full-reverse 0.0.0-stage → 1.0.0

package/skills/full-reverse/schemas/examples/claims.example.json

@@ -0,0 +1,355 @@
+{
+  "schema_version": "full-reverse.claims/1",
+  "investigation_id": "inv_20260115-example",
+  "created_at": "2026-01-15T10:00:00Z",
+  "inputs": {
+    "inventory": {
+      "path": "inventory.json",
+      "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+    },
+    "evidence_index": {
+      "path": "evidence/index.json",
+      "sha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+    }
+  },
+  "claims": [
+    {
+      "comparison_build_ids": [],
+      "evidence": [
+        {
+          "kind": "canonical",
+          "file": "evidence/records/0123456789abcdef-analyze-javascript-application.json",
+          "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+          "evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222",
+          "selectors": [
+            {
+              "type": "json-pointer",
+              "pointer": "/normalized_result/summary/module_count",
+              "role": "count",
+              "expect": {
+                "equals": 42
+              }
+            }
+          ]
+        }
+      ],
+      "locations": [
+        {
+          "kind": "artifact-member",
+          "member_path": "src/pricing/discount.js",
+          "evidence": [
+            {
+              "kind": "canonical",
+              "file": "evidence/records/0123456789abcdef-analyze-javascript-application.json",
+              "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+              "evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222",
+              "selectors": [
+                {
+                  "type": "json-pointer",
+                  "pointer": "/normalized_result/graph/modules/7/path",
+                  "role": "path",
+                  "expect": {
+                    "equals": "src/pricing/discount.js"
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ],
+      "limitations": [],
+      "contradicts": [],
+      "derivation": {
+        "input_claim_ids": [],
+        "input_evidence": [
+          {
+            "kind": "canonical",
+            "file": "evidence/records/0123456789abcdef-analyze-javascript-application.json",
+            "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+            "evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222",
+            "selectors": [
+              {
+                "type": "json-pointer",
+                "pointer": "/normalized_result/summary/module_count",
+                "role": "count",
+                "expect": {
+                  "equals": 42
+                }
+              }
+            ]
+          }
+        ],
+        "procedure": "Read /normalized_result/graph/modules/7/path from the saved analysis record."
+      },
+      "inference": null,
+      "unavailable_reason": null,
+      "user_statement": null,
+      "polarity": "presence",
+      "basis": "static",
+      "claim_id": "clm_discount-module",
+      "statement": "The packaged application contains a module src/pricing/discount.js.",
+      "state": "derived",
+      "question_ids": [
+        "q_discount-rule"
+      ],
+      "build_id": "bld_app-asar",
+      "context": {
+        "question": "Which module computes the checkout discount?",
+        "bounds": "Static module inventory of app.asar 1.4.2"
+      },
+      "coverage": {
+        "status": "complete",
+        "scope": "All JavaScript modules REA reported for app.asar",
+        "evidence": [
+          {
+            "kind": "canonical",
+            "file": "evidence/records/1111111111111111-inspect-analysis-view.json",
+            "sha256": "3333333333333333333333333333333333333333333333333333333333333333",
+            "evidence_id": "ev_4444444444444444444444444444444444444444444444444444444444444444",
+            "selectors": [
+              {
+                "type": "json-pointer",
+                "pointer": "/normalized_result/coverage/source_complete",
+                "role": "coverage",
+                "expect": {
+                  "equals": true
+                }
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "comparison_build_ids": [],
+      "evidence": [
+        {
+          "kind": "canonical",
+          "file": "evidence/records/0123456789abcdef-analyze-javascript-application.json",
+          "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+          "evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222",
+          "selectors": [
+            {
+              "type": "json-pointer",
+              "pointer": "/normalized_result/summary/module_count",
+              "role": "count",
+              "expect": {
+                "equals": 42
+              }
+            }
+          ]
+        }
+      ],
+      "locations": [],
+      "limitations": [],
+      "contradicts": [],
+      "derivation": {
+        "input_claim_ids": [],
+        "input_evidence": [
+          {
+            "kind": "canonical",
+            "file": "evidence/records/0123456789abcdef-analyze-javascript-application.json",
+            "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+            "evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222",
+            "selectors": [
+              {
+                "type": "json-pointer",
+                "pointer": "/normalized_result/summary/module_count",
+                "role": "count",
+                "expect": {
+                  "equals": 42
+                }
+              }
+            ]
+          }
+        ],
+        "procedure": "No inventory node has extension .node in the complete inventory."
+      },
+      "inference": null,
+      "unavailable_reason": null,
+      "user_statement": null,
+      "polarity": "absence",
+      "basis": "static",
+      "claim_id": "clm_no-native-addon",
+      "statement": "app.asar contains no native addon (.node) file.",
+      "state": "derived",
+      "question_ids": [
+        "q_discount-rule"
+      ],
+      "build_id": "bld_app-asar",
+      "context": {
+        "question": "Does the packaged application load native code?",
+        "bounds": "Files inventoried in app.asar; does not cover files outside the archive"
+      },
+      "coverage": {
+        "status": "complete",
+        "scope": "Complete ASAR file inventory",
+        "evidence": [
+          {
+            "kind": "canonical",
+            "file": "evidence/records/1111111111111111-inspect-analysis-view.json",
+            "sha256": "3333333333333333333333333333333333333333333333333333333333333333",
+            "evidence_id": "ev_4444444444444444444444444444444444444444444444444444444444444444",
+            "selectors": [
+              {
+                "type": "json-pointer",
+                "pointer": "/normalized_result/coverage/source_complete",
+                "role": "coverage",
+                "expect": {
+                  "equals": true
+                }
+              }
+            ]
+          }
+        ]
+      }
+    },
+    {
+      "comparison_build_ids": [],
+      "evidence": [
+        {
+          "kind": "canonical",
+          "file": "evidence/records/0123456789abcdef-analyze-javascript-application.json",
+          "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+          "evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222",
+          "selectors": [
+            {
+              "type": "json-pointer",
+              "pointer": "/normalized_result/summary/module_count",
+              "role": "count",
+              "expect": {
+                "equals": 42
+              }
+            }
+          ]
+        }
+      ],
+      "locations": [],
+      "limitations": [
+        "Inferred from names, not from observed behavior"
+      ],
+      "contradicts": [],
+      "derivation": null,
+      "inference": {
+        "rationale": "Exported function names mention membership tiers.",
+        "uncertainty": "Names may not reflect behavior."
+      },
+      "unavailable_reason": null,
+      "user_statement": null,
+      "polarity": "presence",
+      "basis": "static",
+      "claim_id": "clm_discount-purpose",
+      "statement": "The discount module most likely applies membership pricing.",
+      "state": "inferred",
+      "question_ids": [
+        "q_discount-rule"
+      ],
+      "build_id": "bld_app-asar",
+      "context": {
+        "question": "What does the discount module do?",
+        "bounds": "Names of exported functions in the module"
+      },
+      "coverage": {
+        "status": "partial",
+        "scope": "Export names only; function bodies not examined",
+        "evidence": []
+      }
+    },
+    {
+      "comparison_build_ids": [],
+      "evidence": [],
+      "locations": [],
+      "limitations": [],
+      "contradicts": [],
+      "derivation": null,
+      "inference": null,
+      "unavailable_reason": null,
+      "user_statement": null,
+      "polarity": "presence",
+      "basis": "static",
+      "claim_id": "clm_pricing-unknown",
+      "statement": "Whether the client contacts a remote pricing service is unknown.",
+      "state": "unknown",
+      "question_ids": [
+        "q_server-pricing"
+      ],
+      "build_id": "bld_app-asar",
+      "context": {
+        "question": "Does the client contact a pricing service?",
+        "bounds": "Static evidence only"
+      },
+      "coverage": {
+        "status": "unknown",
+        "scope": "No runtime or network evidence",
+        "evidence": []
+      }
+    },
+    {
+      "comparison_build_ids": [],
+      "evidence": [
+        {
+          "kind": "external",
+          "file": "evidence/external/2222222222222222-screenshot.png",
+          "sha256": "5555555555555555555555555555555555555555555555555555555555555555",
+          "ext_id": "ext_5555555555555555555555555555555555555555555555555555555555555555",
+          "selectors": [
+            {
+              "type": "image-region",
+              "x": 10,
+              "y": 20,
+              "width": 200,
+              "height": 40
+            }
+          ]
+        }
+      ],
+      "locations": [],
+      "limitations": [
+        "Provenance partial"
+      ],
+      "contradicts": [],
+      "derivation": {
+        "input_claim_ids": [],
+        "input_evidence": [
+          {
+            "kind": "external",
+            "file": "evidence/external/2222222222222222-screenshot.png",
+            "sha256": "5555555555555555555555555555555555555555555555555555555555555555",
+            "ext_id": "ext_5555555555555555555555555555555555555555555555555555555555555555",
+            "selectors": [
+              {
+                "type": "image-region",
+                "x": 10,
+                "y": 20,
+                "width": 200,
+                "height": 40
+              }
+            ]
+          }
+        ],
+        "procedure": "Read the total from the highlighted screenshot region."
+      },
+      "inference": null,
+      "unavailable_reason": null,
+      "user_statement": null,
+      "polarity": "presence",
+      "basis": "external",
+      "claim_id": "clm_screenshot-total",
+      "statement": "The checkout screen displayed a total of 1350 in the captured scenario.",
+      "state": "derived",
+      "question_ids": [
+        "q_discount-rule"
+      ],
+      "build_id": "bld_app-asar",
+      "context": {
+        "question": "What does checkout display?",
+        "bounds": "One user-supplied screenshot"
+      },
+      "coverage": {
+        "status": "partial",
+        "scope": "One screenshot",
+        "evidence": []
+      }
+    }
+  ]
+}

package/skills/full-reverse/schemas/examples/evidence-index.example.json

@@ -0,0 +1,254 @@
+{
+  "schema_version": "full-reverse.evidence-index/1",
+  "investigation_id": "inv_20260115-example",
+  "updated_at": "2026-01-15T10:00:00Z",
+  "entries": [
+    {
+      "entry_id": "ei_1111111111111111",
+      "kind": "canonical-record",
+      "file": "evidence/records/0123456789abcdef-analyze-javascript-application.json",
+      "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+      "bytes": 1000,
+      "status": "complete",
+      "content_type": "rea-record",
+      "producer": {
+        "name": "rea",
+        "version": "6.4.0",
+        "provider": {
+          "id": "rea-javascript-application",
+          "name": "REA JavaScript application analyzer",
+          "version": "1"
+        }
+      },
+      "operation": "analyze_javascript_application",
+      "predicate_type": "rea.javascript-application-analysis",
+      "records": [
+        {
+          "evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222",
+          "pointer": "",
+          "operation": "analyze_javascript_application",
+          "predicate_type": "rea.javascript-application-analysis",
+          "confidence": "derived",
+          "authority": "shipped-artifact",
+          "binding_digests": [
+            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+          ],
+          "parent_evidence_id": null
+        }
+      ],
+      "records_truncated": false,
+      "id_authentication": {
+        "status": "verified",
+        "reason": null
+      },
+      "invocation": {
+        "source": "cli",
+        "command": [
+          "rea",
+          "analyze-javascript-application",
+          "/apps/Example/resources/app.asar",
+          "--json"
+        ],
+        "exit_code": 0,
+        "stderr_file": null,
+        "stderr_sha256": null,
+        "step_id": "step_inspect-js-1"
+      },
+      "target": {
+        "association": "intrinsic",
+        "build_id": "bld_app-asar",
+        "binding_source": "subject",
+        "binding_digests": [
+          "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        ],
+        "identity_state": null
+      },
+      "external": null,
+      "published_at": "2026-01-15T10:00:00Z",
+      "note": ""
+    },
+    {
+      "entry_id": "ei_3333333333333333",
+      "kind": "derived-view",
+      "file": "evidence/records/1111111111111111-inspect-analysis-view.json",
+      "sha256": "3333333333333333333333333333333333333333333333333333333333333333",
+      "bytes": 1000,
+      "status": "complete",
+      "content_type": "rea-record",
+      "producer": {
+        "name": "rea",
+        "version": "6.4.0",
+        "provider": {
+          "id": "rea-javascript-application",
+          "name": "REA JavaScript application analyzer",
+          "version": "1"
+        }
+      },
+      "operation": "inspect_analysis_view",
+      "predicate_type": "rea.analysis-view",
+      "records": [
+        {
+          "evidence_id": "ev_4444444444444444444444444444444444444444444444444444444444444444",
+          "pointer": "",
+          "operation": "inspect_analysis_view",
+          "predicate_type": "rea.analysis-view",
+          "confidence": "derived",
+          "authority": "shipped-artifact",
+          "binding_digests": [
+            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+          ],
+          "parent_evidence_id": "ev_2222222222222222222222222222222222222222222222222222222222222222"
+        }
+      ],
+      "records_truncated": false,
+      "id_authentication": {
+        "status": "verified",
+        "reason": null
+      },
+      "invocation": {
+        "source": "cli",
+        "command": [
+          "rea",
+          "analyze-javascript-application",
+          "/apps/Example/resources/app.asar",
+          "--json"
+        ],
+        "exit_code": 0,
+        "stderr_file": null,
+        "stderr_sha256": null,
+        "step_id": "step_inspect-js-1"
+      },
+      "target": {
+        "association": "intrinsic",
+        "build_id": "bld_app-asar",
+        "binding_source": "subject",
+        "binding_digests": [
+          "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        ],
+        "identity_state": null
+      },
+      "external": null,
+      "published_at": "2026-01-15T10:00:00Z",
+      "note": ""
+    },
+    {
+      "entry_id": "ei_5555555555555555",
+      "kind": "external",
+      "file": "evidence/external/2222222222222222-screenshot.png",
+      "sha256": "5555555555555555555555555555555555555555555555555555555555555555",
+      "bytes": 1000,
+      "status": "complete",
+      "content_type": "binary",
+      "producer": {
+        "name": null,
+        "version": null,
+        "provider": null
+      },
+      "operation": null,
+      "predicate_type": null,
+      "records": [],
+      "records_truncated": false,
+      "id_authentication": {
+        "status": "not-applicable",
+        "reason": null
+      },
+      "invocation": {
+        "source": "external",
+        "command": null,
+        "exit_code": null,
+        "stderr_file": null,
+        "stderr_sha256": null,
+        "step_id": null
+      },
+      "target": {
+        "association": "declared",
+        "build_id": "bld_app-asar",
+        "binding_source": "none",
+        "binding_digests": [],
+        "identity_state": null
+      },
+      "external": {
+        "ext_id": "ext_5555555555555555555555555555555555555555555555555555555555555555",
+        "file": {
+          "path": "evidence/external/2222222222222222-screenshot.png",
+          "sha256": "5555555555555555555555555555555555555555555555555555555555555555",
+          "bytes": 48211
+        },
+        "media_type": "image/png",
+        "observation_kind": "screenshot",
+        "description": "User-supplied screenshot of the checkout screen.",
+        "acquisition": {
+          "provenance_status": "partial",
+          "method": "user screenshot",
+          "tool": null,
+          "acquired_by": "user",
+          "acquired_at": null,
+          "scenario_id": null
+        },
+        "sensitivity": {
+          "classification": "internal",
+          "contains_secrets_or_personal_data": "no",
+          "sharing": "Keep inside the investigation workspace"
+        },
+        "target_association": {
+          "status": "declared",
+          "build_id": "bld_app-asar",
+          "rationale": "User stated it shows version 1.4.2"
+        },
+        "limitations": [
+          "Capture time unknown"
+        ],
+        "registered_at": "2026-01-15T10:00:00Z"
+      },
+      "published_at": "2026-01-15T10:00:00Z",
+      "note": ""
+    },
+    {
+      "entry_id": "ei_3333333333333333",
+      "kind": "diagnostic",
+      "file": "evidence/diagnostics/3333333333333333-diagnostic.json",
+      "sha256": "3333333333333333000000000000000000000000000000000000000000000000",
+      "bytes": 1000,
+      "status": "error",
+      "content_type": "rea-error",
+      "producer": {
+        "name": "rea",
+        "version": "6.4.0",
+        "provider": null
+      },
+      "operation": null,
+      "predicate_type": null,
+      "records": [],
+      "records_truncated": false,
+      "id_authentication": {
+        "status": "not-applicable",
+        "reason": null
+      },
+      "invocation": {
+        "source": "cli",
+        "command": [
+          "rea",
+          "analyze",
+          "/apps/Example/native.exe",
+          "--provider",
+          "ghidra",
+          "--json"
+        ],
+        "exit_code": 1,
+        "stderr_file": null,
+        "stderr_sha256": null,
+        "step_id": null
+      },
+      "target": {
+        "association": "unbound",
+        "build_id": null,
+        "binding_source": "none",
+        "binding_digests": [],
+        "identity_state": null
+      },
+      "external": null,
+      "published_at": "2026-01-15T10:00:00Z",
+      "note": "Provider unavailable; not evidence of absence."
+    }
+  ]
+}

package/skills/full-reverse/schemas/examples/external-evidence.example.json

@@ -0,0 +1,33 @@
+{
+  "ext_id": "ext_5555555555555555555555555555555555555555555555555555555555555555",
+  "file": {
+    "path": "evidence/external/2222222222222222-screenshot.png",
+    "sha256": "5555555555555555555555555555555555555555555555555555555555555555",
+    "bytes": 48211
+  },
+  "media_type": "image/png",
+  "observation_kind": "screenshot",
+  "description": "User-supplied screenshot of the checkout screen.",
+  "acquisition": {
+    "provenance_status": "partial",
+    "method": "user screenshot",
+    "tool": null,
+    "acquired_by": "user",
+    "acquired_at": null,
+    "scenario_id": null
+  },
+  "sensitivity": {
+    "classification": "internal",
+    "contains_secrets_or_personal_data": "no",
+    "sharing": "Keep inside the investigation workspace"
+  },
+  "target_association": {
+    "status": "declared",
+    "build_id": "bld_app-asar",
+    "rationale": "User stated it shows version 1.4.2"
+  },
+  "limitations": [
+    "Capture time unknown"
+  ],
+  "registered_at": "2026-01-15T10:00:00Z"
+}