The REA Evidence Contract: Every Result You Can Prove

Most analysis tools show you an answer. REA shows you an answer plus the receipts: which bytes were read, which engine produced the result, which library versions ran, and a content-addressed ID that ties the claim to the proof. That package is the REA evidence contract — and when results accumulate, they consolidate into an REA evidence bundle you can export and hand to someone else. This page walks the full lifecycle with outputs we ran ourselves in our lab on 2026-10-12. Nothing here is a feature list; every block below executed on our machine. The source behind this contract is the morluto/rea GitHub repository itself.

what an evidence record contains

Run a single layout inspection and read the output like a contract — every field is a promise:

$ npx rea inspect-binary-layout /root/projects/realearn/lab-env/hello
evidence_id: ev_6e479c83fba06374c38ab8f9fa3876e561d28d3515aa68473598e9f94dcb556c
subject: hello / sha256 36cdabb6…4207352 / elf / x86_64
provider: pwntools-elf @ pwntools 4.15.0;pyelftools 0.33;unicorn 2.1.2
normalized_result: 31 sections, entry_point 0x400320

Four claims, four proofs:

• evidence_id — content-addressed: derived from the record itself, so the ID is the integrity check. Change one input byte and a different ID proves it.
• subject sha256 — exactly which bytes were analyzed. "I analyzed this file" becomes "I analyzed the file with this hash".
• provider + pinned versions — pwntools 4.15.0, pyelftools 0.33, Unicorn 2.1.2, to the patch number. Someone reproducing your run knows what to install.
• normalized_result — the finding itself, in a form your own binutils can check: we confirmed those 31 sections against manual readelf output, and they agreed.

from records to a rea evidence bundle

One record proves one step. Real analysis chains steps — and REA retains them in-session, then consolidates them into an exportable bundle:

inspect_binary_layout(hello) → ev_6e479c83…   (session-retained)
$ get_evidence_bundle(detail:summary)
total_retained_records: 1 ✓
$ export_evidence_bundle → hello-bundle.json  (39113 bytes, records:1, unknowns:0)

The bundle is session JSON; the last mile converts it to portable canonical form:

$ rea evidence-export hello-bundle.json hello-canonical.json
validation passed — canonical export ✓

That two-step is deliberate, and the refusal that guards it is instructive — see the next section.

what the contract refuses (and why that is the point)

A contract is only worth something if it refuses to sign bad paper. Three refusals we hit, all by running the tool:

1. raw evidence JSON is not a bundle

Feeding a single evidence record straight into evidence-export fails — with the fix in the error message:

$ rea evidence-export record.json out.json
evidence_integrity_mismatch
(Error message includes remediation: export the session bundle via MCP export_evidence_bundle first, then feed it to evidence-export)

2. oversized results are refused, not truncated

Asking for the same layout analysis on a 4.5MB system library (OpenSSL's libcrypto) over the MCP channel returns resource_constraint — with a pointer to the evidence-bundle path. The CLI channel handled the same target fine with --format json (30 sections / 11 segments). The channel decides; nothing gets silently cut.

3. missing engines are named, precisely

Ask for deep analysis with no engine installed and REA refuses with provider_unavailable and a three-line rejection list — ghidra(not_configured) / hopper(executable_missing) / ida(not_configured). Three different problems, three different fixes, all named. The full walkthrough is in our boundary lesson.

Contrast the design with tools that guess: a plausible-looking answer with no trail cannot be audited, reproduced, or defended. Fail-closed beats plausible — that is the whole philosophy the REA evidence contract encodes.

why an evidence bundle matters outside the lab

• Reports: attach the bundle; a reviewer re-runs or spot-checks instead of trusting you.
• Tickets & handoffs: the provider versions settle "works on my machine" before it starts.
• Learning: every claim in our own guides traces to a dated lab record — the same discipline, applied to a tutorial site.

FAQ

Related: AgentEnv: turn a recorded capture into an MCP server · REA vs Ghidra — which to pick · REA vs Ghidra MCP · the setup guide behind these records · the 6.5–6.7 changelog: what breaks 6.4-era evidence