rea-agents 1.2.0 → 1.4.0

package/dist/domain/investigationWorkspace.js

@@ -0,0 +1,341 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { evidenceBundleSchema, parseEvidenceBundle, } from "./evidenceBundle.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const artifactFormatSchema = evidenceBundleSchema.shape.artifacts.element.shape.format;
+/** Bounded controls for one automatic, provider-neutral artifact comparison. */
+const investigationRunOptionsSchema = z.object({
+    max_entries: z.number().int().min(1).max(50_000).default(10_000),
+    max_total_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(Number.MAX_SAFE_INTEGER)
+        .default(1_073_741_824),
+    max_entry_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(Number.MAX_SAFE_INTEGER)
+        .default(268_435_456),
+    max_compression_ratio: z.number().min(1).max(100_000).default(1_000),
+    max_depth: z.number().int().min(0).max(100).default(20),
+    max_path_bytes: z.number().int().min(1).max(65_535).default(4_096),
+    page_size: z.number().int().min(1).max(500).default(500),
+    change_limit: z.number().int().min(1).max(500).default(500),
+});
+const DEFAULT_INVESTIGATION_RUN_OPTIONS = {
+    max_entries: 10_000,
+    max_total_bytes: 1_073_741_824,
+    max_entry_bytes: 268_435_456,
+    max_compression_ratio: 1_000,
+    max_depth: 20,
+    max_path_bytes: 4_096,
+    page_size: 500,
+    change_limit: 500,
+};
+/** Explicit write approval and two local versions for an automatic run. */
+export const crossVersionInvestigationInputSchema = z
+    .object({
+    approved: z.literal(true),
+    workspace_path: z.string().min(1).max(4_096),
+    workspace_name: z.string().trim().min(1).max(200).default("default"),
+    expected_workspace_revision: z.number().int().min(1).optional(),
+    left_path: z.string().min(1).max(4_096),
+    right_path: z.string().min(1).max(4_096),
+    integrity_policy: z.enum(["fail", "record-and-continue"]).default("fail"),
+    integrity_continue_approved: z.boolean().default(false),
+    max_integrity_mismatches: z.number().int().min(1).max(100).default(10),
+    options: investigationRunOptionsSchema.default(DEFAULT_INVESTIGATION_RUN_OPTIONS),
+})
+    .superRefine((input, context) => {
+    if (input.integrity_policy === "record-and-continue" &&
+        input.integrity_continue_approved !== true)
+        context.addIssue({
+            code: "custom",
+            path: ["integrity_continue_approved"],
+            message: "record-and-continue requires explicit approval",
+        });
+});
+const targetSchema = z.object({
+    root_sha256: digestSchema,
+    graph_sha256: digestSchema,
+    manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
+    format: artifactFormatSchema,
+});
+const stageSchema = z.enum([
+    "inventory_left",
+    "inventory_right",
+    "compare_artifacts",
+    "find_changed_behavior",
+]);
+const investigationRunBaseSchema = z.object({
+    schema_version: z.literal(1),
+    run_id: z.string().regex(/^run_[a-f0-9]{64}$/u),
+    request_sha256: digestSchema,
+    left: targetSchema,
+    right: targetSchema,
+    options: investigationRunOptionsSchema,
+    integrity_policy: z.enum(["fail", "record-and-continue"]),
+    integrity_continue_approved: z.boolean(),
+    max_integrity_mismatches: z.number().int().min(1).max(100),
+    status: z.enum(["running", "complete"]),
+    completed_stages: z.array(stageSchema).max(4),
+    left_inventory_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    right_inventory_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+    comparison_evidence_id: evidenceIdSchema.nullable(),
+    result_evidence_id: evidenceIdSchema.nullable(),
+    limitations: z.array(z.string().max(4_096)).max(100),
+});
+export const investigationRunSchema = z
+    .union([
+    investigationRunBaseSchema.extend({
+        legacy_request_identity: z.literal(true),
+    }),
+    investigationRunBaseSchema,
+])
+    .superRefine((run, context) => {
+    if (!("legacy_request_identity" in run))
+        return;
+    const legacyIdentity = createLegacyInvestigationRunIdentity(run);
+    if (run.integrity_policy !== "fail" ||
+        run.integrity_continue_approved ||
+        run.max_integrity_mismatches !== 10 ||
+        run.run_id !== legacyIdentity.runId ||
+        run.request_sha256 !== legacyIdentity.requestSha256)
+        context.addIssue({
+            code: "custom",
+            path: ["legacy_request_identity"],
+            message: "Legacy request identity is valid only for migrated strict runs",
+        });
+});
+export const investigationRunSummarySchema = z.object({
+    schema_version: z.literal(1),
+    workspace_id: z.string().regex(/^ws_[a-f0-9]{64}$/u),
+    run_id: z.string().regex(/^run_[a-f0-9]{64}$/u),
+    left_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
+    right_manifest_id: z.string().regex(/^agm_[a-f0-9]{64}$/u),
+    inventory_evidence_count: z.number().int().min(2).max(200),
+    comparison_evidence_id: evidenceIdSchema,
+    limitations: z.array(z.string().max(4_096)).max(100),
+});
+const investigationWorkspaceSchema = z.object({
+    workspace_version: z.literal(1),
+    workspace_id: z.string().regex(/^ws_[a-f0-9]{64}$/u),
+    name: z.string().trim().min(1).max(200),
+    revision: z.number().int().min(1),
+    previous_revision_digest: z
+        .string()
+        .regex(/^wrev_[a-f0-9]{64}$/u)
+        .nullable(),
+    revision_digest: z.string().regex(/^wrev_[a-f0-9]{64}$/u),
+    bundle: evidenceBundleSchema,
+    runs: z.array(investigationRunSchema).max(1_000),
+});
+const legacyInvestigationRunSchema = investigationRunBaseSchema
+    .omit({
+    integrity_policy: true,
+    integrity_continue_approved: true,
+    max_integrity_mismatches: true,
+})
+    .strict();
+const legacyInvestigationWorkspaceSchema = investigationWorkspaceSchema
+    .extend({
+    runs: z.array(legacyInvestigationRunSchema).max(1_000),
+})
+    .strict();
+/** Derive a stable run identity from content commitments and bounded controls. */
+export const createInvestigationRunIdentity = (input) => {
+    const requestSha256 = digestCanonical({
+        schema: "rea.cross-version-investigation-request/v1",
+        left: input.left,
+        right: input.right,
+        options: input.options,
+        integrity: {
+            policy: input.integrity_policy,
+            approved: input.integrity_continue_approved,
+            max_mismatches: input.max_integrity_mismatches,
+        },
+    });
+    return { runId: `run_${requestSha256}`, requestSha256 };
+};
+/** Build the first canonical workspace revision. */
+export const createInvestigationWorkspace = (name, bundle, runs) => buildWorkspace({
+    workspaceId: `ws_${digestCanonical({ schema: "rea.workspace/v1", name })}`,
+    name,
+    revision: 1,
+    previousRevisionDigest: null,
+    bundle,
+    runs,
+});
+/** Create the next immutable workspace revision. */
+export const reviseInvestigationWorkspace = (current, bundle, runs) => buildWorkspace({
+    workspaceId: current.workspace_id,
+    name: current.name,
+    revision: current.revision + 1,
+    previousRevisionDigest: current.revision_digest,
+    bundle,
+    runs,
+});
+/** Parse a workspace and verify identities, revision digest, and references. */
+export const parseInvestigationWorkspace = (input) => {
+    if (isLegacyWorkspace(input))
+        return migrateLegacyWorkspace(input);
+    const parsed = investigationWorkspaceSchema.parse(input);
+    const bundle = parseEvidenceBundle(parsed.bundle);
+    const canonical = buildWorkspace({
+        workspaceId: parsed.workspace_id,
+        name: parsed.name,
+        revision: parsed.revision,
+        previousRevisionDigest: parsed.previous_revision_digest,
+        bundle,
+        runs: parsed.runs,
+    });
+    if (parsed.workspace_id !== workspaceIdFor(parsed.name))
+        throw new TypeError("Investigation workspace ID does not match its name");
+    if (parsed.revision_digest !== canonical.revision_digest)
+        throw new TypeError("Investigation workspace revision digest is invalid");
+    if (JSON.stringify(parsed) !== JSON.stringify(canonical))
+        throw new TypeError("Investigation workspace is not canonical");
+    validateRunReferences(canonical);
+    return canonical;
+};
+/** Encode a validated workspace as byte-stable canonical JSON. */
+export const serializeInvestigationWorkspace = (workspace) => canonicalJson(parseInvestigationWorkspace(workspace));
+const buildWorkspace = (input) => {
+    const runs = [...input.runs]
+        .map((run) => investigationRunSchema.parse(run))
+        .sort((left, right) => left.run_id.localeCompare(right.run_id));
+    assertUnique(runs.map(({ run_id: id }) => id), "investigation run ID");
+    const semantic = {
+        workspace_version: 1,
+        workspace_id: input.workspaceId,
+        name: input.name,
+        revision: input.revision,
+        previous_revision_digest: input.previousRevisionDigest,
+        bundle: parseEvidenceBundle(input.bundle),
+        runs,
+    };
+    return investigationWorkspaceSchema.parse({
+        ...semantic,
+        revision_digest: `wrev_${digestCanonical(semantic)}`,
+    });
+};
+const validateRunReferences = (workspace) => {
+    const evidenceIds = new Set(workspace.bundle.records.map(({ evidence_id: id }) => id));
+    for (const run of workspace.runs) {
+        const expectedIdentity = createInvestigationRunIdentity(run);
+        const legacyIdentity = createLegacyInvestigationRunIdentity(run);
+        if ((run.run_id !== expectedIdentity.runId ||
+            run.request_sha256 !== expectedIdentity.requestSha256) &&
+            (!("legacy_request_identity" in run) ||
+                run.integrity_policy !== "fail" ||
+                run.integrity_continue_approved ||
+                run.max_integrity_mismatches !== 10 ||
+                run.run_id !== legacyIdentity.runId ||
+                run.request_sha256 !== legacyIdentity.requestSha256))
+            throw new TypeError("Investigation run identity is invalid");
+        validateRunStages(run);
+        const references = [
+            ...run.left_inventory_evidence_ids,
+            ...run.right_inventory_evidence_ids,
+            ...(run.comparison_evidence_id === null
+                ? []
+                : [run.comparison_evidence_id]),
+            ...(run.result_evidence_id === null ? [] : [run.result_evidence_id]),
+        ];
+        if (references.some((evidenceId) => !evidenceIds.has(evidenceId)))
+            throw new TypeError("Investigation run references missing Evidence");
+    }
+};
+/** Derive the pre-integrity-policy run identity for strict workspace migration. */
+export const createLegacyInvestigationRunIdentity = (input) => {
+    const requestSha256 = digestCanonical({
+        schema: "rea.cross-version-investigation-request/v1",
+        left: input.left,
+        right: input.right,
+        options: input.options,
+    });
+    return { runId: `run_${requestSha256}`, requestSha256 };
+};
+const isLegacyWorkspace = (input) => {
+    if (typeof input !== "object" || input === null || !("runs" in input))
+        return false;
+    const runs = input.runs;
+    return (Array.isArray(runs) &&
+        runs.some((run) => typeof run === "object" && run !== null && !("integrity_policy" in run)));
+};
+const migrateLegacyWorkspace = (input) => {
+    const parsed = legacyInvestigationWorkspaceSchema.parse(input);
+    const bundle = parseEvidenceBundle(parsed.bundle);
+    const runs = [...parsed.runs].sort((left, right) => left.run_id.localeCompare(right.run_id));
+    const semantic = {
+        workspace_version: 1,
+        workspace_id: parsed.workspace_id,
+        name: parsed.name,
+        revision: parsed.revision,
+        previous_revision_digest: parsed.previous_revision_digest,
+        bundle,
+        runs,
+    };
+    if (parsed.workspace_id !== workspaceIdFor(parsed.name))
+        throw new TypeError("Investigation workspace ID does not match its name");
+    if (parsed.revision_digest !== `wrev_${digestCanonical(semantic)}`)
+        throw new TypeError("Investigation workspace revision digest is invalid");
+    const canonical = legacyInvestigationWorkspaceSchema.parse({
+        ...semantic,
+        revision_digest: parsed.revision_digest,
+    });
+    if (JSON.stringify(parsed) !== JSON.stringify(canonical))
+        throw new TypeError("Investigation workspace is not canonical");
+    for (const run of runs) {
+        const identity = createLegacyInvestigationRunIdentity(run);
+        if (run.run_id !== identity.runId ||
+            run.request_sha256 !== identity.requestSha256)
+            throw new TypeError("Investigation run identity is invalid");
+    }
+    const migrated = buildWorkspace({
+        workspaceId: parsed.workspace_id,
+        name: parsed.name,
+        revision: parsed.revision,
+        previousRevisionDigest: parsed.previous_revision_digest,
+        bundle,
+        runs: runs.map((run) => ({
+            ...run,
+            legacy_request_identity: true,
+            integrity_policy: "fail",
+            integrity_continue_approved: false,
+            max_integrity_mismatches: 10,
+        })),
+    });
+    validateRunReferences(migrated);
+    return migrated;
+};
+const validateRunStages = (run) => {
+    const expected = [
+        "inventory_left",
+        "inventory_right",
+        ...(run.comparison_evidence_id === null ? [] : ["compare_artifacts"]),
+        ...(run.result_evidence_id === null ? [] : ["find_changed_behavior"]),
+    ];
+    if (JSON.stringify(run.completed_stages) !== JSON.stringify(expected))
+        throw new TypeError("Investigation run stages are inconsistent");
+    if (run.status === "complete" && run.result_evidence_id === null)
+        throw new TypeError("Completed investigation run has no result Evidence");
+    if (run.status === "running" && run.result_evidence_id !== null)
+        throw new TypeError("Running investigation run has final result Evidence");
+};
+const workspaceIdFor = (name) => `ws_${digestCanonical({ schema: "rea.workspace/v1", name })}`;
+const digestCanonical = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
+const canonicalJson = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Investigation workspace could not canonicalize data");
+    return encoded;
+};
+const assertUnique = (values, description) => {
+    if (new Set(values).size !== values.length)
+        throw new TypeError(`Duplicate ${description}`);
+};

package/dist/domain/jsonValue.js

@@ -1,3 +1,5 @@
 import { z } from "zod";
 /** JSON-safe value shared by domain, application, and adapter boundaries. */
 export const jsonValueSchema = z.json();
+/** JSON object boundary for caller-visible parameter maps. */
+export const jsonObjectSchema = z.record(z.string(), jsonValueSchema);

package/dist/domain/nativeInspection.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { jsonValueSchema } from "./jsonValue.js";
 const hexAddress = z.string().regex(/^0x[a-fA-F0-9]+$/u);
 const coverage = (item) => z.object({
     items: z.array(item),
@@ -106,7 +107,7 @@ export const inspectSignatureSchema = z.object({
     hash_algorithms: z.array(z.string()),
     authorities: z.array(z.string()),
     designated_requirement: z.string().nullable(),
-    entitlements: z.unknown().nullable(),
+    entitlements: jsonValueSchema.nullable(),
     timestamp: z.string().nullable(),
     hardened_runtime: z.boolean().nullable(),
     provenance: z.array(nativeCommandInvocationSchema),
@@ -114,7 +115,7 @@ export const inspectSignatureSchema = z.object({
 });
 export const inspectPlistSchema = z.object({
     format: z.enum(["xml", "binary", "json", "unknown"]),
-    value: z.unknown(),
+    value: jsonValueSchema,
     bundle: z.object({
         identifier: z.string().nullable(),
         executable: z.string().nullable(),

package/dist/domain/permissionPolicy.js

@@ -0,0 +1,157 @@
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { err, ok } from "./result.js";
+/** A proposed grant exceeds the administrator-owned maximum authority. */
+export class PermissionGrantError extends Error {
+    reason;
+    missing;
+    _tag = "PermissionGrantError";
+    constructor(reason, missing) {
+        super(`Permission grant rejected: ${reason}`);
+        this.reason = reason;
+        this.missing = missing;
+    }
+}
+/** Create a fail-closed policy with no implicit grants. */
+export const createPermissionPolicy = (ceilings, grants = []) => ({
+    ceilings: ceilings.map(normalizeScope),
+    grants: grants.map(normalizeGrant),
+    revoked_grant_ids: new Set(),
+    consumed_grant_ids: new Set(),
+});
+/** Add one grant only when it is a subset of its administrator ceiling. */
+export const grantPermission = (policy, grant) => {
+    const normalized = normalizeGrant(grant);
+    if (normalized.lifetime === "once" && normalized.operation_identity === null)
+        return err(new PermissionGrantError("invalid_once_scope", {}));
+    const missing = missingFromScopes(normalized, policy.ceilings);
+    if (hasMissing(missing))
+        return err(new PermissionGrantError("outside_administrator_ceiling", missing));
+    return ok({ ...policy, grants: [...policy.grants, normalized] });
+};
+/** Evaluate exact requested authority against the ceiling and active grants. */
+export const evaluatePermission = (policy, request, now = new Date()) => {
+    const normalized = normalizeRequest(request);
+    const outsideCeiling = missingFromScopes(normalized, policy.ceilings);
+    if (hasMissing(outsideCeiling))
+        return {
+            allowed: false,
+            reason: "outside_administrator_ceiling",
+            missing: outsideCeiling,
+        };
+    const candidates = policy.grants.filter((grant) => grant.capability === normalized.capability &&
+        !policy.revoked_grant_ids.has(grant.grant_id) &&
+        !policy.consumed_grant_ids.has(grant.grant_id) &&
+        !isExpired(grant, now) &&
+        (grant.lifetime !== "once" ||
+            grant.operation_identity === normalized.operation_identity));
+    const selected = candidates.find((grant) => !hasMissing(missingFromScopes(normalized, [grant])));
+    if (selected !== undefined)
+        return {
+            allowed: true,
+            grant_id: selected.grant_id,
+            lifetime: selected.lifetime,
+        };
+    const coveringGrant = policy.grants.find((grant) => grant.capability === normalized.capability &&
+        (grant.lifetime !== "once" ||
+            grant.operation_identity === normalized.operation_identity) &&
+        !hasMissing(missingFromScopes(normalized, [grant])));
+    return {
+        allowed: false,
+        reason: coveringGrant !== undefined && isExpired(coveringGrant, now)
+            ? "grant_expired"
+            : candidates.length === 0 &&
+                policy.grants.some((grant) => grant.capability === normalized.capability)
+                ? "grant_revoked_or_consumed"
+                : "grant_required",
+        missing: missingFromScopes(normalized, candidates),
+    };
+};
+/** Consume an allowed one-shot decision; longer-lived grants are unchanged. */
+export const consumePermission = (policy, decision) => decision.lifetime === "once"
+    ? {
+        ...policy,
+        consumed_grant_ids: new Set([
+            ...policy.consumed_grant_ids,
+            decision.grant_id,
+        ]),
+    }
+    : policy;
+/** Revoke one grant for every future evaluation. */
+export const revokePermission = (policy, grantId) => ({
+    ...policy,
+    revoked_grant_ids: new Set([...policy.revoked_grant_ids, grantId]),
+});
+/** Drop connection-bound authority when an MCP or CLI session ends. */
+export const clearSessionPermissions = (policy) => ({
+    ...policy,
+    grants: policy.grants.filter(({ lifetime }) => lifetime !== "once" && lifetime !== "session"),
+});
+/** Atomically replace administrator ceilings while retaining auditable grants. */
+export const reloadPermissionCeilings = (policy, ceilings) => ({
+    ...policy,
+    ceilings: ceilings.map(normalizeScope),
+});
+const normalizeScope = (scope) => ({
+    capability: scope.capability,
+    roots: uniqueSorted(scope.roots.map((path) => resolve(path))),
+    executables: uniqueSorted(scope.executables.map((path) => resolve(path))),
+    environment_names: uniqueSorted(scope.environment_names),
+    network: scope.network,
+    mount: scope.mount,
+});
+const normalizeGrant = (grant) => ({
+    ...normalizeScope(grant),
+    grant_id: grant.grant_id,
+    lifetime: grant.lifetime,
+    operation_identity: grant.operation_identity,
+    expires_at: grant.expires_at,
+});
+const normalizeRequest = (request) => ({
+    ...normalizeScope(request),
+    operation_identity: request.operation_identity,
+});
+const missingFromScopes = (request, scopes) => {
+    const relevant = scopes.filter(({ capability }) => capability === request.capability);
+    const roots = request.roots.filter((path) => !relevant.some((scope) => containsAny(scope.roots, path)));
+    const executables = request.executables.filter((path) => !relevant.some((scope) => containsAny(scope.executables, path)));
+    const environmentNames = request.environment_names.filter((name) => !relevant.some((scope) => scope.environment_names.includes(name)));
+    const network = request.network === "none" ||
+        relevant.some((scope) => networkRank(scope.network) >= networkRank(request.network))
+        ? undefined
+        : request.network;
+    const mount = !request.mount || relevant.some((scope) => scope.mount)
+        ? undefined
+        : true;
+    return {
+        ...(roots.length === 0 ? {} : { roots }),
+        ...(executables.length === 0 ? {} : { executables }),
+        ...(environmentNames.length === 0
+            ? {}
+            : { environment_names: environmentNames }),
+        ...(network === undefined ? {} : { network }),
+        ...(mount === undefined ? {} : { mount }),
+    };
+};
+const HOST_PATH_OPERATIONS = { relative, isAbsolute, sep };
+/** Test whether a candidate is inside a root using one platform path flavor. */
+export const isPathContained = (root, candidate, operations = HOST_PATH_OPERATIONS) => {
+    const relation = operations.relative(root, candidate);
+    return (relation === "" ||
+        (relation !== ".." &&
+            !relation.startsWith(`..${operations.sep}`) &&
+            !operations.isAbsolute(relation)));
+};
+const containsAny = (roots, candidate) => roots.some((root) => isPathContained(root, candidate));
+const networkRank = (network) => {
+    switch (network) {
+        case "none":
+            return 0;
+        case "loopback":
+            return 1;
+        case "external":
+            return 2;
+    }
+};
+const isExpired = (grant, now) => grant.expires_at !== null && Date.parse(grant.expires_at) <= now.getTime();
+const hasMissing = (missing) => Object.keys(missing).length > 0;
+const uniqueSorted = (values) => [...new Set(values)].sort((left, right) => left.localeCompare(right));

package/dist/domain/processCapture.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { jsonValueSchema } from "./jsonValue.js";
 import { LEGACY_PROCESS_CAPTURE_MESSAGE, normalizationSchema, } from "./processScenario.js";
 export * from "./processScenario.js";
 const fileStateSchema = z.object({
@@ -31,10 +32,10 @@ export const processCaptureSchema = z.object({
         pty_backend: z.literal("node-pty"),
         started_at: z.iso.datetime(),
         completed_at: z.iso.datetime(),
-        scenario: z.record(z.string(), z.unknown()),
-        comparison_contract: z.record(z.string(), z.unknown()),
-        shim_plan: z.array(z.unknown()),
-        replay_plan: z.record(z.string(), z.unknown()),
+        scenario: z.record(z.string(), jsonValueSchema),
+        comparison_contract: z.record(z.string(), jsonValueSchema),
+        shim_plan: z.array(jsonValueSchema),
+        replay_plan: z.record(z.string(), jsonValueSchema),
         full_scenario_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
         comparison_contract_sha256: z.string().regex(/^[a-f0-9]{64}$/u),
         executable_sha256: z.string().regex(/^[a-f0-9]{64}$/u),

package/dist/domain/processComparison.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { validateProcessCapture } from "./processCapture.js";
+import { jsonValueSchema } from "./jsonValue.js";
 /** Comparison classification that never equates incomplete evidence. */
 export const comparisonStatusSchema = z.enum([
     "unchanged",
@@ -8,6 +9,7 @@ export const comparisonStatusSchema = z.enum([
     "changed",
     "truncated",
     "unknown",
+    "contradiction",
 ]);
 /** Pure normalized comparison between two captures. */
 export const processCaptureComparisonSchema = z
@@ -37,8 +39,8 @@ export const processCaptureComparisonSchema = z
             index: z.number().int().nonnegative(),
             left_at_ms: z.number().int().nonnegative().nullable(),
             right_at_ms: z.number().int().nonnegative().nullable(),
-            left: z.unknown().nullable(),
-            right: z.unknown().nullable(),
+            left: jsonValueSchema.nullable(),
+            right: jsonValueSchema.nullable(),
         }),
     ]),
     limitations: z.array(z.string()),
@@ -127,8 +129,8 @@ const firstCollectionDivergence = (dimension, left, right) => {
             index,
             left_at_ms: eventTime(leftValue),
             right_at_ms: eventTime(rightValue),
-            left: leftValue,
-            right: rightValue,
+            left: jsonValueSchema.parse(leftValue),
+            right: jsonValueSchema.parse(rightValue),
         };
     }
     return null;

package/dist/domain/reconstructionVerification.js

@@ -261,7 +261,7 @@ const authorityLimitations = (claim, sources, sides) => {
 const classify = (observed, limitations, unknowns) => {
     if (limitations.length > 0)
         return "unknown";
-    if (["changed", "added", "removed"].includes(observed))
+    if (["changed", "added", "removed", "contradiction"].includes(observed))
         return "fail";
     if (observed === "unknown" || observed === "truncated" || unknowns.length > 0)
         return "unknown";

package/dist/domain/reconstructionVerificationSchemas.js

@@ -86,6 +86,7 @@ export const reconstructionClaimResultSchema = z.object({
         "changed",
         "truncated",
         "unknown",
+        "contradiction",
     ]),
     comparison_evidence_id: evidenceIdSchema,
     left_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),

package/dist/domain/staticRuntimeCorrelation.js

@@ -260,7 +260,11 @@ const selectStatic = (evidence, selector) => {
     const status = matches[0].classification;
     return {
         status,
-        conclusion_kind: status === "unknown" ? "unresolved_branch" : "derived_relationship",
+        conclusion_kind: status === "contradiction"
+            ? "contradiction"
+            : status === "unknown"
+                ? "unresolved_branch"
+                : "derived_relationship",
     };
 };
 const parseStatic = (input) => {

package/dist/generatedPackageMetadata.js

@@ -0,0 +1,9 @@
+/** Generated from package.json and package-lock.json; do not edit. */
+export const PACKAGE_METADATA = {
+    name: "rea-agents",
+    version: "1.4.0",
+    serverSdkVersion: "2.0.0-beta.4",
+    clientSdkVersion: "2.0.0-beta.4",
+    coreSdkVersion: "2.0.0-beta.4",
+    skillVersion: "12",
+};