{
  "projectId": "rig-onchain-kit",
  "title": "Rig Onchain Kit · 发布产物与执行边界",
  "summary": "发布包包含实际本地钱包签名与发送交易的实现。SignerContext 用 Tokio task-local 传递签名器；这种上下文隔离并不构成交易额度、审批或损失控制。",
  "scope": "crates.io 官方 rig-onchain-kit 1.0.0 的发布源码；保留原始 crate 哈希并转换为 ZIP 兼容输入供 REA 清单检查。未编译、运行或签名。",
  "status": "partial",
  "analyzedAt": "2026-10-13",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "REA 已检查官方 crate 内容的兼容派生清单",
      "detail": "原始 crate 解压后未改文件内容，转换为 ZIP 供 REA 检查；inspect_artifact 返回 115 个内容节点、116 个文件/目录出现项。这个结果证明本次检查输入的身份和结构，不证明 Python、Go 或 Rust 代码运行行为，也不等同于完成产品逆向。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_2bd0f1de473adbc0b1af1c5348939c4b5d4704a6fe56f882de82bbba82676ed5"
      ],
      "sourceUrls": [
        "https://static.crates.io/crates/rig-onchain-kit/rig-onchain-kit-1.0.0.crate"
      ]
    },
    {
      "title": "SignerContext 是任务级上下文",
      "detail": "发布包的 signer/mod.rs 使用 tokio::task_local! 保存 Arc<dyn TransactionSigner>，with_signer 通过 scope 将签名器绑定到异步任务。它解决工具调用取得哪个签名器的问题，不能由此推导账户托管安全或交易限额。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/0xPlaygrounds/rig-onchain-kit/blob/999f0898dfe68c0ad9de00a48f56fa12503a6974/src/signer/mod.rs#L86"
      ]
    },
    {
      "title": "本地 Solana 路径会签名并发送交易",
      "detail": "LocalSolanaSigner 从传入私钥创建 Keypair；sign_and_send_solana_transaction 读取 blockhash、调用 try_sign 后调用 send_tx。调用者若启用这一实现，接口语义包含发送交易，而不只是生成建议。该路径在本次没有执行。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/0xPlaygrounds/rig-onchain-kit/blob/999f0898dfe68c0ad9de00a48f56fa12503a6974/src/signer/solana.rs#L16",
        "https://github.com/0xPlaygrounds/rig-onchain-kit/blob/999f0898dfe68c0ad9de00a48f56fa12503a6974/src/signer/solana.rs#L37"
      ]
    },
    {
      "title": "发布源码与仓库 commit 有明确对应",
      "detail": "crate 内 .cargo_vcs_info.json 标记的 commit 为 999f0898dfe68c0ad9de00a48f56fa12503a6974，与本报告引用的固定源码一致。发布包同时含 Local EVM、Local Solana 与 Privy 签名器实现，不能用一个笼统的托管标签概括所有接入方式。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/0xPlaygrounds/rig-onchain-kit/blob/999f0898dfe68c0ad9de00a48f56fa12503a6974/src/signer/evm.rs#L1",
        "https://github.com/0xPlaygrounds/rig-onchain-kit/blob/999f0898dfe68c0ad9de00a48f56fa12503a6974/src/signer/privy.rs#L1"
      ]
    }
  ],
  "limitations": [
    "REA 6.4.0 的该 CLI 不直接识别 .crate/tar.gz；因此检查的是从原包解压、未改文件内容的 ZIP 派生输入。原始与派生 SHA-256 分开保留。",
    "发布包是 Rust 源码分发，不是经本次验证的编译二进制；REA 文件清单不提供 Rust 语义或运行证明。",
    "没有加载私钥、创建钱包、请求签名或广播任何交易。"
  ],
  "artifacts": [
    {
      "label": "crates.io 官方发布源码包 1.0.0",
      "url": "https://static.crates.io/crates/rig-onchain-kit/rig-onchain-kit-1.0.0.crate",
      "sha256": "b2851ab36127d91ff82394608f8748f2cd2f3dd6ff8b01ce0de9d8869221549f",
      "bytes": 118124
    }
  ],
  "evidenceIds": [
    "ev_2bd0f1de473adbc0b1af1c5348939c4b5d4704a6fe56f882de82bbba82676ed5"
  ],
  "reportUrl": "/research/rea/rig-onchain-kit.json",
  "methodology": "REA 原始输出负责产物身份、文件结构或原生元数据；code_inference 结论来自带固定版本引用的源码阅读。未完成动态运行、实盘测试、完整安全审计或收益验证。",
  "sourceCommit": "999f0898dfe68c0ad9de00a48f56fa12503a6974",
  "releasedArtifactAvailable": true,
  "analysisInput": {
    "sha256": "a8471cc819b011575816005483efe41da61aa992277132a00d27c121bc328ebf",
    "format": "zip",
    "evidenceId": "ev_2bd0f1de473adbc0b1af1c5348939c4b5d4704a6fe56f882de82bbba82676ed5",
    "operation": "inspect_artifact",
    "publicSourceUrls": [
      "https://static.crates.io/crates/rig-onchain-kit/rig-onchain-kit-1.0.0.crate"
    ],
    "derivedFromSha256": "b2851ab36127d91ff82394608f8748f2cd2f3dd6ff8b01ce0de9d8869221549f",
    "transformation": "官方 .crate 经 tar 解压，文件内容不变；zip -qr 生成供 REA 识别的兼容输入，原包与派生包分开记录。"
  },
  "analysisAttempts": [
    {
      "command": "rea inspect-artifact <rig-onchain-kit source directory> --format json",
      "result": "unavailable",
      "code": "target_unavailable",
      "reason": "REA CLI 的此入口拒绝普通目录；已改用明确记录的 ZIP 输入。"
    },
    {
      "command": "rea inspect-artifact rig-onchain-kit-1.0.0-rea-input.zip --format json",
      "result": "completed",
      "evidenceIds": [
        "ev_2bd0f1de473adbc0b1af1c5348939c4b5d4704a6fe56f882de82bbba82676ed5"
      ],
      "coverage": "published_artifact_inventory"
    }
  ]
}