rea-agents 1.0.0 → 1.2.0

package/dist/domain/processComparison.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { validateProcessCapture } from "./processCapture.js";
 /** Comparison classification that never equates incomplete evidence. */
 export const comparisonStatusSchema = z.enum([
     "unchanged",
@@ -13,19 +14,44 @@ export const processCaptureComparisonSchema = z
     .object({
     status: comparisonStatusSchema,
     terminal: comparisonStatusSchema,
+    interaction: comparisonStatusSchema,
     exit: comparisonStatusSchema,
     filesystem: comparisonStatusSchema,
     protocol: comparisonStatusSchema,
     process: comparisonStatusSchema,
+    shim: comparisonStatusSchema,
+    first_divergence: z.discriminatedUnion("status", [
+        z.object({ status: z.literal("none") }),
+        z.object({ status: z.literal("unknown"), reason: z.string() }),
+        z.object({
+            status: z.literal("found"),
+            dimension: z.enum([
+                "terminal",
+                "interaction",
+                "exit",
+                "filesystem",
+                "protocol",
+                "process",
+                "shim",
+            ]),
+            index: z.number().int().nonnegative(),
+            left_at_ms: z.number().int().nonnegative().nullable(),
+            right_at_ms: z.number().int().nonnegative().nullable(),
+            left: z.unknown().nullable(),
+            right: z.unknown().nullable(),
+        }),
+    ]),
     limitations: z.array(z.string()),
 })
     .superRefine((comparison, context) => {
     const dimensions = [
         comparison.terminal,
+        comparison.interaction,
         comparison.exit,
         comparison.filesystem,
         comparison.protocol,
         comparison.process,
+        comparison.shim,
     ];
     const expected = dimensions.includes("truncated")
         ? "truncated"
@@ -41,7 +67,28 @@ export const processCaptureComparisonSchema = z
             path: ["status"],
         });
 });
-const stableFiles = (capture) => JSON.stringify([...capture.files_after].sort((left, right) => left.path.localeCompare(right.path)));
+const terminalObservations = (capture) => [
+    ...capture.frames.map((frame) => ({ kind: "raw", ...frame })),
+    ...capture.rendered_frames.map((frame) => ({
+        kind: "rendered",
+        ...frame,
+    })),
+].sort((left, right) => {
+    const time = left.at_ms - right.at_ms;
+    if (time !== 0)
+        return time;
+    if (left.kind !== right.kind)
+        return left.kind === "raw" ? -1 : 1;
+    return left.sequence - right.sequence;
+});
+const filesystemObservations = (capture) => [
+    ...capture.filesystem_checkpoints,
+    {
+        name: "final",
+        files: capture.files_after,
+        effects: capture.filesystem_effects,
+    },
+];
 const classifyCollection = (left, right) => {
     if (JSON.stringify(left) === JSON.stringify(right))
         return "unchanged";
@@ -57,44 +104,141 @@ const comparisonStatus = (dimensions) => {
         return "changed";
     return dimensions.includes("unknown") ? "unknown" : "unchanged";
 };
-/** Compare bounded captures without equating missing or incompatible evidence. */
-export const compareProcessCaptures = (left, right) => {
-    if (left.truncated || right.truncated) {
+const eventTime = (value) => {
+    if (typeof value === "object" &&
+        value !== null &&
+        "at_ms" in value &&
+        typeof value.at_ms === "number" &&
+        Number.isSafeInteger(value.at_ms) &&
+        value.at_ms >= 0)
+        return value.at_ms;
+    return null;
+};
+const firstCollectionDivergence = (dimension, left, right) => {
+    const length = Math.max(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        const leftValue = left[index] ?? null;
+        const rightValue = right[index] ?? null;
+        if (JSON.stringify(leftValue) === JSON.stringify(rightValue))
+            continue;
         return {
-            status: "truncated",
-            terminal: "truncated",
-            exit: "truncated",
-            filesystem: "truncated",
-            protocol: "truncated",
-            process: "truncated",
-            limitations: ["At least one capture is truncated."],
+            status: "found",
+            dimension,
+            index,
+            left_at_ms: eventTime(leftValue),
+            right_at_ms: eventTime(rightValue),
+            left: leftValue,
+            right: rightValue,
         };
     }
-    const sameNormalization = JSON.stringify(left.normalization) === JSON.stringify(right.normalization);
+    return null;
+};
+const chooseFirstDivergence = (candidates) => {
+    const found = candidates.filter((candidate) => candidate !== null);
+    return (found.sort((left, right) => {
+        const leftTime = Math.min(left.left_at_ms ?? Number.MAX_SAFE_INTEGER, left.right_at_ms ?? Number.MAX_SAFE_INTEGER);
+        const rightTime = Math.min(right.left_at_ms ?? Number.MAX_SAFE_INTEGER, right.right_at_ms ?? Number.MAX_SAFE_INTEGER);
+        return leftTime - rightTime;
+    })[0] ?? { status: "none" });
+};
+const assertComparable = (left, right, options) => {
+    const invalid = [
+        ...validateProcessCapture(left),
+        ...validateProcessCapture(right),
+    ];
+    if (invalid.length > 0)
+        throw new TypeError(`Invalid Process Capture v4: ${invalid[0].path}`);
+    if (left.schema_version !== right.schema_version ||
+        left.manifest.comparison_contract_sha256 !==
+            right.manifest.comparison_contract_sha256)
+        throw new TypeError("Process captures have incompatible comparison contracts");
+    if (options.maxCaptureAgeMs === undefined)
+        return;
+    const maxCaptureAgeMs = options.maxCaptureAgeMs;
+    const now = (options.now ?? Date.now)();
+    if ([left, right].some(({ manifest }) => now - Date.parse(manifest.completed_at) > maxCaptureAgeMs))
+        throw new TypeError("Process capture exceeds max_capture_age_ms");
+};
+const truncatedComparison = () => ({
+    status: "truncated",
+    terminal: "truncated",
+    interaction: "truncated",
+    exit: "truncated",
+    filesystem: "truncated",
+    protocol: "truncated",
+    process: "truncated",
+    shim: "truncated",
+    first_divergence: {
+        status: "unknown",
+        reason: "At least one capture is truncated.",
+    },
+    limitations: ["At least one capture is truncated."],
+});
+const compareDimensions = (left, right, sameNormalization) => {
     const classify = (scope, leftValues, rightValues) => !sameNormalization || hasUnknown(left, scope) || hasUnknown(right, scope)
         ? "unknown"
         : classifyCollection(leftValues, rightValues);
-    const terminal = classify("terminal", left.frames.map(({ data }) => data), right.frames.map(({ data }) => data));
-    const exit = hasUnknown(left, "exit") || hasUnknown(right, "exit")
-        ? "unknown"
-        : JSON.stringify(left.exit) === JSON.stringify(right.exit)
-            ? "unchanged"
-            : "changed";
-    const filesystem = !hasUnknown(left, "filesystem") &&
-        !hasUnknown(right, "filesystem") &&
-        sameNormalization &&
-        stableFiles(left) === stableFiles(right)
-        ? "unchanged"
-        : classify("filesystem", left.filesystem_effects, right.filesystem_effects);
-    const protocol = classify("protocol", left.protocol_events, right.protocol_events);
-    const process = classify("process", left.process_samples, right.process_samples);
     return {
-        status: comparisonStatus([terminal, exit, filesystem, protocol, process]),
-        terminal,
-        exit,
-        filesystem,
-        protocol,
-        process,
+        terminal: classify("terminal", terminalObservations(left), terminalObservations(right)),
+        interaction: classify("terminal", left.interaction_events, right.interaction_events),
+        exit: hasUnknown(left, "exit") || hasUnknown(right, "exit")
+            ? "unknown"
+            : JSON.stringify({ exit: left.exit, settlement: left.settlement }) ===
+                JSON.stringify({ exit: right.exit, settlement: right.settlement })
+                ? "unchanged"
+                : "changed",
+        filesystem: classify("filesystem", filesystemObservations(left), filesystemObservations(right)),
+        protocol: classify("protocol", left.protocol_events, right.protocol_events),
+        process: classify("process", left.process_samples, right.process_samples),
+        shim: sameNormalization
+            ? classifyCollection(left.shim_events, right.shim_events)
+            : "unknown",
+    };
+};
+/** Compare bounded captures without equating missing or incompatible evidence. */
+/**
+ * Compare two Process Capture v4 observations without treating absence as proof.
+ *
+ * Observed differences outrank residual unknowns. A capture may therefore be
+ * definitively changed in one dimension while completeness remains unknown.
+ */
+export const compareProcessCaptures = (left, right, options = {}) => {
+    assertComparable(left, right, options);
+    if (left.truncated || right.truncated)
+        return truncatedComparison();
+    const sameNormalization = JSON.stringify(left.normalization) === JSON.stringify(right.normalization);
+    const dimensions = compareDimensions(left, right, sameNormalization);
+    const observedFirstDivergence = chooseFirstDivergence([
+        firstCollectionDivergence("terminal", terminalObservations(left), terminalObservations(right)),
+        firstCollectionDivergence("interaction", left.interaction_events, right.interaction_events),
+        firstCollectionDivergence("exit", [{ ...left.exit, settlement: left.settlement }], [{ ...right.exit, settlement: right.settlement }]),
+        firstCollectionDivergence("filesystem", filesystemObservations(left), filesystemObservations(right)),
+        firstCollectionDivergence("protocol", left.protocol_events, right.protocol_events),
+        firstCollectionDivergence("process", left.process_samples, right.process_samples),
+        firstCollectionDivergence("shim", left.shim_events, right.shim_events),
+    ]);
+    const firstDivergence = observedFirstDivergence.status === "found"
+        ? observedFirstDivergence
+        : !sameNormalization ||
+            left.residual_unknowns.length > 0 ||
+            right.residual_unknowns.length > 0
+            ? {
+                status: "unknown",
+                reason: "Residual unknowns prevent proving that no divergence occurred.",
+            }
+            : observedFirstDivergence;
+    return {
+        status: comparisonStatus([
+            dimensions.terminal,
+            dimensions.interaction,
+            dimensions.exit,
+            dimensions.filesystem,
+            dimensions.protocol,
+            dimensions.process,
+            dimensions.shim,
+        ]),
+        ...dimensions,
+        first_divergence: firstDivergence,
         limitations: [
             ...left.limitations,
             ...right.limitations,

package/dist/domain/processScenario.js

@@ -0,0 +1,370 @@
+import { createHash } from "node:crypto";
+import { resolve } from "node:path";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+const positiveBudget = z.number().int().positive();
+const timedEventBase = { at_ms: z.number().int().nonnegative() };
+const environmentName = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/u);
+const reservedEnvironment = new Set([
+    "HOME",
+    "TERM",
+    "REA_PROCESS_RUN_ID",
+    "REA_REPLAY_HTTP_URL",
+    "REA_REPLAY_WEBSOCKET_URL",
+    "REA_SHIM_LEDGER_URL",
+]);
+export const normalizationSchema = z.object({
+    paths: z.boolean(),
+    pids: z.boolean(),
+    ports: z.boolean(),
+    time_bucket_ms: positiveBudget.max(60_000),
+    patterns: z.array(z.object({
+        pattern: z.string().max(500),
+        replacement: z.string().max(100),
+    })),
+});
+const checkpointNameSchema = z
+    .string()
+    .regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/u);
+const commandNameSchema = z
+    .string()
+    .regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u);
+const outputChunkSchema = z.object({
+    at_ms: z.number().int().nonnegative().max(300_000),
+    stream: z.enum(["stdout", "stderr"]),
+    data: z.string().max(1_000_000),
+});
+/** Actionable refusal shared by CLI, MCP, and Evidence import boundaries. */
+export const LEGACY_PROCESS_CAPTURE_MESSAGE = "Process Capture v3 is unsupported. Re-run the scenario with this REA version using capture_process_scenario to produce Process Capture v4; captures cannot be upgraded because v4 requires new manifest and settlement evidence.";
+/** Compute a canonical SHA-256 commitment independent of object key order. */
+export const digestProcessCommitment = (value) => {
+    const serialized = canonicalize(value);
+    if (serialized === undefined)
+        throw new TypeError("Process capture commitment is not canonical JSON");
+    return createHash("sha256").update(serialized).digest("hex");
+};
+/** Build the secret-safe scenario projection committed by Process Capture v4. */
+export const processScenarioCommitment = (scenario, executableSha256) => ({
+    ...scenario,
+    environment: Object.fromEntries(Object.entries(scenario.environment).map(([name, value]) => [
+        name,
+        scenario.secret_aliases.includes(name) ? "<redacted-secret>" : value,
+    ])),
+    unknown_registry_approved: scenario.unknown_registry_approved === true,
+    executable_sha256: executableSha256 ?? null,
+});
+/** Project observation settings shared by authority and reconstruction. */
+export const processComparisonContract = (scenario) => ({
+    working_directory: scenario.working_directory,
+    inherit_environment: scenario.inherit_environment,
+    secret_aliases: scenario.secret_aliases,
+    network_access: scenario.network_access,
+    filesystem_roots: scenario.filesystem_roots,
+    terminal: scenario.terminal,
+    checkpoints: scenario.checkpoints,
+    events: scenario.events,
+    timeout_ms: scenario.timeout_ms,
+    idle_timeout_ms: scenario.idle_timeout_ms,
+    settle_ms: scenario.settle_ms,
+    limits: scenario.limits,
+    normalization: scenario.normalization,
+    command_shims: scenario.command_shims,
+    replay: scenario.replay,
+});
+/**
+ * Boundary schema for one explicitly approved, bounded process experiment.
+ * Defaults are part of the evidence contract and must remain deterministic.
+ */
+export const processScenarioSchema = z
+    .object({
+    approved: z
+        .literal(true)
+        .describe("Explicit per-call acknowledgement that this operation launches the target"),
+    unknown_registry_approved: z
+        .literal(true)
+        .optional()
+        .describe("Explicit approval to record capture residuals durably"),
+    executable: z.string().startsWith("/"),
+    arguments: z.array(z.string()).max(256).default([]),
+    working_directory: z.string().startsWith("/"),
+    environment: z.record(environmentName, z.string()).default({}),
+    inherit_environment: z.array(environmentName).max(64).default([]),
+    secret_aliases: z.array(environmentName).max(64).default([]),
+    network_access: z.literal("host").default("host"),
+    filesystem_roots: z.array(z.string().startsWith("/")).max(16).default([]),
+    terminal: z
+        .object({
+        columns: z.number().int().min(1).max(1_000).default(80),
+        rows: z.number().int().min(1).max(1_000).default(24),
+        scrollback: z.number().int().min(0).max(10_000).default(1_000),
+    })
+        .default({ columns: 80, rows: 24, scrollback: 1_000 }),
+    checkpoints: z
+        .array(z.object({
+        name: checkpointNameSchema,
+        trigger: z.discriminatedUnion("type", [
+            z.object({
+                type: z.literal("time"),
+                at_ms: z.number().int().nonnegative().max(300_000),
+            }),
+            z.object({
+                type: z.literal("terminal_literal"),
+                value: z.string().min(1).max(10_000),
+                occurrence: z.number().int().positive().max(1_000).default(1),
+            }),
+            z.object({ type: z.literal("root_exit") }),
+            z.object({ type: z.literal("settled") }),
+        ]),
+    }))
+        .max(64)
+        .default([]),
+    command_shims: z
+        .array(z.object({
+        name: commandNameSchema,
+        routes: z
+            .array(z.object({
+            arguments: z.array(z.string()).max(256),
+            outputs: z.array(outputChunkSchema).max(1_000).default([]),
+            termination: z.discriminatedUnion("type", [
+                z.object({
+                    type: z.literal("exit"),
+                    code: z.number().int().min(0).max(255),
+                }),
+                z.object({
+                    type: z.literal("signal"),
+                    signal: z.enum(["SIGINT", "SIGTERM", "SIGKILL"]),
+                }),
+            ]),
+            max_calls: z.number().int().positive().max(100).default(1),
+        }))
+            .min(1)
+            .max(100),
+    }))
+        .max(32)
+        .default([]),
+    events: z
+        .array(z.discriminatedUnion("type", [
+        z.object({
+            ...timedEventBase,
+            type: z.literal("input"),
+            data: z.string(),
+            sensitive: z.boolean().default(false),
+        }),
+        z.object({
+            ...timedEventBase,
+            type: z.literal("resize"),
+            columns: z.number().int().min(1).max(1_000),
+            rows: z.number().int().min(1).max(1_000),
+        }),
+        z.object({
+            ...timedEventBase,
+            type: z.literal("signal"),
+            signal: z.enum(["SIGINT", "SIGTERM", "SIGKILL"]),
+        }),
+    ]))
+        .max(1_000)
+        .default([]),
+    timeout_ms: positiveBudget.max(300_000).default(30_000),
+    idle_timeout_ms: positiveBudget.max(300_000).default(30_000),
+    settle_ms: z.number().int().nonnegative().max(10_000).default(100),
+    limits: z
+        .object({
+        output_bytes: positiveBudget.max(10_000_000).default(1_000_000),
+        frames: positiveBudget.max(100_000).default(10_000),
+        files: positiveBudget.max(100_000).default(10_000),
+        file_bytes: positiveBudget.max(100_000_000).default(10_000_000),
+        processes: positiveBudget.max(10_000).default(1_000),
+        protocol_events: positiveBudget.max(100_000).default(10_000),
+        protocol_body_bytes: positiveBudget.max(10_000_000).default(1_000_000),
+        connections: positiveBudget.max(1_000).default(100),
+        filesystem_depth: z.number().int().min(1).max(64).default(16),
+    })
+        .default({
+        output_bytes: 1_000_000,
+        frames: 10_000,
+        files: 10_000,
+        file_bytes: 10_000_000,
+        processes: 1_000,
+        protocol_events: 10_000,
+        protocol_body_bytes: 1_000_000,
+        connections: 100,
+        filesystem_depth: 16,
+    }),
+    normalization: z
+        .object({
+        paths: z.boolean().default(true),
+        pids: z.boolean().default(true),
+        ports: z.boolean().default(true),
+        time_bucket_ms: positiveBudget.max(60_000).default(10),
+        patterns: z
+            .array(z.object({
+            pattern: z.string().max(500),
+            replacement: z.string().max(100),
+        }))
+            .max(32)
+            .default([]),
+    })
+        .default({
+        paths: true,
+        pids: true,
+        ports: true,
+        time_bucket_ms: 10,
+        patterns: [],
+    }),
+    replay: z
+        .object({
+        http: z
+            .array(z.object({
+            method: z.string().max(16),
+            path: z.string().startsWith("/"),
+            status: z.number().int().min(100).max(599),
+            body: z.string().max(1_000_000),
+            request_headers: z.record(z.string(), z.string()).default({}),
+            request_body: z.string().max(1_000_000).optional(),
+            response_headers: z.record(z.string(), z.string()).default({}),
+            delay_ms: z.number().int().nonnegative().max(30_000).default(0),
+            disconnect: z.boolean().default(false),
+            max_calls: z.number().int().min(1).max(100).default(1),
+        }))
+            .max(100)
+            .default([]),
+        websocket_messages: z
+            .array(z.string().max(1_000_000))
+            .max(100)
+            .default([]),
+        websocket_connections: z
+            .array(z.object({
+            messages: z
+                .array(z.object({
+                data: z.string().max(1_000_000),
+                delay_ms: z
+                    .number()
+                    .int()
+                    .nonnegative()
+                    .max(30_000)
+                    .default(0),
+            }))
+                .max(100),
+            disconnect_after: z.boolean().default(false),
+        }))
+            .max(100)
+            .default([]),
+    })
+        .default({
+        http: [],
+        websocket_messages: [],
+        websocket_connections: [],
+    }),
+})
+    .strict()
+    .superRefine((scenario, context) => {
+    for (let index = 1; index < scenario.events.length; index += 1) {
+        if (scenario.events[index].at_ms < scenario.events[index - 1].at_ms) {
+            context.addIssue({
+                code: "custom",
+                message: "events must be ordered by at_ms",
+                path: ["events", index],
+            });
+        }
+    }
+    const secrets = new Set(scenario.secret_aliases);
+    for (const alias of secrets) {
+        if (!(alias in scenario.environment)) {
+            context.addIssue({
+                code: "custom",
+                message: "secret alias has no environment value",
+                path: ["secret_aliases"],
+            });
+        }
+    }
+    const explicit = new Set(Object.keys(scenario.environment));
+    for (const name of [...explicit, ...scenario.inherit_environment]) {
+        if (reservedEnvironment.has(name)) {
+            context.addIssue({
+                code: "custom",
+                message: `${name} is reserved by the process adapter`,
+                path: ["environment", name],
+            });
+        }
+    }
+    for (const name of scenario.inherit_environment) {
+        if (explicit.has(name)) {
+            context.addIssue({
+                code: "custom",
+                message: "an environment name cannot be explicit and inherited",
+                path: ["inherit_environment"],
+            });
+        }
+    }
+    for (const event of scenario.events) {
+        if (event.at_ms > scenario.timeout_ms) {
+            context.addIssue({
+                code: "custom",
+                message: "event occurs after the scenario timeout",
+                path: ["events"],
+            });
+        }
+    }
+    const checkpointNames = scenario.checkpoints.map(({ name }) => name);
+    for (const [index, name] of checkpointNames.entries()) {
+        if (name === "before" || name === "after_settlement")
+            context.addIssue({
+                code: "custom",
+                message: "checkpoint name is reserved by the capture lifecycle",
+                path: ["checkpoints", index, "name"],
+            });
+    }
+    if (new Set(checkpointNames).size !== checkpointNames.length)
+        context.addIssue({
+            code: "custom",
+            message: "checkpoint names must be unique",
+            path: ["checkpoints"],
+        });
+    const shimNames = scenario.command_shims.map(({ name }) => name);
+    if (new Set(shimNames).size !== shimNames.length)
+        context.addIssue({
+            code: "custom",
+            message: "command shim names must be unique",
+            path: ["command_shims"],
+        });
+});
+/** Parse untrusted process scenario input and apply safe default budgets. */
+export const parseProcessScenario = (input) => processScenarioSchema.parse(input);
+const isWithin = (candidate, root) => resolve(candidate) === resolve(root) ||
+    resolve(candidate).startsWith(`${resolve(root)}${resolve(root).endsWith("/") ? "" : "/"}`);
+/** Evaluate scenario authority before any process or filesystem side effect occurs. */
+export const authorizeProcessScenario = (scenario, policy) => {
+    if (!policy.enabled)
+        return { allowed: false, reason: "process capture is disabled" };
+    if (scenario.network_access === "host" && !policy.allowExternalNetwork)
+        return {
+            allowed: false,
+            reason: "host network access is not approved by operator policy",
+        };
+    if (!policy.executableRoots.some((root) => isWithin(scenario.executable, root))) {
+        return { allowed: false, reason: "executable is outside approved roots" };
+    }
+    if (!policy.workingRoots.some((root) => isWithin(scenario.working_directory, root))) {
+        return {
+            allowed: false,
+            reason: "working directory is outside approved roots",
+        };
+    }
+    const requestedNames = [
+        ...Object.keys(scenario.environment),
+        ...scenario.inherit_environment,
+    ];
+    if (requestedNames.some((name) => !policy.allowedEnvironment.includes(name))) {
+        return {
+            allowed: false,
+            reason: "scenario requests an environment variable not allowed by policy",
+        };
+    }
+    if (scenario.filesystem_roots.some((path) => !policy.workingRoots.some((root) => isWithin(path, root)))) {
+        return {
+            allowed: false,
+            reason: "filesystem root is outside approved roots",
+        };
+    }
+    return { allowed: true };
+};

package/dist/domain/reconstructionVerification.js

@@ -18,7 +18,7 @@ const MAX_CANONICAL_BYTES = 32 * 1024 * 1024;
 const providers = {
     behavioral: {
         operation: "compare_process_captures",
-        predicate: "rea.process-comparison/v1",
+        predicate: "rea.process-comparison/v3",
         id: "rea-process",
         name: "REA deterministic process harness",
     },
@@ -137,7 +137,7 @@ const evaluateClaim = (claim, records, heads) => {
 };
 const validateSourceKinds = (claim, sources) => {
     const expected = claim.kind === "behavioral"
-        ? ["capture_process_scenario", "rea.process-capture/v2"]
+        ? ["capture_process_scenario", "rea.process-capture/v4"]
         : claim.kind === "structural-function"
             ? ["analyze_function", "rea.analysis/v2"]
             : ["inventory_artifact", "rea.analysis/v2"];
@@ -160,7 +160,7 @@ const validateComparisonIdentity = (claim, evidence) => {
         evidence.predicate_type !== expected.predicate ||
         evidence.provider.id !== expected.id ||
         evidence.provider.name !== expected.name ||
-        evidence.provider.version !== "1" ||
+        evidence.provider.version !== (claim.kind === "behavioral" ? "3" : "1") ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null)

package/dist/domain/runtimeVersion.js

@@ -0,0 +1,8 @@
+/** Return whether a Node.js version satisfies REA's tested runtime families. */
+export const supportsNodeVersion = (version) => {
+    const [majorText = "", minorText = ""] = version.split(".");
+    const major = Number.parseInt(majorText, 10);
+    const minor = Number.parseInt(minorText, 10);
+    return ((major === 22 && minor >= 19) ||
+        (major >= 24 && (major !== 24 || minor >= 11)));
+};

package/dist/domain/staticRuntimeCorrelation.js

@@ -138,7 +138,7 @@ const EXPECTED = {
         "REA function comparison",
     ],
     compare_process_captures: [
-        "rea.process-comparison/v1",
+        "rea.process-comparison/v3",
         "rea-process",
         "REA deterministic process harness",
     ],
@@ -299,7 +299,8 @@ const assertComparisonIdentity = (evidence) => {
         evidence.predicate_type !== expected[0] ||
         evidence.provider.id !== expected[1] ||
         evidence.provider.name !== expected[2] ||
-        evidence.provider.version !== "1" ||
+        evidence.provider.version !==
+            (evidence.operation === "compare_process_captures" ? "3" : "1") ||
         evidence.confidence !== "derived" ||
         evidence.authority !== "analyst-inference" ||
         evidence.subject !== null ||

package/dist/identity.js

@@ -6,6 +6,7 @@
 export const PRODUCT_IDENTITY = {
     displayName: "REA",
     packageName: "rea-agents",
+    packageVersion: "1.1.0",
     cliBinary: "rea",
     mcpCommand: "npx -y rea-agents mcp",
     mcpServerKey: "rea",