# Vendor Architecture Audit Findings

> Date: 2026-05-31; updated after vendor-surface pruning.
> Architecture map: `docs/research/vendor-architecture-map-2026-05-31.md`.
> Reading list: `docs/research/vendor-library-study-2026-05-31.md`.

## Summary

The vendor surface is now intentionally narrow:

- **Active:** Ghidra/SLEIGH for binary semantics.
- **Manifest-only candidates:** LIEF for binary metadata, Souffle for Fold-owned
  facts.
- **Deferred:** RetDec, Remill/McSema, PhASAR, Crab/Clam.

## Findings and status

| ID | Severity | Finding | Status |
|---|---|---|---|
| V1 | High | Ghidra-enabled macOS build failed because zlib injected SDK include paths before libc++ headers. | Fixed: Ghidra now links `libz` via `cpp.find_library('z')`. |
| V2 | Medium | Binary lanes needed explicit ownership between metadata, heuristics, raw P-Code, and SSA P-Code. | Addressed: architecture map assigns r2/LIEF to metadata and Ghidra to semantics. |
| V3 | Medium | Ghidra P-Code support was initially AArch64-only. | Partially fixed: x86/x86-64 SLEIGH and arch mappings added; ARM32/MIPS remain future scope. |
| V4 | Medium | P-Code encoder intentionally under-approximates path-sensitive hazards. | Open: expand CBRANCH/path predicates before broad SAT hazard gates. |
| V5 | Low | `.sla` docs and runtime behavior diverged. | Fixed: checked-in `.sla` are runtime copies; Meson-generated `.sla` are validation artifacts. |
| V6 | Low | Too many dormant vendor lanes created misleading build surface. | Fixed: active scaffolding pruned to Souffle and LIEF only. |
| V7 | High | SQL injection detector missed return-value taint sources such as `getenv()`. | Fixed with regression tests. |
| V8 | High | r2 CLI fallback could hang or run uncapped structural scans. | Fixed with CLI timeout and bounded fallback scans. |
| V9 | Medium | Base64 hardcoded-string heuristic over-reported by marker syntax alone. | Fixed with decode/entropy filtering and tests. |
| V10 | Medium | P-Code `int-overflow` gate over-advertised unsigned machine arithmetic. | Fixed: P-Code overflow hooks remain gated until signedness provenance exists. |

## Current vendor policy

### Ghidra/SLEIGH

Ghidra owns binary semantics. Fold should continue mapping P-Code into native
hazard observers and summaries. External references:

- https://ghidra.re/ghidra_docs/languages/html/pcoderef.html
- https://ghidra.re/ghidra_docs/languages/html/sleigh.html

### LIEF

LIEF is the next metadata candidate. It should mirror r2-backed metadata first,
without changing finding semantics. External references:

- https://lief.re/doc/latest/api/cpp/index.html
- https://lief.re/doc/stable/api/binary_abstraction/cpp.html

### Souffle

Souffle is the next derived-fact candidate after stable MidIR/fact IDs. Start
with standalone TSV facts and `.dl` rules. External references:

- https://souffle-lang.github.io/interface
- https://souffle-lang.github.io/execute

## Deferred candidates

RetDec, Remill/McSema, PhASAR, and Crab/Clam are documented in the reading list
but should not be scaffolded again until a fixture demonstrates need.

## Validation already run for related fixes

```sh
ninja -C build/release
meson test -C build/release --print-errorlogs
meson test -C build/release pcode_summary --print-errorlogs
git diff --check
```

## Remaining follow-up

1. Add LIEF metadata prototype only after listing current r2 metadata fields.
2. Define stable MidIR/fact IDs before Souffle.
3. Expand Ghidra P-Code path predicates before broadening binary hazard gates.
4. Keep deferred vendors docs-only unless a reproducible fixture proves need.