Where is REA heading? A plain-words summary (corrections welcome)

[CassieFox23]

TL;DR: I am a hobbyist modder who tests REA on Linux, not a coder. Claude Code read the roadmap issues and put the plan in plain words for me. Please tell me what I got wrong.

Claude Code read the 59 issues: 58 labelled roadmap, plus #18. It used the issue text and comments. This is main as of edf4624, 2026-10-12. Anything marked (my reading) is my inference, not the maintainers' words.

The big idea

#32 is the top roadmap. Its goal says "Agents choose the target and compose investigations". REA supplies the results.

You point an agent at a program. REA hands back facts, each with proof. The agent plans the experiment. #32 says #555 cut permission grants and #572 cut the replay sandbox.

#1267 and #1431 say current work is bug fixes. #969 says new work stops after its last step. So REA looks like it is tidying up (my reading).

At a glance

Theme	Open	Done	What it means
Evidence and trust	0	13	Results you can check.
Process capture	6	7	Record a program run. Some proof needs a paid tool.
Windows safety	4	1	Safe process and file handling.
Browser and web	3	5	Watch and compare websites.
Runtime and debugging	4	3	Live hooks, a live debugger.
Mobile, new platforms	2	6	Android, HarmonyOS, firmware.
MCP speed, internals	2	2	#1065 and #740. 40 and 21 comments.
The roadmap itself	1	0	#32.

Done means closed. Five closed as premature or out of scope: #36, #43, #44, #45, #70. The folds below list every issue by theme.

Thanks, morluto, for REA.

Questions for maintainers

1. Is the big idea right: the agent plans, REA supplies proof?
2. Is "tidying up" fair, or is new feature work still planned?
3. Is anything open really done, or the other way round?
   • Roadmap: evolve REA into an agent-first multi-tool reverse-engineering platform #32 lists eight items as remaining.
   • All eight are closed:
     • Windows: Ghidra provider is hard-gated off via hasWindowsNativeAuthority, contradicting the advertised Windows x64 P0 #527
     • [Refactor] Enforce analysis rules at the module interface so call sites cannot violate them #544
     • Inline Evidence omits normalized_result, so tool output cannot be fed to the comparison tools #551
     • Managed PE/CLI inspection must use explicit targets consistently through CLI and MCP #553
     • Comparators derive definite answers from partially observed evidence #558
     • Error handling: swallowed causes and thrown errors at provider and application seams #562
     • Assert CLI/MCP parity and derive CLI failure classification from the contract #565
     • Report the real cause when the native PTY backend is unavailable #568
4. Is any wording misleading, like "done" for issues closed as premature?
5. Is anything big missing from the roadmap label?

What's done (37 closed issues)

Evidence and trust

• Add evidence-backed investigation workflows for agents #18: Investigation steps with proof. Closed 2026-08-17. Split into Add inspect_artifact provider-neutral inspection tool #347, Add find_code_for_string and trace_call_path bounded tracing tools #348, Add inspect_native_api and agent investigation orchestration #349.
• Introduce provider-neutral analysis capabilities and sessions #20: Providers with a shared shape. Closed 2026-07-17.
• Add evidence envelopes, artifact hashes, and reproducible exports #21: Evidence wrappers with hashes. Closed 2026-07-17.
• Keep installed REA skills and localized product claims current #24: Installed skills match the product. Closed 2026-07-17.
• Model applications as artifact graphs and add safe decomposition #35: Apps as graphs of parts. Closed 2026-08-17. Split earlier.
• Add differential analysis and reconstruction verification workflows #37: Compare versions, check rebuilds. Closed 2026-08-17. Split earlier.
• Introduce canonical Evidence v2 records #49: Evidence v2 records. Closed 2026-07-17.
• Add an in-memory evidence ledger and deterministic bundle model #50: Evidence ledger. Closed 2026-07-17.
• Add validated evidence bundle import and export tools #51: Evidence bundles. Closed 2026-07-17.
• Replace string capabilities with typed provider descriptors #52: Typed provider details. Closed 2026-07-17.
• Correct provider-neutral analysis error classification #53: Error fix. Closed 2026-07-13.
• Regenerate evidence and completion ledgers automatically #72: Ledgers that update themselves. Closed 2026-07-22.
• Create an evidence-linked residual-unknowns registry #73: List of open questions. Closed 2026-07-17.

Process capture

• Make runtime ownership and side-effect policy explicit #27: Clear rules for who owns a process. Closed 2026-07-25. Children closed.
• Replace temporal Hopper cleanup with explicit process ownership #56: Hopper cleanup by owner, not timer. Closed 2026-07-13. No comment.
• Define reusable deterministic process-capture scenario contracts #57: Capture scenarios to reuse. Closed 2026-07-25.
• Implement a bounded macOS and Linux PTY capture adapter #58: Linux and macOS terminal capture. Closed 2026-07-17.
• Add deterministic loopback HTTP and WebSocket replay #60: Local web replay. Closed 2026-07-22. refactor!: simplify runtime tools and remove replay engines #572 later cut replay systems. I do not know if this piece went too.
• Add normalized differential comparison for process captures #61: Compare two process captures. Closed 2026-07-20.
• Build process-fidelity conformance fixtures #62: Test programs for capture checks. Closed 2026-08-05. Split into Design portable process-fidelity conformance export package #336, Add semantic-diff trust gates for conformance fixtures #337, Run conformance fixtures in clean-checkout CI replay #338.

Windows

• Add first-class Windows artifact and analysis support #38: Windows files and analysis. Closed 2026-08-17. Split earlier. Safety work lives in Define a trusted Windows native authority and packaging boundary #287.

Browser and web

• Build a Playwright/CDP differential recorder #63: Browser recorder. Closed 2026-07-25. Done through feat: add runtime reconstruction roadmap workflows #433.
• Add structural and visual browser comparison #65: Compare browser pages. Closed 2026-07-25. Done through feat: add runtime reconstruction roadmap workflows #433.
• Import historical source trees as reference-only evidence #66: Old source trees as reference. Closed 2026-07-12. No comment.
• Map historical source modules to current bundles #67: Map old source to current bundles. Closed 2026-07-25. Done through feat: add runtime reconstruction roadmap workflows #433.
• Add native JavaScript bundle indexing and semantic queries #68: Search inside web code bundles. Closed 2026-07-20.

Runtime and debugging

• Add approval-gated dynamic observation providers #36: Runtime watching that asks first. Closed 2026-07-20 as out of scope or premature.
• Define controlled external-service test environments #70: Test setups for outside services. Closed 2026-07-20 as out of scope or premature.
• [Feature] Modular binary diagnostics and debugger adapters using pwntools and pwndbg #969: Binary layout and crash tools. Closed 2026-10-08: "Verified fixed on main... Closing per audit."

Mobile and new platforms

• Add protocol and distributed-client investigation workflows #40: Protocol and client work. Closed 2026-08-17. Split earlier.
• Add mobile application investigation providers and workflows #41: Mobile app work. Closed 2026-08-17. Split earlier.
• Add managed-runtime, bytecode, and package ecosystem providers #42: Managed code and packages. Closed 2026-08-17. Split earlier.
• Add firmware, embedded-system, and filesystem-image analysis #44: Firmware images. Closed 2026-07-20. Called premature.
• [Feature] Integrate IoT firmware analysis tools into REA: research and roadmap #718: Firmware tools. Closed 2026-10-10. No comment.
• [Feature] Modular EVM bytecode analysis and execution evidence adapters #972: EVM bytecode inspection. Closed 2026-10-08, "per audit" like [Feature] Modular binary diagnostics and debugger adapters using pwntools and pwndbg #969.

MCP and internals

• Create reusable reverse-engineering skill packs and investigation playbooks #43: Skill packs and playbooks. Closed 2026-07-20 as out of scope or premature.
• Add a versioned provider SDK, capability registry, and integration test kit #45: Provider kit for outsiders. Closed 2026-07-20 as out of scope or premature.

What's still open (22 issues)

Dates are UTC, written YYYY-MM-DD.

The roadmap itself

• Roadmap: evolve REA into an agent-first multi-tool reverse-engineering platform #32: Top roadmap. Last comment 2026-07-22. Last update 2026-10-06.

Process capture

• Epic: Evidence v2 and deterministic process fidelity #48: Evidence v2 and process epic. Last comment 2026-07-22.
• Capture owned process trees and filesystem effects #59: Capture whole process trees. No comment since 2026-07-20. Child Integrate event-backed process-tree capture into Process Capture v4 #333 is open.
• Build a multi-binary Hopper conformance and fidelity suite #25: Test suite for a paid disassembler. No comment since 2026-07-20.
• Complete truthful analyze_function dossiers #31: Honest function reports. No comment since 2026-07-20.
• Complete Hopper function dossiers with real references and CFG edges #54: Callers and flow edges. 2026-10-10: a user wrote in support. The maintainer last spoke 2026-07-20.
• Strengthen semantic Hopper conformance across source-built fixtures #55: Checks on two binaries. No comment since 2026-07-20.

Windows safety

• Define a trusted Windows native authority and packaging boundary #287: Native add-on plan. Last comment 2026-10-05, a reply to an offer to contribute. Children Implement Windows native authority Node-API package #318, Integrate Windows native authority package into release and real-Windows verifier #319 are open.
• Own Windows Ghidra process trees with kill-on-close semantics #288: Clean up Windows process trees. No comment since 2026-07-20.
• Use handle-based reparse-safe filesystem authority on Windows #289: Safe file paths. No comment since 2026-07-20.
• Create and verify private Windows runtime DACLs #290: Private runtime folders. No comment since 2026-07-20.

Browser and web

• Add browser and web-application reverse-engineering capabilities #39: Browser and web parent. 2026-10-09 triage note: keep open. Open children Add Electron shell and IPC instrumentation #64, Capture Electron main/preload/utility process lifecycle and shell events #375.
• Add Electron shell and IPC instrumentation #64: Desktop web app hooks. No comment since 2026-07-20.
• [Feature] Website reverse engineering roadmap: network evidence, captured assets, and modular adapters #774: Study shipped website code. Last comment 2026-10-08, an offer to help. [Feature] Attribute website worker and service-worker sources and runtime ownership #883 is open. PR feat(mcp): derive an API surface view from retained web network captures #1891 merged 2026-10-12, after the snapshot.

Runtime and debugging

• [Feature] Modular native runtime instrumentation through a Frida adapter #968: Live hooks. Last comment 2026-10-09. A [Feature] Roadmap: improve MCP usability and performance under bounded resources #1065 comment says PR feat: add Frida instrumentation support #1359 waits on its contributor.
• [Feature] Live native debugging through x64dbg, GDB and LLDB adapters #1267: Live debugger. Created 2026-10-09. The issue says it is deferred.
• Create a resettable macOS clean-room environment #69: macOS test machine. No comment since 2026-07-20.
• Add approval-gated Objective-C runtime observation #71: Watch Apple apps run. No comment since 2026-07-20.

Mobile and new platforms

• [Feature] Integrate APK analysis tools into REA: research and roadmap #717: Android and APK tools. Last comment 2026-10-09, an offer to help. Open links: PR feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing #1582, [Design] Android split APK sets: set identity and relationship evidence before a bundletool lane #1813, [Feature] Java Reverse Engineering #1558.
• [Feature] HarmonyOS/OpenHarmony package and Ark bytecode analysis (ArkDecompiler evaluation) #1431: HarmonyOS apps. Created 2026-10-10. The issue says deferred research. No comments. PR feat(harmony): project HarmonyOS package inventory evidence #1447 merged 2026-10-11.

MCP and internals

• [Feature] Roadmap: improve MCP usability and performance under bounded resources #1065: Fast, steady MCP. Last comment 2026-10-11. 40 comments in all. Two acceptance boxes ticked, six not.
• [Design] Roadmap: clarify investigation ownership and modularize REA capability integration #740: Tidy internals. Last comment 2026-10-11. 21 comments in all.

Words you'll see

Word	Plain meaning
Evidence	A result plus its proof.
Observation	Seen by REA.
Inference	Worked out by REA.
Unknown	A gap REA admits.
Provider	The engine behind a tool.
Retained view	REA keeps a big result and hands back a slice.
Typed failure	An error with a real name and cause.
Dossier	The full report on one function.
Process capture	Run a program in a fake terminal and record it.
Job Object	A Windows group of processes that end together.
DACL	A Windows list of who may touch a file.
Reparse point	A Windows link. Paths can lie through it.
Deferred	Kept open for later. Not built now.
Split	The work moved to child issues.
Premature	The maintainer's word for too early.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊