{
  "added_at": "2026-10-18",
  "additional_evidence_urls": [
    "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/package.json",
    "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/LICENSE",
    "https://github.com/morluto/rea/pull/1447"
  ],
  "category": "workflow-guides",
  "description_en": "Inventories HarmonyOS HAP, HSP and App Pack files through REA’s hardened ZIP reader and projects an execution-free application graph: component paths, IDs and hashes, Stage/FA packaging hints, runtime-family hints and path-based native-bridge hypotheses. Every claim rests on path presence; manifests, Ark bytecode, resources and signatures are not decoded or verified.",
  "description_zh": "通过 REA 加固的 ZIP 读取器清点 HarmonyOS 的 HAP、HSP 与 App Pack 文件，并投影出无需执行的应用图：组件路径、ID 与哈希、Stage／FA 打包模型提示、运行时类别提示，以及基于路径的原生桥接假设。所有结论仅基于路径存在；清单、Ark 字节码、资源和签名均未被解码或验证。",
  "entry_url": "https://awesomerea.org/resources/rea-harmony-guide/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/rea-harmony-guide/",
  "evidence_url": "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/docs/harmony-analysis.md",
  "group": "rea",
  "id": "rea-harmony-guide",
  "json_url": "https://awesomerea.org/resources/rea-harmony-guide/record.json",
  "kind": "documentation",
  "markdown_url": "https://awesomerea.org/resources/rea-harmony-guide/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/rea-harmony-guide/index.md",
  "name": "Static HarmonyOS package inventory",
  "name_zh": "HarmonyOS 应用包静态清点",
  "record_type": "resource",
  "relationship": "official-documentation",
  "requirements": [
    "Reviewed on main as rea-agents 6.7.0, which declares Node ^22.19.0, ^24.11.0 or 26+. No HarmonyOS SDK, toolchain or engine is needed: inspect-artifact produces the inventory and project-harmony-application-graph (MCP project_harmony_application_graph) projects it, with CLI and MCP sharing one workflow. .hap, .hsp and ZIP-verified root .app inputs are recognized; .har shared libraries are deferred because the suffix also names HTTP Archive JSON.",
    "Outputs are path-presence claims: Stage is inferred only from module.json and FA only from config.json, App Pack children are listed without recursive inventory, encrypted or unavailable entries make coverage partial, and N-API bridge entries are hypotheses. Manifest semantics, Ark bytecode contents and versions, resource resolution, signing verification and observed native boundaries stay listed as limitations, and inventories that cannot be authenticated fail closed.",
    "The verification lane downloads a SHA-256-pinned harmony-next-pipeline 1.0.1 HAP from an MIT-licensed source repository into an ignored directory and checks inventory authenticity, projection determinism, Stage path hints, exact component sets, complete coverage and CLI/MCP parity. The fixture’s compiler/SDK versions and reproducible build are not established, and the lane does not complete the pinned-toolchain acceptance in roadmap issue #1431.",
    "REA declares MIT. Analysed packages keep their own licenses, and the guide says the fixture’s bundled component licenses were not independently audited; the downloaded artifact is not redistributed. Merged PR #1447 introduced this increment."
  ],
  "requirements_zh": [
    "审阅时 main 上为 rea-agents 6.7.0，声明支持 Node ^22.19.0、^24.11.0 或 26 及以上。无需 HarmonyOS SDK、工具链或引擎：inspect-artifact 生成清单，project-harmony-application-graph（对应 MCP 的 project_harmony_application_graph）对其投影，命令行与 MCP 共用同一工作流。可识别 .hap、.hsp 及经 ZIP 校验的根级 .app 输入；由于后缀 .har 也用于 HTTP Archive JSON，HarmonyOS 共享库 .har 暂不支持。",
    "输出均为基于路径存在的结论：仅凭 module.json 判断 Stage 模型、仅凭 config.json 判断 FA 模型；App Pack 的子包只列出路径而不递归清点；加密或不可用的条目会使覆盖率标为部分；N-API 桥接条目仅为假设。清单语义、Ark 字节码内容与版本、资源解析、签名验证以及实际观察到的原生边界均列为局限；无法验证真实性的清单会直接失败。",
    "验证流程将一个以 SHA-256 固定的 harmony-next-pipeline 1.0.1 HAP（源码仓库采用 MIT 许可）下载到被忽略的目录，检查清单真实性、投影确定性、Stage 路径提示、精确组件集合、完整覆盖以及命令行与 MCP 的一致性。该测试包的编译器／SDK 版本与可复现构建尚未确立，此流程也未完成路线图 issue #1431 中固定工具链的验收。",
    "REA 声明 MIT。被分析的应用包保留各自许可；指南说明测试包内捆绑组件的许可未经独立审核，下载的产物也不会再分发。已合并的 PR #1447 引入了这一增量。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/morluto/rea/blob/main/docs/harmony-analysis.md",
  "verification": "source-reviewed",
  "verified_at": "2026-10-18"
}