[Tracker] Open PRs that can't merge yet: conflicts and red CI #5654

Merge conflict only (40)

• feat(ghidra): admit caller-selected matching dSYM companions #2025 feat(ghidra): admit caller-selected matching dSYM companions (conflicts)
• feat(ghidra): select the loopback bridge transport on POSIX hosts #4591 feat(ghidra): select the loopback bridge transport on POSIX hosts (conflicts)
• fix(call-path): bound inline shortest-path enumeration #4984 fix(call-path): bound inline shortest-path enumeration (conflicts)
• feat(firmware): map STM32, GD32, and ESP32 SoC peripherals and auto-detect target platform #5361 feat(firmware): map STM32, GD32, and ESP32 SoC peripherals and auto-detect target platform (conflicts)
• fix(process): name the fixed finalization delivery grace #6342 fix(process): name the fixed finalization delivery grace (conflicts)
• fix(ghidra): bound bridge request lines above the authentication handshake #6991 fix(ghidra): bound bridge request lines above the authentication handshake (conflicts)
• feat(mcp): advertise each tool's family in tools/list _meta #7154 feat(mcp): advertise each tool's family in tools/list _meta (conflicts)
• fix(plugins): show REA branding and remove rejected Git attributes #7546 fix(plugins): show REA branding and remove rejected Git attributes (conflicts)
• fix(android): point JADX setup errors at the pinned public JAR #7778 fix(android): point JADX setup errors at the pinned public JAR (conflicts)
• fix(cli): enforce selector bounds and absolute mapping path in schemas #7789 fix(cli): enforce selector bounds and absolute mapping path in schemas (conflicts)
• feat(browser): accept mitmproxy 12.3.1 for native capture decode #8088 feat(browser): accept mitmproxy 12.3.1 for native capture decode (conflicts)
• fix(mcp): ensure resultType on tools/call wire results #8157 fix(mcp): ensure resultType on tools/call wire results (conflicts)
• feat(native): surface inferred prototype instruction conflicts #8161 feat(native): surface inferred prototype instruction conflicts (conflicts)
• feat(ghidra): export session diagnostics after cleanup #8199 feat(ghidra): export session diagnostics after cleanup (conflicts)
• fix(decompile): preserve procedure_info limitation on resume #8456 fix(decompile): preserve procedure_info limitation on resume (conflicts)
• fix(native): report an unexamined thunk target in value traces #8678 fix(native): report an unexamined thunk target in value traces (conflicts)
• feat(python): decode CPython 3.14 and 3.15 pyc code objects #8707 feat(python): inspect CPython 3.14 and 3.15 pyc files (conflicts)
• feat(browser): count credential-named members in HAR capture inspection #8708 feat(browser): count credential-named members in HAR capture inspection (conflicts)
• feat: add multi-client agent evaluation for Claude Code and Gemini CLI (issue #1932) #8930 feat: add multi-client agent evaluation for Claude Code and Gemini CLI (issue [Feature] Run the agent evaluation against Claude Code and Gemini CLI, not only Codex #1932) (conflicts)
• fix(artifacts): explain ASAR PE signed-after-packing mismatches #9024 fix(artifacts): explain ASAR PE signed-after-packing mismatches (conflicts)
• feat(desktop): name an app's files when a capture starts, say why a draft is empty, and list the folders a bundle leaves unowned #9089 feat(desktop): name an app's files when a capture starts, say why a draft is empty, and list the folders a bundle leaves unowned (conflicts)
• fix(desktop): grade a computer-app task only once the app's files have settled #9105 fix(desktop): grade a computer-app task only once the app's files have settled (conflicts)
• feat(desktop): read gzip documents as the document inside #9111 feat(desktop): read gzip documents as the document inside (conflicts)
• feat(desktop): install extra packages beside an archive app, and keep a package file's dependencies at export #9112 feat(desktop): install extra packages beside an archive app, and keep a package file's dependencies at export (conflicts)
• feat(desktop): check text kept in attributes, name a record by a child's text, and count members #9114 feat(desktop): check text kept in attributes, name a record by a child's text, and count members (conflicts)
• feat(desktop): draft child-text selectors, member counts and attribute text, and fold in a third batch's findings #9132 feat(desktop): draft child-text selectors, member counts and attribute text, and fold in a third batch's findings (conflicts)
• feat(ghidra): admit ELF64 LoongArch LP64D targets #9146 feat(ghidra): admit ELF64 LoongArch LP64D targets (conflicts)
• docs: distinguish the pinned jadx-headless-mcp release from same-named packages #9150 docs: distinguish the pinned jadx-headless-mcp release from same-named packages (conflicts)
• docs(desktop): set up a desktop build host from a fresh Linux machine #9184 docs(desktop): set up a desktop build host from a fresh Linux machine (conflicts)
• feat(desktop): name a record by a nested field or a child's attribute #9185 feat(desktop): name a record by a nested field or a child's attribute (conflicts)
• fix(test): reset retained unknowns before divergent dispatch snapshot #9194 fix(test): reset retained unknowns before divergent dispatch snapshot (conflicts)
• feat(desktop): set up and check a desktop build host in one command #9199 feat(desktop): set up and check a desktop build host in one command (conflicts)
• fix(desktop): find ids in archive entries and draft nothing for a state directory's lock #9210 fix(desktop): find ids in archive entries and draft nothing for a state directory's lock (conflicts)
• feat(desktop): install an app from an AppImage or an upstream tarball, pinned by its SHA-256 #9215 feat(desktop): install an app from an AppImage or an upstream tarball, pinned by its SHA-256 (conflicts)
• feat(desktop): isolate declared secrets during app builds #9225 feat(desktop): isolate declared secrets during app builds (conflicts)
• fix(process): report denied inspection as typed cleanup failures #9261 fix(process): report denied inspection as typed cleanup failures (conflicts)
• feat(evidence): opt-in logical path-root redaction at Evidence creation time  #9271 feat(evidence): opt-in logical path-root redaction at Evidence creation time (conflicts)
• fix(desktop): admit output directories through DesktopOutputTree #9292 fix(desktop): admit output directories through DesktopOutputTree (conflicts)
• feat(desktop): target agentenv-framework 0.9.1464 #9302 feat(desktop): target agentenv-framework 0.9.1464 (conflicts)
• docs(android): show the first checks for a local APK #9426 docs(android): show the first checks for a local APK (conflicts)

Failing CI only (77)

• fix(javascript)!: preserve Vite dependency values and uncertainty #1840 fix(javascript)!: preserve Vite dependency values and uncertainty (CI)
• feat(browser): derive API surfaces from retained SAZ captures #2884 feat(browser): derive API surfaces from retained SAZ captures (CI)
• docs(docker): add a container image and guide #3420 docs(docker): add a container image and guide (CI)
• fix(cli): preserve command status after complete pipe reads #4038 fix(cli): preserve command status after complete pipe reads (CI)
• feat(unreal): inspect Unreal pak footers and indexes #4362 feat(unreal): inspect Unreal pak footers and indexes (CI)
• docs(native): explain resource-only bundle admission #5764 docs(native): explain resource-only bundle admission (CI)
• feat(unity): inventory Addressables content catalogs #7186 feat(unity): inventory Addressables content catalogs (CI)
• fix(mcp): advertise absolute filesystem paths #7449 fix(mcp): advertise absolute filesystem paths (CI)
• feat(install): warn when installed rea is not on PATH #7473 feat(install): warn when installed rea is not on PATH (CI)
• feat(ghidra): open M-profile raw images at a separate load base #7951 feat(ghidra): open M-profile raw images at a separate load base (CI)
• build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.2 #8129 build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.2 (CI)
• feat(ghidra): admit RISC-V ilp32f ELF with a derived calling convention #8401 feat(ghidra): admit RISC-V ilp32f ELF with a derived calling convention (CI)
• fix(ghidra)!: load ESP-IDF flash code in Ghidra's default address space #8464 fix(ghidra)!: load ESP-IDF flash code in Ghidra's default address space (CI)
• feat(il2cpp): link 32-bit ARM (armeabi-v7a) libil2cpp.so #8739 feat(il2cpp): link 32-bit ARM (armeabi-v7a) libil2cpp.so (CI)
• fix(elf): decode Linux ELF32 core identity layouts #8880 fix(elf): decode Linux ELF32 core identity layouts (CI)
• fix(gpu): report an AMDGPU container past the decoder limit as capacity #8882 fix(gpu): report an AMDGPU container past the decoder limit as capacity (CI)
• feat(v8): inspect V8 code cache containers and retained byte patterns #8993 feat(v8): inspect V8 code cache containers and retained byte patterns (CI)
• feat(desktop): say why an app exited at launch, and fix the build skill and tools where a five-app batch stumbled #9058 feat(desktop): say why an app exited at launch, and fix the build skill and tools where a five-app batch stumbled (CI)
• fix(javascript): name minified receiverless import calls by their final callee #9095 fix(javascript): name minified receiverless import calls by their final callee (CI)
• fix(desktop): retain ZIP contents with extended Zip64 records #9173 fix(desktop): retain ZIP contents with extended Zip64 records (CI)
• fix(rust): report consumed-stream inflate limit for padded PE sections #9232 fix(rust): report consumed-stream inflate limit for padded PE sections (CI)
• fix(javascript): project class definition-time effects through getters #9233 fix(javascript): project class definition-time effects through getters (CI)
• fix(agentenv): preserve helper teardown results on signals #9237 fix(agentenv): preserve helper teardown results on signals (CI)
• fix(process): prepare Darwin ownership before Java deadline #9244 fix(process): prepare Darwin ownership before Java deadline (CI)
• fix(desktop): align exported numeric task comparisons #9249 fix(desktop): align exported numeric task comparisons (CI)
• fix(desktop): retain readable SQLite tables in exported views #9272 fix(desktop): retain readable SQLite tables in exported views (CI)
• fix(desktop): preserve Unicode XML names in exported views #9293 fix(desktop): preserve Unicode XML names in exported views (CI)
• fix(desktop): reserve exported Python exception names #9294 fix(desktop): reserve reader exception names in exported classes (CI)
• fix(cli): validate paths before capture file admission #9318 fix(cli): validate paths before capture file admission (CI)
• feat(evidence): filter retained instruction references by address #9319 feat(evidence): filter retained instruction references by address (CI)
• fix(browser): validate complete PNG image data #9322 fix(browser): validate complete PNG image data (CI)
• fix(electron)!: report incomplete semantic coverage #9323 fix(electron)!: report incomplete semantic coverage (CI)
• feat(evidence): page saved objdump output #9324 feat(evidence): page saved objdump output (CI)
• feat(evidence): page retained procedure aliases #9325 feat(evidence): page retained procedure aliases (CI)
• fix(setup): explain unavailable Hopper installation on Linux #9326 fix(setup): explain unavailable Hopper installation on Linux (CI)
• fix(elf): validate decoded section-name alignment #9330 fix(elf): validate decoded section-name alignment (CI)
• feat(sqlite)!: page selected rows with a stated order and row offset #9331 feat(sqlite)!: page selected rows with a stated order and row offset (CI)
• fix(desktop): recognize empty ZIP state views #9336 fix(desktop): recognize empty ZIP state views (CI)
• fix(pe): reject short export directory declarations #9343 fix(pe): reject short export directory declarations (CI)
• fix(gpu): keep overflowing PTX parameter offsets unknown #9349 fix(gpu): keep overflowing PTX parameter offsets unknown (CI)
• fix(browser): respect quoted Permissions-Policy boundaries #9375 fix(browser): respect quoted Permissions-Policy boundaries (CI)
• build(deps): bump the npm-minor-and-patch group across 2 directories with 37 updates #9382 build(deps): bump the npm-minor-and-patch group across 2 directories with 37 updates (CI)
• fix(javascript): keep strict module checks unproven when alias walks exhaust their budget #9387 fix(javascript): keep strict module checks unproven when alias walks exhaust their budget (CI)
• fix(entropy)!: own selected Windows path spelling at admission #9393 fix(evidence)!: keep one Evidence identity across Windows path case (CI)
• fix(javascript): omit fs acquisitions for rejected primitive paths #9411 fix(javascript): omit fs acquisitions for rejected primitive paths (CI)
• fix(javascript): preserve loader authority for exact suffixes #9477 fix(javascript): preserve loader authority for exact suffixes (CI)
• feat(api-contract): read OpenAPI YAML documents offline #9485 feat(api-contract): read OpenAPI YAML documents offline (CI)
• feat(artifacts): inventory and extract Android boot and vendor_boot images #9487 feat(artifacts): inventory and extract Android boot and vendor_boot images (CI)
• feat(windows): add quick tools launcher with Thai documentation #9489 feat(windows): add quick tools launcher with Thai documentation (CI)
• fix(mcp): narrow union input diagnostics to the branches a tag selects #9490 fix(mcp): narrow union input diagnostics to the branches a tag selects (CI)
• fix(cli): admit local application path for analyze-javascript-application #9494 fix(cli): admit local application path for analyze-javascript-application (CI)
• fix(cli): reject empty selected paths on Electron and desktop commands #9495 fix(cli): reject empty selected paths on Electron and desktop commands (CI)
• fix(hopper): accept the provider's caller and callee coverage declaration #9496 fix(hopper): accept the provider's caller and callee coverage declaration (CI)
• fix(javascript): recover inline FunctionExpression bundler IIFEs and Rspack getters #9500 fix(javascript): recover inline FunctionExpression bundler IIFEs and Rspack getters (CI)
• feat(electron): report V8 cachedData compilation boundaries #9501 feat(electron): report V8 cachedData execution boundaries (CI)
• feat(web): report value-free header names in the api-surface view #9504 feat(web): report value-free header names in the api-surface view (CI)
• fix(setup): name the launcher digest mismatch when the feed is stale #9506 fix(setup): name the launcher digest mismatch when the feed is stale (CI)
• style(cli): fix native command formatting check #9507 style(cli): fix native command formatting check (CI)
• fix(javascript): keep parameter members a function overwrites unresolved #9508 fix(javascript): keep parameter members a function overwrites unresolved (CI)
• fix(javascript): read the target of method-first request(method, url) calls #9509 fix(javascript): read the target of method-first request(method, url) calls (CI)
• fix(javascript): keep Electron options visible past conditional literal spreads #9510 fix(javascript): keep Electron options visible past conditional literal spreads (CI)
• fix(browser): give CDP targets outside the HTTP(S) page scope an actionable recovery #9511 fix(browser): give CDP targets outside the HTTP(S) page scope an actionable recovery (CI)
• feat(electron): recover standard native addon loaders and unpacked addon handoffs #9512 feat(electron): recover standard native addon loaders and unpacked addon handoffs (CI)
• fix(pe): reject misaligned certificate table offsets #9514 fix(pe): reject misaligned certificate table offsets (CI)
• fix(protobuf): stop trailers at the HTTP field boundary #9516 fix(protobuf): stop trailers at the HTTP field boundary (CI)
• fix(apk): validate the Zip64 end record size #9518 fix(apk): validate the Zip64 end record size (CI)
• fix(native): preserve duplicate byte-read provenance #9524 fix(native): preserve duplicate byte-read provenance (CI)
• fix(dotnet): reject invalid UTF-8 metadata versions #9533 fix(dotnet): reject invalid UTF-8 metadata versions (CI)
• fix(javascript): observe proven Electron net.fetch and net.request targets #9534 fix(javascript): observe proven Electron net.fetch and net.request targets (CI)
• docs(cli): propose bounded decimal-token schemas #9535 docs(cli): propose bounded decimal-token schemas (CI)
• docs(windows): propose Prefetch Evidence inspection #9536 docs(windows): propose Prefetch Evidence inspection (CI)
• docs(windows): propose Registry hive Evidence inspection #9537 docs(windows): propose Registry hive Evidence inspection (CI)
• fix(electron): trace IPC channels and bridge keys spelled as exact templates #9538 fix(electron): trace IPC channels and bridge keys spelled as exact templates (CI)
• fix(rust): read rustc commit paths written with a Windows separator #9542 fix(rust): read rustc commit paths written with a Windows separator (CI)
• fix(ida): report the regex syntax error for invalid search patterns #9544 fix(ida): report the regex syntax error for invalid search patterns (CI)
• fix(managed): report InternalCall methods as runtime-provided boundaries #9547 fix(managed): report InternalCall methods as runtime-provided boundaries (CI)
• test(ida): expect Windows to fold a missing parent in the workspace root #9548 test(ida): expect Windows to fold a missing parent in the workspace root (CI)

Merge conflict and failing CI (21)

• fix(adb): project actionable pm path refusal details #1903 fix(adb): project actionable pm path refusal details (both)
• feat(javascript)!: bound semantic graphs by serialized Evidence bytes #2092 feat(javascript)!: bound semantic graphs by serialized Evidence bytes (both)
• feat(windows): admit live SQLite, process, and window tools #6326 feat(windows): admit live SQLite, process, and window tools (both)
• feat(setup): discover project-scoped MCP registrations in doctor and … #7283 feat(setup): discover project-scoped MCP registrations in doctor and … (both)
• fix(artifacts): name a refused symlink's resolved target #8721 fix(artifacts): name a refused symlink's resolved target (both)
• feat(desktop): draft checks a build agent keeps: values, paired selectors, noise demoted, and checks for elements without attributes #9091 feat(desktop): draft checks a build agent keeps: values, paired selectors, noise demoted, and checks for elements without attributes (both)
• docs(ghidra): mention a prebuilt arm64 fallback when no toolchain is present #9141 docs(ghidra): mention a prebuilt arm64 fallback when no toolchain is present (both)
• feat(firmware)!: migrate region inspection to binwalk-ng 4.0.0 #9172 feat(firmware)!: migrate region inspection to binwalk-ng 4.0.0 (both)
• fix(desktop): preserve exported keyfile key identity #9176 fix(desktop): preserve exported keyfile key identity (both)
• fix(dotnet): detect decreasing TypeDef member list starts across invalid rows #9177 fix(dotnet): detect decreasing TypeDef member list starts across invalid rows (both)
• fix(desktop): export and grade deeply nested task values #9183 fix(desktop): export and grade deeply nested task values (both)
• fix(cli): validate dylib root selectors before dispatch #9212 fix(cli): validate dylib root selectors before dispatch (both)
• feat(desktop): build several tasks from one capture, and measure each task's pass rate within a budget #9216 feat(desktop): build several tasks from one capture, and measure each task's pass rate within a budget (both)
• feat(desktop): check apps whose files REA can't read, through the app's own headless mode or a screen judge #9217 feat(desktop): check apps whose files REA can't read, through the app's own headless mode or a screen judge (both)
• fix(cli): reject malformed boolean option literals #9226 fix(cli): reject malformed boolean option literals (both)
• fix: distinguish single symlink from loop in inspect ELOOP errors and name resolved target #9259 fix: distinguish single symlink from loop in inspect ELOOP errors and name resolved target (both)
• fix(desktop): quote captured metadata in exported bundles #9298 fix(desktop): quote captured metadata in exported bundles (both)
• feat(cli): reuse analysis snapshots in native value traces #9320 feat(cli): reuse analysis snapshots in native value traces (both)
• fix(managed): preserve unknown field access opcodes #9520 fix(managed): preserve unknown field access opcodes (both)
• fix(native): reject inherited Lipo CPU names #9522 fix(native): reject inherited Lipo CPU names (both)
• fix(elf): disclose duplicate kernel-module text sections #9530 fix(elf): disclose duplicate kernel-module text sections (both)

Merge conflict only (26)

• feat(angr): add angr MCP analysis provider #2418 feat(angr): add angr MCP analysis provider (conflicts)
• feat(adb): add UI Automator discovery, waits and actions #3004 feat(adb): add UI Automator discovery, waits and actions (conflicts)
• feat(evm): inspect exact Solidity compiler artifacts #3024 feat(evm): inspect exact Solidity compiler artifacts (conflicts)
• feat(doctor): diagnose firmware integration readiness #3899 feat(doctor): diagnose firmware integration readiness (conflicts)
• feat(ghidra): report blocks the decompiler removed as unreachable #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts)
• feat(ghidra): admit RISC-V position-independent executables (#4487) #4811 feat(ghidra): admit RISC-V position-independent executables ([Feature] Ghidra RISC-V lane: admit position-independent executables (ET_DYN); distro riscv64 binaries are almost all PIE #4487) (conflicts)
• feat(ida): support the official Hex-Rays IDA MCP headlessly #4813 feat(ida): support the official Hex-Rays IDA MCP headlessly (conflicts)
• docs: add REA guide and architecture patterns aligned to 6.7.0 #5197 docs: add REA guide and architecture patterns aligned to 6.7.0 (conflicts)
• feat(binary-ninja): add GUI MCP analysis provider #5794 feat(binary-ninja): add GUI MCP analysis provider (conflicts)
• fix(ghidra): add structured startup-timeout diagnostics #6142 fix(ghidra): add structured startup-timeout diagnostics (conflicts)
• test(ghidra): verify PSP Allegrex unresolved indirect branches #6931 test(ghidra): verify PSP Allegrex unresolved indirect branches (conflicts)
• test(inspector): keep the target cancellation fixture path exactly reported #7056 test(inspector): keep the target cancellation fixture path exactly reported (conflicts)
• feat(setup): prefer client plugins with opt-in Cursor installation #7619 feat(setup): prefer client plugins with opt-in Cursor installation (conflicts)
• feat(ghidra): analyze Game Boy SM83 cartridge ROMs #8012 feat(ghidra): analyze Game Boy SM83 cartridge ROMs (conflicts)
• fix(cli): keep MCP registration JSON output parseable #8071 fix(cli): keep MCP registration JSON output parseable (conflicts)
• fix(kuna): distinguish xref inventory misses from procedure misses #8436 fix(kuna): distinguish xref inventory misses from procedure misses (conflicts)
• fix(browser): record the redirect answered to a request step #8467 fix(browser): record the redirect answered to a request step (conflicts)
• feat(psp): correlate caller-selected symbol maps with Ghidra inventories #8615 feat(psp): correlate caller-selected symbol maps with Ghidra inventories (conflicts)
• fix(native): name chained imports from the binary's import table #8724 fix(native): name chained imports from the binary's import table (conflicts)
• fix(decompile): retain pseudocode language facts on bulk export #8771 fix(decompile): retain pseudocode language facts on bulk export (conflicts)
• feat(diagnostics): inspect and search raw file bytes by file offset #8879 feat(diagnostics): inspect and search raw file bytes by file offset (conflicts)
• docs(doctor): clarify providerInspections coverage versus catalog surfaces #8887 docs(doctor): clarify providerInspections coverage versus catalog surfaces (conflicts)
• docs(setup): clarify doctor registration does not prove client tool names #8888 docs(setup): clarify doctor registration does not prove client tool names (conflicts)
• fix(cli): reject separate empty-string values for mcp add valued options #8929 fix(cli): reject separate empty-string values for mcp add valued options (conflicts)
• docs(install): document pinned and reviewable installation options #8933 docs: prefer pinned install commands and reviewable install.sh (conflicts)
• feat(artifacts): inspect and extract Android backups #9047 feat(artifacts): inspect and extract Android backups (conflicts)

Failing CI only (6)

• fix(browser): summarize nonstandard response status codes #7776 fix(browser): summarize nonstandard response status codes (CI)
• test(browser): measure source-map verifier startup deadline #7990 test(browser): measure source-map verifier startup deadline (CI)
• Fix: [Design] Make retained graph results reusable across MCP snapshot handoffs #8741 Fix: [Design] Make retained graph results reusable across MCP snapshot handoffs (CI)
• Fix: [Design] Inspect explicitly selected code outside provider inventory #8759 Fix: [Design] Inspect explicitly selected code outside provider inventory (CI)
• Fix: [Design] Make Kuna automatic analysis mode and its limits visible #8796 Fix: [Design] Make Kuna automatic analysis mode and its limits visible (CI)
• Create datadog-synthetics.yml #8939 Create datadog-synthetics.yml (CI)

Merge conflict and failing CI (8)

• feat(ghidra)!: preserve paged warnings and require observed comparison coverage #2904 feat(ghidra)!: preserve paged warnings and require observed comparison coverage (both)
• feat(artifacts): recognize CFB containers with explicit coverage limits #3404 feat(artifacts): recognize CFB containers with explicit coverage limits (both)
• feat(i18n): add Albanian README and website translations #4172 feat(i18n): add Albanian README and website translations (both)
• feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources #4285 feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources (both)
• feat(go): add capped build-info admission overrides #8447 feat(go): add capped build-info admission overrides (both)
• fix(apple): keep integer precision when strings follow offset table #8906 fix(apple): keep integer precision when strings follow offset table (both)
• fix(cli): align ADB setting key validation with its schema #8953 fix(cli): align ADB setting key validation with its schema (both)
• feat(hwp): add inspect_hwp_document tool for HWP/HWPX documents #9053 feat(hwp): add inspect_hwp_document tool for HWP/HWPX documents (both)

Merge conflict only (120)

• feat(ghidra): verify and pin the 32-bit ARM (armhf) lane #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts)
• feat(process): add owned debugger shutdown lifecycle #1959 feat(process): add owned debugger shutdown lifecycle (conflicts)
• fix(gdb)!: preserve interrupt and provider cleanup ownership #1961 fix(gdb)!: preserve interrupt and provider cleanup ownership (conflicts)
• fix(javascript): preserve builtin effects at their read sites #2041 fix(javascript): preserve builtin effects at their read sites (conflicts)
• docs(readme): add Hinglish translation #2043 docs(readme): add Hinglish translation (conflicts)
• feat(packaging): prepare a Windows portable runtime #2136 feat(packaging): prepare a Windows portable runtime (conflicts)
• feat(mcp): accept common argument-name aliases for procedure and search tools #2148 feat(mcp): accept common argument-name aliases for procedure and search tools (conflicts)
• feat(ghidra): admit plain MIPS32 PIC shared images #2362 feat(ghidra): admit plain MIPS32 PIC shared images (conflicts)
• fix(cli): preserve mcp doctor output choices on argument errors #2693 fix(cli): preserve mcp doctor output choices on argument errors (conflicts)
• fix(wasm): raise the WABT output budget to 128 MiB #2694 fix(wasm): raise the WABT output budget to 128 MiB (conflicts)
• fix(adb): drop the remaining exclusivity claim from push guidance #2868 fix(adb): drop the remaining exclusivity claim from push guidance (conflicts)
• feat(browser): add screenshot bounds and region comparisons #2988 feat(browser): add screenshot bounds and region comparisons (conflicts)
• feat(providers): enable agent-aware deep provider selection #3090 feat(providers): enable agent-aware deep provider selection (conflicts)
• docs(readme): sync Simplified Chinese README with current English prerequisites #3113 docs(readme): sync Simplified Chinese README with current English prerequisites (conflicts)
• docs(skill): flag hidden-window throttling in passive browser observation #3124 docs(skill): flag hidden-window throttling in passive browser observation (conflicts)
• feat(binary): recognize XEX2 and PowerPC PE basefiles #3429 feat(binary): recognize XEX2 and PowerPC PE basefiles (conflicts)
• fix(process): bound bridge response framing #3444 fix(process): bound bridge response framing (conflicts)
• fix(browser): keep an undecodable Electron worker target uncertain #3513 fix(browser): keep an undecodable Electron worker target uncertain (conflicts)
• feat(reverse): add radare2 one-shot commands and analysis sessions #3521 feat(reverse): add radare2 one-shot commands and analysis sessions (conflicts)
• feat(reconstruction): verify visual screenshot claims #3529 feat(reconstruction): verify visual screenshot claims (conflicts)
• feat(ghidra): persistent project cache with cross-session identity #3531 feat(ghidra): persistent project cache with cross-session identity (conflicts)
• fix(android): classify a pre-handshake JADX heap shortage as a resource limit #3573 fix(android): classify a pre-handshake JADX heap shortage as a resource limit (conflicts)
• fix(debugger): shield inferior identity verification on proc stat ENOENT #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts)
• feat(android)!: expose method access flags and absent body reasons #3585 feat(android)!: expose method access flags and absent body reasons (conflicts)
• feat(jvm): inspect JVM source-line & local-variable debug metadata (#2377) #3586 feat(jvm): inspect JVM source-line & local-variable debug metadata ([Feature] Inspect JVM source-line and local-variable metadata for debugging readiness #2377) (conflicts)
• feat(windows): admit arm64 hosts for the bundled native controls #3602 feat(windows): admit arm64 hosts for the bundled native controls (conflicts)
• Feat/claude code codex plugin #3697 Feat/claude code codex plugin (conflicts)
• feat(experiments): prototype Electron IPC effect attribution #3742 feat(experiments): prototype Electron IPC effect attribution (conflicts)
• feat(jvm): export Vineflower sources with explicit dependencies #3753 feat(jvm): export Vineflower sources with explicit dependencies (conflicts)
• Feat/lucas profile roadmap #3762 Feat/lucas profile roadmap (conflicts)
• Fix/review feedback 3762 #3769 Fix/review feedback 3762 (conflicts)
• feat(native): inspect Windows minidump streams offline #3770 feat(native): inspect Windows minidump streams offline (conflicts)
• feat(bridge): discover BYO x64dbg without launching a session #3773 feat(bridge): discover BYO x64dbg without launching a session (conflicts)
• feat(native): static packer identification for PE and ELF #3775 feat(native): static packer identification for PE and ELF (conflicts)
• feat(ghidra): apply a caller-selected PDB that matches the target #3818 feat(ghidra): apply a caller-selected PDB that matches the target (conflicts)
• feat(managed)!: expose file-backed field initialization data #3835 feat(managed)!: expose file-backed field initialization data (conflicts)
• feat(android): add boot wait and resource-id to code tracing #3840 feat(android): add boot wait and resource-id to code tracing (conflicts)
• feat(website): polish interactions and remove em dashes #3903 feat(website): polish interactions and remove em dashes (conflicts)
• feat(cli): report MCP catalog size in doctor #3905 feat(cli): report MCP catalog size in doctor (conflicts)
• feat(evidence): add literal text query to retained Evidence summaries #3966 feat(evidence): add literal text query to retained Evidence summaries (conflicts)
• feat(clients): register ggcode during setup #4039 feat(clients): register ggcode during setup (conflicts)
• fix(setup): write the recommended tool call timeout into dsh registrations #4043 fix(setup): write the recommended tool call timeout into dsh registrations (conflicts)
• feat(evidence): cluster inspected artifacts into families by root digest #4133 feat(evidence): cluster inspected artifacts into families by root digest (conflicts)
• docs(ar): synchronize README_ar.md with upstream English documentation #4139 docs(ar): synchronize README_ar.md with upstream English documentation (conflicts)
• feat(windows): capture selected windows through owned helpers #4143 feat(windows): capture selected windows through owned helpers (conflicts)
• feat(analysis-view): page retained browser scenario steps and text #4163 feat(analysis-view): page retained browser scenario steps and text (conflicts)
• fix(ghidra): prevent loader relocations from constant folding #4198 fix(ghidra): prevent loader relocations from constant folding (conflicts)
• feat(ida): verify headless caller relationships with call graphs #4200 feat(ida): verify headless caller relationships with call graphs (conflicts)
• docs(android): define safe TLS capture composition #4203 docs(android): define safe TLS capture composition (conflicts)
• test(ghidra): align fixtures with Windows host boundaries #4334 test(ghidra): align fixtures with Windows host boundaries (conflicts)
• feat(setup): add IBM Bob client registration #4367 feat(setup): add IBM Bob client registration (conflicts)
• feat(evidence): add evidence bundle audit command and MCP tool #4482 feat(evidence): add evidence bundle audit command and MCP tool (conflicts)
• fix(managed): compare member bodies by nominal identity across builds #4516 fix(managed): compare member bodies by nominal identity across builds (conflicts)
• fix(rizin): default debugger sessions to plain output #4546 fix(rizin): default debugger sessions to plain output (conflicts)
• feat(browser-extension): inspect declared CRX and XPI manifest surfaces #4554 feat(browser-extension): inspect declared CRX and XPI manifest surfaces (conflicts)
• fix(browser): record dedicated worker requests through attached sessions #4585 fix(browser): record dedicated worker requests through attached sessions (conflicts)
• feat(evidence): cluster artifacts from retained Evidence references and summaries #4589 feat(evidence): cluster artifacts from retained Evidence references and summaries (conflicts)
• fix(errors): separate recovery actions from failure messages #4829 fix(errors): separate recovery actions from failure messages (conflicts)
• fix(domain): admit SPARC V9 (EM_SPARCV9, 43) ELF binaries #4843 fix(domain): admit SPARC V9 (EM_SPARCV9, 43) ELF binaries (conflicts)
• Feat/snes rom 65816 #4911 Feat/snes rom 65816 (conflicts)
• test(http3): verify reset and partial-response capture semantics #4924 test(http3): verify reset and partial-response capture semantics (conflicts)
• feat(reconstruction)!: require failing verifier controls #4991 feat(reconstruction)!: require failing verifier controls (conflicts)
• fix(browser): reclaim scenario profiles whose owner is gone #4995 fix(browser): reclaim scenario profiles whose owner is gone (conflicts)
• feat(rust): read cargo-auditable dependencies from WebAssembly modules #5069 feat(rust): read cargo-auditable dependencies from WebAssembly modules (conflicts)
• fix: allow Tiny PE e_lfanew inside DOS header #5216 fix: allow Tiny PE e_lfanew inside DOS header (conflicts)
• chore(android): update jadx-headless-mcp provider to 0.8.0 #5248 chore(android): update jadx-headless-mcp provider to 0.8.0 (conflicts)
• test(ghidra): strengthen raw-binary, firmware, and instruction flow verification #5263 test(ghidra): strengthen raw-binary, firmware, and instruction flow verification (conflicts)
• fix(javascript): keep var reads before their declarator unknown #5303 fix(javascript): keep var reads before their declarator unknown (conflicts)
• feat(android): add optional DroidASC class discovery backend #5380 feat(android): add optional DroidASC class discovery backend (conflicts)
• fix(process): reschedule poll on failure and bound stream buffer #5558 fix(process): reschedule poll on failure and bound stream buffer (conflicts)
• fix(browser): ensure cancellation deadline and teardown on hanging CDP calls #5560 fix(browser): ensure cancellation deadline and teardown on hanging CDP calls (conflicts)
• fix(native): keep ELF layout independent of pwntools kernel probes #5755 fix(native): keep ELF layout independent of pwntools kernel probes (conflicts)
• fix(firmware): reclassify output-directory admission failures as invalid_request #5902 fix(firmware): reclassify output-directory admission failures as invalid_request (conflicts)
• fix(adb): preserve filesystem meaning of host paths #6089 fix(adb): preserve filesystem meaning of host paths (conflicts)
• fix(javascript): bound member-mutation traversal and add max-heap-mb to compare-application-versions (#6127) #6146 fix(javascript): bound member-mutation traversal and add max-heap-mb to compare-application-versions (analyze-javascript-application exhausts a 6 GiB worker heap on a 233 KB file #6127) (conflicts)
• feat: extended artifact formats, Gzip reader, Python/PyInstaller, PE inspector, JVM reader, Minidump parser, and platform portability #6147 feat: extended artifact formats, Gzip reader, Python/PyInstaller, PE inspector, JVM reader, Minidump parser, and platform portability (conflicts)
• fix(javascript): include slotless accesses in property traces #6190 fix(javascript): include slotless accesses in property traces (conflicts)
• feat(harmony): add xpanda-backed Ark bytecode analysis #6288 feat(harmony): add xpanda-backed Ark bytecode analysis (conflicts)
• chore(experiments): prototype MCAP summary inspection #6306 chore(experiments): prototype MCAP summary inspection (conflicts)
• fix(cli): delegate rea mcp add to setup --client on Windows (#5811) #6347 fix(cli): delegate rea mcp add to setup --client on Windows ([Bug] rea mcp add fails on Windows with spawn npx ENOENT #5811) (conflicts)
• fix(reconstruction)!: require distinct contents for fixture controls #6367 fix(reconstruction)!: require distinct contents for fixture controls (conflicts)
• fix(comparison): reject blank function names #6856 fix(comparison): reject blank function names (conflicts)
• feat(comparison): add opt-in address-normalized function text views #6970 feat(comparison): add opt-in address-normalized function text views (conflicts)
• feat(doctor): report the configured workflow beside an audit-wide result #7004 feat(doctor): report the configured workflow beside an audit-wide result (conflicts)
• feat(binary-ninja-headless): add owned headless Binary Ninja provider #7041 feat(binary-ninja-headless): add owned headless Binary Ninja provider (conflicts)
• fix(capture): run without a PTY where the native preload cannot fork #7046 fix(capture): run without a PTY where the native preload cannot fork (conflicts)
• test(contracts): pin public machine-readable analysis output contracts #7085 test(contracts): pin public machine-readable analysis output contracts (conflicts)
• fix(reference): bound historical source imports #7125 fix(reference): bound historical source imports (conflicts)
• fix(ghidra): explain building the native decompiler on macOS and Linux ARM64 #7141 fix(ghidra): explain building the native decompiler on macOS and Linux ARM64 (conflicts)
• fix(process): identify inaccessible Linux namespace peers #7147 fix(process): identify inaccessible Linux namespace peers (conflicts)
• feat(artifacts): add dry-run plan for artifact extraction #7177 feat(artifacts): add dry-run plan for artifact extraction (conflicts)
• feat(ledger)!: require failing negative control before verifier closes obligation #7178 feat(ledger)!: require failing negative control before verifier closes obligation (conflicts)
• feat(javascript): retain source-proven main-to-renderer IPC sends #7210 feat(javascript): retain source-proven main-to-renderer IPC sends (conflicts)
• feat(ghidra): accept Ghidra 12.2.x as a compatible, unverified release line #7239 feat(ghidra): accept Ghidra 12.2.x as a compatible, unverified release line (conflicts)
• feat(android): project expected JNI/JNA symbol names and structural attack-surface facts #7245 feat(android): project expected JNI/JNA symbol names and structural attack-surface facts (conflicts)
• fix(cli): state each option default once in help output #7334 fix(cli): state each option default once in help output (conflicts)
• fix(analysis-view): qualify 32-segment route limit in prefix-variance guidance #7446 fix(analysis-view): qualify 32-segment route limit in prefix-variance guidance (conflicts)
• fix(mcp): explain skipped doctor identity probes #7465 fix(mcp): explain skipped doctor identity probes (conflicts)
• fix(adb)!: reject malformed package numeric tokens #7470 fix(adb)!: reject malformed package numeric tokens (conflicts)
• docs(client-configuration): document Cursor, Windsurf, and Command Code targets #7750 docs(client-configuration): document Cursor, Windsurf, and Command Code targets (conflicts)
• fix(wasm): retain rejected REA_WABT_BIN_DIRECTORY value in refusal #7753 fix(wasm): retain rejected REA_WABT_BIN_DIRECTORY value in refusal (conflicts)
• fix(native): name the exhausted native export allowance by its units #7754 fix(native): name the exhausted native export allowance by its units (conflicts)
• docs(ci): match SQLite and build-cache lane descriptions to workflows #7756 docs(ci): match SQLite and build-cache lane descriptions to workflows (conflicts)
• feat(android): pin jadx-headless-mcp 0.8.0 #7772 feat(android): pin jadx-headless-mcp 0.8.0 (conflicts)
• feat(native): inspect Linux BTF types and BTF.ext records #7783 feat(native): inspect Linux BTF types and BTF.ext records (conflicts)
• fix(cli): publish partial Evidence to --evidence_output on failure #7797 fix(cli): publish partial Evidence to --evidence_output on failure (conflicts)
• docs(readme): sync zh-TW README with English #7980 docs(readme): sync zh-TW README with English (conflicts)
• docs(id): restore MCP setup recovery guidance #8000 docs(id): restore MCP setup recovery guidance (conflicts)
• docs(ida): note headless decompile needs a paginated upstream #8093 docs(ida): note headless decompile needs a paginated upstream (conflicts)
• fix(process): stabilize capture comparisons #8279 fix(process): stabilize capture comparisons (conflicts)
• docs: note that tool family scoping is not in the published 6.8.0 pac… #8310 docs: note that tool family scoping is not in the published 6.8.0 pac… (conflicts)
• fix(mcp): deliver guidance results under their advertised result object #8326 fix(mcp): deliver guidance results under their advertised result object (conflicts)
• fix(providers): mark callee coverage partial at computed call sites #8340 fix(providers): mark callee coverage partial at computed call sites (conflicts)
• fix(native): keep fixed zero-parameter calls out of missing-binding unknowns #8343 fix(native): keep fixed zero-parameter calls out of missing-binding unknowns (conflicts)
• fix(ghidra): report byte-search cursor mismatches without schema repair #8420 fix(ghidra): report byte-search cursor mismatches without schema repair (conflicts)
• fix(setup): isolate Gemini CLI detection from Antigravity #8479 fix(setup): isolate Gemini CLI detection from Antigravity (conflicts)
• feat(unity): inspect WebGL data containers and SerializedFile assets #8497 feat(unity): inspect WebGL data containers and SerializedFile assets (conflicts)
• fix(navigation): name instruction alternatives in navigation refusals #8537 fix(navigation): name instruction alternatives in navigation refusals (conflicts)
• fix(analysis): append large inventories without exceeding call-argument limits #8568 fix(analysis): append large inventories without exceeding call-argument limits (conflicts)
• fix: preserve navigation, network, and control-transfer uncertainty #8695 fix: preserve navigation, network, and control-transfer uncertainty (conflicts)

Failing CI only (45)

• fix(javascript): resolve spread and constant kill-signal arguments #2830 fix(javascript): resolve spread and constant kill-signal arguments (CI)
• perf(ghidra): resolve Swift select provenance once per function #2870 perf(ghidra): resolve Swift select provenance once per function (CI)
• Configure the Cursor Cloud Agent environment #3043 Configure the Cursor Cloud Agent environment (CI)
• docs: clarify automated agent development setup #3074 docs: clarify automated agent development setup (CI)
• Improve page template UI: responsive layout, dark mode, reading progress #3258 Improve page template UI: responsive layout, dark mode, reading progress (CI)
• docs(skills): add REA repository analysis workflow #3411 docs(skills): add REA repository analysis workflow (CI)
• feat(android): check split APK set consistency from manifest facts #3495 feat(android): check split APK set consistency from manifest facts (CI)
• feat(artifacts): read compiled AndroidManifest.xml attributes #3496 feat(artifacts): read compiled AndroidManifest.xml attributes (CI)
• Lunz Research Group Apresents: REA-LUNZ-CAUSAL-ENGINE #3750 Lunz Research Group Apresents: REA-LUNZ-CAUSAL-ENGINE (CI)
• docs: add a static VB6 native OCX investigation workflow #3810 docs: add a static VB6 native OCX investigation workflow (CI)
• fix(javascript): treat exact location-only moves as unchanged #4536 fix(javascript): treat exact location-only moves as unchanged (CI)
• feat(js): resolve class instance method calls in semantic graphs #4675 feat(js): resolve class instance method calls in semantic graphs (CI)
• test(adb): bind snapshot cleanup fixtures to runtime ownership #4741 test(adb): bind snapshot cleanup fixtures to runtime ownership (CI)
• fix(cli): stream default TOON results past the string limit #4807 fix(cli): stream default TOON results past the string limit (CI)
• feat(experiments): add MCP tool-selection eval harness #5024 feat(experiments): add MCP tool-selection eval harness (CI)
• fix(adb): reuse shared PNG header validation #5172 fix(adb): reuse shared PNG header validation (CI)
• test(mcp): normalize server identity fixture paths on Windows #5213 test(mcp): normalize server identity fixture paths on Windows (CI)
• fix: correct cmd.exe /s /c argument quoting for Windows batch launchers #5317 fix: correct cmd.exe /s /c argument quoting for Windows batch launchers (CI)
• fix(ghidra): raise decompiler max payload cap for very large functions #5325 fix(ghidra): raise decompiler max payload cap for very large functions (CI)
• test(setup): cover skill aliases and independent cleanup retries #5936 test(setup): cover skill aliases and independent cleanup retries (CI)
• fix(browser): return completed scenario capture when cleanup is unconfirmed #6381 fix(browser): return completed scenario capture when cleanup is unconfirmed (CI)
• feat(cli): add provider-free 'profile' command with per-fact confidence #6396 feat(cli): add provider-free 'profile' command with per-fact confidence (CI)
• REA ENGINEER  #6940 REA ENGINEER (CI)
• ci(real-go-binary): pin Go 1.26.10 #6992 ci(real-go-binary): pin Go 1.26.10 (CI)
• fix(pe): admit Authenticode nesting depth of signed Windows binaries #7160 fix(pe): admit Authenticode nesting depth of signed Windows binaries (CI)
• fix(environment): map id-list elements when a scalar set also changed #7161 fix(environment): map id-list elements when a scalar set also changed (CI)
• feat(process): support FreeBSD hosts #7174 feat(process): support FreeBSD hosts (CI)
• feat: add investigation-loop domain module (Phase 1, #7193) #7197 feat: add investigation-loop domain module (Phase 1, [Feature] Investigation-loop construct for agent-driven deep dives (loop engineering) #7193) (CI)
• chore(bridge): remove unused imports and a shadowed loop variable #7231 chore(bridge): remove unused imports and a shadowed loop variable (CI)
• fix(cli): count the full-output envelope for TOON/YAML token counts #7278 fix(cli): count the full-output envelope for TOON/YAML token counts (CI)
• Initial commit #7463 Initial commit (CI)
• Feat/studio #7591 Feat/studio (CI)
• docs(i18n): mention bun add --global in translated FAQ update answers #7878 docs(i18n): mention bun add --global in translated FAQ update answers (CI)
• fix(ida): surface actionable error when headless decompile lacks pagination #8094 fix(ida): surface actionable error when headless decompile lacks pagination (CI)
• chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.1 #8128 chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.1 (CI)
• chore(deps-dev): bump @toon-format/toon from 2.3.1 to 4.4.0 #8130 chore(deps-dev): bump @toon-format/toon from 2.3.1 to 4.4.0 (CI)
• chore(deps): bump actions/cache/restore from 4.3.0 to 6.1.0 #8131 chore(deps): bump actions/cache/restore from 4.3.0 to 6.1.0 (CI)
• chore(deps): bump canonicalize from 3.0.0 to 5.1.0 #8132 chore(deps): bump canonicalize from 3.0.0 to 5.1.0 (CI)
• build(deps): bump actions/setup-node from 4.4.0 to 7.1.0 #8133 build(deps): bump actions/setup-node from 4.4.0 to 7.1.0 (CI)
• chore(deps): bump write-file-atomic from 7.0.0 to 8.0.0 #8134 chore(deps): bump write-file-atomic from 7.0.0 to 8.0.0 (CI)
• chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.2 #8135 chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.2 (CI)
• chore(deps-dev): bump lint-staged from 16.4.0 to 17.6.0 #8136 chore(deps-dev): bump lint-staged from 16.4.0 to 17.6.0 (CI)
• fix(analysis): order graph depths numerically #8268 fix(analysis): order graph depths numerically (CI)
• perf(artifacts): skip re-creating owned extraction directories #8458 perf(artifacts): skip re-creating owned extraction directories (CI)
• fix(verifiers): retain the Go fixture root until MCP ownership completes #8650 fix(verifiers): retain the Go fixture root until MCP ownership completes (CI)

Merge conflict and failing CI (105)

• docs(website): add reproducible starter demos #1704 docs(website): add reproducible starter demos (both)
• fix(setup): preserve user fields on an existing REA client entry #1732 fix(setup): preserve user fields on an existing REA client entry (both)
• feat(javascript): add proof-gated js-redox deobfuscation #1815 feat(javascript): add proof-gated js-redox deobfuscation (both)
• feat(ghidra): add bounded PS-X EXE static analysis #1948 feat(ghidra): add bounded PS-X EXE static analysis (both)
• feat(evaluation): run agent evaluation against Claude Code and Gemini CLI #1971 feat(evaluation): run agent evaluation against Claude Code and Gemini CLI (both)
• feat(javascript): resolve package exports and imports wildcard patterns #2018 feat(javascript): resolve package exports and imports wildcard patterns (both)
• docs(skill): pin the package runner and treat target content as untrusted #2052 docs(skill): pin the package runner and treat target content as untrusted (both)
• feat(browser): retain worker source and runtime evidence #2068 feat(browser): retain worker source and runtime evidence (both)
• feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine #2093 feat(javascript-recovery): add jsbeautify as a caller-supplied recovery engine (both)
• feat(javascript): fold constant values and recover Electron boundaries through wrappers #2094 feat(javascript): fold constant values and recover Electron boundaries through wrappers (both)
• fix(javascript): admit measured transfer retention in parent result budget #2097 fix(javascript): admit measured transfer retention in parent result budget (both)
• fix(setup): show non-interactive setup results in a terminal #2185 fix(setup): show non-interactive setup results in a terminal (both)
• feat(ios): Add iOS app support - add jailbroken runtime debugging lanes #2264 feat(ios): Add iOS app support - add jailbroken runtime debugging lanes (both)
• feat(wasm): decode WebAssembly components offline #2406 feat(wasm): decode WebAssembly components offline (both)
• feat(website): add Central Kurdish (Sorani) locale #2407 feat(website): add Central Kurdish (Sorani) locale (both)
• feat(setup): support private Claude Code project registrations #2414 feat(setup): support private Claude Code project registrations (both)
• feat(managed): bind Portable PDB sequence points to selected methods #2435 feat(managed): bind Portable PDB sequence points to selected methods (both)
• fix(javascript): preserve intrinsic invocation read identity #2465 fix(javascript): preserve intrinsic invocation read identity (both)
• docs(skills): add source attribution and evidence handoff guidance #2701 docs(skills): add source attribution and evidence handoff guidance (both)
• feat(java): inspect archives and decompile selected classes #2717 feat(java): inspect archives and decompile selected classes (both)
• fix(ghidra): keep unreported Java bitness unknown #2771 fix(ghidra): keep unreported Java bitness unknown (both)
• feat(windows): add REA desktop GUI #2819 feat(windows): add REA desktop GUI (both)
• fix(android): require explicit invoke coverage state #2850 fix(android): require explicit invoke coverage state (both)
• docs: add Hindi (हिन्दी) translation of README #2862 docs: add Hindi (हिन्दी) translation of README (both)
• fix(browser): preserve explicit URL references and endpoint evidence #2878 fix(browser): preserve explicit URL references and endpoint evidence (both)
• feat(native): decode RT_STRING and RT_VERSION payloads in PE resources #2887 feat(native): decode RT_STRING and RT_VERSION payloads in PE resources (both)
• fix(filesystem): PRoot compatibility for sameRegularFileState #2922 fix(filesystem): PRoot compatibility for sameRegularFileState (both)
• feat(ghidra): admit bounded m68k ELF analysis through Ghidra #2923 feat(ghidra): admit bounded m68k ELF analysis through Ghidra (both)
• fix(hopper): support WSLg socket symlinks for private displays #2969 fix(hopper): support WSLg socket symlinks for private displays (both)
• fix(javascript): global augmentation kind and additional web/browser inspections #2986 fix(javascript): global augmentation kind and additional web/browser inspections (both)
• feat(cli): run ordered tool batches in one provider session #3028 feat(cli): run ordered tool batches in one provider session (both)
• fix(ghidra): recover registered Borland SEH handler gaps #3029 fix(ghidra): recover registered Borland SEH handler gaps (both)
• Fix/android runtime fallback #3030 Fix/android runtime fallback (both)
• docs(skill): add optional public-source research guidance #3037 docs(skill): add optional public-source research guidance (both)
• fix(android): decode guardian readiness across UTF-8 chunks #3048 fix(android): decode guardian readiness across UTF-8 chunks (both)
• feat(setup): support OpenClaw native MCP and active profiles #3100 feat(setup): support OpenClaw native MCP and active profiles (both)
• feat(ghidra): admit ELF and thin Mach-O targets on Windows #3129 feat(ghidra): admit ELF and thin Mach-O targets on Windows (both)
• feat(managed): decode signature-owned custom attribute arguments #3317 feat(managed): decode signature-owned custom attribute arguments (both)
• test(javascript): cover missing package-manifest companions staying unknown #3339 test(javascript): cover missing package-manifest companions staying unknown (both)
• feat(javascript): recover synchronous child-process creation #3433 feat(javascript): recover synchronous child-process creation (both)
• fix(setup): default Claude Desktop to compact MCP schemas #3486 fix(setup): default Claude Desktop to compact MCP schemas (both)
• fix(application): surface web resource cleanup errors via tagged error algebra #3492 fix(application): surface web resource cleanup errors via tagged error algebra (both)
• docs(i18n): add Devanagari CSS, Hindi README base, and initial website translations #3547 docs(i18n): add Devanagari CSS, Hindi README base, and initial website translations (both)
• fix(hopper): normalize cross-platform launcher paths #3558 fix(hopper): normalize cross-platform launcher paths (both)
• Feat/pri resources #3589 Feat/pri resources (both)
• fix(security): harden archive and Hopper probes #3659 fix(security): harden archive and Hopper probes (both)
• fix(flutter): inspect the renamed Dart AOT snapshot layout #3662 fix(flutter): inspect the renamed Dart AOT snapshot layout (both)
• fix(android): disable JVM perf data for JADX Java launches #3772 fix(android): disable JVM perf data for JADX Java launches (both)
• feat(ghidra): select an existing-project program inside a project folder #3817 feat(ghidra): select an existing-project program inside a project folder (both)
• test(browser): cover invalid WebMCP annotation payloads #3837 test(browser): cover invalid WebMCP annotation payloads (both)
• feat(procmon): read saved Process Monitor XML and CSV exports as Evidence #3967 feat(procmon): read saved Process Monitor XML and CSV exports as Evidence (both)
• feat(setup): add MiniMax Code client #3968 feat(setup): add MiniMax Code client (both)
• feat(go)!: inspect compiler-declared function entries #3976 feat(go)!: inspect compiler-declared function entries (both)
• feat(windows): support Windows ARM64 native controls and provider boundaries #4061 feat(windows): support Windows ARM64 native controls and provider boundaries (both)
• perf(cli): skip command schemas for standalone version queries #4083 perf(cli): skip command schemas for standalone version queries (both)
• feat(mcp): support real-time operation progress and ETA notifications #4161 feat(mcp): support real-time operation progress and ETA notifications (both)
• fix(browser): preserve uncertainty for omitted initiator URLs (#4211) #4224 fix(browser): preserve uncertainty for omitted initiator URLs ([Bug] Omitted initiator URLs cause unsupported passive network comparison results #4211) (both)
• fix(apple): retain keyed archive scalar object kinds #4317 fix(apple): retain keyed archive scalar object kinds (both)
• fix(cleanup): restore shared ownership across browser, capture, and adb boundaries #4345 fix(cleanup): restore shared ownership across browser, capture, and adb boundaries (both)
• fix(javascript): preserve loader getters across inactive defaults #4355 fix(javascript): preserve loader getters across inactive defaults (both)
• fix(browser): record dedicated worker requests in page inspection #4456 fix(browser): record dedicated worker requests in page inspection (both)
• docs: add Urdu (اردو) README translation #4491 docs: add Urdu (اردو) README translation (both)
• fix(setup): preserve exact Windows AppData roots #4523 fix(setup): preserve exact Windows AppData roots (both)
• fix(ghidra): admit recordless legacy MIPS32 carves missing section tables #4532 fix(ghidra): admit recordless legacy MIPS32 carves missing section tables (both)
• fix(native): scale NativeAOT work budget and resolve base types by index #4559 fix(native): scale NativeAOT work budget and resolve base types by index (both)
• docs: add a .NET static-analysis walkthrough #4611 docs: add a .NET static-analysis walkthrough (both)
• fix(javascript): scope candidate this event receivers #4656 fix(javascript): scope candidate this event receivers (both)
• fix(javascript): bound alias-cycle call-target and returned-reference expansion #4716 fix(javascript): bound alias-cycle call-target and returned-reference expansion (both)
• fix(setup): bound Hopper downloads by idle time instead of total duration #4719 fix(setup): bound Hopper downloads by idle time instead of total duration (both)
• fix(adb): attribute pull file refusals to the device path #4720 fix(adb): attribute pull file refusals to the device path (both)
• fix: clean up quality gate findings #4857 fix: clean up quality gate findings (both)
• fix: ELF multi-architecture support and quality fixes #4871 fix: ELF multi-architecture support and quality fixes (both)
• Improve reverse engineering reliability, Android analysis, and binary diagnostics #4887 Improve reverse engineering reliability, Android analysis, and binary diagnostics (both)
• test(adb): cover push device-state refusal attribution #4963 test(adb): cover push device-state refusal attribution (both)
• docs(i18n): add Azerbaijani README and sync Turkish edition #4971 docs(i18n): add Azerbaijani README and sync Turkish edition (both)
• fix(update): refuse unverified Bun ancestor ownership #5061 fix(update): refuse unverified Bun ancestor ownership (both)
• fix(artifacts): keep readable entries of a directory with unreadable entries #5230 fix(artifacts): keep readable entries of a directory with unreadable entries (both)
• fix(macho): exact arm64e.x1 slice names and mach-o-universal format #5254 fix(macho): exact arm64e.x1 slice names and mach-o-universal format (both)
• docs: add Urdu README translation #5276 docs: add Urdu README translation (both)
• fix(process): preserve observed command failures before cancellation #5296 fix(process): preserve observed command failures before cancellation (both)
• feat(browser): wake or classify discarded CDP page targets before inspection #5368 feat(browser): wake or classify discarded CDP page targets before inspection (both)
• fix(evidence): stop offering overwrite for outputs that never overwrite #5597 fix(evidence): stop offering overwrite for outputs that never overwrite (both)
• Rama #5622 Rama (both)
• docs(skill): unify reverse-engineering and UI/UX workflows #5712 docs(skill): unify reverse-engineering and UI/UX workflows (both)
• fix(ghidra): point Windows ELF rejection to WSL2 fallback #6124 fix(ghidra): point Windows ELF rejection to WSL2 fallback (both)
• fix(domain): reject ELF files whose program header table runs past the end #6165 fix(domain): reject ELF files whose program header table runs past the end (both)
• feat(ci): require live dependency security evidence for releases #6728 feat(ci): require live dependency security evidence for releases (both)
• test(gpu): retain unsupported PE layout delivery regression #6930 test(gpu): retain unsupported PE layout delivery regression (both)
• fix(process): settle exits during Linux credential observation #6983 fix(process): settle exits during Linux credential observation (both)
• fix(javascript): follow Electron through aliases of Webpack externals #6993 fix(javascript): follow Electron through aliases of Webpack externals (both)
• feat(browser): add passive CSS variables and design token extraction #7030 feat(browser): add passive CSS variables and design token extraction (both)
• perf(javascript): reuse semantic coverage projections #7096 perf(javascript): reuse semantic coverage projections (both)
• fix(update): report Frida native module readiness #7216 fix(update): report Frida native module readiness (both)
• fix(electron): resolve module constant window options read inside functions #7229 fix(electron): resolve module constant window options read inside functions (both)
• feat(elf): decode FDO packaging and dlopen note metadata #7237 feat(elf): decode FDO packaging and dlopen note metadata (both)
• feat(scripts): add repository integrity check #7248 feat(scripts): add repository integrity check (both)
• feat(android): project declared component process and access flags #7264 feat(android): project declared component process and access flags (both)
• feat(solana): add Solana sBPF program analysis domain #7339 feat(solana): add Solana sBPF program analysis domain (both)
• test(windows): declare the native loader fixture optional header #7454 test(windows): declare the native loader fixture optional header (both)
• feat(desktop): add installable REA desktop app #7466 feat(desktop): add installable REA desktop app (both)
• fix(native): admit retroactive flag when decoding Swift static witness tables #7489 fix(native): admit retroactive flag when decoding Swift static witness tables (both)
• fix(pe): preserve TLS templates in virtual zero padding #7529 fix(pe): preserve TLS templates in virtual zero padding (both)
• fix(cli): exit with code 1 on cleanup failure when exit code is undef… #8151 fix(cli): exit with code 1 on cleanup failure when exit code is undef… (both)
• Revise README for usage and community engagement #8265 Revise README for usage and community engagement (both)
• Revise README for REA project introduction #8269 Revise README for REA project introduction (both)

A maintainer asked for changes on these 8 at some point. They are also in the groups above. I did not check whether the author has updated them since.

• feat(ghidra): verify and pin the 32-bit ARM (armhf) lane #1922 feat(ghidra): verify and pin the 32-bit ARM (armhf) lane (conflicts)
• docs(docker): add a container image and guide #3420 docs(docker): add a container image and guide (CI)
• fix(browser): keep an undecodable Electron worker target uncertain #3513 fix(browser): keep an undecodable Electron worker target uncertain (conflicts)
• fix(debugger): shield inferior identity verification on proc stat ENOENT #3580 fix(debugger): shield inferior identity verification on proc stat ENOENT (conflicts)
• feat(windows): capture selected windows through owned helpers #4143 feat(windows): capture selected windows through owned helpers (conflicts)
• feat(i18n): add Albanian README and website translations #4172 feat(i18n): add Albanian README and website translations (both)
• feat(ghidra): report blocks the decompiler removed as unreachable #4237 feat(ghidra): report blocks the decompiler removed as unreachable (conflicts)
• feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources #4285 feat(native): decode Delphi/C++Builder TPF0 form payloads in PE resources (both)

• Start. The list opened on 20 October 2026 with 354 pull requests. Each was open, not a draft, and blocked by a conflict or a failing check.
• Since then. 735 more were added and 641 moved out, so 448 are listed now. Moved on since opening lists the ones still open.
• Each refresh. When a pull request's block changes, its line moves to the matching list. Every line is sorted into its day group again.
• Last activity. The days count from the author's last push or comment. Maintainer comments do not reset it. A pull request with no author activity counts from its last push.
• Failing CI. A check is failing when its newest run failed, whether or not it is required. A cancelled or skipped run does not count.
• Checks passing. Main's four required checks all ran and passed. When those runs wait for a maintainer to approve them, the line says so.
• Changes requested. A review with changes requested, from an owner, member or collaborator who is not the author.
• Age. Every pull request here was opened in the last 29 days.

• [Tracker] Audit and subsystem index of active bug reports (October 2026) #3537: Open bugs, by subsystem (matbrgz)
• [Tracker] Audit and consolidation index of duplicate issues and reports (October 2026) #4330: Duplicate issues, in clusters (matbrgz)
• [Tracker] New issue intake by area #5653: New issues by area, pointing at [Tracker] Audit and consolidation index of duplicate issues and reports (October 2026) #4330 for duplicates (CassieFox23)

• [Tracker] Open feature requests by area #3796: Feature requests, by area (CassieFox23)
• [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #2383: Support for the top 100 languages (matbrgz)
• [Roadmap] Track scoped static artifact and recorded-crash improvements #2357: Static file and crash report work (matbrgz)
• [RFC/Epic] Universal Artifact Discovery: recursive inspection, entropy profiling, file signatures and candidate analyzer routing #3714 to [RFC/Epic] Declarative Format DSL and Domain Extensibility SDK: schema pattern language, typed capability boundaries and isolated analyzer registration #3719: six RFC epics on formats and bytecode (matbrgz)
• [Tracker] Browser / Electron / JavaScript analysis: correctness, performance and capability completion #4027: Browser, Electron and JS work (N0zoM1z0)
• [Roadmap] Embedded firmware: make REA work on the devices around us #7955: Firmware on real devices (Entrpi)
• Roadmap: evolve REA into an agent-first multi-tool reverse-engineering platform #32: The main roadmap (morluto)
• Epic: Evidence v2 and deterministic process fidelity #48: The Evidence v2 epic (morluto)
• Where is REA heading? A plain-words summary (corrections welcome) #2039: The roadmap in plain words, a discussion (CassieFox23)

• [Tracker] Open documentation issues and pull requests #3795: Open docs issues and PRs (CassieFox23)

• [Tracker] Ready to close or merge: issues and pull requests #3582: Ready to close or merge, issues and PRs (CassieFox23)
• [Tracker] Open PRs that can't merge yet: conflicts and red CI #5654: Open PRs with conflicts or red CI (this one, CassieFox23)

• REA on Fedora-based Linux: setup notes, gotchas and my test queue #1435: Linux setup notes and test queue, a discussion (CassieFox23)