inventory.c produces separate x86-64 debug and stripped ELF executables. It covers imports, an external puts function, linker thunks, source symbols, direct calls, a targetless callback call, two referenced strings, and a multi-block branch.
entry-aliases.c preserves secondary imported entry labels, a bare-hex alias, and an interior label. The native CLI/MCP lane verifies entry selection, annotation, interior-label rejection, and unchanged source bytes.
cross-format.c is freestanding so the verifier can produce AArch64 ELF, x86-64 PE, and x86-64 Mach-O targets from the same semantics. It preserves an exported entry, direct and indirect calls, a volatile string reference, and a multi-block branch across loaders.
no-return.c and ReaNoReturnProbe.java inject incorrect import flags into a real ELF or Mach-O analysis database, verify caller recovery, propagated flag repair and signature preservation, and retain genuine/unknown no-return calls and independently identified entries. Run npm run build:cached, then node scripts/verify-real-ghidra-noreturn.mjs with the Ghidra/JDK environment below on Linux or macOS x64/arm64. On Linux, use a procps-compatible process table that exposes REA's current process for owned cleanup. It also checks named limitations through the real read-only TCP bridge and provider Evidence projection; default Unix-socket transport, Windows, and the reported Amethyst artifact need separate verification. Fixture target code is never executed.

scripts/verify-real-ghidra.mjs uses cc, clang, and lld-link by default; REA_CC, REA_CLANG, and REA_LLD_LINK can select alternate commands. The verifier requires the verified bring-your-own Ghidra 12.1.4 installation through GHIDRA_INSTALL_DIR and validates header classification before starting the provider. Provider admission accepts the rest of the 12.1.x line; this lane does not.

Conformance compares semantic facts: provider/profile identity, function classification, resolved call edges, typed references, strings/xrefs, and CFG topology. It only requires provider pseudocode and assembly to be non-empty, bounded, and address-bearing; it never compares their text with Hopper. The callback fixture also proves that an unresolved targetless flow is not silently promoted to a direct callee. Every target runs in a separate owned project and must leave no process, socket, project, or runtime root after close.