Finding
The programmatic pipeline's DECOMPILE stage is documented/configured as bytecode-to-Solidity, but it currently returns TAC and ignores the configured model path.
Evidence
PipelineConfig exposes decompiler_model_path, but initialize() never creates SmartContractDecompiler or uses that path: src/pipeline_orchestrator.py:31-44, src/pipeline_orchestrator.py:107-135.
_run_decompilation() calls analyze_bytecode_to_tac() and stores the TAC string in result.decompiled_source: src/pipeline_orchestrator.py:203-211.
- E2E coverage only checks
decompiled_source is not None, so TAC can pass as "decompiled" output: tests/test_e2e.py:190-196.
Impact
API/SDK callers can believe they received Solidity when they actually received intermediate TAC. Audit/report flows built on this result can present misleading output and make inference reliability hard to reason about.
Recommended fix
Instantiate and use SmartContractDecompiler when the decompile stage is enabled and a model path is configured. Return separate structured fields for TAC, generated Solidity, model status, and errors; fail or warn explicitly when no model is available.
Acceptance criteria
PipelineStage.DECOMPILE uses model-backed decompile_contract() when decompiler_model_path is set.
- TAC and Solidity are separate fields in
PipelineResult/to_dict().
- Missing model paths produce an explicit stage failure or
decompilation_status, not TAC in decompiled_source.
- Tests assert that model-backed decompile returns Solidity-shaped output and that TAC-only fallback is clearly labeled.
Finding
The programmatic pipeline's
DECOMPILEstage is documented/configured as bytecode-to-Solidity, but it currently returns TAC and ignores the configured model path.Evidence
PipelineConfigexposesdecompiler_model_path, butinitialize()never createsSmartContractDecompileror uses that path:src/pipeline_orchestrator.py:31-44,src/pipeline_orchestrator.py:107-135._run_decompilation()callsanalyze_bytecode_to_tac()and stores the TAC string inresult.decompiled_source:src/pipeline_orchestrator.py:203-211.decompiled_source is not None, so TAC can pass as "decompiled" output:tests/test_e2e.py:190-196.Impact
API/SDK callers can believe they received Solidity when they actually received intermediate TAC. Audit/report flows built on this result can present misleading output and make inference reliability hard to reason about.
Recommended fix
Instantiate and use
SmartContractDecompilerwhen the decompile stage is enabled and a model path is configured. Return separate structured fields for TAC, generated Solidity, model status, and errors; fail or warn explicitly when no model is available.Acceptance criteria
PipelineStage.DECOMPILEuses model-backeddecompile_contract()whendecompiler_model_pathis set.PipelineResult/to_dict().decompilation_status, not TAC indecompiled_source.