# Offline B-Route Reverse Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Use offline reverse engineering to advance the primary B-route when no logged-in iSphere environment is available.

**Architecture:** Treat the available iSphere/IMPlatformClient binaries as read-only samples. Recover the send-message, send-file, plugin/IPC, and bridge-transport evidence needed to decide whether B-route can be implemented without relying on RPA. Keep A-route/RPA as backup-only and do not execute real send or upload in this plan.

**Tech Stack:** Windows PowerShell, .NET Framework IL tools, existing extracted IL files, Go 1.23.4 for repeatable analyzers, Markdown evidence reports.

## Global Constraints

- Repository root: `E:\coding\codex\isphere-ai-bridge`.
- Active branch for execution should be a new `codex/` branch, not `main` directly.
- Do not use `rg`; use `git ls-files`, `ag`, `grep -R`, or PowerShell commands.
- Tomorrow has no logged-in iSphere environment; do not wait for online evidence.
- Preserve original binaries read-only. Any extraction output must go under ignored `runs/` or committed sanitized docs/scripts only.
- B-route remains primary. A-route/RPA remains backup-only.
- No real message send, no file upload, no network replay, no process injection, and no client mutation in this plan.
- Outputs must separate verified facts from reverse-engineering hypotheses.

---

## Available offline samples

Use these local samples first:

| Sample | Purpose | SHA256 |
| --- | --- | --- |
| `runs/offline-real-client-window/full/zyl/Impp/IMPlatformClient.exe` | main managed client; text send, chat window, plugin/IPC candidates | `E2966E58360DAEEBF178410A961E2DC52748C63E9CCBD94BD6EC8434A1A09CB7` |
| `runs/offline-real-client-window/full/zyl/Impp/IMPP.Service.dll` | file upload service candidates | `F859DE2F34E024B5F372D95F22CBF8A018C780F24203E7A76D392E52BD90CADD` |
| `runs/offline-real-client-window/full/zyl/Impp/IMPP.Interface.dll` | service/interface contract candidates | `DD093CF61FAE85C2D2581F289B01AA477546712E098FEF81272FDD989E50D12D` |
| `runs/offline-real-client-window/full/zyl/Impp/IMPP.Model.dll` | model/parameter types | `7CBABDD23A7234D15E294C549EEEC78EFBAD6E957CD45A6E8A85309349A624A5` |
| `runs/offline-real-client-window/full/zyl/Impp/IMPP.UI.dll` | UI/plugin helpers and possible send controls | `4C61212519C01D1B731ED4F20DF3411C491616F4ADA98A4529722A6AA3689E6D` |
| `runs/offline-real-client-window/full/zyl/Impp/IMPP.Common.dll` | shared utility and message types | `02A47C99C27C9BFE2BADC438389300C92220B07609BD87C48B4B5E1B4EE6AEB4` |
| `runs/offline-real-client-window/full/zyl/Impp/IMPP.Helper.dll` | helper abstractions | `30932D082B6678699C832C63F923E01EAD84674FAEDB613D631E034E03742FB9` |
| `runs/offline-real-client-window/full/zyl/Impp/smack.dll` | XMPP chat/send layer | `BAD0BB0591765DB153B17CECC1112B0BBDBF3B1D3370DDF973F91974E92CEC66` |
| `runs/offline-real-client-window/full/zyl/Impp/TcpFileTransfer.dll` | native/transfer candidate | `6C4874B46D1E7DC04C9B6784180603452400B881E04509D464A0D58814EFEDA7` |
| `runs/offline-real-client-window/full/zyl/Impp/HttpServerLib.dll` | local API/IPC candidate | `FFDB633216AE332B8EDFFC83E2AE546B7A80144C659FF4053FDFE4FE382A8D12` |
| `runs/offline-real-client-window/full/zyl/Impp/INetwork.dll` | network abstraction candidate | `E40BE4EE2439E4280461F4D2BADB318A5F4572428F069AB6D17B4C4F0E8CFAC9` |
| `runs/offline-real-client-window/full/zyl/Impp/IOClientNetwork.dll` | network implementation candidate | `64CA231A614771325741A5F098E52EBF20F7190E339B64962DE2EDEDCFFFF904` |

Existing IL evidence to reuse:

- `runs/offline-evidence-intake/zyl-qqfile-20260709/metadata/c28-il/IMPlatformClient.exe.il`
- `runs/offline-chat-window/frmP2PChat-ctor.il.txt`
- `runs/offline-chat-window/frmP2PChat-ctor-null-risk.md`

---

## Task 1: Offline reverse case index

**Files:**
- Create: `docs/source-discovery/2026-07-12-offline-broute-reverse-index.md`
- Create: `scripts/build-offline-broute-reverse-index.ps1`

**Interfaces:**
- Produces: a sanitized Markdown/JSON index of sample paths, SHA256, size, timestamp, and role.
- Consumes: the sample paths listed above.

- [ ] Write `scripts/build-offline-broute-reverse-index.ps1` to hash the sample list and emit `runs/offline-broute-reverse/index.json` plus `docs/source-discovery/2026-07-12-offline-broute-reverse-index.md`.

The script must not copy or modify binaries. It should only read metadata and hashes.

- [ ] Run:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\build-offline-broute-reverse-index.ps1
```

Expected: JSON and Markdown index generated; no binary copied.

## Task 2: Text-send static call graph

**Files:**
- Create: `scripts/extract-broute-text-send-map.ps1`
- Create: `docs/source-discovery/2026-07-12-broute-text-send-static-map.md`

**Interfaces:**
- Consumes: `IMPlatformClient.exe.il`, `smack.dll`, and related managed assemblies.
- Produces: function map for:
  - `AppContextManager.SendTxtMessageByJid`
  - `MessageScheduling.SendChatMessage`
  - `Chat.SendMessage`
  - `XMPPConnection.send`
  - `MessageCenter` send-related callbacks

- [ ] Extract method headers, signatures, call sites, and surrounding IL windows.
- [ ] Mark each function as one of: `confirmed_signature`, `confirmed_callsite`, `string_only`, or `not_found`.
- [ ] Write the report with a conclusion section:

```markdown
## Decision

B-route text send remains plausible only if a bridge can enter the logged-in runtime or an existing IPC/API exposes the same call. Offline IL confirms call shape, but not runtime invocability.
```

- [ ] Verify:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\extract-broute-text-send-map.ps1
git diff --check
```

Expected: exit 0 and report contains all target function names.

## Task 3: File-send/static upload call graph

**Files:**
- Create: `scripts/extract-broute-file-send-map.ps1`
- Create: `docs/source-discovery/2026-07-12-broute-file-send-static-map.md`

**Interfaces:**
- Consumes: `IMPlatformClient.exe`, `IMPP.Service.dll`, `IMPP.Interface.dll`, `IMPP.Model.dll`, `TcpFileTransfer.dll`.
- Produces: function/type map for:
  - `IMPP.Client.OffLineFileSend.sendFile`
  - `IMPP.Client.OffLineFileSend.trans_UploadCompleted`
  - `IMPP.Service.BLL.FileTransfer.FileUpload`
  - `IMPP.Service.BLL.FileTransfer.AsynFileUpload`
  - `FileUploadPara`
  - chat/file message send method names such as `sendFileMessage`

- [ ] Extract signatures and parameter types.
- [ ] Identify whether file send is direct upload first or chat-message first.
- [ ] Identify what local file path, server file id, file hash, and target JID values are required.
- [ ] Verify:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\extract-broute-file-send-map.ps1
git diff --check
```

Expected: report separates upload step from chat message step.

## Task 4: Bridge/IPC/plugin reverse map

**Files:**
- Create: `scripts/extract-broute-bridge-map.ps1`
- Create: `docs/source-discovery/2026-07-12-broute-bridge-static-map.md`

**Interfaces:**
- Consumes: `IMPlatformClient.exe`, `HttpServerLib.dll`, `IMPlatformClient.Web.exe`, `INetwork.dll`, `IOClientNetwork.dll`, config files, and existing live-probe `services_registry_shortcuts.json` / `network_inventory.json`.
- Produces: static evidence table for:
  - localhost HTTP server routes or ports;
  - named pipe strings;
  - plugin loader classes or directories;
  - command-line switches;
  - COM/service candidates;
  - update/patch extension points.

- [ ] Search strings and IL for `HttpListener`, `TcpListener`, `NamedPipe`, `Pipe`, `Plugin`, `LoadFrom`, `Assembly.Load`, `localhost`, `127.0.0.1`, `http://`, `net.pipe`, `Register`, `Route`, and `Command`.
- [ ] Report exact methods/classes where bridge candidates appear.
- [ ] Classify each candidate:
  - `usable_without_login`
  - `requires_logged_in_process`
  - `static_only_unknown`
  - `not_a_bridge`
- [ ] Verify:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\extract-broute-bridge-map.ps1
git diff --check
```

Expected: report gives a yes/no recommendation for whether B-route should pursue IPC/plugin before in-process adapter.

## Task 5: Offline bridge decision update

**Files:**
- Modify: `docs/superpowers/plans/2026-07-12-b-route-bridge-next-plan.md`
- Modify: `docs/source-discovery/capability-source-matrix.md`
- Create: `docs/source-discovery/2026-07-12-offline-broute-reverse-decision.md`

**Interfaces:**
- Consumes: reports from Tasks 1-4.
- Produces: next implementation decision:
  - `existing_ipc_first`
  - `plugin_extension_first`
  - `in_process_adapter_research`
  - `external_sidecar_preview_only`
  - `fallback_rpa_only`

- [ ] Write decision using only offline evidence.
- [ ] If no bridge is found, state clearly that external sidecar can only do preview/probe unless an in-process bridge is added.
- [ ] Keep RPA marked backup-only.

## Task 6: Optional offline prototype only after decision

**Files:**
- To be added only after Task 5 decision.

**Rules:**
- If decision is `existing_ipc_first`, prototype a non-mutating client call to the local API only.
- If decision is `plugin_extension_first`, prototype plugin discovery only, not send.
- If decision is `in_process_adapter_research`, create a new explicit plan before coding.
- If decision is `external_sidecar_preview_only`, continue with the already planned preview-only B-route sidecar boundary.
- If decision is `fallback_rpa_only`, ask the user before promoting RPA beyond backup.

---

## Stop conditions

Stop and report if:

1. Static evidence shows all B-route send functions require live-only objects with no reachable bridge.
2. Bridge/plugin evidence implies invasive in-process loading and no safer IPC/API path exists.
3. File send requires server-issued upload tokens that cannot be derived offline.
4. Any next step would send a real message, upload a real file, mutate the client, attach a hook, or replay network traffic.

## Recommended immediate execution

Run Task 1 through Task 4 while offline. Do not wait for tomorrow's login evidence. After those reports exist, decide whether B-route can continue through IPC/plugin/static sidecar preview or whether RPA remains the only near-term operational path.