From cf899f36a2f1cc4ff28bf355145fbf3ddd4fd59a Mon Sep 17 00:00:00 2001 From: Kazuki Nakashima <65545348+lynnswap@users.noreply.github.com> Date: Tue, 25 Aug 2026 07:28:29 +0900 Subject: [PATCH 1/6] chore: track issue remediation progress --- Docs/issue-remediation-progress.md | 40 ++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 Docs/issue-remediation-progress.md diff --git a/Docs/issue-remediation-progress.md b/Docs/issue-remediation-progress.md new file mode 100644 index 0000000..73769f6 --- /dev/null +++ b/Docs/issue-remediation-progress.md @@ -0,0 +1,40 @@ +# Issue remediation progress + +Base: `main` at `6bdce4438828938cf8ae8e5a1aed1b31015bba78` + +## Delivery order + +1. #60 canonical Objective-C protocol conformances +2. #79 bounded Objective-C metadata reads +3. #80 bounded MachOKit chained-fixup reads +4. #81 actionable bounded raw-helper crash diagnostics + +Each issue is delivered as an independent Ready PR targeting `main`. A later +issue does not enter implementation until the earlier issue has a review-clean +PR. + +## Current issue: #60 + +Status: design audit in progress on branch +`codex/issue-60-ios-protocol-aliases`. + +Verified evidence: + +- The `v0.5.4` iOS 27.0 `24A5390f` run published `ARAnchor` without + `ARDaemonSecureCoding` and `ARAnchorCopying`. +- The persisted warnings classify both dropped entries as + `missingBackingData`. +- PR #63 previously recovered only exact runtime-registry pointer matches. +- The dependency owner is MachOObjCSection's loaded-image protocol list reader; + PrivateHeaderKit warning propagation is not the correction point. + +Pending: + +- Prove how the raw list pointers differ from their registered canonical + protocol objects. +- Fix that identity mapping at the dependency owner without accepting unknown + pointers or inventing names. +- Add deterministic dependency tests and an iOS runtime smoke. +- Advance the coherent dependency cohort in PrivateHeaderKit. +- Run repository validation and a clean base-branch codex review. +- Push and open a non-draft PR to `main`. From b57dfaec0aff86c242e4af968be40d9e44ec1963 Mon Sep 17 00:00:00 2001 From: Kazuki Nakashima <65545348+lynnswap@users.noreply.github.com> Date: Tue, 25 Aug 2026 07:42:57 +0900 Subject: [PATCH 2/6] docs: record issue 60 design contract --- Docs/issue-remediation-progress.md | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/Docs/issue-remediation-progress.md b/Docs/issue-remediation-progress.md index 73769f6..bfc1a98 100644 --- a/Docs/issue-remediation-progress.md +++ b/Docs/issue-remediation-progress.md @@ -15,7 +15,7 @@ PR. ## Current issue: #60 -Status: design audit in progress on branch +Status: design gate complete on branch `codex/issue-60-ios-protocol-aliases`. Verified evidence: @@ -27,13 +27,32 @@ Verified evidence: - PR #63 previously recovered only exact runtime-registry pointer matches. - The dependency owner is MachOObjCSection's loaded-image protocol list reader; PrivateHeaderKit warning propagation is not the correction point. +- Apple objc4 defines raw `protocol_ref_t` values as potentially unremapped and + resolves a noncanonical reference by its raw `mangledName`. Therefore exact + address membership in `objc_copyProtocolList` is not a valid identity + invariant. +- The current dependency tests cover exact-address hits but not an address miss + whose bounded raw name resolves to a registered canonical protocol. + +Design contract: + +- Probe the complete raw protocol layout before reading any field. +- Read the raw mangled name with a fixed bound and without unbounded + `String(cString:)` traversal. +- Admit an out-of-image reference only when `objc_getProtocol(rawName)` finds + the Objective-C runtime's canonical identity. +- Preserve the raw mangled name in generated output. +- Unknown names, unreadable layouts/names, and full metadata reads remain typed + degradation; no caller-side merge or inferred image owner is allowed. +- Remove the address snapshot, lock, and refresh state made obsolete by the + runtime-owned name lookup. Pending: -- Prove how the raw list pointers differ from their registered canonical - protocol objects. -- Fix that identity mapping at the dependency owner without accepting unknown - pointers or inventing names. +- Implement the design contract in a MachOObjCSection worktree based on + `932bff230815e39901e825e419db588377edee5c`. +- Cover distinct-address alias, raw Swift mangled-name preservation, unknown + name, unreadable/nonterminated name, unreadable layout, and full-read cases. - Add deterministic dependency tests and an iOS runtime smoke. - Advance the coherent dependency cohort in PrivateHeaderKit. - Run repository validation and a clean base-branch codex review. From b3c2186bbdd90e43a7c2425f05be9229bab02e0d Mon Sep 17 00:00:00 2001 From: Kazuki Nakashima <65545348+lynnswap@users.noreply.github.com> Date: Tue, 25 Aug 2026 08:25:02 +0900 Subject: [PATCH 3/6] fix(deps): recover canonical protocol aliases --- Docs/issue-remediation-progress.md | 16 ++++++++++------ Package.resolved | 6 +++--- Package.swift | 4 ++-- .../PrivateHeaderKitHelperProtocolTests.swift | 4 ++-- 4 files changed, 17 insertions(+), 13 deletions(-) diff --git a/Docs/issue-remediation-progress.md b/Docs/issue-remediation-progress.md index bfc1a98..6762719 100644 --- a/Docs/issue-remediation-progress.md +++ b/Docs/issue-remediation-progress.md @@ -49,11 +49,15 @@ Design contract: Pending: -- Implement the design contract in a MachOObjCSection worktree based on - `932bff230815e39901e825e419db588377edee5c`. -- Cover distinct-address alias, raw Swift mangled-name preservation, unknown - name, unreadable/nonterminated name, unreadable layout, and full-read cases. -- Add deterministic dependency tests and an iOS runtime smoke. -- Advance the coherent dependency cohort in PrivateHeaderKit. +- MachOObjCSection implementation is published at + `afa2c40fdf870630cf41dbe97ed2e9997dd80cfd`; focused and sibling tests, + release build, iOS/watchOS cross-compiles, and codex review passed. +- MachOSwiftSection coherent pin is published at + `6cf064a9541fe993adcaf5af50575cea0192029e`; remote graph, 640 non-baseline + tests, fixture build, and codex review passed. Its Xcode 27 metadata-offset + fixture target fails identically on the previous cohort. +- Run the iOS 27.0 `24A5390f` ARKit runtime smoke and verify `ARAnchor` + conformance plus zero matching warnings. +- PrivateHeaderKit now pins the coherent published dependency cohort. - Run repository validation and a clean base-branch codex review. - Push and open a non-draft PR to `main`. diff --git a/Package.resolved b/Package.resolved index 7121f71..fbff4cc 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,5 +1,5 @@ { - "originHash" : "960c1304bba8fbed955189c62569a0296b9685043bd012a0c38de087a55397f3", + "originHash" : "e67acff6d0c19bb416004d028ecd932114222de4a1ca0bc3288d44c5647267b4", "pins" : [ { "identity" : "associatedobject", @@ -60,7 +60,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/lynnswap/MachOObjCSection.git", "state" : { - "revision" : "932bff230815e39901e825e419db588377edee5c" + "revision" : "afa2c40fdf870630cf41dbe97ed2e9997dd80cfd" } }, { @@ -68,7 +68,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/lynnswap/MachOSwiftSection.git", "state" : { - "revision" : "8970e899efb13f355c2b8769e67e35ba39e07004" + "revision" : "6cf064a9541fe993adcaf5af50575cea0192029e" } }, { diff --git a/Package.swift b/Package.swift index 82ba15b..ef87a37 100644 --- a/Package.swift +++ b/Package.swift @@ -37,7 +37,7 @@ let package = Package( ), .package( url: "https://github.com/lynnswap/MachOObjCSection.git", - revision: "932bff230815e39901e825e419db588377edee5c" + revision: "afa2c40fdf870630cf41dbe97ed2e9997dd80cfd" ), .package( url: "https://github.com/MxIris-Reverse-Engineering/swift-objc-dump.git", @@ -45,7 +45,7 @@ let package = Package( ), .package( url: "https://github.com/lynnswap/MachOSwiftSection.git", - revision: "8970e899efb13f355c2b8769e67e35ba39e07004" + revision: "6cf064a9541fe993adcaf5af50575cea0192029e" ), .package( url: "https://github.com/MxIris-Reverse-Engineering/swift-demangling", diff --git a/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift b/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift index 4a142d0..26fccd1 100644 --- a/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift +++ b/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift @@ -158,7 +158,7 @@ struct PrivateHeaderKitHelperProtocolTests { let state = try #require(pin["state"] as? [String: Any]) #expect(pin["location"] as? String == "https://github.com/lynnswap/MachOObjCSection.git") - #expect(state["revision"] as? String == "932bff230815e39901e825e419db588377edee5c") + #expect(state["revision"] as? String == "afa2c40fdf870630cf41dbe97ed2e9997dd80cfd") #expect(state["version"] == nil) let swiftSectionPin = try #require( @@ -173,7 +173,7 @@ struct PrivateHeaderKitHelperProtocolTests { ) #expect( swiftSectionState["revision"] as? String - == "8970e899efb13f355c2b8769e67e35ba39e07004" + == "6cf064a9541fe993adcaf5af50575cea0192029e" ) #expect(swiftSectionState["version"] == nil) } From cffff4c484dbf949a4d9b812c326f417c081818e Mon Sep 17 00:00:00 2001 From: Kazuki Nakashima <65545348+lynnswap@users.noreply.github.com> Date: Tue, 25 Aug 2026 08:51:22 +0900 Subject: [PATCH 4/6] docs: refine issue 60 protocol contract --- Docs/issue-remediation-progress.md | 40 ++++++++++++++++-------------- 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/Docs/issue-remediation-progress.md b/Docs/issue-remediation-progress.md index 6762719..c0fae6c 100644 --- a/Docs/issue-remediation-progress.md +++ b/Docs/issue-remediation-progress.md @@ -31,33 +31,37 @@ Verified evidence: resolves a noncanonical reference by its raw `mangledName`. Therefore exact address membership in `objc_copyProtocolList` is not a valid identity invariant. -- The current dependency tests cover exact-address hits but not an address miss - whose bounded raw name resolves to a registered canonical protocol. +- A focused `24A5390f` runtime trace proved that the missing ARKit protocol + objects and their names are readable in the active main dyld-cache mapping. + `ARDaemonSecureCoding` and `ARAnchorCopying` both carry flags `0x60000000`, + while `objc_getProtocol(rawName)` returns `nil`. +- In objc4, those flags are `PROTOCOL_FIXED_UP_1 | PROTOCOL_IS_CANONICAL`, and + `remapProtocol` returns a canonical raw pointer before consulting the runtime + name registry. The runtime lookup is therefore not an admission requirement + for a cache-owned canonical protocol. Design contract: -- Probe the complete raw protocol layout before reading any field. -- Read the raw mangled name with a fixed bound and without unbounded - `String(cString:)` traversal. -- Admit an out-of-image reference only when `objc_getProtocol(rawName)` finds - the Objective-C runtime's canonical identity. +- Probe the raw protocol layout and verify that its declared size covers the + mandatory prefix through `flags`. +- For a canonical pointer, require the protocol object and mangled name to be + in active dyld-cache mappings, and bound the UTF-8 read by both the fixed + string limit and the mapping boundary. +- Mirror objc4's two identity paths: use the stable cache identity directly + for a cache-owned canonical protocol; otherwise use + `objc_getProtocol(rawName)` to canonicalize a noncanonical alias. - Preserve the raw mangled name in generated output. - Unknown names, unreadable layouts/names, and full metadata reads remain typed degradation; no caller-side merge or inferred image owner is allowed. -- Remove the address snapshot, lock, and refresh state made obsolete by the - runtime-owned name lookup. +- Do not accept readable arbitrary memory based only on a forged canonical bit. Pending: -- MachOObjCSection implementation is published at - `afa2c40fdf870630cf41dbe97ed2e9997dd80cfd`; focused and sibling tests, - release build, iOS/watchOS cross-compiles, and codex review passed. -- MachOSwiftSection coherent pin is published at - `6cf064a9541fe993adcaf5af50575cea0192029e`; remote graph, 640 non-baseline - tests, fixture build, and codex review passed. Its Xcode 27 metadata-offset - fixture target fails identically on the previous cohort. -- Run the iOS 27.0 `24A5390f` ARKit runtime smoke and verify `ARAnchor` +- Replace the insufficient name-registry-only dependency implementation with + the refined canonical-cache contract, then publish a new coherent dependency + cohort. +- Re-run the iOS 27.0 `24A5390f` ARKit runtime smoke and verify `ARAnchor` conformance plus zero matching warnings. -- PrivateHeaderKit now pins the coherent published dependency cohort. +- Update PrivateHeaderKit to the final coherent dependency cohort. - Run repository validation and a clean base-branch codex review. - Push and open a non-draft PR to `main`. From 1da4e574464fdb6225f503b940a20d9d0ebd6b0d Mon Sep 17 00:00:00 2001 From: Kazuki Nakashima <65545348+lynnswap@users.noreply.github.com> Date: Tue, 25 Aug 2026 10:15:06 +0900 Subject: [PATCH 5/6] fix(deps): finalize canonical protocol cohort --- Docs/issue-remediation-progress.md | 13 +++++++++---- Package.resolved | 6 +++--- Package.swift | 4 ++-- .../PrivateHeaderKitHelperProtocolTests.swift | 4 ++-- 4 files changed, 16 insertions(+), 11 deletions(-) diff --git a/Docs/issue-remediation-progress.md b/Docs/issue-remediation-progress.md index c0fae6c..371a6db 100644 --- a/Docs/issue-remediation-progress.md +++ b/Docs/issue-remediation-progress.md @@ -57,11 +57,16 @@ Design contract: Pending: -- Replace the insufficient name-registry-only dependency implementation with - the refined canonical-cache contract, then publish a new coherent dependency - cohort. +- Final MachOObjCSection commit + `c7716997aa1ace417c43fcd15b5322dbbe79ec54` is published. Focused protocol + tests, sibling relative-member tests, release build, iOS/watchOS architecture + builds, and the final codex review are green. +- Final MachOSwiftSection cohort commit + `122f50ee5196816a0d9d628a56a978636bc9bb03` is published. The remote graph, + 640 non-baseline tests, and branch-wide codex review are green. - Re-run the iOS 27.0 `24A5390f` ARKit runtime smoke and verify `ARAnchor` conformance plus zero matching warnings. -- Update PrivateHeaderKit to the final coherent dependency cohort. +- PrivateHeaderKit now resolves the final coherent dependency cohort; run its + exact-pin and repository validation gates. - Run repository validation and a clean base-branch codex review. - Push and open a non-draft PR to `main`. diff --git a/Package.resolved b/Package.resolved index fbff4cc..c2260db 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,5 +1,5 @@ { - "originHash" : "e67acff6d0c19bb416004d028ecd932114222de4a1ca0bc3288d44c5647267b4", + "originHash" : "6146038d8a5b37eb8ef6f14bdf40e0b3bd544839acf3bb48981b67334823a2b7", "pins" : [ { "identity" : "associatedobject", @@ -60,7 +60,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/lynnswap/MachOObjCSection.git", "state" : { - "revision" : "afa2c40fdf870630cf41dbe97ed2e9997dd80cfd" + "revision" : "c7716997aa1ace417c43fcd15b5322dbbe79ec54" } }, { @@ -68,7 +68,7 @@ "kind" : "remoteSourceControl", "location" : "https://github.com/lynnswap/MachOSwiftSection.git", "state" : { - "revision" : "6cf064a9541fe993adcaf5af50575cea0192029e" + "revision" : "122f50ee5196816a0d9d628a56a978636bc9bb03" } }, { diff --git a/Package.swift b/Package.swift index ef87a37..0ee6db0 100644 --- a/Package.swift +++ b/Package.swift @@ -37,7 +37,7 @@ let package = Package( ), .package( url: "https://github.com/lynnswap/MachOObjCSection.git", - revision: "afa2c40fdf870630cf41dbe97ed2e9997dd80cfd" + revision: "c7716997aa1ace417c43fcd15b5322dbbe79ec54" ), .package( url: "https://github.com/MxIris-Reverse-Engineering/swift-objc-dump.git", @@ -45,7 +45,7 @@ let package = Package( ), .package( url: "https://github.com/lynnswap/MachOSwiftSection.git", - revision: "6cf064a9541fe993adcaf5af50575cea0192029e" + revision: "122f50ee5196816a0d9d628a56a978636bc9bb03" ), .package( url: "https://github.com/MxIris-Reverse-Engineering/swift-demangling", diff --git a/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift b/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift index 26fccd1..378adb2 100644 --- a/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift +++ b/Tests/PrivateHeaderKitHelperProtocolTests/PrivateHeaderKitHelperProtocolTests.swift @@ -158,7 +158,7 @@ struct PrivateHeaderKitHelperProtocolTests { let state = try #require(pin["state"] as? [String: Any]) #expect(pin["location"] as? String == "https://github.com/lynnswap/MachOObjCSection.git") - #expect(state["revision"] as? String == "afa2c40fdf870630cf41dbe97ed2e9997dd80cfd") + #expect(state["revision"] as? String == "c7716997aa1ace417c43fcd15b5322dbbe79ec54") #expect(state["version"] == nil) let swiftSectionPin = try #require( @@ -173,7 +173,7 @@ struct PrivateHeaderKitHelperProtocolTests { ) #expect( swiftSectionState["revision"] as? String - == "6cf064a9541fe993adcaf5af50575cea0192029e" + == "122f50ee5196816a0d9d628a56a978636bc9bb03" ) #expect(swiftSectionState["version"] == nil) } From c4336de503aba8ddba298292d682d20ff103e0dd Mon Sep 17 00:00:00 2001 From: Kazuki Nakashima <65545348+lynnswap@users.noreply.github.com> Date: Tue, 25 Aug 2026 10:20:21 +0900 Subject: [PATCH 6/6] chore: remove completed issue progress ledger --- Docs/issue-remediation-progress.md | 72 ------------------------------ 1 file changed, 72 deletions(-) delete mode 100644 Docs/issue-remediation-progress.md diff --git a/Docs/issue-remediation-progress.md b/Docs/issue-remediation-progress.md deleted file mode 100644 index 371a6db..0000000 --- a/Docs/issue-remediation-progress.md +++ /dev/null @@ -1,72 +0,0 @@ -# Issue remediation progress - -Base: `main` at `6bdce4438828938cf8ae8e5a1aed1b31015bba78` - -## Delivery order - -1. #60 canonical Objective-C protocol conformances -2. #79 bounded Objective-C metadata reads -3. #80 bounded MachOKit chained-fixup reads -4. #81 actionable bounded raw-helper crash diagnostics - -Each issue is delivered as an independent Ready PR targeting `main`. A later -issue does not enter implementation until the earlier issue has a review-clean -PR. - -## Current issue: #60 - -Status: design gate complete on branch -`codex/issue-60-ios-protocol-aliases`. - -Verified evidence: - -- The `v0.5.4` iOS 27.0 `24A5390f` run published `ARAnchor` without - `ARDaemonSecureCoding` and `ARAnchorCopying`. -- The persisted warnings classify both dropped entries as - `missingBackingData`. -- PR #63 previously recovered only exact runtime-registry pointer matches. -- The dependency owner is MachOObjCSection's loaded-image protocol list reader; - PrivateHeaderKit warning propagation is not the correction point. -- Apple objc4 defines raw `protocol_ref_t` values as potentially unremapped and - resolves a noncanonical reference by its raw `mangledName`. Therefore exact - address membership in `objc_copyProtocolList` is not a valid identity - invariant. -- A focused `24A5390f` runtime trace proved that the missing ARKit protocol - objects and their names are readable in the active main dyld-cache mapping. - `ARDaemonSecureCoding` and `ARAnchorCopying` both carry flags `0x60000000`, - while `objc_getProtocol(rawName)` returns `nil`. -- In objc4, those flags are `PROTOCOL_FIXED_UP_1 | PROTOCOL_IS_CANONICAL`, and - `remapProtocol` returns a canonical raw pointer before consulting the runtime - name registry. The runtime lookup is therefore not an admission requirement - for a cache-owned canonical protocol. - -Design contract: - -- Probe the raw protocol layout and verify that its declared size covers the - mandatory prefix through `flags`. -- For a canonical pointer, require the protocol object and mangled name to be - in active dyld-cache mappings, and bound the UTF-8 read by both the fixed - string limit and the mapping boundary. -- Mirror objc4's two identity paths: use the stable cache identity directly - for a cache-owned canonical protocol; otherwise use - `objc_getProtocol(rawName)` to canonicalize a noncanonical alias. -- Preserve the raw mangled name in generated output. -- Unknown names, unreadable layouts/names, and full metadata reads remain typed - degradation; no caller-side merge or inferred image owner is allowed. -- Do not accept readable arbitrary memory based only on a forged canonical bit. - -Pending: - -- Final MachOObjCSection commit - `c7716997aa1ace417c43fcd15b5322dbbe79ec54` is published. Focused protocol - tests, sibling relative-member tests, release build, iOS/watchOS architecture - builds, and the final codex review are green. -- Final MachOSwiftSection cohort commit - `122f50ee5196816a0d9d628a56a978636bc9bb03` is published. The remote graph, - 640 non-baseline tests, and branch-wide codex review are green. -- Re-run the iOS 27.0 `24A5390f` ARKit runtime smoke and verify `ARAnchor` - conformance plus zero matching warnings. -- PrivateHeaderKit now resolves the final coherent dependency cohort; run its - exact-pin and repository validation gates. -- Run repository validation and a clean base-branch codex review. -- Push and open a non-draft PR to `main`.