What rea standardizes and what it leaves to Ghidra
Two stacks under one host band for macOS 26.2 arm64 with Node 22.22.0 and JDK 21.0.12.1. The left stack is rea 6.7.0: the CLI and MCP adapters with 153 commands, 207 tools, and 6 prompts over one BinarySession, the session with one target and one bound provider that the registry selects and never replaces, the Evidence record with 16 fields and an ev_ content hash kept in the EvidenceLedger, the Zod contracts and the error projection with code, category, message, and retryable, and the GhidraProvider and GhidraClient that send JSON lines over bridge.sock. The right stack is Ghidra 12.1.4: ReaGhidraBridge.java as the last post-script, the analyzeHeadless import with the loader chosen from the header, the FunctionManager, ReferenceManager, and BasicBlockModel that found 13 procedures and 39 strings, the DecompInterface with the native decompile binary for mac_arm_64, and the Program database deleted on close. The bottom band is the artifact ledger-arm64-O1 and its private copy target-01b5d08b08fb.bin.
host · macOS 26.2 arm64 · Node 22.22.0 · JDK 21.0.12.1 · GHIDRA_INSTALL_DIR set
REA 6.7.0 · WHAT IT STANDARDIZES
GHIDRA 12.1.4 · WHAT REA LEAVES TO IT
CLI and MCP
153 commands, 207 tools, 6 prompts
one BinarySession behind both
BinarySession
one target, one bound provider
the registry selects, never replaces
Evidence
16 fields, ev_ content hash
EvidenceLedger, snapshots, bundles
contracts and errors
Zod schemas for every tool
code, category, message, retryable
GhidraProvider, GhidraClient
profile digest, private copy
JSON lines over bridge.sock
ReaGhidraBridge.java
a GhidraScript, the last -postScript
one Program, one socket client
analyzeHeadless import
loader chosen from the header
-readOnly, default auto-analysis
FunctionManager, ReferenceManager
BasicBlockModel, Listing text
13 procedures, 39 strings here
DecompInterface, decompile
native binary for mac_arm_64
pseudocode and high p-code
the Program database
addresses, symbols, references
deleted on close: -deleteProject
ledger-arm64-O1
mach-o arm64, 33872 bytes
sha256 starts 01b5d08b
target-01b5d08b08fb.bin
the private copy Ghidra imports
same bytes, deleted on close