixtures.
+
+Repository main and npm 4.1.0 include experimental Windows x64 Ghidra support for native x86-64 PE applications on local NTFS, with bundled Job Object, private-DACL, and path-admission controls. Check the [release boundary](docs/installation.md#released-package-and-main) before expecting this from an older npm package. See [Windows Ghidra P0](docs/windows-ghidra-p0.md) for prerequisites and verified scope.
 
 If something is not working, run:
 
@@ -202,9 +182,13 @@ Setup checks the installations and saves their paths in your selected agents' co
 
 The adapter exposes inventory, function, memory and load-image inspection, plus atomic function annotation edits on Linux and macOS. `annotate_native_function` edits names and entry comments in the session database and returns a refreshed function dossier; executable bytes stay unchanged. Ghidra does not provide GUI controls through REA.
 
+Opening a Ghidra target selects its provider; the first analysis query starts import and auto-analysis. That query can take longer than a client's default request deadline. See [first-query deadlines and recovery](docs/mcp-contracts.md#ghidra-first-query-deadlines-and-recovery) for an SDK example and cancellation recovery.
+
 REA analyzes a temporary copy of the target and removes the temporary project when the session closes. Results identify what Ghidra observed and what it could not resolve. Decompilation produces pseudocode rather than the original source.
 
 Ghidra also imports DOS MZ executables with an explicit 16-bit x86 real-mode profile. Function results include complete observed body ranges, distinguishing owned bytes from the enclosing span. See the [DOS analysis guide](docs/ghidra-dos.md) for addresses, packing, and verification boundaries.
+See [optional NativeAOT metadata recovery](docs/ghidra-nativeaot.md) for the pinned
+headless adapter, supported layout and existing native-tool workflow.
 
 Windows Ghidra P0 uses bundled native controls for its read-only native x86-64 PE boundary on local NTFS; see the [Windows Ghidra P0 guide](docs/windows-ghidra-p0.md). See [Ghidra installation](docs/installation.md#ghidra), [provider evaluation](docs/provider-evaluation.md), and [testing](docs/testing.md) for configuration details, coverage, and real-provider verification.
 
@@ -217,6 +201,19 @@ rea uninstall --purge-data # also removes only ~/.rea/cache and ~/.rea/state
 
 Uninstall preserves Hopper, Node.js, Evidence files, captures, unrelated skills, and other MCP servers. It refuses malformed client configuration and never follows purge-data symlinks.
 
+### IDA Pro analysis provider
+
+Already have [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) working? REA can reuse its MCP registration for read-only analysis of the current GUI target, or use its database supervisor to open and analyze a supplied binary headlessly.
+
+```bash
+export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
+rea function /absolute/path/to/program main --provider ida --json
+```
+
+The registration selects `attached` (default, legacy 1.4 tools) or `headless` (modern database supervisor). Setup can preserve this file reference in your selected agent's REA registration. REA adapts existing analysis contracts and manages its own headless database; it leaves an attached GUI database open and never saves it. Results stay live because external IDA database changes are not immutable snapshots.
+
+See the [IDA provider guide](docs/ida-provider.md) for upstream installation links, exact configuration examples, Windows-native headless operation, lifecycle cleanup, and coverage. The initial real workflows cover a Windows GUI and Windows x64 headless IDA 9.3; other engine/platform combinations remain unverified. Use a package version that includes this adapter; repository main can lead the npm release.
+
 ### CLI or agent?
 
 | If you want to…                                                  | Use                                                                 |
@@ -253,6 +250,11 @@ Import an older source tree as a reference. REA keeps it separate from observati
 rea import-reference-source /absolute/path/to/source
 ```
 
+Historical-source import requires safe no-follow file opens and currently runs
+on Linux and macOS. Native Windows reports `unsupported_host`; run the import
+with Linux REA in WSL or on another supported host. Changing permissions or
+reinstalling REA does not enable this Windows workflow.
+
 Imports read the path supplied to the command. File names do not cause automatic omissions; files are represented by hashes and metadata. To exclude selected paths, set `REA_REFERENCE_SECRET_PATTERNS_JSON` to a JSON string array of ignore patterns. Exports never replace an existing file unless `--overwrite` is explicit.
 
 Use a snapshot to save successful analysis results and reuse them on later runs. REA reuses a result only when the target bytes, operation, parameters, analysis tool, and settings match. It does not cache changes or cursor-dependent calls. Snapshot files stay local and use owner-only permissions.
@@ -270,6 +272,49 @@ result is returned. Pass `snapshot_path` and, when required, `overwrite: true` t
 `close_binary` to save atomically before Hopper resources are released. If the
 save fails, REA deliberately leaves the session open.
 
+## Just ask your agent
+
+After [setup](#quick-start), restart your agent and ask:
+
+```text
+Understand how search works in the Notes app, show me the evidence, and build a
+similar feature for my project.
+```
+
+Replace Notes with the app you want to understand, or ask for an overview first.
+
+## The investigation model
+
+<table>
+<tr>
+<td width="33%" valign="top">
+<strong>Decompile</strong><br /><br />
+Open an app and recover readable code, strings, names, and other clues about how it works.
+</td>
+<td width="33%" valign="top">
+<strong>Understand</strong><br /><br />
+Follow the code from one part of the app to another until the agent can explain how a feature actually works.
+</td>
+<td width="33%" valign="top">
+<strong>Recreate</strong><br /><br />
+Turn what the agent learned into a feature for your own product, adapted to your stack, interface, and requirements.
+</td>
+</tr>
+</table>
+
+REA shows how it reached its conclusions. It does not claim to recover original source code or automatically clone an application.
+
+## Why REA
+
+|                          |                                                                                                       |
+| ------------------------ | ----------------------------------------------------------------------------------------------------- |
+| **Built for agents**     | Ask what an app does and let your agent inspect it instead of guessing.                               |
+| **CLI and MCP**          | Run the same reverse-engineering capabilities from your terminal or agent.                            |
+| **Guided setup**         | Configure your agent, connect an existing analysis tool, or install Hopper with your approval.        |
+| **From insight to code** | Understand a feature, then build your own version in the same coding session.                         |
+| **Local by design**      | Analysis runs on your supported local host. REA does not upload the app to a hosted analysis service. |
+| **Keeps context**        | Investigate several apps without starting over for every question.                                    |
+
 ## One prompt, a full investigation
 
 ```text
@@ -305,29 +350,40 @@ See [native investigation](docs/native-investigation.md) for keyed archives, ins
 
 ## Tool catalog for investigation
 
-| Tool family               | Count | Examples                                                                                                                                                  |
-| ------------------------- | ----: | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Native inspection         |    41 | functions, pseudocode, assembly, strings, symbols, calls, references, annotations, byte reads, and file offsets                                           |
-| Investigation workflows   |    14 | app overviews, function dossiers, native APIs and dispatch, batch decompilation, feature traces, call paths, call graphs, Swift and Objective-C discovery |
-| Native macOS utilities    |     7 | Mach-O metadata, code signatures, plists, architectures, and Swift demangling without launching Hopper                                                    |
-| Artifact graph            |     5 | directory and package inventories, compiled Interface Builder files, Apple asset catalogs, and extraction                                                 |
-| Managed PE/CLI            |     7 | .NET identity, metadata, CIL instructions, native dependencies, reconstruction imports, and build comparisons                                             |
-| Browser observation       |     9 | page structure, network metadata, scripts, source maps, WebMCP discovery, screenshots, and capture comparisons                                            |
-| Electron analysis         |     5 | renderer observation, static app mapping, and static/runtime reconciliation                                                                               |
-| JavaScript runtime        |     2 | Node/Electron Inspector target discovery, script locations, and execution-context events                                                                  |
-| Application workflows     |     7 | cross-layer feature traces, build comparisons, historical source mapping, static return-shape comparison, and reconstruction checks                       |
-| Workspace and observation |    21 | sessions, evidence bundles, navigation context, process/artifact/function comparisons, and open-question tracking                                         |
+| Tool family               | Count | Examples                                                                                                                                                            |
+| ------------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Native inspection         |    41 | functions, pseudocode, assembly, strings, symbols, calls, references, annotations, byte reads, and file offsets                                                     |
+| Investigation workflows   |    14 | app overviews, function dossiers, native APIs and dispatch, batch decompilation, feature traces, call paths, call graphs, Swift and Objective-C discovery           |
+| Native macOS utilities    |     7 | Mach-O metadata, code signatures, plists, architectures, and Swift demangling without launching Hopper                                                              |
+| Artifact graph            |     5 | directory and package inventories, compiled Interface Builder files, Apple asset catalogs, and extraction                                                           |
+| Managed PE/CLI            |     7 | .NET identity, metadata, CIL instructions, native dependencies, reconstruction imports, and build comparisons                                                       |
+| Firmware                  |     2 | Linux firmware region inspection and explicit extraction                                                                                                            |
+| Android APK               |     5 | package and manifest declarations, class search, member inventories, method decompilation, and incoming static references                                           |
+| Browser observation       |     9 | page structure, network metadata, scripts, source maps, WebMCP discovery, screenshots, and capture comparisons                                                      |
+| Electron analysis         |     5 | renderer observation, static app mapping, and static/runtime reconciliation                                                                                         |
+| JavaScript runtime        |     2 | Node/Electron Inspector target discovery, script locations, and execution-context events                                                                            |
+| Application workflows     |     8 | captured website script export; cross-layer feature traces, build comparisons, historical source mapping, static return-shape comparison, and reconstruction checks |
+| Workspace and observation |    21 | sessions, evidence bundles, navigation context, process/artifact/function comparisons, and open-question tracking                                                   |
 
 The public interface describes what the agent is trying to learn. Providers decide how to answer. macOS utilities handle common semantic inspection without launching Hopper; Hopper handles deeper native analysis; the process harness records direct behavioral captures.
 
 ## Current status
 
-REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites; use `rea capabilities` to check what is available on your host.
+REA supports native application, JavaScript, Electron, .NET, and browser investigation on macOS and Linux. Individual tools have platform and runtime prerequisites. `rea capabilities` and `rea providers` describe the binary-session providers and auxiliary operations; they are not an inventory of every browser, Android, or application workflow. Use the connected MCP tool list and `binary_session` tool availability for the full MCP surface, and the relevant guide for each tool's prerequisites. Repository main can be ahead of [the npm release](docs/installation.md#released-package-and-main).
 
-- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through Hopper or Ghidra. Inspect functions, strings, assembly, decompilation, calls, and references. Hopper also accepts `.hop` databases and supports annotations.
+Static Android APK inspection is verified on Linux with headless JADX; see [Android analysis](docs/android-analysis.md) for its separate prerequisites and coverage.
+
+- **Native binaries:** Open Mach-O, ELF, PE, and Mac `.app` targets through a selected deep provider. Hopper and Ghidra cover broad inventory and function analysis; the IDA adapter supplies its documented read-only function/string operations. Hopper also accepts `.hop` databases and supports annotations.
 - **Packages and resources:** Inspect directories, ZIP, APK, IPA, ASAR, plists, compiled Interface Builder files, and Apple asset catalogs. Artifact requests name the input and requested extraction or traversal directly; macOS DMG traversal also requires the host's native mounting support.
 - **JavaScript and Electron:** Map modules, imports, source maps, routes, IPC channels, storage, and native add-ons without running the app. Compare builds and trace a feature across the recovered graph. Dynamic and ambiguous relationships remain unresolved. See [JavaScript application workflows](docs/javascript-application-workflows.md).
 - **Websites:** Inspect a selected page in an existing Chrome-family browser. Capture page structure, network metadata, script evidence, and screenshots requested by the call. Passive observation does not navigate or execute page JavaScript. See [browser observation](docs/browser-observation.md).
+
+  Export retained scripts with `export_web_scripts` / `rea export-web-scripts`
+  into a verified local directory, then use the existing JavaScript analysis
+  and tracing tools. Source URLs, frame or transaction references, competing
+  versions, and missing-source states remain inline. See
+  [captured website scripts](docs/website-script-export.md).
+
 - **Electron and Node runtime observation:** Inspect selected Electron pages or attach to a Node/Electron V8 Inspector target. Inspector observation records script locations and execution-context events; it does not infer imports, IPC activity, or which modules executed. See [runtime observation](docs/javascript-runtime-observation.md).
 - **.NET assemblies:** Inspect metadata and CIL instructions, compare builds, and check declared native dependencies without loading or running the assembly. Imported decompiler output is labeled as analyst inference. See [managed-code analysis](docs/managed-code-analysis.md).
 - **Controlled behavior capture:** Run process, browser, or Electron scenarios with the target, actions, and lifecycle declared in each request, then compare the resulting evidence. Missing observations cannot establish that two runs behaved the same way.
@@ -335,7 +391,7 @@ REA supports native application, JavaScript, Electron, .NET, and browser investi
 - **Open questions:** Track unresolved findings, contradictions, and follow-up probes. Reconstruction checks report pass, fail, or unknown rather than treating missing evidence as a pass.
 - **Guided workflows:** Start six [MCP investigation workflows](docs/mcp-prompts.md) with suggestions based on your current session.
 
-Windows Ghidra P0 supports the read-only native x86-64 PE boundary on local NTFS. Hopper-only features, such as GUI controls and annotations, are not available through Ghidra.
+Windows x64 Ghidra P0 supports native, non-managed, non-DLL x86-64 PE applications on fixed local NTFS with 25 read-only operations. Linux/macOS Ghidra additionally supports atomic session-scoped function names and entry comments. Ghidra has no GUI controls; Windows P0 has no mutation authority.
 
 ### Website observation with CDP
 
@@ -365,8 +421,12 @@ the launched browser. Connect mode accepts one exact loopback CDP target and
 disconnects without closing the external browser. The request supplies the
 selected executable or endpoint, actions, and any origin or environment
 selections needed by the scenario. Scenario JSON contains secret references and
-environment-variable names, never secret values. See the
-[browser scenario contract](docs/browser-scenario-contract.md).
+environment-variable names, never secret values. The default capture retains
+only the final URL; request `dom`, `accessibility`, or `screenshot` when an
+interaction changes the page without navigating. For asynchronous updates,
+wait for a page-specific result-ready condition before capture. See the
+[browser scenario contract](docs/browser-scenario-contract.md), including its
+interaction example.
 
 ### Node and Electron V8 Inspector observation
 
@@ -405,7 +465,7 @@ The [current status](#current-status) section describes shipped capabilities. Th
 
 1. **Expand browser and Electron interaction:** add scenario actions beyond the current click and wait operations.
 2. **Observe native apps at runtime:** explore LLDB, Frida, system logs, and native API tracing.
-3. **Evaluate more tools and targets:** assess IDA/Hex-Rays, Binary Ninja, Rizin, LIEF, Windows-native tools, mobile apps, and firmware.
+3. **Evaluate more tools and targets:** assess Binary Ninja, Rizin, LIEF, Windows-native tools, mobile apps, and firmware. IDA support already ships via the bring-your-own upstream adapter; see the [IDA provider guide](docs/ida-provider.md).
 
 Setup already lets you choose agent integration and Hopper installation. Support for installing additional analysis tools is future work, described in the [installation roadmap](docs/roadmap.md).
 
@@ -424,7 +484,7 @@ Setup offers supported agent integrations for selection. Existing REA registrati
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
     }
   }
 }
@@ -454,11 +514,18 @@ flowchart LR
     Session --> Registry["Deep-provider registry<br/>deterministic selection"]
     Registry --> Hopper["Hopper provider"]
     Registry --> Ghidra["Ghidra provider<br/>inventory + function analysis + annotations"]
+    Registry --> Ida["IDA MCP provider<br/>attached GUI or owned headless database"]
     Hopper --> Runtime["Owned provider runtime<br/>deadline + bounded diagnostics + cleanup"]
     Ghidra --> Runtime
+    Ida --> IdaRuntime["Upstream MCP lifecycle<br/>live observations + owned database cleanup"]
+    IdaRuntime --> Target
     Session --> Native["Native macOS provider"]
     Session --> Artifact["Artifact graph provider"]
     REA --> Browser["Browser CDP provider"]
+    REA --> Android["Android static provider<br/>headless JADX adapter"]
+    Android --> Runtime
+    REA --> Firmware["Firmware providers<br/>Binwalk / Unblob adapters"]
+    Firmware --> Runtime
     REA --> Process["Process capture provider"]
     Runtime --> Target["Target software"]
     Process --> Target
@@ -518,7 +585,7 @@ For MCP, pass the optional selector on `open_binary`:
 }
 ```
 
-Use `--provider`, or `provider_id` in MCP, to choose Hopper or Ghidra for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.
+Use `--provider`, or `provider_id` in MCP, to choose Hopper, Ghidra, or IDA for a target. This choice overrides `REA_ANALYSIS_PROVIDER`.
 
 With `auto`, REA selects the only available tool that supports the target. If both are available, specify one before opening the target. The session keeps that choice until you explicitly switch or close it; a failure never silently switches tools. Artifact-only analysis can work without a native analysis tool.
 
@@ -571,9 +638,9 @@ Process Capture records behavior and is not a security sandbox.
 Capture a scenario or compare two saved Process Capture Evidence records:
 
 ```bash
-rea capture-process ./scenario.json > authority.json
-rea capture-process ./reconstruction.json > reconstruction.json
-rea compare-process-captures authority.json reconstruction.json
+rea capture-process ./authority-scenario.json --json > authority-capture.json
+rea capture-process ./reconstruction-scenario.json --json > reconstruction-capture.json
+rea compare-process-captures authority-capture.json reconstruction-capture.json --json
 ```
 
 The comparison reports each observed dimension separately and identifies the
@@ -581,9 +648,16 @@ first terminal, interaction, exit, filesystem, or process divergence.
 See [Process Capture](docs/process-capture.md) for scenario fields, limits, and
 evidence boundaries.
 
-REA installs a prebuilt PTY backend for supported macOS, Linux, and Windows
-architectures. If the capability check reports that the backend is unavailable,
-reinstall REA for the current platform and architecture.
+Process Capture currently runs on Linux and macOS with a working native PTY
+backend. Native Windows capture remains unavailable until the PTY adapter can
+verify descendant cleanup; installing or reinstalling its Windows PTY binary
+does not enable capture. For Linux commands, run Linux REA inside WSL.
+Comparing existing capture Evidence remains available on Windows.
+
+On supported capture hosts, a missing or incompatible PTY binary can be fixed
+by reinstalling REA for the current platform, architecture, and Node.js version
+with optional dependencies enabled. Use separate scenario and output files;
+`--json` produces the JSON consumed by the comparison command.
 
 ASAR inventory verifies Electron integrity metadata for both archive entries
 and `.asar.unpacked` companion files. Integrity failures identify the logical
@@ -596,7 +670,7 @@ verified or absent.
 
 ## Security model
 
-Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets. Your agent or model provider has its own data policy.
+Analysis runs locally. REA communicates with Hopper and Ghidra through authenticated private local sockets and with IDA through its configured local MCP registration. Your agent or model provider has its own data policy.
 
 Runtime requests act on the declared target and lifecycle. Analysis tools and launched targets run with your user permissions, and native UI capture still depends on macOS Accessibility and Screen Recording access. Static JavaScript analysis does not execute extracted modules; use direct browser, Electron, or process capture when runtime behavior is needed.
 

README_ar.md

@@ -2,9 +2,9 @@
 
 [English](README.md) · [简体中文](README_zh.md) · [日本語](README_ja.md) · [한국어](README_ko.md) · **العربية**
 
-# REA: هندسة أي شيء عكسيًا
+# REA: اعكس هندسة أي شيء
 
-### استقصِ سلوك التطبيقات والملفات التنفيذية الأصلية باستخدام وكيلك.
+### وسيط MCP واحد للهندسة العكسية عبر الملفات التنفيذية والتطبيقات وسلوك وقت التشغيل.
 
 **اعثر على ميزة تعجبك. افهم آلية عملها. ابنها بالطريقة التي تريدها.**
 
@@ -15,7 +15,7 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
 
 [البدء السريع](#البدء-السريع) · [حالة الدعم](#حالة-الدعم) · [من الملف التنفيذي إلى السلوك](#من-الملف-التنفيذي-إلى-السلوك) · [منصة أدوات التحقيق](#منصة-أدوات-التحقيق) · [خطة العمل](#خطة-العمل) · [كيف يعمل؟](#كيف-يعمل)
 
@@ -47,7 +47,7 @@
 
 يوفر REA أدوات لتحليل الملفات التنفيذية الأصلية وتطبيقات JavaScript وElectron وتجميعات .NET والمواقع. يمكنك استخدامها من وكيلك أو من الطرفية. يعمل التحليل محليًا، وتتضمن النتائج الأدلة والقيود.
 
-يضبط Setup إعدادات الوكيل ويربطه بتثبيت موجود من Hopper أو Ghidra. ويمكنه تثبيت Hopper بعد موافقتك.
+يضبط Setup إعدادات الوكيل ويربطه بتثبيت موجود من Hopper أو Ghidra، ويثبّت سير عمل REA الموجّه. ويمكنه تثبيت Hopper بعد موافقتك. ولا يحتاج التحليل الثابت لتطبيقات JavaScript إلى أي محرك.
 
 ## اطلب من وكيلك مباشرة
 
@@ -69,14 +69,14 @@
 
 ## لماذا REA؟
 
-|                      |                                                                                       |
-| -------------------- | ------------------------------------------------------------------------------------- |
-| **مصمم للوكلاء**      | اسأل عما يفعله تطبيق مترجم ودع الوكيل يجمع الأدلة بدلًا من التخمين.                      |
-| **CLI وMCP**         | استخدم قدرات الهندسة العكسية نفسها من الطرفية أو وكيل البرمجة.                        |
-| **يتولى التعقيد**    | يدير REA إعداد الأدوات وفتح التطبيق واستمرار الاستقصاء والتنظيف بعد الانتهاء.            |
-| **سير عمل كامل**     | انتقل من النظرة الأولى إلى الشيفرة شبه المصدرية وعلاقات الاستدعاء والأنواع وأدلة التنفيذ. |
-| **محلي حسب التصميم** | يجري التحليل على جهازك المدعوم ولا يرفع REA الملف التنفيذي إلى خدمة تحليل مستضافة.     |
-| **يحافظ على السياق** | استقصِ عدة ملفات تنفيذية من دون بدء التحليل من جديد عند كل سؤال.                       |
+|                          |                                                                              |
+| ------------------------ | ---------------------------------------------------------------------------- |
+| **مصمم للوكلاء**          | اسأل عما يفعله التطبيق ودع الوكيل يفحصه بدلًا من التخمين.                      |
+| **CLI وMCP**             | استخدم قدرات الهندسة العكسية نفسها من الطرفية أو الوكيل.                     |
+| **إعداد موجّه**           | اضبط وكيلك، واربط أداة تحليل موجودة، أو ثبّت Hopper بموافقتك.                 |
+| **من الفهم إلى الشيفرة** | افهم الميزة ثم ابنِ نسختك الخاصة في جلسة البرمجة نفسها.                       |
+| **محلي حسب التصميم**     | يجري التحليل على مضيفك المحلي المدعوم، ولا يرفع REA التطبيق إلى خدمة مستضافة. |
+| **يحافظ على السياق**     | استقصِ عدة تطبيقات دون بدء التحليل من جديد عند كل سؤال.                       |
 
 ## البدء السريع
 
@@ -98,15 +98,24 @@ npx rea-agents setup
 
 يمكن تشغيل Hopper في الوضع التجريبي. إذا ظهرت رسالة عند التشغيل الأول، فاختر التجربة أو أدخل ترخيصًا موجودًا.
 
-### الاستخدام من الطرفية
+### مهارة مساعد البرمجة (اختياري)
 
-بعد الإعداد، شغّل:
+أضف المهارة إلى مساعد البرمجة للحصول على سياق أغنى:
 
 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```
 
+توفر المهارة سير عمل التحقيق في REA. نفّذ الإعداد أعلاه لربط REA بالوكيل وضبط أدوات التحليل. يثبّت الإعداد افتراضيًا مهارة مطابقة للإصدار؛ وهذا الأمر يثبّت نسخة المستودع.
+
+لشجرة JavaScript/Electron المستخرجة أو ملف ASAR، لا يلزم إعداد MCP ولا محرك أصلي:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+استبدل المسار بهدفك (مثل `"D:/apps/example"` على Windows). يدعم سير العمل الثابت هذه المسارات، بينما يتطلب التحليل الأصلي محركه الخاص.
+
 ### تثبيت أمر rea
 
 ثبت واجهة سطر الأوامر:
@@ -136,7 +145,7 @@ rea setup
 
 يستطيع Setup التحقق من التثبيت وحفظ المسارات؛ ولا يثبت أو يحدّث Ghidra أو Java أو Node.js أو npm أو Homebrew.
 
-تحليل Ghidra على Windows غير متاح. لم تُنفذ بعد ضوابط ملكية العمليات وأذونات المجلدات الخاصة والتحقق الآمن من المسارات. حتى التثبيت الصحيح لـ Ghidra وJava لا يفعّل التحليل. راجع [Windows Ghidra P0](docs/windows-ghidra-p0.md).
+يتضمن فرع main والحزمة npm 4.1.0 دعمًا تجريبيًا لـ Windows x64 Ghidra P0 لتطبيقات PE الأصلية x86-64 (غير المُدارة وغير DLL) على NTFS محلي، مع ضوابط Job Object وقوائم DACL الخاصة وقبول المسارات المجمّعة. تحقق من [حد الإصدار](docs/installation.md#released-package-and-main) قبل توقع ذلك من حزمة npm أقدم. راجع [دليل Windows Ghidra P0](docs/windows-ghidra-p0.md) للمتطلبات والنطاق الموثق.
 
 ### تشخيص المشكلات
 
@@ -152,12 +161,12 @@ rea setup
 
 ## حالة الدعم
 
-يوفر REA عبر CLI وMCP تحليل الملفات التنفيذية الأصلية وتطبيقات JavaScript وElectron وتجميعات .NET والمواقع. تعتمد العمليات المتاحة على الجهاز والهدف وأداة التحليل المختارة.
+تُوصف قدرات المستودع الحالية ومتطلبات الأنظمة في [دليل الدعم الإنجليزي](README.md#current-status). قد يسبق فرع main [إصدار npm](docs/installation.md#released-package-and-main).
 
-- يدعم Hopper التحليل الأصلي والتعليقات؛ ويختلف سلوك واجهته الرسومية حسب المنصة.
-- يقدم Ghidra على Linux x64 وmacOS x64/arm64 عددًا قدره 22 عملية للقراءة فقط: الجرد والبحث وفك الترجمة والتعليمات والاستدعاءات والمراجع والأنواع. لا يقدم عمليات واجهة رسومية أو تعديل.
-- لسير عمل المتصفح وElectron وتشغيل العمليات متطلبات مستقلة للإعداد والموافقة وإدارة دورة الحياة. راجع [English README](README.md#current-status) للتفاصيل الكاملة.
-- تحليل Ghidra على Windows غير مفعّل. تابع التقدم في [#527](https://github.com/morluto/rea/issues/527).
+- يوفر Ghidra 25 عملية للقراءة فقط على Linux x64 وmacOS x64/arm64 وحدود Windows x64 P0 التجريبية. يدعم Linux/macOS أيضًا تعليقات الدوال الذرية على مستوى الجلسة. نظام Windows P0 للقراءة فقط، ولا يوفر Ghidra أي تحكم في الواجهة.
+- يتطلب الفحص الثابت لنظام Android تجهيز JADX/Java بشكل منفصل؛ ويغطي التحقق بالموفر الحقيقي نظام Linux. راجع [تحليل Android](docs/android-analysis.md).
+- تحدد طلبات المتصفح وElectron والعمليات هدفها وإجراءاتها ودورة حياتها مباشرة، وتعتمد على وصول المضيف الفعلي دون منح أذونات منفصلة من REA. ما زالت كتابة إعدادات Setup وتثبيت Hopper تتطلب الموافقة على خطتها الدقيقة.
+- يصف `rea capabilities` عمليات جلسة الملف التنفيذي لا كل أدوات التطبيقات ووقت التشغيل. راجع قائمة أدوات MCP الكاملة والدليل ذا الصلة.
 
 ## استقصاء كامل بطلب واحد
 
@@ -202,18 +211,20 @@ rea setup
 
 ## منصة أدوات التحقيق
 
-| عائلة الأدوات          | العدد | الاستخدام                                                                               |
-| --------------------- | ----: | -------------------------------------------------------------------------------------- |
-| فحص الملفات التنفيذية |    41 | الدوال والشيفرة شبه المصدرية والتعليمات والسلاسل والرموز والمراجع والتعليقات            |
-| التحليل المركب        |    14 | النظرة العامة وتحليل الدوال وفك الترجمة الدفعي ومخطط الاستدعاء وفحص Swift وObjC         |
-| أدوات macOS الأصلية    |     7 | بيانات Mach-O والتوقيعات وplist والمعماريات واستعادة أسماء Swift                       |
-| الملفات والحزم        |     5 | فحص الدلائل والحزم وInterface Builder وموارد Apple والاستخراج                            |
-| .NET PE/CLI           |     7 | هوية التجميع والبيانات الوصفية وCIL والاستدعاءات الأصلية والمقارنة واستيراد إعادة البناء |
-| مراقبة المتصفح        |     9 | الصفحات والبرامج النصية وخرائط المصدر وWebMCP والصور ومقارنة الالتقاط                   |
-| تحليل Electron        |     5 | مراقبة الصفحات وبنية التطبيق وربط النتائج الثابتة بنتائج التشغيل                       |
-| وقت تشغيل JavaScript  |     2 | الاتصال بهدف Node/Electron Inspector موجود لمراقبة البرامج وسياقات التنفيذ              |
-| سير عمل التطبيقات     |     7 | تتبع الميزات ومقارنة الإصدارات وبنية قيم الإرجاع والتحقق من إعادة الإنشاء                 |
-| جلسة الملف التنفيذي   |    21 | تبديل الأهداف وحفظ الأدلة ومقارنة العمليات والدوال وتسجيل الأسئلة غير المحسومة            |
+| عائلة الأدوات         | العدد | الاستخدام                                                                                                                                                 |
+| -------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| الفحص الأصلي          |    41 | الدوال والشيفرة شبه المصدرية والتعليمات والسلاسل والرموز والاستدعاءات والمراجع والتعليقات وقراءة البايتات ومواضع الملفات                                   |
+| سير عمل التحقيق      |    14 | نظرات عامة على التطبيقات وملفات الدوال وواجهات API الأصلية والتوزيع وفك الترجمة الدفعي وتتبع الميزات ومسارات الاستدعاء ومخططاته واكتشاف Swift وObjective-C |
+| أدوات macOS الأصلية   |     7 | بيانات Mach-O والتوقيعات وplist والمعماريات واستعادة أسماء Swift دون تشغيل Hopper                                                                        |
+| مخطط المخرجات        |     5 | جرد الدلائل والحزم وملفات Interface Builder المترجمة وكتالوجات موارد Apple والاستخراج                                                                      |
+| PE/CLI المُدار        |     7 | هوية تجميعات .NET وبياناتها الوصفية وتعليمات CIL والاعتماديات الأصلية واستيراد إعادة البناء ومقارنة الإصدارات                                               |
+| البرامج الثابتة      |     2 | فحص مناطق البرامج الثابتة على Linux واستخراجها الصريح                                                                                                    |
+| Android APK          |     5 | بيانات الحزمة وmanifest والبحث عن الأصناف وقوائم الأعضاء وفك ترجمة الأساليب والمراجع الثابتة                                                                |
+| مراقبة المتصفح       |     9 | بنية الصفحات وبيانات الشبكة والبرامج النصية وخرائط المصدر واكتشاف WebMCP والصور ومقارنة الالتقاط                                                          |
+| تحليل Electron       |     5 | مراقبة العارضين وخريطة التطبيق الثابتة والمواءمة بين نتائج الثبات والتشغيل                                                                               |
+| وقت تشغيل JavaScript |     2 | اكتشاف أهداف Node/Electron Inspector ومواضع البرامج وأحداث سياقات التنفيذ                                                                                |
+| سير عمل التطبيقات    |     8 | تصدير النصوص البرمجية الملتقطة، تتبع الميزات عبر الطبقات ومقارنة الإصدارات ومواءمة المصدر التاريخي ومقارنة أشكال القيم المعادة والتحقق من إعادة الإنشاء    |
+| مساحة العمل والملاحظة |    21 | الجلسات وحزم الأدلة وسياق التنقل ومقارنة العمليات والمخرجات والدوال وتسجيل الأسئلة غير المحسومة                                                            |
 
 ## خطة العمل
 
@@ -230,7 +241,7 @@ rea setup
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
     }
   }
 }
@@ -274,8 +285,9 @@ npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/
 
 ## الأمان والخصوصية
 
-- يبقى تحليل الملف التنفيذي محليًا بين REA ومزوّد التحليل المختار.
+- يبقى التحليل محليًا بين REA وموفر التحليل المختار عبر مقابس محلية خاصة، ومع IDA عبر تسجيل MCP المحلي المضبوط.
 - لا يرفع REA الأهداف إلى خدمة مستضافة.
+- تعمل أدوات التحليل والأهداف المطلقة بصلاحيات المستخدم نفسه؛ وما زال التقاط واجهة النظام على macOS يعتمد على الوصول إلى تسهيلات الاستخدام وتسجيل الشاشة. ولا ينفّذ التحليل الثابت للـ JavaScript الوحدات المستخرجة.
 - تستخدم جلسات Ghidra مشروعًا مؤقتًا معزولًا ولا تفتح مشاريع Ghidra التي يملكها المستخدم أو تعدّلها.
 - راجع الملفات التنفيذية غير الموثوقة واعزلها كما تفعل مع أي مدخل أصلي قد يكون ضارًا.
 - أبلغ عن الثغرات وفق [سياسة الأمان](SECURITY.md)، وليس عبر قضية عامة.
@@ -299,7 +311,7 @@ npx -y rea-agents@latest compare /absolute/path/to/left-evidence.json /absolute/
 <details>
 <summary><strong>هل يعمل REA على Linux أو Windows؟</strong></summary>
 
-يدعم REA نظام macOS 12+ وUbuntu 24.04+ وFedora 41+ وArch Linux بنواة 64 بت. يعمل تحليل Ghidra للقراءة فقط على Linux x64 وmacOS x64/arm64 مع Ghidra 12.1.4 وJDK 21 الكامل. تحليل Ghidra على Windows غير متاح بسبب الضوابط الأصلية غير المنفذة؛ راجع [Windows Ghidra P0](docs/windows-ghidra-p0.md).
+يدعم REA نظام macOS 12+ وUbuntu 24.04+ وFedora 41+ وArch Linux بنواة 64 بت. يعمل تحليل Ghidra للقراءة فقط على Linux x64 وmacOS x64/arm64 مع Ghidra 12.1.4 وJDK 21 الكامل، إضافة إلى حد Windows x64 P0 التجريبي لتطبيقات PE الأصلية x86-64 على NTFS محلي؛ راجع [دليل Windows Ghidra P0](docs/windows-ghidra-p0.md) للنطاق الموثق.
 
 </details>
 

README_ja.md

@@ -15,7 +15,7 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
 
 [クイックスタート](#クイックスタート) · [現在の対応状況](#現在の対応状況) · [バイナリから動作へ](#バイナリから動作へ) · [調査ツールカタログ](#調査ツールカタログ) · [ロードマップ](#ロードマップ) · [仕組み](#仕組み)
 
@@ -69,14 +69,14 @@ REA は調査をバイナリ上の根拠に結び付けます。元のソース
 
 ## REA を選ぶ理由
 
-|                        |                                                                                                      |
-| ---------------------- | ---------------------------------------------------------------------------------------------------- |
-| **エージェント向け**   | コンパイル済みアプリについて質問し、推測ではなく根拠を集めさせることができます。                     |
-| **CLI と MCP**         | ターミナルとコーディングエージェントから同じリバースエンジニアリング機能を使えます。                 |
-| **複雑さを処理**       | ツール設定、アプリの読み込み、調査の維持、終了後のクリーンアップを REA が担います。                  |
-| **一連の調査に対応**   | 最初の概要から疑似コード、呼び出し関係、型、実装の手掛かりまで掘り下げられます。                     |
-| **ローカルで解析**     | 解析は対応するローカルホストで実行され、REA がバイナリをホスト型解析サービスへ送ることはありません。 |
-| **コンテキストを維持** | 質問ごとに解析を最初からやり直さず、複数のバイナリを続けて調査できます。                             |
+|                            |                                                                                                      |
+| -------------------------- | ---------------------------------------------------------------------------------------------------- |
+| **エージェント向け**       | アプリの動作について質問し、推測ではなくエージェントに調査させることができます。                     |
+| **CLI と MCP**             | ターミナルとエージェントから同じリバースエンジニアリング機能を使えます。                             |
+| **ガイド付きセットアップ** | エージェントの設定、既存の解析ツールへの接続、承認後の Hopper インストールに対応します。             |
+| **洞察からコードへ**       | 機能を理解したら、同じコーディングセッションで自分のプロダクト向けに実装できます。                   |
+| **ローカルで解析**         | 解析は対応するローカルホストで実行され、REA がバイナリをホスト型解析サービスへ送ることはありません。 |
+| **コンテキストを維持**     | 質問ごとに解析を最初からやり直さず、複数のアプリを続けて調査できます。                               |
 
 ## クイックスタート
 
@@ -98,15 +98,24 @@ Setup は最初に連携するエージェントを複数選択できるよう
 
 Hopper はデモモードで使えます。初回起動の画面ではデモを選択するか、既存のライセンスを入力してください。
 
-### ターミナルで使う
+### AI コーディングアシスタント向けスキル（任意）
 
-設定後に実行します：
+AI コーディングアシスタントにスキルを追加すると、より豊富なコンテキストが得られます：
 
 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```
 
+このスキルは REA の調査ワークフローを提供します。上記の setup を実行して REA をエージェントに接続し、解析ツールを設定してください。Setup は既定でバージョンに合ったスキルをインストールします。このコマンドではリポジトリ版のスキルをインストールします。
+
+展開済みの JavaScript/Electron アプリのツリーや ASAR であれば、MCP の設定もネイティブエンジンも不要です：
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+パスを調査対象に置き換えてください（Windows では `"D:/apps/example"` のようなパス）。この静的ワークフローではそのようなパスも扱えます。ネイティブ解析には専用のエンジン設定が必要です。
+
 ### rea コマンドをインストール
 
 コマンドラインツールをインストールします：
@@ -136,7 +145,7 @@ Ghidra は Linux x64 と macOS x64/arm64 に対応します。Ghidra 12.1.4 と
 
 Setup はインストールを確認し、パスを保存できます。Ghidra、Java、Node.js、npm、Homebrew のインストールや更新は行いません。
 
-Windows の Ghidra 解析は利用できません。プロセスの所有権、プライベートディレクトリの権限、安全なパス検証が未実装のため、Ghidra と Java を正しくインストールしても有効になりません。[Windows Ghidra P0](docs/windows-ghidra-p0.md)を参照してください。
+リポジトリの main と npm 4.1.0 には、ローカル NTFS 上のネイティブ x86-64 PE アプリケーション（非マネージド、非 DLL 向け）を対象とする実験的な Windows x64 Ghidra P0 対応が含まれています。Job Object、プライベート DACL、パス許可の各制御が同梱されています。古い npm パッケージに期待する前に[リリース境界](docs/installation.md#released-package-and-main)を確認してください。前提条件と検証済みの範囲は [Windows Ghidra P0](docs/windows-ghidra-p0.md) を参照してください。
 
 ### トラブルシューティング
 
@@ -152,12 +161,12 @@ Linux の既定ランチャーは `/opt/hopper/bin/Hopper` です。別の場所
 
 ## 現在の対応状況
 
-REA は CLI と MCP からネイティブバイナリ、JavaScript/Electron アプリ、.NET アセンブリ、Web サイトを解析できます。使える操作はホスト、対象、選択した解析ツールによって異なります。
+リポジトリの現在の機能とプラットフォーム要件は[英語の対応状況ガイド](README.md#current-status)で説明しています。main は [npm リリース](docs/installation.md#released-package-and-main)より先行する場合があります。
 
-- Hopper はネイティブ解析と注釈操作に対応します。GUI の動作はプラットフォームによって異なります。
-- Ghidra は Linux x64 と macOS x64/arm64 で、一覧、検索、逆コンパイル、アセンブリ、呼び出し、参照、命令、型の検査など 22 の読み取り専用操作を提供します。GUI 操作や変更操作はありません。
-- ブラウザー、Electron、プロセスの実行時ワークフローには、それぞれ設定、承認、終了処理の要件があります。詳細は [English README](README.md#current-status) を参照してください。
-- Windows の Ghidra 解析は未対応です。進捗は [#527](https://github.com/morluto/rea/issues/527) で確認できます。
+- Ghidra は Linux x64、macOS x64/arm64、実験的な Windows x64 P0 境界で 25 件の読み取り専用操作を提供します。Linux/macOS ではアトミックなセッション内関数注釈にも対応します。Windows P0 は読み取り専用であり、Ghidra に GUI 操作はありません。
+- 静的な Android 検査には持ち込みの JADX/Java が別途必要です。実プロバイダー検証は Linux を対象とします。詳しくは[Android 解析](docs/android-analysis.md)を参照してください。
+- ブラウザー、Electron、プロセスの各リクエストは対象・操作・ライフサイクルを直接指定し、ホストの実際のアクセスに依存します。REA 側の個別の許可付与は不要です。Setup による設定書き込みと Hopper のインストールは、引き続き正確な計画の承認が必要です。
+- `rea capabilities` はバイナリセッション操作の説明であり、すべてのアプリ／ランタイムツールの目録ではありません。接続済み MCP ツール一覧と関連ガイドを参照してください。
 
 ## ひとつのプロンプトで調査を完結
 
@@ -191,18 +200,20 @@ REA は手順 1〜5 のバイナリ解析を処理し、手順 6 はエージェ
 
 ## 調査ツールカタログ
 
-| ツール分類           |  数 | 用途                                                                        |
-| -------------------- | --: | --------------------------------------------------------------------------- |
-| バイナリ検査         |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、参照、注釈                  |
-| 組み合わせた解析     |  14 | 概要、関数解析、一括逆コンパイル、呼び出しグラフ、Swift と ObjC             |
-| macOS ネイティブ     |   7 | Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元              |
-| ファイルとパッケージ |   5 | ディレクトリとパッケージ、Interface Builder、Apple リソース、抽出           |
-| .NET PE/CLI          |   7 | アセンブリ識別、メタデータ、CIL、ネイティブ呼び出し、比較、再構築の取り込み |
-| ブラウザー観察       |   9 | ページ、スクリプト、ソースマップ、WebMCP、スクリーンショット、比較          |
-| Electron 解析        |   5 | ページ観察、アプリ構造、静的・実行時結果の対応付け                          |
-| JavaScript 実行時    |   2 | 既存の Node/Electron Inspector に接続し、スクリプトと実行コンテキストを観察 |
-| アプリのワークフロー |   7 | 機能追跡、バージョン比較、戻り値構造の比較、再実装の検証                    |
-| バイナリセッション   |  21 | 対象切り替え、根拠の保存、プロセス・関数比較、未解決事項の記録              |
+| ツール分類           |  数 | 用途                                                                                                                                         |
+| -------------------- | --: | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| ネイティブ検査       |  41 | 関数、疑似コード、アセンブリ、文字列、シンボル、呼び出し、参照、注釈、バイト読み取り、ファイルオフセット                                     |
+| 調査ワークフロー     |  14 | アプリ概要、関数ドシエ、ネイティブ API とディスパッチ、一括逆コンパイル、機能トレース、コールパス、コールグラフ、Swift と Objective-C の検出 |
+| macOS ネイティブ     |   7 | Hopper を起動せずに扱える Mach-O メタデータ、署名、plist、アーキテクチャ、Swift 名の復元                                                     |
+| 成果物グラフ         |   5 | ディレクトリとパッケージの目録、コンパイル済み Interface Builder ファイル、Apple アセットカタログ、抽出                                      |
+| マネージド PE/CLI    |   7 | .NET の識別、メタデータ、CIL 命令、ネイティブ依存関係、再構築インポート、ビルド比較                                                          |
+| ファームウェア       |   2 | Linux ファームウェア領域の検査と明示的な展開                                                                                                 |
+| Android APK          |   5 | パッケージと manifest の宣言、クラス検索、メンバー一覧、メソッド逆コンパイル、静的参照                                                       |
+| ブラウザー観察       |   9 | ページ構成、ネットワークメタデータ、スクリプト、ソースマップ、WebMCP 検出、スクリーンショット、キャプチャ比較                                |
+| Electron 解析        |   5 | レンダラー観察、静的アプリマッピング、静的／実行時結果の対応付け                                                                             |
+| JavaScript 実行時    |   2 | Node/Electron Inspector 対象の検出、スクリプト位置、実行コンテキストイベント                                                                 |
+| アプリワークフロー   |   8 | 取得した Web スクリプトのエクスポート、層をまたぐ機能トレース、ビルド比較、履歴ソース対応、静的戻り値形状の比較、再実装検証                  |
+| ワークスペースと観察 |  21 | セッション、証跡バンドル、ナビゲーション文脈、プロセス・成果物・関数比較、未解決事項の記録                                                   |
 
 ## ロードマップ
 
@@ -219,7 +230,7 @@ Setup は Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsurf
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
     }
   }
 }

README_ko.md

@@ -15,7 +15,7 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
 
 [빠른 시작](#빠른-시작) · [현재 지원 범위](#현재-지원-범위) · [바이너리에서 동작까지](#바이너리에서-동작까지) · [조사 도구 카탈로그](#조사-도구-카탈로그) · [로드맵](#로드맵) · [작동 방식](#작동-방식)
 
@@ -70,14 +70,14 @@ REA는 분석을 바이너리 증거에 근거하게 합니다. 원본 소스
 
 ## REA를 사용하는 이유
 
-|                    |                                                                                                     |
-| ------------------ | --------------------------------------------------------------------------------------------------- |
-| **에이전트용**     | 컴파일된 앱에 관해 질문하고 추측 대신 증거를 수집하게 합니다.                                       |
-| **CLI와 MCP**      | 터미널과 코딩 에이전트에서 동일한 리버스 엔지니어링 기능을 사용합니다.                              |
-| **복잡성 처리**    | 도구 설정, 앱 열기, 조사 유지, 작업 후 정리를 REA가 처리합니다.                                     |
-| **전체 조사 과정** | 첫 개요에서 의사 코드, 호출 관계, 타입, 구현 단서까지 이어서 조사합니다.                            |
-| **로컬 분석**      | 분석은 지원되는 로컬 호스트에서 실행되며 REA는 바이너리를 호스팅 분석 서비스에 업로드하지 않습니다. |
-| **컨텍스트 유지**  | 질문마다 분석을 처음부터 시작하지 않고 여러 바이너리를 연속으로 조사합니다.                         |
+|                     |                                                                                                     |
+| ------------------- | --------------------------------------------------------------------------------------------------- |
+| **에이전트용**      | 앱의 동작에 대해 질문하고 추측 대신 에이전트가 조사하게 합니다.                                     |
+| **CLI와 MCP**       | 터미널과 에이전트에서 동일한 리버스 엔지니어링 기능을 사용합니다.                                   |
+| **안내식 설정**     | 에이전트 설정, 기존 분석 도구 연결, 승인 후 Hopper 설치를 지원합니다.                               |
+| **통찰에서 코드로** | 기능을 이해한 뒤 같은 코딩 세션에서 자신의 제품에 맞는 버전을 구현합니다.                           |
+| **로컬 분석**       | 분석은 지원되는 로컬 호스트에서 실행되며 REA는 바이너리를 호스팅 분석 서비스에 업로드하지 않습니다. |
+| **컨텍스트 유지**   | 질문마다 분석을 처음부터 시작하지 않고 여러 앱을 연속으로 조사합니다.                               |
 
 ## 빠른 시작
 
@@ -99,15 +99,24 @@ Setup은 먼저 연결할 에이전트를 여러 개 선택하도록 안내합
 
 Hopper는 데모 모드로 사용할 수 있습니다. 첫 실행 안내가 나오면 데모를 선택하거나 기존 라이선스를 입력하세요.
 
-### 터미널에서 실행하기
+### AI 코딩 어시스턴트용 스킬(선택)
 
-설정 후 실행하세요.
+AI 코딩 어시스턴트에 스킬을 추가하면 더 풍부한 컨텍스트를 얻을 수 있습니다.
 
 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```
 
+이 스킬은 REA의 조사 워크플로를 제공합니다. 위 setup을 실행해 REA를 에이전트에 연결하고 분석 도구를 설정하세요. Setup은 기본적으로 버전에 맞는 스킬을 설치합니다. 이 명령은 저장소 버전의 스킬을 설치합니다.
+
+압축을 해제한 JavaScript/Electron 앱 트리나 ASAR라면 MCP 설정이나 네이티브 엔진 없이 바로 분석할 수 있습니다.
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+경로를 조사 대상으로 바꾸세요(Windows에서는 `"D:/apps/example"` 같은 경로). 이 정적 워크플로에서는 이런 경로도 지원됩니다. 네이티브 분석에는 전용 엔진 설정이 필요합니다.
+
 ### rea 명령 설치하기
 
 명령줄 도구를 설치하세요.
@@ -137,7 +146,7 @@ Ghidra는 Linux x64와 macOS x64/arm64를 지원합니다. Ghidra 12.1.4와 완
 
 Setup은 설치를 확인하고 경로를 저장할 수 있습니다. Ghidra, Java, Node.js, npm, Homebrew를 설치하거나 업데이트하지 않습니다.
 
-Windows Ghidra 분석은 사용할 수 없습니다. 프로세스 소유권, 비공개 디렉터리 권한, 안전한 경로 검사가 구현되지 않았으므로 Ghidra와 Java를 올바르게 설치해도 분석을 활성화할 수 없습니다. [Windows Ghidra P0](docs/windows-ghidra-p0.md)를 참고하세요.
+저장소 main과 npm 4.1.0에는 로컬 NTFS상의 네이티브 x86-64 PE 애플리케이션(비관리, 비 DLL 대상)을 위한 실험적인 Windows x64 Ghidra P0 지원이 포함되어 있습니다. Job Object, 비공개 DACL, 경로 승인 제어가 함께 제공됩니다. 이전 npm 패키지에 이 기능이 있을 것으로 기대하기 전에 [릴리스 경계](docs/installation.md#released-package-and-main)를 확인하세요. 전제 조건과 검증 범위는 [Windows Ghidra P0](docs/windows-ghidra-p0.md)를 참고하세요.
 
 ### 문제 해결
 
@@ -153,12 +162,12 @@ Linux의 기본 Hopper 실행 파일은 `/opt/hopper/bin/Hopper`입니다. 다
 
 ## 현재 지원 범위
 
-REA는 CLI와 MCP로 네이티브 바이너리, JavaScript/Electron 앱, .NET 어셈블리, 웹사이트를 분석합니다. 사용할 수 있는 작업은 호스트, 대상, 선택한 분석 도구에 따라 다릅니다.
+저장소의 현재 기능과 플랫폼 요구 사항은 [영문 지원 가이드](README.md#current-status)에 설명되어 있습니다. main은 [npm 릴리스](docs/installation.md#released-package-and-main)보다 앞설 수 있습니다.
 
-- Hopper는 네이티브 분석과 주석 작업을 지원합니다. GUI 동작은 플랫폼에 따라 다릅니다.
-- Ghidra는 Linux x64와 macOS x64/arm64에서 목록, 검색, 디컴파일, 어셈블리, 호출, 참조, 명령어, 타입 검사 등 읽기 전용 작업 22개를 제공합니다. GUI나 변경 작업은 제공하지 않습니다.
-- 브라우저, Electron, 프로세스 런타임 워크플로에는 각각 설정, 승인, 종료 처리 요구 사항이 있습니다. 자세한 내용은 [English README](README.md#current-status)를 참고하세요.
-- Windows Ghidra 분석은 아직 사용할 수 없습니다. 진행 상황은 [#527](https://github.com/morluto/rea/issues/527)에서 확인하세요.
+- Ghidra는 Linux x64, macOS x64/arm64, 실험적인 Windows x64 P0 경계에서 25개의 읽기 전용 작업을 제공합니다. Linux/macOS에서는 원자적 세션 함수 주석도 추가로 지원합니다. Windows P0는 읽기 전용이며 Ghidra에는 GUI 제어가 없습니다.
+- 정적 Android 검사는 별도로 준비한 JADX/Java가 필요합니다. 실제 제공자 검증은 Linux를 대상으로 합니다. [Android 분석](docs/android-analysis.md)을 참고하세요.
+- 브라우저, Electron, 프로세스 요청은 대상·동작·수명 주기를 직접 지정하며 호스트의 실제 접근에 의존합니다. 별도의 REA 권한 승인은 필요 없습니다. Setup의 설정 쓰기와 Hopper 설치는 여전히 정확한 계획에 대한 승인이 필요합니다.
+- `rea capabilities`는 모든 앱/런타임 도구의 목록이 아니라 바이너리 세션 작업을 설명합니다. 연결된 MCP 도구 목록과 관련 가이드를 참고하세요.
 
 ## 하나의 프롬프트로 전체 조사
 
@@ -192,18 +201,20 @@ REA는 1–5단계의 바이너리 분석을 처리합니다. 6단계는 에이
 
 ## 조사 도구 카탈로그
 
-| 도구 분류         |  수 | 용도                                                                 |
-| ----------------- | --: | -------------------------------------------------------------------- |
-| 바이너리 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 참조, 주석                  |
-| 결합 분석         |  14 | 개요, 함수 분석, 일괄 디컴파일, 호출 그래프, Swift와 ObjC 검사       |
-| macOS 네이티브    |   7 | Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원            |
-| 파일과 패키지     |   5 | 디렉터리와 패키지 검사, Interface Builder, Apple 리소스, 추출        |
-| .NET PE/CLI       |   7 | 어셈블리 식별, 메타데이터, CIL, 네이티브 호출, 비교, 재구성 가져오기 |
-| 브라우저 관찰     |   9 | 페이지, 스크립트, 소스 맵, WebMCP, 스크린샷, 캡처 비교               |
-| Electron 분석     |   5 | 페이지 관찰, 앱 구조, 정적·런타임 결과 연결                          |
-| JavaScript 런타임 |   2 | 기존 Node/Electron Inspector에 연결해 스크립트와 실행 컨텍스트 관찰  |
-| 앱 워크플로       |   7 | 기능 추적, 버전 비교, 반환 구조 비교, 재구현 검증                    |
-| 바이너리 세션     |  21 | 대상 전환, 근거 저장, 프로세스·함수 비교, 미해결 항목 기록           |
+| 도구 분류         |  수 | 용도                                                                                                                      |
+| ----------------- | --: | ------------------------------------------------------------------------------------------------------------------------- |
+| 네이티브 검사     |  41 | 함수, 의사 코드, 어셈블리, 문자열, 심볼, 호출, 참조, 주석, 바이트 읽기, 파일 오프셋                                       |
+| 조사 워크플로     |  14 | 앱 개요, 함수 기록서, 네이티브 API와 디스패치, 일괄 디컴파일, 기능 추적, 호출 경로, 호출 그래프, Swift와 Objective-C 탐색 |
+| macOS 네이티브    |   7 | Hopper 실행 없이 처리하는 Mach-O 메타데이터, 서명, plist, 아키텍처, Swift 이름 복원                                       |
+| 아티팩트 그래프   |   5 | 디렉터리와 패키지 목록, 컴파일된 Interface Builder 파일, Apple 애셋 카탈로그, 추출                                        |
+| 관리 PE/CLI       |   7 | .NET 식별, 메타데이터, CIL 명령어, 네이티브 종속성, 재구성 가져오기, 빌드 비교                                            |
+| 펌웨어            |   2 | Linux 펌웨어 영역 검사 및 명시적 추출                                                                                     |
+| Android APK       |   5 | 패키지와 manifest 선언, 클래스 검색, 멤버 목록, 메서드 디컴파일, 정적 참조                                                |
+| 브라우저 관찰     |   9 | 페이지 구조, 네트워크 메타데이터, 스크립트, 소스 맵, WebMCP 탐색, 스크린샷, 캡처 비교                                     |
+| Electron 분석     |   5 | 렌더러 관찰, 정적 앱 매핑, 정적·런타임 결과 연결                                                                          |
+| JavaScript 런타임 |   2 | Node/Electron Inspector 대상 탐색, 스크립트 위치, 실행 컨텍스트 이벤트                                                    |
+| 앱 워크플로       |   8 | 캡처한 웹 스크립트 내보내기, 계층 간 기능 추적, 빌드 비교, 히스토리 소스 매핑, 정적 반환 구조 비교, 재구현 검증           |
+| 작업 공간과 관찰  |  21 | 세션, 근거 번들, 탐색 컨텍스트, 프로세스·아티팩트·함수 비교, 미해결 항목 기록                                             |
 
 ## 로드맵
 
@@ -220,7 +231,7 @@ Setup은 Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
     }
   }
 }

README_zh.md

@@ -15,7 +15,7 @@
 [![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](LICENSE)
 [![Discord](https://img.shields.io/discord/1556595354999332884?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/GkcryMnJDM)
 
-<a href="https://trendshift.io/repositories/82054?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/82054/weekly?language=TypeScript" alt="morluto/rea | Trendshift" width="250" height="55" /></a>
+<a href="https://trendshift.io/repositories/82054?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-82054" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/82054" alt="morluto%2Frea | Trendshift" width="250" height="55"/></a>
 
 [快速开始](#快速开始) · [当前状态](#当前状态) · [从二进制到行为](#从二进制到行为) · [调查工具目录](#调查工具目录) · [路线图](#路线图) · [工作原理](#工作原理)
 
@@ -71,12 +71,12 @@ REA 让调查始终以二进制证据为依据。它不会声称能恢复原始
 
 |                  |                                                                      |
 | ---------------- | -------------------------------------------------------------------- |
-| **为智能体设计** | 直接询问编译后应用的行为，让智能体搜集证据，而不是猜测。             |
-| **CLI 与 MCP**   | 在终端或编程智能体中使用同一套逆向工程能力。                         |
-| **处理复杂流程** | REA 负责工具设置、打开应用、维持调查过程，并在完成后清理资源。       |
-| **完整工作流**   | 从初步概览推进到伪代码、调用关系、类型和实现线索。                   |
+| **为智能体设计** | 直接询问应用的行为，让智能体去检查，而不是猜测。                     |
+| **CLI 与 MCP**   | 在终端或智能体中使用同一套逆向工程能力。                             |
+| **引导式设置**   | 配置智能体、连接已有分析工具，或在你批准后安装 Hopper。              |
+| **从洞察到代码** | 理解功能后，在同一次编程会话中构建属于你自己的版本。                 |
 | **本地运行**     | 分析在受支持的本机系统上运行；REA 不会把二进制上传到托管式分析服务。 |
-| **保留上下文**   | 连续调查多个二进制文件，无需为每个问题重新开始整个分析过程。         |
+| **保留上下文**   | 连续调查多个应用，无需为每个问题重新开始整个分析过程。               |
 
 ## 快速开始
 
@@ -98,15 +98,24 @@ Setup 会先展示变更并备份已有配置。要求与更多选项见[安装
 
 Hopper 支持演示模式。如果首次启动时出现提示，选择演示模式或输入已有许可证。
 
-### 从终端运行
+### AI 编程助手技能（可选）
 
-设置完成后：
+为你的 AI 编程助手添加 skill，以获得更丰富的上下文：
 
 ```bash
-npx -y rea-agents@latest doctor
-npx -y rea-agents@latest analyze /Applications/Notes.app
+npx skills add morluto/rea --skill reverse-engineer-anything
 ```
 
+该 skill 提供 REA 的调查工作流。先运行上文的 setup，把 REA 连接到你的智能体并配置分析工具。Setup 默认会安装版本匹配的 skill；这条命令安装的是仓库版本。
+
+对于已解包的 JavaScript/Electron 应用目录或 ASAR，无需 MCP 配置，也无需原生引擎：
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+把路径换成你的目标（例如 Windows 上的 `"D:/apps/example"`）。这条静态流程支持此类路径。原生分析仍需要先配置对应的分析引擎。
+
 ### 安装 rea 命令
 
 安装命令行工具：
@@ -124,7 +133,7 @@ npm install --global rea-agents
 rea setup
 ```
 
-### 运行要求
+### 系统要求
 
 - macOS 12 或更高版本
 - Ubuntu 24.04+、Fedora 41+ 或 64 位 Arch Linux
@@ -136,9 +145,9 @@ Ghidra 支持 Linux x64 和 macOS x64/arm64。单独安装 Ghidra 12.1.4 和完
 
 Setup 可以验证安装并保存路径，不会安装或升级 Ghidra、Java、Node.js、npm 或 Homebrew。
 
-Windows Ghidra 分析目前不可用。进程归属、私有目录权限和安全路径检查尚未实现，正确安装 Ghidra 和 Java 也不能启用分析。详见 [Windows Ghidra P0](docs/windows-ghidra-p0.md)。
+仓库 main 分支与 npm 4.1.0 已包含实验性的 Windows x64 Ghidra P0 支持，适用于本地 NTFS 上的原生 x86-64 PE 应用（非托管、非 DLL），并附带 Job Object、私有 DACL 与路径准入控制。请先确认[发布边界](docs/installation.md#released-package-and-main)，再假定旧版 npm 包具备该能力。详见 [Windows Ghidra P0](docs/windows-ghidra-p0.md) 的前置条件与已验证范围。
 
-### 故障排查
+### 故障排除
 
 运行 `npx -y rea-agents@latest doctor`，检查主机、依赖、分析工具和智能体配置。该命令不会修改文件。添加 `--json` 可获取结构化诊断。
 
@@ -152,12 +161,12 @@ Linux 上的默认 Hopper 启动器为 `/opt/hopper/bin/Hopper`。其他路径
 
 ## 当前状态
 
-REA 可以通过 CLI 和 MCP 分析原生二进制、JavaScript/Electron 应用、.NET 程序集和网站。具体操作取决于主机、目标和所选分析工具。
+仓库当前能力与平台要求见[英文支持指南](README.md#current-status)。main 分支可能领先于 [npm 发布版](docs/installation.md#released-package-and-main)。
 
-- Hopper 支持原生分析和注释操作；GUI 行为取决于平台。
-- Ghidra 在 Linux x64 和 macOS x64/arm64 上提供 22 项只读操作，包括清单、搜索、反编译、汇编、调用关系、引用、指令与类型检查。它不提供 GUI 或修改操作。
-- 浏览器、Electron 和进程运行时工作流有独立的配置、批准和生命周期要求。详见 [English README](README.md#current-status) 中的完整状态说明。
-- Windows Ghidra 分析尚未启用，跟踪进展见 [#527](https://github.com/morluto/rea/issues/527)。
+- Ghidra 在 Linux x64、macOS x64/arm64 以及实验性的 Windows x64 P0 边界上提供 25 个只读操作。Linux/macOS 额外支持原子化的会话级函数注释。Windows P0 为只读；Ghidra 不提供 GUI 控制。
+- 静态 Android 检查需要自备 JADX/Java，前置条件独立；真机验证覆盖 Linux。详见 [Android 分析](docs/android-analysis.md)。
+- 浏览器、Electron 与进程请求需直接声明目标、动作与生命周期，并依赖宿主的实际访问权限，无需 REA 另行授权。Setup 的配置写入与 Hopper 安装仍需逐项批准确切计划。
+- `rea capabilities` 描述的是二进制会话操作，而非全部应用/运行时工具。请以已连接 MCP 工具列表与相关指南为准。
 
 ## 一个提示词，完成一次完整调查
 
@@ -191,18 +200,20 @@ REA 负责第 1–5 步中的二进制分析。第 6 步由智能体使用其常
 
 ## 调查工具目录
 
-| 工具类别          | 数量 | 用途                                                      |
-| ----------------- | ---: | --------------------------------------------------------- |
-| 二进制检查        |   41 | 函数、伪代码、汇编、字符串、符号、段、引用与注释          |
-| 组合分析          |   14 | 概览、函数分析、批量反编译、调用图、Swift 与 ObjC 检查    |
-| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原     |
-| 制品检查          |    5 | 目录与软件包检查、Interface Builder、Apple 资源目录与提取 |
-| .NET PE/CLI       |    7 | 程序集身份、元数据、CIL、原生调用声明、成员比较与重建导入 |
-| 浏览器观察        |    9 | 页面、脚本、来源映射、WebMCP 工具、截图与捕获比较         |
-| Electron 分析     |    5 | 页面观察、应用结构与静态/运行时结果关联                   |
-| JavaScript 运行时 |    2 | 连接现有 Node/Electron Inspector，观察脚本与执行上下文    |
-| 应用工作流        |    7 | 功能追踪、版本比较、返回结构比较与重建验证                |
-| 二进制会话        |   21 | 目标切换、证据包、进程与函数比较、待解决问题记录          |
+| 工具类别          | 数量 | 用途                                                                                                   |
+| ----------------- | ---: | ------------------------------------------------------------------------------------------------------ |
+| 原生检查          |   41 | 函数、伪代码、汇编、字符串、符号、调用、引用、注释、字节读取与文件偏移                                 |
+| 调查工作流        |   14 | 应用概览、函数档案、原生 API 与分发、批量反编译、功能追踪、调用路径与调用图、Swift 与 Objective-C 发现 |
+| macOS 原生工具    |    7 | Mach-O 元数据、代码签名、plist、架构与 Swift 符号还原，无需启动 Hopper                                 |
+| 产物图            |    5 | 目录与软件包清单、编译后的 Interface Builder 文件、Apple 资源目录与提取                                |
+| 托管 PE/CLI       |    7 | .NET 程序集身份、元数据、CIL 指令、原生依赖声明、重建导入与构建比较                                    |
+| 固件              |    2 | Linux 固件区域检查与显式提取                                                                           |
+| Android APK       |    5 | 包与 manifest 声明、类搜索、成员清单、方法反编译与静态引用                                             |
+| 浏览器观察        |    9 | 页面结构、网络元数据、脚本、来源映射、WebMCP 发现、截图与捕获比较                                      |
+| Electron 分析     |    5 | 渲染进程观察、静态应用映射、静态/运行时结果关联                                                        |
+| JavaScript 运行时 |    2 | Node/Electron Inspector 目标发现、脚本位置与执行上下文事件                                             |
+| 应用工作流        |    8 | 捕获的网站脚本导出、跨层功能追踪、构建比较、历史源码映射、静态返回结构比较与重建验证                   |
+| 工作区与观察      |   21 | 会话、证据包、导航上下文、进程/产物/函数比较与待解决问题跟踪                                           |
 
 ## 路线图
 
@@ -219,7 +230,7 @@ Setup 支持 Claude Code、Claude Desktop、Codex、Cursor、Gemini CLI、Windsu
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
     }
   }
 }

bridge/ghidra/ReaGhidraBridge.java

@@ -151,6 +151,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
     private List<FunctionEntry> procedureInventory;
     private List<InventoryItem> stringInventory;
     private DecompInterface decompiler;
+    private final ReaGhidraExtensions analysisExtensions = new ReaGhidraExtensions();
     private static AddressSpace sessionDefaultAddressSpace;
 
     @Override
@@ -196,6 +197,9 @@ public final class ReaGhidraBridge extends HeadlessScript {
         // each edit owns a real outer transaction and can roll back immediately.
         end(true);
         try {
+            if (!descriptor.transport.equals("unix-socket") && descriptor.analysisExtensions.size() > 0)
+                throw new IOException("Windows Ghidra P0 does not admit metadata recovery or database mutation.");
+            analysisExtensions.analyze(descriptor.analysisExtensions, currentProgram, monitor);
             initializeDecompiler();
             serve(descriptor);
         }
@@ -204,6 +208,7 @@ public final class ReaGhidraBridge extends HeadlessScript {
                 decompiler.dispose();
                 decompiler = null;
             }
+            analysisExtensions.close();
         }
     }
 
@@ -414,6 +419,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
                 .toArray(String[]::new)
         ));
         result.add("target", target);
+        JsonArray extensions = analysisExtensions.reports();
+        if (extensions.size() > 0) result.add("analysis_extensions", extensions);
         return result;
     }
 
@@ -454,6 +461,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
     private JsonObject inspectNativeLoadImage(JsonObject params) throws Exception {
         requireKeys(params, Set.of());
         JsonObject result = new JsonObject();
+        JsonArray recovery = analysisExtensions.inspectImage();
+        if (recovery.size() > 0) result.add("metadata_recovery", recovery);
         result.addProperty("executable_format", currentProgram.getExecutableFormat());
         result.addProperty("language_id", currentProgram.getLanguageID().getIdAsString());
         result.addProperty("compiler_spec_id", currentProgram.getCompilerSpec().getCompilerSpecID().getIdAsString());
@@ -822,6 +831,10 @@ public final class ReaGhidraBridge extends HeadlessScript {
         result.addProperty("total_fields", totalFields);
         result.addProperty("truncated", totalFields > 20_000);
         result.add("limitations", GSON.toJsonTree(List.of("Layouts are Ghidra data-type database observations; original debug/source authority and flexible-tail semantics are not inferred. Nested and recursive types retain category-path identities for separate inspection.", "At most 20000 fields or enum members are serialized per type to bound provider output. total_fields and truncated report omissions. Enum values preserve Ghidra's signed long representation.")));
+        if (type != null) {
+            JsonObject metadata = analysisExtensions.inspectDataType(currentProgram, type, address, monitor);
+            if (metadata != null) result.add("metadata_recovery", metadata);
+        }
         return result;
     }
 
@@ -3051,10 +3064,11 @@ public final class ReaGhidraBridge extends HeadlessScript {
         if (!Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS)) {
             throw new IllegalArgumentException("REA session descriptor is invalid");
         }
-        JsonObject object = requireObject(
-            JsonParser.parseString(Files.readString(path, StandardCharsets.UTF_8)),
-            DESCRIPTOR_KEYS
-        );
+        JsonElement parsed = JsonParser.parseString(Files.readString(path, StandardCharsets.UTF_8));
+        Set<String> keys = new HashSet<>(DESCRIPTOR_KEYS);
+        if (parsed.isJsonObject() && parsed.getAsJsonObject().has("analysis_extensions"))
+            keys.add("analysis_extensions");
+        JsonObject object = requireObject(parsed, keys);
         return new SessionDescriptor(
             requireString(object, "transport"),
             requireString(object, "endpoint_path"),
@@ -3062,7 +3076,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
             requireString(object, "run_id"),
             requireSha256(object, "target_sha256"),
             requireString(object, "provider_version"),
-            requireString(object, "profile_digest")
+            requireString(object, "profile_digest"),
+            object.has("analysis_extensions") ? object.getAsJsonArray("analysis_extensions") : new JsonArray()
         );
     }
 
@@ -3246,7 +3261,8 @@ public final class ReaGhidraBridge extends HeadlessScript {
         String runId,
         String targetSha256,
         String providerVersion,
-        String profileDigest
+        String profileDigest,
+        JsonArray analysisExtensions
     ) {}
     private record Request(int id, String method, JsonObject params) {}
 

bridge/ghidra/ReaGhidraExtensions.java

@@ -0,0 +1,113 @@
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.exception.CancelledException;
+import ghidra.util.task.TaskMonitor;
+import java.lang.reflect.InvocationTargetException;
+import java.net.URLClassLoader;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.List;
+
+/** Session-owned extension loading; analyzer algorithms stay behind each adapter ABI. */
+final class ReaGhidraExtensions implements AutoCloseable {
+    private record Loaded(URLClassLoader loader, Object instance, String sha256) {}
+    private final List<Loaded> loaded = new ArrayList<>();
+    private final JsonArray reports = new JsonArray();
+
+    void analyze(JsonArray descriptors, Program program, TaskMonitor monitor) throws Exception {
+        for (var item : descriptors) {
+            monitor.checkCancelled();
+            JsonObject descriptor = item.getAsJsonObject();
+            String id = descriptor.get("id").getAsString();
+            String entry = descriptor.get("entry_class").getAsString();
+            String digest = descriptor.get("sha256").getAsString();
+            JsonObject report = new JsonObject();
+            report.addProperty("id", id);
+            report.addProperty("sha256", digest);
+            URLClassLoader loader = null;
+            try {
+                if (!id.equals("nativeaot") || !entry.equals("rea.extensions.nativeaot.NativeAotExtension") ||
+                    descriptor.get("integration_api").getAsInt() != 1)
+                    throw new IllegalArgumentException("Unregistered Ghidra extension ABI: " + id);
+                Path path = Path.of(descriptor.get("path").getAsString());
+                if (!path.isAbsolute() || !Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS) || Files.size(path) > 8 * 1024 * 1024)
+                    throw new IllegalArgumentException("Invalid private extension artifact: " + path);
+                String measured = java.util.HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(Files.readAllBytes(path)));
+                if (!measured.equals(digest)) throw new IllegalArgumentException("Private extension digest mismatch: " + id);
+                loader = new URLClassLoader(new java.net.URL[] { path.toUri().toURL() }, getClass().getClassLoader());
+                Class<?> type = Class.forName(entry, true, loader);
+                Object instance = type.getConstructor().newInstance();
+                Object response = type.getMethod("analyze", Program.class, TaskMonitor.class).invoke(instance, program, monitor);
+                if (!(response instanceof JsonObject result)) throw new IllegalArgumentException("Invalid Ghidra extension result: " + id);
+                report.addProperty("status", result.get("status").getAsString());
+                report.add("reason", result.get("reason").deepCopy());
+                report.add("result", result);
+                loaded.add(new Loaded(loader, instance, digest));
+                loader = null;
+            } catch (InvocationTargetException ex) {
+                if (ex.getCause() instanceof CancelledException cancelled) throw cancelled;
+                failure(report, ex.getCause());
+            } catch (Exception | LinkageError ex) {
+                failure(report, ex);
+            } finally {
+                if (loader != null) loader.close();
+            }
+            reports.add(report);
+        }
+    }
+
+    JsonArray reports() { return reports.deepCopy(); }
+
+    JsonArray inspectImage() throws Exception {
+        JsonArray summaries = new JsonArray();
+        for (Loaded extension : loaded) {
+            Object response = extension.instance.getClass().getMethod("inspectImage").invoke(extension.instance);
+            if (!(response instanceof JsonObject summary)) throw new IllegalArgumentException("Invalid extension image summary");
+            summary.addProperty("analysis_artifact_sha256", extension.sha256);
+            summaries.add(summary);
+        }
+        return summaries;
+    }
+
+    JsonObject inspectDataType(Program program, DataType type, Address address, TaskMonitor monitor) throws Exception {
+        for (Loaded extension : loaded) {
+            try {
+                Object response = extension.instance.getClass().getMethod("inspectDataType", Program.class, DataType.class, Address.class, TaskMonitor.class)
+                    .invoke(extension.instance, program, type, address, monitor);
+                if (response instanceof JsonObject result) return result;
+                if (response != null) throw new IllegalArgumentException("Invalid extension type metadata result");
+            } catch (InvocationTargetException ex) {
+                if (ex.getCause() instanceof CancelledException cancelled) throw cancelled;
+                throw new IllegalStateException("Ghidra extension type inspection failed: " + ex.getCause(), ex.getCause());
+            }
+        }
+        return null;
+    }
+
+    private static void failure(JsonObject report, Throwable ex) {
+        String reason = "Extension loading/analysis failed: " + ex;
+        if (ex.getCause() != null) reason += "; caused by " + ex.getCause();
+        report.addProperty("status", "failed");
+        report.addProperty("reason", reason);
+        JsonObject result = new JsonObject();
+        result.addProperty("loader_failure", reason);
+        report.add("result", result);
+    }
+
+    @Override public void close() throws Exception {
+        Exception failure = null;
+        for (Loaded extension : loaded) {
+            try { extension.loader.close(); }
+            catch (Exception ex) { if (failure == null) failure = ex; else failure.addSuppressed(ex); }
+        }
+        loaded.clear();
+        if (failure != null) throw failure;
+    }
+}

bridge/ghidra/extensions/nativeaot/NativeAotDirectory.java

@@ -0,0 +1,70 @@
+package rea.extensions.nativeaot;
+
+import ghidra.app.util.importer.MessageLog;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import java.util.LinkedHashSet;
+import nativeaot.rtr.ReadyToRunDirectory;
+import nativeaot.rtr.ReadyToRunSection;
+import nativeaot.rtr.SignatureReadyToRunLocator;
+import nativeaot.rtr.SymbolReadyToRunLocator;
+
+/** Validate the producer's NativeAOT row layout before database mutation. */
+final class NativeAotDirectory {
+    record Located(Address address, ReadyToRunDirectory directory, String discovery) {}
+
+    static Located locate(Program program, TaskMonitor monitor, MessageLog log) throws Exception {
+        Address[] symbols = SymbolReadyToRunLocator.instance.locateModules(program, monitor, log);
+        String discovery = symbols.length == 0 ? "signature-heuristic" : "symbol";
+        Address[] found = symbols.length == 0
+            ? SignatureReadyToRunLocator.instance.locateModules(program, monitor, log) : symbols;
+        var candidates = new LinkedHashSet<Address>();
+        for (Address address : found) if (address.getOffset() != 0) candidates.add(address);
+        if (candidates.isEmpty()) return null;
+        if (candidates.size() != 1)
+            throw new UnsupportedOperationException("Ambiguous NativeAOT directory candidates: " + candidates);
+        Address address = candidates.iterator().next();
+        var memory = program.getMemory();
+        byte[] header = new byte[16];
+        if (memory.getBytes(address, header) != header.length)
+            throw new IllegalArgumentException("Incomplete NativeAOT header at " + address);
+        int count = Short.toUnsignedInt(memory.getShort(address.add(12)));
+        if (count < 1 || count > 80 || Byte.toUnsignedInt(header[14]) != 24 || header[15] != 1)
+            throw new UnsupportedOperationException("Unsupported NativeAOT row layout at " + address +
+                ": sections=" + count + ", entry_size=" + Byte.toUnsignedInt(header[14]) + ", entry_type=" + Byte.toUnsignedInt(header[15]));
+        byte[] rows = new byte[count * 24];
+        if (memory.getBytes(address.add(16), rows) != rows.length)
+            throw new IllegalArgumentException("Incomplete NativeAOT directory rows at " + address);
+        ReadyToRunDirectory directory = ReadyToRunDirectory.readAtAddress(program, address);
+        if (directory.getMajorVersion() != 9 || directory.getMinorVersion() != 1)
+            throw new UnsupportedOperationException("Unsupported NativeAOT RTR format " +
+                directory.getMajorVersion() + "." + directory.getMinorVersion() + " at " + address + "; verified format is 9.1 (.NET 8.0.22 Linux x64 fixture).");
+        var types = new LinkedHashSet<Integer>();
+        for (ReadyToRunSection section : directory.getSections()) {
+            monitor.checkCancelled();
+            if (!types.add(section.getType())) throw new IllegalArgumentException("Duplicate NativeAOT section " + section.getType() + " at " + address);
+            // ModuleInfoRow flags bit 0 declares an end pointer. ThreadStaticIndex
+            // (204) is a single-address entry with flags=0 and an absent end.
+            if (section.getFlags() != 0 && section.getFlags() != 1)
+                throw new UnsupportedOperationException("Unsupported NativeAOT section flags " + section.getFlags() + " for section " + section.getType());
+            boolean hasEnd = section.getFlags() == 1;
+            if (!hasEnd && section.getEnd() != 0)
+                throw new IllegalArgumentException("NativeAOT single-address section " + section.getType() + " reports an unexpected end");
+            if (hasEnd && Long.compareUnsigned(section.getStart(), section.getEnd()) > 0)
+                throw new IllegalArgumentException("Reversed NativeAOT section " + section.getType() + " at " + address);
+            if (section.getStart() != 0 && (!hasEnd || section.getStart() != section.getEnd()) &&
+                (!memory.contains(address.getNewAddress(section.getStart())) ||
+                 (hasEnd && !memory.contains(address.getNewAddress(section.getEnd() - 1)))))
+                throw new IllegalArgumentException("Unmapped NativeAOT section " + section.getType() + " at " + address);
+        }
+        if (directory.getSectionByType(ReadyToRunSection.DEHYDRATED_DATA) == null)
+            throw new UnsupportedOperationException("NativeAOT directory at " + address + " has no DEHYDRATED_DATA; non-dehydrated layouts are not verified.");
+        for (int type : new int[] { ReadyToRunSection.DEHYDRATED_DATA, ReadyToRunSection.FROZEN_OBJECT_REGION }) {
+            ReadyToRunSection section = directory.getSectionByType(type);
+            if (section != null && section.getFlags() != 1)
+                throw new IllegalArgumentException("NativeAOT section " + type + " requires an end pointer");
+        }
+        return new Located(address, directory, discovery);
+    }
+}

bridge/ghidra/extensions/nativeaot/NativeAotExtension.java

@@ -0,0 +1,183 @@
+package rea.extensions.nativeaot;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.app.util.importer.MessageLog;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.address.AddressSet;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.exception.CancelledException;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.FrozenObjectAnnotator;
+import nativeaot.objectmodel.MethodTableCrawler;
+import nativeaot.objectmodel.MethodTableManager;
+import nativeaot.rehydration.MetadataRehydratorNet80;
+import nativeaot.rtr.ReadyToRunSection;
+import java.util.ArrayList;
+import java.util.List;
+import java.security.MessageDigest;
+
+/** Optional headless facade over the unchanged upstream analysis primitives. */
+public final class NativeAotExtension {
+    private MethodTableManager manager;
+    private NativeAotDirectory.Located located;
+    private JsonObject report;
+    private final List<String> diagnostics = new ArrayList<>();
+    private JsonObject derivedRange;
+
+    public JsonObject analyze(Program program, TaskMonitor monitor) throws Exception {
+        report = new JsonObject();
+        report.addProperty("id", "nativeaot");
+        report.addProperty("integration_api", 1);
+        report.addProperty("source_revision", "effeb734fc570c32650f88b159608979dc7b423e");
+        report.addProperty("source_revision_authority", "build-reported-unattested");
+        report.addProperty("status", "not_applicable");
+        report.addProperty("reason", "No NativeAOT directory with the supported row layout was found.");
+        report.addProperty("method_tables", 0);
+        if (!program.getLanguageID().getIdAsString().startsWith("x86:LE:64"))
+            return failure("unsupported", "NativeAOT adapter supports x86-64 only.");
+        MessageLog log = new MessageLog();
+        int transaction = program.startTransaction("REA NativeAOT metadata recovery");
+        boolean commit = false;
+        String stage = "directory-discovery";
+        try {
+            located = NativeAotDirectory.locate(program, monitor, log);
+            if (located == null) return finish(log);
+            report.addProperty("header_address", address(located.address()));
+            report.addProperty("discovery", located.discovery());
+            report.addProperty("format_major", located.directory().getMajorVersion());
+            report.addProperty("format_minor", located.directory().getMinorVersion());
+            stage = "metadata-rehydration";
+            var section = located.directory().getSectionByType(ReadyToRunSection.DEHYDRATED_DATA);
+            Address start = located.address().getNewAddress(section.getStart());
+            Address end = located.address().getNewAddress(section.getEnd());
+            if (start.compareTo(end) >= 0) throw new IllegalArgumentException("Empty dehydrated section at " + start);
+            var scan = new MetadataRehydratorNet80().rehydrate(program, new AddressSet(start, end).getFirstRange(), monitor, log);
+            // Upstream reports an inclusive end at base + written length.
+            long writtenLength = scan.getScanningRange().getLength() - 1;
+            derivedRange = new JsonObject();
+            derivedRange.addProperty("address", address(scan.getScanningRange().getMinAddress()));
+            derivedRange.addProperty("size_bytes", writtenLength);
+            derivedRange.addProperty("sha256", hashMemory(program, scan.getScanningRange().getMinAddress(), writtenLength, monitor));
+            derivedRange.add("file_offset", JsonNull.INSTANCE);
+            stage = "method-table-recovery";
+            manager = MethodTableManager.createForDirectory(program, located.directory());
+            var conventions = NativeAotMethodConventions.capture(program, monitor);
+            new MethodTableCrawler(manager, program, scan).analyze(monitor, log);
+            stage = "calling-convention-preservation";
+            NativeAotMethodConventions.restore(program, manager, conventions, monitor);
+            log.appendMsg("REA", "Preserved pre-recovery calling conventions; new functions use the loaded compiler specification default. Original method signatures remain unknown.");
+            if (manager.getObjectMT() == null || manager.getMethodTableCount() == 0)
+                throw new UnsupportedOperationException("No unambiguous System.Object method table was recovered at header " + located.address());
+            stage = "frozen-object-annotation";
+            if (manager.getStringMT() == null || scan.getPointerLocations().length == 0) {
+                diagnostics.add("Frozen-object annotation unavailable: System.String table or pointer locations were not recovered.");
+            } else {
+                new FrozenObjectAnnotator(program, manager).analyze(located.directory(), scan.getPointerLocations(), monitor, log);
+            }
+            monitor.checkCancelled();
+            report.addProperty("method_tables", manager.getMethodTableCount());
+            JsonObject coverage = auditFrozenObjects(program, scan.getPointerLocations(), monitor);
+            report.add("coverage", coverage);
+            if (coverage.get("frozen_objects_annotated").getAsInt() != coverage.get("frozen_object_candidates").getAsInt())
+                diagnostics.add("Some frozen-object candidates lack committed instance annotations; inspect coverage counts and Ghidra diagnostics.");
+            report.addProperty("status", diagnostics.isEmpty() ? "complete" : "partial");
+            report.add("reason", JsonNull.INSTANCE);
+            report.add("derived_memory", derivedRange.deepCopy());
+            JsonArray tables = new JsonArray();
+            for (var mt : manager.getMethodTables()) {
+                monitor.checkCancelled();
+                JsonObject identity = new JsonObject();
+                identity.addProperty("address", address(mt.getAddress()));
+                identity.addProperty("type", mt.getMTType().getPathName());
+                tables.add(identity);
+            }
+            report.add("types", tables);
+            commit = true;
+            return finish(log);
+        } catch (CancelledException ex) {
+            manager = null;
+            throw ex;
+        } catch (Exception ex) {
+            manager = null;
+            diagnostics.add(stage + ": " + ex.getClass().getSimpleName() + ": " + ex.getMessage());
+            report.addProperty("status", ex instanceof UnsupportedOperationException ? "unsupported" : "failed");
+            report.addProperty("reason", stage + ": " + ex.getMessage());
+            return finish(log);
+        } finally {
+            program.endTransaction(transaction, commit);
+        }
+    }
+
+    /** Inline discovery for the existing loaded-image inspection. */
+    public JsonObject inspectImage() {
+        JsonObject summary = new JsonObject();
+        summary.addProperty("format", "dotnet-nativeaot");
+        for (String key : new String[] { "status", "reason", "header_address", "discovery", "format_major", "format_minor", "method_tables", "derived_memory", "coverage", "diagnostics" })
+            summary.add(key, report.has(key) ? report.get(key).deepCopy() : JsonNull.INSTANCE);
+        summary.add("types", report.has("types") ? report.get("types").deepCopy() : new JsonArray());
+        JsonArray limitations = new JsonArray();
+        limitations.add("Recovery covers the reported metadata candidates; it does not reconstruct original C# source, custom field layouts, every runtime object, or execution behavior.");
+        limitations.add("Method prototypes and parameter names remain Ghidra inferences; verify them against instructions and call sites. Pre-recovery conventions are retained rather than universally forcing __thiscall.");
+        limitations.add("NativeAOT type identities and relationships are inferred; generated names are not original names. Derived memory has no original file offsets.");
+        summary.add("limitations", limitations);
+        return summary;
+    }
+
+    /** Read recovered relationships without restoring or mutating database state. */
+    public JsonObject inspectDataType(Program program, DataType type, Address selected, TaskMonitor monitor) throws Exception {
+        if (manager == null) return null;
+        return NativeAotTypeMetadata.describe(program, manager, located, type, report, derivedRange, monitor);
+    }
+
+    private JsonObject auditFrozenObjects(Program program, Address[] pointerLocations, TaskMonitor monitor) throws Exception {
+        JsonObject coverage = new JsonObject();
+        int candidates = 0, annotated = 0;
+        var section = located.directory().getSectionByType(ReadyToRunSection.FROZEN_OBJECT_REGION);
+        if (section != null) for (Address location : section.getPointersInSection(pointerLocations)) {
+            monitor.checkCancelled();
+            var table = manager.getMethodTable(program.getMemory().getLong(location));
+            if (table == null) continue;
+            candidates++;
+            var expected = table.getInstanceType();
+            var actual = program.getListing().getDataAt(location);
+            if (expected != null && actual != null && actual.getDataType().getPathName().equals(expected.getPathName())) annotated++;
+        }
+        coverage.addProperty("frozen_object_candidates", candidates);
+        coverage.addProperty("frozen_objects_annotated", annotated);
+        coverage.addProperty("basis", "rehydrated-pointer-candidates-and-committed-instance-types");
+        return coverage;
+    }
+
+    private JsonObject finish(MessageLog log) {
+        if (!log.toString().isBlank()) diagnostics.add(log.toString());
+        JsonArray messages = new JsonArray();
+        for (String message : diagnostics) messages.add(message);
+        report.add("diagnostics", messages);
+        return report;
+    }
+
+    private JsonObject failure(String status, String reason) {
+        report.addProperty("status", status);
+        report.addProperty("reason", reason);
+        return finish(new MessageLog());
+    }
+
+    static String address(Address value) { return "0x" + Long.toUnsignedString(value.getOffset(), 16); }
+
+    private static String hashMemory(Program program, Address start, long length, TaskMonitor monitor) throws Exception {
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        byte[] buffer = new byte[65536];
+        for (long offset = 0; offset < length;) {
+            monitor.checkCancelled();
+            int count = (int)Math.min(buffer.length, length - offset);
+            if (program.getMemory().getBytes(start.add(offset), buffer, 0, count) != count)
+                throw new IllegalStateException("Incomplete derived-memory read at " + start.add(offset));
+            digest.update(buffer, 0, count);
+            offset += count;
+        }
+        return java.util.HexFormat.of().formatHex(digest.digest());
+    }
+}

bridge/ghidra/extensions/nativeaot/NativeAotMethodConventions.java

@@ -0,0 +1,38 @@
+package rea.extensions.nativeaot;
+
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.MethodTableManager;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+
+/** Keep upstream's unconditional __thiscall assignment out of x64 ABI evidence. */
+final class NativeAotMethodConventions {
+    static Map<Address, String> capture(Program program, TaskMonitor monitor) throws Exception {
+        Map<Address, String> result = new HashMap<>();
+        var functions = program.getFunctionManager().getFunctions(true);
+        while (functions.hasNext()) {
+            monitor.checkCancelled();
+            var function = functions.next();
+            result.put(function.getEntryPoint(), function.getCallingConventionName());
+        }
+        return result;
+    }
+
+    static void restore(Program program, MethodTableManager manager, Map<Address, String> previous, TaskMonitor monitor) throws Exception {
+        var visited = new HashSet<Address>();
+        String defaultConvention = program.getCompilerSpec().getDefaultCallingConvention().getName();
+        for (var table : manager.getMethodTables()) for (long target : table.getVTable()) {
+            monitor.checkCancelled();
+            Address address = table.getAddress().getNewAddress(target);
+            if (!visited.add(address)) continue;
+            var function = program.getFunctionManager().getFunctionAt(address);
+            if (function == null) continue;
+            String convention = previous.containsKey(address) ? previous.get(address) : defaultConvention;
+            if (!java.util.Objects.equals(function.getCallingConventionName(), convention))
+                function.setCallingConvention(convention);
+        }
+    }
+}

bridge/ghidra/extensions/nativeaot/NativeAotTypeMetadata.java

@@ -0,0 +1,70 @@
+package rea.extensions.nativeaot;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonNull;
+import com.google.gson.JsonObject;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.Program;
+import ghidra.util.task.TaskMonitor;
+import nativeaot.objectmodel.MethodTable;
+import nativeaot.objectmodel.MethodTableManager;
+
+/** Translate a selected recovered type into provider-neutral metadata evidence. */
+final class NativeAotTypeMetadata {
+    static JsonObject describe(Program program, MethodTableManager manager, NativeAotDirectory.Located located,
+        DataType type, JsonObject report, JsonObject derivedRange, TaskMonitor monitor) throws Exception {
+        for (MethodTable table : manager.getMethodTables()) {
+            monitor.checkCancelled();
+            boolean sameType = type.getPathName().equals(table.getMTType().getPathName()) ||
+                (table.getInstanceType() != null && type.getPathName().equals(table.getInstanceType().getPathName()));
+            if (!sameType) continue;
+            JsonObject result = new JsonObject();
+            result.addProperty("format", "dotnet-nativeaot");
+            result.addProperty("status", report.get("status").getAsString());
+            result.addProperty("header_address", NativeAotExtension.address(located.address()));
+            result.addProperty("format_major", located.directory().getMajorVersion());
+            result.addProperty("format_minor", located.directory().getMinorVersion());
+            result.addProperty("method_table_address", NativeAotExtension.address(table.getAddress()));
+            result.addProperty("name_origin", table == manager.getObjectMT() || table == manager.getStringMT() ? "inferred" : "generated");
+            result.add("original_name", JsonNull.INSTANCE);
+            result.addProperty("base_size_bytes", table.getBaseSize());
+            result.add("related_type", identity(manager, table.getRelatedTypeAddress()));
+            JsonArray interfaces = new JsonArray();
+            for (long value : table.getInterfaceAddresses()) if (value != 0) interfaces.add(identity(manager, value));
+            result.add("interfaces", interfaces);
+            JsonArray slots = new JsonArray();
+            for (int slot = 0; slot < table.getVTableSlotCount(); slot++) {
+                monitor.checkCancelled();
+                long value = table.getVTableSlot(slot);
+                JsonObject target = new JsonObject();
+                target.addProperty("slot", slot);
+                target.addProperty("slot_address", NativeAotExtension.address(table.getAddress().add(24 + slot * 8L)));
+                target.add("target_address", value == 0 ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive("0x" + Long.toUnsignedString(value, 16)));
+                var function = value == 0 ? null : program.getFunctionManager().getFunctionAt(table.getAddress().getNewAddress(value));
+                target.add("procedure_name", function == null ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive(function.getName(true)));
+                target.addProperty("basis", "method-table-pointer");
+                slots.add(target);
+            }
+            result.add("virtual_slots", slots);
+            result.add("derived_memory", derivedRange.deepCopy());
+            result.add("diagnostics", report.get("diagnostics").deepCopy());
+            JsonArray limitations = new JsonArray();
+            limitations.add("Type identities and relationships are recovered by upstream heuristics. Original source names and custom field layouts are not recovered.");
+            limitations.add("Method prototypes are inferred, not original signatures. REA preserves pre-recovery calling conventions and the loaded compiler default for new functions.");
+            limitations.add("Rehydrated metadata bytes are derived analysis-memory content; their original file offsets and runtime behavior remain unknown.");
+            limitations.add("Verified workflow: .NET 8.0.22 NativeAOT RTR 9.1, Linux x64 ELF / Windows x64 PE on Linux; other runtime layouts and hosts are unverified.");
+            result.add("limitations", limitations);
+            return result;
+        }
+        return null;
+    }
+
+    private static com.google.gson.JsonElement identity(MethodTableManager manager, long value) throws Exception {
+        if (value == 0) return JsonNull.INSTANCE;
+        JsonObject result = new JsonObject();
+        result.addProperty("address", "0x" + Long.toUnsignedString(value, 16));
+        MethodTable table = manager.getMethodTable(value);
+        result.add("type", table == null ? JsonNull.INSTANCE : new com.google.gson.JsonPrimitive(table.getMTType().getPathName()));
+        return result;
+    }
+}

docs/adr/0001-provider-selection-and-analysis-profiles.md

@@ -5,9 +5,12 @@
 - Implementation status: The provider registry, deterministic selection,
   target binding, analysis-profile commitment, and snapshot/Evidence migration
   are implemented. Ghidra discovery, target/profile resolution, doctor checks,
-  the private headless-session foundation, ten read-only inventory capabilities,
-  and twelve function-analysis capabilities are implemented with real
-  cross-format conformance.
+  the private headless-session foundation, thirteen read-only inventory/load-image
+  capabilities, and twelve function-analysis capabilities are implemented with
+  real cross-format conformance. Linux/macOS also supports atomic session
+  function annotations; experimental Windows x64 P0 uses bundled native controls
+  and admits only the 25 read-only operations. See the
+  [release boundary](../installation.md#released-package-and-main).
 
 ## Context
 
@@ -25,7 +28,7 @@ engine, engine version, or complete analysis configuration. Two analyses of the
 same bytes could therefore disagree because of language, compiler, loader,
 analyzer, or provider-version differences while appearing target-compatible.
 
-These constraints are embodied in the current
+The decision addressed the earlier representations of
 [`CompositeProvider`](../../src/application/CompositeProvider.ts),
 [runtime composition](../../src/application/runtime.ts),
 [`BinarySession`](../../src/application/BinarySession.ts),

docs/adr/README.md

@@ -4,8 +4,8 @@ Accepted decisions describe the architecture that implementation PRs must
 follow. Acceptance does not by itself mean the behavior is shipped; each record
 states its implementation status separately.
 
-| ADR                                                                                                                | Status               | Implementation                                                                                                               |
-| ------------------------------------------------------------------------------------------------------------------ | -------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted             | Provider selection and 22 Ghidra operations shipped on Linux/macOS; experimental Windows x64 P0 with bundled native controls |
-| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Superseded           | Historical design; the controlled JavaScript replay tool was removed                                                         |
-| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Partially superseded | Seven static managed tools remain; runtime planning removed                                                                  |
+| ADR                                                                                                                | Status               | Implementation                                                                                                                        |
+| ------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| [0001: Provider selection and analysis profiles](0001-provider-selection-and-analysis-profiles.md)                 | Accepted             | Provider selection and 25 read-only Ghidra operations on Linux/macOS and experimental Windows x64 P0; Linux/macOS session annotations |
+| [0002: Controlled JavaScript replay authority and sandbox policy](0002-controlled-replay-authority-and-sandbox.md) | Superseded           | Historical design; the controlled JavaScript replay tool was removed                                                                  |
+| [0003: Managed-code evidence and provider boundary](0003-managed-code-evidence-and-provider-boundary.md)           | Partially superseded | Seven static managed tools remain; runtime planning removed                                                                           |

docs/android-analysis.md

@@ -0,0 +1,130 @@
+# Static Android APK analysis
+
+REA wraps an existing headless JADX engine through `src/android/`. Its source is
+kept as an unmodified, commit-pinned Git submodule; see
+[upstream provenance](../third_party/README.md). CLI and MCP use the same
+application workflow and return artifact-bound Evidence inline.
+
+This family is present on repository main and in npm 4.1.0. Check the
+[released package boundary](installation.md#released-package-and-main) and the
+connected server's tool list before selecting it.
+
+## Supply tools
+
+Use **Java 17 or newer** and **jadx-headless-mcp 0.7.1**. REA does not install Java,
+an Android SDK, JADX, a device service or an emulator. Set the path in the shell
+or MCP server environment:
+
+```sh
+export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar
+# Optional: select an existing JDK rather than java on PATH.
+export JAVA_HOME=/absolute/path/existing-jdk
+```
+
+Linux is verified with the public Appium ApiDemos fixture. The POSIX adapter can
+run on macOS, but that host has not undergone real Android verification.
+Windows is unsupported for this provider's owned stdio process boundary.
+
+## Answer an analyst question
+
+```sh
+rea inspect-android-package /path/Example.apk
+rea search-android-classes /path/Example.apk MainActivity
+rea inspect-android-class /path/Example.apk example.MainActivity
+rea inspect-android-method /path/Example.apk example.MainActivity onCreate
+rea inspect-android-method /path/Example.apk example.MainActivity select --overload-index 1
+rea trace-android-references /path/Example.apk example.MainActivity
+rea trace-android-references /path/Example.apk example.MainActivity --method-name onCreate
+```
+
+Equivalent MCP methods are `inspect_android_package`, `search_android_classes`,
+`inspect_android_class`, `inspect_android_method` and `trace_android_references`.
+Every request includes `path`. Class/method operations use `class_name`,
+`method_name` and optional `overload_index` as applicable. For example:
+
+```json
+{
+  "name": "inspect_android_method",
+  "arguments": {
+    "path": "/path/Example.apk",
+    "class_name": "example.MainActivity",
+    "method_name": "select",
+    "overload_index": 1
+  }
+}
+```
+
+Use `inspect_android_class` to choose an overload. REA rejects an ambiguous
+method request rather than silently selecting the first match. The engine's
+method reference operation cannot select overloads, so REA reports that boundary
+as unsupported when multiple same-name methods exist.
+
+The engine's smali fallback also joins same-name overloads; REA rejects that
+fallback for an overloaded method instead of attributing all bodies to one
+selected overload. Native/abstract methods with no decompiled body report
+`body_status: "not_available"` without inferring which implementation flag caused it.
+
+## Interpret the result
+
+- Package inspection retains decoded manifest XML, summary declarations,
+  permissions and class/resource counts. Summary fields are extracted by the
+  upstream engine and should be checked against the retained XML when needed.
+  Signature verification is explicitly `not_performed`.
+- Class search consumes all pages and checks their counts. An empty `query`
+  inventories all class names; class names are decompiler representations.
+- Class inventories return display signatures, fields and inner class names.
+  Exact DEX descriptors are unknown. Overload indices are tied to this artifact
+  and engine, not stable identities across different builds.
+- Method inspection reports Java or smali, fallback markers and complete/partial
+  returned text. Decompiled source is a derived representation. A complete text
+  result does not establish complete semantics or a byte-identical reconstruction.
+- Reference results are incoming static relationships between provider nodes.
+  Source lines and DEX instruction offsets remain unknown. They are not observed
+  runtime calls.
+- Original requests, APK SHA-256, actual engine JAR SHA-256 and raw producer
+  responses remain in Evidence. Source revision is populated only for bytes
+  matching the audited release JAR.
+
+These operations do not execute the APK or provide split APK/AAB handling,
+signature validation, full resource-table semantics, native-library analysis or
+Android runtime capture. Existing artifact inventory/extraction tools can supply
+archive evidence; `project_android_application_graph` remains a separate,
+execution-free inventory projection.
+
+## Resource and lifecycle limits
+
+Each request creates private, immutable APK and JAR copies. Their workspace and
+owned process group are cleaned on success, failure, timeout and cancellation.
+REA never writes to the original APK or launches target code.
+
+If process cleanup cannot be confirmed, REA retains the workspace and reports its
+location. That provider instance blocks subsequent engine launches until the
+caller resolves the reported resources and starts a fresh instance.
+
+The provider serializes requests within each REA instance, uses one worker and
+sets JVM maximum heap to **512 MiB**. Heap is not a total RSS cap: the JVM also
+uses native memory. Independent REA instances have independent queues. Whole
+operations have a **120-second** execution deadline after reaching the queue's
+front; upstream decompilation is limited to **90 seconds**.
+
+Decoded manifest and method text have a **1 MiB** upstream byte budget and report
+truncation. A protocol frame above **8 MiB**, or cumulative stdout/stderr above
+**32 MiB**, fails with a diagnostic instead of returning an incomplete inventory
+as complete. These are memory-safety boundaries, not undocumented result caps.
+
+## Real verification
+
+Download the explicit public fixtures once; this installs no tools:
+
+```sh
+npm run fixtures:android
+export REA_JADX_MCP_JAR="$PWD/_reference/apk-integration/jadx-headless-mcp-0.7.1-all.jar"
+export REA_ANDROID_TEST_APK="$PWD/_reference/apk-integration/ApiDemos-debug.apk"
+npm run verify:android
+```
+
+The download script verifies fixed SHA-256 values, reuses matching files and
+refuses to overwrite a different existing file. APK/JAR files live under ignored
+`_reference/` and are excluded from package contents. The lane exercises actual
+REA CLI and MCP results with the real engine, separately from synthetic protocol
+regressions. It needs no Gradle build, emulator, Android SDK or Ghidra.

docs/architecture.mermaid

@@ -1,7 +1,7 @@
 graph TD
     subgraph "Entry Points"
-        CLI["src/cli.ts<br/>One-shot CLI adapter<br/>setup, diagnostics, analysis, decompilation"]
-        MAIN["src/main.ts<br/>MCP stdio server adapter<br/>config, session, process lifetime"]
+        CLI["src/cli.ts + src/cli/<br/>One-shot CLI adapter<br/>setup, diagnostics, analysis, decompilation"]
+        MAIN["src/main.ts + src/main/<br/>MCP stdio server adapter<br/>config, session, process lifetime"]
         DISPATCH["scripts/rea.mjs<br/>Executable dispatcher<br/>routes mcp / one-shot"]
     end
 
@@ -9,22 +9,26 @@ graph TD
         SERVER["src/server/<br/>MCP request translation<br/>createServer, tool registration, toolResult"]
         HOPPER_BRIDGE["bridge/hopper_bridge.py<br/>Runs inside Hopper<br/>adapts operations to Hopper Python API"]
         GHIDRA_BRIDGE["bridge/ghidra/ReaGhidraBridge.java<br/>Packaged HeadlessScript<br/>inventory, decompiler, references, CFG"]
-        INSTALL["Host installation adapters<br/>macOS: verified vendor DMG to ~/Applications<br/>Linux: verified vendor package + apt/dnf/pacman"]
+        INSTALL["src/cli/ + src/application/Setup*<br/>Host installation adapters<br/>macOS: verified vendor DMG to ~/Applications<br/>Linux: verified vendor package + apt/dnf/pacman"]
     end
 
     subgraph "Application Layer"
         APP["src/application/<br/>Shared CLI/MCP workflows<br/>enhanced analysis and investigations"]
         SESSION["SessionProviderRouter + BinarySession<br/>one immutable deep binding per target<br/>disjoint auxiliary routing"]
         REGISTRY["AnalysisProviderRegistry<br/>sorted deep candidates<br/>deterministic selection, no fallback"]
-        JS_RECON["JavaScript artifact reconstruction<br/>directory/ASAR reads<br/>AST-only bundle projection"]
+        JS_RECON["src/application/ + src/artifacts/<br/>JavaScript artifact reconstruction<br/>directory/ASAR reads<br/>AST-only bundle projection"]
     end
 
     subgraph "Provider Layers"
         HOPPER["src/hopper/<br/>Hopper launch & Unix-socket protocol<br/>BridgeLauncher, HopperClient, protocol"]
         GHIDRA["src/ghidra/<br/>Ghidra discovery, profile & function analysis<br/>snapshot, Unix/Windows transport, bounded lifecycle"]
+        IDA["src/ida/<br/>Upstream MCP contract adaptation<br/>live GUI binding or owned headless database"]
+        IDA_MCP["External ida-pro-mcp<br/>GUI proxy or database supervisor<br/>upstream installation and engine lifecycle"]
         AUX["src/artifacts/ + src/native/<br/>disjoint artifact and native capabilities"]
-        BROWSER["src/browser/<br/>Loopback CDP transport<br/>exact-origin passive observation"]
+        BROWSER["src/browser/<br/>CDP / Playwright capture<br/>captured script adapters and publication"]
         DOTNET["src/dotnet/<br/>Managed static metadata provider<br/>PE/CLI metadata inventory, members, IL"]
+        FIRMWARE["src/firmware/<br/>Binwalk / Unblob adapters<br/>owned processes, report normalization, private extraction"]
+        ANDROID["src/android/<br/>Static APK adapter<br/>owned SDK stdio, pinned headless JADX, normalization"]
         REFERENCE["src/reference/<br/>Filesystem reference-source reader<br/>bounded traversal, validation, errors"]
     end
 
@@ -44,7 +48,7 @@ graph TD
     end
 
     subgraph "Configuration"
-        CONFIG["src/config.ts<br/>Zod-validated env parsing<br/>provider settings and origins"]
+        CONFIG["src/config.ts + src/config/<br/>Zod-validated env parsing<br/>provider settings and origins"]
     end
 
     subgraph "Tests"
@@ -61,11 +65,22 @@ graph TD
     MAIN --> SERVER
     MAIN --> APP
     CLI --> APP
+    APP --> FIRMWARE
+    FIRMWARE --> PROCESS
+    FIRMWARE --> CONTRACTS
+    APP --> ANDROID
+    ANDROID --> PROCESS
+    ANDROID --> CONTRACTS
+    ANDROID --> DOMAIN
     CLI --> ERRORS
     APP --> SESSION
     SESSION --> REGISTRY
     REGISTRY --> HOPPER
     REGISTRY --> GHIDRA
+    REGISTRY --> IDA
+    IDA --> IDA_MCP
+    IDA --> CONTRACTS
+    IDA --> DOMAIN
     SESSION --> AUX
     APP --> JS_RECON
     APP --> INSTALL
@@ -96,6 +111,7 @@ graph TD
     TESTS -.-> MAIN
     TESTS -.-> HOPPER
     TESTS -.-> GHIDRA
+    TESTS -.-> IDA
     TESTS -.-> PROCESS
     TESTS -.-> BROWSER
     TESTS -.-> EVALUATION

docs/browser-observation.md

@@ -1,14 +1,18 @@
 # Website observation with CDP
 
+Captured Debugger sources can be exported for REA's existing static JavaScript
+analysis with `export_web_scripts`. See [captured website scripts](website-script-export.md)
+for the capture options, source mappings, and browser/local resolution limits.
+
 REA can attach to a user-owned Chrome-family browser through the Chrome DevTools Protocol (CDP) and produce bounded Evidence about an existing page. This is a passive reverse-engineering capability, not a general browser automation or remote-control surface.
 
 ## Shipped surfaces
 
-- `list_browser_targets` / `rea list-browser-targets` discovers page targets at the selected target's current origin by default, with an optional exact-origin filter.
+- `list_browser_targets` / `rea list-browser-targets` discovers all eligible page targets at the endpoint by default, with an optional exact-origin filter.
 - `inspect_web_page` / `rea inspect-web-page` captures DOM structure, accessibility nodes, scripts, resources, safe response/DOM metadata, attach-window network and console metadata, WebSocket frame sizes, workers, quota, and optionally selected storage key names, redacted storage-content fingerprints, or script sources.
 - `analyze_web_bundle` / `rea analyze-web-bundle` parses selected script artifacts without execution and derives chunk edges, route and endpoint candidates, vendor fingerprints, static WebMCP declarations, and optionally source-map/original-source evidence.
 - `observe_web_session` / `rea observe-web-session` arms an observation window of the requested duration for an external user action and records ordered reload, SPA navigation, redirect, failure, lifecycle, and target-termination metadata.
-- `discover_webmcp_tools` / `rea discover-webmcp-tools` uses the experimental CDP WebMCP domain to return every in-scope registration and its complete structural input-schema summary inline. REA never exposes `WebMCP.invokeTool`; malformed protocol payloads fail explicitly instead of returning incomplete tool metadata.
+- `discover_webmcp_tools` / `rea discover-webmcp-tools` uses the experimental CDP WebMCP domain to return every in-scope registration and its complete structural input-schema summary inline. Registrations with the same name and URL in distinct observed frames retain separate identities. `tool_key` includes the observed frame ID; it is not a stable identity across navigation or browser sessions. Same-frame registration updates replace that owner only, and removal leaves other owners intact. REA never exposes `WebMCP.invokeTool`; malformed protocol payloads fail explicitly instead of returning incomplete tool metadata.
 - `compare_web_captures` / `rea compare-web-captures` compares passive captures or exact-step-aligned browser scenarios. Scenario results commit reproducible literal normalization and expose alignment failures plus artifact-level action, screenshot, DOM, accessibility, URL, history, storage, and event differences. Missing or truncated evidence is never treated as equivalence.
 - `capture_web_screenshot` / `rea capture-web-screenshot` returns a content-addressed visible-viewport PNG.
 - `compare_web_screenshots` / `rea compare-web-screenshots` performs bounded local PNG pixel comparison without OCR or external services.
@@ -37,9 +41,9 @@ REA does not launch, own, or terminate this browser. Use a dedicated profile and
 
 ## Request boundary
 
-Each request supplies a literal loopback CDP endpoint and target. Target
-discovery uses the selected target's current origin by default; an optional
-exact HTTP(S) origin filter can narrow the result. `localhost`, private-LAN
+Discovery supplies a literal loopback CDP endpoint and returns all eligible
+page targets unless an exact HTTP(S) origin filter narrows the result. Follow-up
+inspection requests select one target; their default scope is its current origin. `localhost`, private-LAN
 addresses, HTTPS CDP endpoints, credentials, paths, queries, fragments, and
 implicit ports are not valid CDP endpoints. Origin filters contain only scheme,
 host, and port; paths, credentials, queries, fragments, and wildcards are not
@@ -120,7 +124,7 @@ REA retains local observation data and removes only URL userinfo credentials, ex
 - Request/response bodies are not requested or parsed by default. When selected, only allowed-origin JSON media types are read, converted immediately to complete value-free property paths/types, and discarded. `Network.getResponseBody` is never sent unless JSON body shape capture is selected.
 - Console observations with a stack source retain call type, argument types, timestamp, and source location. When console text capture is selected, already-delivered primitive values are retained verbatim; objects, getters, and remote properties are never expanded.
 - WebSocket observations retain direction, opcode, and payload byte length. When shape capture is selected, text frames are classified as text or complete value-free JSON shape; binary bytes, hashes, prefixes, and raw frames are never retained.
-- Storage observations always redact values. Key names, IndexedDB names, and cache names require `include_storage_keys`; stable content fingerprints require the additional `include_storage_fingerprints` selection. Cache bodies above 64 KiB and partial IndexedDB remote objects make fingerprint coverage incomplete, so identical observations remain `unknown`.
+- Storage observations always redact values. Key names, IndexedDB names, and cache names require `include_storage_keys`; stable content fingerprints require the additional `include_storage_fingerprints` selection. Cookie fingerprints cover cookies applicable to the current main-frame URL, including its path, rather than every cookie path on that origin. Other storage remains scoped to the origin. Cache bodies above 64 KiB and partial IndexedDB remote objects make fingerprint coverage incomplete, so identical observations remain `unknown`.
 - Script metadata is included only when CDP supplies a URL on an allowed origin. Stable keys exclude transient CDP script IDs, and exact transient raw URLs are used only during script/resource reconciliation. URL-less scripts are excluded because their origin cannot be established. When CDP supplies an execution-context association, the accepted script retains its authorized frame ID for later attribution. Source content is omitted unless explicitly requested and is returned inline as a self-verifying artifact with its SHA-256 digest.
 
 Frames, resources, scripts, events, and workers outside the selected origin scope are excluded. An explicit `allowed_origins` list can include additional origins; excluded target details are counted without being exposed.
@@ -142,10 +146,12 @@ Disallowed-origin entries are filtered before retention.
 
 CDP discovery, WebSocket connection, and commands continue until the peer responds or the caller cancels the operation; REA has no internal byte, message-count, or pending-command quota for these exchanges. Without caller cancellation, a stalled peer can leave an operation waiting. On cancellation, REA closes only its own WebSocket, waiting up to one second before terminating it. Malformed unsolicited protocol events poison the connection so later commands fail closed.
 
-Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Every requested map, mapping, original source, AST node, and finding from parsed content is returned inline; failed maps remain explicitly unavailable and make bundle completeness partial.
+Network and console coverage starts only after REA attaches and enables the relevant CDP domains. `prior_activity_available` is always `false`; absence from these arrays is not evidence that an event never occurred. Source maps are not fetched by inspection. Bundle analysis fetches them only when `fetch_source_maps` is selected, with exact-origin redirect checks and no credentials, cookies, or referrer. Every requested map, mapping, original source, AST node, and finding from parsed content is returned inline; failed maps remain explicitly unavailable and make bundle completeness partial. Original source artifacts with `.ts`, `.tsx`, `.mts`, or `.cts` suffixes carry `text/typescript`; other source names retain `text/javascript`.
 
 ## Non-goals and threat model
 
 The browser provider deliberately does not expose generic CDP commands, `Runtime.evaluate`, WebMCP invocation, navigation, input, downloads, page closure, or browser closure. Screenshot capture is the sole pixel surface and returns an image only when requested. REA disables the domains it enabled, detaches the target session, and closes only its own WebSocket.
 
 This feature is not a browser sandbox or network containment mechanism. The attached page and browser continue running with their existing privileges and may make external requests independently of REA. CDP gives deep access to the selected browser profile, so use a dedicated profile, include only origins you intend to inspect, and treat other same-user processes as outside this boundary.
+
+Response metadata normalizes a `Referrer-Policy` fallback list to its last recognized nonempty policy, including mixed-case tokens. Unknown policy names are skipped; malformed token syntax and lists without a recognized policy remain `null`. This reports the response's declared policy, not the effective policy of a document or an inferred browser default.

docs/browser-scenario-contract.md

@@ -21,6 +21,115 @@ Duration, action, and navigation
 timeouts remain fixed provider-owned liveness limits; the request does not
 accept a caller-controlled `limits` object.
 
+## Minimal launch example
+
+Save this as `browser-scenario.json`, replacing the executable path with an
+already-installed Chrome-family browser and the URL with your running fixture:
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    { "step_id": "settle", "action": "wait_for_timeout", "duration_ms": 100 }
+  ]
+}
+```
+
+```bash
+rea capture-browser-scenario ./browser-scenario.json --json > browser-capture.json
+```
+
+The default capture includes the final URL. Select DOM, screenshots, or events
+only when they help answer the question. REA launches and cleans up the browser
+profile for this request; it does not start your fixture server or install a
+browser. A schema-valid scenario does not prove that the executable or target
+is available on the host.
+
+## Interaction example: capture the visible result
+
+The default final URL answers "where did the page end up?", not "what did the
+page show?". Many interactions, such as a search button that renders results in
+place, change the page without changing the URL. A capture with only the
+default `url` artifact then reports that the click succeeded and the URL is
+unchanged, which cannot tell you whether results appeared.
+
+Request the artifacts that answer your question and wait for the state you want
+to inspect. This scenario clicks a Search button, waits for the current search
+results, and captures the final DOM, accessibility tree, and URL. It assumes the
+local page clears `#results`'s `data-state` while loading and sets it to `ready`
+after rendering the current response. Adapt the selectors and readiness marker
+to your page; an already-visible container or previous results are insufficient.
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    {
+      "step_id": "search",
+      "action": "click",
+      "locator": { "kind": "css", "selector": "#search" },
+      "timeout_ms": 10000
+    },
+    {
+      "step_id": "results-ready",
+      "action": "wait_for",
+      "locator": { "kind": "css", "selector": "#results[data-state='ready']" },
+      "state": "visible",
+      "timeout_ms": 10000
+    }
+  ],
+  "capture": { "at_end": ["dom", "accessibility", "url"] }
+}
+```
+
+Save it as `browser-search.json` and run it the same way as the minimal
+example:
+
+```bash
+rea capture-browser-scenario ./browser-search.json --json > browser-search-capture.json
+```
+
+Through MCP, pass the same object as the `capture_browser_scenario` arguments.
+The final step's DOM and accessibility artifacts retain the page state at that
+capture time inline. REA still launches and cleans up the browser profile.
+
+The click's `timeout_ms` covers the click action. A non-navigating `fetch` or
+delayed render can finish later, so use `wait_for` to observe a page-specific
+ready condition before final capture. A page that updates synchronously can
+omit that wait. REA does not infer application readiness from capture selection.
+
+Choose captures by the question being asked:
+
+- `dom` and `accessibility`: text or structure the page rendered, such as
+  search results, validation messages, or updated lists. The accessibility tree
+  is usually the more compact way to read visible text.
+- `screenshot`: visual layout or styling, or content not exposed as text, such
+  as a canvas.
+- `history` or `storage`: navigation history, or cookies and web storage the
+  interaction wrote. Request them only when that state is the question; they
+  are never captured implicitly.
+- `after_each_step` instead of `at_end`: intermediate state between actions in
+  a multi-step scenario.
+- `events` (`console`, `page-errors`, `network`, and so on): how the page
+  reached its result, such as the request a search issued or an error it
+  logged. Select only the event families you need.
+
+Capture states are reported per artifact. An artifact you did not request is
+`not_requested`, which means REA did not look, not that the page had nothing
+to show. A step's `completeness` of `complete` covers only the sections that
+were requested. A URL-only capture can be `complete` and still be unable to
+answer a question about rendered content, so add the relevant artifact and run
+the scenario again rather than inferring from its absence. Capture completeness
+also does not assert that the page's background work has finished.
+
 The browser boundary is part of the contract. Launch mode requires a
 caller-selected executable and always uses a provider-owned temporary profile
 that is closed and deleted during cleanup. Connect mode accepts only an
@@ -85,6 +194,83 @@ external browser without closing it. The request itself defines the operation;
 there is no additional REA grant step. The browser and host still enforce their
 own access and process rules.
 
+## Network evidence
+
+`capture.events: ["network"]` retains request, response, completion, failure,
+and unfinished-request metadata. Select content independently:
+
+```json
+{
+  "browser": {
+    "mode": "launch",
+    "executable_path": "/absolute/path/to/chromium"
+  },
+  "start_url": { "url": "http://127.0.0.1:3000" },
+  "actions": [
+    {
+      "step_id": "run",
+      "action": "click",
+      "locator": { "kind": "css", "selector": "#start" },
+      "timeout_ms": 10000
+    },
+    {
+      "step_id": "ready",
+      "action": "wait_for",
+      "locator": { "kind": "css", "selector": "#done" },
+      "state": "visible",
+      "timeout_ms": 10000
+    }
+  ],
+  "capture": {
+    "network": {
+      "request_body": true,
+      "response_body": true,
+      "header_values": true
+    }
+  }
+}
+```
+
+All three options default to `false`. Any selected network content also enables
+network metadata observation; listing `network` in `events` is then optional.
+Each observed request object receives a capture-scoped `transaction_id`.
+Requests sharing a URL remain distinct. Redirects link to the preceding
+transaction only when it was observed; a null predecessor does not establish
+that no earlier hop existed. Older captures without IDs remain readable and
+their transaction association is unknown.
+
+`scenario.network_content` records the resolved content selection. Comparing
+captures with different selection, or legacy captures without that coverage
+information, reports network evidence as unknown with a recovery instruction.
+Capturing more data alone does not establish a website change.
+
+`network-content` events reference the exact request or response event through
+`source_event_sequence`. They include independently typed headers and body
+states. Captured bodies retain base64 bytes, byte count, media type, and SHA-256
+of the retained bytes. Request bytes are those exposed by Playwright; a
+`not_exposed` request body does not prove absence or complete multipart file
+coverage. Response bytes are decoded by the browser, not the compressed wire
+representation. No later fetch is substituted for the original response.
+Headers preserve producer order and duplicates. Authorization,
+Proxy-Authorization, Cookie, and Set-Cookie values are null with
+`redacted: true`; ordinary values remain intact. Declared UTF-8 secret values
+and their standard URI/form or JSON-escaped representations are replaced without
+decoding unrelated binary bytes. Other encodings are not interpreted. Digests describe the
+retained representation after redaction.
+
+Only completed responses are read. At the end of the final step, observation
+stops; requests still in flight emit `request-unfinished`, and their observed
+responses have explicitly unavailable bodies. This cutoff does not wait for
+long-lived streaming connections. Already-started content reads settle before
+browser cleanup, with a provider-owned five-second timeout per read and
+cancellation support. Failed or unexposed reads retain per-content states and make selected
+event coverage incomplete. Body events can arrive during later steps or final
+drain; event bounds describe receipt during the step, while the source event
+reference establishes the transaction phase. Comparison attributes content to
+its source event's step and excludes the sequence reference from normalization.
+Playwright scenario capture does not supply initiator stacks; passive CDP
+observation retains its own initiator evidence.
+
 ## Scenario comparison
 
 `compare_web_captures` and `compare-web-captures` also accept two complete

docs/capability-migration.md

@@ -0,0 +1,95 @@
+# Incremental capability migration
+
+This working guide tracks the migration in #740. Update it as concrete domains
+migrate. Existing public contracts and domain-specific ports remain authoritative;
+there is no new universal provider interface or fixed module manifest.
+
+## Ownership to preserve
+
+| Responsibility                                | Current owner                            | Migration direction                                            |
+| --------------------------------------------- | ---------------------------------------- | -------------------------------------------------------------- |
+| Analyst semantics and Evidence representation | domain                                   | Keep pure and provider-neutral                                 |
+| Named public input/output contracts           | contracts                                | Keep exact CLI/MCP meaning and complete discovery              |
+| Producer parsing and external tool protocols  | provider adapters                        | Keep behind the relevant typed port                            |
+| Shared analyst workflows                      | application                              | Share between CLI and MCP                                      |
+| Concrete provider construction                | binary runtime, composition, MCP startup | Consolidate one capability at a time in production composition |
+| Investigation Evidence and Unknowns           | BinarySessionRecords                     | Extract one composed record owner after caller migration       |
+| Target/profile snapshots and invalidation     | BinarySessionRecords/BinarySession       | Keep binary-owned                                              |
+| Subprocess ownership and host primitives      | process/windows                          | Reuse; preserve cancellation and cleanup                       |
+| Public translation                            | CLI/MCP adapters                         | Delegate to shared workflows and named contracts               |
+
+Retain exact Evidence IDs, provenance, detached reads, atomic Evidence/Unknown
+mutations and optimistic revisions. Preserve current close and failed-cleanup
+record clearing while extracting ownership; #721 owns any retention-policy change.
+Each CLI invocation and MCP connection keeps its own state. Provider registration
+must not launch engines or install prerequisites.
+
+## Migrate before generalizing
+
+1. Record the actual callers, state, environment, protocol and verification owner
+   of the capability being migrated.
+2. Move concrete construction behind its existing typed port. Preserve injected
+   ports, selected environment, queues, failure state and cleanup behavior.
+3. Test both caller paths and the applicable package/real-provider boundary.
+4. Use independently migrated capabilities to identify repeated metadata and
+   composition needs. Derive a small source declaration only when those needs
+   are established; keep unlike target/lifecycle semantics separate.
+5. Move a coherent capability's files, fixtures and verification lanes in a
+   mechanical PR. Update all path-sensitive consumers in that same PR.
+
+Pure helpers do not need an interface each. A capture-format adapter or typed
+factory may be sufficient. Avoid generic JSON execution, external MCP catalog
+passthrough, eager provider acquisition, new permission fields or a multi-package
+rewrite. Optional loading should preserve successful peers and report the failed
+capability without hiding tools from the catalog.
+
+## Checks before and after a move
+
+`npm run verify:test-discovery` compares actual Vitest file discovery with every
+repository-owned `*.test.ts` under src and tests, including newly added files. The
+check requires Git, includes untracked non-ignored tests, and excludes removed
+paths during a move. It
+rejects missing files and overlapping project ownership. It only lists files;
+it does not replace behavior tests or real-provider verification.
+
+Check imports, project isolation and coverage, development-test selection,
+lint exceptions, catalog/generator imports, npm and CI verification entrypoints,
+fixture ownership, and installed-package bridge/native path resolution.
+Domain and contracts must not import application workflows, caller adapters or
+provider implementations. Production composition is a deliberate outer boundary.
+Other existing adapter imports will migrate incrementally; do not widen a lint
+exception to conceal new protocol code inside application workflows.
+
+Select verification by the claim changed: schema/composition, package, real
+engine or host-native workflow. Record host/target prerequisites and source-owned
+fixtures. Run heavy lanes serially with bounded workers/heaps and reuse existing
+engines. Recording ports do not prove real provider or platform support.
+
+## Extension examples to validate during migration
+
+An implementation of an existing port should require a provider adapter, typed
+production factory selection, exact producer parsing/provenance and matching
+verification. Existing workflow meaning and public contracts should stay stable.
+
+A new analyst capability deliberately adds semantics, named contracts, a typed
+port/workflow when needed, both caller adapters, availability, documentation and
+verification. Its integration is broader than swapping a provider. The migration
+should eliminate incidental duplicate wiring, not erase those design decisions.
+
+Update these examples with real migrated entrypoints before closing #740.
+
+## First production factory migration
+
+`src/composition/android.ts` and `src/composition/firmware.ts` construct providers
+behind the existing AndroidAnalysisPort and FirmwareAnalysisPort. CLI registrars
+pass their selected environment; MCP uses the process environment unless a caller
+injects a port. Each factory call returns a fresh instance and acquires no process,
+workspace or toolchain. Queues, cleanup-failure state and per-request cleanup stay
+inside the provider. The existing launcher seams remain available to boundary
+fixtures, which now exercise the production factories.
+
+Application workflows and MCP registration must not import these concrete
+providers. Composition may import their implementations. Binary composition is
+still at its existing entrypoint while its direct-analysis callers are investigated.
+This concrete pilot does not introduce a shared provider interface or module
+manifest.

docs/firmware-analysis.md

@@ -0,0 +1,173 @@
+# Firmware analysis
+
+REA integrates **Binwalk 3.1.0** for region inspection and **Unblob 26.6.4** for
+explicit extraction. This first firmware milestone is verified on Linux x64.
+No device, root privilege, mount, emulation or execution of extracted programs
+is needed. Arbitrary firmware bytes do not pass native executable admission;
+select a returned ELF separately for supported Ghidra analysis.
+
+## Caller-supplied tools
+
+Provide existing tools using absolute executable paths, scoped to your shell:
+
+```sh
+export REA_BINWALK_COMMAND=/absolute/path/to/binwalk
+export REA_UNBLOB_COMMAND=/absolute/path/to/unblob
+```
+
+REA does not install these tools, their dependencies or system packages. It
+checks the actual tool version when executing a request. Inspection and
+extraction have independent prerequisites; one does not require the other.
+Both require util-linux `prlimit`, normally `/usr/bin/prlimit`; override its
+absolute path with `REA_FIRMWARE_PRLIMIT_COMMAND` if needed.
+
+Unblob needs the external extractor for the selected format on its inherited
+`PATH`: for example, `debugfs` for ext2/ext3/ext4. Its default Landlock sandbox
+and skip rules stay enabled. Sandbox startup failures remain actionable errors;
+REA does not retry with `--no-sandbox`. Missing extractors reported in a valid
+analysis report retain partial results and dependency names inline.
+
+Upstream sources are preserved unmodified as optional pinned submodules:
+
+```sh
+git submodule update --init third_party/binwalk third_party/unblob
+```
+
+Normal REA builds and npm packages do not include or build these sources or
+engine binaries. See [upstream provenance](../third_party/README.md).
+
+## CLI and MCP
+
+```sh
+rea inspect-firmware-regions /path/to/firmware.bin
+rea extract-firmware /path/to/firmware.bin /path/to/new-output
+rea extract-firmware /path/to/firmware.bin /path/to/selected-output \
+  --offset 64 --length 4096 --max-depth 3
+```
+
+The corresponding MCP tools accept the same intent:
+
+```json
+{
+  "name": "inspect_firmware_regions",
+  "arguments": { "path": "/path/to/firmware.bin" }
+}
+```
+
+```json
+{
+  "name": "extract_firmware",
+  "arguments": {
+    "path": "/path/to/firmware.bin",
+    "output_directory": "/path/to/new-output",
+    "range": { "offset": 64, "length": 4096 },
+    "max_depth": 3
+  }
+}
+```
+
+Both return Evidence with the original path and SHA-256, raw producer reports,
+actual executable path/digest, version and limitations. Binwalk signature UUIDs
+and Unblob blob IDs are producer-local identities; compare content hashes and
+source ranges across runs. A matching version does not attest an installed
+build's source revision, so that field remains unknown.
+
+### Interpret the results
+
+- Region offsets refer to bytes in the original firmware. `reported_size`
+  preserves Binwalk's output; `size_basis=provider_reported_validation_unknown`
+  reflects that Binwalk can replace unknown lengths with the next signature or
+  EOF before serialization. Neither a signature nor its confidence byte proves
+  a valid partition, encryption or runtime behavior.
+- Extraction returns regular file paths, independently verified SHA-256 values,
+  producer hashes when available, chunks, diagnostics and task derivations.
+  Unblob's task report is unordered; REA resolves relationships by paths and
+  blob IDs. Logical references use `$input`, `$output`, or `$output/<relative-path>`
+  so a real file named `$input` stays distinct from the original input.
+  Chunk offsets belong to the task's input file. Only chunks in the
+  selected input have a known `root_file_range`, adjusted by the selected offset.
+- Decompressed children have unknown original byte ranges and runtime addresses.
+  Task lineage does not establish a byte-for-byte mapping through decompression.
+- `partial` marks unknown/encrypted chunks, reported extraction problems,
+  unpublished links/special files or reached depth limits. `complete` means the
+  engine finished its configured extraction without those reported conditions;
+  default skip rules and format coverage still apply. It does not establish
+  complete firmware reconstruction.
+- The destination must be absent, absolute, with an existing parent. Publication
+  uses exclusive, symlink-resistant writes and durable digest readback. Existing
+  destinations are never overwritten. This is not an atomic directory rename:
+  a new tree can be visible while files are written. Failed uncommitted output
+  is rolled back. Symlinks and special files are recorded without publication;
+  empty directories, ownership and executable permission bits are not reproduced.
+
+Select a verified native child for the existing tools:
+
+```json
+{
+  "name": "open_binary",
+  "arguments": {
+    "path": "/path/from/extraction/usr/bin/program",
+    "provider_id": "ghidra"
+  }
+}
+```
+
+Then use `analyze_function`, `inspect_native_api` or the other native primitives.
+Native architecture and executable validation still apply. This milestone does
+not add MIPS/PPC/RISC-V decompilation, raw flash load profiles, bootloader/device
+tree semantics, vulnerability scanning, emulation or hardware runtime capture.
+
+## Resource and lifecycle policy
+
+- Nonempty regular firmware inputs: at most **128 MiB**, copied and hashed into
+  a private workspace before analysis. No in-place source modification.
+- One queued heavy operation per provider instance; Binwalk one thread and
+  Unblob one worker. No automatic parallel extraction engines.
+- **120-second** deadline; inherited **1 GiB per-process address-space** limit,
+  120 CPU seconds and zero core-dump allowance through `prlimit`.
+- JSON reports: at most **8 MiB**; oversized reports fail without a truncated
+  success. Diagnostic output is bounded with exact captured byte counts.
+- Default staging budget: **256 MiB** and **10,000 entries**, configurable using
+  `max_output_bytes` / `max_output_files` (CLI `--max-output-bytes` /
+  `--max-output-files`). Depth defaults to 3, allowed range 1–10.
+
+Staging budgets are polled and rechecked after exit; short-lived overshoot is
+possible. The inherited file-size limit bounds each file, not total storage;
+address-space limits are per process, not an aggregate memory quota. Worker
+count is not CPU affinity for every external extractor. These limits do not
+claim cgroup/container containment. Cancellation cleans the owned process group
+before removing its workspace; uncertain cleanup retains resources and blocks
+further operations in that provider instance.
+
+## Verification
+
+Generate small public, source-derived fixtures into ignored `_reference/`:
+
+```sh
+npm run fixtures:firmware
+npm run verify:firmware
+```
+
+Fixture generation requires existing Python 3 and a host C compiler (`cc`);
+override with `REA_FIRMWARE_PYTHON` / `REA_FIRMWARE_CC`. The independent oracle
+records gzip offset/length and extracted file hashes. Real verification checks
+CLI/MCP, full-file and selected-range extraction, unknown chunks, depth limits,
+content parity and unchanged source bytes. No binary fixture is committed.
+
+Additional lanes are explicit, so the base lane stays small:
+
+```sh
+# Existing mke2fs and debugfs required; put debugfs on the scoped PATH.
+REA_FIRMWARE_VERIFY_EXT4=1 npm run fixtures:firmware
+REA_FIRMWARE_VERIFY_EXT4=1 npm run verify:firmware
+
+# Existing Ghidra 12.1.4 and Java required.
+REA_FIRMWARE_VERIFY_GHIDRA=1 npm run verify:firmware
+```
+
+`REA_FIRMWARE_MKE2FS_COMMAND` selects the optional ext4 fixture producer.
+`REA_FIRMWARE_FIXTURE_ROOT` selects generated data storage.
+`REA_FIRMWARE_TEST_ENTRYPOINT` can select an isolated installed npm package's
+`scripts/rea.mjs` to verify the packaged CLI/MCP workflow. Real coverage here is
+generated gzip/USTAR/ext4 with a Linux x64 ELF child; SquashFS, UBIFS, proprietary
+firmware, other hosts and architectures remain unverified.

docs/ghidra-nativeaot.md

@@ -0,0 +1,99 @@
+# Optional NativeAOT metadata recovery
+
+REA integrates [Washi1337/ghidra-nativeaot](https://github.com/Washi1337/ghidra-nativeaot)
+through an optional headless adapter. The original source is an opt-in submodule,
+pinned to `effeb734fc570c32650f88b159608979dc7b423e`; its MIT license and existing
+source notices are retained. No upstream source or algorithms are rewritten.
+
+The initial tested layout is .NET runtime **8.0.22**, NativeAOT RTR **9.1**,
+x86-64 ELF and native Windows PE **targets analyzed on Linux x64**, using
+Ghidra **12.1.4** and JDK **21**. Other layouts/architectures/hosts are unsupported.
+Windows Ghidra P0 has no database mutation authority. A PE/CLI or ReadyToRun
+assembly should use `inspect_managed_artifact`; it is not NativeAOT.
+
+## Build and configure
+
+Bring your own supported Ghidra/JDK installation. This developer build needs
+existing `git`, `javac` and `jar`; it does not invoke Gradle, download toolchains,
+or change host configuration:
+
+```sh
+git submodule update --init third_party/ghidra-nativeaot
+npm run build:ghidra:nativeaot
+export REA_GHIDRA_NATIVEAOT_JAR="$PWD/_reference/nativeaot-integration/extension/rea-ghidra-nativeaot.jar"
+```
+
+The build requires a clean pinned upstream checkout, compiles unchanged upstream
+Java plus the REA facade, uses a fresh classes directory, and writes the JAR and
+build manifest under ignored `_reference/`. `REA_NATIVEAOT_BUILD_ROOT` can select
+another local output directory; `REA_NATIVEAOT_SOURCE` can select an equivalent
+clean pinned source checkout. Neither output nor compiled fixture belongs in Git
+or the npm package. An installed REA accepts an existing explicitly supplied JAR.
+
+REA commits the actual JAR SHA-256 into the analysis profile, copies identical
+bytes into the owned runtime, rechecks the digest before loading, and closes the
+classloader/project on session close. Profiles cannot enable code absent from
+explicit local configuration. JARs execute within Ghidra; supply a build you trust.
+The producer's reported source revision is build metadata, not an attestation of
+arbitrary caller-supplied bytes. The bounded loader accepts regular JARs up to
+8 MiB to limit startup artifact memory; this does not truncate analysis results.
+
+## Use existing tools
+
+Open the executable with provider `ghidra`. `inspect_native_load_image` returns
+optional `observations.metadata_recovery` inline, including the detected header,
+layout, recovery status, type category paths/addresses, diagnostics, annotation
+coverage and derived-memory SHA. The enclosing `unsupported` load-image status
+for PE/ELF concerns independent DOS loader verification; metadata recovery has
+its own status. It is not a failed import.
+
+Pass one returned type path or its typed address to `inspect_native_data_type`.
+Its optional `metadata_recovery` includes related/base type, implemented
+interfaces and virtual slots with targets and known procedure names. Follow
+these with `analyze_function`, string searches and ordinary cross-references.
+For CLI use:
+
+```sh
+rea inspect-native-load-image ./NativeAotFixture --provider ghidra --json
+rea inspect-native-data-type ./NativeAotFixture --type /NativeAOT/MethodTables/Class_ADDRESS_MT --provider ghidra --json
+rea function ./NativeAotFixture 0xADDRESS --provider ghidra --json
+```
+
+No new MCP workflow or approval flag is required. Configuration opts into the
+adapter; without it ordinary Ghidra profiles/results remain unchanged.
+
+## Evidence boundaries
+
+Discovery prefers an imported RTR symbol, otherwise the upstream initialized,
+non-executable-memory signature heuristic. REA rejects ambiguous candidates,
+unknown layout versions, malformed directory rows, unsupported flags and
+unmapped ranges before recovery. It requires the verified dehydrated layout.
+
+The adapter performs rehydration, method-table recovery and frozen-object
+annotation in one ephemeral Program transaction. Fatal failure/cancellation
+rolls it back. Recovery may change analysis-memory bytes, never the original
+executable file. Derived ranges have a digest and **no original file offset**;
+they are not captured runtime state. Candidate/committed instance annotation
+counts distinguish partial frozen-object coverage. Coverage concerns the
+recovered candidate set, not every possible object or every runtime type.
+
+REA preserves pre-recovery calling conventions and uses the loaded compiler
+specification default for newly created methods. The upstream universal
+`__thiscall` assignment is not treated as x64 ABI authority. Parameters and
+method prototypes remain inferences; verify them against instructions/call sites.
+
+Type relationships and System.Object/System.String identification use upstream
+heuristics. Generated names are explicitly marked; original class/member names
+and custom field layouts remain unknown. Pseudocode is recovered native logic,
+not original C# source. Unsupported recovery reports its stage and reason; it
+does not imply that ordinary native disassembly/decompilation is impossible.
+
+## Verification
+
+See [the dedicated lane](testing.md#optional-nativeaot-ghidra-analysis).
+Fixtures are source-built benign .NET programs with inheritance, an interface,
+virtual dispatch, representative arithmetic and frozen strings. Independent
+compiler/linker symbols and raw directory bytes provide the oracle. Stripped
+fixtures exercise heuristic detection. Tests do not execute the resulting
+NativeAOT binaries. Fixture generation and adapter compilation are optional and
+never prerequisites of ordinary native analysis or setup.

docs/ida-provider.md

@@ -0,0 +1,111 @@
+# IDA Pro provider
+
+REA adapts an existing [mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp) server into its native analysis tools. Install and configure IDA, Hex-Rays, Python, and upstream MCP using that repository's instructions. REA does not install, upgrade, activate, or license them, and does not bundle another IDA server.
+
+Choose one lifecycle mode in an upstream MCP JSON registration. Set `REA_IDA_MCP_CONFIG` to that file, then select `ida` once through `REA_ANALYSIS_PROVIDER`, the CLI's `--provider ida`, or MCP's `open_binary.provider_id`. No provider startup occurs during discovery.
+
+## Analyze an already-open GUI target
+
+The attached profile supports upstream **1.4.0 legacy tools**, including `get_metadata`, `list_functions`, and `decompile_function`. Copy the upstream registration's `command`, `args`, and optional `env` into a JSON file. An existing `mcpServers` object with an `ida-pro-mcp` entry is also accepted. For example:
+
+```json
+{
+  "command": "python",
+  "args": [
+    "/absolute/path/to/ida_pro_mcp/server.py",
+    "--ida-rpc",
+    "http://127.0.0.1:13337"
+  ]
+}
+```
+
+Use the executable and arguments from your working upstream registration. The legacy GUI's `/mcp` endpoint is its internal RPC endpoint; connect REA through the upstream stdio proxy rather than treating that URL as Streamable HTTP.
+
+```bash
+export REA_IDA_MCP_CONFIG=/absolute/path/to/ida-mcp.json
+export REA_ANALYSIS_PROVIDER=ida
+rea function /absolute/path/to/program main --json
+rea decompile /absolute/path/to/program main --json
+```
+
+Open the **original input binary** in REA, not an `.idb` or `.i64` database. Its SHA-256 must match IDA's recorded input hash. REA checks the attached identity and image base around each analysis request. A mismatch or target switch fails with recovery guidance. The original input must remain readable by REA; WSL can use its mounted alias while the GUI runs on Windows.
+
+REA's close operation releases its MCP connection or proxy. It never saves or closes the existing GUI database. External edits remain visible because results are live and are not replayed from snapshots. These checks do not lock the GUI or prove that the database is unpatched.
+
+## Give REA a target for headless analysis
+
+The headless profile supports upstream's **database supervisor** API: `idb_open`, `idb_list`, `idb_close`, explicit `database` arguments, and modern analysis tools. Legacy 1.4.0 `idalib-mcp`, which accepts one initial filename and serves SSE, does not implement this profile. Follow the [upstream headless instructions](https://github.com/mrexodia/ida-pro-mcp#headless-idalib-session-model) for an installation with the supervisor API.
+
+```json
+{
+  "command": "idalib-mcp",
+  "args": ["--stdio", "--max-workers", "1"],
+  "mode": "headless"
+}
+```
+
+Use an already-installed executable. When required by your existing idalib installation, include `"env": { "IDADIR": "/absolute/path/to/ida" }`. REA neither edits the global activation configuration nor installs dependencies. A configured local Streamable HTTP supervisor can instead use `"url": "http://127.0.0.1:8745/mcp"` and `"mode": "headless"`.
+
+The same CLI commands work in both modes. For a Windows-native REA process:
+
+```powershell
+$env:REA_IDA_MCP_CONFIG = 'D:\analysis\ida-mcp.json'
+$env:REA_ANALYSIS_PROVIDER = 'ida'
+rea function 'D:\samples\program.exe' main --json
+```
+
+Headless REA and the configured supervisor must share the host filesystem and native path syntax. Run REA on Windows when the supervisor runs on Windows. The attached profile can span WSL and a Windows GUI because it binds recorded input hashes instead of asking the GUI to open a WSL path.
+
+REA copies the admitted binary into a private temporary directory, checks its digest, and requests an owned worker with `force_headless`. POSIX workspaces use mode `0700`; Windows uses the matching package's native private-DACL boundary on a local NTFS temporary directory. It injects the returned database ID into analysis requests. It verifies the active owned worker and input path rather than adopting a user database. On close or failed startup, it releases its session with `save: false`, verifies that it is absent from upstream session discovery, and removes its private input and sidecars. An unverified release retains the workspace and reports incomplete cleanup.
+
+One REA session owns one database. Stdio registrations default `IDA_MCP_MAX_WORKERS` to `1`; the explicit upstream `--max-workers 1` also bounds a supervisor. Database size and engine memory depend on the target and upstream; REA does not impose an engine memory limit. The original binary is never executed or overwritten. Optional `workspaceRoot` selects an existing absolute temporary-directory parent on the REA host. Ensure it has space for the input copy and IDA working files.
+
+Headless cleanup uses the upstream database lifecycle. Abruptly terminating REA, its proxy, or the supervisor does not establish worker release. Prefer `close_binary` for MCP sessions; after an interrupted process, inspect upstream session inventory and retained workspace diagnostics before removing working files. This adapter does not claim Windows Job Object containment for the upstream detached workers.
+
+## Connect an agent once
+
+Add the registration path to the **REA** MCP entry's environment, keeping the upstream registration in its separate JSON file:
+
+```json
+{
+  "mcpServers": {
+    "rea": {
+      "command": "npx",
+      "args": ["-y", "rea-agents@<version-with-ida>", "mcp"],
+      "env": {
+        "REA_ANALYSIS_PROVIDER": "ida",
+        "REA_IDA_MCP_CONFIG": "/absolute/path/to/ida-mcp.json"
+      }
+    }
+  }
+}
+```
+
+Use a package version that actually includes this adapter; repository main can be ahead of the npm release. After reconnecting, call:
+
+```json
+{"name":"open_binary","arguments":{"path":"/absolute/path/to/program","provider_id":"ida"}}
+{"name":"analyze_function","arguments":{"procedure":"main"}}
+{"name":"search_strings","arguments":{"pattern":"license"}}
+{"name":"close_binary","arguments":{}}
+```
+
+Opening an MCP target starts its selected provider session; headless opening waits for auto-analysis. Set the agent's MCP request deadline long enough for the target. The registration's optional `timeoutMs` defaults to 300000 for upstream requests. Cancellation drains the current upstream request before cleanup; it does not force-stop GUI analysis. An open request that times out without a completed response retains the private workspace because worker inventory alone cannot prove the request has stopped. `binary_session` reports actual tool availability. Repeated doctor/setup calls are unnecessary when the registration already works.
+
+For guided registration, set `REA_IDA_MCP_CONFIG` before `rea setup --client <client>`. Setup includes that file reference in its reviewed plan and preserves it after approval; it does not copy upstream credentials into the agent configuration. `rea doctor --provider ida --json` validates the registration without starting IDA and explicitly leaves runtime compatibility and target binding for analysis.
+
+## Coverage and evidence
+
+Both profiles support procedure/string inventory and literal or regex search, procedure resolution, pseudocode, assembly, raw function instructions, resolved callees, incoming address references, and a function dossier. Inventories and modern pseudocode/assembly follow upstream pagination. Upstream limits on modern xrefs and callees are retained as explicit truncation limitations. A transport-level truncated preview is rejected rather than reported as complete evidence; the error preserves upstream retrieval guidance.
+
+The legacy profile additionally supports direct callers. Its producer may report call-site or interior addresses; REA resolves the reported function symbol to its canonical entry. The modern profile does not prove direct callers from its code/data xref labels, so that capability is unavailable and the dossier marks it unknown.
+
+Complete body ranges, typed reference edges, CFG, referenced data, source locals, comment kinds, and database revision are unavailable. Empty unsupported dossier facets mean **unknown**, not observed absence. `binary_overview`, whole-symbol inventory, mutation, debugging, arbitrary Python forwarding, and GUI navigation are outside this adapter's coverage. Check session availability before composing a workflow that needs those facets.
+
+`provider.version` identifies the REA adapter; the profile explicitly records `version_scope: "rea-ida-adapter"`. The MCP handshake's `serverInfo` is separate and does not establish IDA or Python distribution versions. Raw observations preserve producer metadata and output. Attached hashes identify the recorded original input; headless identity uses the digest-verified private copy and observed worker input path. Neither proves source-code recovery or an unmodified analysis database.
+
+## Verification
+
+Run `npm run verify:ida -- --target /absolute/path/to/program --procedure main` with a configured upstream server. It exercises production CLI and MCP tools, validates their output contracts and Evidence, checks original-input preservation and session cleanup, and keeps local target data out of its console summary. Supply `--package-root` to verify an extracted or installed package. See [testing](testing.md) for the distinction between adapter tests and real-provider evidence.
+
+The initial real workflows use stdio registrations for the legacy Windows GUI profile and a Windows x64 headless supervisor with IDA 9.3. Streamable HTTP is tested against a loopback MCP fixture with the pinned client SDK; a real IDA HTTP-supervisor workflow remains unverified. Linux/macOS headless engine operation, other IDA releases, architectures, and modern attached GUI tools require their corresponding real workflows before support is claimed.

docs/installation.md

@@ -61,6 +61,55 @@ curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh |
 
 Supported options are `--version <semver>`, `--dry-run`, `--no-setup`, `--no-prompt`, and `--verbose`. Neither `--no-prompt` nor a non-interactive shell grants permission to install external dependencies.
 
+## Released package and main
+
+Repository main documents its current code and generated catalog. `@latest`
+selects the npm release, and persistent MCP registrations are pinned to the
+version that performed setup. Installing newer instructions does not update a
+running server or its registration.
+
+The release checked on **2026-10-06** was **4.1.0** (125 MCP tools). That artifact
+includes main's Windows native control bundle, Android/JADX and firmware
+tools, Ghidra function annotation workflow, and retained application-Evidence
+references.
+Main's catalog describes the current code; a source build or a subsequent
+release containing later changes is required for anything newer. Package startup alone does not verify a
+provider's real platform workflow.
+
+To check the published version, run `npm view rea-agents dist-tags.latest`.
+Use the connected server's actual tool list and advertised input schemas for
+feature selection. The same package version string in a development checkout
+does not establish that its bytes match the npm tarball. Update a registration
+through a reviewed, scoped setup plan, then restart/reconnect the agent.
+
+## Skill-only installation
+
+```bash
+npx skills add morluto/rea --skill reverse-engineer-anything
+```
+
+This installs agent instructions and bundled references, not REA MCP
+registration or analysis engines. Follow the skill's
+[conditional connection guide](../skills/reverse-engineer-anything/SKILL.md#connect-only-when-needed).
+Working tools can be used immediately. If tools are missing, inspect the current
+client's registration with `doctor --client codex --json` (substitute its client
+ID), then plan repairs with `setup --client codex --dry-run --json`. Show and
+approve the exact changes before applying that scope. An aligned registration
+with tools absent from the active session needs a restart/reconnection;
+`doctor` checks files and prerequisites, not the live agent connection.
+
+Guided setup installs the package's matching skill by default. The skills.sh
+route can select newer repository instructions, so follow actual server schemas
+and the release boundary above. Static JavaScript CLI inspection can proceed
+while MCP is unavailable:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+It returns the complete Evidence record directly and requires no native engine.
+Provider failures in doctor do not prevent unrelated target-free tools.
+
 ## Supported agents
 
 Setup can configure these clients for REA's local MCP server:
@@ -277,9 +326,18 @@ macOS use a current-user-only local bridge socket and descriptor. The
 experimental Windows transport uses authenticated IPv4 loopback with a
 private native-owned bearer descriptor and Job Object process ownership.
 
-Operations begin only after default auto-analysis completes. The provider
-startup deadline fails the open rather than exposing partial analysis. One
-session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
+Operations begin only after default auto-analysis completes. `open_binary`
+selects and validates the target/provider binding; it does not wait for Ghidra
+import and auto-analysis. The first Ghidra-backed query starts that work lazily.
+The provider startup deadline is 330,000 ms for import, analysis, bridge, and
+health readiness; a startup failure is returned by the query that triggered it,
+without exposing partial analysis. This deadline is separate from MCP transport
+initialization and the client's deadline for that individual tool call. A client
+can time out earlier even when Ghidra would complete within its startup deadline.
+See [Ghidra first-query deadlines and recovery](mcp-contracts.md#ghidra-first-query-deadlines-and-recovery)
+for client options and the close/reopen recovery flow.
+
+One session contains exactly one imported Program; use `provider_id: "ghidra"`, `--provider ghidra`, or
 `REA_ANALYSIS_PROVIDER=ghidra` when both Hopper and Ghidra support the target.
 One persistent decompiler is owned by the Program, and a serial queue keeps
 Ghidra API calls on the owning Program thread without a fixed queue length.
@@ -310,9 +368,12 @@ host-native Ghidra acceptance lane.
 On a controlled Windows x64 runner, use
 `npm run verify:ghidra:windows`. The verifier generates a deterministic native
 PE fixture from source bytes and requires the Windows native authority before
-opening the provider. This lane remains blocked until those controls are
-implemented; its intended checks include operation coverage, digest identity,
-and complete runtime cleanup.
+opening the provider. The controls are implemented on main; see the
+[release boundary](#released-package-and-main). The lane verifies all 25 admitted
+read-only operations, digest identity, and runtime cleanup. The separate
+`verify:ghidra:windows:package` lane checks the packed CLI/MCP boundary with an
+ordinary user. It requires the built Windows native bundle and an existing
+Ghidra/JDK installation; neither is inferred from startup alone.
 
 ## Diagnose, update, and remove
 
@@ -337,7 +398,7 @@ For a client that requires manual configuration, use:
   "mcpServers": {
     "rea": {
       "command": "npx",
-      "args": ["-y", "rea-agents@4.0.1", "mcp"]
+      "args": ["-y", "rea-agents@4.1.0", "mcp"]
     }
   }
 }

docs/javascript-application-workflows.md

@@ -55,6 +55,16 @@ registrations/removals and dispatch, Node timers and cancellation handles, async
 defaults, request construction and response consumers, parse/coercion/
 validation boundaries, and built-in resource acquisition/release.
 
+Mutation tracking covers explicit member assignments, updates, deletion, and
+loop assignment targets, including the supported local aliases and shared
+nested references. Calls such as `Object.assign`, `Reflect.set`, and
+`Reflect.deleteProperty`, and writes reaching a caller's object through another
+function's parameter, are not tracked by this mutation pass. These channels
+can leave an initializer-derived literal in the graph even after the runtime
+value changes. Treat such a result as an uncovered mutation channel, not as
+proof of the current runtime value; a follow-up needs to model that channel
+and verify its caller/alias behavior.
+
 Function fingerprints commit normalized syntax, control-flow shape, relation
 shape, literal sets, arity, and detected effects without using local names or
 source offsets. Equal duplicate fingerprints remain ambiguous. Dynamic
@@ -139,9 +149,34 @@ available browser, Electron, or process workflows.
 
 ## CLI and verification
 
-All five CLI commands accept inline JSON or a path to a JSON file. Put the full
-Evidence records in the workflow input, as in the corresponding MCP tool; the
-CLI does not resolve Evidence IDs from a separate bundle.
+All five CLI commands accept inline JSON or a path to a JSON file. The CLI
+returns an Evidence record directly. Put the full records in a later CLI input;
+a separate CLI process has no retained MCP connection state.
+
+For a literal string trace, analyze your supplied tree once, then build the
+input from the saved Evidence (replace the target and seed):
+
+```bash
+rea analyze-javascript-application /absolute/path/to/app --json > application-evidence.json
+node --input-type=module -e '
+import { readFileSync, writeFileSync } from "node:fs";
+const application = JSON.parse(readFileSync("application-evidence.json", "utf8"));
+writeFileSync("trace-input.json", JSON.stringify({
+  application, seed: { kind: "string", value: "search-result" }, direction: "both"
+}));'
+rea trace-application-feature ./trace-input.json --json
+```
+
+MCP analysis returns an envelope containing `result`, `evidence_id`, and full
+`evidence`. If the connected server advertises retained references, reuse its
+exact returned ID as `{"kind":"retained-evidence","evidence_id":"RETURNED_ID"}`
+in `application`, or `left`/`right` for comparisons. `RETURNED_ID` is a template,
+not a literal valid ID. Native Evidence arrays still use complete records.
+References are scoped to one connection; `close_binary` clears them. Export a
+bundle before closing and import it on another connection, or supply the full
+inline Evidence there. Versions before 4.1.0 accept full inline Evidence only; installing
+newer skill instructions does not change that schema. See
+[MCP Evidence inputs](mcp-contracts.md#retained-application-evidence-inputs).
 
 For two operator-provided directories or ASARs, run:
 

docs/javascript-runtime-observation.md

@@ -18,6 +18,24 @@ rea observe-javascript-runtime http://127.0.0.1:9229 TARGET_ID \
   --runtime-kind node --json
 ```
 
+## Start a caller-owned Node target
+
+Run your selected application with Inspector bound to loopback:
+
+```bash
+node --inspect=127.0.0.1:9229 ./app.mjs
+```
+
+Keep it running while listing targets and observing the selected ID. Use a free
+port and the same literal endpoint in both REA calls. Stop the application
+through its normal lifecycle when finished; REA disconnects but does not own or
+terminate it. Node.js must already be installed.
+
+Use `--inspect` for this passive workflow. `--inspect-brk` pauses before the
+application starts, and REA never resumes it or sends
+`Runtime.runIfWaitingForDebugger`. Resume a paused target with a separate
+caller-owned debugger before requesting application runtime observations.
+
 The caller supplies the literal-loopback HTTP endpoint directly. Selecting an endpoint exposes all targets it serves and their local script locations or renderer origins. A target must match the exact requested target ID and expose a same-port WebSocket reported by that endpoint. Targets already marked attached are rejected rather than displacing another debugger. Local paths are canonicalized after symlink resolution.
 
 `list_javascript_runtime_targets` returns every available target in one inline

docs/managed-code-analysis.md

@@ -1,4 +1,4 @@
-# Managed-code analysis plan
+# Managed-code analysis and planned extensions
 
 REA inspects .NET PE/CLI artifacts without loading or executing their code.
 It can identify an assembly, inspect metadata and CIL, compare members across
@@ -27,6 +27,20 @@ This guide describes the implementation and verification of
 [ADR-0003](adr/0003-managed-code-evidence-and-provider-boundary.md). The canonical
 tool inventory is [`product-catalog.json`](product-catalog.json).
 
+## Shipped scope
+
+The canonical parser admits PE/CLI bytes and their metadata/CIL without loading
+an assembly. It reports observed implementation markers and unavailable facts;
+it does not unpack .NET single-file hosts, decode IL2CPP metadata, or infer a
+NativeAOT identity from an ordinary native PE. Inputs without admitted CLI
+metadata do not become managed assemblies through naming or routing guesses.
+Inspect separately obtained components explicitly and preserve their identities.
+
+The broader deployment classification and native-body mapping below are design
+goals from ADR-0003, not claims that every row has an implemented parser. A
+valid marker can establish a candidate native boundary, not recovered native
+semantics or runtime behavior.
+
 ## Analysis objective
 
 REA's managed-code track is intended to answer five different questions without
@@ -43,9 +57,9 @@ collapsing them:
 The ordinary workflow ends at question four. Static analysis never loads or
 executes the target.
 
-## Classification workflow
+## Planned deployment classification
 
-Classification proceeds from the outermost authenticated bytes inward:
+The intended extended classifier proceeds from outermost authenticated bytes inward:
 
 ```text
 source path
@@ -58,7 +72,7 @@ source path
   -> managed-only, native-only, composed, degraded, or unsupported route
 ```
 
-The result is a vector rather than one label. For example, a single-file modern
+The planned result is a vector rather than one label. For example, a single-file modern
 .NET deployment can contain a native host, ordinary CIL assemblies, and
 ReadyToRun components. Each component receives its own digest, classification,
 coverage, and route while retaining the outer bundle commitment.
@@ -76,6 +90,51 @@ coverage, and route while retaining the outer bundle commitment.
 | Obfuscated assembly   | Same positive byte observations as its underlying deployment form            | Meaning inferred only from names                                                          |
 | Malformed/unsupported | Exact admitted regions and failure locations                                 | Completeness, successfully skipped rows, or semantics beyond the admitted parser boundary |
 
+### NativeAOT metadata recovery
+
+NativeAOT removes the ordinary CIL method bodies, so a CIL decompiler cannot
+reconstruct those bodies as C# source. The executable remains a native target
+for Hopper or Ghidra, where decompilation produces pseudocode and analyst
+inference. This is a different route from ordinary managed member inspection.
+
+NativeAOT is not limited to Windows `.exe` files. The native image can be PE,
+ELF, or Mach-O, and NativeAOT can also publish shared libraries (PE DLL, ELF
+`.so`, or Mach-O `.dylib`) with explicitly exported entry points. Identify the
+image from its bytes and loader metadata, not its filename extension. When the
+image is inside an application bundle, inventory or extract the bundle first
+and carry the component identity into native analysis. Matching PDB, ELF debug,
+or dSYM sidecars can add symbol evidence when the selected provider supports
+them; verify their identity and keep them separate from observations made from
+the executable itself. [Microsoft's NativeAOT overview](https://learn.microsoft.com/en-us/dotnet/core/deploying/native-aot/)
+lists supported OS/architecture targets and deployment limitations, while its
+[native library guide](https://learn.microsoft.com/en-us/dotnet/core/deploying/native-aot/libraries)
+describes exported shared-library entry points.
+
+The [Ghidra NativeAOT analyzer](https://github.com/Washi1337/ghidra-nativeaot)
+is a useful optional companion for recovering ReadyToRun metadata. It
+rehydrates the `DEHYDRATED_DATA` section and annotates method tables, type
+relationships, vtable slots, frozen objects, and strings. It does not recover
+original C# method bodies. It is a separate Ghidra extension and interactive
+metadata browser; REA does not currently install or invoke it through its
+headless bridge. Its README describes ReadyToRun header discovery, including
+symbol-based and heuristic paths, so a missed header or unsupported binary
+should remain an explicit limitation rather than a failed claim about the
+binary's contents.
+
+The upstream analyzer currently gates its own analysis to x86-64. NativeAOT's
+broader platform matrix does not establish REA coverage: PE/COFF, ELF, Mach-O,
+shared libraries, target architectures, and runtime metadata versions each need
+their own provider verification. REA's experimental Windows Ghidra boundary is
+limited to admitted native x86-64 PE applications, so it does not currently
+establish coverage for PE DLLs. Mobile NativeAOT targets should remain
+experimental until REA has a matching provider and package-level verification.
+
+For REA's native analysis, preserve the same artifact path and digest used by
+`inspect_managed_artifact`, and report recovered type data as provider
+observations. Linking those types to native function addresses requires verified
+provider evidence; names or vtable similarity alone do not prove that a native
+function implements a specific managed method.
+
 ## Evidence record shape
 
 Every planned operation returns a provider result and Evidence with four
@@ -257,17 +316,20 @@ or server-side behavior.
 ## Tool and packaging boundary
 
 The production parser is REA-owned TypeScript and ships with the existing Node
-application. It is verified against the ECMA-335 format and independent pinned
-oracles but has no runtime dependency on them.
+application. Deterministic conformance uses source-owned byte-built PE/CLI
+fixtures and expected semantic facts. An optional real ILSpy lane runs only when
+its executable is explicitly supplied; the default lane does not establish
+independent pinned-oracle parity. Production inspection needs none of those tools.
 
-- `System.Reflection.Metadata` is the primary independent metadata/CIL oracle.
-- `ICSharpCode.Decompiler` and `ilspycmd` are reconstruction and differential
-  oracles. An admitted BYO reconstruction operation records its exact version
+- A pinned `System.Reflection.Metadata` differential oracle is planned; it is
+  not part of the current verifier.
+- `ICSharpCode.Decompiler`/`ilspycmd` can supply reconstruction inference.
+  A BYO reconstruction import records the supplied version
   and remains non-canonical. When `REA_ILSPY_CMD_PATH` points to an absolute
   runnable `ilspycmd`, `verify:managed` runs a source-owned real ILSpy oracle
   and imports its C# output as reconstruction inference against exact static
   member Evidence.
-- dnlib and Mono.Cecil may increase differential coverage. Their mutation APIs
+- dnlib and Mono.Cecil are potential future differential oracles. Their mutation APIs
   are not exposed or included in the production parsing boundary.
 - The package contains no .NET runtime, SDK, ILSpy installation, proprietary
   assembly, or compiled conformance fixture.
@@ -288,6 +350,11 @@ by the selected Hopper/Ghidra host and format matrix.
 
 ## Source-built conformance corpus
 
+The current lane uses source-owned byte-built fixtures and malformed-input
+regressions, with optional operator-supplied applications and ILSpy verification.
+The table below describes the desired expanded corpus; it is not a report that
+all compiler-generated forms have been independently verified.
+
 Fixture sources are intentionally small and behavior-focused. Build outputs
 are generated outside tracked fixture directories and must not remain after
 verification or packaging.

docs/mcp-contracts.md

@@ -57,6 +57,74 @@ CLI calls work without a progress token and translate SIGINT into the same
 AbortSignal used by providers. Existing controlled-process cleanup and provider
 shutdown rules still apply; REA never kills a process it cannot prove it owns.
 
+## Ghidra first-query deadlines and recovery
+
+A successful MCP initialize handshake establishes the REA connection.
+`open_binary` then selects a target and provider binding; it does not establish
+that Ghidra has finished importing the target. The first Ghidra-backed query,
+such as `binary_overview`, starts the engine and waits for import, default
+auto-analysis, bridge connection, and health readiness before returning analysis.
+
+These deadlines have different owners:
+
+| Deadline             | Owner and effect                                                                                                                                                 |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| MCP initialize       | The client bounds transport/REA connection startup, before any target query.                                                                                     |
+| Ghidra startup       | REA allows 330,000 ms for engine readiness from the first provider query; startup failure is reported by that query.                                             |
+| Individual tool call | The client bounds its wait, including cold engine startup. The pinned client SDK 2.3.1 defaults to 60,000 ms and can cancel earlier than REA's startup deadline. |
+
+For an already connected client using the pinned SDK, request options are the
+**second** argument of `callTool`:
+
+```js
+const overview = await client.callTool(
+  { name: "binary_overview", arguments: {} },
+  {
+    timeout: 240000,
+    onprogress: ({ progress, total, message }) => {
+      console.error({ progress, total, message });
+    },
+  },
+);
+```
+
+The SDK's `onprogress` option supplies a progress token and handles matching
+notifications. A raw MCP client can instead send `_meta.progressToken` in the
+request and handle `notifications/progress`. Progress reports do not establish
+engine readiness or a percentage of Ghidra auto-analysis. A longer server
+startup allowance does not extend the client's deadline; progress also does not
+extend it unless the client explicitly implements that policy.
+
+The 240-second setting is a measured example, not a universal timeout: a
+controlled Linux x64/WSL2 fixture took about 64 seconds for its first overview
+with Ghidra 12.1.4 on a mounted NTFS installation, native JDK 21, two CPUs, and a
+512 MiB Java heap. Target size, storage, and analysis work can change that time.
+Configure the deadline in the caller's existing request settings; it is not a
+tool argument, setup grant, or server-side automatic extension. CLI analysis has
+no MCP client request deadline, but keeps the provider startup deadline and
+SIGINT cancellation.
+
+If the client timed out or cancelled during startup, the pending query may have
+been interrupted. Reissuing `open_binary` for the same active target can reuse
+the current client, so it is not a fresh-start recovery. On the same connection:
+
+1. Keep any useful inline Evidence, or export a bundle before closing if retained
+   records are needed. `binary_session` can show the selected binding and its
+   recorded state; target selection alone does not prove engine readiness.
+2. Call `close_binary` and check its result. It drains owned work, closes the
+   provider, and clears retained session records. A `cleanup_incomplete` result
+   must be addressed according to its reported owned resources before retrying.
+3. Call `open_binary` with the same caller-selected path and
+   `provider_id: "ghidra"`, then retry the first query with an appropriate client
+   deadline. The connection and selected provider do not need to change.
+
+This close/reopen flow was exercised on one real Linux stdio connection after a
+controlled startup timeout, followed by a successful overview and function
+analysis. It is not a Windows/macOS coverage claim. REA cleans only resources it
+owns and never switches to another provider automatically. A provider timeout,
+installation failure, or host permission denial needs its own reported recovery;
+increasing a client deadline alone does not fix those failures.
+
 ## Tool results
 
 Evidence-producing tools return `{ result, evidence_id, evidence }` in both
@@ -68,6 +136,47 @@ directly to `compare_functions`, and `inspect_artifact` Evidence to
 `compare_artifacts`. Use `get_evidence_bundle` when the task needs broader
 retained session history or an explicit bundle for transfer.
 
+## Retained application Evidence inputs
+
+`trace_application_feature`, `trace_javascript_semantics`,
+`compare_application_versions`, `compare_source_to_bundle`, and
+`compare_javascript_export_shapes` accept complete inline application Evidence
+or an exact reference to a record already retained by the current connection:
+
+```json
+{
+  "name": "trace_application_feature",
+  "arguments": {
+    "application": {
+      "kind": "retained-evidence",
+      "evidence_id": "ev_<64 lowercase hex characters>"
+    },
+    "seed": { "kind": "module", "value": "search.js", "match": "exact" }
+  }
+}
+```
+
+Use the `evidence_id` returned by `analyze_javascript_application` (or another
+compatible application-graph producer). Comparisons accept this form in `left`
+and `right`; each side can independently be inline or retained. Native
+observation arrays continue to take complete inline Evidence. Results and their
+Evidence remain complete inline, and both input forms pass the same semantic,
+identity, authority, and provenance checks without running the producer again.
+
+References belong to the current connection's Evidence ledger. Opening another
+target preserves retained records; `close_binary` clears them, even when no
+binary is active. A fresh connection has its own ledger. A missing reference
+reports its exact ID and `details.reason: "missing"`; the server cannot infer
+whether it was never recorded, cleared, or retained by another connection.
+Supply complete inline Evidence, repeat its producer, or import an exported
+Evidence bundle before referencing that imported record. Export a bundle before
+closing if the investigation needs it later.
+
+CLI application workflows continue to read portable inline Evidence from files
+and run the same analysis workflows; a standalone CLI invocation cannot resolve
+another MCP connection's retained records. No additional lookup call, provider
+selection, or approval step is required for a same-session follow-up.
+
 ## Aggregate native context
 
 `get_navigation_context` composes the selected document, current address, and

docs/mcp-prompts.md

@@ -25,6 +25,13 @@ Tool results include their Evidence inline. Prompts do not require a bundle or
 resource fetch to read a result; an Evidence ID is only a reference when a
 prompt argument or tool explicitly accepts one.
 
+For a JavaScript/Electron application directory, `investigate_feature` points
+directly to `analyze_javascript_application` with `input_path`; it does not
+require `open_binary`. The CLI equivalent is `rea analyze <directory>`.
+`open_binary` and the doctor target check admit files and macOS app bundles.
+A directory outside that opening route is reported with an available analysis
+action; this does not establish support for every directory format.
+
 For target paths in `compare_application_versions`, the prompt suggests
 opening each target before calling `inspect_artifact`; inspection operates on
 the active target and returns the graph and findings together inline.

docs/native-investigation.md

@@ -6,6 +6,12 @@ coverage and unknowns. The CLI and MCP use the same application workflows.
 
 ## Static inspection
 
+`inspect_macho` retains otool segment `file_offset` values relative to the
+selected Mach-O slice. Its evidence file-offset ranges address the original
+input file and include the observed lipo slice offset for universal binaries.
+If that offset is unavailable, segment evidence locations are omitted with an
+explicit limitation; architecture inventory locations remain available.
+
 - `inspect_asset_catalog` / `rea inspect-asset-catalog <app>` reads compiled
   `Assets.car` metadata through macOS `assetutil --info`. Catalog digests, raw
   rendition fields, pagination and exact UI resource-name matches are returned.

docs/process-capture.md

@@ -12,14 +12,37 @@ sandbox. Filesystem observation paths select what REA snapshots; they do not
 restrict what the process can read or write. The inherited environment is not
 recorded, so its influence may remain unknown.
 
+## Host support
+
+Capturing a new scenario currently requires Linux or macOS and a working
+native PTY backend. Native Windows capture is unavailable because the PTY
+adapter does not yet verify descendant cleanup. The native Job Object controls
+used by other REA providers do not establish PTY capture support. Reinstalling
+the Windows PTY binary does not enable this workflow.
+
+For Linux commands, use Linux REA inside WSL. Adapt the scenario to that host;
+this does not establish capture of a native Windows process tree. Comparing
+existing capture Evidence through the CLI or MCP remains available on Windows
+and does not launch a PTY or the captured target.
+
+On supported capture hosts, a missing or incompatible native PTY binary has a
+different recovery: reinstall REA for the active platform, architecture, and
+Node.js version with optional dependencies enabled. Capability diagnostics
+distinguish this from the Windows capture-adapter limitation.
+
 ## Capture a command
 
 Write a JSON scenario and pass its path to the CLI:
 
 ```sh
-rea capture-process ./scenario.json > capture.json
+rea capture-process ./scenario.json --json > capture.json
 ```
 
+`--json` is required when saving input for JSON consumers; the default terminal
+format is TOON. The file contains the complete capture Evidence record.
+Choose an output file distinct from the scenario input: shell redirection opens
+and truncates the output before REA reads the scenario.
+
 For example:
 
 ```json

docs/product-catalog.json

@@ -1,16 +1,16 @@
 {
   "package": {
     "name": "rea-agents",
-    "version": "4.0.1",
+    "version": "4.1.0",
     "sdk": {
       "server": "2.3.1",
       "client": "2.3.1",
       "core": "2.3.1"
     },
-    "skill_version": "24"
+    "skill_version": "26"
   },
   "tools": {
-    "total": 118,
+    "total": 126,
     "families": [
       {
         "id": "direct",
@@ -121,6 +121,24 @@
           "verify_managed_native_boundaries"
         ]
       },
+      {
+        "id": "firmware",
+        "surface": "firmware-provider",
+        "count": 2,
+        "tools": ["extract_firmware", "inspect_firmware_regions"]
+      },
+      {
+        "id": "android",
+        "surface": "android-provider",
+        "count": 5,
+        "tools": [
+          "inspect_android_class",
+          "inspect_android_method",
+          "inspect_android_package",
+          "search_android_classes",
+          "trace_android_references"
+        ]
+      },
       {
         "id": "browser",
         "surface": "browser-provider",
@@ -161,13 +179,14 @@
       {
         "id": "application",
         "surface": "application-workflow",
-        "count": 7,
+        "count": 8,
         "tools": [
           "build_reconstruction_obligation_ledger",
           "compare_application_versions",
           "compare_javascript_export_shapes",
           "compare_source_to_bundle",
           "evaluate_reconstruction_coverage",
+          "export_web_scripts",
           "trace_application_feature",
           "trace_javascript_semantics"
         ]
@@ -203,6 +222,12 @@
     ]
   },
   "providers": [
+    {
+      "id": "binwalk",
+      "name": "Binwalk",
+      "version": "3.1.0",
+      "capabilities": ["inspect_firmware_regions"]
+    },
     {
       "id": "ghidra",
       "name": "Ghidra",
@@ -280,6 +305,37 @@
         "xrefs"
       ]
     },
+    {
+      "id": "ida",
+      "name": "IDA Pro MCP adapter",
+      "version": "1",
+      "capabilities": [
+        "analyze_function",
+        "list_procedures",
+        "list_strings",
+        "procedure_address",
+        "procedure_assembly",
+        "procedure_callees",
+        "procedure_callers",
+        "procedure_pseudo_code",
+        "read_function_instructions",
+        "search_procedures",
+        "search_strings",
+        "xrefs"
+      ]
+    },
+    {
+      "id": "jadx",
+      "name": "JADX headless",
+      "version": "0.7.1",
+      "capabilities": [
+        "inspect_android_class",
+        "inspect_android_method",
+        "inspect_android_package",
+        "search_android_classes",
+        "trace_android_references"
+      ]
+    },
     {
       "id": "native-macos",
       "name": "macOS native inspection utilities",
@@ -394,6 +450,18 @@
         "list_javascript_runtime_targets",
         "observe_javascript_runtime"
       ]
+    },
+    {
+      "id": "rea-web-script-export",
+      "name": "REA captured script export",
+      "version": "1",
+      "capabilities": ["export_web_scripts"]
+    },
+    {
+      "id": "unblob",
+      "name": "Unblob",
+      "version": "26.6.4",
+      "capabilities": ["extract_firmware"]
     }
   ],
   "setup_clients": [
@@ -471,7 +539,7 @@
     }
   ],
   "cli": {
-    "primary_count": 73,
+    "primary_count": 81,
     "commands": [
       "address-to-file-offset",
       "analyze",
@@ -501,14 +569,20 @@
       "evaluate-reconstruction-coverage",
       "evidence-export",
       "evidence-import",
+      "export-web-scripts",
       "extract-artifact",
+      "extract-firmware",
       "function",
       "import-managed-reconstruction",
       "import-reference-source",
       "inspect",
+      "inspect-android-class",
+      "inspect-android-method",
+      "inspect-android-package",
       "inspect-artifact",
       "inspect-asset-catalog",
       "inspect-electron-page",
+      "inspect-firmware-regions",
       "inspect-keyed-archive",
       "inspect-macho",
       "inspect-managed-artifact",
@@ -536,8 +610,10 @@
       "reconcile-javascript-runtime",
       "resolve-native-call-targets",
       "search",
+      "search-android-classes",
       "setup",
       "trace",
+      "trace-android-references",
       "trace-application-feature",
       "trace-javascript-semantics",
       "trace-native-ui-action",
@@ -556,15 +632,15 @@
   },
   "runtime_catalog": {
     "counts": {
-      "cli_commands": 73,
-      "mcp_tools": 118,
+      "cli_commands": 81,
+      "mcp_tools": 126,
       "mcp_prompts": 6
     },
     "digests": {
-      "tools_sha256": "bbd9aacf7bb0bc54a8f8743491583482e1176252513d99780a309d0fddeb3df0",
-      "prompts_sha256": "4762db348821fec787a5b8c6423f2c48a71f6f0ec2afee97b16ad69030ec504b",
-      "combined_sha256": "b4f7e5860d90b029876b58fe7cd4a8041fef1f2add23440e37e90827d808e503",
-      "providers_sha256": "e094c361b60ec930a6062a1a90ee05536ce411541dba5b51ace7e2da2ba25af0"
+      "tools_sha256": "569db1182f19869a3bdb22cf217bc75526f317b59635c8866d0e62741077cd52",
+      "prompts_sha256": "ef2de8814390b340623c32001610aa2709d90bed51537b6e562ab3abf144ab4d",
+      "combined_sha256": "e21455dd7d64af94e0b07aff55ab82f03a37e46729ece51be38b50083d2d5b55",
+      "providers_sha256": "7949ddcf2eb5ba41b022bb3dfa1951ab96dbf5640285fa7fd5d35b0e4a5bdab3"
     }
   }
 }

docs/provider-evaluation.md

@@ -1,5 +1,7 @@
 # Static-analysis provider evaluation
 
+This guide describes repository main. Check the [released package boundary](installation.md#released-package-and-main) when using npm.
+
 Ghidra read-only analysis is available on Linux x64 and macOS x64/arm64.
 Install Ghidra 12.1.4 and a full 64-bit JDK 21 separately, then configure REA to
 use them. macOS installations need the matching native decompiler.
@@ -55,8 +57,9 @@ follow.
 optional `JAVA_HOME` must identify a 64-bit full JDK 21, otherwise doctor probes
 `java`/`javac` or `java.exe`/`javac.exe` from `PATH`. Supported Linux and macOS
 hosts accept compatible ELF, PE, and Mach-O executable targets. Host admission
-and target compatibility are separate checks. The intended Windows P0 accepts
-only native x86-64 PE applications; it remains blocked before launch.
+and target compatibility are separate checks. Windows x64 P0 admits only native,
+non-managed, non-DLL x86-64 PE applications on fixed local NTFS, with the packaged
+native authority available before launch.
 
 The launcher creates one ephemeral runtime root with project,
 home/cache/config/data/temp, logs, descriptor, endpoint, target snapshot, and
@@ -67,18 +70,21 @@ On Linux, the mode-0600 descriptor carries the random token without
 exposing it in argv or environment and the Java bridge binds a mode-restricted
 Unix socket. macOS uses the same local transport. The bridge reports actual
 Ghidra/language/compiler/analysis/import-digest metadata and accepts only
-authenticated `ping`, `shutdown`, ten inventory methods, and twelve
-function-analysis methods. Close, cancellation, timeout, malformed protocol,
+authenticated `ping`, `shutdown`, thirteen read-only inventory/load-image methods,
+and twelve function-analysis methods. Linux/macOS also admits atomic function
+annotation changes in the ephemeral database. Close, cancellation, timeout, malformed protocol,
 or process exit stops the owned process resources, closes the socket, and
 removes the runtime root.
 
 The experimental Windows transport uses authenticated IPv4 loopback with a
-token-free endpoint record, but cannot start while the native authority is
-unavailable. Its `taskkill` cleanup code does not establish Job Object ownership,
-private DACLs, or reparse-safe paths.
+token-free endpoint record. The bundled native authority establishes Job Object
+ownership, protected runtime DACLs, and handle-based path admission before
+launch. If the bundle or an admission constraint is unavailable, the provider
+remains unavailable; a `taskkill` fallback does not establish that authority.
 
-The provider catalog lists the 25 Ghidra operations. GUI cursor,
-navigation, and mutation operations remain absent; the router therefore
+The provider catalog lists 25 read-only Ghidra operations and the Linux/macOS
+session annotation operation. GUI cursor/navigation and persistent mutations
+remain unavailable; Windows P0 admits no database mutation. The router therefore
 reports them unavailable instead of borrowing Hopper semantics or inferring
 capability from a successful import.
 
@@ -144,8 +150,8 @@ request cancellation and lifecycle-deadline cleanup, bounded stdout and stderr r
 exact byte counts, process-exit diagnostics, and bounded TERM-to-KILL shutdown.
 Reusable fixtures exercise exit, timeout, cancellation, graceful termination,
 forced termination, double-close, spawn failure, and resource release. Windows
-process-tree termination code exists, but the missing Job Object and private
-runtime controls prevent it from establishing an available Ghidra session.
+Ghidra uses its native Job Object, private runtime, and path-admission boundary;
+generic process-tree termination alone cannot establish provider availability.
 
 The foundation does not define a bridge schema, socket framing, health payload,
 analysis model, or shutdown acknowledgement. Hopper keeps its authenticated

docs/testing.md

@@ -47,7 +47,7 @@ The process-global Vitest configuration contract rejects new direct temporary-ro
 creation outside the workspace seam and its narrowly documented boundary/package
 exceptions.
 
-Real Hopper, Ghidra, browser, package, and managed-code claims belong to their
+Real Hopper, Ghidra, IDA, browser, package, and managed-code claims belong to their
 explicit `npm run verify:*` lanes. The reconstruction-readiness lane also
 checks deterministic rerun, tamper, and stale-input handling; those checks do
 not execute extracted JavaScript modules. When application runtime behavior is
@@ -85,6 +85,27 @@ regressions until a real fixture establishes equivalent coverage.
 decoding. Its SDK client explicitly permits the larger inline JSON response;
 this lane does not establish large image-comparison request transport coverage.
 
+`verify:browser:network` is a focused real-browser lane for transaction identity,
+selected request/response bytes, binary and compressed responses, duplicate
+headers, credential and declared-secret redaction, redirects, streaming cutoff,
+CLI/MCP parity, and owned-profile cleanup. Set `REA_BROWSER_EXECUTABLE` to an
+installed Chrome-family browser. An optional script argument selects an already
+installed package's `scripts/rea.mjs` entry point for packaged-artifact checks.
+The complete `verify:browser` lane includes these same checks.
+
+After building, `verify:browser:dom` checks empty and HTML-whitespace form
+destinations against a native Chrome DOM-property oracle through CLI and stdio
+MCP. It requires `REA_BROWSER_EXECUTABLE` and accepts an optional installed REA
+entrypoint. The full browser lane includes the same public-adapter assertions
+before other fixtures navigate the selected page.
+
+`verify:browser:scripts` checks active script capture → exact-byte export →
+existing static JavaScript analysis through CLI and stdio MCP, including
+manifest readback, competing query variants, and resolved relative imports.
+It uses an installed browser and accepts an optional installed REA entrypoint.
+The complete `verify:browser` lane also exercises passive script export through
+both public adapters. See [website script export](website-script-export.md).
+
 The [test suite audit](test-suite-audit.md) records the pruning decisions,
 replacement evidence and remaining priorities.
 
@@ -148,6 +169,84 @@ the CLI and stdio MCP, including special filenames, unresolved discovery
 locations, and independently resolved loaded scripts. Double-quote filenames
 are tested on POSIX only because Windows does not support them.
 
+## Android APK analysis
+
+`npm run verify:android` requires an existing Java 17+ and an explicit
+`REA_JADX_MCP_JAR` for jadx-headless-mcp 0.7.1. Set `REA_ANDROID_TEST_APK` to the
+fixed public ApiDemos v6.0.18 fixture. Obtain both with the explicit
+`npm run fixtures:android` command; files are SHA-256 verified and
+kept under ignored `_reference/`. No Gradle build, Android SDK, emulator or
+application execution is required. The lane compares real CLI/MCP package,
+class search, class inventory, method decompilation and incoming references.
+See [Android analysis](android-analysis.md) for boundaries and resource budgets.
+
+Synthetic producer regressions run independently:
+
+```sh
+npm run test:focused -- tests/boundary/android/jadxIntegration.test.ts tests/boundary/mcp/androidAnalysisMcp.test.ts
+```
+
+## Optional NativeAOT Ghidra analysis
+
+This lane is separate from the default native lane. `build:fixtures:nativeaot`
+requires an existing .NET SDK 8.0.416, the platform NativeAOT compiler/linker and
+runtime pack 8.0.22. It builds benign sources into ignored `_reference/` and
+records independent symbol/directory/SHA oracles; it never executes the target.
+Linux also builds stripped, ordinary-native and small malformed/ambiguous/layout
+negative inputs. The optional Windows fixture workflow builds a PE on a Windows
+runner; analyzing that PE on Linux does not verify a Windows Ghidra host.
+
+Build the clean pinned upstream adapter with `build:ghidra:nativeaot`, then set
+`REA_GHIDRA_NATIVEAOT_JAR`. Run `verify:ghidra:nativeaot -- symbols`, `-- stripped`,
+`-- ordinary`, `-- unsupported`, `-- malformed`, `-- ambiguous`, and
+`-- loader-failure`, and `-- default-native` separately. The loader-failure mode source-builds
+a deliberately failing JDK 21 initializer and checks the actual loader cause and
+cleanup. The default-native mode verifies ordinary analysis with the optional
+extension disabled.
+The real MCP lane checks source identity, inline format discovery, metadata
+relationships/slots against independent compiler symbols, frozen strings,
+pseudocode and owned cleanup. Set `REA_NATIVEAOT_PROOF_CLI=1` for one equivalent
+CLI type inspection; this costs an additional full import. Select an unpacked
+installed package with `REA_NATIVEAOT_PROOF_PACKAGE_ROOT`, a fixture directory
+with `REA_NATIVEAOT_PROOF_FIXTURE_ROOT`, and optional evidence capture directory
+with `REA_NATIVEAOT_PROOF_CAPTURE_DIR` (absolute paths).
+
+Keep builds/imports sequential on small hosts; scope `GHIDRA_HEADLESS_MAXMEM`
+(e.g. `768M`) to this command and use CPU affinity if needed. REA does not install
+or upgrade Java, Ghidra, .NET or native toolchains. See
+[the supported layout and provenance](ghidra-nativeaot.md).
+
+## IDA MCP adapter
+
+`npm run verify:ida -- --target /absolute/path/to/program --procedure main`
+uses the existing `REA_IDA_MCP_CONFIG` registration. It installs no engine,
+Python package, or compiler. The target must already be open in the GUI for
+the legacy attached profile; the database-supervisor headless profile opens
+a digest-verified private copy. A caller-supplied fixture keeps prerequisites
+limited to the selected engine and host. `tests/conformance/ida/inventory.c`
+provides an optional small native fixture source with an exported
+`rea_fixture_add` function.
+
+The lane invokes the production CLI dispatcher and connects the pinned MCP
+client SDK to the production REA server. It verifies function Evidence and
+CLI/MCP parity, inventory/search, pseudocode, instructions, xrefs, malformed
+input, original-input preservation, and lifecycle cleanup. For headless
+analysis it confirms that the owned database IDs disappear from upstream
+discovery and private workspaces are removed. For attached analysis it confirms
+the existing GUI target remains reachable with the same input identity.
+`--package-root` selects an installed/extracted REA artifact. `--report` writes
+private local observations with mode `0600`; the console summary contains no
+target paths or upstream output.
+
+Adapter and composition tests cover producer parsing, pagination, canonical
+entries, external callees, target switches, cancellation draining, snapshot
+replay exclusion, ownership failures, and incomplete cleanup. They do not
+establish real IDA operation. The initial real workflows cover legacy upstream
+1.4.0 on a Windows GUI and the modern supervisor at upstream commit
+`c133c3853faa111a9b00ee615c013b720d0c4acd` with Windows x64 IDA 9.3.
+Linux/macOS headless, modern attached GUI tools, other engine versions and
+architectures remain unverified; see the [provider guide](ida-provider.md).
+
 ## DOS Ghidra analysis
 
 `npm run verify:ghidra:dos` requires the supported Ghidra and JDK installation
@@ -294,3 +393,15 @@ allows a host-permission-boundary-only result and explicitly reports
 Both commands reject a changed executable digest and clean up the fixture
 process and helper. These lanes require an interactive macOS desktop. See [native investigation](native-investigation.md)
 for the exact ABI, authority, graph and observation boundaries.
+
+### Firmware adapters
+
+`npm run fixtures:firmware` uses existing Python 3 and a host C compiler to make
+an ignored gzip/USTAR firmware fixture and independent offset/hash oracle.
+`npm run verify:firmware` requires caller-supplied Binwalk 3.1.0, Unblob 26.6.4
+and util-linux prlimit on Linux. It verifies CLI/MCP parity, selected ranges,
+unknown chunks, depth limits and extracted child digests. The optional
+`REA_FIRMWARE_VERIFY_EXT4=1` lane requires existing mke2fs/debugfs; the separate
+`REA_FIRMWARE_VERIFY_GHIDRA=1` lane checks a selected host ELF through real Ghidra.
+Neither optional toolchain is a base-lane prerequisite. See
+[firmware analysis](firmware-analysis.md) for limits and unverified formats.

docs/user-visible-errors.csv

@@ -7,7 +7,7 @@ harm_rank,location,trigger,current_copy,user_risk,proposed_replacement,implement
 6,src/domain/errors.ts:AnalysisProtocolError,Application protocol fails,Raw constructor message,Can expose protocol internals,"Analysis returned an unreadable result. Retry once; if it continues, run `rea doctor`.",implemented,focused assertions passed; full `npm run check` passed
 7,src/domain/errors.ts:HopperProcessError,Analysis subprocess stops,"Hopper bridge stopped unexpectedly with code {exitCode}",Exposes provider bridge and process code,"Analysis could not start or stopped unexpectedly. Run `rea doctor`, then try again.",implemented,focused assertions passed; full `npm run check` passed
 8,src/domain/errors.ts:HopperStartError,Analysis subprocess cannot start,Hopper application bridge could not be started,Exposes provider and bridge implementation,"Analysis could not start or stopped unexpectedly. Run `rea doctor`, then try again.",implemented,focused assertions passed; full `npm run check` passed
-9,src/domain/errors.ts:BinaryTargetError,Target cannot open,"Cannot open artifact: {reason}",May expose raw reason and lacks checks,"REA could not open that app or binary. Check that the path exists, is readable, and points to a supported file.",implemented,focused assertions passed; full `npm run check` passed
+9,src/domain/errors.ts:BinaryTargetError,Target cannot open,"Cannot open artifact: {reason}",May expose raw reason and lacks checks,"Preserve the target admission reason; directories name analyze_javascript_application and rea analyze as available alternatives.",implemented,focused assertions passed; full `npm run check` passed
 10,src/domain/errors.ts:ConfigurationError,Environment configuration invalid,Raw constructor message,May expose provider-specific variables and lacks recovery,"REA configuration is invalid. Run `rea doctor` and fix the reported setting.",implemented,focused assertions passed; full `npm run check` passed
 11,src/domain/errors.ts:ArtifactOperationError,Artifact inventory or extraction fails,"Artifact {operation} failed: {reason} at {logicalPath} (declared_sha256=...)",Exposes paths hashes and internal reason,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed
 12,src/domain/errors.ts:EvidenceFileError,Evidence file operation fails,"Evidence bundle {operation} failed: {reason}",Internal reason token gives weak recovery,"Reason-specific plain message with safe recovery step.",implemented,focused assertions passed; full `npm run check` passed

docs/verification/managed-conformance-manifest.json

@@ -1,5 +1,5 @@
 {
-  "manifest_id": "ecm_125743de92b0cbb08a3cb11ee0d9305f60e5c4fb81152b8b748d348f91f99ee8",
+  "manifest_id": "ecm_d68a1575bdaa1a044ccce8e27c5dd335612f909bc81c52ce3089b576fd772940",
   "verifier": {
     "id": "rea-managed-conformance",
     "version": "1"
@@ -13,7 +13,7 @@
   "skill_digests": [
     {
       "skill_id": "reverse-engineer-anything",
-      "sha256": "26338313efd5c941e1f3e1f1d35e2605d47749f674c359458e76d5a470b0cbb1"
+      "sha256": "d2d971cc67bb0f7b80b4e39382a6bd1146445ed1dbf52043f89e2da2985c97ba"
     }
   ],
   "claims": [

docs/website-script-export.md

@@ -0,0 +1,86 @@
+# Captured website scripts and static JavaScript analysis
+
+`export_web_scripts` bridges retained browser sources into the existing local
+JavaScript analyzer. Both CLI and MCP use the same workflow. It reads a saved
+`inspect_web_page` or `capture_browser_scenario` capture and writes scripts plus a
+verified manifest into one caller-selected, absent directory.
+
+## Capture and export
+
+For passive inspection, select `include_script_sources: true` (CLI:
+`--include-script-sources`). For scenarios, select
+`capture.network.response_body: true`. Save either the complete Evidence record
+or its normalized result as UTF-8 JSON. The compact MCP wrapper's `evidence`
+field contains the complete Evidence record.
+
+```sh
+rea export-web-scripts /analysis/capture.json /analysis/exported-scripts --json
+rea analyze-javascript-application /analysis/exported-scripts/files --json
+```
+
+MCP uses `export_web_scripts` with `capture_path` and `output_directory` absolute
+filesystem paths. Its inline result includes `analysis_input`, which can be
+passed directly to `analyze_javascript_application`. When no script bytes are
+exportable, `analysis_input` is null and the manifest retains the unavailable
+sources and their reasons. Capture again with the corresponding content option.
+
+The destination must not exist. Use a new directory for each capture; an
+existing directory or symlink is rejected without overwriting its contents.
+REA creates private output, verifies every written file by digest and durable
+readback, and removes its own partial output on failure or cancellation.
+A failed rollback reports residual paths.
+
+## Sources and mappings
+
+Every source is returned inline with its URL and its script/frame identity or
+request transaction and event sequence references. The result also contains
+the input capture's byte digest, original coverage, source Evidence link when
+provided, and the persisted manifest's digest and byte count. A saved Evidence
+envelope must have a valid semantic identifier and matching operation.
+
+Exported `relative_path` values are relative to `analysis_input.input_path`.
+The persisted `manifest.json` contains the same inline manifest fields, excluding
+its own descriptor. It does not duplicate script bytes.
+
+- Passive sources are the Debugger-exposed text encoded as UTF-8, with the
+  verified source digest and source-map declaration retained. Unavailable or
+  explicitly non-JavaScript sources remain unavailable.
+- Scenario sources use observed requests classified as `script`, matched to
+  completed response bytes by transaction and event identity. URLs never select
+  the response. Binary and empty retained bytes are written exactly.
+- Ordinary query-free `.js`, `.mjs`, and `.cjs` URL paths are arranged under a
+  directory for each origin, preserving their relative module layout when it
+  is unambiguous.
+- Competing versions, query/fragment variants, case and file/directory prefix
+  collisions, inline sources, and unrepresentable paths use unique isolated
+  names with a stated reason. Missing competing sources also prevent selection
+  of an apparently canonical version.
+
+## Interpretation and limits
+
+Export does not fetch URLs or execute JavaScript. Retained Debugger sources and
+response bytes do not establish execution or a complete website. Response bytes
+are browser-decoded bytes; they do not represent transfer encoding. Declared
+redaction is preserved and can change JavaScript syntax; passive captures do
+not report a byte-redaction flag, so that value remains unknown.
+
+The existing analyzer inventories and parses the actual exported files. It can
+resolve ordinary captured relative modules, but does not implement browser
+import maps, root-relative URL loading, remote imports, or runtime behavior.
+Its local resolver may strip import queries/fragments; isolated variants are
+kept away from canonical paths to prevent those from selecting a different
+observed version. Missing dependencies remain unknown. Source maps are not
+fetched or reconstructed during export.
+
+The export Evidence describes a derivation from the saved capture. Subsequent
+application-analysis Evidence describes the local exported artifact. Their
+identities and authorities remain separate.
+
+## Verification
+
+`npm run verify:browser:scripts` exercises active capture, exact source export,
+manifest readback, query variants, and relative-module analysis through a real
+browser, CLI, and stdio MCP. Set `REA_BROWSER_EXECUTABLE` to an installed
+Chrome-family browser. The verifier accepts an optional installed REA entrypoint
+argument for package verification. `npm run verify:browser` additionally covers
+passive `inspect_web_page` export through both public adapters.

docs/windows-ghidra-p0.md

@@ -1,7 +1,11 @@
 # Windows Ghidra P0
 
-Status: experimental Windows x64 support for the read-only P0 boundary. The
-published package bundles native process, filesystem, and DACL controls. REA
+This guide describes repository main. npm 4.1.0 includes the Windows
+native bundle; check the [release boundary](installation.md#released-package-and-main)
+before applying these instructions to an older published package.
+
+Status: experimental Windows x64 support for the read-only P0 boundary. Windows
+package builds bundle native process, filesystem, and DACL controls. REA
 uses them automatically when the analyst selects a Ghidra operation; no
 additional permission flag or degraded mode is required.
 
@@ -28,6 +32,10 @@ REA does not install or upgrade Ghidra, Java, Python, npm, Node.js, Hopper, or a
 compiler. The adapter uses the packaged Java `HeadlessScript`; Python and
 PyGhidra are not prerequisites. Users do not build the native addon.
 
+REA selects its packaged bridge scripts by explicit path. Same-named files or
+directories in the caller's working directory do not select a different
+script or require users to clean that directory before analysis.
+
 ## Configuration
 
 ```powershell

native/windows/README.md

@@ -66,6 +66,11 @@ Windows failures retain their constraint, requested coordinate, Win32 code,
 and system message. Unsupported filesystems and reparse paths are distinct
 from OS access denial and missing packaged controls.
 
+Ordinary drive-absolute paths accept backslashes, forward slashes, or mixed
+separators. File identity retains the original requested spelling. Separator
+translation does not resolve dot components, repeated separators, or extend
+the supported device/UNC namespaces; existing admission checks still apply.
+
 The bearer-token descriptor remains under its immutable private lease until
 `runtime_close` on Windows; POSIX removes the descriptor after the bridge reads
 it. Job ownership guarantees process termination on owner death, not deletion

native/windows/src/authority.hpp

@@ -19,6 +19,16 @@
 
 namespace rea {
 
+// Translate ordinary DOS drive separators without resolving components or
+// changing extended, device, UNC, relative, or drive-relative namespaces.
+inline std::wstring ordinaryDriveSeparators(std::wstring path) {
+  if (path.size() >= 3 && path[1] == L':' &&
+      ((path[0] >= L'A' && path[0] <= L'Z') || (path[0] >= L'a' && path[0] <= L'z')) &&
+      (path[2] == L'\\' || path[2] == L'/'))
+    std::replace(path.begin(), path.end(), L'/', L'\\');
+  return path;
+}
+
 struct Failure : std::runtime_error {
   DWORD win32;
   std::wstring path;

native/windows/src/filesystem.cc

@@ -14,6 +14,7 @@ static std::wstring hex(const unsigned char* bytes, size_t count) {
 }
 
 static std::wstring localPath(std::wstring path) {
+  path = ordinaryDriveSeparators(std::move(path));
   if (path.rfind(L"\\\\?\\", 0) == 0) path.erase(0, 4);
   require(path.size() >= 3 && path[1] == L':' && path[2] == L'\\' &&
           ((path[0] >= L'A' && path[0] <= L'Z') || (path[0] >= L'a' && path[0] <= L'z')),

native/windows/src/process.cc

@@ -44,7 +44,8 @@ static void pipe(Handle& read, Handle& write) {
 
 std::unique_ptr<Process> spawnProcess(const std::wstring& command, const std::wstring& commandLine,
                                     const std::wstring& cwd, const std::vector<std::wstring>& environment) {
-  require(command.size() >= 3 && command[1] == L':' && command[2] == L'\\',
+  const auto executable = ordinaryDriveSeparators(command);
+  require(executable.size() >= 3 && executable[1] == L':' && executable[2] == L'\\',
           "Owned Windows process requires an absolute executable path", command, ERROR_INVALID_PARAMETER);
   auto result = std::make_unique<Process>();
   result->job = createJob();
@@ -102,7 +103,7 @@ std::unique_ptr<Process> spawnProcess(const std::wstring& command, const std::ws
   if (uniqueEnvironment.empty()) variables.push_back(L'\0');
   std::vector<wchar_t> line(commandLine.begin(), commandLine.end()); line.push_back(L'\0');
   PROCESS_INFORMATION process{};
-  require(CreateProcessW(command.c_str(), line.data(), nullptr, nullptr, TRUE,
+  require(CreateProcessW(executable.c_str(), line.data(), nullptr, nullptr, TRUE,
                          CREATE_UNICODE_ENVIRONMENT | EXTENDED_STARTUPINFO_PRESENT | CREATE_SUSPENDED | CREATE_NO_WINDOW,
                          variables.data(), cwd.empty() ? nullptr : cwd.c_str(), &startup.StartupInfo, &process),
           "Create process atomically inside owned Job Object failed", command);

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "rea-agents",
-  "version": "4.0.1",
+  "version": "4.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "rea-agents",
-      "version": "4.0.1",
+      "version": "4.1.0",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "8.0.4",
@@ -2659,9 +2659,9 @@
       }
     },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.9.10",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.10.tgz",
-      "integrity": "sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==",
+      "version": "0.9.12",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz",
+      "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==",
       "license": "MIT",
       "engines": {
         "node": ">=14.6"
@@ -2846,15 +2846,15 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/buffer": {

package.json

@@ -1,7 +1,7 @@
 {
   "name": "rea-agents",
   "mcpName": "io.github.morluto/rea",
-  "version": "4.0.1",
+  "version": "4.1.0",
   "description": "Reverse engineer anything from your terminal or agent with one CLI and MCP server.",
   "license": "MIT",
   "repository": {
@@ -44,6 +44,7 @@
     "bridge/hopper_bridge.py",
     "bridge/native/ReaNativeUI.swift",
     "bridge/ghidra/ReaGhidraBridge.java",
+    "bridge/ghidra/ReaGhidraExtensions.java",
     "bridge/ghidra/ReaGhidraPrepareCom.java",
     "scripts/rea.mjs",
     "scripts/electron-active-hook.cjs",
@@ -122,6 +123,7 @@
     "verify:native-ui": "npm run build:cached && node scripts/verify-native-ui.mjs",
     "verify:keyed-archive": "npm run build:cached && node scripts/verify-keyed-archive.mjs",
     "verify:ghidra": "npm run build:cached && node scripts/verify-real-ghidra.mjs",
+    "verify:ida": "npm run build:cached && node scripts/verify-real-ida.mjs",
     "verify:ghidra:switch": "npm run build:cached && node scripts/verify-real-ghidra-switch.mjs",
     "verify:ghidra:dos": "npm run build:cached && node scripts/verify-real-ghidra-dos.mjs",
     "verify:ghidra:com": "npm run build:cached && node scripts/verify-real-ghidra-com.mjs",
@@ -130,12 +132,18 @@
     "verify:ghidra:cross-format": "npm run build:cached && node scripts/verify-real-ghidra.mjs --cross-format",
     "verify:ghidra:windows": "npm run build:cached && npm run build:ghidra-windows-fixture && node scripts/verify-real-ghidra-windows.mjs",
     "verify:browser": "npm run build:cached && node scripts/verify-real-browser.mjs",
+    "verify:browser:dom": "node scripts/verify-browser-dom-destinations.mjs",
+    "verify:browser:network": "npm run build:cached && node scripts/verify-browser-network.mjs",
     "verify:electron": "npm run build:cached && node scripts/verify-real-electron.mjs",
     "verify:inspector": "npm run build:cached && node scripts/verify-real-javascript-runtime-observation.mjs",
     "verify:javascript-runtime": "npm run build:cached && node scripts/verify-local-javascript-runtime.mjs",
     "verify:javascript:digests": "npm run build:cached && node scripts/verify-large-javascript-digests.mjs",
     "verify:application-workflows": "npm run build:cached && node scripts/verify-local-application-workflows.mjs",
     "verify:managed": "npm run build:cached && node scripts/verify-managed-conformance.mjs",
+    "verify:firmware": "npm run build:cached && node scripts/verify-real-firmware.mjs",
+    "fixtures:firmware": "node scripts/generate-firmware-fixtures.mjs",
+    "verify:android": "npm run build:cached && node scripts/verify-real-android.mjs",
+    "fixtures:android": "node scripts/fetch-android-fixtures.mjs",
     "verify:agent": "npm run build:cached && node scripts/verify-agent-experience.mjs",
     "verify:hopper:linux": "npm run verify:fixtures && npm run build:cached && node scripts/verify-real-hopper-linux.mjs",
     "verify:setup:linux": "npm run build:cached && node scripts/verify-linux-setup-e2e.mjs",
@@ -164,7 +172,12 @@
     "verify:windows-native:artifact": "node scripts/verify-windows-native-artifact.mjs",
     "prepublishOnly": "npm run verify:windows-native:artifact",
     "verify:windows-native": "node scripts/verify-windows-native.mjs",
-    "verify:ghidra:windows:package": "node scripts/verify-packaged-ghidra-windows.mjs"
+    "verify:ghidra:windows:package": "node scripts/verify-packaged-ghidra-windows.mjs",
+    "build:ghidra:nativeaot": "node scripts/build-ghidra-nativeaot.mjs",
+    "build:fixtures:nativeaot": "node scripts/generate-nativeaot-fixtures.mjs",
+    "verify:ghidra:nativeaot": "npm run build:cached && node scripts/verify-real-ghidra-nativeaot.mjs",
+    "verify:browser:scripts": "npm run build:cached && node scripts/verify-browser-scripts.mjs",
+    "verify:test-discovery": "node scripts/verify-test-discovery.mjs"
   },
   "lint-staged": {
     "*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}": [

scripts/build-ghidra-nativeaot.mjs

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const source = resolve(
+  process.env.REA_NATIVEAOT_SOURCE ??
+    join(root, "third_party/ghidra-nativeaot"),
+);
+const install = process.env.GHIDRA_INSTALL_DIR;
+if (!install)
+  throw new Error(
+    "NativeAOT build lane requires existing GHIDRA_INSTALL_DIR (Ghidra 12.1.4).",
+  );
+const properties = await readFile(
+  join(install, "Ghidra/application.properties"),
+  "utf8",
+);
+if (!/^application.version=12\.1\.4\s*$/m.test(properties))
+  throw new Error("NativeAOT build lane requires Ghidra 12.1.4.");
+const output = resolve(
+  process.env.REA_NATIVEAOT_BUILD_ROOT ??
+    join(root, "_reference/nativeaot-integration/extension"),
+);
+const java = process.env.JAVA_HOME ? join(process.env.JAVA_HOME, "bin") : null;
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    encoding: "utf8",
+    timeout: 120_000,
+    maxBuffer: 4 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `NativeAOT build prerequisite/action ${command} failed: ${result.error?.message ?? ""}\n${result.stdout ?? ""}${result.stderr ?? ""}`,
+    );
+  return result.stdout.trim();
+};
+const javac = java ? join(java, "javac") : "javac";
+if (!/^javac 21(?:\.|$)/u.test(run(javac, ["-version"])))
+  throw new Error(
+    "NativeAOT build lane requires an existing JDK 21 javac; REA does not install or upgrade Java.",
+  );
+const revision = run("git", ["-C", source, "rev-parse", "HEAD"]);
+if (
+  revision !== "effeb734fc570c32650f88b159608979dc7b423e" ||
+  run("git", ["-C", source, "status", "--porcelain"])
+)
+  throw new Error(
+    "NativeAOT build requires the clean pinned upstream source; initialize third_party/ghidra-nativeaot.",
+  );
+const files = async (path, extension) => {
+  const result = [];
+  for (const entry of await readdir(path, { withFileTypes: true })) {
+    const child = join(path, entry.name);
+    if (entry.isDirectory()) result.push(...(await files(child, extension)));
+    else if (entry.isFile() && child.endsWith(extension)) result.push(child);
+  }
+  return result.sort();
+};
+await mkdir(output, { recursive: true });
+const classes = await mkdtemp(join(output, "classes-"));
+try {
+  const sources = [
+    ...(await files(join(source, "src/main/java"), ".java")),
+    ...(await files(join(root, "bridge/ghidra/extensions/nativeaot"), ".java")),
+  ];
+  const jars = await files(join(install, "Ghidra"), ".jar");
+  const args = [
+    "-proc:none",
+    "-cp",
+    jars.join(process.platform === "win32" ? ";" : ":"),
+    "-d",
+    classes,
+    ...sources,
+  ];
+  await writeFile(
+    join(output, "javac.args"),
+    args
+      .map((s) => `"${s.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`)
+      .join("\n"),
+  );
+  run(javac, [
+    "-J-Xmx512m",
+    "-J-XX:ActiveProcessorCount=1",
+    `@${join(output, "javac.args")}`,
+  ]);
+  await writeFile(
+    join(classes, "LICENSE-ghidra-nativeaot.md"),
+    await readFile(join(source, "LICENSE.md")),
+  );
+  const jar = join(output, "rea-ghidra-nativeaot.jar");
+  run(java ? join(java, "jar") : "jar", [
+    "--create",
+    "--file",
+    jar,
+    "--date=2025-01-01T00:00:00Z",
+    "-C",
+    classes,
+    ".",
+  ]);
+  const sha256 = createHash("sha256")
+    .update(await readFile(jar))
+    .digest("hex");
+  await writeFile(
+    join(output, "build.json"),
+    JSON.stringify(
+      {
+        jar,
+        sha256,
+        upstream_revision: revision,
+        ghidra_version: "12.1.4",
+        integration_api: 1,
+      },
+      null,
+      2,
+    ) + "\n",
+  );
+  console.log(
+    JSON.stringify({
+      jar,
+      sha256,
+      upstream_revision: revision,
+      ghidra_version: "12.1.4",
+      integration_api: 1,
+    }),
+  );
+} finally {
+  await rm(classes, { recursive: true, force: true });
+}

scripts/fetch-android-fixtures.mjs

@@ -0,0 +1,70 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { link, mkdir, open, rm } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { JADX_RELEASE } from "../src/android/JadxRelease.ts";
+import fixture from "./fixtures/android-apidemos.json" with { type: "json" };
+
+const args = process.argv.slice(2);
+if (args.length > 1)
+  throw new Error("Usage: node scripts/fetch-android-fixtures.mjs [DIRECTORY]");
+const directory = resolve(
+  args[0] ??
+    fileURLToPath(new URL("../_reference/apk-integration/", import.meta.url)),
+);
+await mkdir(directory, { recursive: true });
+const hashFile = async (path) => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+};
+for (const item of [
+  {
+    url: JADX_RELEASE.url,
+    sha256: JADX_RELEASE.sha256,
+    filename: "jadx-headless-mcp-0.7.1-all.jar",
+  },
+  fixture,
+]) {
+  const path = join(directory, item.filename);
+  try {
+    const digest = await hashFile(path);
+    if (digest !== item.sha256)
+      throw new Error(
+        `Existing ${path} has a different SHA-256; it was not overwritten`,
+      );
+    console.log(`Verified existing ${path}: ${digest}`);
+    continue;
+  } catch (cause) {
+    if (!(cause instanceof Error && "code" in cause && cause.code === "ENOENT"))
+      throw cause;
+  }
+  const temporary = `${path}.${randomUUID()}.partial`;
+  try {
+    const response = await fetch(item.url, {
+      signal: AbortSignal.timeout(120_000),
+    });
+    if (!response.ok || response.body === null)
+      throw new Error(`Download failed: ${item.url}: HTTP ${response.status}`);
+    const handle = await open(temporary, "wx", 0o600);
+    const hash = createHash("sha256");
+    try {
+      for await (const chunk of response.body) {
+        hash.update(chunk);
+        await handle.writeFile(chunk);
+      }
+    } finally {
+      await handle.close();
+    }
+    const digest = hash.digest("hex");
+    if (digest !== item.sha256)
+      throw new Error(
+        `SHA-256 mismatch for ${item.filename}: expected ${item.sha256}, received ${digest}`,
+      );
+    await link(temporary, path);
+    console.log(`Downloaded and verified ${path}: ${digest}`);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}

scripts/fixtures/android-apidemos.json

@@ -0,0 +1,14 @@
+{
+  "name": "Appium ApiDemos",
+  "version": "6.0.18",
+  "source": "https://github.com/appium/android-apidemos",
+  "source_revision": "3e716ee04ef3390284bfab761e28da8c15c08143",
+  "license": "Apache-2.0",
+  "license_url": "https://github.com/appium/android-apidemos/blob/3e716ee04ef3390284bfab761e28da8c15c08143/LICENSE",
+  "url": "https://github.com/appium/android-apidemos/releases/download/v6.0.18/ApiDemos-debug.apk",
+  "filename": "ApiDemos-debug.apk",
+  "sha256": "a9eecf37b26cd084855c530db81c2bb1b91f4c1b095a04f47aa7c20e2791f686",
+  "package": "io.appium.android.apis",
+  "class_name": "io.appium.android.apis.ApiDemos",
+  "method_name": "onCreate"
+}

scripts/fixtures/browser-network-site.mjs

@@ -0,0 +1,109 @@
+import { once } from "node:events";
+import { createServer } from "node:http";
+import { gzipSync } from "node:zlib";
+
+export const networkFixtureSecret = "私密-network-fixture";
+export const networkFixtureBinary = Buffer.from([0xff, 0, 0xfe, 1]);
+export const networkFixtureDecoded = Buffer.from("decoded-response-marker");
+
+const html = `<!doctype html><meta charset="utf-8"><body><button id="start">Run</button><main id="done" hidden>Done</main>
+<script>document.querySelector('#start').onclick = async () => {
+  const send = marker => fetch('/same', {method:'POST', headers:{
+    'Content-Type':'application/json', 'Authorization':'Bearer transport-only', 'X-Marker': marker
+  }, body:JSON.stringify({marker, password:'ordinary-selected-value', declared:'${networkFixtureSecret}'})}).then(r=>r.text());
+  await Promise.all([send('slow'),send('fast'),fetch('/redirect').then(r=>r.text()),
+    fetch('/binary').then(r=>r.arrayBuffer()),fetch('/compressed').then(r=>r.text()),
+    fetch('/empty').then(r=>r.text()),
+    fetch('/form', {method:'POST', body:new URLSearchParams({declared:'${networkFixtureSecret}'})}).then(r=>r.text())]);
+  await fetch('/stream');
+  document.querySelector('#done').hidden=false;
+};</script>`;
+
+/** Start an isolated fixture with concurrent, redirected, binary, and streaming responses. */
+export async function startBrowserNetworkSite() {
+  const counts = new Map();
+  const timers = new Set();
+  const server = createServer(async (request, response) => {
+    const path = new URL(request.url, "http://fixture.test").pathname;
+    counts.set(path, (counts.get(path) ?? 0) + 1);
+    if (path === "/same") {
+      const chunks = [];
+      for await (const chunk of request) chunks.push(chunk);
+      const body = JSON.parse(Buffer.concat(chunks).toString());
+      const timer = setTimeout(
+        () => {
+          timers.delete(timer);
+          response.writeHead(200, [
+            "Content-Type",
+            "application/json",
+            "X-Repeat",
+            "first",
+            "X-Repeat",
+            "second",
+            "Set-Cookie",
+            "fixture_session=transport-cookie; HttpOnly",
+            "X-Declared",
+            encodeURIComponent(networkFixtureSecret),
+          ]);
+          response.end(
+            JSON.stringify({
+              marker: body.marker,
+              password: body.password,
+              declared: body.declared,
+            }),
+          );
+        },
+        body.marker === "slow" ? 120 : 5,
+      );
+      timers.add(timer);
+    } else if (path === "/redirect") {
+      response.writeHead(302, { Location: "/landing" });
+      response.end();
+    } else if (path === "/landing") {
+      response.end("redirect-target");
+    } else if (path === "/form") {
+      const chunks = [];
+      for await (const chunk of request) chunks.push(chunk);
+      response.end(
+        new URLSearchParams(Buffer.concat(chunks).toString()).get("declared"),
+      );
+    } else if (path === "/binary") {
+      response.writeHead(200, { "Content-Type": "application/octet-stream" });
+      response.end(networkFixtureBinary);
+    } else if (path === "/compressed") {
+      response.writeHead(200, {
+        "Content-Type": "text/plain",
+        "Content-Encoding": "gzip",
+      });
+      response.end(gzipSync(networkFixtureDecoded));
+    } else if (path === "/empty") {
+      response.writeHead(204);
+      response.end();
+    } else if (path === "/stream") {
+      response.writeHead(200, { "Content-Type": "text/event-stream" });
+      response.write("data: still-open\n\n");
+    } else if (path === "/favicon.ico") {
+      response.writeHead(204);
+      response.end();
+    } else {
+      response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      response.end(html);
+    }
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const address = server.address();
+  if (typeof address !== "object" || address === null)
+    throw new Error("Network fixture has no TCP address");
+  return {
+    origin: `http://127.0.0.1:${address.port}`,
+    counts,
+    async close() {
+      for (const timer of timers) clearTimeout(timer);
+      server.closeAllConnections();
+      await new Promise((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      );
+    },
+  };
+}

scripts/fixtures/browser-script-site.mjs

@@ -0,0 +1,49 @@
+import { createServer } from "node:http";
+
+/** Independently authored modules and competing query variants for export verification. */
+export async function startBrowserScriptSite() {
+  const assets = new Map([
+    [
+      "/app/main.js",
+      "import { sourceMarker } from './lib/dep.js'; export const result = sourceMarker; document.body.dataset.ready = 'true';\n",
+    ],
+    [
+      "/app/lib/dep.js",
+      "export const sourceMarker = 'independent-source-marker';\n",
+    ],
+    ["/variant.js?v=1", "globalThis.variantOne = 'query-variant-one';\n"],
+    ["/variant.js?v=2", "globalThis.variantTwo = 'query-variant-two';\n"],
+  ]);
+  const counts = new Map();
+  const server = createServer((request, response) => {
+    counts.set(request.url, (counts.get(request.url) ?? 0) + 1);
+    const source = assets.get(request.url);
+    if (source !== undefined) {
+      response.setHeader("content-type", "text/javascript; charset=utf-8");
+      response.end(source);
+      return;
+    }
+    response.setHeader("content-type", "text/html; charset=utf-8");
+    response.end(
+      '<!doctype html><html><body><script src="/variant.js?v=1"></script><script src="/variant.js?v=2"></script><script type="module" src="/app/main.js"></script></body></html>',
+    );
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string")
+    throw new Error("Script fixture did not bind a port");
+  return {
+    origin: `http://127.0.0.1:${address.port}`,
+    assets,
+    counts,
+    close: () =>
+      new Promise((resolve, reject) =>
+        server.close((cause) =>
+          cause === undefined ? resolve() : reject(cause),
+        ),
+      ),
+  };
+}

scripts/fixtures/browser-verifier-site.mjs

@@ -52,8 +52,12 @@ export async function startBrowserVerifierSite() {
       return;
     }
     response.setHeader("content-type", "text/html");
+    response.setHeader("set-cookie", [
+      "rea-root-cookie=root-fixture; Path=/; SameSite=Lax",
+      "rea-app-cookie=app-fixture; Path=/app; SameSite=Lax",
+    ]);
     response.end(
-      '<!doctype html><html><head><title>REA browser verifier</title></head><body><main><h1>Browser evidence</h1><button aria-label="ax-private-label-value">Verify</button></main><script type="module" src="/app.js?token=script-query-secret"></script></body></html>',
+      '<!doctype html><html><head><title>REA browser verifier</title><base href="assets/"></head><body><main><h1>Browser evidence</h1><a href="guide">Guide</a><button aria-label="ax-private-label-value">Verify</button><form action=""></form><form action=" "></form><button formaction=""></button><input formaction=""></main><script type="module" src="/app.js?token=script-query-secret"></script></body></html>',
     );
   });
   const webSockets = new WebSocketServer({ noServer: true });

scripts/generate-firmware-fixtures.mjs

@@ -0,0 +1,42 @@
+import { execFile } from "node:child_process";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+const exec = promisify(execFile);
+const root = resolve(
+  process.env.REA_FIRMWARE_FIXTURE_ROOT ??
+    "_reference/firmware-integration/generated",
+);
+for (const [command, args, purpose] of [
+  [
+    process.env.REA_FIRMWARE_PYTHON ?? "python3",
+    ["--version"],
+    "Python 3 standard-library fixture generator",
+  ],
+  [
+    process.env.REA_FIRMWARE_CC ?? "cc",
+    ["--version"],
+    "host ELF fixture compiler",
+  ],
+]) {
+  try {
+    await exec(command, args);
+  } catch (cause) {
+    throw new Error(`fixtures:firmware requires ${purpose}: ${command}`, {
+      cause,
+    });
+  }
+}
+const ext4 =
+  process.env.REA_FIRMWARE_VERIFY_EXT4 === "1"
+    ? [process.env.REA_FIRMWARE_MKE2FS_COMMAND ?? "mke2fs"]
+    : [];
+for (const command of ext4) await exec(command, ["-V"]);
+const generated = await exec(process.env.REA_FIRMWARE_PYTHON ?? "python3", [
+  fileURLToPath(new URL("./lib/generate-firmware-fixture.py", import.meta.url)),
+  root,
+  process.env.REA_FIRMWARE_CC ?? "cc",
+  ...ext4,
+]);
+console.log(generated.stdout.trim());

scripts/generate-nativeaot-fixtures.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+if (process.arch !== "x64" || !["linux", "win32"].includes(process.platform))
+  throw new Error(
+    "NativeAOT fixture lane requires Linux or Windows x64; it does not cross-compile NativeAOT.",
+  );
+const runtime = process.platform === "win32" ? "win-x64" : "linux-x64";
+const directory = resolve(
+  process.env.REA_NATIVEAOT_FIXTURE_ROOT ??
+    join(root, "_reference/nativeaot-integration/generated"),
+);
+const output = join(directory, runtime);
+await mkdir(output, { recursive: true });
+const env = {
+  ...process.env,
+  DOTNET_CLI_HOME: join(output, "cli-home"),
+  DOTNET_CLI_TELEMETRY_OPTOUT: "1",
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1",
+  DOTNET_PROCESSOR_COUNT: "1",
+  COMPlus_GCHeapHardLimit: "30000000",
+  NUGET_PACKAGES: process.env.NUGET_PACKAGES ?? join(directory, "nuget"),
+};
+await writeFile(
+  join(output, "global.json"),
+  JSON.stringify({ sdk: { version: "8.0.416", rollForward: "disable" } }) +
+    "\n",
+);
+const run = (command, args) => {
+  const result = spawnSync(command, args, {
+    cwd: output,
+    env,
+    encoding: "utf8",
+    timeout: 300_000,
+    maxBuffer: 8 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      `NativeAOT fixture lane requires/action failed ${command}: ${result.error?.message ?? ""}\n${result.stdout ?? ""}${result.stderr ?? ""}`,
+    );
+  return result.stdout;
+};
+const dotnet = process.env.REA_NATIVEAOT_DOTNET ?? "dotnet";
+if (run(dotnet, ["--version"]).trim() !== "8.0.416")
+  throw new Error(
+    "NativeAOT fixtures require existing .NET SDK 8.0.416; REA does not install SDKs.",
+  );
+if (process.platform === "linux") {
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--version"]);
+  run(process.env.REA_NATIVEAOT_NM ?? "nm", ["--version"]);
+  run(process.env.REA_NATIVEAOT_CC ?? "cc", ["--version"]);
+  run("clang", ["--version"]);
+}
+const map = join(output, "NativeAotFixture.map");
+run(dotnet, [
+  "publish",
+  join(root, "tests/fixtures/nativeaot/NativeAotFixture.csproj"),
+  "-r",
+  runtime,
+  "-c",
+  "Release",
+  "-o",
+  join(output, "symbols"),
+  "--maxcpucount:1",
+  `-p:BaseIntermediateOutputPath=${join(output, "obj")}/`,
+  `-p:BaseOutputPath=${join(output, "bin")}/`,
+  `-p:NativeAotMapPath=${map}`,
+]);
+const name =
+  process.platform === "win32" ? "NativeAotFixture.exe" : "NativeAotFixture";
+const binary = join(output, "symbols", name);
+let symbols = "";
+if (process.platform === "linux") {
+  // Preserve the symbol table as an independent oracle while avoiding a full
+  // runtime DWARF import in this metadata-specific lane.
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--strip-debug", binary]);
+  symbols = run(process.env.REA_NATIVEAOT_NM ?? "nm", ["-n", binary]);
+  await mkdir(join(output, "stripped"), { recursive: true });
+  const stripped = join(output, "stripped", name);
+  await copyFile(binary, stripped);
+  run(process.env.REA_NATIVEAOT_STRIP ?? "strip", ["--strip-all", stripped]);
+} else {
+  symbols = await readFile(map, "utf8");
+}
+const bytes = await readFile(binary);
+const candidates = [];
+for (let offset = 0; offset <= bytes.length - 16; offset++) {
+  if (
+    bytes.readUInt32LE(offset) !== 0x00525452 ||
+    bytes[offset + 14] !== 24 ||
+    bytes[offset + 15] !== 1
+  )
+    continue;
+  const count = bytes.readUInt16LE(offset + 12);
+  if (count === 0 || count > 80 || offset + 16 + count * 24 > bytes.length)
+    continue;
+  candidates.push({
+    offset,
+    major: bytes.readUInt16LE(offset + 4),
+    minor: bytes.readUInt16LE(offset + 6),
+    sections: Array.from({ length: count }, (_, index) => {
+      const row = offset + 16 + index * 24;
+      return {
+        type: bytes.readUInt32LE(row),
+        flags: bytes.readUInt32LE(row + 4),
+        start: `0x${bytes.readBigUInt64LE(row + 8).toString(16)}`,
+        end: `0x${bytes.readBigUInt64LE(row + 16).toString(16)}`,
+      };
+    }),
+  });
+}
+if (
+  candidates.length !== 1 ||
+  candidates[0].major !== 9 ||
+  candidates[0].minor !== 1
+)
+  throw new Error(
+    "NativeAOT fixture did not produce exactly one independent RTR 9.1 directory.",
+  );
+const sha256 = createHash("sha256").update(bytes).digest("hex");
+await writeFile(join(output, "symbols.txt"), symbols);
+await writeFile(
+  join(output, "oracle.json"),
+  JSON.stringify(
+    {
+      sdk: "8.0.416",
+      runtime_version: "8.0.22",
+      runtime,
+      binary,
+      sha256,
+      headers: candidates,
+      expected_strings: [
+        "REA_NATIVEAOT_FROZEN",
+        "REA_NATIVEAOT_BASE",
+        "REA_NATIVEAOT_DERIVED",
+      ],
+    },
+    null,
+    2,
+  ) + "\n",
+);
+// A source-built negative input, not a downloaded third-party target.
+if (process.platform === "linux") {
+  const source = join(output, "ordinary.c");
+  await writeFile(
+    source,
+    "int ordinary_probe(int x) { return x * 3 + 1; }\nint main(void) { return ordinary_probe(1); }\n",
+  );
+  run(process.env.REA_NATIVEAOT_CC ?? "cc", [
+    "-g",
+    "-O0",
+    source,
+    "-o",
+    join(output, "ordinary"),
+  ]);
+  // Small source-built producer regressions run in seconds: no executable
+  // patching, large runtime import, or downloaded opaque negative inputs.
+  const row = "struct Row { unsigned type, flags; const char *start, *end; };";
+  const header =
+    "struct Header { unsigned signature; unsigned short major, minor; unsigned flags; unsigned short count; unsigned char size, type; struct Row row; };";
+  for (const kind of ["unsupported", "malformed", "ambiguous"]) {
+    const major = kind === "unsupported" ? 99 : 9;
+    const declaration = `const struct Header __attribute__((aligned(8))) probe = {0x00525452, ${major}, 1, 0, 1, 24, 1, {207, 1, data + 8, data}};`;
+    const extra =
+      kind === "ambiguous" ? declaration.replace("probe", "second_probe") : "";
+    const negative = join(output, `${kind}.c`);
+    await writeFile(
+      negative,
+      `${row}\n${header}\nconst char data[16] = {0};\n${declaration}\n${extra}\nint main(void) { return 0; }\n`,
+    );
+    run(process.env.REA_NATIVEAOT_CC ?? "cc", [
+      "-O0",
+      "-fno-pie",
+      "-no-pie",
+      negative,
+      "-o",
+      join(output, kind),
+    ]);
+  }
+}
+console.log(
+  `PASS source-built ${runtime} NativeAOT fixture, independent RTR 9.1 oracle and SHA-256 ${sha256}; no target execution`,
+);

scripts/lib/android-cli-cancellation.mjs

@@ -0,0 +1,120 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import {
+  cleanupOwnedProcessGroup,
+  readProcessRunId,
+} from "../../dist/process/ProcessOwnership.js";
+
+/** Exercise a real CLI signal while the owned Java engine is still running. */
+export const verifyAndroidCliCancellation = async ({
+  entrypoint,
+  environment,
+  path,
+  repository,
+  execute,
+}) => {
+  const child = spawn(
+    process.execPath,
+    [entrypoint, "inspect-android-package", path, "--format", "json"],
+    { cwd: repository, env: environment, stdio: ["ignore", "pipe", "pipe"] },
+  );
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk.toString();
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  const exited = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve({ code, signal }));
+  });
+  let group;
+  let ownership;
+  try {
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+      const table = (
+        await execute("ps", ["-eo", "pid=,ppid=,pgid=,args="], {
+          timeout: 5_000,
+          maxBuffer: 2 * 1024 * 1024,
+        })
+      ).stdout;
+      for (const row of table.split("\n")) {
+        const entry = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/u.exec(row);
+        if (
+          entry !== null &&
+          Number(entry[2]) === child.pid &&
+          entry[4].includes("engine.jar") &&
+          entry[4].includes("-Xmx512m")
+        ) {
+          group = Number(entry[3]);
+          const runId = await readProcessRunId(Number(entry[1]));
+          assert.ok(
+            runId !== undefined,
+            "Owned Java process did not carry an identity token",
+          );
+          ownership = {
+            runId,
+            leaderPid: Number(entry[1]),
+            processGroupId: group,
+          };
+        }
+      }
+      if (group !== undefined) break;
+      if (child.exitCode !== null || child.signalCode !== null)
+        throw new Error(
+          `CLI exited before acquiring JADX: ${stdout}\n${stderr}`,
+        );
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    assert.ok(
+      group !== undefined,
+      "CLI did not acquire the expected owned Java group",
+    );
+    child.kill("SIGTERM");
+    let timer;
+    const result = await Promise.race([
+      exited,
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("CLI cancellation did not finish cleanup")),
+          10_000,
+        );
+      }),
+    ]).finally(() => clearTimeout(timer));
+    assert.equal(result.code, 143, `${stdout}\n${stderr}`);
+    assert.equal(result.signal, null);
+    assert.equal(JSON.parse(stdout).code, "cancelled");
+    assert.throws(() => process.kill(-group, 0), { code: "ESRCH" });
+    console.log(
+      "PASS real CLI SIGTERM cancellation and owned Java group cleanup",
+    );
+  } finally {
+    await cleanupCancellation(child, exited, ownership);
+  }
+};
+
+const cleanupCancellation = async (child, exited, ownership) => {
+  if (child.exitCode === null && child.signalCode === null) {
+    child.kill("SIGTERM");
+    let timer;
+    await Promise.race([
+      exited,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, 2_000);
+      }),
+    ]).finally(() => clearTimeout(timer));
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill("SIGKILL");
+      await exited;
+    }
+  }
+  if (ownership !== undefined)
+    assert.equal(
+      (await cleanupOwnedProcessGroup(ownership)).cleaned,
+      true,
+      "Verifier could not confirm its owned Java group cleanup",
+    );
+};

scripts/lib/browser-dom-destinations-e2e.mjs

@@ -0,0 +1,60 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { parseEvidence } from "../../dist/domain/evidence.js";
+import { assertFormDestinations } from "./browser-verifier-assertions.mjs";
+import { mcpTextValue } from "./mcp-verifier-results.mjs";
+
+/** Verify the real fixture's form destinations through CLI and stdio MCP. */
+export async function verifyBrowserDomDestinations(
+  attachment,
+  entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
+  documentUrl,
+) {
+  const env = { ...process.env, REA_LOG_LEVEL: "silent" };
+  const { stdout } = await promisify(execFile)(
+    process.execPath,
+    [
+      entrypoint,
+      "inspect-web-page",
+      attachment.cdp_endpoint,
+      attachment.target_id,
+      "--observation-ms",
+      "100",
+      "--json",
+    ],
+    { env, timeout: 60000, maxBuffer: 32 * 1024 * 1024 },
+  );
+  assertFormDestinations(
+    parseEvidence(JSON.parse(stdout)).normalized_result,
+    documentUrl,
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    env,
+    stderr: "pipe",
+  });
+  const client = new Client({ name: "browser-dom-destinations", version: "1" });
+  try {
+    await client.connect(transport);
+    const result = await client.callTool({
+      name: "inspect_web_page",
+      arguments: { ...attachment, observation_ms: 100 },
+    });
+    assert.notEqual(result.isError, true, mcpTextValue(result));
+    assertFormDestinations(
+      parseEvidence(JSON.parse(mcpTextValue(result)).evidence)
+        .normalized_result,
+      documentUrl,
+    );
+    return { cli: true, stdio_mcp: true, current_document_destinations: 4 };
+  } finally {
+    await client.close();
+    await transport.close();
+  }
+}

scripts/lib/browser-network-assertions.mjs

@@ -0,0 +1,156 @@
+import assert from "node:assert/strict";
+import {
+  networkFixtureBinary,
+  networkFixtureDecoded,
+  networkFixtureSecret,
+} from "../fixtures/browser-network-site.mjs";
+
+const retained = (event) => {
+  assert.equal(event?.kind, "network-content");
+  assert.equal(event.body.state, "captured", JSON.stringify(event.body));
+  return Buffer.from(event.body.content, "base64");
+};
+
+/** Verify association against server-authored markers rather than provider-derived expectations. */
+export function assertBrowserNetworkEvidence(
+  capture,
+  origin,
+  expectedCleanup = "terminated-owned-process",
+) {
+  assert.ok(capture.steps.every((step) => step.status === "completed"));
+  assert.equal(capture.browser.cleanup, expectedCleanup);
+  assert.deepEqual(capture.scenario.network_content, {
+    request_body: true,
+    response_body: true,
+    header_values: true,
+  });
+  assert.equal(capture.completeness.equality_eligible, false);
+  assert.ok(!JSON.stringify(capture).includes(networkFixtureSecret));
+  const events = capture.events.items;
+  const content = events.filter((event) => event.kind === "network-content");
+  const requestEvents = events.filter((event) => event.kind === "request");
+  const sameUrlRequests = requestEvents.filter(
+    (event) => event.url.url === `${origin}/same`,
+  );
+  assert.equal(sameUrlRequests.length, 2);
+  assert.equal(
+    new Set(sameUrlRequests.map((event) => event.transaction_id)).size,
+    2,
+  );
+  const markers = [];
+  for (const request of sameUrlRequests) {
+    const requestContent = content.find(
+      (event) =>
+        event.phase === "request" &&
+        event.transaction_id === request.transaction_id,
+    );
+    const responseContent = content.find(
+      (event) =>
+        event.phase === "response" &&
+        event.transaction_id === request.transaction_id,
+    );
+    const input = JSON.parse(retained(requestContent).toString());
+    const output = JSON.parse(retained(responseContent).toString());
+    assert.equal(
+      output.marker,
+      input.marker,
+      "Response was associated with a different same-URL request",
+    );
+    assert.equal(output.password, "ordinary-selected-value");
+    assert.equal(input.declared, "[REDACTED:network_secret]");
+    assert.equal(output.declared, input.declared);
+    assert.equal(requestContent.body.redacted, true);
+    assert.equal(responseContent.headers.state, "captured");
+    assert.ok(
+      responseContent.headers.items.some(
+        (item) =>
+          item.name.toLowerCase() === "x-declared" &&
+          item.value === "[REDACTED:network_secret]" &&
+          item.redacted,
+      ),
+    );
+    assert.deepEqual(
+      responseContent.headers.items
+        .filter((item) => item.name.toLowerCase() === "x-repeat")
+        .map((item) => item.value),
+      ["first", "second"],
+    );
+    assert.ok(
+      responseContent.headers.items.some(
+        (item) =>
+          item.name.toLowerCase() === "set-cookie" &&
+          item.value === null &&
+          item.redacted,
+      ),
+    );
+    assert.ok(
+      requestContent.headers.items.some(
+        (item) =>
+          item.name.toLowerCase() === "authorization" &&
+          item.value === null &&
+          item.redacted,
+      ),
+    );
+    assert.ok(
+      events.some(
+        (event) =>
+          event.kind === "request-finished" &&
+          event.transaction_id === request.transaction_id,
+      ),
+    );
+    markers.push(input.marker);
+  }
+  assert.deepEqual(markers.sort(), ["fast", "slow"]);
+  const responseFor = (path) => {
+    const response = events.find(
+      (event) =>
+        event.kind === "response" && event.url.url === `${origin}${path}`,
+    );
+    assert.ok(response, `Missing response ${path}`);
+    return content.find(
+      (event) =>
+        event.phase === "response" &&
+        event.source_event_sequence === response.sequence,
+    );
+  };
+  assert.deepEqual(retained(responseFor("/binary")), networkFixtureBinary);
+  assert.deepEqual(retained(responseFor("/compressed")), networkFixtureDecoded);
+  assert.equal(
+    responseFor("/compressed").body.representation,
+    "browser-decoded-response-bytes",
+  );
+  const formRequest = requestEvents.find(
+    (event) => event.url.url === `${origin}/form`,
+  );
+  assert.ok(formRequest);
+  const formContent = content.find(
+    (event) =>
+      event.phase === "request" &&
+      event.transaction_id === formRequest.transaction_id,
+  );
+  assert.equal(
+    retained(formContent).toString(),
+    "declared=[REDACTED:network_secret]",
+  );
+  assert.equal(
+    retained(responseFor("/form")).toString(),
+    "[REDACTED:network_secret]",
+  );
+  assert.equal(responseFor("/stream").body.state, "unavailable");
+  assert.equal(responseFor("/stream").body.reason, "response-unfinished");
+  const first = requestEvents.find(
+    (event) => event.url.url === `${origin}/redirect`,
+  );
+  const next = requestEvents.find(
+    (event) => event.url.url === `${origin}/landing`,
+  );
+  assert.ok(first && next);
+  assert.equal(next.redirected_from_transaction_id, first.transaction_id);
+  return {
+    same_url_markers: markers,
+    binary_bytes: networkFixtureBinary.length,
+    compressed_representation: "browser-decoded-response-bytes",
+    unfinished_stream: "response-unfinished",
+    empty_response_state: responseFor("/empty").body.state,
+  };
+}

scripts/lib/browser-network-e2e.mjs

@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { browserScenarioSchema } from "../../dist/domain/browserScenario.js";
+import { browserScenarioCaptureSchema } from "../../dist/domain/browserScenarioCapture.js";
+import { parseEvidence } from "../../dist/domain/evidence.js";
+import {
+  startBrowserNetworkSite,
+  networkFixtureSecret,
+} from "../fixtures/browser-network-site.mjs";
+import { assertBrowserNetworkEvidence } from "./browser-network-assertions.mjs";
+import { scenarioProfiles } from "./browser-scenario-verifier.mjs";
+
+/** Exercise selected network content through real CLI and stdio MCP, one browser at a time. */
+export async function verifyBrowserNetworkEvidence(
+  executable,
+  entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
+  attachment,
+) {
+  const site = await startBrowserNetworkSite();
+  const profilesBefore = await scenarioProfiles();
+  try {
+    const scenario = browserScenarioSchema.parse({
+      browser: { mode: "launch", executable_path: executable },
+      start_url: { url: site.origin },
+      actions: [
+        {
+          step_id: "run",
+          action: "click",
+          locator: { kind: "css", selector: "#start" },
+          timeout_ms: 10_000,
+        },
+        {
+          step_id: "ready",
+          action: "wait_for",
+          locator: { kind: "css", selector: "#done" },
+          state: "visible",
+          timeout_ms: 10_000,
+        },
+      ],
+      secrets: [
+        {
+          secret_id: "network_secret",
+          environment_variable: "REA_NETWORK_FIXTURE_SECRET",
+        },
+      ],
+      capture: {
+        at_end: ["url"],
+        network: {
+          request_body: true,
+          response_body: true,
+          header_values: true,
+        },
+      },
+    });
+    const env = {
+      ...process.env,
+      REA_LOG_LEVEL: "silent",
+      REA_NETWORK_FIXTURE_SECRET: networkFixtureSecret,
+      HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
+    };
+    const { stdout } = await promisify(execFile)(
+      process.execPath,
+      [
+        entrypoint,
+        "capture-browser-scenario",
+        JSON.stringify(scenario),
+        "--json",
+      ],
+      { env, timeout: 60_000, maxBuffer: 16 * 1024 * 1024 },
+    );
+    const cli = browserScenarioCaptureSchema.parse(
+      parseEvidence(JSON.parse(stdout)).normalized_result,
+    );
+    const cliProof = assertBrowserNetworkEvidence(cli, site.origin);
+    // The oracle must reject a deliberately incorrect same-URL association.
+    const swapped = structuredClone(cli);
+    const responses = swapped.events.items.filter(
+      (event) =>
+        event.kind === "network-content" &&
+        event.phase === "response" &&
+        event.body.state === "captured" &&
+        Buffer.from(event.body.content, "base64")
+          .toString()
+          .includes('"marker":'),
+    );
+    assert.equal(responses.length, 2);
+    [responses[0].transaction_id, responses[1].transaction_id] = [
+      responses[1].transaction_id,
+      responses[0].transaction_id,
+    ];
+    assert.throws(
+      () => assertBrowserNetworkEvidence(swapped, site.origin),
+      /associated with a different same-URL request/,
+    );
+    const transport = new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      env,
+      stderr: "pipe",
+    });
+    const client = new Client({ name: "network-real-e2e", version: "1" });
+    let mcpProof;
+    try {
+      await client.connect(transport);
+      const result = await client.callTool(
+        { name: "capture_browser_scenario", arguments: scenario },
+        { timeout: 60_000 },
+      );
+      assert.notEqual(result.isError, true, JSON.stringify(result));
+      const evidence = parseEvidence({
+        ...result.structuredContent?.evidence,
+        normalized_result: result.structuredContent?.result,
+      });
+      mcpProof = assertBrowserNetworkEvidence(
+        browserScenarioCaptureSchema.parse(evidence.normalized_result),
+        site.origin,
+      );
+      if (attachment !== undefined) {
+        const connectedScenario = browserScenarioSchema.parse({
+          ...scenario,
+          browser: { mode: "connect", ...attachment },
+        });
+        const connected = await client.callTool(
+          { name: "capture_browser_scenario", arguments: connectedScenario },
+          { timeout: 60_000 },
+        );
+        assert.notEqual(connected.isError, true, JSON.stringify(connected));
+        const connectedEvidence = parseEvidence({
+          ...connected.structuredContent?.evidence,
+          normalized_result: connected.structuredContent?.result,
+        });
+        assert.deepEqual(
+          assertBrowserNetworkEvidence(
+            browserScenarioCaptureSchema.parse(
+              connectedEvidence.normalized_result,
+            ),
+            site.origin,
+            "disconnected-external",
+          ),
+          cliProof,
+        );
+        assert.ok(
+          (await fetch(`${attachment.cdp_endpoint}/json/version`)).ok,
+          "Network capture closed the external browser",
+        );
+      }
+    } finally {
+      try {
+        await client.close();
+      } finally {
+        await transport.close();
+      }
+    }
+    assert.deepEqual(mcpProof, cliProof);
+    for (const path of [
+      "/redirect",
+      "/landing",
+      "/binary",
+      "/compressed",
+      "/stream",
+      "/empty",
+      "/form",
+    ])
+      assert.equal(
+        site.counts.get(path),
+        attachment === undefined ? 2 : 3,
+        `Unexpected implicit refetch of ${path}`,
+      );
+    assert.equal(site.counts.get("/same"), attachment === undefined ? 4 : 6);
+    const profilesAfter = await scenarioProfiles();
+    assert.ok(
+      [...profilesAfter].every((profile) => profilesBefore.has(profile)),
+      "A scenario profile survived cleanup",
+    );
+    return {
+      ...cliProof,
+      cli: true,
+      mcp: true,
+      association_fault_rejected: true,
+      implicit_refetches: 0,
+      profile_cleanup: true,
+      connected_network_verified: attachment !== undefined,
+    };
+  } finally {
+    await site.close();
+  }
+}

scripts/lib/browser-scenario-verifier.mjs

@@ -204,11 +204,20 @@ export function assertScenarioCapture(capture) {
     throw new Error(
       "Scenario event URL did not report declared-secret redaction",
     );
+  const unfinished = capture.events.items.filter(
+    ({ kind }) => kind === "request-unfinished",
+  );
+  // This fixture polls continuously. A request crossing the capture cutoff
+  // makes later activity unknown even when no response body was selected.
+  const expectedMissing = unfinished.length === 0 ? [] : ["events"];
   if (
     capture.events.items.length === 0 ||
-    capture.completeness.equality_eligible !== true
+    capture.completeness.equality_eligible !== (unfinished.length === 0) ||
+    JSON.stringify(capture.completeness.missing_sections) !==
+      JSON.stringify(expectedMissing) ||
+    capture.completeness.truncated_sections.length !== 0
   )
     throw new Error(
-      "Scenario launch did not produce complete runtime evidence",
+      `Scenario launch completeness disagrees with its capture cutoff: ${JSON.stringify({ completeness: capture.completeness, unfinished })}`,
     );
 }

scripts/lib/browser-script-export-assertions.mjs

@@ -0,0 +1,70 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { webScriptExportResultSchema } from "../../dist/domain/webScriptExport.js";
+import { javascriptApplicationAnalysisResultSchema } from "../../dist/domain/javascriptApplicationAnalysis.js";
+
+/** Verify exact exported bytes and the independently authored source manifest. */
+export const assertWebScriptExport = async (evidence, capture, assets) => {
+  const result = webScriptExportResultSchema.parse(evidence.normalized_result);
+  assert.equal(result.source_evidence_id, capture.evidence_id);
+  assert.deepEqual(evidence.evidence_links, [capture.evidence_id]);
+  const manifest = await readFile(result.manifest.path);
+  assert.equal(
+    createHash("sha256").update(manifest).digest("hex"),
+    result.manifest.sha256,
+  );
+  const { manifest: descriptor, ...inline } = result;
+  assert.equal(descriptor.bytes, manifest.length);
+  assert.deepEqual(JSON.parse(manifest.toString()), inline);
+  assert.ok(result.analysis_input);
+  assert.ok(result.scripts.length > 0);
+  for (const script of result.scripts) {
+    assert.equal(script.content.state, "exported");
+    const bytes = await readFile(
+      join(result.analysis_input.input_path, script.content.relative_path),
+    );
+    assert.equal(
+      createHash("sha256").update(bytes).digest("hex"),
+      script.content.sha256,
+    );
+    if (assets) {
+      const url = new URL(script.url);
+      assert.equal(
+        bytes.toString(),
+        assets.get(`${url.pathname}${url.search}`),
+        `Wrong bytes for ${script.url}`,
+      );
+    }
+  }
+  if (assets) {
+    assert.equal(result.scripts.length, assets.size);
+    const variants = result.scripts.filter(({ url }) =>
+      url.includes("/variant.js?"),
+    );
+    assert.equal(variants.length, 2);
+    assert.ok(variants.every(({ content }) => content.layout === "isolated"));
+    assert.equal(
+      new Set(variants.map(({ content }) => content.relative_path)).size,
+      2,
+    );
+  }
+  return result;
+};
+/** Verify existing application analysis and an observed relative module layout. */
+export const assertExportedScriptAnalysis = (evidence, modules, imports) => {
+  const result = javascriptApplicationAnalysisResultSchema.parse(
+    evidence.normalized_result,
+  );
+  assert.equal(result.statistics.parsed_javascript_files, modules);
+  if (imports)
+    assert.ok(
+      result.graph.edges.some(
+        ({ relation, properties }) =>
+          relation === "imports" &&
+          properties.specifier === "./lib/dep.js" &&
+          properties.resolution_status === "resolved",
+      ),
+    );
+};

scripts/lib/browser-script-export-e2e.mjs

@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+import { parseEvidence } from "../../dist/domain/evidence.js";
+import { startBrowserScriptSite } from "../fixtures/browser-script-site.mjs";
+import {
+  assertWebScriptExport,
+  assertExportedScriptAnalysis,
+} from "./browser-script-export-assertions.mjs";
+import { mcpTextValue } from "./mcp-verifier-results.mjs";
+
+/** Verify capture → export → existing analysis through real CLI and stdio MCP. */
+export async function verifyBrowserScriptExport(
+  executable,
+  entrypoint = fileURLToPath(new URL("../rea.mjs", import.meta.url)),
+  attachment,
+) {
+  const site = await startBrowserScriptSite();
+  const root = await mkdtemp(join(tmpdir(), "rea-browser-script-export-"));
+  const env = {
+    ...process.env,
+    REA_LOG_LEVEL: "silent",
+    HOPPER_LAUNCHER_PATH: "/rea-unconfigured-provider/hopper",
+  };
+  const cli = exportCli(entrypoint, env);
+  const scenario = scriptCaptureScenario(executable, site.origin);
+  const save = (name, capture) => saveCapture(root, name, capture);
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entrypoint, "mcp"],
+    env,
+    stderr: "pipe",
+  });
+  const client = new Client({ name: "web-script-real-e2e", version: "1" });
+  try {
+    const cliCapture = await cli(
+      "capture-browser-scenario",
+      JSON.stringify(scenario),
+    );
+    const cliInput = await save("cli", cliCapture);
+    const counts = new Map(site.counts);
+    const cliExport = await cli(
+      "export-web-scripts",
+      cliInput.capture_path,
+      cliInput.output_directory,
+    );
+    const cliResult = await assertWebScriptExport(
+      cliExport,
+      cliCapture,
+      site.assets,
+    );
+    await cli(
+      "analyze-javascript-application",
+      cliResult.analysis_input.input_path,
+    ).then((value) => assertExportedScriptAnalysis(value, 4, true));
+    assert.deepEqual(
+      site.counts,
+      counts,
+      "Export/analysis refetched a captured asset",
+    );
+    await client.connect(transport);
+    const call = async (name, args) => {
+      const result = await client.callTool({ name, arguments: args });
+      assert.notEqual(result.isError, true, mcpTextValue(result));
+      return parseEvidence(JSON.parse(mcpTextValue(result)).evidence);
+    };
+    const mcpCapture = await call("capture_browser_scenario", scenario);
+    const mcpInput = await save("mcp", mcpCapture);
+    const mcpCounts = new Map(site.counts);
+    const mcpResult = await assertWebScriptExport(
+      await call("export_web_scripts", mcpInput),
+      mcpCapture,
+      site.assets,
+    );
+    assertExportedScriptAnalysis(
+      await call("analyze_javascript_application", mcpResult.analysis_input),
+      4,
+      true,
+    );
+    assert.deepEqual(
+      site.counts,
+      mcpCounts,
+      "MCP export/analysis refetched a captured asset",
+    );
+    const passive = attachment
+      ? await verifyPassiveExport(attachment, { cli, call, save })
+      : false;
+    return {
+      cli: true,
+      stdio_mcp: true,
+      active_scripts: 4,
+      passive,
+      exact_bytes: true,
+      manifest_readback: true,
+      relative_import_resolved: true,
+      query_variants_isolated: true,
+      implicit_refetches: 0,
+    };
+  } finally {
+    await client.close();
+    await transport.close();
+    await site.close();
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+const verifyPassiveExport = async (attachment, { cli, call, save }) => {
+  const input = {
+    ...attachment,
+    observation_ms: 100,
+    include_script_sources: true,
+  };
+  const page = await call("inspect_web_page", input);
+  const pageInput = await save("passive", page);
+  const exported = await assertWebScriptExport(
+    await call("export_web_scripts", pageInput),
+    page,
+  );
+  assertExportedScriptAnalysis(
+    await call("analyze_javascript_application", exported.analysis_input),
+    exported.scripts.length,
+    false,
+  );
+  const pageCli = await cli(
+    "inspect-web-page",
+    attachment.cdp_endpoint,
+    attachment.target_id,
+    "--include-script-sources",
+    "--observation-ms",
+    "100",
+  );
+  const pageCliInput = await save("passive-cli", pageCli);
+  const pageCliResult = await assertWebScriptExport(
+    await cli(
+      "export-web-scripts",
+      pageCliInput.capture_path,
+      pageCliInput.output_directory,
+    ),
+    pageCli,
+  );
+  assertExportedScriptAnalysis(
+    await cli(
+      "analyze-javascript-application",
+      pageCliResult.analysis_input.input_path,
+    ),
+    pageCliResult.scripts.length,
+    false,
+  );
+  return true;
+};
+
+const exportCli =
+  (entrypoint, env) =>
+  async (...args) => {
+    const { stdout } = await promisify(execFile)(
+      process.execPath,
+      [entrypoint, ...args, "--json"],
+      { env, timeout: 60000, maxBuffer: 32 * 1024 * 1024 },
+    );
+    return parseEvidence(JSON.parse(stdout));
+  };
+
+const saveCapture = async (root, name, capture) => {
+  const capturePath = join(root, `${name}.json`);
+  await writeFile(capturePath, JSON.stringify(capture));
+  return {
+    capture_path: capturePath,
+    output_directory: join(root, `${name}-export`),
+  };
+};
+
+const scriptCaptureScenario = (executable, origin) => ({
+  browser: { mode: "launch", executable_path: executable },
+  start_url: { url: origin },
+  actions: [
+    {
+      step_id: "ready",
+      action: "wait_for",
+      locator: { kind: "css", selector: '[data-ready="true"]' },
+      state: "visible",
+      timeout_ms: 10000,
+    },
+  ],
+  capture: { network: { response_body: true } },
+});

scripts/lib/browser-verifier-assertions.mjs

@@ -22,7 +22,7 @@ export function assertObservation(result, origin) {
   assertObservationInventory(result, origin);
   assertObservationEvents(result);
   assertObservationPrivacy(result);
-  assertObservationMetadata(result);
+  assertObservationMetadata(result, origin);
 }
 
 function assertObservationInventory(result, origin) {
@@ -86,9 +86,27 @@ function assertObservationPrivacy(result) {
     );
 }
 
-function assertObservationMetadata(result) {
+function assertObservationMetadata(result, origin) {
+  assertFormDestinations(result);
+  if (
+    !result.metadata.dom_urls.some(
+      ({ attribute, url }) =>
+        attribute === "href" && url === `${origin}/assets/guide`,
+    )
+  )
+    throw new Error(
+      "Real Chrome relative DOM URL did not use the document base",
+    );
   if (!result.storage.local_storage_keys.includes("rea-storage-key"))
     throw new Error("Real Chrome local-storage key inventory was missing");
+  if (
+    result.storage.content_fingerprints.filter(
+      ({ scope }) => scope === "cookie",
+    ).length !== 2
+  )
+    throw new Error(
+      "Real Chrome root and current-page cookie fingerprints were missing",
+    );
   if (!result.storage.indexed_db_names.includes("rea-browser-db"))
     throw new Error("Real Chrome IndexedDB name inventory was missing");
   if (!result.storage.cache_names.includes("rea-browser-cache"))
@@ -104,6 +122,23 @@ function assertObservationMetadata(result) {
     throw new Error("Real Chrome safe response metadata was missing");
 }
 
+/** Assert the fixture's empty form destinations retain the current document URL. */
+export function assertFormDestinations(
+  result,
+  documentUrl = result.target.url,
+) {
+  const destinations = result.metadata.dom_urls.filter(
+    ({ attribute }) => attribute === "action" || attribute === "formaction",
+  );
+  if (
+    destinations.length !== 4 ||
+    destinations.some(({ url }) => url !== documentUrl)
+  )
+    throw new Error(
+      `Real Chrome form destinations did not use the current document URL: ${JSON.stringify({ expected: documentUrl, target: result.target.url, destinations })}`,
+    );
+}
+
 /** Assert real-browser static bundle and source-map findings. */
 export function assertBundleAnalysis(result) {
   if (

scripts/lib/catalog-builders.mjs

@@ -31,6 +31,16 @@ export const toolFamilyCatalog = (sources) => {
         ...sources.managedWorkflowContracts.MANAGED_WORKFLOW_TOOL_CONTRACTS,
       ],
     },
+    {
+      id: "firmware",
+      surface: "firmware-provider",
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS,
+    },
+    {
+      id: "android",
+      surface: "android-provider",
+      contracts: sources.androidContracts.ANDROID_TOOL_CONTRACTS,
+    },
     {
       id: "browser",
       surface: "browser-provider",
@@ -54,7 +64,10 @@ export const toolFamilyCatalog = (sources) => {
     {
       id: "application",
       surface: "application-workflow",
-      contracts: sources.applicationContracts.APPLICATION_TOOL_CONTRACTS,
+      contracts: [
+        ...sources.applicationContracts.APPLICATION_TOOL_CONTRACTS,
+        ...sources.webScriptContracts.WEB_SCRIPT_TOOL_CONTRACTS,
+      ],
     },
     {
       id: "session",
@@ -96,6 +109,10 @@ export const providerCatalog = (sources) => {
       identity: sources.ghidraProvider.GHIDRA_PROVIDER_IDENTITY,
       contracts: sources.ghidraProvider.GHIDRA_PROVIDER_TOOL_CONTRACTS,
     },
+    {
+      identity: sources.idaProvider.IDA_PROVIDER_IDENTITY,
+      contracts: sources.idaProvider.IDA_PROVIDER_TOOL_CONTRACTS,
+    },
     {
       identity: sources.nativeProvider.NATIVE_MACOS_PROVIDER_IDENTITY,
       contracts: sources.nativeContracts.NATIVE_TOOL_CONTRACTS,
@@ -113,6 +130,22 @@ export const providerCatalog = (sources) => {
       contracts:
         sources.managedWorkflowContracts.MANAGED_WORKFLOW_TOOL_CONTRACTS,
     },
+    {
+      identity: sources.firmwareProvider.BINWALK_PROVIDER_IDENTITY,
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS.filter(
+        ({ name }) => name === "inspect_firmware_regions",
+      ),
+    },
+    {
+      identity: sources.firmwareProvider.UNBLOB_PROVIDER_IDENTITY,
+      contracts: sources.firmwareContracts.FIRMWARE_TOOL_CONTRACTS.filter(
+        ({ name }) => name === "extract_firmware",
+      ),
+    },
+    {
+      identity: sources.androidProvider.JADX_PROVIDER_IDENTITY,
+      contracts: sources.androidContracts.ANDROID_TOOL_CONTRACTS,
+    },
     {
       identity: sources.browserProvider.CDP_BROWSER_PROVIDER_IDENTITY,
       contracts: sources.browserContracts.BROWSER_TOOL_CONTRACTS,
@@ -154,6 +187,10 @@ export const providerCatalog = (sources) => {
         sources.artifactProviders.JAVASCRIPT_APPLICATION_WORKFLOW_PROVIDER,
       contracts: sources.applicationContracts.APPLICATION_TOOL_CONTRACTS,
     },
+    {
+      identity: sources.artifactProviders.WEB_SCRIPT_EXPORT_PROVIDER,
+      contracts: sources.webScriptContracts.WEB_SCRIPT_TOOL_CONTRACTS,
+    },
   ]
     .map(({ identity, contracts }) => ({
       id: identity.id,

scripts/lib/catalog-core.mjs

@@ -43,6 +43,10 @@ const SOURCE_PATHS = {
   nativeContracts: "dist/contracts/nativeToolContracts.js",
   artifactContracts: "dist/contracts/artifactToolContracts.js",
   managedContracts: "dist/contracts/managedToolContracts.js",
+  firmwareContracts: "dist/contracts/firmwareToolContracts.js",
+  firmwareProvider: "dist/firmware/FirmwareRelease.js",
+  androidContracts: "dist/contracts/androidToolContracts.js",
+  androidProvider: "dist/android/JadxRelease.js",
   managedWorkflowContracts: "dist/contracts/managedWorkflowToolContracts.js",
   browserContracts: "dist/contracts/browserToolContracts.js",
   browserScenarioContracts: "dist/contracts/browserScenarioToolContracts.js",
@@ -50,9 +54,11 @@ const SOURCE_PATHS = {
   javascriptRuntimeObservationContracts:
     "dist/contracts/javascriptRuntimeObservationToolContracts.js",
   applicationContracts: "dist/contracts/applicationToolContracts.js",
+  webScriptContracts: "dist/contracts/webScriptToolContracts.js",
   supportedClients: "dist/application/SupportedClients.js",
   hopperProvider: "dist/hopper/HopperProvider.js",
   ghidraProvider: "dist/ghidra/GhidraProvider.js",
+  idaProvider: "dist/ida/IdaProviderCapabilities.js",
   nativeProvider: "dist/native/NativeMacOSProvider.js",
   artifactProviders: "dist/application/InvestigationProviders.js",
   browserProvider: "dist/browser/CdpBrowserProvider.js",

scripts/lib/docs-facts.d.mts

@@ -1,5 +1,9 @@
 import type { ProductCatalog } from "./product-catalog.mjs";
 
+export function skillReferenceIssues(
+  skillRoot: string,
+): Promise<readonly string[]>;
+
 export function documentationFactIssues(
   root: string,
   catalog: ProductCatalog,

scripts/lib/docs-facts.mjs

@@ -1,5 +1,5 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 
 const README_PATHS = [
   "README.md",
@@ -28,9 +28,49 @@ const requireText = (issues, path, content, expected) => {
   if (!content.includes(expected)) issues.push(`${path}: missing ${expected}`);
 };
 
+/** Check that local Markdown references travel with an installed skill bundle. */
+export const skillReferenceIssues = async (skillRoot) => {
+  const issues = [];
+  const paths = (await readdir(skillRoot, { recursive: true }))
+    .filter((path) => path.endsWith(".md"))
+    .sort();
+  for (const path of paths) {
+    const content = await readFile(join(skillRoot, path), "utf8");
+    for (const match of content.matchAll(/\[[^\]\n]*\]\(([^)\s]+)\)/gu)) {
+      const destination = match[1];
+      if (/^(?:https?:\/\/|mailto:|#)/u.test(destination)) continue;
+      const target = resolve(
+        dirname(join(skillRoot, path)),
+        destination.split("#")[0],
+      );
+      const withinBundle = relative(resolve(skillRoot), target);
+      if (
+        withinBundle === ".." ||
+        withinBundle.startsWith(`..${sep}`) ||
+        isAbsolute(withinBundle)
+      ) {
+        issues.push(
+          `${path}: reference escapes installed skill bundle: ${destination}`,
+        );
+        continue;
+      }
+      try {
+        if (!(await stat(target)).isFile())
+          issues.push(`${path}: reference is not a file: ${destination}`);
+      } catch (cause) {
+        if (cause?.code !== "ENOENT") throw cause;
+        issues.push(`${path}: missing skill reference: ${destination}`);
+      }
+    }
+  }
+  return issues;
+};
+
 /** Return every caller-visible documentation mismatch against canonical facts. */
 export const documentationFactIssues = async (root, catalog) => {
-  const issues = [];
+  const issues = await skillReferenceIssues(
+    join(root, "skills/reverse-engineer-anything"),
+  );
   const expectedCounts = catalog.tools.families.map(({ count }) => count);
   for (const path of README_PATHS) {
     const content = await readFile(join(root, path), "utf8");

scripts/lib/generate-firmware-fixture.py

@@ -0,0 +1,43 @@
+"""Generate firmware bytes using standard format producers, with an independent oracle."""
+import gzip
+import hashlib
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+
+root = Path(sys.argv[1]).resolve()
+root.mkdir(parents=True, exist_ok=True)
+source = root / "probe.c"
+source.write_text("int firmware_probe(int x){return x*7+3;} int main(void){return firmware_probe(4);}\n")
+subprocess.run([sys.argv[2], "-O0", "-g", "-fno-inline", str(source), "-o", str(root / "probe")], check=True)
+payloads = {"etc/rea.conf": b"rea_fixture=true\n", "usr/bin/probe": (root / "probe").read_bytes()}
+buffer = io.BytesIO()
+with tarfile.open(fileobj=buffer, mode="w", format=tarfile.USTAR_FORMAT) as archive:
+    for name, data in payloads.items():
+        info = tarfile.TarInfo(name)
+        info.size = len(data)
+        info.mode = 0o644
+        info.mtime = 0
+        archive.addfile(info, io.BytesIO(data))
+compressed = gzip.compress(buffer.getvalue(), mtime=0)
+image = b"REA firmware fixture\n".ljust(64, b"\xff") + compressed + b"\x00" * 128
+(root / "firmware.bin").write_bytes(image)
+(root / "oracle.json").write_text(json.dumps({
+    "generator": "Python tarfile USTAR + gzip; host cc; no target execution",
+    "offset": 64, "length": len(compressed), "size": len(image),
+    "sha256": hashlib.sha256(image).hexdigest(),
+    "files": {name: {"sha256": hashlib.sha256(data).hexdigest(), "size": len(data)} for name, data in payloads.items()},
+}, indent=2) + "\n")
+print(root)
+
+if len(sys.argv) > 3:
+    tree = root / "ext4-root"
+    tree.mkdir(exist_ok=True)
+    for name, data in payloads.items():
+        target = tree / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(data)
+    subprocess.run([sys.argv[3], "-q", "-t", "ext4", "-F", "-d", str(tree), str(root / "ext4.bin"), "8192"], check=True)

scripts/lib/test-discovery.d.mts

@@ -0,0 +1,14 @@
+/** Compare actual Vitest discovery with repository-owned test paths. */
+export function compareTestDiscovery(
+  expectedPaths: readonly string[],
+  discovery: unknown,
+  root: string,
+): {
+  readonly missing: readonly string[];
+  readonly unexpected: readonly string[];
+  readonly duplicates: readonly {
+    readonly file: string;
+    readonly projects: readonly string[];
+  }[];
+  readonly discovered: number;
+};

scripts/lib/test-discovery.mjs

@@ -0,0 +1,41 @@
+import { relative, resolve } from "node:path";
+
+/** Compare actual Vitest discovery with repository-owned test paths. */
+export const compareTestDiscovery = (expectedPaths, discovery, root) => {
+  if (!Array.isArray(discovery))
+    throw new TypeError("Vitest file discovery must be an array");
+  const projectsByFile = new Map();
+  for (const entry of discovery) {
+    if (
+      entry === null ||
+      typeof entry !== "object" ||
+      typeof entry.file !== "string" ||
+      entry.file.length === 0 ||
+      typeof entry.projectName !== "string" ||
+      entry.projectName.length === 0
+    )
+      throw new TypeError(
+        "Vitest discovery requires file and projectName strings",
+      );
+    const path = relative(root, resolve(root, entry.file)).replaceAll(
+      "\\",
+      "/",
+    );
+    const projects = projectsByFile.get(path) ?? [];
+    projects.push(entry.projectName);
+    projectsByFile.set(path, projects);
+  }
+  const expected = new Set(expectedPaths);
+  const sorted = (values) => [...values].sort();
+  return {
+    missing: sorted(expected).filter((path) => !projectsByFile.has(path)),
+    unexpected: sorted(projectsByFile.keys()).filter(
+      (path) => !expected.has(path),
+    ),
+    duplicates: sorted(projectsByFile.keys()).flatMap((file) => {
+      const projects = projectsByFile.get(file);
+      return projects.length > 1 ? [{ file, projects: sorted(projects) }] : [];
+    }),
+    discovered: projectsByFile.size,
+  };
+};

scripts/verify-browser-dom-destinations.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { chromium } from "playwright-core";
+import { startBrowserVerifierSite } from "./fixtures/browser-verifier-site.mjs";
+import { verifyBrowserDomDestinations } from "./lib/browser-dom-destinations-e2e.mjs";
+
+const executable = process.env.REA_BROWSER_EXECUTABLE;
+if (!executable)
+  throw new Error("verify:browser:dom requires REA_BROWSER_EXECUTABLE");
+const profile = await mkdtemp(join(tmpdir(), "rea-browser-dom-"));
+const site = await startBrowserVerifierSite();
+let context;
+try {
+  context = await chromium.launchPersistentContext(profile, {
+    executablePath: executable,
+    headless: true,
+    args: ["--remote-debugging-port=0"],
+  });
+  const page = context.pages()[0] ?? (await context.newPage());
+  await page.goto(`${site.origin}/app?selected=fixture#section`);
+  const native = await page.evaluate(() =>
+    [
+      ...document.querySelectorAll("form,button[formaction],input[formaction]"),
+    ].map((element) =>
+      element.tagName === "FORM" ? element.action : element.formAction,
+    ),
+  );
+  assert.deepEqual(native, Array(4).fill(page.url()));
+  const session = await context.newCDPSession(page);
+  const { targetInfo } = await session.send("Target.getTargetInfo");
+  await session.detach();
+  const [port] = (
+    await readFile(join(profile, "DevToolsActivePort"), "utf8")
+  ).split("\n");
+  const result = await verifyBrowserDomDestinations(
+    {
+      cdp_endpoint: `http://127.0.0.1:${port}`,
+      target_id: targetInfo.targetId,
+    },
+    process.argv[2],
+    page.url(),
+  );
+  process.stdout.write(
+    `${JSON.stringify({ ...result, browser: context.browser().version(), native_oracle: true, verified: true })}\n`,
+  );
+} finally {
+  await context?.close();
+  await site.close();
+  await rm(profile, { recursive: true, force: true });
+}

scripts/verify-browser-network.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { access } from "node:fs/promises";
+import { verifyBrowserNetworkEvidence } from "./lib/browser-network-e2e.mjs";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+
+const executable = process.env.REA_BROWSER_EXECUTABLE;
+if (executable === undefined || executable === "")
+  throw new Error(
+    "verify:browser:network requires REA_BROWSER_EXECUTABLE pointing to an installed Chrome-family browser",
+  );
+await access(executable);
+const run = createVerifierRun();
+const proof = await verifyBrowserNetworkEvidence(executable, process.argv[2]);
+process.stdout.write(
+  `${JSON.stringify({ ...proof, verifier_run: await completeVerifierRun(run), verified: true })}\n`,
+);

scripts/verify-browser-scripts.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { access } from "node:fs/promises";
+import { verifyBrowserScriptExport } from "./lib/browser-script-export-e2e.mjs";
+import { createVerifierRun, completeVerifierRun } from "./lib/verifier-run.mjs";
+
+const executable = process.env.REA_BROWSER_EXECUTABLE;
+if (executable === undefined || executable === "")
+  throw new Error(
+    "verify:browser:scripts requires REA_BROWSER_EXECUTABLE pointing to an installed Chrome-family browser",
+  );
+await access(executable);
+const run = createVerifierRun();
+const proof = await verifyBrowserScriptExport(executable, process.argv[2]);
+process.stdout.write(
+  `${JSON.stringify({ ...proof, verifier_run: await completeVerifierRun(run), verified: true })}\n`,
+);

scripts/verify-package-setup.mjs

@@ -2,11 +2,12 @@ import {
   lstat,
   mkdir,
   readFile,
+  readdir,
   rm,
   symlink,
   writeFile,
 } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import { spawn } from "@lydell/node-pty";
 
@@ -19,6 +20,7 @@ import {
   runWithStatus,
 } from "./lib/verify-package-core.mjs";
 import { parse as parseJsonc } from "jsonc-parser";
+import { skillReferenceIssues } from "./lib/docs-facts.mjs";
 
 const OPENCODE_ORIGINAL = `{
   // OpenCode preferences must survive setup.
@@ -473,19 +475,23 @@ const assertSkill = async ({ skillPath, siblingSkillPath, root }) => {
   );
   if (skill !== canonicalSkill)
     throw new Error("packaged skill did not match its canonical source");
-  const installedReference = await readFile(
-    join(skillPath, "..", "references/javascript-applications.md"),
-    "utf8",
-  );
-  const canonicalReference = await readFile(
-    join(
-      root,
-      "skills/reverse-engineer-anything/references/javascript-applications.md",
-    ),
-    "utf8",
-  );
-  if (installedReference !== canonicalReference)
-    throw new Error("packaged skill references did not match canonical source");
+  const canonicalRoot = join(root, "skills/reverse-engineer-anything");
+  for (const reference of await readdir(join(canonicalRoot, "references"))) {
+    const installed = await readFile(
+      join(dirname(skillPath), "references", reference),
+      "utf8",
+    );
+    const canonical = await readFile(
+      join(canonicalRoot, "references", reference),
+      "utf8",
+    );
+    if (installed !== canonical)
+      throw new Error(
+        `packaged skill reference did not match canonical source: ${reference}`,
+      );
+  }
+  const issues = await skillReferenceIssues(dirname(skillPath));
+  if (issues.length > 0) throw new Error(issues.join("\n"));
   if ((await readFile(siblingSkillPath, "utf8")) !== "unrelated skill\n")
     throw new Error("packaged skill installation modified a sibling skill");
 };

scripts/verify-packaged-ghidra-windows.mjs

@@ -108,14 +108,26 @@ try {
 const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const runtimeParent = join(workspace, "runtime with spaces");
 await mkdir(runtimeParent);
+const callerDirectory = join(workspace, "caller cwd with spaces");
+const scriptCollisions = ["ReaGhidraBridge.java", "ReaGhidraPrepareCom.java"];
+await mkdir(callerDirectory);
+for (const name of scriptCollisions) await mkdir(join(callerDirectory, name));
 const environment = {
-  ...process.env,
+  ...Object.fromEntries(
+    Object.entries(process.env).filter(
+      ([name]) => name.toLowerCase() !== "comspec",
+    ),
+  ),
+  ComSpec: (
+    process.env.ComSpec ??
+    join(process.env.SystemRoot ?? "C:\\Windows", "System32", "cmd.exe")
+  ).replaceAll("\\", "/"),
   REA_ANALYSIS_PROVIDER: "ghidra",
   REA_LOG_LEVEL: "error",
   GHIDRA_HEADLESS_MAXMEM: "512m",
   NODE_OPTIONS: "--max-old-space-size=512",
-  TEMP: runtimeParent,
-  TMP: runtimeParent,
+  TEMP: runtimeParent.replaceAll("\\", "/"),
+  TMP: runtimeParent.replaceAll("\\", "/"),
   HOME: workspace,
   USERPROFILE: workspace,
   APPDATA: join(workspace, "appdata"),
@@ -150,6 +162,7 @@ try {
     (
       await exec(process.execPath, [entry, "providers", "--json"], {
         env: environment,
+        cwd: callerDirectory,
         timeout: 30_000,
       })
     ).stdout,
@@ -159,7 +172,12 @@ try {
   const inspected = await exec(
     process.execPath,
     [entry, "inspect", target, "--provider", "ghidra", "--format", "json"],
-    { env: environment, timeout: 360_000, maxBuffer: 8 * 1024 * 1024 },
+    {
+      env: environment,
+      cwd: callerDirectory,
+      timeout: 360_000,
+      maxBuffer: 8 * 1024 * 1024,
+    },
   );
   const inspection = JSON.parse(inspected.stdout);
   assert.ok(inspection.error === undefined);
@@ -169,6 +187,7 @@ try {
     command: process.execPath,
     args: [entry, "mcp"],
     env: environment,
+    cwd: callerDirectory,
     stderr: "pipe",
   });
   const client = new Client({
@@ -282,6 +301,10 @@ try {
     token,
     "Analysis changed caller token authority.",
   );
+  assert.deepEqual((await readdir(callerDirectory)).sort(), scriptCollisions);
+  for (const name of scriptCollisions)
+    assert.deepEqual(await readdir(join(callerDirectory, name)), []);
+  report.callerScriptCollisionsPreserved = true;
   report.runtimeCleanup = true;
   report.ok = true;
   if (process.argv[4] !== undefined)

scripts/verify-real-android.mjs

@@ -0,0 +1,221 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { access, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { hashAndroidFile } from "../dist/android/AndroidTargetSnapshot.js";
+import { JADX_RELEASE } from "../dist/android/JadxRelease.js";
+import fixture from "./fixtures/android-apidemos.json" with { type: "json" };
+import { verifyAndroidCliCancellation } from "./lib/android-cli-cancellation.mjs";
+
+const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const apk = process.env.REA_ANDROID_TEST_APK;
+const jar = process.env.REA_JADX_MCP_JAR;
+if (apk === undefined || jar === undefined)
+  throw new Error(
+    "verify:android requires REA_ANDROID_TEST_APK and REA_JADX_MCP_JAR. Run node scripts/fetch-android-fixtures.mjs and select the downloaded files; see docs/android-analysis.md.",
+  );
+await access(apk);
+await access(jar);
+assert.equal(
+  await hashAndroidFile(apk),
+  fixture.sha256,
+  "Real Android lane requires the fixed ApiDemos release fixture",
+);
+assert.equal(
+  await hashAndroidFile(jar),
+  JADX_RELEASE.sha256,
+  "Real Android lane requires the audited headless JADX release JAR",
+);
+const java =
+  process.env.JAVA_HOME === undefined
+    ? "java"
+    : resolve(process.env.JAVA_HOME, "bin/java");
+const execute = promisify(execFile);
+await execute(java, ["-version"], { timeout: 10_000 });
+const entrypoint =
+  process.env.REA_ANDROID_ENTRYPOINT ?? resolve(repository, "scripts/rea.mjs");
+const environment = { ...process.env, REA_JADX_MCP_JAR: resolve(jar) };
+const path = resolve(apk);
+const tasks = [
+  {
+    name: "inspect_android_package",
+    args: ["inspect-android-package", path],
+    input: { path },
+  },
+  {
+    name: "search_android_classes",
+    args: ["search-android-classes", path, "ApiDemos"],
+    input: { path, query: "ApiDemos" },
+  },
+  {
+    name: "inspect_android_class",
+    args: ["inspect-android-class", path, fixture.class_name],
+    input: { path, class_name: fixture.class_name },
+  },
+  {
+    name: "inspect_android_method",
+    args: [
+      "inspect-android-method",
+      path,
+      fixture.class_name,
+      fixture.method_name,
+    ],
+    input: {
+      path,
+      class_name: fixture.class_name,
+      method_name: fixture.method_name,
+    },
+  },
+  {
+    name: "trace_android_references",
+    args: [
+      "trace-android-references",
+      path,
+      fixture.class_name,
+      "--method-name",
+      "activityIntent",
+    ],
+    input: {
+      path,
+      class_name: fixture.class_name,
+      method_name: "activityIntent",
+    },
+  },
+];
+const cliResults = new Map();
+for (const task of tasks) {
+  const response = await execute(
+    process.execPath,
+    [entrypoint, ...task.args, "--format", "json"],
+    {
+      cwd: repository,
+      env: environment,
+      timeout: 150_000,
+      maxBuffer: 8 * 1024 * 1024,
+    },
+  );
+  const evidence = parseEvidence(JSON.parse(response.stdout));
+  assert.equal(evidence.subject?.digest.sha256, fixture.sha256);
+  assert.equal(evidence.operation, task.name);
+  cliResults.set(task.name, evidence);
+  console.log(`PASS CLI ${task.name}`);
+}
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [entrypoint, "mcp"],
+  cwd: repository,
+  env: environment,
+  stderr: "pipe",
+});
+let stderr = "";
+transport.stderr?.on("data", (chunk) => {
+  stderr += chunk.toString();
+});
+const client = new Client({ name: "rea-real-android-verifier", version: "1" });
+try {
+  await client.connect(transport, { timeout: 30_000 });
+  for (const task of tasks) {
+    const response = await client.callTool(
+      { name: task.name, arguments: task.input },
+      { timeout: 150_000 },
+    );
+    assert.notEqual(response.isError, true, JSON.stringify(response));
+    const structured = response.structuredContent;
+    assert.ok(structured !== undefined && structured.evidence !== undefined);
+    const evidence = parseEvidence(structured.evidence);
+    assert.deepEqual(
+      evidence.normalized_result,
+      cliResults.get(task.name).normalized_result,
+    );
+    // Raw observations retain different workspace paths and load durations.
+    // Validate each evidence ID independently; compare portable results/intent.
+    assert.equal(structured.evidence_id, evidence.evidence_id);
+    assert.deepEqual(evidence.parameters, cliResults.get(task.name).parameters);
+    assert.deepEqual(evidence.provider, cliResults.get(task.name).provider);
+    assert.deepEqual(
+      evidence.subject.digest,
+      cliResults.get(task.name).subject.digest,
+    );
+    assert.deepEqual(
+      evidence.limitations,
+      cliResults.get(task.name).limitations,
+    );
+    assert.equal(evidence.confidence, cliResults.get(task.name).confidence);
+    assert.deepEqual(structured.result, evidence.normalized_result);
+    console.log(`PASS MCP/CLI parity ${task.name}`);
+  }
+} catch (cause) {
+  process.stderr.write(stderr);
+  throw cause;
+} finally {
+  await client.close();
+}
+const packageResult = cliResults.get(
+  "inspect_android_package",
+).normalized_result;
+assert.equal(packageResult.package_name, fixture.package);
+assert.equal(packageResult.version_name, fixture.version);
+assert.equal(packageResult.min_sdk, "26");
+assert.equal(packageResult.target_sdk, "33");
+assert.equal(packageResult.manifest.status, "complete");
+assert.ok(packageResult.manifest.text.includes(fixture.package));
+assert.ok(packageResult.permissions.includes("android.permission.INTERNET"));
+assert.equal(packageResult.signature_verification, "not_performed");
+assert.ok(
+  cliResults
+    .get("search_android_classes")
+    .normalized_result.matches.includes(fixture.class_name),
+);
+const classResult = cliResults.get("inspect_android_class").normalized_result;
+assert.ok(
+  classResult.methods.some((method) => method.name === fixture.method_name),
+);
+const method = cliResults.get("inspect_android_method").normalized_result;
+assert.equal(method.representation, "java");
+assert.equal(method.body_status, "available");
+assert.equal(method.source.status, "complete");
+assert.ok(method.source.text.includes("getIntent()"));
+assert.ok(method.source.text.includes("setListAdapter"));
+assert.equal(method.method.dex_descriptor, null);
+const references = cliResults.get("trace_android_references").normalized_result;
+assert.ok(references.total > 0);
+assert.ok(
+  references.references.every(
+    (reference) =>
+      reference.dex_offset === null && reference.source_line === null,
+  ),
+);
+await verifyAndroidCliCancellation({
+  entrypoint,
+  environment,
+  path,
+  repository,
+  execute,
+});
+assert.equal(
+  await hashAndroidFile(apk),
+  fixture.sha256,
+  "Original APK must remain unchanged",
+);
+const report = {
+  lane: "real-android",
+  platform: process.platform,
+  fixture: { version: fixture.version, sha256: fixture.sha256 },
+  engine: packageResult.engine,
+  operations: tasks.map((task) => task.name),
+  cli_mcp_parity: true,
+  original_apk_unchanged: true,
+  apk_executed: false,
+  cli_sigterm_cleanup: true,
+};
+if (process.env.REA_ANDROID_REPORT !== undefined)
+  await writeFile(
+    process.env.REA_ANDROID_REPORT,
+    JSON.stringify(report, null, 2) + "\n",
+  );
+console.log(JSON.stringify(report, null, 2));

scripts/verify-real-browser.mjs

@@ -35,6 +35,9 @@ import {
 import { completeVerifierRun, createVerifierRun } from "./lib/verifier-run.mjs";
 import { verifyLargeScreenshotE2e } from "./lib/browser-screenshot-e2e.mjs";
 import { verifyPopupEventCoverage } from "./lib/browser-popup-e2e.mjs";
+import { verifyBrowserNetworkEvidence } from "./lib/browser-network-e2e.mjs";
+import { verifyBrowserScriptExport } from "./lib/browser-script-export-e2e.mjs";
+import { verifyBrowserDomDestinations } from "./lib/browser-dom-destinations-e2e.mjs";
 
 const REAL_BROWSER_STARTUP_TIMEOUT_MS = 60_000;
 const SCENARIO_SECRET_VALUE = "rea-browser-verifier-secret";
@@ -96,6 +99,10 @@ try {
   );
   if (!observed.ok) throw observed.error;
   assertObservation(observed.value, site.origin);
+  const domDestinations = await verifyBrowserDomDestinations({
+    cdp_endpoint: endpoint,
+    target_id: target,
+  });
   const serialized = JSON.stringify(observed.value);
   if (
     !observed.value.target.url.includes("startup=browser-secret-value") ||
@@ -320,6 +327,15 @@ try {
 
   const largeScreenshot = await verifyLargeScreenshotE2e(endpoint, site.origin);
   const popupEvents = await verifyPopupEventCoverage(executable);
+  const networkEvidence = await verifyBrowserNetworkEvidence(
+    executable,
+    undefined,
+    { cdp_endpoint: endpoint, target_id: target },
+  );
+  const scriptExport = await verifyBrowserScriptExport(executable, undefined, {
+    cdp_endpoint: endpoint,
+    target_id: target,
+  });
   process.stdout.write(
     `${JSON.stringify({
       verifier_run: await completeVerifierRun(verifierRun),
@@ -339,6 +355,9 @@ try {
       screenshotBytes: screenshot.value.artifact.bytes,
       largeScreenshot,
       popupEvents,
+      networkEvidence,
+      scriptExport,
+      domDestinations,
       browserScenarioCli: true,
       browserScenarioAttachCleanup: "disconnected-external",
       browserScenarioLaunchCleanup: "terminated-owned-process",

scripts/verify-real-firmware.mjs

@@ -0,0 +1,254 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import {
+  access,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  symlink,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { firmwareResultSchemas } from "../dist/domain/firmwareAnalysis.js";
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { hashFirmwareFile } from "../dist/firmware/FirmwareFiles.js";
+
+const exec = promisify(execFile);
+const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const entrypoint = resolve(
+  process.env.REA_FIRMWARE_TEST_ENTRYPOINT ??
+    join(repository, "scripts/rea.mjs"),
+);
+if (process.platform !== "linux")
+  throw new Error(
+    "verify:firmware requires Linux; other hosts are not verified",
+  );
+for (const variable of ["REA_BINWALK_COMMAND", "REA_UNBLOB_COMMAND"]) {
+  const path = process.env[variable];
+  if (path === undefined)
+    throw new Error(
+      `verify:firmware requires ${variable}; see docs/firmware-analysis.md`,
+    );
+  await access(path);
+}
+const fixtureRoot = resolve(
+  process.env.REA_FIRMWARE_FIXTURE_ROOT ??
+    join(repository, "_reference/firmware-integration/generated"),
+);
+await access(join(fixtureRoot, "oracle.json")).catch((cause) => {
+  throw new Error(
+    "verify:firmware requires generated fixtures; run npm run fixtures:firmware",
+    { cause },
+  );
+});
+const oracle = JSON.parse(
+  await readFile(join(fixtureRoot, "oracle.json"), "utf8"),
+);
+const path = join(fixtureRoot, "firmware.bin");
+assert.equal(await hashFirmwareFile(path), oracle.sha256);
+const root = await mkdtemp(join(tmpdir(), "rea-real-firmware-"));
+const environment = Object.fromEntries(
+  Object.entries(process.env).filter(([, value]) => value !== undefined),
+);
+const client = new Client({ name: "rea-real-firmware-verifier", version: "1" });
+const cli = async (args, env = environment) => {
+  const response = await exec(
+    process.execPath,
+    [entrypoint, ...args, "--format", "json"],
+    {
+      env,
+      cwd: repository,
+      timeout: 150_000,
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  );
+  return parseEvidence(JSON.parse(response.stdout));
+};
+const call = async (name, args) => {
+  const response = await client.callTool(
+    { name, arguments: args },
+    { timeout: 150_000 },
+  );
+  assert.notEqual(response.isError, true, JSON.stringify(response));
+  assert.ok(response.structuredContent !== undefined);
+  return response.structuredContent;
+};
+const verifyRegions = (evidence) => {
+  assert.equal(evidence.subject.digest.sha256, oracle.sha256);
+  const result = firmwareResultSchemas.inspect_firmware_regions.parse(
+    evidence.normalized_result,
+  );
+  const gzip = result.regions.find(
+    (region) => region.signature === "gzip" && region.offset === oracle.offset,
+  );
+  assert.ok(
+    gzip !== undefined,
+    "Binwalk must find the independently generated gzip offset",
+  );
+  assert.equal(gzip.reported_size, oracle.length);
+  assert.equal(gzip.size_basis, "provider_reported_validation_unknown");
+  return result.regions.map(({ provider_id, ...region }) => region);
+};
+const verifyFiles = async (evidence) => {
+  const result = firmwareResultSchemas.extract_firmware.parse(
+    evidence.normalized_result,
+  );
+  assert.ok(result.chunks.some((chunk) => chunk.handler === "gzip"));
+  for (const [suffix, expected] of Object.entries(oracle.files)) {
+    const file = result.files.find((candidate) =>
+      candidate.relative_path.endsWith(`/${suffix}`),
+    );
+    assert.ok(file !== undefined, `Missing extracted ${suffix}`);
+    assert.equal(file.sha256, expected.sha256);
+    assert.equal(file.size, expected.size);
+    assert.equal(await hashFirmwareFile(file.path), expected.sha256);
+    assert.equal(file.original_file_range, null);
+    assert.equal(file.runtime_address, null);
+  }
+  return result;
+};
+try {
+  const inspected = await cli(["inspect-firmware-regions", path]);
+  const cliRegions = verifyRegions(inspected);
+  const extracted = await cli([
+    "extract-firmware",
+    path,
+    join(root, "cli-output"),
+  ]);
+  const cliFiles = await verifyFiles(extracted);
+  assert.equal(cliFiles.coverage, "partial");
+  assert.ok(
+    cliFiles.chunks.some(
+      (chunk) =>
+        chunk.handler === null &&
+        chunk.range.offset === 0 &&
+        chunk.range.length === 64,
+    ),
+  );
+  await client.connect(
+    new StdioClientTransport({
+      command: process.execPath,
+      args: [entrypoint, "mcp"],
+      cwd: repository,
+      env: environment,
+      stderr: "pipe",
+    }),
+    { timeout: 30_000 },
+  );
+  const inspectedMcp = await call("inspect_firmware_regions", { path });
+  const mcpEvidence = parseEvidence(inspectedMcp.evidence);
+  assert.deepEqual(verifyRegions(mcpEvidence), cliRegions);
+  const extractedMcp = await call("extract_firmware", {
+    path,
+    output_directory: join(root, "mcp-output"),
+  });
+  const mcpFiles = await verifyFiles(parseEvidence(extractedMcp.evidence));
+  const contentIdentity = (result) =>
+    result.files.map(({ relative_path, sha256, size }) => ({
+      relative_path,
+      sha256,
+      size,
+    }));
+  assert.deepEqual(contentIdentity(mcpFiles), contentIdentity(cliFiles));
+  const selected = await call("extract_firmware", {
+    path,
+    output_directory: join(root, "selected-output"),
+    range: { offset: oracle.offset, length: oracle.length },
+  });
+  const selectedFiles = await verifyFiles(parseEvidence(selected.evidence));
+  assert.equal(selectedFiles.selection.offset, oracle.offset);
+  assert.equal(selectedFiles.selection.length, oracle.length);
+  const depth = await call("extract_firmware", {
+    path,
+    output_directory: join(root, "depth-output"),
+    max_depth: 1,
+  });
+  const depthResult = firmwareResultSchemas.extract_firmware.parse(
+    depth.result,
+  );
+  assert.equal(depthResult.coverage, "partial");
+  assert.ok(depthResult.depth_limited_paths.length > 0);
+  console.log(
+    "PASS real Binwalk/Unblob: CLI, MCP, independent offsets/digests, range extraction, unknown chunks and depth limits",
+  );
+  if (process.env.REA_FIRMWARE_VERIFY_EXT4 === "1") {
+    const ext4 = join(fixtureRoot, "ext4.bin");
+    await access(ext4);
+    const response = await call("extract_firmware", {
+      path: ext4,
+      output_directory: join(root, "ext4-output"),
+    });
+    const result = firmwareResultSchemas.extract_firmware.parse(
+      response.result,
+    );
+    assert.ok(result.chunks.some((chunk) => chunk.handler === "extfs"));
+    assert.equal(result.coverage, "complete");
+    for (const [suffix, expected] of Object.entries(oracle.files))
+      assert.equal(
+        result.files.find((file) => file.relative_path.endsWith(`/${suffix}`))
+          ?.sha256,
+        expected.sha256,
+      );
+    console.log("PASS real ext4 extraction with debugfs; no mounts");
+    // Preserve the process-ownership utility while withholding all extractors.
+    const withoutExtractors = join(root, "without-extractors");
+    await access("/bin/ps");
+    await mkdir(withoutExtractors);
+    await symlink("/bin/ps", join(withoutExtractors, "ps"));
+    const missing = await cli(
+      ["extract-firmware", ext4, join(root, "missing-extractor-output")],
+      { ...environment, PATH: withoutExtractors },
+    );
+    const partial = firmwareResultSchemas.extract_firmware.parse(
+      missing.normalized_result,
+    );
+    assert.equal(partial.coverage, "partial");
+    assert.ok(JSON.stringify(partial.diagnostics).includes("debugfs"));
+    console.log(
+      "PASS real missing-extractor diagnostics retained despite Unblob exit 1",
+    );
+  }
+  if (process.env.REA_FIRMWARE_VERIFY_GHIDRA === "1") {
+    if (process.env.GHIDRA_INSTALL_DIR === undefined)
+      throw new Error(
+        "Firmware Ghidra handoff requires GHIDRA_INSTALL_DIR and Java; see docs/ghidra.md",
+      );
+    const child = mcpFiles.files.find((file) =>
+      file.relative_path.endsWith("/usr/bin/probe"),
+    );
+    assert.ok(child !== undefined);
+    await call("open_binary", { path: child.path, provider_id: "ghidra" });
+    const dossier = await call("analyze_function", {
+      procedure: "firmware_probe",
+    });
+    const evidence = parseEvidence(dossier.evidence);
+    assert.equal(
+      evidence.subject.digest.sha256,
+      oracle.files["usr/bin/probe"].sha256,
+    );
+    const pseudocode = await call("procedure_pseudo_code", {
+      procedure: "firmware_probe",
+    });
+    assert.equal(parseEvidence(pseudocode.evidence).provider.id, "ghidra");
+    assert.ok(
+      JSON.stringify(evidence.normalized_result).includes("firmware_probe"),
+    );
+    await call("close_binary", {});
+    console.log(
+      "PASS real Ghidra handoff of the selected extracted host ELF, bound to its digest",
+    );
+  }
+  assert.equal(
+    await hashFirmwareFile(path),
+    oracle.sha256,
+    "Original firmware bytes must remain unchanged",
+  );
+} finally {
+  await client.close();
+  await rm(root, { recursive: true, force: true });
+}

scripts/verify-real-ghidra-nativeaot.mjs

@@ -0,0 +1,403 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  mkdtemp,
+  mkdir,
+  readFile,
+  readdir,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { parseEvidence } from "../dist/domain/evidence.js";
+import { nativeDataTypeSchema } from "../dist/domain/nativeDataType.js";
+import { nativeLoadImageSchema } from "../dist/domain/nativeLoadImage.js";
+
+const mode = process.argv[2] ?? "symbols";
+if (
+  ![
+    "symbols",
+    "stripped",
+    "ordinary",
+    "unsupported",
+    "malformed",
+    "ambiguous",
+    "loader-failure",
+    "default-native",
+  ].includes(mode) ||
+  process.argv.length > 3
+)
+  throw new Error(
+    "Usage: verify-real-ghidra-nativeaot.mjs [symbols|stripped|ordinary|unsupported|malformed|ambiguous|loader-failure|default-native]",
+  );
+if (process.platform !== "linux" || process.arch !== "x64")
+  throw new Error(
+    "verify:ghidra:nativeaot requires a Linux x64 host; Windows host mutation is not supported.",
+  );
+for (const key of ["loader-failure", "default-native"].includes(mode)
+  ? ["GHIDRA_INSTALL_DIR"]
+  : ["GHIDRA_INSTALL_DIR", "REA_GHIDRA_NATIVEAOT_JAR"])
+  if (!process.env[key] || !isAbsolute(process.env[key]))
+    throw new Error(
+      `verify:ghidra:nativeaot prerequisite missing: absolute ${key}`,
+    );
+const fixtureRoot = resolve(
+  process.env.REA_NATIVEAOT_PROOF_FIXTURE_ROOT ??
+    "_reference/nativeaot-integration/generated/linux-x64",
+);
+const oracle = JSON.parse(
+  await readFile(join(fixtureRoot, "oracle.json"), "utf8"),
+);
+const symbolTarget = join(
+  fixtureRoot,
+  "symbols",
+  oracle.runtime === "win-x64" ? "NativeAotFixture.exe" : "NativeAotFixture",
+);
+const target =
+  mode === "stripped"
+    ? join(fixtureRoot, "stripped", basename(symbolTarget))
+    : [
+          "ordinary",
+          "unsupported",
+          "malformed",
+          "ambiguous",
+          "loader-failure",
+          "default-native",
+        ].includes(mode)
+      ? join(
+          fixtureRoot,
+          ["loader-failure", "default-native"].includes(mode)
+            ? "ordinary"
+            : mode,
+        )
+      : symbolTarget;
+const bytes = await readFile(target);
+const sha256 = hash(bytes);
+const workspace = await mkdtemp(join(tmpdir(), "rea-nativeaot-proof-"));
+const runtime = join(workspace, "runtime");
+await mkdir(runtime);
+const packageRoot = process.env.REA_NATIVEAOT_PROOF_PACKAGE_ROOT;
+if (packageRoot !== undefined && !isAbsolute(packageRoot))
+  throw new Error("REA_NATIVEAOT_PROOF_PACKAGE_ROOT must be absolute");
+const entrypoint =
+  packageRoot === undefined
+    ? fileURLToPath(new URL("./rea.mjs", import.meta.url))
+    : join(packageRoot, "scripts/rea.mjs");
+const env = {
+  PATH: process.env.PATH ?? "/usr/bin:/bin",
+  TMPDIR: runtime,
+  REA_LOG_LEVEL: "silent",
+  REA_ANALYSIS_PROVIDER: "ghidra",
+  GHIDRA_INSTALL_DIR: process.env.GHIDRA_INSTALL_DIR,
+  REA_GHIDRA_NATIVEAOT_JAR: process.env.REA_GHIDRA_NATIVEAOT_JAR,
+  GHIDRA_HEADLESS_MAXMEM: process.env.GHIDRA_HEADLESS_MAXMEM ?? "768M",
+  ...(process.env.JAVA_HOME === undefined
+    ? {}
+    : { JAVA_HOME: process.env.JAVA_HOME }),
+};
+if (mode === "default-native") delete env.REA_GHIDRA_NATIVEAOT_JAR;
+// Source-built linkage failure exercises the actual JVM loader boundary, not
+// a simulated producer report. Its class/JAR exist only in the owned workspace.
+if (mode === "loader-failure")
+  env.REA_GHIDRA_NATIVEAOT_JAR = join(workspace, "bad-extension.jar");
+async function prepareLoaderFailure() {
+  const source = join(workspace, "NativeAotExtension.java");
+  const classes = join(workspace, "classes");
+  await mkdir(classes);
+  await writeFile(
+    source,
+    `package rea.extensions.nativeaot;
+public final class NativeAotExtension {
+  static { fail(); }
+  private static void fail() { throw new IllegalStateException("REA_INITIALIZER_FIXTURE"); }
+  public NativeAotExtension() {}
+}
+`,
+  );
+  const command = (name) =>
+    process.env.JAVA_HOME === undefined
+      ? name
+      : join(process.env.JAVA_HOME, "bin", name);
+  await promisify(execFile)(
+    command("javac"),
+    ["-J-Xmx512m", "-J-XX:ActiveProcessorCount=1", "-d", classes, source],
+    { timeout: 60000 },
+  );
+  await promisify(execFile)(
+    command("jar"),
+    ["--create", "--file", env.REA_GHIDRA_NATIVEAOT_JAR, "-C", classes, "."],
+    { timeout: 60000 },
+  );
+}
+const transport = new StdioClientTransport({
+  command: process.execPath,
+  args: [entrypoint, "mcp"],
+  env,
+  stderr: "pipe",
+});
+const client = new Client({ name: "rea-nativeaot-proof", version: "1" });
+let stderr = "";
+transport.stderr?.on("data", (chunk) => {
+  stderr = (stderr + chunk.toString()).slice(-65536);
+});
+let opened = false;
+let report;
+try {
+  if (mode === "loader-failure") await prepareLoaderFailure();
+  await client.connect(transport);
+  const response = await client.callTool(
+    { name: "open_binary", arguments: { path: target, provider_id: "ghidra" } },
+    { timeout: 360000 },
+  );
+  if (
+    ["unsupported", "malformed", "ambiguous", "loader-failure"].includes(mode)
+  ) {
+    // MCP open binds a lazy session; the first inspection starts import.
+    let failure = response;
+    if (failure.isError !== true) {
+      opened = true;
+      failure = await client.callTool(
+        { name: "inspect_native_load_image", arguments: {} },
+        { timeout: 360000 },
+      );
+    }
+    assert.equal(failure.isError, true, JSON.stringify(failure));
+    const diagnostic = JSON.stringify(failure);
+    assert.match(
+      diagnostic,
+      mode === "unsupported"
+        ? /Unsupported NativeAOT RTR format/
+        : mode === "malformed"
+          ? /Reversed NativeAOT section/
+          : mode === "loader-failure"
+            ? /ExceptionInInitializerError.*REA_INITIALIZER_FIXTURE/
+            : /Ambiguous NativeAOT directory candidates/,
+    );
+    report = { mode, target, sha256, typed_failure: failure };
+  } else if (mode === "default-native") {
+    assert.notEqual(response.isError, true, JSON.stringify(response));
+    opened = true;
+    const image = nativeLoadImageSchema.parse(
+      await call("inspect_native_load_image"),
+    );
+    assert.equal(image.observations.metadata_recovery, undefined);
+    report = { mode, target, sha256, image };
+  } else {
+    assert.notEqual(response.isError, true, JSON.stringify(response));
+    opened = true;
+    const image = nativeLoadImageSchema.parse(
+      await call("inspect_native_load_image"),
+    );
+    const summary = image.observations.metadata_recovery?.[0];
+    assert.ok(
+      summary,
+      "Loaded-image inspection omitted inline runtime-format discovery",
+    );
+    assert.equal(summary.format, "dotnet-nativeaot");
+    assert.equal(
+      summary.analysis_artifact_sha256,
+      hash(await readFile(env.REA_GHIDRA_NATIVEAOT_JAR)),
+    );
+    if (mode === "ordinary") {
+      assert.equal(summary.status, "not_applicable");
+      assert.equal(summary.method_tables, 0);
+      assert.deepEqual(summary.types, []);
+      report = { mode, target, sha256, summary };
+    } else {
+      assert.ok(["complete", "partial"].includes(summary.status));
+      assert.equal(summary.format_major, 9);
+      assert.equal(summary.format_minor, 1);
+      assert.equal(summary.types.length, summary.method_tables);
+      assert.ok(summary.method_tables > 0);
+      assert.equal(
+        summary.discovery,
+        mode === "stripped" || oracle.runtime === "win-x64"
+          ? "signature-heuristic"
+          : "symbol",
+      );
+      assert.equal(summary.derived_memory.file_offset, null);
+      assert.ok(summary.coverage.frozen_objects_annotated > 0);
+      // Independent compiler/linker symbols identify fixture classes. Recovered
+      // Class_address names are never treated as the original source identities.
+      const symbols = await readFile(join(fixtureRoot, "symbols.txt"), "utf8");
+      const bias =
+        oracle.runtime === "linux-x64"
+          ? BigInt(image.observations.image_base)
+          : 0n;
+      const addressOf = (name) => {
+        const line = symbols
+          .split(/\r?\n/u)
+          .find((line) => line.split(/\s+/u).includes(name));
+        assert.ok(line, `Independent symbol missing: ${name}`);
+        const match =
+          oracle.runtime === "linux-x64"
+            ? line.match(/^([a-f0-9]+)\s/iu)
+            : line.match(/\s([a-f0-9]{16})\s/iu);
+        assert.ok(match, `Unrecognized independent symbol line: ${line}`);
+        return `0x${(BigInt(`0x${match[1]}`) + bias).toString(16)}`;
+      };
+      const fixtureSymbols =
+        oracle.symbols ??
+        (oracle.runtime === "win-x64"
+          ? {
+              base: "??_7NativeAotFixture_BaseProbe@@6B@",
+              derived: "??_7NativeAotFixture_DerivedProbe@@6B@",
+              interface: "??_7NativeAotFixture_IProbe@@6B@",
+              compute: "NativeAotFixture_DerivedProbe__Compute",
+              dispatch: "NativeAotFixture_Program__Dispatch",
+            }
+          : {
+              base: "_ZTV26NativeAotFixture_BaseProbe",
+              derived: "_ZTV29NativeAotFixture_DerivedProbe",
+              interface: "_ZTV23NativeAotFixture_IProbe",
+              compute: "NativeAotFixture_DerivedProbe__Compute",
+              dispatch: "NativeAotFixture_Program__Dispatch",
+            });
+      const lookup = (address) => {
+        const identity = summary.types.find((type) => type.address === address);
+        assert.ok(identity?.type, `Recovered identity missing at ${address}`);
+        return identity.type;
+      };
+      const derivedAddress = addressOf(fixtureSymbols.derived);
+      const baseAddress = addressOf(fixtureSymbols.base);
+      const interfaceAddress = addressOf(fixtureSymbols.interface);
+      const derived = nativeDataTypeSchema.parse(
+        await call("inspect_native_data_type", {
+          type: lookup(derivedAddress),
+        }),
+      );
+      const metadata = derived.metadata_recovery;
+      assert.ok(metadata);
+      assert.equal(metadata.original_name, null);
+      assert.equal(metadata.name_origin, "generated");
+      assert.equal(metadata.method_table_address, derivedAddress);
+      assert.equal(metadata.related_type.address, baseAddress);
+      assert.ok(
+        metadata.interfaces.some((type) => type.address === interfaceAddress),
+      );
+      assert.ok(
+        metadata.virtual_slots.some(
+          (slot) => slot.target_address === addressOf(fixtureSymbols.compute),
+        ),
+      );
+      const compute = await call("analyze_function", {
+        procedure: addressOf(fixtureSymbols.compute),
+      });
+      assert.ok(compute.pseudocode.trim());
+      assert.doesNotMatch(
+        compute.pseudocode,
+        /\b__thiscall\b/u,
+        "Upstream x64 calling-convention rewrite leaked into recovered pseudocode",
+      );
+      assert.match(compute.pseudocode, /(?:0xb|\b11\b|<<)/u);
+      const dispatch = await call("analyze_function", {
+        procedure: addressOf(fixtureSymbols.dispatch),
+      });
+      assert.ok(dispatch.pseudocode.trim());
+      for (const literal of oracle.expected_strings)
+        assert.ok(
+          (await call("search_strings", { pattern: literal })).length > 0,
+          `Frozen string missing: ${literal}`,
+        );
+      const observed = await call("read_bytes", {
+        address: metadata.virtual_slots[0].slot_address,
+        length: 8,
+      });
+      assert.equal(observed.complete, true);
+      assert.equal(
+        `0x${Buffer.from(observed.bytes_hex, "hex").readBigUInt64LE().toString(16)}`,
+        metadata.virtual_slots[0].target_address,
+      );
+      report = { mode, target, sha256, summary, derived, compute, dispatch };
+      await call("close_binary");
+      opened = false;
+      // One representative CLI boundary, selected explicitly to avoid repeated
+      // full NativeAOT auto-analysis during each focused iteration.
+      if (process.env.REA_NATIVEAOT_PROOF_CLI === "1") {
+        const { stdout } = await promisify(execFile)(
+          process.execPath,
+          [
+            entrypoint,
+            "inspect-native-data-type",
+            target,
+            "--type",
+            lookup(derivedAddress),
+            "--provider",
+            "ghidra",
+            "--json",
+          ],
+          { env, timeout: 360000, maxBuffer: 16 * 1024 * 1024 },
+        );
+        const evidence = parseEvidence(JSON.parse(stdout));
+        assert.equal(evidence.subject.digest.sha256, sha256);
+        assert.deepEqual(
+          evidence.normalized_result.metadata_recovery,
+          metadata,
+        );
+        report.cli_metadata = evidence.normalized_result.metadata_recovery;
+      }
+    }
+  }
+  assert.equal(
+    hash(await readFile(target)),
+    sha256,
+    "Input executable changed",
+  );
+  if (opened) {
+    await call("close_binary");
+    opened = false;
+  }
+  await client.close();
+  assert.deepEqual(
+    await readdir(runtime),
+    [],
+    "Owned runtime/project/extension files leaked after close",
+  );
+  const capture = process.env.REA_NATIVEAOT_PROOF_CAPTURE_DIR;
+  if (capture !== undefined) {
+    assert.ok(isAbsolute(capture));
+    await mkdir(capture, { recursive: true });
+    await writeFile(
+      join(capture, `${oracle.runtime}-${mode}.json`),
+      JSON.stringify(report, null, 2) + "\n",
+    );
+  }
+  console.log(
+    `PASS real Ghidra NativeAOT ${oracle.runtime}/${mode}: MCP metadata, source identity and owned cleanup${report?.compute ? ", independent type/slot oracle and pseudocode" : ""}${report?.cli_metadata ? ", equivalent CLI" : ""}`,
+  );
+} catch (error) {
+  console.error(stderr);
+  throw error;
+} finally {
+  if (opened)
+    await client
+      .callTool({ name: "close_binary", arguments: {} })
+      .catch(() => {});
+  await client.close().catch(() => {});
+  await rm(workspace, { recursive: true, force: true });
+}
+function hash(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+async function call(name, args = {}) {
+  const response = await client.callTool(
+    { name, arguments: args },
+    { timeout: 360000 },
+  );
+  assert.notEqual(response.isError, true, JSON.stringify(response));
+  if (name === "close_binary") return response.structuredContent;
+  const evidence = parseEvidence(response.structuredContent.evidence);
+  assert.equal(evidence.subject.digest.sha256, sha256);
+  assert.deepEqual(
+    evidence.normalized_result,
+    response.structuredContent.result,
+  );
+  return response.structuredContent.result;
+}

scripts/verify-real-ida.mjs

@@ -0,0 +1,256 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { access, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { parseArgs, promisify } from "node:util";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+
+const { values } = parseArgs({
+  options: {
+    target: { type: "string" },
+    procedure: { type: "string", default: "rea_fixture_add" },
+    "package-root": { type: "string" },
+    report: { type: "string" },
+  },
+});
+if (values.target === undefined || process.env.REA_IDA_MCP_CONFIG === undefined)
+  throw new Error(
+    "IDA verification requires --target and REA_IDA_MCP_CONFIG; see docs/ida-provider.md. No toolchain is installed by this lane.",
+  );
+const packageRoot = resolve(
+  values["package-root"] ?? fileURLToPath(new URL("..", import.meta.url)),
+);
+const target = resolve(values.target);
+const entry = join(packageRoot, "scripts", "rea.mjs");
+const importBuilt = (path) =>
+  import(pathToFileURL(join(packageRoot, "dist", path)).href);
+const [
+  { toolContract },
+  { evidenceSchema },
+  { functionDossierSchema },
+  { readIdaConfiguration },
+  { createIdaMcpConnection },
+] = await Promise.all([
+  importBuilt("contracts/toolContracts.js"),
+  importBuilt("domain/evidence.js"),
+  importBuilt("domain/hopperValues.js"),
+  importBuilt("ida/IdaConfiguration.js"),
+  importBuilt("ida/IdaMcpConnection.js"),
+]);
+const registration = readIdaConfiguration(process.env.REA_IDA_MCP_CONFIG);
+if (!registration.ok) throw registration.error;
+const config = registration.value;
+const environment = Object.fromEntries(
+  Object.entries({
+    ...process.env,
+    REA_ANALYSIS_PROVIDER: "ida",
+    REA_LOG_LEVEL: "error",
+  }).filter(([, value]) => value !== undefined),
+);
+const report = {
+  passed: false,
+  mode: config.mode,
+  checks: [],
+  observations: [],
+};
+let phase = "target admission";
+const workspaces = new Set();
+const databases = new Set();
+const digest = async () => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(target)) hash.update(chunk);
+  return hash.digest("hex");
+};
+const observe = (input) => {
+  const evidence = evidenceSchema.parse(input);
+  assert.equal(evidence.provider.id, "ida");
+  assert.equal(evidence.provider.version, "1");
+  assert.equal(evidence.analysis_profile.parameters.cache_policy, "live");
+  assert.equal(evidence.analysis_profile.parameters.engine_version, null);
+  assert.ok(evidence.limitations.length > 0);
+  assert.ok(
+    evidence.locations.some((location) => location.kind === "artifact-path"),
+  );
+  if (config.mode === "headless") {
+    assert.notEqual(evidence.raw_result.metadata_before.input_path, target);
+    workspaces.add(dirname(evidence.raw_result.metadata_before.input_path));
+    for (const observation of evidence.raw_result.observations) {
+      assert.equal(typeof observation.arguments.database, "string");
+      databases.add(observation.arguments.database);
+    }
+  }
+  report.observations.push(evidence);
+  return evidence.normalized_result;
+};
+const cli = async () => {
+  phase = "production CLI function analysis";
+  const { stdout } = await promisify(execFile)(
+    process.execPath,
+    [
+      entry,
+      "function",
+      target,
+      values.procedure,
+      "--provider",
+      "ida",
+      "--json",
+    ],
+    {
+      env: environment,
+      timeout: config.timeoutMs * 3,
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  ).catch((cause) => {
+    report.failed_cli = { stdout: cause.stdout, stderr: cause.stderr };
+    throw cause;
+  });
+  const dossier = functionDossierSchema.parse(observe(JSON.parse(stdout)));
+  assert.ok(dossier.pseudocode.length > 0);
+  assert.ok(dossier.assembly.length > 0);
+  assert.equal(dossier.procedure.body.available, false);
+  report.checks.push("production CLI and complete function Evidence");
+  return dossier;
+};
+const mcp = async (cliDossier) => {
+  const client = new Client({ name: "rea-real-ida-verifier", version: "1" });
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [entry, "mcp"],
+    env: environment,
+    stderr: "pipe",
+  });
+  transport.stderr?.on("data", () => undefined);
+  const call = async (name, args) => {
+    phase = `production MCP ${name}`;
+    const result = await client.callTool(
+      { name, arguments: args },
+      { timeout: config.timeoutMs * 2 },
+    );
+    if (result.isError === true) report.failed_tool_result = result;
+    assert.notEqual(result.isError, true);
+    return toolContract(name).outputSchema.parse(result.structuredContent);
+  };
+  let opened = false;
+  try {
+    await client.connect(transport, { timeout: config.timeoutMs });
+    await call("open_binary", { path: target, provider_id: "ida" });
+    opened = true;
+    const analyzed = await call("analyze_function", {
+      procedure: values.procedure,
+    });
+    const dossier = functionDossierSchema.parse(observe(analyzed.evidence));
+    assert.deepEqual(dossier.procedure, cliDossier.procedure);
+    assert.equal(dossier.pseudocode, cliDossier.pseudocode);
+    assert.deepEqual(dossier.assembly, cliDossier.assembly);
+    assert.equal(analyzed.evidence_id, analyzed.evidence.evidence_id);
+    for (const [name, args] of [
+      ["list_procedures", {}],
+      ["list_strings", {}],
+      ["procedure_address", { procedure: dossier.procedure.name }],
+      ["procedure_assembly", { procedure: dossier.procedure.address }],
+      ["procedure_callees", { procedure: dossier.procedure.address }],
+      ...(config.mode === "attached"
+        ? [["procedure_callers", { procedure: dossier.procedure.address }]]
+        : []),
+      ["search_procedures", { pattern: dossier.procedure.name }],
+      ["procedure_pseudo_code", { procedure: dossier.procedure.address }],
+      ["read_function_instructions", { procedure: dossier.procedure.address }],
+      ["search_strings", { pattern: "a.b", mode: "literal" }],
+      ["xrefs", { address: dossier.procedure.address }],
+    ]) {
+      const result = await call(name, args);
+      observe(result.evidence);
+    }
+    const invalid = await client.callTool({
+      name: "xrefs",
+      arguments: { address: "not-an-address" },
+    });
+    assert.equal(invalid.isError, true);
+    assert.equal(invalid.structuredContent.error.code, "invalid_request");
+    await call("close_binary", {});
+    opened = false;
+    report.checks.push(
+      "one MCP connection, target selection, analysis/search/xrefs, invalid input, and close",
+    );
+    report.checks.push(
+      "CLI/MCP function identity, pseudocode, assembly, and raw Evidence parity",
+    );
+  } finally {
+    const completedPhase = phase;
+    if (opened) await call("close_binary", {});
+    await client.close();
+    phase = completedPhase;
+  }
+};
+const cleanup = async () => {
+  phase = "upstream lifecycle verification";
+  const upstream = createIdaMcpConnection(config);
+  try {
+    await upstream.connect();
+    if (config.mode === "attached") {
+      const metadata = await upstream.call("get_metadata", {});
+      assert.equal(metadata.sha256.toLowerCase(), await digest());
+      report.checks.push(
+        "existing GUI target remains open with the original input identity",
+      );
+    } else {
+      const inventory = await upstream.call("idb_list", {});
+      assert.ok(
+        inventory.sessions.every(
+          (session) => !databases.has(session.session_id),
+        ),
+      );
+      for (const workspace of workspaces)
+        await assert.rejects(access(workspace), { code: "ENOENT" });
+      report.checks.push(
+        "owned database IDs absent from upstream discovery and private workspaces removed",
+      );
+    }
+  } finally {
+    await upstream.close();
+  }
+};
+try {
+  const before = await digest();
+  await mcp(await cli());
+  await cleanup();
+  assert.equal(await digest(), before);
+  report.checks.push("original binary unchanged and never executed");
+  report.passed = true;
+} catch (cause) {
+  report.failure = {
+    phase,
+    message: cause instanceof Error ? cause.message : String(cause),
+  };
+  process.exitCode = 1;
+} finally {
+  if (values.report !== undefined)
+    await writeFile(
+      resolve(values.report),
+      `${JSON.stringify(report, null, 2)}\n`,
+      { mode: 0o600 },
+    );
+  console.log(
+    JSON.stringify(
+      {
+        passed: report.passed,
+        mode: report.mode,
+        checks: report.checks,
+        ...(report.passed
+          ? {}
+          : {
+              failed_phase: phase,
+              detail: "Use --report for private local diagnostics.",
+            }),
+      },
+      null,
+      2,
+    ),
+  );
+}

scripts/verify-test-discovery.mjs

@@ -0,0 +1,65 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { promisify } from "node:util";
+
+import { compareTestDiscovery } from "./lib/test-discovery.mjs";
+
+const execute = promisify(execFile);
+const root = resolve(import.meta.dirname, "..");
+
+const temporary = await mkdtemp(join(tmpdir(), "rea-test-discovery-"));
+try {
+  const output = join(temporary, "discovery.json");
+  await execute(
+    process.execPath,
+    [
+      join(root, "node_modules/vitest/vitest.mjs"),
+      "list",
+      "--filesOnly",
+      `--json=${output}`,
+    ],
+    { cwd: root, maxBuffer: 8 * 1024 * 1024 },
+  );
+  const files = await execute(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      "src",
+      "tests",
+    ],
+    { cwd: root, maxBuffer: 8 * 1024 * 1024 },
+  );
+  const expected = [];
+  for (const path of files.stdout
+    .split("\0")
+    .filter((path) => path.endsWith(".test.ts"))) {
+    try {
+      if ((await stat(join(root, path))).isFile()) expected.push(path);
+    } catch (cause) {
+      if (cause.code !== "ENOENT") throw cause;
+    }
+  }
+  const report = compareTestDiscovery(
+    expected,
+    JSON.parse(await readFile(output, "utf8")),
+    root,
+  );
+  if (
+    report.missing.length ||
+    report.unexpected.length ||
+    report.duplicates.length
+  ) {
+    console.error(JSON.stringify(report, null, 2));
+    process.exitCode = 1;
+  } else
+    console.log(`Discovered all ${report.discovered} test files exactly once.`);
+} finally {
+  await rm(temporary, { recursive: true, force: true });
+}

scripts/verify-windows-native.mjs

@@ -79,13 +79,43 @@ try {
   await mkdir(sourceDirectory);
   const source = join(sourceDirectory, "target.bin");
   await writeFile(source, Buffer.alloc(1024 * 1024, 0x37));
+  const sourceIdentity = native.call("open", [source]);
+  try {
+    for (const requested of [
+      source.replaceAll("\\", "/"),
+      source.replace(/\\/u, "/"),
+    ]) {
+      const admitted = native.call("open", [requested]);
+      try {
+        assert.equal(admitted.requestedPath, requested);
+        assert.equal(admitted.finalPath, sourceIdentity.finalPath);
+        assert.equal(admitted.fileId, sourceIdentity.fileId);
+        assert.equal(native.call("read", [admitted.handle, 0, 1])[0], 0x37);
+      } finally {
+        native.call("close", [admitted.handle]);
+      }
+    }
+  } finally {
+    native.call("close", [sourceIdentity.handle]);
+  }
+  for (const rejected of [
+    source.replace(/^([A-Za-z]):\\/u, "$1:"),
+    `${sourceDirectory}/../source/target.bin`,
+    `${sourceDirectory}//target.bin`,
+    `${source}:stream`,
+    `\\\\?\\${source.replaceAll("\\", "/")}`,
+    "//localhost/share/target.bin",
+  ])
+    assert.throws(() => native.call("open", [rejected]));
+  report.controls.ordinaryDriveSeparatorsAndRequestedIdentity = true;
   const snapshotOwner = WindowsPrivateRuntime.create(
-    workspace,
+    workspace.replace(/\\/u, "/"),
     "single-flight-",
   );
   try {
     const rejectedController = new AbortController();
-    const accepted = snapshotOwner.snapshot(source, "accepted.bin");
+    const requestedSource = source.replaceAll("\\", "/");
+    const accepted = snapshotOwner.snapshot(requestedSource, "accepted.bin");
     const rejected = snapshotOwner.snapshot(
       source,
       "rejected.bin",
@@ -94,6 +124,7 @@ try {
     rejectedController.abort();
     await assert.rejects(rejected, /Runtime snapshot is still pending/u);
     const completed = await accepted;
+    assert.equal(completed.source.requestedPath, requestedSource);
     assert.equal(
       completed.sha256,
       createHash("sha256")
@@ -147,7 +178,7 @@ try {
   );
   assert.throws(() => native.call("open", [source + ":stream"]));
   const runtime = native.call("runtime_create", [
-    workspace,
+    workspace.replaceAll("\\", "/"),
     "private root with spaces-",
   ]);
   const sentinel = join(sourceDirectory, "sentinel");
@@ -316,6 +347,23 @@ setInterval(()=>{},1000);\n`,
   assert.match(settled.output, /observed/u);
   native.call("process_close", [exited.handle]);
   report.processes.normalExitAndOutput = true;
+  const forwardCommand = process.execPath.replaceAll("\\", "/");
+  const forwardProcess = native.call("process_spawn", [
+    forwardCommand,
+    [forwardCommand, "-e", "console.log('forward executable')"]
+      .map(quote)
+      .join(" "),
+    workspace,
+    environment,
+  ]);
+  try {
+    const completed = await wait(forwardProcess);
+    assert.equal(completed.exitCode, 0);
+    assert.match(completed.output, /forward executable/u);
+    report.processes.ordinaryDriveSeparators = true;
+  } finally {
+    native.call("process_close", [forwardProcess.handle]);
+  }
   const boundaryFixture = process.argv[3];
   if (boundaryFixture !== undefined) {
     const before = JSON.parse(

server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/morluto/rea",
     "source": "github"
   },
-  "version": "4.0.1",
+  "version": "4.1.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "rea-agents",
-      "version": "4.0.1",
+      "version": "4.1.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

skills/reverse-engineer-anything/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: reverse-engineer-anything
-description: Reverse engineer native, managed, Electron/JavaScript, packaged, and browser applications with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
+description: Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
 metadata:
-  version: "24"
-  tool_count: 118
-  catalog_digest: "b4f7e5860d90b029876b58fe7cd4a8041fef1f2add23440e37e90827d808e503"
+  version: "26"
+  tool_count: 126
+  catalog_digest: "e21455dd7d64af94e0b07aff55ab82f03a37e46729ece51be38b50083d2d5b55"
 ---
 
 # REA
@@ -15,32 +15,110 @@ behavior not established by available source. For ordinary analysis of a
 complete source repository, use normal repository tools and do not run REA
 readiness or provider commands.
 
+## Connect only when needed
+
+Installing this skill supplies instructions; it does not register the REA MCP
+server, install analysis engines, or add tools to an already-running agent.
+
+If REA tools are available and their registration is not known to be stale,
+proceed directly to the target. Do not run diagnostics or setup before every
+investigation. Use the connected server's actual tool list and input schemas;
+a skill installed from repository main may describe capabilities absent from
+an older npm release. Keep complete inline Evidence when that server does not
+advertise retained references.
+
+When tools are absent or registration is stale:
+
+1. Diagnose without changing files. For Codex, run
+   `npx -y rea-agents@latest doctor --client codex --json`. Substitute the current
+   supported client: `claude_code`, `claude_desktop`, `codex`, `cursor`,
+   `gemini_cli`, `windsurf`, `devin`, `opencode`, `antigravity`, `copilot_cli`,
+   `commandcode`, or `vscode`. If the client is unknown, use `doctor --json` and
+   inspect its registration results before choosing a setup scope.
+2. Distinguish the reason. Missing, malformed, or stale registration needs a
+   scoped configuration repair. An aligned registration with no tools in the
+   active session needs a restart/reconnection; doctor cannot prove that the
+   current agent has connected. A missing provider affects only tasks requiring
+   that provider: static JavaScript inspection needs neither Hopper nor Ghidra,
+   and Android inspection has separate bring-your-own JADX/Java prerequisites.
+3. For a configuration repair, prepare the read-only plan:
+   `npx -y rea-agents@latest setup --client codex --dry-run --json`.
+   Use the current client's ID, show its exact proposed paths, backups, and
+   changes, and obtain approval before setup writes configuration or installs
+   Hopper. Setup normally installs the matching bundled skill too; include that
+   replacement in the reviewed plan. After approval, apply the same scope with
+   `npx -y rea-agents@latest setup --client codex --yes`. Add `--install-hopper`
+   only if that separate installation was needed and explicitly approved.
+4. Restart/reconnect the affected agent. Verify that REA tools actually appear
+   in the session, then resume the original investigation. If they remain
+   absent, inspect the client's MCP launch error rather than repeating setup.
+
+REA setup never installs or upgrades Node.js, npm, Homebrew, Java, Ghidra, IDA,
+JADX, Binwalk, or Unblob. Use existing prerequisites; do not install unrelated
+software to repair
+MCP registration. For an unsupported client, use manual stdio registration
+with a version-pinned `rea-agents` package or continue through the CLI.
+
+A concrete CLI fallback for an operator-supplied JavaScript tree or ASAR is:
+
+```bash
+npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
+```
+
+No MCP registration or native engine is required. Read the returned Evidence,
+graph, limitations, and unknowns with the same care as an MCP result; the CLI
+returns the Evidence record directly. This fallback does not establish that
+MCP is configured. Native CLI tasks still require their selected engine.
+
 ## Route the target first
 
-Choose the first tool from the target the user supplied. Do not call
-`open_binary` unless the target is native or an analysis database.
+Choose the first tool from the target the user supplied. Use `open_binary` for
+active-target native or archive workflows; target-free tools take their own
+explicit path or endpoint and do not need it.
 
 - ASAR or extracted JavaScript/Electron tree:
   `analyze_javascript_application`.
-- Archive, application package, ZIP/APK/IPA/MSIX/AppX, or DMG:
+- Archive/package member inventory (ZIP/APK/IPA/MSIX/AppX or DMG):
   `open_binary` with the supplied local path; use `inspect_artifact` when its
   graph and findings help answer the question.
+- Android APK code, classes, methods, or incoming references:
+  `inspect_android_package`, then focused Android tools when advertised.
+  Archive member inventory still uses the archive route above.
 - Managed PE/CLI assembly: `inspect_managed_artifact`.
+- Firmware image: `inspect_firmware_regions` when advertised. Use
+  `extract_firmware` when extraction is requested, with a caller-selected new
+  absolute output directory. These tools use caller-supplied Binwalk/Unblob on
+  Linux; see the [firmware guide](https://github.com/morluto/rea/blob/main/docs/firmware-analysis.md).
+- .NET NativeAOT PE/ELF: native Ghidra analysis. Native code can yield pseudocode;
+  consult the NativeAOT workflow in `references/native-and-artifacts.md` for
+  optional metadata recovery and its supported host/layout boundary.
 - User-owned browser page already open: `list_browser_targets`.
 - User-owned Electron runtime already open: `list_electron_targets`.
 - Native executable, library, or analysis database: `open_binary`, then
   use focused analysis tools directly; call `binary_overview` when metadata or
-  inventory context is useful.
+  inventory context is useful and available from the selected provider.
+
+For an existing IDA MCP configuration, use `open_binary` with the original
+input binary and `provider_id: "ida"`; do not pass an `.idb` or `.i64` database.
+The legacy attached profile binds the already-open GUI input by SHA-256 and
+leaves its database open. The modern headless profile creates and closes an
+owned private database without saving. Installation and registration reuse
+[mrexodia/ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp); see the
+[IDA provider guide](https://github.com/morluto/rea/blob/main/docs/ida-provider.md).
+Proceed directly to `analyze_function`, pseudocode, or function/string searches
+after opening; IDA does not supply `binary_overview`. Consult session availability
+when composing broader workflows. Modern direct callers and unsupported dossier
+facets remain unknown; live IDA results are not replayed from snapshots.
 
 If the app is missing, ask which app to inspect. Resolve a human-readable app
 name to one clear installed artifact when possible; ask only when matches are
 ambiguous. Never choose an example app on the user's behalf.
 
 In a target-free session, use `open_binary` to bind any archive/package or
-native target whose analysis tool operates on the active target. Do not call a
-tool hidden from `tools/list`; inspect `binary_session` with
-`detail: "capabilities"` for the exact remediation when a desired capability
-is unavailable.
+native target whose analysis tool operates on the active target. Do not call an
+unadvertised tool; inspect `binary_session` with `{}` and its
+`result.tool_availability` for availability reasons and remediation. The tool
+list stays complete; availability depends on the operation, target, and host.
 
 ## Work summary-first
 
@@ -98,23 +176,13 @@ as complete while required questions remain open.
   [references/native-and-artifacts.md](references/native-and-artifacts.md)
 - ASARs, extracted JavaScript, feature tracing, and version comparison:
   [references/javascript-applications.md](references/javascript-applications.md)
+- Android APK declarations, classes, methods, and static references:
+  [references/android-applications.md](references/android-applications.md)
 - Passive browser/Electron observation and static/runtime reconciliation:
   [references/runtime-observation.md](references/runtime-observation.md)
 - Evidence paging, comparisons, residual unknowns, and verification:
   [references/evidence-workflows.md](references/evidence-workflows.md)
 
-## Readiness and setup
-
-The readiness rule is conditional: when REA tools are available and their
-registration is not known to be stale, proceed directly; do not run `doctor`
-before every task. Run `npx -y rea-agents@latest doctor` when the MCP server or
-required provider is unavailable, registration is reported stale, or the user
-asks for an environment diagnosis. Propose
-`npx -y rea-agents@latest setup` only when doctor identifies an alignment or
-provider problem. Show the exact plan and obtain approval before setup writes
-configuration or installs Hopper. Restart the agent after MCP registration
-changes; direct CLI commands remain available immediately.
-
 ## Finish the task
 
 Explain findings in plain language and tie them to returned evidence. When the

skills/reverse-engineer-anything/references/android-applications.md

@@ -0,0 +1,31 @@
+# Android application artifacts
+
+Use the connected server's advertised Android tools. Repository main and npm
+4.1.0 include this family. A skill installation alone cannot add it to an
+older server.
+
+Start with `inspect_android_package` on the caller's APK path for package
+identity, manifest declarations, coverage, and inline Evidence. Use
+`search_android_classes` to find candidates, `inspect_android_class` for one
+class's members, `inspect_android_method` for decompilation, and
+`trace_android_references` for incoming static references. Each call takes its
+own APK path and explicit selectors; do not open a native session first.
+Choose an `overload_index` from the class inventory when methods are ambiguous
+instead of guessing.
+
+The provider requires a separately supplied headless JADX MCP JAR 0.7.1 and
+Java 17 or newer. `REA_JADX_MCP_JAR` selects the absolute JAR path; `JAVA_HOME`
+can select Java. REA setup does not install or configure that JAR, and doctor
+provider scopes cover Hopper/Ghidra rather than JADX. Use existing tools and
+report missing prerequisites for the Android task specifically.
+
+Real verification covers Linux. macOS has the POSIX launch boundary but no
+claimed real-provider verification; Windows is unsupported. Calls use one
+worker, a bounded JVM heap, and provider deadlines. The APK is never launched,
+and no emulator is required.
+
+Manifest entries and decompiled text are static observations, not execution or
+policy enforcement. Incoming references are recovered static relationships;
+reflection, dynamic loading, and unresolved calls remain unknown. Preserve
+artifact digests, locations, diagnostics, and incomplete coverage. For archive
+members rather than code analysis, use `open_binary` and `inspect_artifact`.

skills/reverse-engineer-anything/references/javascript-applications.md

@@ -15,7 +15,9 @@ registration, defaults, or policy enforcement from static analysis.
 
 Use `trace_application_feature` on existing application Evidence for one
 literal node ID, route, string, API, IPC channel, module, or native export.
-Choose a direction and include the complete application Evidence inline. Include
+Choose a direction and reuse the returned application Evidence ID when the
+connected server advertises retained references, or supply complete Evidence
+inline. Include
 Hopper or Ghidra Evidence only when its artifact digest matches exactly.
 
 For version comparison, analyze each version once, then call
@@ -27,10 +29,25 @@ opposite-side coverage; otherwise report unknown.
 When the question asks how one exact exported callable's returned object shape
 changed, analyze each version once and then call
 `compare_javascript_export_shapes` with explicit module paths and export names.
-Include the complete Evidence records from both analysis calls. Accept variant
+Use the returned IDs on the same connection, or complete inline Evidence
+records, from both analysis calls. Accept variant
 pairing only through the tool's unique exact literal discriminant. Cite the
 comparison Evidence and report JSON Pointer changes; dynamic values, ambiguous
 variants, and incomplete parent-property coverage stay unknown. This is static
 inference, not runtime behavior. When runtime semantics are needed, run
 behavioral probes against the relevant application versions and capture them
 through the available browser, Electron, or process workflows.
+
+## Reusing application Evidence
+
+When advertised by the connected server, application trace and compare tools
+accept complete inline Evidence or
+`{"kind":"retained-evidence","evidence_id":"ev_<64 lowercase hex characters>"}`
+for their application input (`application`, or `left`/`right`). This notation is
+a template: replace it with the actual returned ID. Versions before 4.1.0 accept only full
+inline Evidence. Use the exact ID
+returned by the producer on the same MCP connection. Resolution does not run
+analysis or select a provider; findings remain inline. Native observation
+arrays still take full Evidence. `close_binary` clears retained references;
+export a bundle before closing, or supply portable inline Evidence in another
+connection. A missing reference includes its ID and recovery guidance.

skills/reverse-engineer-anything/references/native-and-artifacts.md

@@ -37,6 +37,31 @@ assembly. Keep managed/native boundaries and unavailable reconstruction facts
 explicit. A bring-your-own reconstruction oracle is separate from the canonical
 parser and must not become an implicit setup dependency.
 
+### .NET NativeAOT
+
+NativeAOT binaries contain native machine code, so ordinary CIL decompilers
+cannot recover the original method bodies. When managed metadata/CIL is absent,
+classify that as a native-analysis route rather than claiming source recovery.
+Open the native image with the selected deep provider and inspect functions,
+strings, calls, and references; describe decompiler output as pseudocode and
+inference.
+
+NativeAOT images can be PE/COFF, ELF, or Mach-O executables and shared
+libraries. Use file bytes and loader metadata rather than suffixes to identify
+them. For packaged apps, inventory/extract with REA's artifact tools and retain
+the exact contained image identity. PDB, ELF debug, or dSYM sidecars are
+additional evidence only when the provider accepts and matches them.
+
+For deeper type recovery, the optional third-party
+[Ghidra NativeAOT analyzer](https://github.com/Washi1337/ghidra-nativeaot)
+rehydrates ReadyToRun metadata and can recover method tables, type relationships,
+frozen objects, and strings. This is a Ghidra extension with its own install and
+interactive workflow; it is not currently part of REA's managed parser or
+headless Ghidra bridge. Treat its annotations as analysis evidence, retain the
+binary identity, and do not present recovered types as original source. Header
+discovery may require a symbol or analyst identification of the ReadyToRun
+header, depending on the binary and analyzer version.
+
 ## Packages and extraction
 
 Use `inspect_artifact` for application bundles, archives, ZIP/APK/IPA/MSIX/AppX,
@@ -59,7 +84,7 @@ separate filesystem-writing operation.
 For headerless DOS COM, explicitly open with `format: "dos-com"` (CLI
 `--target-format dos-com`). Inspect the load image before trusting function
 analysis: the entry is `0x10100`, file offset zero, with imposed real-mode segment
-context. PSP/stack/device state remains unmodeled. See [DOS guide](../../../docs/ghidra-dos.md).
+context. PSP/stack/device state remains unmodeled. See [DOS guide](https://github.com/morluto/rea/blob/main/docs/ghidra-dos.md).
 
 ### Function annotations in Ghidra
 

src/android/AndroidTargetSnapshot.ts

@@ -0,0 +1,46 @@
+import { constants, createReadStream } from "node:fs";
+import { chmod, copyFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { AnalysisInputError } from "../domain/analysisErrorCore.js";
+import type { AndroidOperation } from "../domain/androidAnalysis.js";
+
+/** Stream a local file digest without retaining the APK or JAR in memory. */
+export const hashAndroidFile = async (path: string): Promise<string> => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+};
+
+/** Bind decompiler input to the admitted artifact, even if the original changes. */
+export const snapshotAndroidTarget = async (
+  path: string,
+  sha256: string,
+  root: string,
+  operation: AndroidOperation,
+): Promise<string> => {
+  const snapshot = join(root, "target.apk");
+  await copyFile(path, snapshot, constants.COPYFILE_EXCL);
+  await chmod(snapshot, 0o400);
+  if ((await hashAndroidFile(snapshot)) !== sha256)
+    throw new AnalysisInputError(operation, undefined, [
+      {
+        path: ["path"],
+        reason: "invalid_value",
+        message:
+          "APK bytes changed after admission; retry against a stable file.",
+      },
+    ]);
+  return snapshot;
+};
+
+/** Fingerprint the actual immutable engine bytes executed for this observation. */
+export const snapshotAndroidEngine = async (
+  source: string,
+  root: string,
+): Promise<{ path: string; sha256: string }> => {
+  const path = join(root, "engine.jar");
+  await copyFile(source, path, constants.COPYFILE_EXCL);
+  await chmod(path, 0o400);
+  return { path, sha256: await hashAndroidFile(path) };
+};

src/android/JadxAnalysis.ts

@@ -0,0 +1,351 @@
+import type { z } from "zod";
+import type { AndroidRequest } from "../domain/androidAnalysis.js";
+import { androidResultSchemas } from "../domain/androidAnalysis.js";
+import {
+  AnalysisCapabilityUnavailableError,
+  AnalysisInputError,
+  AnalysisOutputError,
+} from "../domain/analysisErrorCore.js";
+import type { JsonValue } from "../domain/jsonValue.js";
+import {
+  jadxAppSchema,
+  jadxClassPageSchema,
+  jadxClassSchema,
+  jadxLoadSchema,
+  jadxMethodSchema,
+  jadxXrefsSchema,
+  normalizeJadxText,
+} from "./JadxProtocol.js";
+
+/** The adapter consumes tool payloads, never provider RPC details outside this layer. */
+export interface JadxToolPort {
+  json(
+    name: string,
+    input: Readonly<Record<string, JsonValue>>,
+  ): Promise<JsonValue>;
+  text(
+    name: string,
+    input: Readonly<Record<string, JsonValue>>,
+  ): Promise<string>;
+}
+
+type Engine = z.infer<
+  typeof androidResultSchemas.inspect_android_package
+>["engine"];
+type ClassSummary = z.infer<typeof jadxClassSchema>;
+
+const methodsOf = (summary: ClassSummary) => {
+  const seen = new Map<string, number>();
+  return summary.methods.map((method) => {
+    const index = seen.get(method.name) ?? 0;
+    seen.set(method.name, index + 1);
+    return {
+      name: method.name,
+      reported_signature: method.signature,
+      overload_index: index,
+      is_constructor: method.is_constructor,
+      dex_descriptor: null,
+    };
+  });
+};
+
+const inputFailure = (
+  request: AndroidRequest,
+  field: string,
+  message: string,
+): never => {
+  throw new AnalysisInputError(request.operation, undefined, [
+    { path: [field], reason: "invalid_value", message },
+  ]);
+};
+
+const classSummary = async (
+  tools: JadxToolPort,
+  request: Exclude<
+    AndroidRequest,
+    { operation: "inspect_android_package" | "search_android_classes" }
+  >,
+): Promise<ClassSummary> => {
+  const raw = await tools.json("get_class_summary", {
+    class_name: request.input.class_name,
+  });
+  if (
+    raw !== null &&
+    typeof raw === "object" &&
+    !Array.isArray(raw) &&
+    typeof raw.error === "string"
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      `JADX class summary failed: ${raw.error}`,
+    );
+  const summary = jadxClassSchema.safeParse(raw);
+  if (!summary.success)
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX class summary failed or was malformed; negative counts are not an empty class",
+      { cause: summary.error },
+    );
+  const value = summary.data;
+  if (value.full_name !== request.input.class_name)
+    inputFailure(
+      request,
+      "class_name",
+      `Exact class ${request.input.class_name} resolved to ${value.full_name}; use the fully qualified class name from search_android_classes.`,
+    );
+  if (
+    value.method_count !== value.methods.length ||
+    value.field_count !== value.fields.length ||
+    value.inner_class_count !== value.inner_classes.length
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX class member counts do not match the returned inventory",
+    );
+  return value;
+};
+
+const inspectPackage = async (
+  tools: JadxToolPort,
+  loaded: z.infer<typeof jadxLoadSchema>,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const app = jadxAppSchema.parse(await tools.json("get_app_info", {}));
+  const manifest = normalizeJadxText(
+    await tools.text("get_android_manifest", {}),
+  );
+  return androidResultSchemas.inspect_android_package.parse({
+    engine,
+    package_name: app.package || null,
+    version_name: app.version_name || null,
+    version_code: app.version_code || null,
+    min_sdk: app.min_sdk || null,
+    target_sdk: app.target_sdk || null,
+    permissions: app.permissions,
+    manifest,
+    class_count: loaded.class_count,
+    resource_count: loaded.resource_count,
+    signature_verification: "not_performed",
+  });
+};
+
+const searchClasses = async (
+  tools: JadxToolPort,
+  request: Extract<AndroidRequest, { operation: "search_android_classes" }>,
+  loaded: z.infer<typeof jadxLoadSchema>,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const classes: string[] = [];
+  let total: number | undefined;
+  do {
+    const page = jadxClassPageSchema.parse(
+      await tools.json("list_classes", {
+        offset: classes.length,
+        limit: 200,
+      }),
+    );
+    if (
+      (total !== undefined && total !== page.total) ||
+      page.offset !== classes.length ||
+      page.limit !== 200 ||
+      page.items.length > 200
+    )
+      throw new AnalysisOutputError(
+        request.operation,
+        "JADX class pagination changed identity or counts",
+      );
+    total = page.total;
+    classes.push(...page.items);
+    if (
+      classes.length > total ||
+      (page.items.length === 0 && classes.length < total)
+    )
+      throw new AnalysisOutputError(
+        request.operation,
+        "JADX class pagination is incomplete",
+      );
+  } while (classes.length < total);
+  if (new Set(classes).size !== classes.length || total !== loaded.class_count)
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX class inventory is duplicated or differs from the loaded class count",
+    );
+  return androidResultSchemas.search_android_classes.parse({
+    engine,
+    query: request.input.query,
+    total_classes: total,
+    matches: classes.filter((name) => name.includes(request.input.query)),
+    coverage: "complete",
+  });
+};
+
+const matchingMethods = (
+  summary: ClassSummary,
+  request: Extract<
+    AndroidRequest,
+    { operation: "inspect_android_method" | "trace_android_references" }
+  >,
+) => {
+  const candidates = methodsOf(summary).filter(
+    (method) => method.name === request.input.method_name,
+  );
+  if (request.input.method_name !== undefined && candidates.length === 0)
+    inputFailure(
+      request,
+      "method_name",
+      `Method ${summary.full_name}.${request.input.method_name} was not found; inspect_android_class lists available methods.`,
+    );
+  return candidates;
+};
+
+const inspectMethod = async (
+  tools: JadxToolPort,
+  request: Extract<AndroidRequest, { operation: "inspect_android_method" }>,
+  summary: ClassSummary,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const candidates = matchingMethods(summary, request);
+  if (candidates.length > 1 && request.input.overload_index === undefined)
+    inputFailure(
+      request,
+      "overload_index",
+      `Select one of ${candidates.length} overloads: ${candidates.map((method) => `${method.overload_index}: ${method.reported_signature}`).join("; ")}`,
+    );
+  const index = request.input.overload_index ?? 0;
+  const selected = candidates[index];
+  if (selected === undefined)
+    inputFailure(
+      request,
+      "overload_index",
+      `Index ${index} is outside the ${candidates.length} matching overloads.`,
+    );
+  const body = jadxMethodSchema.parse(
+    await tools.json("get_method_body", {
+      class_name: summary.full_name,
+      method_name: request.input.method_name,
+      overload_index: index,
+      smali_fallback: true,
+    }),
+  );
+  if (
+    body.class_name !== summary.full_name ||
+    body.method_name !== request.input.method_name ||
+    body.overload_index !== index ||
+    body.overload_count !== candidates.length
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX returned a different method or overload inventory",
+    );
+  if (body.body.startsWith("// ERROR:"))
+    throw new AnalysisOutputError(
+      request.operation,
+      `JADX did not produce method source: ${body.body}`,
+    );
+  if (body.mode === "smali" && candidates.length > 1)
+    throw new AnalysisCapabilityUnavailableError(
+      "jadx",
+      request.operation,
+      `JADX 0.7.1 smali fallback joins all same-name overloads for ${summary.full_name}.${request.input.method_name}; it cannot establish source for only overload ${index}.`,
+    );
+  return androidResultSchemas.inspect_android_method.parse({
+    engine,
+    class_name: summary.full_name,
+    method: selected,
+    overload_count: candidates.length,
+    representation: body.mode,
+    body_status:
+      body.body.length === 0 ||
+      body.body ===
+        "// method exists but has no decompiled body (native/abstract)"
+        ? "not_available"
+        : "available",
+    fell_back: body.fell_back,
+    markers: body.markers,
+    source: normalizeJadxText(body.body),
+  });
+};
+
+/** Normalize only the selected analyst outcome and reject ambiguous engine selectors. */
+export const analyzeJadxRequest = async (
+  tools: JadxToolPort,
+  request: AndroidRequest,
+  loaded: z.infer<typeof jadxLoadSchema>,
+  engine: Engine,
+): Promise<JsonValue> => {
+  if (request.operation === "inspect_android_package")
+    return inspectPackage(tools, loaded, engine);
+  if (request.operation === "search_android_classes")
+    return searchClasses(tools, request, loaded, engine);
+  const summary = await classSummary(tools, request);
+  if (request.operation === "inspect_android_class")
+    return androidResultSchemas.inspect_android_class.parse({
+      engine,
+      class_name: summary.full_name,
+      methods: methodsOf(summary),
+      fields: summary.fields.map((field) => ({
+        name: field.name,
+        reported_type: field.type,
+      })),
+      inner_classes: summary.inner_classes,
+    });
+  if (request.operation === "inspect_android_method")
+    return inspectMethod(tools, request, summary, engine);
+  return traceReferences(tools, request, summary, engine);
+};
+
+const traceReferences = async (
+  tools: JadxToolPort,
+  request: Extract<AndroidRequest, { operation: "trace_android_references" }>,
+  summary: ClassSummary,
+  engine: Engine,
+): Promise<JsonValue> => {
+  const methodName = request.input.method_name;
+  const candidates = matchingMethods(summary, request);
+  if (candidates.length > 1)
+    throw new AnalysisCapabilityUnavailableError(
+      "jadx",
+      request.operation,
+      `JADX 0.7.1 references select the first same-name method; ${summary.full_name}.${methodName} has ${candidates.length} overloads. No unambiguous reference result is available.`,
+    );
+  const expectedTarget =
+    methodName === undefined
+      ? summary.full_name
+      : `${summary.full_name}.${methodName}`;
+  const xrefs = jadxXrefsSchema.parse(
+    await tools.json(
+      methodName === undefined ? "get_xrefs_to_class" : "get_xrefs_to_method",
+      {
+        class_name: summary.full_name,
+        ...(methodName === undefined ? {} : { method_name: methodName }),
+        limit: 2_147_483_647,
+        resolve_line: false,
+      },
+    ),
+  );
+  if (
+    xrefs.target !== expectedTarget ||
+    xrefs.total !== xrefs.count ||
+    xrefs.count !== xrefs.items.length
+  )
+    throw new AnalysisOutputError(
+      request.operation,
+      "JADX references are incomplete or refer to another target",
+    );
+  return androidResultSchemas.trace_android_references.parse({
+    engine,
+    class_name: summary.full_name,
+    method_name: methodName ?? null,
+    total: xrefs.total,
+    references: xrefs.items.map((reference) => ({
+      kind: reference.kind,
+      name: reference.name,
+      reported_full_name: reference.full_name,
+      containing_class: reference.containing_class,
+      top_class: reference.top_class,
+      source_line: null,
+      dex_offset: null,
+    })),
+    coverage: "complete",
+  });
+};

src/android/JadxConfiguration.ts

@@ -0,0 +1,60 @@
+import { access, realpath, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+import type { AndroidOperation } from "../domain/androidAnalysis.js";
+
+/** Caller-supplied tools, resolved only when an Android operation is selected. */
+export interface JadxConfiguration {
+  readonly jar: string;
+  readonly java: string;
+}
+
+/** Admit explicit local tooling without installing or changing host configuration. */
+export const resolveJadxConfiguration = async (
+  environment: Readonly<Record<string, string | undefined>>,
+  operation: AndroidOperation,
+): Promise<JadxConfiguration> => {
+  const unavailable = (reason: string) =>
+    new AnalysisCapabilityUnavailableError("jadx", operation, reason);
+  if (process.platform !== "linux" && process.platform !== "darwin")
+    throw unavailable(
+      `Android JADX subprocess ownership is unsupported on ${process.platform}; use Linux or macOS. Only Linux has real-provider verification.`,
+    );
+  const jar = environment.REA_JADX_MCP_JAR;
+  if (environment.JAVA_HOME !== undefined && !isAbsolute(environment.JAVA_HOME))
+    throw unavailable(
+      "JAVA_HOME must select an existing JDK by absolute path; omit it to use java on PATH.",
+    );
+  if (jar === undefined || !isAbsolute(jar))
+    throw unavailable(
+      "Set REA_JADX_MCP_JAR to the absolute path of a caller-supplied jadx-headless-mcp 0.7.1 JAR. REA does not download or install it.",
+    );
+  const java =
+    environment.JAVA_HOME === undefined
+      ? "java"
+      : join(environment.JAVA_HOME, "bin", "java");
+  try {
+    await access(jar, constants.R_OK);
+    if (!(await stat(jar)).isFile())
+      throw unavailable(`REA_JADX_MCP_JAR is not a regular file: ${jar}`);
+  } catch (cause) {
+    if (cause instanceof AnalysisCapabilityUnavailableError) throw cause;
+    throw unavailable(
+      `Cannot read REA_JADX_MCP_JAR ${jar}: ${cause instanceof Error ? cause.message : String(cause)}`,
+    );
+  }
+  if (environment.JAVA_HOME !== undefined) {
+    try {
+      await access(java, constants.R_OK | constants.X_OK);
+      if (!(await stat(java)).isFile())
+        throw unavailable(`JAVA_HOME java is not a regular file: ${java}`);
+    } catch (cause) {
+      if (cause instanceof AnalysisCapabilityUnavailableError) throw cause;
+      throw unavailable(
+        `Cannot execute JAVA_HOME java ${java}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      );
+    }
+  }
+  return { jar: await realpath(jar), java };
+};

src/android/JadxMcpTransport.ts

@@ -0,0 +1,183 @@
+import {
+  deserializeMessage,
+  serializeMessage,
+  type JSONRPCMessage,
+  type Transport,
+} from "@modelcontextprotocol/client";
+import { randomUUID } from "node:crypto";
+import type {
+  OwnedProviderProcessSpawnOptions,
+  SpawnedOwnedProviderProcess,
+} from "../process/ProviderProcess.js";
+import {
+  ProviderProcessSupervisor,
+  spawnOwnedProviderProcess,
+} from "../process/ProviderProcess.js";
+import { cleanupOwnedProcessGroup } from "../process/ProcessOwnership.js";
+import { ProviderCleanupError } from "../domain/providerCleanupError.js";
+
+const MAX_FRAME_BYTES = 8 * 1024 * 1024;
+const MAX_SESSION_BYTES = 32 * 1024 * 1024;
+
+/** Injectable process acquisition seam; the production launcher owns a POSIX group. */
+export type JadxLauncher = (
+  options: OwnedProviderProcessSpawnOptions,
+) => Promise<SpawnedOwnedProviderProcess>;
+
+/** SDK-framed stdio with REA-owned process cleanup rather than an unowned child. */
+export class JadxMcpTransport implements Transport {
+  onclose: Transport["onclose"];
+  onerror: Transport["onerror"];
+  onmessage: Transport["onmessage"];
+  readonly runId = randomUUID();
+  #spawned: SpawnedOwnedProviderProcess | undefined;
+  #supervisor: ProviderProcessSupervisor | undefined;
+  #buffer = Buffer.alloc(0);
+  #bytes = 0;
+  #started = false;
+  #closed = false;
+  #closePromise: Promise<void> | undefined;
+  #starting: Promise<void> | undefined;
+  #failure: string | null = null;
+
+  constructor(
+    readonly options: Omit<OwnedProviderProcessSpawnOptions, "runId" | "stdin">,
+    readonly launcher: JadxLauncher = spawnOwnedProviderProcess,
+  ) {}
+
+  /** Acquires exactly one protocol process after the SDK installs callbacks. */
+  start(): Promise<void> {
+    if (this.#started || this.#closed)
+      throw new Error("JADX transport cannot be restarted");
+    this.#started = true;
+    this.#starting = this.#acquire();
+    return this.#starting;
+  }
+
+  async #acquire(): Promise<void> {
+    const spawned = await this.launcher({
+      ...this.options,
+      runId: this.runId,
+      stdin: "pipe",
+    });
+    this.#spawned = spawned;
+    this.#supervisor = new ProviderProcessSupervisor({
+      ...spawned,
+      ownsProcessLifetime: true,
+      cleanup:
+        spawned.cleanup ?? (() => cleanupOwnedProcessGroup(spawned.ownership)),
+    });
+    if (
+      spawned.process.stdin === undefined ||
+      spawned.process.stdin === null ||
+      spawned.process.stdout === null
+    )
+      throw new Error("JADX launcher did not supply protocol stdin/stdout");
+    spawned.process.stdout.on("data", this.#read);
+    spawned.process.stderr?.on("data", this.#countStderr);
+    spawned.process.on("error", this.#error);
+    spawned.process.once("exit", this.#exit);
+    spawned.process.stdin.on("error", this.#error);
+    if (this.#closed) throw new Error("JADX transport closed during startup");
+  }
+
+  /** Writes SDK-serialized messages and observes stream backpressure. */
+  async send(message: JSONRPCMessage): Promise<void> {
+    const input = this.#spawned?.process.stdin;
+    if (this.#closed || input === undefined || input === null)
+      throw new Error("JADX protocol process is not writable");
+    await new Promise<void>((resolve, reject) => {
+      input.write(serializeMessage(message), (cause) =>
+        cause === null || cause === undefined ? resolve() : reject(cause),
+      );
+    });
+  }
+
+  /** Verifies owned process exit before declaring the transport closed. */
+  close(): Promise<void> {
+    this.#closePromise ??= this.#stop();
+    return this.#closePromise;
+  }
+
+  /** Captured provider stderr without persisting inherited environment values. */
+  diagnostics(): string {
+    return this.#supervisor?.snapshot().stderr.text ?? "";
+  }
+
+  /** Preserve the failed protocol/resource constraint after the SDK closes requests. */
+  failureReason(): string | null {
+    return this.#failure;
+  }
+
+  async #stop(): Promise<void> {
+    this.#closed = true;
+    // A cancellation may race acquisition. Join it before inspecting ownership.
+    await this.#starting?.catch(() => undefined);
+    const process = this.#spawned?.process;
+    process?.stdout?.off("data", this.#read);
+    process?.stderr?.off("data", this.#countStderr);
+    process?.off("error", this.#error);
+    process?.off("exit", this.#exit);
+    process?.stdin?.off("error", this.#error);
+    const stopped = await this.#supervisor?.stop();
+    this.onclose?.();
+    if (stopped?.status === "incomplete")
+      throw new ProviderCleanupError("jadx", [this.runId], {
+        reason: stopped.reason,
+        stderr: this.diagnostics(),
+      });
+  }
+
+  readonly #error = (error: Error): void => {
+    this.onerror?.(error);
+  };
+  readonly #exit = (): void => {
+    this.onclose?.();
+  };
+  readonly #countStderr = (chunk: Buffer | string): void => {
+    this.#bytes += Buffer.byteLength(chunk);
+    if (this.#bytes > MAX_SESSION_BYTES)
+      this.#fail(
+        new Error(
+          `JADX session output exceeds ${MAX_SESSION_BYTES} bytes; no complete result is available`,
+        ),
+      );
+  };
+  readonly #read = (chunk: Buffer | string): void => {
+    if (this.#closed) return;
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    this.#bytes += bytes.length;
+    if (this.#bytes > MAX_SESSION_BYTES) {
+      this.#fail(
+        new Error(
+          `JADX session output exceeds ${MAX_SESSION_BYTES} bytes; no complete result is available`,
+        ),
+      );
+      return;
+    }
+    this.#buffer = Buffer.concat([this.#buffer, bytes]);
+    try {
+      let newline: number;
+      while ((newline = this.#buffer.indexOf(10)) !== -1) {
+        if (newline > MAX_FRAME_BYTES)
+          throw new Error(`JADX MCP frame exceeds ${MAX_FRAME_BYTES} bytes`);
+        const line = this.#buffer.subarray(0, newline).toString("utf8");
+        this.#buffer = this.#buffer.subarray(newline + 1);
+        this.onmessage?.(deserializeMessage(line));
+      }
+      if (this.#buffer.length > MAX_FRAME_BYTES)
+        throw new Error(`JADX MCP frame exceeds ${MAX_FRAME_BYTES} bytes`);
+    } catch (cause) {
+      this.#fail(cause instanceof Error ? cause : new Error(String(cause)));
+    }
+  };
+  #fail(error: Error): void {
+    this.#failure ??= error.message;
+    this.onerror?.(error);
+    // Closing immediately rejects the SDK's outstanding request. The owner
+    // awaits close again and retains a cleanup failure in the returned Result.
+    void this.close().catch((cause: unknown) =>
+      this.onerror?.(cause instanceof Error ? cause : new Error(String(cause))),
+    );
+  }
+}

src/android/JadxProtocol.ts

@@ -0,0 +1,134 @@
+import { z } from "zod";
+import { AnalysisOutputError } from "../domain/analysisErrorCore.js";
+import { jsonValueSchema } from "../domain/jsonValue.js";
+import type { AndroidOperation } from "../domain/androidAnalysis.js";
+
+const count = z.number().int().nonnegative();
+export const jadxLoadSchema = z.object({
+  state: z.literal("LOADED"),
+  apk_path: z.string(),
+  class_count: count,
+  resource_count: count,
+  threads: z.literal(1),
+  resources: z.literal("full"),
+});
+export const jadxAppSchema = z.object({
+  package: z.string(),
+  version_name: z.string(),
+  version_code: z.string(),
+  min_sdk: z.string(),
+  target_sdk: z.string(),
+  permissions: z.array(z.string()),
+});
+export const jadxClassPageSchema = z.object({
+  total: count,
+  offset: count,
+  limit: count,
+  items: z.array(z.string()),
+});
+export const jadxClassSchema = z.object({
+  full_name: z.string(),
+  name: z.string(),
+  method_count: count,
+  field_count: count,
+  inner_class_count: count,
+  methods: z.array(
+    z.object({
+      name: z.string(),
+      signature: z.string(),
+      is_constructor: z.boolean(),
+      def_pos: z.number().int(),
+    }),
+  ),
+  fields: z.array(
+    z.object({ name: z.string(), type: z.string(), def_pos: z.number().int() }),
+  ),
+  inner_classes: z.array(z.string()),
+});
+export const jadxMethodSchema = z.object({
+  class_name: z.string(),
+  method_name: z.string(),
+  full_name: z.string(),
+  overload_index: count,
+  overload_count: count,
+  mode: z.enum(["java", "smali"]),
+  fell_back: z.boolean(),
+  markers: z.array(z.string()),
+  body: z.string(),
+});
+export const jadxXrefsSchema = z.object({
+  target: z.string(),
+  total: count,
+  count,
+  resolve_line: z.literal(false),
+  items: z.array(
+    z.object({
+      kind: z.string(),
+      name: z.string(),
+      full_name: z.string(),
+      containing_class: z.string(),
+      top_class: z.string(),
+      def_pos: z.number().int(),
+    }),
+  ),
+});
+const toolResponse = z.object({
+  content: z
+    .array(z.object({ type: z.literal("text"), text: z.string() }))
+    .length(1),
+  isError: z.boolean().optional(),
+});
+
+/** Parse the upstream text-only envelope, preserving errors at the producing boundary. */
+export const parseJadxEnvelope = (
+  response: unknown,
+  operation: AndroidOperation,
+): { text: string; failed: boolean } => {
+  const parsed = toolResponse.safeParse(response);
+  if (!parsed.success || parsed.data.content[0] === undefined)
+    throw new AnalysisOutputError(
+      operation,
+      "JADX returned an unsupported MCP content envelope",
+    );
+  return {
+    text: parsed.data.content[0].text,
+    failed: parsed.data.isError === true,
+  };
+};
+
+/** Decode an upstream JSON text payload without trusting its contents. */
+export const parseJadxJson = (
+  text: string,
+  operation: AndroidOperation,
+): z.infer<typeof jsonValueSchema> => {
+  try {
+    return jsonValueSchema.parse(JSON.parse(text));
+  } catch (cause) {
+    throw new AnalysisOutputError(
+      operation,
+      "JADX returned malformed JSON text",
+      { cause },
+    );
+  }
+};
+
+/** Upstream byte truncation is reported rather than promoted to a complete source. */
+export const normalizeJadxText = (
+  text: string,
+): {
+  status: "complete" | "partial";
+  text: string;
+  reported_total_bytes: number | null;
+} => {
+  const marker =
+    /\n\n\.\.\. \[truncated: exceeds (\d+) bytes, total (\d+) bytes\]$/u.exec(
+      text,
+    );
+  const total = marker?.[2] === undefined ? null : Number(marker[2]);
+  return {
+    status: marker === null ? "complete" : "partial",
+    text,
+    reported_total_bytes:
+      total !== null && Number.isSafeInteger(total) ? total : null,
+  };
+};