rea-agents 1.7.0 → 2.1.0

package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js

@@ -0,0 +1,65 @@
+import { compareManagedMembersEvidenceValidated } from "../../application/ManagedMemberComparisonService.js";
+import { compareManagedMembersReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { managedMemberComparisonResultSchema } from "../../domain/managedMemberComparison.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedEvidence } from "./evidence.js";
+const compareContract = managedWorkflowContract("compare_managed_members");
+/** Register the managed member comparison workflow tool. */
+export const registerCompareManagedMembers = (server, options) => {
+    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
+        const parsedInput = safeParseToolInput(compareManagedMembersReferenceInputSchema, input, compareContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, compareContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.left_evidence_id,
+            parsedInput.value.right_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, compareContract);
+        const [left, right] = resolved.value;
+        if (left === undefined || right === undefined)
+            throw new TypeError("Managed comparison Evidence resolution failed");
+        const { left_evidence_id: _leftEvidenceId, right_evidence_id: _rightEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, left, right };
+        const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareManagedMembersEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, compareContract);
+        const recorded = recordManagedSources(options.recordEvidence, [
+            parsed.left,
+            parsed.right,
+        ]);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, compareContract);
+        const comparison = managedMemberComparisonResultSchema.parse(result.value.normalized_result);
+        const unknown = comparison.summary.unknown > 0;
+        const output = parsed.unknown_registry_approved === true && unknown
+            ? options.recordEvidenceWithUnknown?.(result.value, {
+                approved: true,
+                question: "Which managed members remain unmatched or ambiguous across these versions?",
+                severity: "medium",
+                domain: "managed-member-comparison",
+                supporting_evidence_ids: [result.value.evidence_id],
+                contradicting_evidence_ids: [],
+                required_authority: "shipped-artifact",
+                required_confidence: "observed",
+                required_environment: null,
+                recommended_probes: [
+                    {
+                        operation: "inspect_managed_members",
+                        rationale: "Repeat static member inspection with complete pages and method bodies.",
+                    },
+                ],
+                relationships: [],
+            })
+            : options.recordEvidence?.(result.value);
+        if (output !== undefined && !output.ok)
+            return toCallToolResult(output, compareContract);
+        return toCallToolResult({ ok: true, value: result.value }, compareContract, {
+            evidenceResourcesAvailable: output !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/contract.js

@@ -0,0 +1,8 @@
+import { MANAGED_WORKFLOW_TOOL_CONTRACTS } from "../../contracts/managedWorkflowToolContracts.js";
+/** Locate one managed workflow tool contract by exact name. */
+export const managedWorkflowContract = (name) => {
+    const found = MANAGED_WORKFLOW_TOOL_CONTRACTS.find((candidate) => candidate.name === name);
+    if (found === undefined)
+        throw new Error(`Missing ${name} contract`);
+    return found;
+};

package/dist/server/registerManagedWorkflowTools/evidence.js

@@ -0,0 +1,43 @@
+import { resolveSessionEvidenceIds } from "../sessionEvidence.js";
+export const resolveManagedEvidence = (session, evidenceIds) => resolveSessionEvidenceIds(session, evidenceIds, {
+    operation: "inspect_managed_members",
+    predicate: "rea.analysis/v2",
+});
+export const resolveManagedArtifactEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
+    operation: "inspect_managed_artifact",
+    predicate: "rea.analysis/v2",
+});
+export const resolveManagedBoundaryEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
+    operation: "inspect_managed_native_boundaries",
+    predicate: "rea.analysis/v2",
+});
+export const resolveNativeEvidence = (session, evidenceIds) => {
+    const records = [];
+    for (const evidenceId of evidenceIds) {
+        const operation = session.evidenceById(evidenceId)?.operation;
+        const expectedOperation = operation === "inspect_macho" || operation === "analyze_function"
+            ? operation
+            : "inspect_macho or analyze_function";
+        const resolved = resolveSessionEvidenceIds(session, [evidenceId], {
+            operation: expectedOperation,
+            predicate: "rea.analysis/v2",
+        });
+        if (!resolved.ok)
+            return resolved;
+        records.push(...resolved.value);
+    }
+    return { ok: true, value: records };
+};
+export const recordManagedSources = (recordEvidence, sources) => {
+    for (const source of sources) {
+        const recorded = recordEvidence?.(source);
+        if (recorded !== undefined && !recorded.ok)
+            return recorded;
+    }
+    return { ok: true, value: null };
+};
+export const sourceEvidence = (input) => [
+    input.managed_artifact,
+    input.managed_members,
+    input.managed_native_boundaries,
+].filter((evidence) => evidence !== undefined);

package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js

@@ -0,0 +1,39 @@
+import { importManagedReconstructionEvidenceValidated } from "../../application/ManagedReconstructionService.js";
+import { managedReconstructionReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { resolveManagedEvidence } from "./evidence.js";
+const reconstructionContract = managedWorkflowContract("import_managed_reconstruction");
+/** Register the managed reconstruction import workflow tool. */
+export const registerImportManagedReconstruction = (server, options) => {
+    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedReconstructionReferenceInputSchema, input, reconstructionContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, reconstructionContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.static_members_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, reconstructionContract);
+        const staticMembers = resolved.value[0];
+        if (staticMembers === undefined)
+            throw new TypeError("Managed reconstruction Evidence resolution failed");
+        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, static_members: staticMembers };
+        const result = await logToolExecution(options.logger, reconstructionContract.name, () => Promise.resolve(importManagedReconstructionEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, reconstructionContract);
+        const recordedSource = options.recordEvidence?.(parsed.static_members);
+        if (recordedSource !== undefined && !recordedSource.ok)
+            return toCallToolResult(recordedSource, reconstructionContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, reconstructionContract);
+        return toCallToolResult(result, reconstructionContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/planManagedRuntimeCorrelation.js

@@ -0,0 +1,39 @@
+import { planManagedRuntimeCorrelationEvidenceValidated } from "../../application/ManagedRuntimeCorrelationService.js";
+import { managedRuntimeCorrelationReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { resolveManagedEvidence } from "./evidence.js";
+const runtimeContract = managedWorkflowContract("plan_managed_runtime_correlation");
+/** Register the managed runtime correlation planning workflow tool. */
+export const registerPlanManagedRuntimeCorrelation = (server, options) => {
+    server.registerTool(runtimeContract.name, toolRegistrationOptions(runtimeContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedRuntimeCorrelationReferenceInputSchema, input, runtimeContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, runtimeContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.static_members_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, runtimeContract);
+        const staticMembers = resolved.value[0];
+        if (staticMembers === undefined)
+            throw new TypeError("Managed runtime Evidence resolution failed");
+        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, static_members: staticMembers };
+        const result = await logToolExecution(options.logger, runtimeContract.name, () => Promise.resolve(planManagedRuntimeCorrelationEvidenceValidated(options.runtime, parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, runtimeContract);
+        const recordedSource = options.recordEvidence?.(parsed.static_members);
+        if (recordedSource !== undefined && !recordedSource.ok)
+            return toCallToolResult(recordedSource, runtimeContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, runtimeContract);
+        return toCallToolResult(result, runtimeContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js

@@ -0,0 +1,52 @@
+import { projectManagedApplicationGraphEvidence } from "../../application/ManagedApplicationGraphService.js";
+import { managedApplicationGraphReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedArtifactEvidence, resolveManagedBoundaryEvidence, resolveManagedEvidence, sourceEvidence, } from "./evidence.js";
+const graphContract = managedWorkflowContract("project_managed_application_graph");
+/** Register the managed application graph projection workflow tool. */
+export const registerProjectManagedApplicationGraph = (server, options) => {
+    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedApplicationGraphReferenceInputSchema, input, graphContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, graphContract);
+        const managedArtifact = parsedInput.value.managed_artifact_evidence_id === undefined
+            ? undefined
+            : resolveManagedArtifactEvidence(options.session, parsedInput.value.managed_artifact_evidence_id);
+        if (managedArtifact !== undefined && !managedArtifact.ok)
+            return toCallToolResult(managedArtifact, graphContract);
+        const managedMembers = parsedInput.value.managed_members_evidence_id === undefined
+            ? undefined
+            : resolveManagedEvidence(options.session, [
+                parsedInput.value.managed_members_evidence_id,
+            ]);
+        if (managedMembers !== undefined && !managedMembers.ok)
+            return toCallToolResult(managedMembers, graphContract);
+        const managedBoundaries = parsedInput.value.managed_native_boundaries_evidence_id === undefined
+            ? undefined
+            : resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_native_boundaries_evidence_id);
+        if (managedBoundaries !== undefined && !managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, graphContract);
+        const parsed = {
+            limits: parsedInput.value.limits,
+            managed_artifact: managedArtifact?.value[0],
+            managed_members: managedMembers?.value[0],
+            managed_native_boundaries: managedBoundaries?.value[0],
+        };
+        const result = await logToolExecution(options.logger, graphContract.name, () => Promise.resolve(projectManagedApplicationGraphEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, graphContract);
+        const recordedSources = recordManagedSources(options.recordEvidence, sourceEvidence(parsed));
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, graphContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, graphContract);
+        return toCallToolResult(result, graphContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js

@@ -0,0 +1,75 @@
+import { verifyManagedNativeBoundariesEvidence } from "../../application/ManagedNativeVerificationService.js";
+import { managedNativeVerificationReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { managedNativeVerificationResultSchema } from "../../domain/managedNativeVerification.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedBoundaryEvidence, resolveNativeEvidence, } from "./evidence.js";
+const nativeVerificationContract = managedWorkflowContract("verify_managed_native_boundaries");
+/** Register the managed/native boundary verification workflow tool. */
+export const registerVerifyManagedNativeBoundaries = (server, options) => {
+    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedNativeVerificationReferenceInputSchema, input, nativeVerificationContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, nativeVerificationContract);
+        const managedBoundaries = resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_boundaries_evidence_id);
+        if (!managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, nativeVerificationContract);
+        const nativeObservations = resolveNativeEvidence(options.session, parsedInput.value.native_observation_evidence_ids);
+        if (!nativeObservations.ok)
+            return toCallToolResult(nativeObservations, nativeVerificationContract);
+        const managedBoundary = managedBoundaries.value[0];
+        if (managedBoundary === undefined)
+            throw new TypeError("Managed boundary Evidence resolution failed");
+        const { managed_boundaries_evidence_id: _managedBoundariesEvidenceId, native_observation_evidence_ids: _nativeObservationEvidenceIds, ...referencedInput } = parsedInput.value;
+        const parsed = {
+            ...referencedInput,
+            managed_boundaries: managedBoundary,
+            native_observations: nativeObservations.value,
+        };
+        const result = await logToolExecution(options.logger, nativeVerificationContract.name, () => Promise.resolve(verifyManagedNativeBoundariesEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, nativeVerificationContract);
+        const recordedSources = recordManagedSources(options.recordEvidence, [
+            parsed.managed_boundaries,
+            ...parsed.native_observations,
+        ]);
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, nativeVerificationContract);
+        const verification = managedNativeVerificationResultSchema.parse(result.value.normalized_result);
+        const unknown = verification.summary.unresolved > 0 ||
+            verification.summary.contradicted > 0 ||
+            verification.summary.native_body_unresolved > 0;
+        const output = parsed.unknown_registry_approved === true && unknown
+            ? options.recordEvidenceWithUnknown?.(result.value, {
+                approved: true,
+                question: "Which managed/native boundaries remain unresolved or contradicted by the supplied native Evidence?",
+                severity: "medium",
+                domain: "managed-native-verification",
+                supporting_evidence_ids: [result.value.evidence_id],
+                contradicting_evidence_ids: [],
+                required_authority: "shipped-artifact",
+                required_confidence: "observed",
+                required_environment: null,
+                recommended_probes: [
+                    {
+                        operation: "inspect_managed_native_boundaries",
+                        rationale: "Repeat managed boundary inspection with complete ModuleRef, ImplMap, and native implementation pages.",
+                    },
+                    {
+                        operation: "analyze_function",
+                        rationale: "Analyze the provider-resolved native function candidate for the declared export.",
+                    },
+                ],
+                relationships: [],
+            })
+            : options.recordEvidence?.(result.value);
+        if (output !== undefined && !output.ok)
+            return toCallToolResult(output, nativeVerificationContract);
+        return toCallToolResult(result, nativeVerificationContract, {
+            evidenceResourcesAvailable: output !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools.js

@@ -0,0 +1,13 @@
+import { registerCompareManagedMembers } from "./registerManagedWorkflowTools/compareManagedMembers.js";
+import { registerVerifyManagedNativeBoundaries } from "./registerManagedWorkflowTools/verifyManagedNativeBoundaries.js";
+import { registerImportManagedReconstruction } from "./registerManagedWorkflowTools/importManagedReconstruction.js";
+import { registerPlanManagedRuntimeCorrelation } from "./registerManagedWorkflowTools/planManagedRuntimeCorrelation.js";
+import { registerProjectManagedApplicationGraph } from "./registerManagedWorkflowTools/projectManagedApplicationGraph.js";
+/** Register provider-neutral managed-code workflows. */
+export const registerManagedWorkflowTools = (server, options) => {
+    registerCompareManagedMembers(server, options);
+    registerVerifyManagedNativeBoundaries(server, options);
+    registerImportManagedReconstruction(server, options);
+    registerPlanManagedRuntimeCorrelation(server, options);
+    registerProjectManagedApplicationGraph(server, options);
+};

package/dist/server/registerOfficialTools.js

@@ -5,6 +5,8 @@ import { logToolExecution } from "./toolLogging.js";
 import { createEvidence } from "../domain/evidence.js";
 import { AnalysisCapabilityUnavailableError, UnknownRegistryError, } from "../domain/errors.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
+import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
 /** Register direct bridge proxies, preserving MCP cancellation and typed errors. */
 export const registerOfficialTools = (server, analysis, options) => {
     for (const contract of OFFICIAL_TOOL_CONTRACTS) {
@@ -17,81 +19,93 @@ export const registerOfficialTools = (server, analysis, options) => {
     }
 };
 const registerOfficialTool = (server, analysis, contract, registration) => {
-    server.registerTool(contract.name, {
-        description: contract.description,
-        inputSchema: contract.inputSchema,
-        outputSchema: contract.outputSchema,
-        annotations: contract.annotations,
-    }, async (input, context) => {
-        const arguments_ = projectOfficialArguments(contract, input);
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
+        const parsedInput = safeParseToolInput(contract.inputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const arguments_ = projectOfficialArguments(contract, parsedInput.value);
         const progress = mcpProgressReporter(context);
-        await progress.report({
-            phase: contract.name,
-            completed: 0,
-            total: 1,
-            message: "started",
-        });
-        const result = await logToolExecution(registration.logger, contract.name, () => analysis.execute(contract.name, arguments_, {
+        const result = await runOfficialOperation(analysis, contract, arguments_, {
+            logger: registration.logger,
             signal: context.mcpReq.signal,
             progress,
-        }));
-        await progress.report({
-            phase: contract.name,
-            completed: 1,
-            total: 1,
-            message: result.ok ? "completed" : "failed",
-            terminal: true,
         });
-        if (result.ok) {
-            const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
-                operation: contract.name,
-                parameters: arguments_,
-                result: result.value.result,
-                ...(result.value.analysisProfile === undefined
-                    ? {}
-                    : { analysisProfile: result.value.analysisProfile }),
-                rawResult: result.value.rawResult,
-                limitations: result.value.limitations,
-                locations: result.value.locations,
-            });
-            const recorded = registration.recordEvidence?.(evidence);
-            if (recorded !== undefined && !recorded.ok)
-                return toCallToolResult(recorded, contract);
-            return toCallToolResult({ ok: true, value: evidence }, contract, {
-                evidenceResourcesAvailable: recorded !== undefined,
-            });
-        }
-        if (result.error instanceof AnalysisCapabilityUnavailableError &&
-            approvedUnknownTracking(input) &&
-            registration.recordUnknown !== undefined) {
-            const unknown = registration.recordUnknown({
-                approved: true,
-                question: "The requested analysis is unavailable for the current target.",
-                severity: "medium",
-                domain: "analysis-capability",
-                supporting_evidence_ids: [],
-                contradicting_evidence_ids: [],
-                required_authority: "shipped-artifact",
-                required_confidence: "observed",
-                required_environment: null,
-                recommended_probes: [
-                    {
-                        operation: contract.name,
-                        rationale: "Choose another analysis or target that can answer this question.",
-                    },
-                ],
-                relationships: [],
-            });
-            if (!unknown.ok &&
-                !(unknown.error instanceof UnknownRegistryError &&
-                    unknown.error.reason === "already-exists"))
-                return toCallToolResult(unknown, contract);
+        if (!result.ok) {
+            const unknownError = recordOfficialUnknown(input, result.error, contract, registration.recordUnknown);
+            if (unknownError !== undefined)
+                return toCallToolResult(unknownError, contract);
+            return toCallToolResult(result, contract);
         }
-        return toCallToolResult(result, contract);
+        const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
+            operation: contract.name,
+            parameters: arguments_,
+            result: result.value.result,
+            ...(result.value.analysisProfile === undefined
+                ? {}
+                : { analysisProfile: result.value.analysisProfile }),
+            rawResult: result.value.rawResult,
+            limitations: result.value.limitations,
+            locations: result.value.locations,
+        });
+        const recorded = registration.recordEvidence?.(evidence);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, contract);
+        return toCallToolResult({ ok: true, value: evidence }, contract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};
+const runOfficialOperation = async (analysis, contract, arguments_, execution) => {
+    await execution.progress.report({
+        phase: contract.name,
+        completed: 0,
+        total: 1,
+        message: "started",
+    });
+    const result = await logToolExecution(execution.logger, contract.name, () => analysis.execute(contract.name, arguments_, {
+        signal: execution.signal,
+        progress: execution.progress,
+    }));
+    await execution.progress.report({
+        phase: contract.name,
+        completed: 1,
+        total: 1,
+        message: result.ok ? "completed" : "failed",
+        terminal: true,
+    });
+    return result;
+};
+const recordOfficialUnknown = (input, error, contract, recordUnknown) => {
+    if (!(error instanceof AnalysisCapabilityUnavailableError) ||
+        !approvedUnknownTracking(input) ||
+        recordUnknown === undefined)
+        return undefined;
+    const unknown = recordUnknown({
+        approved: true,
+        question: "The requested analysis is unavailable for the current target.",
+        severity: "medium",
+        domain: "analysis-capability",
+        supporting_evidence_ids: [],
+        contradicting_evidence_ids: [],
+        required_authority: "shipped-artifact",
+        required_confidence: "observed",
+        required_environment: null,
+        recommended_probes: [
+            {
+                operation: contract.name,
+                rationale: "Choose another analysis or target that can answer this question.",
+            },
+        ],
+        relationships: [],
     });
+    if (!unknown.ok &&
+        !(unknown.error instanceof UnknownRegistryError &&
+            unknown.error.reason === "already-exists"))
+        return unknown;
+    return undefined;
 };
 const projectOfficialArguments = (contract, input) => {
-    const parsed = jsonObjectSchema.parse(contract.inputSchema.parse(input));
+    const parsed = jsonObjectSchema.parse(input);
     const projected = {};
     for (const key of Object.keys(contract.inputSchema.shape)) {
         if (key === "unknown_registry_approved")

package/dist/server/registerProcessComparisonTool.js

@@ -1,35 +1,40 @@
-import canonicalize from "canonicalize";
-import { z } from "zod";
-import { SESSION_TOOL_CONTRACTS } from "../contracts/toolContracts.js";
+import { processComparisonInputSchema, SESSION_TOOL_CONTRACTS, } from "../contracts/toolContracts.js";
 import { createEvidence } from "../domain/evidence.js";
 import { EvidenceIntegrityError } from "../domain/errors.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { compareProcessCaptures, processCaptureSchema, parseProcessCapture, } from "../domain/processCapture.js";
+import { compareProcessCaptures, parseProcessCapture, } from "../domain/processCapture.js";
 import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
 import { err } from "../domain/result.js";
 import { PROCESS_PROVIDER } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
 import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
 import { runDerivedOperation } from "./runDerivedOperation.js";
+import { safeParseToolInput } from "./toolInputValidation.js";
+import { resolveSessionEvidenceIds } from "./sessionEvidence.js";
 /** Register deterministic process-capture comparison and contradiction tracking. */
 export const registerProcessComparisonTool = (server, session, contract, now = Date.now) => {
     server.registerTool(contract.name, toolRegistrationOptions(contract), async (input, context) => {
-        const parsed = z
-            .object({
-            left_evidence_id: z.string(),
-            left: processCaptureSchema,
-            right_evidence_id: z.string(),
-            right: processCaptureSchema,
-            max_capture_age_ms: z.number().int().nonnegative().optional(),
-            unknown_registry_approved: z.literal(true).optional(),
-        })
-            .parse(input);
-        const validated = validateCaptureSources(session, parsed);
-        if (!validated.ok)
-            return toCallToolResult(validated, contract);
+        const parsedInput = safeParseToolInput(processComparisonInputSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const parsed = parsedInput.value;
+        const expected = {
+            operation: "capture_process_scenario",
+            predicate: "rea.process-capture/v4",
+        };
+        const leftRecord = resolveSessionEvidenceIds(session, [parsed.left_evidence_id], expected);
+        if (!leftRecord.ok)
+            return toCallToolResult(leftRecord, contract);
+        const rightRecord = resolveSessionEvidenceIds(session, [parsed.right_evidence_id], expected);
+        if (!rightRecord.ok)
+            return toCallToolResult(rightRecord, contract);
         let comparison;
+        let leftCapture;
+        let rightCapture;
         try {
-            const computed = await runDerivedOperation(context, contract.name, () => compareProcessCaptures(parsed.left, parsed.right, {
+            leftCapture = parseProcessCapture(leftRecord.value[0]?.normalized_result);
+            rightCapture = parseProcessCapture(rightRecord.value[0]?.normalized_result);
+            const computed = await runDerivedOperation(context, contract.name, () => compareProcessCaptures(leftCapture, rightCapture, {
                 ...(parsed.max_capture_age_ms === undefined
                     ? {}
                     : { maxCaptureAgeMs: parsed.max_capture_age_ms }),
@@ -50,8 +55,8 @@ export const registerProcessComparisonTool = (server, session, contract, now = D
             parameters: {
                 left_evidence_id: parsed.left_evidence_id,
                 right_evidence_id: parsed.right_evidence_id,
-                left_normalization: parsed.left.normalization,
-                right_normalization: parsed.right.normalization,
+                left_normalization: leftCapture.normalization,
+                right_normalization: rightCapture.normalization,
             },
             result: jsonValueSchema.parse(comparison),
             confidence: "derived",
@@ -62,33 +67,6 @@ export const registerProcessComparisonTool = (server, session, contract, now = D
         return toCallToolResult(recordDerivedEvidence(session, evidence, comparisonUnknownInput(parsed, comparison)), contract);
     });
 };
-const validateCaptureSources = (session, parsed) => {
-    for (const [evidenceId, capture] of [
-        [parsed.left_evidence_id, parsed.left],
-        [parsed.right_evidence_id, parsed.right],
-    ]) {
-        const evidence = session.evidenceById(evidenceId);
-        let evidenceCapture;
-        try {
-            evidenceCapture = parseProcessCapture(evidence?.normalized_result);
-        }
-        catch {
-            evidenceCapture = undefined;
-        }
-        if (evidence === undefined ||
-            evidence.operation !== "capture_process_scenario" ||
-            evidence.predicate_type !== "rea.process-capture/v4" ||
-            evidence.provider.id !== PROCESS_PROVIDER.id ||
-            evidence.provider.name !== PROCESS_PROVIDER.name ||
-            evidence.provider.version !== PROCESS_PROVIDER.version ||
-            evidence.confidence !== "observed" ||
-            evidence.authority !== "controlled-replay" ||
-            evidenceCapture === undefined ||
-            canonicalize(evidenceCapture) !== canonicalize(capture))
-            return err(new EvidenceIntegrityError("Process comparison payload does not match its source Evidence"));
-    }
-    return { ok: true, value: null };
-};
 const comparisonUnknownInput = (parsed, comparison) => {
     if (parsed.unknown_registry_approved !== true ||
         comparison.status === "unchanged")