rea-agents 1.6.0 → 2.0.0

package/dist/server/registerElectronTools.js

@@ -1,22 +1,33 @@
+import { analyzeJavaScriptApplicationValidated } from "../application/JavaScriptApplicationService.js";
+import { reconcileJavaScriptRuntimeEvidenceValidated } from "../application/JavaScriptRuntimeReconciliationService.js";
 import { inspectElectronPage, listElectronTargets, } from "../application/ElectronObservationService.js";
 import { ELECTRON_TOOL_CONTRACTS } from "../contracts/electronToolContracts.js";
 import { inspectElectronPageInputSchema, listElectronTargetsInputSchema, } from "../domain/electronObservation.js";
+import { analyzeJavaScriptApplicationInputSchema } from "../domain/javascriptApplicationAnalysis.js";
+import { reconcileJavaScriptRuntimeInputSchema } from "../domain/javascriptRuntimeReconciliationSchemas.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
 /** Register Electron tools even when provider or permission policy is absent. */
 export const registerElectronTools = (server, options) => {
-    const [listContract, inspectContract] = ELECTRON_TOOL_CONTRACTS;
+    const [listContract, inspectContract, analyzeContract, reconcileContract] = ELECTRON_TOOL_CONTRACTS;
     server.registerTool(listContract.name, toolRegistrationOptions(listContract), async (input, context) => {
-        const parsed = listElectronTargetsInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(listElectronTargetsInputSchema, input, listContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, listContract);
+        const parsed = parsedInput.value;
         const result = await logToolExecution(options.logger, listContract.name, () => listElectronTargets(options.electron, options.permissionAuthority, parsed, { signal: context.mcpReq.signal }));
         if (!result.ok)
             return toCallToolResult(result, listContract);
         return evidenceResult(options, listContract, result.value);
     });
     server.registerTool(inspectContract.name, toolRegistrationOptions(inspectContract), async (input, context) => {
-        const parsed = inspectElectronPageInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(inspectElectronPageInputSchema, input, inspectContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, inspectContract);
+        const parsed = parsedInput.value;
         const result = await logToolExecution(options.logger, inspectContract.name, () => inspectElectronPage(options.electron, options.permissionAuthority, parsed, {
             signal: context.mcpReq.signal,
             progress: mcpProgressReporter(context),
@@ -25,6 +36,37 @@ export const registerElectronTools = (server, options) => {
             return toCallToolResult(result, inspectContract);
         return evidenceResult(options, inspectContract, result.value);
     });
+    server.registerTool(analyzeContract.name, toolRegistrationOptions(analyzeContract), async (input, context) => {
+        const parsedInput = safeParseToolInput(analyzeJavaScriptApplicationInputSchema, input, analyzeContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, analyzeContract);
+        const parsed = parsedInput.value;
+        const result = await logToolExecution(options.logger, analyzeContract.name, () => analyzeJavaScriptApplicationValidated(options.permissionAuthority, parsed, {
+            signal: context.mcpReq.signal,
+            progress: mcpProgressReporter(context),
+        }));
+        if (!result.ok)
+            return toCallToolResult(result, analyzeContract);
+        return evidenceResult(options, analyzeContract, result.value);
+    });
+    server.registerTool(reconcileContract.name, toolRegistrationOptions(reconcileContract), async (input) => {
+        const parsedInput = safeParseToolInput(reconcileJavaScriptRuntimeInputSchema, input, reconcileContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, reconcileContract);
+        const parsed = parsedInput.value;
+        const result = await logToolExecution(options.logger, reconcileContract.name, () => Promise.resolve(reconcileJavaScriptRuntimeEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, reconcileContract);
+        for (const source of [
+            ...parsed.static_layers.map(({ analysis }) => analysis),
+            ...parsed.runtime_observations,
+        ]) {
+            const recorded = options.recordEvidence?.(source);
+            if (recorded !== undefined && !recorded.ok)
+                return toCallToolResult(recorded, reconcileContract);
+        }
+        return evidenceResult(options, reconcileContract, result.value);
+    });
 };
 const evidenceResult = (options, contract, evidence) => {
     const recorded = options.recordEvidence?.(evidence);

package/dist/server/registerEnhancedTools.js

@@ -1,18 +1,16 @@
-import { EnhancedTools } from "../application/EnhancedTools.js";
+import { EnhancedTools, } from "../application/EnhancedTools.js";
 import { enhancedToolNameSchema } from "../contracts/enhancedInputs.js";
 import { ENHANCED_TOOL_CONTRACTS, } from "../contracts/toolContracts.js";
 import { toCallToolResult } from "./toolResult.js";
 import { logToolExecution } from "./toolLogging.js";
 import { createEvidence } from "../domain/evidence.js";
-import { jsonObjectSchema } from "../domain/jsonValue.js";
 import { enhancedInputSchemas } from "../contracts/enhancedInputs.js";
-import { UnknownRegistryError } from "../domain/errors.js";
+import { AnalysisInputError, UnknownRegistryError } from "../domain/errors.js";
+import { ok } from "../domain/result.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
-const WORKFLOW_PROVIDER = {
-    id: "rea-workflow",
-    name: "REA composed investigation workflow",
-    version: "1",
-};
+import { REA_WORKFLOW_PROVIDER, workflowAnalysisProfile, } from "../application/InvestigationProviders.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register composed workflows against the same port as direct bridge tools. */
 export const registerEnhancedTools = (server, analysis, options) => {
     const services = new EnhancedTools(analysis);
@@ -20,6 +18,7 @@ export const registerEnhancedTools = (server, analysis, options) => {
         registerEnhancedTool(server, services, contract, {
             logger: options.logger,
             activeTarget: options.activeTarget,
+            analysisProfile: options.analysisProfile,
             recordEvidence: options.recordEvidence,
             recordUnknown: options.recordUnknown,
         });
@@ -27,12 +26,7 @@ export const registerEnhancedTools = (server, analysis, options) => {
 };
 const registerEnhancedTool = (server, services, contract, registration) => {
     const name = enhancedToolNameSchema.parse(contract.name);
-    server.registerTool(name, {
-        description: contract.description,
-        inputSchema: contract.inputSchema,
-        outputSchema: contract.outputSchema,
-        annotations: contract.annotations,
-    }, async (input, context) => {
+    server.registerTool(name, toolRegistrationOptions(contract), async (input, context) => {
         const progress = mcpProgressReporter(context);
         await progress.report({
             phase: name,
@@ -40,9 +34,12 @@ const registerEnhancedTool = (server, services, contract, registration) => {
             total: 1,
             message: "started",
         });
-        const parsedInput = jsonObjectSchema.parse(enhancedInputSchemas[name].parse(input));
-        const parameters = { ...parsedInput };
-        const result = await logToolExecution(registration.logger, name, () => services.execute(name, input, context.mcpReq.signal));
+        const validatedCall = parseEnhancedCall(name, input);
+        if (!validatedCall.ok)
+            return toCallToolResult(validatedCall, contract);
+        const parsedInput = validatedCall.value.input;
+        const parameters = jsonParameters(parsedInput);
+        const result = await logToolExecution(registration.logger, name, () => services.executeValidated(validatedCall.value, context.mcpReq.signal));
         await progress.report({
             phase: name,
             completed: 1,
@@ -51,10 +48,16 @@ const registerEnhancedTool = (server, services, contract, registration) => {
             terminal: true,
         });
         if (result.ok) {
-            const evidence = createEvidence(registration.activeTarget?.(), WORKFLOW_PROVIDER, {
+            const upstreamProfile = registration.analysisProfile?.();
+            const evidence = createEvidence(registration.activeTarget?.(), REA_WORKFLOW_PROVIDER, {
                 operation: name,
                 parameters,
                 result: result.value,
+                ...(upstreamProfile === undefined
+                    ? {}
+                    : {
+                        analysisProfile: workflowAnalysisProfile(upstreamProfile),
+                    }),
                 confidence: "derived",
                 limitations: [
                     "Derived by an REA workflow from one or more provider observations.",
@@ -65,7 +68,7 @@ const registerEnhancedTool = (server, services, contract, registration) => {
                 return toCallToolResult(recorded, contract);
             const unknowns = recordWorkflowUnknowns({
                 name,
-                input: parsedInput,
+                input: parameters,
                 result: result.value,
                 evidenceId: evidence.evidence_id,
                 recordUnknown: registration.recordUnknown,
@@ -79,6 +82,51 @@ const registerEnhancedTool = (server, services, contract, registration) => {
         return toCallToolResult(result, contract);
     });
 };
+const jsonParameters = (input) => Object.fromEntries(Object.entries(input).filter((entry) => entry[1] !== undefined));
+const parseEnhancedCall = (name, input) => {
+    switch (name) {
+        case "swift_classes": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.swift_classes, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "get_objc_classes": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.get_objc_classes, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "get_objc_protocols": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.get_objc_protocols, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "batch_decompile": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.batch_decompile, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "get_call_graph": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.get_call_graph, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "analyze_swift_types": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.analyze_swift_types, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "find_xrefs_to_name": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.find_xrefs_to_name, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "binary_overview": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.binary_overview, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "analyze_function": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.analyze_function, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+        case "trace_feature": {
+            const parsed = safeParseToolInput(enhancedInputSchemas.trace_feature, input, name);
+            return parsed.ok ? ok({ name, input: parsed.value }) : parsed;
+        }
+    }
+};
 const recordWorkflowUnknowns = ({ name, input, result, evidenceId, recordUnknown, }) => {
     if (name !== "trace_feature" ||
         input.unknown_registry_approved !== true ||

package/dist/server/registerEvidenceTools.js

@@ -4,6 +4,7 @@ import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
 import { err } from "../domain/result.js";
 /** Register provider-backed contracts that return atomic Evidence v2 observations. */
@@ -17,7 +18,10 @@ export const registerEvidenceTools = (server, analysis, contracts, options) => {
                 total: 1,
                 message: "started",
             });
-            const parameters = jsonObjectSchema.parse(contract.inputSchema.parse(input));
+            const parsedInput = safeParseToolInput(contract.inputSchema, input, contract.name);
+            if (!parsedInput.ok)
+                return toCallToolResult(parsedInput, contract);
+            const parameters = jsonObjectSchema.parse(parsedInput.value);
             if (options.permissionAuthority !== undefined) {
                 const request = permissionRequest(contract.name, parameters);
                 if (request !== undefined) {

package/dist/server/registerFunctionComparisonTool.js

@@ -4,21 +4,29 @@ import { jsonValueSchema } from "../domain/jsonValue.js";
 import { FUNCTION_COMPARISON_PROVIDER } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
-import { resolveSessionEvidence } from "./sessionEvidence.js";
+import { resolveSessionEvidenceIds } from "./sessionEvidence.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register explicit Evidence-backed function comparison. */
 export const registerFunctionComparisonTool = (server, session, contract) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const parsed = functionComparisonInputSchema.parse(input);
-        const left = resolveSessionEvidence(session, parsed.left);
+        const parsedInput = safeParseToolInput(functionComparisonInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
+        const expected = {
+            operation: "analyze_function",
+            predicate: "rea.analysis/v2",
+        };
+        const left = resolveSessionEvidenceIds(session, parsed.left_evidence_ids, expected);
         if (!left.ok)
             return toCallToolResult(left, contract);
-        const right = resolveSessionEvidence(session, parsed.right);
+        const right = resolveSessionEvidenceIds(session, parsed.right_evidence_ids, expected);
         if (!right.ok)
             return toCallToolResult(right, contract);
-        const leftIds = evidenceIds(left.value);
-        const rightIds = evidenceIds(right.value);
+        const leftIds = left.value.map(({ evidence_id: id }) => id);
+        const rightIds = right.value.map(({ evidence_id: id }) => id);
         const computed = await runDerivedOperation(context, contract.name, () => compareFunctions(left.value, right.value, parsed.offset, parsed.limit));
         if (!computed.ok)
             return toCallToolResult(computed, contract);
@@ -69,4 +77,3 @@ const functionUnknownInput = ({ approved, status, leftIds, rightIds, }) => {
         relationships: [],
     };
 };
-const evidenceIds = (input) => (Array.isArray(input) ? input : [input]).map(({ evidence_id: id }) => id);

package/dist/server/registerInvestigationTools.js

@@ -1,4 +1,6 @@
-import { runCrossVersionInvestigation } from "../application/CrossVersionInvestigation.js";
+import { runCrossVersionInvestigationValidated } from "../application/CrossVersionInvestigation.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 import { buildCallPath, callPathInputSchema } from "../domain/callPath.js";
 import { correlateStaticAndRuntime, staticRuntimeCorrelationInputSchema, } from "../domain/staticRuntimeCorrelation.js";
 import { reconstructionVerificationInputSchema, verifyReconstruction, } from "../domain/reconstructionVerification.js";
@@ -30,7 +32,10 @@ const investigationExecution = (session, signal, inputRoots, integrityContinueEn
 const isIncomplete = (status) => status === "unknown" || status === "truncated";
 const registerChangedBehavior = (server, session, contract, policies) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = changedBehaviorInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(changedBehaviorInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const investigationRun = parsed.investigation_run;
         if (investigationRun !== undefined) {
             const progress = mcpProgressReporter(context);
@@ -54,7 +59,7 @@ const registerChangedBehavior = (server, session, contract, policies) => {
                     operation: contract.name,
                 });
             }
-            const investigated = await runCrossVersionInvestigation(investigationRun, policies.evidenceFiles, {
+            const investigated = await runCrossVersionInvestigationValidated(investigationRun, policies.evidenceFiles, {
                 ...investigationExecution(session, context.mcpReq.signal, policies.inputRoots, policies.integrityContinueEnabled?.() ?? false, progress),
                 ...(workspaceAuthorization === undefined
                     ? {}
@@ -134,7 +139,10 @@ const registerChangedBehavior = (server, session, contract, policies) => {
 };
 const registerCallPath = (server, session, contract) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = callPathInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(callPathInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const closure = evidenceClosure(session, functionEvidenceIds(parsed.functions));
         if (!closure.ok)
             return toCallToolResult(closure, contract);
@@ -177,7 +185,10 @@ const registerCallPath = (server, session, contract) => {
 };
 const registerStaticRuntime = (server, session, contract) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = staticRuntimeCorrelationInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(staticRuntimeCorrelationInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const closure = evidenceClosure(session, comparisonClosure([
             ...parsed.static_comparisons,
             ...parsed.runtime_comparisons,
@@ -219,13 +230,11 @@ const registerStaticRuntime = (server, session, contract) => {
 };
 const registerReconstruction = (server, session, contract) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
-        const parsed = reconstructionVerificationInputSchema.parse(input);
+        const parsedInput = safeParseToolInput(reconstructionVerificationInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
         const owned = session.exportEvidenceBundle();
-        const ownedUnknowns = new Set(owned.unknowns.map(({ revision_digest: digest }) => digest));
-        const ownedEvidenceIds = new Set(owned.records.map(({ evidence_id: id }) => id));
-        if (parsed.evidence_bundle.records.some(({ evidence_id: id }) => !ownedEvidenceIds.has(id)) ||
-            parsed.evidence_bundle.unknowns.some(({ revision_digest: digest }) => !ownedUnknowns.has(digest)))
-            return toCallToolResult(err(new EvidenceIntegrityError("Reconstruction input unknown history is not present in this session")), contract);
         const computed = await runDerivedOperation(context, contract.name, () => verifyReconstruction(parsed.specification, owned, parsed.offset, parsed.limit));
         if (!computed.ok)
             return toCallToolResult(computed, contract);
@@ -261,12 +270,7 @@ const registerReconstruction = (server, session, contract) => {
         }), contract);
     });
 };
-const contractOptions = (contract) => ({
-    description: contract.description,
-    inputSchema: contract.inputSchema,
-    outputSchema: contract.outputSchema,
-    annotations: contract.annotations,
-});
+const contractOptions = toolRegistrationOptions;
 const comparisonClosure = (comparisons) => uniqueIds(comparisons.flatMap((evidence) => [
     evidence.evidence_id,
     ...evidence.evidence_links,

package/dist/server/registerManagedTools.js

@@ -0,0 +1,6 @@
+import { MANAGED_TOOL_CONTRACTS } from "../contracts/managedToolContracts.js";
+import { registerEvidenceTools } from "./registerEvidenceTools.js";
+/** Register execution-free managed PE/CLI inspection. */
+export const registerManagedTools = (server, analysis, options) => {
+    registerEvidenceTools(server, analysis, MANAGED_TOOL_CONTRACTS, options);
+};

package/dist/server/registerManagedWorkflowTools.js

@@ -0,0 +1,277 @@
+import { compareManagedMembersEvidenceValidated } from "../application/ManagedMemberComparisonService.js";
+import { projectManagedApplicationGraphEvidence } from "../application/ManagedApplicationGraphService.js";
+import { verifyManagedNativeBoundariesEvidence } from "../application/ManagedNativeVerificationService.js";
+import { importManagedReconstructionEvidenceValidated } from "../application/ManagedReconstructionService.js";
+import { planManagedRuntimeCorrelationEvidenceValidated, } from "../application/ManagedRuntimeCorrelationService.js";
+import { compareManagedMembersReferenceInputSchema, managedApplicationGraphReferenceInputSchema, managedNativeVerificationReferenceInputSchema, managedReconstructionReferenceInputSchema, managedRuntimeCorrelationReferenceInputSchema, MANAGED_WORKFLOW_TOOL_CONTRACTS, } from "../contracts/managedWorkflowToolContracts.js";
+import { managedMemberComparisonResultSchema } from "../domain/managedMemberComparison.js";
+import { managedNativeVerificationResultSchema } from "../domain/managedNativeVerification.js";
+import { logToolExecution } from "./toolLogging.js";
+import { toCallToolResult } from "./toolResult.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
+import { resolveSessionEvidenceIds } from "./sessionEvidence.js";
+/** Register provider-neutral managed-code workflows. */
+export const registerManagedWorkflowTools = (server, options) => {
+    const compareContract = contract("compare_managed_members");
+    const nativeVerificationContract = contract("verify_managed_native_boundaries");
+    const reconstructionContract = contract("import_managed_reconstruction");
+    const runtimeContract = contract("plan_managed_runtime_correlation");
+    const graphContract = contract("project_managed_application_graph");
+    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
+        const parsedInput = safeParseToolInput(compareManagedMembersReferenceInputSchema, input, compareContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, compareContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.left_evidence_id,
+            parsedInput.value.right_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, compareContract);
+        const [left, right] = resolved.value;
+        if (left === undefined || right === undefined)
+            throw new TypeError("Managed comparison Evidence resolution failed");
+        const { left_evidence_id: _leftEvidenceId, right_evidence_id: _rightEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, left, right };
+        const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareManagedMembersEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, compareContract);
+        const recorded = recordSources(options.recordEvidence, [
+            parsed.left,
+            parsed.right,
+        ]);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, compareContract);
+        const comparison = managedMemberComparisonResultSchema.parse(result.value.normalized_result);
+        const unknown = comparison.summary.unknown > 0;
+        const output = parsed.unknown_registry_approved === true && unknown
+            ? options.recordEvidenceWithUnknown?.(result.value, {
+                approved: true,
+                question: "Which managed members remain unmatched or ambiguous across these versions?",
+                severity: "medium",
+                domain: "managed-member-comparison",
+                supporting_evidence_ids: [result.value.evidence_id],
+                contradicting_evidence_ids: [],
+                required_authority: "shipped-artifact",
+                required_confidence: "observed",
+                required_environment: null,
+                recommended_probes: [
+                    {
+                        operation: "inspect_managed_members",
+                        rationale: "Repeat static member inspection with complete pages and method bodies.",
+                    },
+                ],
+                relationships: [],
+            })
+            : options.recordEvidence?.(result.value);
+        if (output !== undefined && !output.ok)
+            return toCallToolResult(output, compareContract);
+        return toCallToolResult({ ok: true, value: result.value }, compareContract, {
+            evidenceResourcesAvailable: output !== undefined,
+        });
+    });
+    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedNativeVerificationReferenceInputSchema, input, nativeVerificationContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, nativeVerificationContract);
+        const managedBoundaries = resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_boundaries_evidence_id);
+        if (!managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, nativeVerificationContract);
+        const nativeObservations = resolveNativeEvidence(options.session, parsedInput.value.native_observation_evidence_ids);
+        if (!nativeObservations.ok)
+            return toCallToolResult(nativeObservations, nativeVerificationContract);
+        const managedBoundary = managedBoundaries.value[0];
+        if (managedBoundary === undefined)
+            throw new TypeError("Managed boundary Evidence resolution failed");
+        const { managed_boundaries_evidence_id: _managedBoundariesEvidenceId, native_observation_evidence_ids: _nativeObservationEvidenceIds, ...referencedInput } = parsedInput.value;
+        const parsed = {
+            ...referencedInput,
+            managed_boundaries: managedBoundary,
+            native_observations: nativeObservations.value,
+        };
+        const result = await logToolExecution(options.logger, nativeVerificationContract.name, () => Promise.resolve(verifyManagedNativeBoundariesEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, nativeVerificationContract);
+        const recordedSources = recordSources(options.recordEvidence, [
+            parsed.managed_boundaries,
+            ...parsed.native_observations,
+        ]);
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, nativeVerificationContract);
+        const verification = managedNativeVerificationResultSchema.parse(result.value.normalized_result);
+        const unknown = verification.summary.unresolved > 0 ||
+            verification.summary.contradicted > 0 ||
+            verification.summary.native_body_unresolved > 0;
+        const output = parsed.unknown_registry_approved === true && unknown
+            ? options.recordEvidenceWithUnknown?.(result.value, {
+                approved: true,
+                question: "Which managed/native boundaries remain unresolved or contradicted by the supplied native Evidence?",
+                severity: "medium",
+                domain: "managed-native-verification",
+                supporting_evidence_ids: [result.value.evidence_id],
+                contradicting_evidence_ids: [],
+                required_authority: "shipped-artifact",
+                required_confidence: "observed",
+                required_environment: null,
+                recommended_probes: [
+                    {
+                        operation: "inspect_managed_native_boundaries",
+                        rationale: "Repeat managed boundary inspection with complete ModuleRef, ImplMap, and native implementation pages.",
+                    },
+                    {
+                        operation: "analyze_function",
+                        rationale: "Analyze the provider-resolved native function candidate for the declared export.",
+                    },
+                ],
+                relationships: [],
+            })
+            : options.recordEvidence?.(result.value);
+        if (output !== undefined && !output.ok)
+            return toCallToolResult(output, nativeVerificationContract);
+        return toCallToolResult(result, nativeVerificationContract, {
+            evidenceResourcesAvailable: output !== undefined,
+        });
+    });
+    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedReconstructionReferenceInputSchema, input, reconstructionContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, reconstructionContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.static_members_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, reconstructionContract);
+        const staticMembers = resolved.value[0];
+        if (staticMembers === undefined)
+            throw new TypeError("Managed reconstruction Evidence resolution failed");
+        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, static_members: staticMembers };
+        const result = await logToolExecution(options.logger, reconstructionContract.name, () => Promise.resolve(importManagedReconstructionEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, reconstructionContract);
+        const recordedSource = options.recordEvidence?.(parsed.static_members);
+        if (recordedSource !== undefined && !recordedSource.ok)
+            return toCallToolResult(recordedSource, reconstructionContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, reconstructionContract);
+        return toCallToolResult(result, reconstructionContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+    server.registerTool(runtimeContract.name, toolRegistrationOptions(runtimeContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedRuntimeCorrelationReferenceInputSchema, input, runtimeContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, runtimeContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.static_members_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, runtimeContract);
+        const staticMembers = resolved.value[0];
+        if (staticMembers === undefined)
+            throw new TypeError("Managed runtime Evidence resolution failed");
+        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, static_members: staticMembers };
+        const result = await logToolExecution(options.logger, runtimeContract.name, () => planManagedRuntimeCorrelationEvidenceValidated(options.runtime, parsed));
+        if (!result.ok)
+            return toCallToolResult(result, runtimeContract);
+        const recordedSource = options.recordEvidence?.(parsed.static_members);
+        if (recordedSource !== undefined && !recordedSource.ok)
+            return toCallToolResult(recordedSource, runtimeContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, runtimeContract);
+        return toCallToolResult(result, runtimeContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedApplicationGraphReferenceInputSchema, input, graphContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, graphContract);
+        const managedArtifact = parsedInput.value.managed_artifact_evidence_id === undefined
+            ? undefined
+            : resolveManagedArtifactEvidence(options.session, parsedInput.value.managed_artifact_evidence_id);
+        if (managedArtifact !== undefined && !managedArtifact.ok)
+            return toCallToolResult(managedArtifact, graphContract);
+        const managedMembers = parsedInput.value.managed_members_evidence_id === undefined
+            ? undefined
+            : resolveManagedEvidence(options.session, [
+                parsedInput.value.managed_members_evidence_id,
+            ]);
+        if (managedMembers !== undefined && !managedMembers.ok)
+            return toCallToolResult(managedMembers, graphContract);
+        const managedBoundaries = parsedInput.value.managed_native_boundaries_evidence_id === undefined
+            ? undefined
+            : resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_native_boundaries_evidence_id);
+        if (managedBoundaries !== undefined && !managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, graphContract);
+        const parsed = {
+            limits: parsedInput.value.limits,
+            managed_artifact: managedArtifact?.value[0],
+            managed_members: managedMembers?.value[0],
+            managed_native_boundaries: managedBoundaries?.value[0],
+        };
+        const result = await logToolExecution(options.logger, graphContract.name, () => Promise.resolve(projectManagedApplicationGraphEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, graphContract);
+        const recordedSources = recordSources(options.recordEvidence, sourceEvidence(parsed));
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, graphContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, graphContract);
+        return toCallToolResult(result, graphContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};
+const contract = (name) => {
+    const found = MANAGED_WORKFLOW_TOOL_CONTRACTS.find((candidate) => candidate.name === name);
+    if (found === undefined)
+        throw new Error(`Missing ${name} contract`);
+    return found;
+};
+const resolveManagedEvidence = (session, evidenceIds) => resolveSessionEvidenceIds(session, evidenceIds, {
+    operation: "inspect_managed_members",
+    predicate: "rea.analysis/v2",
+});
+const resolveManagedArtifactEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
+    operation: "inspect_managed_artifact",
+    predicate: "rea.analysis/v2",
+});
+const resolveManagedBoundaryEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
+    operation: "inspect_managed_native_boundaries",
+    predicate: "rea.analysis/v2",
+});
+const resolveNativeEvidence = (session, evidenceIds) => {
+    const records = [];
+    for (const evidenceId of evidenceIds) {
+        const operation = session.evidenceById(evidenceId)?.operation;
+        const expectedOperation = operation === "inspect_macho" || operation === "analyze_function"
+            ? operation
+            : "inspect_macho or analyze_function";
+        const resolved = resolveSessionEvidenceIds(session, [evidenceId], {
+            operation: expectedOperation,
+            predicate: "rea.analysis/v2",
+        });
+        if (!resolved.ok)
+            return resolved;
+        records.push(...resolved.value);
+    }
+    return { ok: true, value: records };
+};
+const recordSources = (recordEvidence, sources) => {
+    for (const source of sources) {
+        const recorded = recordEvidence?.(source);
+        if (recorded !== undefined && !recorded.ok)
+            return recorded;
+    }
+    return { ok: true, value: null };
+};
+const sourceEvidence = (input) => [
+    input.managed_artifact,
+    input.managed_members,
+    input.managed_native_boundaries,
+].filter((evidence) => evidence !== undefined);