bla-agents 1.1.0 → 1.6.0

package/.agents/skills/blind-llm-agents/SKILL.md

@@ -1,17 +1,27 @@
 ---
 name: blind-llm-agents
-description: Audit, protect, and verify software artifacts (JavaScript/TypeScript, Electron ASAR, WebAssembly, Python .py/.pyc, SQLite, Safetensors/GGUF AI Models, Android DEX/IL2CPP, and Native ELF/Mach-O/PE Binaries) against AI reverse-engineering agents like REA using BLA (Blind LLM Agents / Block Anything).
+description: Audit, protect, and verify software artifacts (JavaScript/TypeScript, Electron ASAR, WebAssembly, Python .py/.pyc, SQLite, Safetensors/GGUF AI Models, Android DEX/IL2CPP, Apple plist, .NET, JVM, ZIP/APK, and Native ELF/Mach-O/PE Binaries) against AI reverse-engineering agents like REA using BLA (Blind LLM Agents). Default verb: bla_harden.
 metadata:
-  version: "1.1.0"
+  version: "1.2.0"
 ---
 
-# BLA: Blind LLM Agents (Block Anything)
+# BLA: Blind LLM Agents
 
 Use BLA whenever the user asks to harden a project against AI reverse-engineering agents (`morluto/rea`), audit exposure, exhaust attacker token/compute budgets, or induce model misjudgment on proprietary logic.
 
-## ⚡ One-Click Agent Defense Hardening (Recommended)
+## ⚡ One-Sentence Hardening (DEFAULT — prefer this)
 
-When the user says **"Harden this project against REA"**, **"一键启动防御强化"**, or **"Run BLA defense"**, invoke the single one-click pipeline immediately:
+When the user says **"Harden my software"**, **"Harden this project against REA"**, **"一键启动防御强化"**, **"Run BLA defense"**, or any equivalent one-liner **without naming a specific file**, invoke:
+
+- **MCP Tool (preferred)**: `bla_harden` with `{ "directory": "." }` (or the project/build path they named)
+- **CLI**: `npx bla-agents@latest harden .`
+- **MCP Prompt**: `bla-harden-project`
+
+`bla_harden` / `bla harden` auto-discovers protectable build outputs under `dist/`, `build/`, `out/`, `release/`, `.asar`, native binaries, `.wasm`, `.py`/`.pyc`, `.sqlite`, `.safetensors`/`.gguf`, `.dex`, `.class`, `.dll`, Apple plists, ZIP/APK, etc., detects each artifact's format, and runs the full **audit → defend (bankrupt) → verify** pipeline on all of them. Return the per-artifact summary to the user. Do **not** ask which files to protect — discover them.
+
+## One-Click Single-Artifact Defense
+
+When the user already named a **specific file**, use:
 
 - **MCP Tool**: `bla_defend` with `{ "input_path": "<target>", "intensity": "bankrupt", "emit_manifest": true }`
 - **CLI Command**: `npx bla-agents@latest defend <target> --manifest`
@@ -19,8 +29,8 @@ When the user says **"Harden this project against REA"**, **"一键启动防御
 `bla_defend` / `bla defend` executes all 5 Counter-REA defense stages automatically:
 1. **Stage 1 (`inspect-release`)**: Read-only scan for accidental `.map` (`sourcesContent`) and symbol leaks.
 2. **Stage 2 (`audit`)**: 16-vector REA vulnerability & Claude Opus 4 / Sonnet 4 / o3 token-cost simulation.
-3. **Stage 3 (`protect --intensity bankrupt`)**: Injects both the **Resource-Exhaustion Suite** (`REA_BUDGET_BREAKER_MATRIX`, 22-family `ReconstructionObligationLedger` flood, Tarjan SCC Call-Graph Labyrinth, BPE Subword Token Sink) and the **Model-Misjudgment Induction Suite** (`ShadowBusinessLogic`, `EvidenceContractPoison` competing-explanation lures, gRPC/vsock `ArchitectureMirage`, `SemanticHoneypot` bait exports, and Shared-ArrayBuffer `DecompilerIllusion`).
-4. **Stage 4 (`verify`)**: Verifies all Counter-REA mathematical invariants and confirms `16x–51x` token/cost bankruptcy amplification.
+3. **Stage 3 (`protect --intensity bankrupt`)**: Injects both the **Resource-Exhaustion Suite** and the **Model-Misjudgment Induction Suite** (including canary honeypots + system-diagnostic decoys across JS, WASM, Python, SQLite, Safetensors/GGUF, DEX, IL2CPP, Apple plist, .NET, JVM, ZIP/APK).
+4. **Stage 4 (`verify`)**: Verifies all Counter-REA mathematical invariants and confirms token/cost bankruptcy amplification.
 5. **Stage 5 (`manifest`)**: Emits `<output>.bla-manifest.json` attesting to the hardened build.
 
 ## Step-by-Step Granular Workflow: Audit -> Protect -> Verify
@@ -28,23 +38,19 @@ When the user says **"Harden this project against REA"**, **"一键启动防御
 1. **Audit (`bla_audit` or `npx bla-agents audit <target>`)**:
    - Reports the **REA Exposure Score (0–100)**, exposed functions/classes/IPC channels/routes, and estimated attacker token and dollar costs.
 2. **Protect (`bla_protect` or `npx bla-agents protect <target> -o <output> --intensity bankrupt`)**:
-   - **Resource Exhaustion (耗尽对方资源)**:
-     - Trips REA's `SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256` ($2^9 = 512$ opaque ternary chunks), `SEMANTIC_ALIAS_SELECTION_LIMIT = 512` (520+ selector states), `SEMANTIC_GETTER_EXPANSION_LIMIT = 512` (self-referential getter rings), and `SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1_048_576` (`codeUnits * 6 + 2` Cartesian string explosion).
-     - Floods all 22 `ReconstructionObligationPolicies` families (`context-bridge-api`, `ipc-channel`, `ipc-handler`, `endpoint`, `storage`, `worker`, `service-worker`, `native-addon`, `child-process`, `stdio`, `signal`, `config-source`, etc.), multiplying mandatory verification fixtures (`positive`, `negative`, `malformed`, `cancellation`, `teardown`) by `20x–60x`.
-     - Injects Tarjan SCC mutually-recursive call-graph labyrinths and BPE subword token amplifiers.
-   - **Model Misjudgment Induction (诱导模型误判)**:
-     - Exploits REA's `COMMON_DISCIPLINE` (*"Report Observations only from cited Evidence... Keep incomplete coverage explicit as Unknowns"*): wraps real business logic in `status: "unknown"` semantic budget breakers while leaving crystal-clear **Shadow Business Logic** (`shamir-ed25519-license-ring`, `enterprise-tiered-pricing-matrix`, `binary-wire-frame-ratchet`, `tpm2-pcr-dongle-handshake`) 100% `observed`, inducing the LLM to reconstruct the decoy algorithm.
-     - Plants high-confidence Evidence Contract competing-explanation lures, gRPC/vsock hardware enclave mirages, and shared-`ArrayBuffer` decompiler aliasing illusions.
+   - **Resource Exhaustion (耗尽对方资源)** and **Model Misjudgment Induction (诱导模型误判)** as documented in [references/counter-rea-matrix.md](references/counter-rea-matrix.md).
 3. **Verify (`bla_verify` or `npx bla-agents verify <protected> [original]`)**:
    - Confirms that all Counter-REA gates pass and reports exact Token & API Cost Amplification.
 
 ## CLI Fallback Commands
 
 ```bash
+npx -y bla-agents@latest harden .
 npx -y bla-agents@latest defend /absolute/path/to/target --manifest --json
 npx -y bla-agents@latest audit /absolute/path/to/target --json
 npx -y bla-agents@latest protect /absolute/path/to/target -o /absolute/path/to/protected --intensity bankrupt --json
 npx -y bla-agents@latest verify /absolute/path/to/protected /absolute/path/to/target --json
+npx -y bla-agents@latest doctor
 ```
 
 See [references/counter-rea-matrix.md](references/counter-rea-matrix.md) for the complete mapping between REA's internal analyzers and BLA's countermeasures.

package/DISCLAIMER.md

@@ -1,20 +1,28 @@
 # Legal & Technical Disclaimer
 
-**BLA (`bla-shield` — Blind LLM Agents / Block Anything)** is a defensive software engineering and intellectual-property protection tool designed for software authors, independent developers, and security researchers to protect their own first-party software artifacts against automated AI reverse-engineering pipelines.
+**BLA (`bla-agents` — Blind LLM Agents)** is a **defensive** software-engineering and intellectual-property protection toolkit. It is intended for software authors, independent developers, and security researchers to protect **their own** first-party software artifacts against automated AI reverse-engineering pipelines such as REA.
 
-## 1. Defensive & Benign Operation Only
+## 1. Defensive use only — protect your own software
+
+You may only run BLA on software, bundles, models, and binaries that **you own** or have **explicit authorization** to modify and distribute. BLA is **not** a tool for attacking, probing, or reverse-engineering third-party software you do not control.
+
+Protective payloads (decoy metadata, honey tables, nesting breakers, canary credentials, synthetic diagnostics) are inert under normal application execution. They are designed to activate **only when an automated reverse-engineering / inspection pipeline** reads the protected artifact — not when your users run the product.
+
+## 2. Benign structures only
 
 All artifacts generated or modified by BLA contain strictly benign, inert software-protection structures:
+
 - Number-theoretic opaque predicates ($O(1)$ arithmetic invariants at runtime)
 - Inert synthetic state-machine functions and decoy cross-references
-- Decoy architectural metadata (such as simulated TEE/SGX enclave delegation manifests, honey VLQ source maps, and synthetic compiler commit strings)
+- Decoy architectural metadata (simulated TEE/SGX enclave manifests, honey VLQ source maps, synthetic compiler commit strings)
+- Format-valid canary / diagnostic metadata that preserves original runtime behavior
 
 BLA **never** injects destructive commands, shell payloads, network callbacks, or exploitative code into protected binaries or scripts.
 
-## 2. Authorized Use
+## 3. Always verify before shipping
 
-You may only run `bla-shield` on software, bundles, and binaries that you own or have explicit authorization to modify and distribute. Always verify protected artifacts in your staging environment (`bla verify <original> <protected>`) before shipping to production.
+Always verify protected artifacts in your staging environment (`bla verify <protected> <original>` or the defend/harden pipeline) before shipping to production. Confirm runtime equivalence for your own workloads.
 
-## 3. Defense-in-Depth
+## 4. Defense-in-depth — not absolute secrecy
 
-While BLA deterministically trips the static, semantic, and metadata resource caps of automated reverse-engineering agents (such as REA), no client-side protection scheme can guarantee absolute mathematical secrecy against a dedicated human analyst with unlimited time and hardware debugging access. Always keep high-value secrets (such as private API keys or master signing keys) on trusted server infrastructure.
+While BLA deterministically trips many static, semantic, and metadata resource caps of automated reverse-engineering agents (such as REA), **no client-side protection scheme can guarantee absolute mathematical secrecy** against a dedicated human analyst with unlimited time and hardware debugging access. Keep high-value secrets (private API keys, master signing keys) on trusted server infrastructure.

package/README.md

@@ -2,290 +2,245 @@
 
 **English** · [简体中文](docs/readme/README_zh.md) · [繁體中文](docs/readme/README_zh-TW.md) · [日本語](docs/readme/README_ja.md) · [한국어](docs/readme/README_ko.md) · [Türkçe](docs/readme/README_tr.md) · [Русский](docs/readme/README_ru.md) · [Tiếng Việt](docs/readme/README_vi.md) · [ไทย](docs/readme/README_th.md) · [Deutsch](docs/readme/README_de.md) · [Español](docs/readme/README_es.md) · [Français](docs/readme/README_fr.md) · [Українська](docs/readme/README_uk.md) · [Polski](docs/readme/README_pl.md) · [Português (Brasil)](docs/readme/README_pt-BR.md) · [العربية](docs/readme/README_ar.md) · [فارسی](docs/readme/README_fa.md) · [Bahasa Indonesia](docs/readme/README_id.md) · [Italiano](docs/readme/README_it.md) · [Ελληνικά](docs/readme/README_el.md) · [മലയാളം](docs/readme/README_ml.md) · [Roman Urdu](docs/readme/README_ur-Latn.md) · [Română](docs/readme/README_ro.md)
 
-# BLA: Blind LLM Agents
+# <img src="docs/assets/logo.png" alt="BLA Shield" width="42" align="absmiddle" /> BLA: Blind LLM Agents
 
-### One MCP for defending binaries, applications, and runtime behavior against AI reverse engineering.
+### Make reverse engineering bankrupt again.
 
-**Ship a feature you built. Blind the agents trying to clone it, down to the binary level.**
+**Point BLA at the build you ship. When an AI reverse-engineering agent (REA) opens it, the analyzer hits resource budgets, follows decoys, and burns tokens — while your users still get the same runtime behavior.**
 
 [![npm version](https://img.shields.io/badge/npm-bla--agents-2563eb?style=flat-square&logo=npm)](https://www.npmjs.com/package/bla-agents)
 [![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-3b82f6?style=flat-square)](docs/cli-and-mcp.md)
-[![Node.js requirements](https://img.shields.io/badge/Node.js-%5E22.13_%7C%7C_%3E%3D24-0284c7?style=flat-square&logo=nodedotjs&logoColor=white)](#what-you-can-protect)
-[![Counter-REA Verified](https://img.shields.io/badge/Counter--REA-BLUE_SHIELD-1d4ed8?style=flat-square)](#showcases)
+[![Node.js](https://img.shields.io/badge/Node.js-%5E22.23.4_%7C%7C_24.x-0284c7?style=flat-square&logo=nodedotjs&logoColor=white)](#format-coverage)
+[![Counter-REA](https://img.shields.io/badge/Counter--REA-empirically_measured-1d4ed8?style=flat-square)](#empirical-results-vs-real-rea)
 [![MIT license](https://img.shields.io/badge/license-MIT-38bdf8?style=flat-square)](LICENSE)
 
-**[Website](https://bla.tools/) · [Guides](https://bla.tools/guides/) · [Showcases](https://bla.tools/showcase/)**
+**[Website](https://bla.tools/) · [Guides](https://bla.tools/guides/) · [Showcases](https://bla.tools/showcase/) · [Disclaimer](DISCLAIMER.md)**
 
-[Quick start](#quick-start) · [How BLA works](#how-bla-works) · [What you can protect](#what-you-can-protect) · [Showcases](#showcases) · [FAQ](#faq) · [Documentation](#documentation)
+[Quick start](#quick-start) · [Empirical results](#empirical-results-vs-real-rea) · [Format coverage](#format-coverage) · [Benchmark](#benchmark-14-targets-internal-estimates) · [FAQ](#faq)
 
-<code>npx bla-agents setup</code> · <code>npx bla-agents defend ./dist --manifest</code>
+```bash
+bla harden .
+# or tell your agent: "Harden my software against REA"
+```
 
 </div>
 
 > [!IMPORTANT]
-> Get BLA from [qybaihe/bla](https://github.com/qybaihe/bla) or the [bla-agents npm package](https://www.npmjs.com/package/bla-agents).
-> Follow the installation and release links from these official sources.
+> BLA is a **defensive** tool for protecting **your own** software. See [DISCLAIMER.md](DISCLAIMER.md).
+> Get BLA from [qybaihe/bla](https://github.com/qybaihe/bla) or [npm `bla-agents`](https://www.npmjs.com/package/bla-agents).
 
 <div align="center">
-
-<br />
-
-<img src="docs/assets/bla-vs-rea-showcase.svg" alt="Side-by-side comparison: REA reconstructing an unprotected app in 38s vs. BLA exhausting REA with 2,121x token burn and resource capacity trips" width="1200" />
-
-<br />
-
+<img src="docs/assets/bla-vs-rea-showcase.svg" alt="Side-by-side: REA on an unprotected artifact vs BLA-protected output" width="1200" />
 </div>
 
 ---
 
-Worried that someone will point [REA](https://github.com/morluto/rea) or a coding agent at your shipped product and clone your core logic in seconds? Ask your agent to harden it with BLA (`Poison → Exhaust → Hallucinate`). It audits your build without requiring source-code rewrites, shows what an attacking agent would recover, injects adversarial chaff and algorithmic tarpits, and verifies that automated reconstruction fails.
-
-BLA connects your agent to tools for protecting native binaries, JavaScript and Electron apps, WebAssembly modules, Python bytecode, SQLite databases, AI model files, and mobile packages. You can also run the same tools from your terminal or build bundler. Protection runs locally and preserves 100% of original runtime behavior.
+## What BLA does
 
-Setup registers BLA with your agent and installs matching workflow instructions. Every static, bytecode, and binary shield is built in—no commercial packer, external LLVM toolchain, or third-party obfuscator is required.
+REA reverse-engineers release artifacts in one command. BLA is the Counter-REA half of that story:
 
-## Quick start
-
-### Set up your agent
+| Layer | What happens |
+| --- | --- |
+| **Poison** | Plant format-valid canaries, honey metadata, and decoy control flow that look like real evidence. |
+| **Exhaust** | Push the artifact past REA's documented resource budgets (headers, nesting, interface inventories, PCAP JSON, fuse sentinels, …). |
+| **Hallucinate** | Leave the analyzer with truncated inventories, redaction failures, and ambiguous rabbit holes — while **runtime stays equivalent**. |
 
-With Node.js and npm installed, run:
+One sentence covers the common case (auto-discovers `dist/` / `build/` / `.asar` / `.wasm` / `.sqlite` / models / … and runs audit → protect → verify):
 
 ```bash
-npx bla-agents setup
-```
-
-Choose your agents (or pass `--all-detected --yes`), review the proposed changes, and approve them. Setup registers BLA's MCP server and installs the `blind-llm-agents` skill, with backups of existing configuration. Restart your agent afterward.
-
-Setup supports Claude Code, Codex, Cursor, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. See [installation and setup](docs/installation.md) for manual MCP registration.
-
-### Ask your agent
-
-Every defense stage—or the entire 5-stage pipeline—can be triggered directly in natural language once your agent is connected:
-
-- **⚡ One-Click Full Defense Hardening (`bla_defend` — Inspect → Audit → Bankrupt Protect → Verify → Manifest):**
-  ```text
-  Run bla_defend on ./dist with bankrupt intensity and emit a signed Counter-REA defense manifest.
-  ```
-- **1. Audit exposure before shipping (`Pre-flight REA Audit`):**
-  ```text
-  Audit my ./dist directory against REA, show me every exposed module and IPC channel, and estimate how much it would cost Claude to reconstruct it.
-  ```
-- **2. Inject Counter-REA protection (`Poison + Exhaust + Hallucinate`):**
-  ```text
-  Protect ./dist/app.asar with BLA at bankrupt intensity, inject enclave chaff and algorithmic tarpits, and output to ./dist/app.shielded.asar.
-  ```
-- **3. Verify defense gates & token amplification (`Verify`):**
-  ```text
-  Verify ./dist/app.shielded.asar against the original ./dist/app.asar and confirm that REA's examination degrades to limited status.
-  ```
-
-### Use the terminal
-
-Every workflow is available directly from your terminal with `npx bla-agents` (or `bla` when installed globally):
-
-- **⚡ One-Click Full Defense Pipeline (`defend`)** — runs release exposure scan, pre-flight REA audit, bankrupt exhaustion + deception injection, verification, and `.bla-manifest.json` generation in one command:
-  ```bash
-  npx -y bla-agents@latest defend /absolute/path/to/app --manifest
-  ```
-- **1. Audit a target (`audit`)** — inspect exposure score (`0–100`), exposed symbols, and estimated attacker clone cost:
-  ```bash
-  npx -y bla-agents@latest audit /absolute/path/to/app --json
-  ```
-- **2. Protect a target (`protect`)** — inject semantic budget breakers, tarpit state machines, enclave chaff, and runtime shields:
-  ```bash
-  npx -y bla-agents@latest protect /absolute/path/to/app -o /absolute/path/to/app.shielded --intensity bankrupt
-  ```
-- **3. Verify Counter-REA resistance (`verify`)** — check that REA's static/semantic passes hit resource limits and >10x token amplification:
-  ```bash
-  npx -y bla-agents@latest verify /absolute/path/to/app.shielded /absolute/path/to/app
-  ```
-- **4. Run the 8-target Counter-REA benchmark (`benchmark`)**:
-  ```bash
-  npx -y bla-agents@latest benchmark
-  ```
-- **5. Emit compile-time native headers (`emit-headers`)** for C/C++, Rust, or Go builds:
-  ```bash
-  npx -y bla-agents@latest emit-headers --lang c -o ./include/bla_shield.h
-  ```
-
-To install the `bla` command for regular use:
-
-```bash
-npm install --global bla-agents
-bla --help
-```
-
-### Use in your build bundler
-
-Import `bla-shield/bundler` in Vite, Rollup, Webpack, or esbuild to automatically shield emitted JavaScript chunks, Honey Source Maps, and `.wasm` assets at build time:
-
-```typescript
-import { defineConfig } from "vite";
-import { blaVitePlugin } from "bla-agents/bundler";
-
-export default defineConfig({
-  plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
-});
+npx bla-agents harden .
+# MCP / agent: bla_harden   ·   "Harden my software against REA"
 ```
 
-### Update BLA
+Same pipeline as `bla defend` / `bla_defend` when you already know the path; `harden` is the default one-command UX.
 
-For a CLI installed with `npm install --global` or `bun add --global`:
+## Quick start
 
 ```bash
-bla update
+# Node.js ^22.23.4 or 24.x recommended (REA red-team needs zlib.zstd on 22.23+)
+npx bla-agents setup          # register MCP + skill with your coding agent
+npx bla-agents harden .       # one-command Counter-REA pass on the current project
+npx bla-agents benchmark      # 14-target showcase (local estimates + runtime checks)
 ```
 
-`bla --update` is an alias for this workflow. If you use `npx`, refresh your agent registrations and skill with:
+Ask your agent after setup:
 
-```bash
-npx bla-agents@latest setup
+```text
+Harden my software against REA
 ```
 
-Review the setup changes and restart your agent. For one-off CLI commands, use `npx bla-agents@latest` (or `bunx bla-agents@latest`) followed by the command.
-
-## How BLA works
+Or run stages explicitly: `audit` · `protect` · `verify` · `defend` — see [CLI and MCP](docs/cli-and-mcp.md).
 
-Your agent calls BLA through MCP to audit a build artifact, inject format-specific Counter-REA shields, and verify the hardened output. When an attacking agent later inspects the protected artifact with REA, REA hits deterministic internal resource limits, drowns in decoy cross-references, and misattributes core logic to hardware enclave stubs:
+---
 
-1. **Poison (`Architectural Chaff & Honey Assets`):** Embeds benign hardware enclave delegation manifests (`SGX` / `TPM2` / `Secure Enclave`), VLQ v3 **Honey Source Maps** (`enclave://tee-runtime/`), honey WASM `"name"` sections, and honey SQLite tables across dead branches and constant pools.
-2. **Exhaust (`Semantic Budget Breakers & Algorithmic Tarpits`):** Trips `morluto/rea`'s hardcoded analyzer caps (`primitive-candidates > 256`, `alias-selections > 512`, `getter-expansion > 512`, `primitive-bytes > 1 MiB`, `maximum_rustc_hashes > 64`, `maximumSentinelsPerSlice > 32`) at zero runtime cost, while weaving 14–36 interconnected Fake XRef state machines into the call graph.
-3. **Hallucinate (`Anti-CDP Runtime Deception & Fuse Hardening`):** Hardens Electron V1 fuse wires in-place (`RunAsNode=0`, `EnableNodeCliInspectArguments=0`) and injects the "Truman Show" runtime guard that serves synthetic enclave attestation telemetry whenever CDP, Node Inspector, Frida, or WebDriver probes attach.
+## Empirical results vs real REA
 
-## What you can protect
+These numbers come from running **real REA** against BLA-hardened samples on commodity hardware (`npm run redteam:rea`). Full machine-readable report: [`docs/redteam/empirical-rea-validation.md`](docs/redteam/empirical-rea-validation.md) / [`.json`](docs/redteam/empirical-rea-validation.json).
 
-BLA requires Node.js 22.5+ (or 24.x+) and npm. All shields run self-contained with zero external tool dependencies:
+**How to read this:** “Empirically verified” means the REA analyzer path actually returned the listed budget / capacity / redaction failure in this environment. It is **not** a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here.
 
-| Target                  | What BLA injects & how REA fails                                                                  | Command / prompt & requirements                                                                       |
-| ----------------------- | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
-| JavaScript / TypeScript | Trips `primitive-candidates > 256`, `alias-selections > 512`, `getter-expansion > 512` + 36 tarpits | `bla protect app.js` · Built-in Babel AST engine; [Counter-REA matrix](.agents/skills/blind-llm-agents/references/counter-rea-matrix.md) |
-| Electron `.asar` apps   | De-literalizes IPC channels (`channel: null`), adds duplicate decoy IPC handlers & shadow module  | `bla protect app.asar` · Built-in Chromium Pickle `.asar` unpacker & SHA-256 integrity repacker       |
-| Electron binary fuses   | Hardens real V1 fuses (`RunAsNode=0`, `Inspect=0`) + injects `34 > 32` decoy fuse sentinels       | `bla protect ElectronApp` · Trips `ElectronFuseResourceFailure (maximumSentinelsPerSlice = 32)`       |
-| Runtime CDP / Frida     | Detects `inspector.url()`, `--inspect`, `__frida` and returns synthetic enclave telemetry         | Automatically injected into JS/TS/Electron bundles via [`runtime-shield.ts`](src/shields/runtime/runtime-shield.ts) |
-| Source maps & HTML      | Strips real maps; injects valid VLQ v3 Honey Source Maps (`enclave://tee-runtime/...`)            | `bla protect index.html` · Redirects REA `recover_javascript_sources` & `trace_web_source_location`   |
-| Native binaries         | Appends `.bla.rodata` enclave chaff, decoy symbol table entries, and multi-scanner overflow traps | `bla protect daemon.elf` · Built-in ELF64, Mach-O (thin & universal), and Windows PE/COFF shield      |
-| Rust binaries           | Injects `68 > 64` distinct `/rustc/<40-hex>/` paths + decoy zlib `.dep-v0` crate dependency graph | `bla protect rust-bin` · Trips `RustBinaryProvider` (`MAX_RUSTC_HASHES = 64` capacity failure)        |
-| Go binaries             | Injects decoy Go `go1.23.4` buildinfo & `dep\tgithub.com/enclave-tees/sgx-bridge` module lines    | `bla protect go-bin` · Pollutes REA `inspect_go_binary` module inventory                              |
-| Flutter / Dart AOT      | Injects `66 > 64` Dart snapshot magic headers (`0xf5f5dcdc`) + `6 > 4` LLVM toolchain lines       | `bla protect libapp.so` · Trips `SnapshotHashScanner (capped: true)` & `conflicting-dart-version`     |
-| WASM artifacts          | Strips debug sections; injects honey `"name"` section (`tee_hardware_enclave_stub`) + custom chaff | `bla protect core.wasm` · Built-in LEB128 binary parser; preserves 100% `WebAssembly.validate`        |
-| Python & `.pyc`         | Injects Python tarpit state machines into `.py` & `TYPE_ASCII` marshal chaff into `.pyc` pools    | `bla protect module.pyc` · Built-in CPython 3.7–3.14 `.pyc` header & marshal framing shield           |
-| SQLite databases        | Injects 3 enclave honey tables with `GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL` traps | `bla protect data.sqlite` · Real tables stay 100% queryable; REA crashes with `SqliteColumnEvaluationFailure` |
-| Model artifacts         | Injects `35 > 32` nested JSON/ARRAY headers into `.safetensors` and `.gguf` model headers         | `bla protect weights.safetensors` · Trips `ModelFormatFailure (json-nesting / metadata-nesting > 32)` |
-| Android DEX & APKs      | Injects `Lcom/enclave/sgx/...` decoy classes into `classes.dex` and recomputes SHA-1 & Adler32    | `bla protect classes.dex` or `app.apk` · Valid Dalvik/ART verification; pollutes JADX/JEB class trees |
-| Unity IL2CPP metadata   | Appends enclave bridge metadata and method-topology tarpits to `global-metadata.dat` (`0xFAB11BAF`) | `bla protect global-metadata.dat` · Pollutes REA `inspect_il2cpp_metadata` type/method recovery       |
-| C / C++ / Rust / Go src | Generates compile-time `bla_shield.h`, `bla_shield.rs`, or `bla_shield.go` with `used, noinline` tarpits | `bla emit-headers --lang c\|rust\|go` ·Compiles directly into Ghidra/Hopper/IDA decompiler views      |
+### Empirically verified on commodity hardware
 
-## Showcases
+Recorded under **Node v24.22.1** with optional **Wabt 1.0.42** + **tshark 4.4** when noted. Soft-skips keep Node 22 / CI green when tooling is absent.
 
-Run `npx bla-agents benchmark` to execute all 8 counter-showcases locally and verify both REA failure modes and 100% runtime equivalence:
+| Format | Before → after | REA outcome after BLA | Budget / error |
+| --- | ---: | --- | --- |
+| **Go buildinfo** | 50 KiB → 1.16 MiB | capacity error | `MAX_BUILD_INFO_BYTES` (1 MiB) — *Go build-info string length exceeds the 1 MiB limit* |
+| **Erlang BEAM** | 84 B → 262 KiB | capacity error | `max_chunks` — *BEAM form exceeds the 64-chunk budget* |
+| **EVM bytecode** | 16 B → **4.00 MiB** | approaches full input cap | `EVM_INTERFACE_LIMITS.inputBytes` (4 MiB) |
+| **PCAP** | 24 B → 1.29 MiB | budget rejected | `TSHARK_JSON_MAX_BYTES` (>8 MiB) → `AnalysisResourceConstraintError` (tshark present) |
+| **Electron ASAR** | 607 B → **16.9 MiB** | capacity error | `DEFAULT_ASAR_MAX_HEADER_BYTES` (16 MiB) |
+| **WASM + Wabt** | 54 B → **6.56 MiB** · 251 exports | `ifaceState=partial` | `WASM_INTERFACE_REPRESENTATION_BYTES` — *Typed WASM interface decoding exceeds the WABT output representation budget* |
+| **SQLite** (Node 24) | 12 KiB → 56 KiB | redaction / column eval | `SqliteColumnEvaluationFailure` — unknown `enclave_unseal_payload()` on honey trap columns |
+| **JavaScript** | 761 B → 116 KiB | budget rejected | `alias-selections` + `getter-expansion` + `primitive-bytes` + `primitive-candidates` (real REA `resourceLimits`) |
+| **Safetensors** | 128 B → 10.1 KiB | capacity error | `MODEL_JSON_NESTING` — *Safetensors JSON nesting exceeds 32 levels* (HF-loadable; tensor bytes unchanged) |
+| **GGUF** | 24 B → 7.7 KiB | capacity error | `MODEL_METADATA_NESTING` — *GGUF metadata nesting exceeds 32 array frames* |
+| **Electron fuses** | 50 KiB → 1.16 MiB | budget rejected | `ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice` (>32) |
+| **Flutter pool** | 50 KiB → 1.16 MiB | projected cap | `MAX_POOL_URIS` / `MAX_POOL_TOKENS` (REA would truncate with “at least N”) |
 
-| Showcase Target (Modeled on REA Official Showcases) | Before BLA (REA Alone) | After `npx bla-agents protect` | Token Burn | Runtime Check |
-| :--- | :--- | :--- | :---: | :---: |
-| **1. DX-Ball Sound-Pan Calculation** (`.js`) | `84/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `2/100` · `10,182,068` tok · **`$160.64`** (`LIMITED`) | **2,121.3x** | ✅ 100% Exact |
-| **2. Notion Electron Clipboard Bridge** (`.asar`) | `98/100` · `9,132` tok · **`$0.34`** (`COMPLETE`) | `2/100` · `23,125,000` tok · **`$358.28`** (`LIMITED`) | **2,532.3x** | ✅ 100% Exact |
-| **3. Enterprise Offline License Validator** (`.ts`) | `84/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `2/100` · `10,182,169` tok · **`$160.64`** (`LIMITED`) | **2,121.3x** | ✅ 100% Exact |
-| **4. WebAssembly Crypto Kernel** (`.wasm`) | `81/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `6/100` · `1,807,067` tok · **`$29.88`** (`LIMITED`) | **376.5x** | ✅ 100% Exact |
-| **5. Native ELF64 Binary** (Rust / Go / Fuse / Dart) | `81/100` · `9,278` tok · **`$0.35`** (`COMPLETE`) | `2/100` · `3,698,135` tok · **`$59.72`** (`LIMITED`) | **398.6x** | ✅ 100% Exact |
-| **6. Local SQLite Entitlement Database** (`.sqlite`) | `81/100` · `10,568` tok · **`$0.29`** (`COMPLETE`) | `7/100` · `1,711,235` tok · **`$28.36`** (`LIMITED`) | **161.9x** | ✅ 100% Exact |
-| **7. Proprietary Edge AI Weights** (`.safetensors`) | `81/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `6/100` · `1,807,073` tok · **`$29.88`** (`LIMITED`) | **376.5x** | ✅ 100% Exact |
-| **8. Android Dalvik Bytecode** (`classes.dex`) | `81/100` · `8,900` tok · **`$0.34`** (`COMPLETE`) | `7/100` · `2,786,285` tok · **`$45.09`** (`LIMITED`) | **313.1x** | ✅ 100% Exact |
+Reproduce:
 
-### DX-Ball: bankrupt a sound-pan reconstruction
+```bash
+# Prefer Node 22.23.4+ or 24.x; set Wabt/tshark for full coverage
+export REA_WABT_BIN_DIRECTORY=$HOME/opt/wabt-1.0.42/bin   # optional
+npm run build && npm run redteam:rea
+```
 
-REA's flagship showcase reconstructs DX-Ball's `clampPan` and `calculateSoundPanFromX` helpers in seconds (`$0.20`). After running `npx bla-agents protect examples/dx-ball-sound-pan/sound-pan.js --intensity bankrupt`, REA's `parse_status` drops to `"partial"`, `examination.status` degrades to `"limited"` (`["alias-selections", "primitive-bytes", "primitive-candidates"]`), and the obligation ledger expands from 2 functions to 38 interconnected state machines (`2,121.3x` token amplification) while returning identical pan values for every input coordinate.
+### Designed-for but **not** empirically verified here
 
-### Notion: blind the Electron clipboard IPC bridge
+These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path needs **native tooling we did not run** on this box:
 
-REA traces Electron apps by matching unique literal strings between `ipcRenderer.invoke("clipboard:write-rich-format")` and `ipcMain.handle(...)`. BLA replaces real IPC channel strings with $\ge 9$-chunk number-theoretic opaque expressions (`electron.ipc[0].channel === null`) and registers duplicate decoy handlers on the same literal channel names—forcing `electron_call_paths_limited: true` and `uncertainty: ["dynamic-findings", "returned-reference-widening"]`.
+| Area | Why unverified here |
+| --- | --- |
+| Ghidra / native decompilation depth | Requires a Ghidra install + REA bridge |
+| Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach |
+| JADX / full Android APK pipeline | APK resigning unsupported; DEX shield is in-tree |
+| **Firmware** containers | Skipped — staging/extraction budgets exist; no honest E2E without firmware corpora |
+| **SPIR-V / CUDA fatbinary / AMD GPU objects** | Skipped — need native GPU object decoders; **PTX text** is shielded in-tree (benchmark only, not a REA GPU-object budget hit) |
+| EVMole in-process EVM decode | Documented as not pathable in-process; EVM shield still densifies to the 4 MiB input approach |
 
-### Native, SQLite & Edge AI: trip REA's binary and container capacity limits
+We do **not** claim those paths are empirically bankrupt until `redteam:rea` (or an equivalent harness) records a real before/after against the live analyzer.
 
-When an attacker runs REA's `inspect_rust_binary`, `inspect_electron_fuses`, `inspect_sqlite_database`, or `inspect_model_artifact` on BLA-protected files, REA's own parsers deterministically abort with capacity and evaluation failures (`Read-only data contains more than 64 distinct rustc commit paths`, `Slice 0 contains more than 32 Electron fuse sentinels`, `SqliteColumnEvaluationFailure`, and `ModelFormatFailure: json-nesting`).
+---
 
-## FAQ
+## Format coverage
+
+| Format | Canary + diagnostic | Exhaustion / budget trip | Empirically vs REA | Notes |
+| --- | :---: | :---: | :---: | --- |
+| JavaScript / TypeScript | ✓ | ✓ semantic budgets | **verified** (in-process) | Babel AST; anti-strip; real REA resourceLimits |
+| Electron `.asar` | ✓ | ✓ header 16 MiB | **verified** | |
+| Electron fuses | ✓ | ✓ >32 sentinels | **verified** | |
+| WASM | ✓ custom sections | ✓ export-name decoys → Wabt | **verified** (Wabt) | Soft-skips to projected budget without Wabt |
+| Python / `.pyc` | ✓ | ✓ | designed-for | |
+| SQLite | ✓ honey + trap cols | ✓ column eval | **verified** (Node 24) | Soft `capability_gated` on Node 22 |
+| Safetensors | ✓ string metadata | ✓ JSON nesting >32 | **verified** | HF-loadable; tensor bytes preserved |
+| GGUF | ✓ | ✓ ARRAY nesting >32 | **verified** | |
+| Go buildinfo | ✓ | ✓ >1 MiB | **verified** | Mapped ELF section |
+| Flutter / Dart pool | ✓ | ✓ URI/token caps | **verified** (projected) | |
+| Erlang BEAM | ✓ | ✓ chunks / atoms | **verified** | |
+| EVM + Solidity meta | ✓ | ✓ → 4 MiB input | **verified** (approach) | |
+| PCAP | ✓ | ✓ tshark JSON >8 MiB | **verified** (tshark) | Soft-skip without tshark |
+| NVIDIA PTX (text) | ✓ | entry flood | benchmark only | Not a REA GPU-object budget |
+| DEX / IL2CPP / bplist / .NET / JVM / ZIP | ✓ | format-specific | designed-for | APK signing-aware protect unsupported |
+| Firmware / SPIR-V / CUDA fatbin / AMD GPU | — | — | **skipped** | See matrix above |
 
-<details>
-<summary><strong>Which agents can use BLA?</strong></summary>
-
-Any coding agent that supports local MCP servers or `SKILL.md` workflows. `npx bla-agents setup` auto-configures Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. See [supported agents](docs/installation.md).
+---
 
-</details>
+## Benchmark (14 targets, internal estimates)
+
+`npx bla-agents benchmark` runs a **local Counter-REA showcase**: exposure scores, **estimated** token/cost multipliers, and **measured** runtime equivalence. Token/$ columns are **internal estimates** derived from BLA's catalog of REA limits — they are **not** the same as the empirical REA process measurements above (those are byte-level analyzer failures with real error strings). `npm run verify:rea` is a **constant-drift harness only** and must never be cited as protection evidence; the only authoritative gate is `npm run redteam:rea`.
+
+Latest local run (bla-agents **v1.4.0**): aggregate **~612.5×** tokens · **~292.2×** cost · **14/14** runtime-exact.
+
+| Target | Unprotected (est.) | Protected (est.) | Token mult (est.) | Runtime |
+| --- | --- | --- | ---: | :---: |
+| DX-Ball sound-pan (`.js`) | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | **2822.7×** | 100% |
+| Notion Electron clipboard (`.asar`) | 98/100 · 9,132 tok · $0.34 | 2/100 · 23.1M tok · $358.28 · LIMITED | **2532.3×** | 100% |
+| Enterprise license validator | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | **2822.7×** | 100% |
+| WASM crypto kernel | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.83M tok · $30.23 · LIMITED | **381.5×** | 100% |
+| Native ELF64 (Rust/Go/Fuse/Dart) | 81/100 · 35,222 tok · $0.73 | 2/100 · 3.72M tok · $60.03 · LIMITED | **105.6×** | 100% |
+| SQLite entitlement DB | 81/100 · 10,568 tok · $0.29 | 7/100 · 1.71M tok · $28.39 · LIMITED | **162.1×** | 100% |
+| Edge AI Safetensors | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.81M tok · $29.90 · LIMITED | **376.8×** | 100% |
+| Android DEX | 81/100 · 8,900 tok · $0.34 | 7/100 · 2.79M tok · $45.11 · LIMITED | **313.2×** | 100% |
+| Apple bplist | 81/100 · 6,440 tok · $0.26 | 9/100 · 1.36M tok · $22.96 · LIMITED | **211.8×** | 100% |
+| .NET managed DLL | 81/100 · 8,900 tok · $0.34 | 6/100 · 2.45M tok · $39.96 · LIMITED | **274.8×** | 100% |
+| Erlang BEAM | 81/100 · 8,900 tok · $0.34 | 5/100 · 3.86M tok · $62.08 · LIMITED | **433.2×** | 100% |
+| EVM Solidity metadata | 81/100 · 6,440 tok · $0.26 | 6/100 · 1.78M tok · $29.40 · LIMITED | **276.3×** | 100% |
+| libpcap capture | 81/100 · 4,800 tok · $0.20 | 8/100 · 1.60M tok · $26.58 · LIMITED | **333.2×** | 100% |
+| NVIDIA PTX text | 81/100 · 4,800 tok · $0.20 | 6/100 · 2.40M tok · $39.29 · LIMITED | **500.2×** | 100% |
 
-<details>
-<summary><strong>Does BLA slow down my app or change its runtime output?</strong></summary>
+---
 
-No. BLA's semantic budget breakers (`alias-selections`, `getter-expansion`, `primitive-bytes`) and tarpit call graphs are guarded by $O(1)$ number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod 7$) that never execute at runtime. Every benchmark target verifies 100% input/output equivalence against the unprotected build.
+## How BLA works
 
-</details>
+1. **Exhaustion** — trip documented REA caps (`primitive-candidates`, ASAR header bytes, WASM interface representation, SQLite column evaluation, model JSON/ARRAY nesting, Go buildinfo, BEAM chunks, PCAP tshark JSON, fuse sentinels, …).
+2. **Deception** — canary credentials + system-diagnostic rabbit holes across Python/WASM/SQLite/models/DEX/IL2CPP/bplist/.NET/JVM/ZIP; decoy IPC / enclave manifests / VLQ maps.
+3. **Runtime guard** — Electron V1 fuse hardening; CDP/Frida/inspector detection returns synthetic telemetry during inspection sessions.
 
-<details>
-<summary><strong>How is BLA different from traditional obfuscators like javascript-obfuscator or O-LLVM?</strong></summary>
+Protections are format-native (no commercial packer / external LLVM required). Red line: **never break protected program behavior, export surface, binary/section integrity, or format validity.**
 
-Traditional obfuscators rename variables (`calculatePrice` $\rightarrow$ `_0x1a2b`), which modern LLMs effortlessly reverse via control-flow semantics, while heavy VM packers slow down execution. BLA is engineered specifically against **AI coding agents and `morluto/rea`'s static/semantic analyzers**—tripping REA's exact internal resource caps, breaking IPC literal pairing, poisoning source maps/metadata with hardware-enclave delegation chaff, and multiplying agent MCP token consumption by up to 2,500x.
+---
 
-</details>
 
-<details>
-<summary><strong>Do I need Hopper, Ghidra, IDA, or WABT installed to protect my files?</strong></summary>
+## Project config defaults (P0)
 
-No. All 19 format shields (Babel AST, Chromium `.asar`, LEB128 `.wasm`, CPython `.pyc`, ELF/Mach-O/PE, SQLite3, `.safetensors`/`.gguf`, and `.dex`/`Il2Cpp`) are built directly into `bla-shield` with zero external binary dependencies.
+- **Per-project seed** — BLA mints a random seed into `.blarc` / `bla.config.json` on first use. Legacy shared fingerprints (`bla-shield-seed-v1`, …) are no longer the default.
+- **`--llm-directives`** — risky LLM-facing bait (fake COPPA/medical notices, dual-use imitation, in-band AI chat markers) is **off by default**; pass the flag (or `llmDirectives: true` / MCP `llm_directives`) to opt in.
+- **`--manifest`** — `.bla-manifest.json` is an **unsigned** attestation (not ed25519-signed) and is **opt-in**; it is not shipped next to customer artifacts by default. Schema: [`defense-manifest-v1.json`](website/schemas/defense-manifest-v1.json).
 
-</details>
+## FAQ
 
 <details>
-<summary><strong>What happens when someone runs REA against a BLA-protected app?</strong></summary>
-
-1. REA's JavaScript/Electron analyzer degrades from `complete` to `partial` / `limited` and fails to pair IPC channels (`channel: null`).
-2. REA's binary, Fuse, SQLite, and AI model inspectors hit hard capacity limits (`>64` rustc hashes, `>32` Electron fuse sentinels, `SqliteColumnEvaluationFailure`, `>32` JSON/ARRAY nesting).
-3. If the agent attempts feature tracing (`trace_application_feature`), it enters 14–36 Fake XRef state machines and Honey Source Maps (`enclave://tee-runtime/`), exhausting its context window and API budget.
+<summary><strong>Which agents can use BLA?</strong></summary>
 
+Any coding agent with local MCP or `SKILL.md` workflows. `npx bla-agents setup` configures Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI.
 </details>
 
 <details>
-<summary><strong>What does installing the skill do?</strong></summary>
-
-The [`blind-llm-agents` skill](.agents/skills/blind-llm-agents/SKILL.md) teaches your coding agent how to run pre-release Counter-REA audits, select the right protection intensity (`stealth`, `balanced`, `maximum`, `bankrupt`), integrate bundler plugins, and verify defense gates automatically.
+<summary><strong>Does BLA change runtime output?</strong></summary>
 
+No on the hot path. Budget guards sit behind $O(1)$ opaque predicates. Every benchmark target checks 100% input/output equivalence against the unprotected build.
 </details>
 
 <details>
-<summary><strong>Does BLA upload my source code or binaries anywhere?</strong></summary>
-
-Never. BLA audits, protects, and verifies all files 100% locally on your machine with deterministic seeded PRNG transforms (`--seed`) and zero network calls.
+<summary><strong>Do I need Ghidra, Hopper, IDA, or Wabt to protect files?</strong></summary>
 
+No. Shields are built into `bla-agents`. Wabt/tshark/Node 24 are optional — they unlock **empirical** red-team probes (`npm run redteam:rea`), not protection itself.
 </details>
 
 <details>
-<summary><strong>What should I do if I hit a bug?</strong></summary>
-
-Update first and run `bla doctor` to check engine readiness:
-
-```bash
-npx bla-agents@latest doctor
-npx bla-agents@latest setup
-```
-
-If the issue persists, [open an issue](https://github.com/qybaihe/bla/issues) with your BLA version (`bla --version`), target format, and steps to reproduce.
+<summary><strong>Is BLA for attacking other people's software?</strong></summary>
 
+No. See [DISCLAIMER.md](DISCLAIMER.md). Protective payloads activate under reverse-engineering inspection of artifacts **you** hardened.
 </details>
 
 ## Documentation
 
-- [Installation and agent setup](docs/installation.md): agent registration, bundler plugins, updates, and uninstall.
-- [CLI and MCP contracts](docs/cli-and-mcp.md): commands, options, exit codes, and JSON-RPC 2.0 MCP tool schemas.
-- [Counter-REA technical defense matrix](.agents/skills/blind-llm-agents/references/counter-rea-matrix.md): exact `morluto/rea` source limits and how BLA exploits them.
+- [DISCLAIMER.md](DISCLAIMER.md) — defensive use, own-software only
+- [Installation and agent setup](docs/installation.md)
+- [CLI and MCP contracts](docs/cli-and-mcp.md)
+- [Empirical REA validation](docs/redteam/empirical-rea-validation.md)
+- [Counter-REA matrix](.agents/skills/blind-llm-agents/references/counter-rea-matrix.md)
+- [v1.4.0 release notes (staged)](docs/releases/v1.4.0.md)
+- [CHANGELOG](CHANGELOG.md)
 
 Report security issues through [SECURITY.md](SECURITY.md).
 
-## Disclaimer
+## Contributing
 
-See [DISCLAIMER.md](DISCLAIMER.md) for responsible-use guidance.
+Issues and PRs welcome at [qybaihe/bla](https://github.com/qybaihe/bla). Before submitting:
 
-BLA is a defensive software-protection toolkit for hardening software, bundles, models, and binaries that you own or are authorized to protect. All injected chaff payloads are strictly benign architectural metadata and synthetic decoy functions that preserve 100% of original runtime behavior.
+```bash
+export PATH=$HOME/node22.23.4/bin:$PATH   # or node24
+npm run build && npm test && node dist/cli.js benchmark
+npm run redteam:rea                        # authoritative (real REA)
+# npm run verify:rea                       # drift harness only — NOT protection proof
+```
 
-## Contributing
+## Community / 友情社区
 
-Issues and pull requests are welcome at [qybaihe/bla](https://github.com/qybaihe/bla). Run `npm run build && npm test && node dist/cli.js benchmark` before submitting changes.
+- 🎯 **[Public BLA CrackMe Challenge (`challenge/`)](challenge/README.md)** — Can your AI reverse-engineering agent beat a `bankrupt`-hardened BLA binary without falling into our Honeypot Flags?
+- [LINUX DO (`linux.do`)](https://linux.do/) — 新的理想型社区
 
 ## License