{
  "added_at": "2026-10-20",
  "additional_evidence_urls": [
    "https://x.com/Noflag404/status/2111625626893660269",
    "https://x.com/Noflag404/status/2111626304097538278"
  ],
  "category": "community-case-studies",
  "description_en": "An unofficial field study that reads REA's source and then drives the running server through 1,012 recorded calls across 27 artifact classes, measuring its content-addressed Evidence records, revision-chained unknown ledger, typed refusals, cold starts and response limits. The author maps those mechanisms onto vulnerability-research agents as an argument for not overclaiming. It evaluates REA's tool surface; it is not a reconstruction or a vulnerability finding.",
  "description_zh": "一篇非官方的实测研究：先阅读 REA 源码，再在 27 类分析对象上对运行中的服务器发出 1,012 次有记录的调用，测量其按内容寻址的 Evidence 记录、按修订串联的未知项台账、带类型的拒绝、冷启动及响应上限。作者把这些机制对应到漏洞研究智能体上，论证为何不应过度声称结论。它评估的是 REA 的工具接口，而非重建案例或漏洞发现。",
  "entry_url": "https://awesomerea.org/resources/noflag-rea-evidence-architecture-study/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/noflag-rea-evidence-architecture-study/",
  "evidence_url": "https://no-flag.com/2026/10/18/REA-paper/",
  "group": "rea",
  "id": "noflag-rea-evidence-architecture-study",
  "json_url": "https://awesomerea.org/resources/noflag-rea-evidence-architecture-study/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/noflag-rea-evidence-architecture-study/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/noflag-rea-evidence-architecture-study/index.md",
  "name": "Show Your Work: a measured dissection of REA's evidence architecture",
  "name_zh": "Show Your Work：对 REA 证据架构的实测剖析",
  "record_type": "resource",
  "relationship": "community-reported-mixed-workflow",
  "requirements": [
    "Published 2026-10-18 on the author's HackThe4O4 blog under the byline Noflag, who calls it unofficial, not peer-reviewed and unaffiliated with REA's maintainers, and says the official source wins where they disagree. The main study used the published rea-agents 6.5.0 package for 993 of the 1,012 calls; 19 calls comparing two deep providers ran a build of commit fe2a398dd, 286 commits later.",
    "All runs used one Debian-derived Linux VM (4 vCPU, 7.9 GB RAM) with operator-supplied engines, including a headless Ghidra 12.x decompiler, GDB, Rizin, a packet dissector, firmware tools, headless Chromium and Electron; the Android device was a container sharing the host kernel. The decompiler startup deadline was raised to 1,200 s, and macOS-only tools, a GUI-attached disassembler's cursor tools and an unlicensed commercial Java decompiler could not be exercised.",
    "The author reports calling all 207 advertised tools, 178 with at least one success, and 454 Evidence-bearing replies. Oversized replies were refused with a retained-Evidence pointer, but a 10.1 MiB request dropped the connection without a reply. Decompiler cold starts ranged from 14 s to 827 s, and two schema switches cut the default 3.09 MB tool catalog to 215 KB.",
    "Timings come from one lightly loaded VM and are offered as orders of magnitude. The calls came from the author's scripted campaign driver acting as an informed caller, and the article names no analyzed targets. The security-agent mapping is presented as argument, not a built system. Per-call records, campaign files and scripts are described as accompanying the research but are not linked from the page.",
    "This evaluates REA's evidence model and tool surface; no reconstruction, exploit or vulnerability is reported. The page states no license; REA, the third-party engines and the analyzed artifacts keep their own terms."
  ],
  "requirements_zh": [
    "文章于 2026-10-18 发布在作者的 HackThe4O4 博客，署名 Noflag。作者称其为非官方、未经同行评审、与 REA 维护者无关的研究，并表示与官方来源不一致时以官方为准。主研究的 1,012 次调用中有 993 次使用已发布的 rea-agents 6.5.0 软件包；另有 19 次比较两个深度分析提供方的调用，运行的是晚 286 个提交的 fe2a398dd 构建。",
    "所有运行都在一台 Debian 系 Linux 虚拟机（4 个 vCPU、7.9 GB 内存）上进行，分析引擎由操作者自备，包括无界面的 Ghidra 12.x 反编译器、GDB、Rizin、数据包解析器、固件工具、无界面 Chromium 和 Electron；Android 设备是与宿主共享内核的容器。反编译器的启动时限被调高到 1,200 秒；仅限 macOS 的工具、依赖图形界面反汇编器光标的工具，以及未获授权的商业 Java 反编译器均无法测试。",
    "作者报告调用了全部 207 个已公布工具，其中 178 个至少成功一次，共有 454 次回复带有 Evidence 记录。超大的回复会被拒绝并附上已保留 Evidence 的引用，但 10.1 MiB 的请求会在无回复的情况下断开连接。反编译器冷启动耗时从 14 秒到 827 秒不等；两个模式开关可将默认 3.09 MB 的工具目录缩小到 215 KB。",
    "耗时数据来自一台轻负载虚拟机，仅作数量级参考。调用由作者编写的脚本化测试驱动程序以熟悉接口的调用方身份发出，文章也未说明具体分析对象。对安全智能体的对应分析属于论证，而非已构建的系统。文中称逐次调用记录、测试配置和脚本随研究提供，但页面并未给出链接。",
    "本文评估的是 REA 的证据模型与工具接口，未报告任何重建、漏洞利用或漏洞。页面未声明许可；REA、第三方引擎及被分析对象保留各自条款。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://no-flag.com/2026/10/18/REA-paper/",
  "verification": "source-reviewed",
  "verified_at": "2026-10-18"
}