rea-agents 1.3.0 → 1.4.0

package/dist/server/registerEvidenceResources.js

@@ -0,0 +1,302 @@
+import { ResourceNotFoundError, ResourceTemplate, } from "@modelcontextprotocol/server";
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+const evidenceUri = (evidenceId) => `rea://evidence/${evidenceId}`;
+/** Expose immutable session-owned Evidence v2 records as MCP resources. */
+export const registerEvidenceResources = (server, session) => {
+    server.registerResource("investigation-workspace-revision", new ResourceTemplate("rea://workspace/{workspaceId}/revision/{revision}", {
+        list: () => ({
+            resources: session.investigationWorkspaces().map((workspace) => ({
+                uri: workspaceUri(workspace.workspace_id, workspace.revision),
+                name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
+                title: `${workspace.name} revision ${String(workspace.revision)}`,
+                description: "Immutable CAS-linked investigation workspace revision.",
+                mimeType: "application/json",
+            })),
+        }),
+        complete: {
+            workspaceId: (prefix) => [
+                ...new Set(session
+                    .investigationWorkspaces()
+                    .map(({ workspace_id }) => workspace_id)),
+            ].filter((workspaceId) => workspaceId.startsWith(prefix)),
+            revision: (prefix, context) => session
+                .investigationWorkspaces()
+                .filter(({ workspace_id }) => context?.arguments?.workspaceId === workspace_id)
+                .map(({ revision }) => String(revision))
+                .filter((revision) => revision.startsWith(prefix)),
+        },
+    }), {
+        title: "Investigation workspace revision",
+        description: "Immutable session-retained workspace with CAS linkage.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const workspaceId = stringVariable(variables.workspaceId, uri.href);
+        const revisionText = stringVariable(variables.revision, uri.href);
+        if (!/^\d+$/u.test(revisionText))
+            throw new ResourceNotFoundError(uri.href);
+        const workspace = session.investigationWorkspace(workspaceId, Number(revisionText));
+        if (workspace === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        return jsonResource(uri.href, workspace);
+    });
+    server.registerResource("session-evidence", new ResourceTemplate("rea://evidence/{evidenceId}", {
+        list: () => ({
+            resources: session.exportEvidenceBundle().records.map((evidence) => ({
+                uri: evidenceUri(evidence.evidence_id),
+                name: evidence.evidence_id,
+                title: `${evidence.operation} evidence`,
+                description: `Session-owned Evidence v2 record for ${evidence.operation}.`,
+                mimeType: "application/json",
+            })),
+        }),
+        complete: {
+            evidenceId: (prefix) => session
+                .exportEvidenceBundle()
+                .records.map(({ evidence_id }) => evidence_id)
+                .filter((evidenceId) => evidenceId.startsWith(prefix)),
+        },
+    }), {
+        title: "Session evidence",
+        description: "Immutable Evidence v2 records owned by this REA session.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const evidenceId = variables.evidenceId;
+        if (typeof evidenceId !== "string")
+            throw new ResourceNotFoundError(uri.href);
+        const evidence = session.evidenceById(evidenceId);
+        if (evidence === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        return {
+            contents: [
+                {
+                    uri: uri.href,
+                    mimeType: "application/json",
+                    text: JSON.stringify(evidence, null, 2),
+                },
+            ],
+        };
+    });
+    server.registerResource("active-residual-unknowns", "rea://unknowns/active", {
+        title: "Active residual unknowns",
+        description: "Current unresolved session-owned residual unknown heads.",
+        mimeType: "application/json",
+    }, (uri) => jsonResource(uri.href, session.listUnknowns().filter(({ status }) => status !== "resolved")));
+    server.registerResource("analysis-snapshot", new ResourceTemplate("rea://snapshot/{snapshotDigest}", {
+        list: () => {
+            const snapshot = session.exportAnalysisSnapshot();
+            if (!snapshot.ok)
+                return { resources: [] };
+            const digest = contentDigest(snapshot.value);
+            return {
+                resources: [
+                    {
+                        uri: `rea://snapshot/${digest}`,
+                        name: digest,
+                        title: "Current analysis snapshot",
+                        description: "Immutable projection of the current target cache.",
+                        mimeType: "application/json",
+                    },
+                ],
+            };
+        },
+    }), {
+        title: "Analysis snapshot",
+        description: "Current provider-neutral analysis snapshot by content digest.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const requested = stringVariable(variables.snapshotDigest, uri.href);
+        const snapshot = session.exportAnalysisSnapshot();
+        if (!snapshot.ok || contentDigest(snapshot.value) !== requested)
+            throw new ResourceNotFoundError(uri.href);
+        return jsonResource(uri.href, snapshot.value);
+    });
+    server.registerResource("artifact-page", new ResourceTemplate("rea://artifact/{manifestId}/{collection}", {
+        list: undefined,
+        complete: {
+            collection: (prefix) => ["nodes", "occurrences", "edges"].filter((value) => value.startsWith(prefix)),
+        },
+    }), {
+        title: "Artifact graph page",
+        description: "Deterministically paged artifact graph collection.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const manifestId = stringVariable(variables.manifestId, uri.href);
+        const collection = stringVariable(variables.collection, uri.href);
+        if (!ARTIFACT_COLLECTIONS.has(collection))
+            throw new ResourceNotFoundError(uri.href);
+        const evidence = session
+            .exportEvidenceBundle()
+            .records.find((record) => artifactManifestId(record.normalized_result) === manifestId);
+        if (evidence === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        const result = objectValue(evidence.normalized_result);
+        const page = result?.[collection];
+        if (page === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        return jsonResource(uri.href, {
+            evidence_id: evidence.evidence_id,
+            manifest_id: manifestId,
+            collection,
+            page,
+            provider: evidence.provider,
+            limitations: evidence.limitations,
+        });
+    });
+    server.registerResource("function-dossier", new ResourceTemplate("rea://function/{targetSha256}/{address}", {
+        list: undefined,
+    }), {
+        title: "Function dossier",
+        description: "Session-owned analyze_function dossier with provenance.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const targetSha256 = stringVariable(variables.targetSha256, uri.href);
+        const address = stringVariable(variables.address, uri.href);
+        const evidence = session
+            .exportEvidenceBundle()
+            .records.find((record) => record.operation === "analyze_function" &&
+            record.subject?.digest.sha256 === targetSha256 &&
+            functionAddress(record.normalized_result) === address);
+        if (evidence === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        return jsonResource(uri.href, evidence);
+    });
+    server.registerResource("evidence-section", new ResourceTemplate("rea://evidence/{evidenceId}/section/{section}", {
+        list: undefined,
+        complete: {
+            evidenceId: (prefix) => evidenceIds(session, prefix),
+            section: (prefix) => EVIDENCE_SECTIONS.filter((section) => section.startsWith(prefix)),
+        },
+    }), {
+        title: "Evidence section",
+        description: "One independently useful bounded section of session Evidence v2.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const evidenceId = stringVariable(variables.evidenceId, uri.href);
+        const section = stringVariable(variables.section, uri.href);
+        const evidence = session.evidenceById(evidenceId);
+        if (evidence === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        const value = evidenceSection(evidence.normalized_result, section);
+        if (value === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        return jsonResource(uri.href, {
+            evidence_id: evidence.evidence_id,
+            operation: evidence.operation,
+            authority: evidence.authority,
+            confidence: evidence.confidence,
+            provider: evidence.provider,
+            limitations: evidence.limitations,
+            section,
+            value,
+        });
+    });
+    server.registerResource("residual-unknown", new ResourceTemplate("rea://unknown/{unknownId}", {
+        list: () => ({
+            resources: session.listUnknowns().map((unknown) => ({
+                uri: `rea://unknown/${unknown.unknown_id}`,
+                name: unknown.unknown_id,
+                title: unknown.question,
+                description: `Current ${unknown.status} residual unknown revision.`,
+                mimeType: "application/json",
+            })),
+        }),
+        complete: {
+            unknownId: (prefix) => session
+                .listUnknowns()
+                .map(({ unknown_id }) => unknown_id)
+                .filter((unknownId) => unknownId.startsWith(prefix)),
+        },
+    }), {
+        title: "Residual unknown",
+        description: "Current session-owned residual unknown head.",
+        mimeType: "application/json",
+    }, (uri, variables) => {
+        const unknownId = stringVariable(variables.unknownId, uri.href);
+        const unknown = session
+            .listUnknowns()
+            .find(({ unknown_id }) => unknown_id === unknownId);
+        if (unknown === undefined)
+            throw new ResourceNotFoundError(uri.href);
+        const history = session
+            .exportEvidenceBundle()
+            .unknowns.filter(({ unknown_id }) => unknown_id === unknownId);
+        return jsonResource(uri.href, { current: unknown, history });
+    });
+};
+const workspaceUri = (workspaceId, revision) => `rea://workspace/${workspaceId}/revision/${String(revision)}`;
+const EVIDENCE_SECTIONS = [
+    "result",
+    "terminal",
+    "filesystem",
+    "process",
+    "protocol",
+    "nodes",
+    "occurrences",
+    "edges",
+];
+const evidenceIds = (session, prefix) => session
+    .exportEvidenceBundle()
+    .records.map(({ evidence_id }) => evidence_id)
+    .filter((evidenceId) => evidenceId.startsWith(prefix));
+const stringVariable = (value, uri) => {
+    if (typeof value !== "string")
+        throw new ResourceNotFoundError(uri);
+    return value;
+};
+const evidenceSection = (result, section) => {
+    if (section === "result")
+        return result;
+    if (typeof result !== "object" || result === null || Array.isArray(result))
+        return undefined;
+    if (section === "terminal")
+        return pick(result, ["frames", "rendered_frames", "interaction_events"]);
+    if (section === "filesystem")
+        return pick(result, [
+            "filesystem_checkpoints",
+            "filesystem_effects",
+            "files_before",
+            "files_after",
+        ]);
+    if (section === "process")
+        return pick(result, ["process_samples", "exit", "settlement", "cleanup"]);
+    if (section === "protocol")
+        return pick(result, ["protocol_events", "shim_events"]);
+    const value = result[section];
+    return value === undefined ? undefined : value;
+};
+const pick = (result, names) => {
+    const entries = names.flatMap((name) => result[name] === undefined ? [] : [[name, result[name]]]);
+    return entries.length === 0 ? undefined : Object.fromEntries(entries);
+};
+const jsonResource = (uri, value) => ({
+    contents: [
+        {
+            uri,
+            mimeType: "application/json",
+            text: JSON.stringify(value, null, 2),
+        },
+    ],
+});
+const ARTIFACT_COLLECTIONS = new Set(["nodes", "occurrences", "edges"]);
+const objectValue = (value) => typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value
+    : undefined;
+const artifactManifestId = (value) => {
+    const manifest = objectValue(objectValue(value)?.manifest ?? null);
+    return typeof manifest?.manifest_id === "string"
+        ? manifest.manifest_id
+        : undefined;
+};
+const functionAddress = (value) => {
+    const result = objectValue(value);
+    const procedure = objectValue(result?.procedure ?? null);
+    const candidate = procedure?.address ?? result?.address;
+    return typeof candidate === "string" ? candidate : undefined;
+};
+const contentDigest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Resource is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/server/registerEvidenceTools.js

@@ -3,14 +3,44 @@ import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { mcpProgressReporter } from "./mcpProgress.js";
+import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { err } from "../domain/result.js";
 /** Register provider-backed contracts that return atomic Evidence v2 observations. */
 export const registerEvidenceTools = (server, analysis, contracts, options) => {
     for (const contract of contracts) {
         server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+            const progress = mcpProgressReporter(context);
+            await progress.report({
+                phase: contract.name,
+                completed: 0,
+                total: 1,
+                message: "started",
+            });
             const parameters = jsonObjectSchema.parse(contract.inputSchema.parse(input));
+            if (options.permissionAuthority !== undefined) {
+                const request = permissionRequest(contract.name, parameters);
+                if (request !== undefined) {
+                    const authorized = await options.permissionAuthority.authorize(request, contract.name === "extract_artifact" ? "write" : "read");
+                    if (!authorized.ok)
+                        return toCallToolResult(err(authorized.error instanceof PermissionRequiredError
+                            ? authorized.error
+                            : new AnalysisProtocolError(authorized.error.message, {
+                                cause: authorized.error,
+                            })), contract);
+                }
+            }
             const execution = await logToolExecution(options.logger, contract.name, () => analysis.execute(contract.name, parameters, {
                 signal: context.mcpReq.signal,
+                progress,
             }));
+            await progress.report({
+                phase: contract.name,
+                completed: 1,
+                total: 1,
+                message: execution.ok ? "completed" : "failed",
+                terminal: true,
+            });
             if (!execution.ok)
                 return toCallToolResult(execution, contract);
             const evidence = createEvidence(execution.value.subject ?? options.activeTarget?.(), execution.value.provider, {
@@ -24,7 +54,34 @@ export const registerEvidenceTools = (server, analysis, contracts, options) => {
             const recorded = options.recordEvidence?.(evidence);
             return recorded !== undefined && !recorded.ok
                 ? toCallToolResult(recorded, contract)
-                : toCallToolResult({ ok: true, value: evidence }, contract);
+                : toCallToolResult({ ok: true, value: evidence }, contract, {
+                    evidenceResourcesAvailable: recorded !== undefined,
+                });
         });
     }
 };
+const permissionRequest = (operation, parameters) => {
+    if (operation === "extract_artifact" &&
+        typeof parameters.output_root === "string")
+        return {
+            capability: "artifact_extract",
+            roots: [parameters.output_root],
+            executables: [],
+            environment_names: [],
+            network: "none",
+            mount: false,
+            operation_identity: `extract_artifact:${parameters.output_root}`,
+        };
+    if (operation === "inventory_artifact" &&
+        parameters.native_mount_approved === true)
+        return {
+            capability: "native_mount",
+            roots: [],
+            executables: [],
+            environment_names: [],
+            network: "none",
+            mount: true,
+            operation_identity: "inventory_artifact:native_mount",
+        };
+    return undefined;
+};

package/dist/server/registerFunctionComparisonTool.js

@@ -6,9 +6,10 @@ import { toCallToolResult } from "./toolResult.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
 import { resolveSessionEvidence } from "./sessionEvidence.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { runDerivedOperation } from "./runDerivedOperation.js";
 /** Register explicit Evidence-backed function comparison. */
 export const registerFunctionComparisonTool = (server, session, contract) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), (input) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
         const parsed = functionComparisonInputSchema.parse(input);
         const left = resolveSessionEvidence(session, parsed.left);
         if (!left.ok)
@@ -18,7 +19,10 @@ export const registerFunctionComparisonTool = (server, session, contract) => {
             return toCallToolResult(right, contract);
         const leftIds = evidenceIds(left.value);
         const rightIds = evidenceIds(right.value);
-        const comparison = compareFunctions(left.value, right.value, parsed.offset, parsed.limit);
+        const computed = await runDerivedOperation(context, contract.name, () => compareFunctions(left.value, right.value, parsed.offset, parsed.limit));
+        if (!computed.ok)
+            return toCallToolResult(computed, contract);
+        const comparison = computed.value;
         const evidence = createEvidence(undefined, FUNCTION_COMPARISON_PROVIDER, {
             predicateType: "rea.function-comparison/v1",
             operation: contract.name,

package/dist/server/registerInvestigationTools.js

@@ -10,6 +10,9 @@ import { err, ok } from "../domain/result.js";
 import { CALL_PATH_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, RECONSTRUCTION_PROVIDER, STATIC_RUNTIME_PROVIDER, } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
+import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { mcpProgressReporter } from "./mcpProgress.js";
+import { runDerivedOperation } from "./runDerivedOperation.js";
 /** Register Evidence-composed differential investigation workflows. */
 export const registerInvestigationTools = (server, session, contracts, policies) => {
     registerChangedBehavior(server, session, contracts[0], policies);
@@ -17,17 +20,62 @@ export const registerInvestigationTools = (server, session, contracts, policies)
     registerStaticRuntime(server, session, contracts[2]);
     registerReconstruction(server, session, contracts[3]);
 };
-const investigationExecution = (session, signal, inputRoots) => ({ session, signal, inputRoots });
+const investigationExecution = (session, signal, inputRoots, integrityContinueEnabled, progress) => ({
+    session,
+    signal,
+    inputRoots,
+    integrityContinueEnabled,
+    ...(progress === undefined ? {} : { progress }),
+});
 const isIncomplete = (status) => status === "unknown" || status === "truncated";
 const registerChangedBehavior = (server, session, contract, policies) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
         const parsed = changedBehaviorInputSchema.parse(input);
         if (parsed.investigation_run !== undefined) {
-            const investigated = await runCrossVersionInvestigation(parsed.investigation_run, policies.evidenceFiles, investigationExecution(session, context.mcpReq.signal, policies.inputRoots));
+            const progress = mcpProgressReporter(context);
+            if (policies.permissionAuthority !== undefined) {
+                const scopes = [
+                    {
+                        capability: "investigation_workspace_read",
+                        roots: [parsed.investigation_run.workspace_path],
+                    },
+                    {
+                        capability: "investigation_workspace_write",
+                        roots: [parsed.investigation_run.workspace_path],
+                    },
+                    {
+                        capability: "investigation_input",
+                        roots: [
+                            parsed.investigation_run.left_path,
+                            parsed.investigation_run.right_path,
+                        ],
+                    },
+                ];
+                for (const scope of scopes) {
+                    const authorized = await policies.permissionAuthority.authorize({
+                        ...scope,
+                        executables: [],
+                        environment_names: [],
+                        network: "none",
+                        mount: false,
+                        operation_identity: `${contract.name}:${scope.capability}:${scope.roots.join(":")}`,
+                    }, scope.capability === "investigation_input" ? "read" : "write");
+                    if (!authorized.ok)
+                        return toCallToolResult(err(authorized.error instanceof PermissionRequiredError
+                            ? authorized.error
+                            : new AnalysisProtocolError(authorized.error.message, {
+                                cause: authorized.error,
+                            })), contract);
+                }
+            }
+            const investigated = await runCrossVersionInvestigation(parsed.investigation_run, policies.evidenceFiles, investigationExecution(session, context.mcpReq.signal, policies.inputRoots, policies.integrityContinueEnabled?.() ?? false, progress));
             if (!investigated.ok)
                 return toCallToolResult(investigated, contract);
+            const workspace = investigated.value.workspace;
+            if (session.retainInvestigationWorkspace(workspace) === "added")
+                server.sendResourceListChanged();
             const result = changedBehaviorResultSchema.parse(investigated.value.evidence.normalized_result);
-            return toCallToolResult(recordWorkflowEvidence(session, investigated.value.evidence, parsed.unknown_registry_approved, isIncomplete(result.behavior_status), {
+            const toolResult = toCallToolResult(recordWorkflowEvidence(session, investigated.value.evidence, parsed.unknown_registry_approved, isIncomplete(result.behavior_status), {
                 question: `Automatic changed behavior run ${result.investigation_run?.run_id ?? "unknown"} remains ${result.behavior_status}`,
                 domain: "changed-behavior",
                 requiredAuthority: "controlled-replay",
@@ -39,12 +87,28 @@ const registerChangedBehavior = (server, session, contract, policies) => {
                     },
                 ],
             }), contract);
+            return {
+                ...toolResult,
+                content: [
+                    ...toolResult.content,
+                    {
+                        type: "resource_link",
+                        uri: `rea://workspace/${workspace.workspace_id}/revision/${String(workspace.revision)}`,
+                        name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
+                        description: "Immutable CAS-linked investigation workspace revision",
+                        mimeType: "application/json",
+                    },
+                ],
+            };
         }
         const closure = evidenceClosure(session, comparisonClosure(parsed.comparisons));
         if (!closure.ok)
             return toCallToolResult(closure, contract);
         const links = closure.value;
-        const result = findChangedBehavior(parsed.comparisons, parsed.offset, parsed.limit);
+        const computed = await runDerivedOperation(context, contract.name, () => findChangedBehavior(parsed.comparisons, parsed.offset, parsed.limit));
+        if (!computed.ok)
+            return toCallToolResult(computed, contract);
+        const result = computed.value;
         const evidence = createEvidence(undefined, CHANGED_BEHAVIOR_PROVIDER, {
             predicateType: "rea.changed-behavior/v1",
             operation: contract.name,
@@ -75,13 +139,16 @@ const registerChangedBehavior = (server, session, contract, policies) => {
     });
 };
 const registerCallPath = (server, session, contract) => {
-    server.registerTool(contract.name, contractOptions(contract), (input) => {
+    server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
         const parsed = callPathInputSchema.parse(input);
         const closure = evidenceClosure(session, functionEvidenceIds(parsed.functions));
         if (!closure.ok)
             return toCallToolResult(closure, contract);
         const links = closure.value;
-        const result = buildCallPath(parsed);
+        const computed = await runDerivedOperation(context, contract.name, () => buildCallPath(parsed));
+        if (!computed.ok)
+            return toCallToolResult(computed, contract);
+        const result = computed.value;
         const evidence = createEvidence(undefined, CALL_PATH_PROVIDER, {
             predicateType: "rea.call-path/v1",
             operation: contract.name,
@@ -115,7 +182,7 @@ const registerCallPath = (server, session, contract) => {
     });
 };
 const registerStaticRuntime = (server, session, contract) => {
-    server.registerTool(contract.name, contractOptions(contract), (input) => {
+    server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
         const parsed = staticRuntimeCorrelationInputSchema.parse(input);
         const closure = evidenceClosure(session, comparisonClosure([
             ...parsed.static_comparisons,
@@ -124,7 +191,10 @@ const registerStaticRuntime = (server, session, contract) => {
         if (!closure.ok)
             return toCallToolResult(closure, contract);
         const links = closure.value;
-        const result = correlateStaticAndRuntime(parsed);
+        const computed = await runDerivedOperation(context, contract.name, () => correlateStaticAndRuntime(parsed));
+        if (!computed.ok)
+            return toCallToolResult(computed, contract);
+        const result = computed.value;
         const evidence = createEvidence(undefined, STATIC_RUNTIME_PROVIDER, {
             predicateType: "rea.static-runtime-correlation/v1",
             operation: contract.name,
@@ -154,7 +224,7 @@ const registerStaticRuntime = (server, session, contract) => {
     });
 };
 const registerReconstruction = (server, session, contract) => {
-    server.registerTool(contract.name, contractOptions(contract), (input) => {
+    server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
         const parsed = reconstructionVerificationInputSchema.parse(input);
         const owned = session.exportEvidenceBundle();
         const ownedUnknowns = new Set(owned.unknowns.map(({ revision_digest: digest }) => digest));
@@ -162,7 +232,10 @@ const registerReconstruction = (server, session, contract) => {
         if (parsed.evidence_bundle.records.some(({ evidence_id: id }) => !ownedEvidenceIds.has(id)) ||
             parsed.evidence_bundle.unknowns.some(({ revision_digest: digest }) => !ownedUnknowns.has(digest)))
             return toCallToolResult(err(new EvidenceIntegrityError("Reconstruction input unknown history is not present in this session")), contract);
-        const result = verifyReconstruction(parsed.specification, owned, parsed.offset, parsed.limit);
+        const computed = await runDerivedOperation(context, contract.name, () => verifyReconstruction(parsed.specification, owned, parsed.offset, parsed.limit));
+        if (!computed.ok)
+            return toCallToolResult(computed, contract);
+        const result = computed.value;
         const closure = evidenceClosure(session, result.evidence_links);
         if (!closure.ok)
             return toCallToolResult(closure, contract);

package/dist/server/registerOfficialTools.js

@@ -4,6 +4,7 @@ import { toCallToolResult } from "./toolResult.js";
 import { logToolExecution } from "./toolLogging.js";
 import { createEvidence } from "../domain/evidence.js";
 import { AnalysisCapabilityUnavailableError, UnknownRegistryError, } from "../domain/errors.js";
+import { mcpProgressReporter } from "./mcpProgress.js";
 /** Register direct bridge proxies, preserving MCP cancellation and typed errors. */
 export const registerOfficialTools = (server, analysis, options) => {
     for (const contract of OFFICIAL_TOOL_CONTRACTS) {
@@ -23,9 +24,24 @@ const registerOfficialTool = (server, analysis, contract, registration) => {
         annotations: contract.annotations,
     }, async (input, context) => {
         const arguments_ = projectOfficialArguments(contract, input);
+        const progress = mcpProgressReporter(context);
+        await progress.report({
+            phase: contract.name,
+            completed: 0,
+            total: 1,
+            message: "started",
+        });
         const result = await logToolExecution(registration.logger, contract.name, () => analysis.execute(contract.name, arguments_, {
             signal: context.mcpReq.signal,
+            progress,
         }));
+        await progress.report({
+            phase: contract.name,
+            completed: 1,
+            total: 1,
+            message: result.ok ? "completed" : "failed",
+            terminal: true,
+        });
         if (result.ok) {
             const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
                 operation: contract.name,
@@ -38,7 +54,9 @@ const registerOfficialTool = (server, analysis, contract, registration) => {
             const recorded = registration.recordEvidence?.(evidence);
             if (recorded !== undefined && !recorded.ok)
                 return toCallToolResult(recorded, contract);
-            return toCallToolResult({ ok: true, value: evidence }, contract);
+            return toCallToolResult({ ok: true, value: evidence }, contract, {
+                evidenceResourcesAvailable: recorded !== undefined,
+            });
         }
         if (result.error instanceof AnalysisCapabilityUnavailableError &&
             approvedUnknownTracking(input) &&

package/dist/server/registerProcessComparisonTool.js

@@ -10,9 +10,10 @@ import { err } from "../domain/result.js";
 import { PROCESS_PROVIDER } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { runDerivedOperation } from "./runDerivedOperation.js";
 /** Register deterministic process-capture comparison and contradiction tracking. */
 export const registerProcessComparisonTool = (server, session, contract, now = Date.now) => {
-    server.registerTool(contract.name, toolRegistrationOptions(contract), (input) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
         const parsed = z
             .object({
             left_evidence_id: z.string(),
@@ -28,12 +29,15 @@ export const registerProcessComparisonTool = (server, session, contract, now = D
             return toCallToolResult(validated, contract);
         let comparison;
         try {
-            comparison = compareProcessCaptures(parsed.left, parsed.right, {
+            const computed = await runDerivedOperation(context, contract.name, () => compareProcessCaptures(parsed.left, parsed.right, {
                 ...(parsed.max_capture_age_ms === undefined
                     ? {}
                     : { maxCaptureAgeMs: parsed.max_capture_age_ms }),
                 now,
-            });
+            }));
+            if (!computed.ok)
+                return toCallToolResult(computed, contract);
+            comparison = computed.value;
         }
         catch (cause) {
             return toCallToolResult(err(new EvidenceIntegrityError(cause instanceof Error