[AUTOMATED] feat(ghidra): ghidra-sim differential test harness — pin the GUI-path quality gap

[mahaloz]

Test harness for the Ghidra integration: make GUI-path regressions and the Phase-2 quality gap measurable numbers in CI, without a live Ghidra. This is PR-A of the ghidra-mode series; the Phase-3 (lazy symbol/type providers) and Phase-4 PRs land against this harness by flipping its pins.

What the harness is

• Shared MockJava loopback (decompiler/crates/kuna-ghidra/tests/ghidra_sim/mod.rs): the interactive single-threaded pipe double proven by decompile_at_e2e.rs, extracted behind a pluggable AnswerSource — wire builders, query pump, session tracer, a dual-<function> doc parser, a markup→C flattener that replicates Java's getC() token cleaning (IllegalCharCppTransformer), badness scanners, and a normalized line-diff metric. decompile_at_e2e.rs is refactored onto it (still green).
• ghidra-sim v1 (tests/ghidra_sim/oracle.rs): a mock-Java answer source backed by kuna's own analysis of real vendored ELFs — bootstrap_from_object for bytes/labels/facts, the real Sleigh re-encoded as wire <inst> docs for getPcode, register/userop tables from the same Sleigh, and a tspec generated from the loaded Sleigh's AddrSpaceManager so packed space indices agree by construction. getMappedSymbols/getExternalRef answer empty — the Phase-2 reality — at a clearly marked PHASE-3 SEAM where the <mapsym> encoder plugs in.
• The differential harness (tests/ghidra_sim_e2e.rs): drives registerProgram → setAction → decompileAt×3 → flushNative → repeat decompileAt → deregister over tests/bug-repro/faillog (plus a sort/grep breadth test), asserts the response-document schema (name/entry echo, markup opref/varref ⊆ ast, 19-query legality + query-legal-command placement, clean warnings), and decompiles the SAME functions through the in-process CLI drive to pin the gap the GUI user experiences.

Today's pinned numbers (faillog, x86-64, stripped)

target	register leaks	Unique/Stack tokens	placeholders	loader-resolvable	getC()-mangled tokens	C lines	diff ratio vs CLI (band)
sub_2620 (main)	108	34	49	24	21	243	0.646 [0.55, 0.70]
sub_3320	58	4	25	18	6	128	0.867 [0.80, 0.95]
sub_3ad0	60	8	17	14	7	89	0.811 [0.70, 0.90]

(Re-measured on main @ 813ee131 after rebasing — the engine PRs #303–#316 shift the ghidra-path output slightly; determinism verified over three identical runs.)

Session query traffic (unchanged by the rebase): getPcode total 1477 vs 1003 distinct decoded instructions (no p-code cache + no-return flow overrun into neighbours); getMappedSymbols = 0 (pinned; Phase 3 flips this to ≥ 1). flushNative + repeat decompile is pinned byte-identical (deterministic engine; Phase 3 turns this into the cache-clearing semantics test via the oracle's label_overrides seam).

How the next PRs flip them:

• Phase 3 (lazy ScopeGhidra/TypeFactoryGhidra): resolvable → 0 (the 24/18/14 are PLT imports the loader already names — localtime, getopt_long, dcgettext, … rendering as sub_ADDR only because getMappedSymbols is unanswered), getMappedSymbols ≥ 1, diff-ratio floors flip to ceilings, register/Unique leak counts collapse (r3 §8 defects a–e, g).
• PR-C (markup emitter): mangled tokens → 0 (see root cause below).

Root cause found (reported, NOT fixed here — PR-C's job)

The live-repro type mangling (unsigned_long__a1, (char__)) is two-sided:

1. kuna's markup path emits the whole rendered declarator as ONE <type> token — tag_type(ty/decl_type/ret_type, …) at decompiler/crates/kuna-decomp/src/p9_emit/printc.rs:1428,1451,2190,2679 receives strings like "unsigned long *" (the code at :2683 even tests decl_type.ends_with('*')). Upstream PrintC::pushTypeStart pushes only the base type NAME as the type token; stars/spaces travel as separate syntax/op tokens.
2. Java's DecompileResults.getDecompiledFunction() (DecompileResults.java:211) runs every funcname/variable/type/field/label token through IllegalCharCppTransformer.simplify, rewriting every non-identifier char to _ — so "unsigned long *" + "a1" reads back as unsigned_long__a1. The GUI panel renders token text verbatim; scripts/exports/getC() consumers see the mangling.

The harness flattener replicates (2) exactly, so (1) is pinned as the mangled tokens column and PR-C's fix is measurable. Fixing (1) is a multi-site token-granularity change (> 10 lines), out of scope here per the brief.

CI + tooling

• .github/workflows/tests.yml gates job (runs on every PR): one new step — cargo test -p kuna-ghidra --release -- --include-ignored with the standard skip-canary grep. Cost: ~1–2 min compile over the already-built release deps + ~2 s of test runtime.
• make test-ghidra: the same run locally.
• make rust-test (dev profile) runs the faillog tests too (~12 s; the sort/grep breadth test is #[ignore]d there and picked up by the release contexts).
• Live-smoke rig (integrations/ghidra/live-smoke/, manual/dev, not CI): a parameterized pyghidra script that swaps DecompileProcessFactory.exepath to kuna_ghidra inside a real Ghidra, decompiles the same functions with both cores, and writes a side-by-side report with the same scanner counts (README covers the offline-pyghidra setup).
• docs/ghidra-integration.md §11 rewritten around the harness.

Gates

make test 675/675 PARITY OK · make test-stages PARITY OK · make rust-test green (the new tests run inside it) · make check-spec OK.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AfGYKwUWvPYYj1Aw7tcLhC

---

Review hardening (aa67ad57): diff-ratio pins are now a band (floors + ceilings [0.70, 0.95, 0.90]) and the flattened-C normalized line count is pinned per target (241 / 174 / 89) — the assert that catches a <break>-token collapse the ratio floors alone could not; the vacuous <= 1.0 assert is gone. decompile_cli now routes through the shared decompile_step::decompile_one with the error-noreturn CALL_RETURN flow overrides exactly as kuna_console::project builds them (latent fix — every faillog pin re-measured identical). Assert strength: warnings frames pinned trim-empty, markup oprefs AND varrefs non-empty per class, ast varnode refs collected from <varnodes> only (all Java's buildVarnodeRefs keys), name echo vs the sim's served code_label. The CI step now tees its log so a failing pin prints diagnostics under bash -e. Live-smoke docs point at cargo build --release -p kuna-ghidra (not make binaries). No pinned value moved.