rea-agents 2.0.0 → 2.1.0

package/dist/server/registerInvestigationTools/helpers.js

@@ -0,0 +1,74 @@
+import { EvidenceIntegrityError, } from "../../domain/errors.js";
+import { err, ok } from "../../domain/result.js";
+import { recordDerivedEvidence } from "../recordDerivedEvidence.js";
+import { evaluateReconstructionClosure } from "../../domain/reconstructionCoverage.js";
+import { AnalysisInputError } from "../../domain/errors.js";
+/** Build the execution context passed to cross-version investigation. */
+export const investigationContext = ({ session, signal, inputRoots, integrityContinueEnabled, progress, }) => ({
+    session,
+    signal,
+    inputRoots,
+    integrityContinueEnabled,
+    ...(progress === undefined ? {} : { progress }),
+});
+export const isIncomplete = (status) => status === "unknown" || status === "truncated";
+export const comparisonClosure = (comparisons) => uniqueIds(comparisons.flatMap((evidence) => [
+    evidence.evidence_id,
+    ...evidence.evidence_links,
+]));
+export const functionEvidenceIds = (groups) => uniqueIds(groups.flatMap((group) => (Array.isArray(group) ? group : [group]).map(({ evidence_id: id }) => id)));
+const uniqueIds = (ids) => [...new Set(ids)].sort((left, right) => left.localeCompare(right));
+export const evidenceClosure = (session, seedIds) => {
+    const records = new Map(session
+        .exportEvidenceBundle()
+        .records.map((evidence) => [evidence.evidence_id, evidence]));
+    const visited = new Set();
+    const pending = [...seedIds];
+    while (pending.length > 0) {
+        const evidenceId = pending.pop();
+        if (evidenceId === undefined || visited.has(evidenceId))
+            continue;
+        const evidence = records.get(evidenceId);
+        if (evidence === undefined)
+            return err(new EvidenceIntegrityError("Investigation input has a dangling Evidence link"));
+        visited.add(evidenceId);
+        pending.push(...evidence.evidence_links);
+    }
+    return ok(uniqueIds([...visited]));
+};
+/** Verify a retained coverage boundary before reconstruction evidence is derived. */
+export const verifyCoverageReadiness = (session, coverage) => {
+    if (coverage === undefined)
+        return ok(null);
+    const workspace = session.reconstructionCoverageWorkspace(coverage.workspace_id, coverage.revision);
+    if (workspace === undefined ||
+        workspace.revision_sha256 !== coverage.revision_sha256)
+        return err(new EvidenceIntegrityError("The requested reconstruction coverage revision is not retained by this session"));
+    try {
+        const result = evaluateReconstructionClosure(workspace, coverage.boundary_id, Date.now());
+        return result.status === "ready"
+            ? ok(null)
+            : err(new EvidenceIntegrityError(`Reconstruction coverage boundary is ${result.status}; readiness requires ready`));
+    }
+    catch (cause) {
+        return err(new AnalysisInputError("verify_reconstruction", { cause }));
+    }
+};
+export const recordWorkflowEvidence = (...[session, evidence, approved, unresolved, input]) => {
+    if (approved !== true || !unresolved) {
+        return recordDerivedEvidence(session, evidence, undefined);
+    }
+    return recordDerivedEvidence(session, evidence, {
+        approved: true,
+        question: input.question,
+        severity: "high",
+        domain: input.domain,
+        supporting_evidence_ids: [evidence.evidence_id],
+        contradicting_evidence_ids: [],
+        required_authority: input.requiredAuthority,
+        required_confidence: input.requiredConfidence,
+        required_environment: null,
+        recommended_probes: [...input.probes],
+        relationships: [],
+    });
+};

package/dist/server/registerInvestigationTools/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/registerInvestigationTools.js

@@ -6,15 +6,14 @@ import { correlateStaticAndRuntime, staticRuntimeCorrelationInputSchema, } from
 import { reconstructionVerificationInputSchema, verifyReconstruction, } from "../domain/reconstructionVerification.js";
 import { changedBehaviorResultSchema, changedBehaviorInputSchema, findChangedBehavior, } from "../domain/changedBehavior.js";
 import { createEvidence } from "../domain/evidence.js";
-import { EvidenceIntegrityError, } from "../domain/errors.js";
+import {} from "../domain/errors.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
-import { err, ok } from "../domain/result.js";
 import { CALL_PATH_PROVIDER, CHANGED_BEHAVIOR_PROVIDER, RECONSTRUCTION_PROVIDER, STATIC_RUNTIME_PROVIDER, } from "./sessionToolPolicies.js";
 import { toCallToolResult } from "./toolResult.js";
-import { recordDerivedEvidence } from "./recordDerivedEvidence.js";
 import { mcpProgressReporter } from "./mcpProgress.js";
-import { runDerivedOperation } from "./runDerivedOperation.js";
+import { runDerivedOperation, } from "./runDerivedOperation.js";
 import { authorizeFileReadWithDeferredWrite, authorizeRootPermission, } from "../application/DeferredFileAuthorization.js";
+import { comparisonClosure, evidenceClosure, functionEvidenceIds, investigationContext, isIncomplete, recordWorkflowEvidence, verifyCoverageReadiness, } from "./registerInvestigationTools/helpers.js";
 /** Register Evidence-composed differential investigation workflows. */
 export const registerInvestigationTools = (server, session, contracts, policies) => {
     registerChangedBehavior(server, session, contracts[0], policies);
@@ -22,14 +21,6 @@ export const registerInvestigationTools = (server, session, contracts, policies)
     registerStaticRuntime(server, session, contracts[2]);
     registerReconstruction(server, session, contracts[3]);
 };
-const investigationExecution = (session, signal, inputRoots, integrityContinueEnabled, progress) => ({
-    session,
-    signal,
-    inputRoots,
-    integrityContinueEnabled,
-    ...(progress === undefined ? {} : { progress }),
-});
-const isIncomplete = (status) => status === "unknown" || status === "truncated";
 const registerChangedBehavior = (server, session, contract, policies) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
         const parsedInput = safeParseToolInput(changedBehaviorInputSchema, input, contract.name);
@@ -37,69 +28,16 @@ const registerChangedBehavior = (server, session, contract, policies) => {
             return toCallToolResult(parsedInput, contract);
         const parsed = parsedInput.value;
         const investigationRun = parsed.investigation_run;
-        if (investigationRun !== undefined) {
-            const progress = mcpProgressReporter(context);
-            let workspaceAuthorization;
-            let authorizeInputRead;
-            if (policies.permissionAuthority !== undefined) {
-                const authority = policies.permissionAuthority;
-                const authorizedWorkspace = await authorizeFileReadWithDeferredWrite(authority, {
-                    path: investigationRun.workspace_path,
-                    readCapability: "investigation_workspace_read",
-                    writeCapability: "investigation_workspace_write",
-                    operation: contract.name,
-                });
-                if (!authorizedWorkspace.ok)
-                    return toCallToolResult(authorizedWorkspace, contract);
-                workspaceAuthorization = authorizedWorkspace.value;
-                authorizeInputRead = () => authorizeRootPermission(authority, {
-                    capability: "investigation_input",
-                    roots: [investigationRun.left_path, investigationRun.right_path],
-                    access: "read",
-                    operation: contract.name,
-                });
-            }
-            const investigated = await runCrossVersionInvestigationValidated(investigationRun, policies.evidenceFiles, {
-                ...investigationExecution(session, context.mcpReq.signal, policies.inputRoots, policies.integrityContinueEnabled?.() ?? false, progress),
-                ...(workspaceAuthorization === undefined
-                    ? {}
-                    : {
-                        authorizeWorkspaceWrite: workspaceAuthorization.authorizeWrite,
-                    }),
-                ...(authorizeInputRead === undefined ? {} : { authorizeInputRead }),
+        if (investigationRun !== undefined)
+            return runAutomaticInvestigation({
+                server,
+                session,
+                contract,
+                policies,
+                investigationRun,
+                unknownRegistryApproved: parsed.unknown_registry_approved,
+                context,
             });
-            if (!investigated.ok)
-                return toCallToolResult(investigated, contract);
-            const workspace = investigated.value.workspace;
-            if (session.retainInvestigationWorkspace(workspace) === "added")
-                server.sendResourceListChanged();
-            const result = changedBehaviorResultSchema.parse(investigated.value.evidence.normalized_result);
-            const toolResult = toCallToolResult(recordWorkflowEvidence(session, investigated.value.evidence, parsed.unknown_registry_approved, isIncomplete(result.behavior_status), {
-                question: `Automatic changed behavior run ${result.investigation_run?.run_id ?? "unknown"} remains ${result.behavior_status}`,
-                domain: "changed-behavior",
-                requiredAuthority: "controlled-replay",
-                requiredConfidence: "observed",
-                probes: [
-                    {
-                        operation: "capture_process_scenario",
-                        rationale: "Capture both versions under the same bounded scenario and environment.",
-                    },
-                ],
-            }), contract);
-            return {
-                ...toolResult,
-                content: [
-                    ...toolResult.content,
-                    {
-                        type: "resource_link",
-                        uri: `rea://workspace/${workspace.workspace_id}/revision/${String(workspace.revision)}`,
-                        name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
-                        description: "Immutable CAS-linked investigation workspace revision",
-                        mimeType: "application/json",
-                    },
-                ],
-            };
-        }
         const closure = evidenceClosure(session, comparisonClosure(parsed.comparisons));
         if (!closure.ok)
             return toCallToolResult(closure, contract);
@@ -137,6 +75,74 @@ const registerChangedBehavior = (server, session, contract, policies) => {
         return toCallToolResult(recorded, contract);
     });
 };
+const runAutomaticInvestigation = async (input) => {
+    const { policies, investigationRun, contract, session } = input;
+    const progress = mcpProgressReporter(input.context);
+    let workspaceAuthorization;
+    let authorizeInputRead;
+    if (policies.permissionAuthority !== undefined) {
+        const authority = policies.permissionAuthority;
+        const authorizedWorkspace = await authorizeFileReadWithDeferredWrite(authority, {
+            path: investigationRun.workspace_path,
+            readCapability: "investigation_workspace_read",
+            writeCapability: "investigation_workspace_write",
+            operation: contract.name,
+        });
+        if (!authorizedWorkspace.ok)
+            return toCallToolResult(authorizedWorkspace, contract);
+        workspaceAuthorization = authorizedWorkspace.value;
+        authorizeInputRead = () => authorizeRootPermission(authority, {
+            capability: "investigation_input",
+            roots: [investigationRun.left_path, investigationRun.right_path],
+            access: "read",
+            operation: contract.name,
+        });
+    }
+    const investigated = await runCrossVersionInvestigationValidated(investigationRun, policies.evidenceFiles, {
+        ...investigationContext({
+            session,
+            signal: input.context.mcpReq.signal,
+            inputRoots: policies.inputRoots,
+            integrityContinueEnabled: policies.integrityContinueEnabled?.() ?? false,
+            progress,
+        }),
+        ...(workspaceAuthorization === undefined
+            ? {}
+            : { authorizeWorkspaceWrite: workspaceAuthorization.authorizeWrite }),
+        ...(authorizeInputRead === undefined ? {} : { authorizeInputRead }),
+    });
+    if (!investigated.ok)
+        return toCallToolResult(investigated, contract);
+    const workspace = investigated.value.workspace;
+    if (session.retainInvestigationWorkspace(workspace) === "added")
+        input.server.sendResourceListChanged();
+    const result = changedBehaviorResultSchema.parse(investigated.value.evidence.normalized_result);
+    const toolResult = toCallToolResult(recordWorkflowEvidence(session, investigated.value.evidence, input.unknownRegistryApproved, isIncomplete(result.behavior_status), {
+        question: `Automatic changed behavior run ${result.investigation_run?.run_id ?? "unknown"} remains ${result.behavior_status}`,
+        domain: "changed-behavior",
+        requiredAuthority: "controlled-replay",
+        requiredConfidence: "observed",
+        probes: [
+            {
+                operation: "capture_process_scenario",
+                rationale: "Capture both versions under the same bounded scenario and environment.",
+            },
+        ],
+    }), contract);
+    return {
+        ...toolResult,
+        content: [
+            ...toolResult.content,
+            {
+                type: "resource_link",
+                uri: `rea://workspace/${workspace.workspace_id}/revision/${String(workspace.revision)}`,
+                name: `${workspace.workspace_id} revision ${String(workspace.revision)}`,
+                description: "Immutable CAS-linked investigation workspace revision",
+                mimeType: "application/json",
+            },
+        ],
+    };
+};
 const registerCallPath = (server, session, contract) => {
     server.registerTool(contract.name, contractOptions(contract), async (input, context) => {
         const parsedInput = safeParseToolInput(callPathInputSchema, input, contract.name);
@@ -234,6 +240,9 @@ const registerReconstruction = (server, session, contract) => {
         if (!parsedInput.ok)
             return toCallToolResult(parsedInput, contract);
         const parsed = parsedInput.value;
+        const coverage = verifyCoverageReadiness(session, parsed.coverage);
+        if (!coverage.ok)
+            return toCallToolResult(coverage, contract);
         const owned = session.exportEvidenceBundle();
         const computed = await runDerivedOperation(context, contract.name, () => verifyReconstruction(parsed.specification, owned, parsed.offset, parsed.limit));
         if (!computed.ok)
@@ -271,45 +280,3 @@ const registerReconstruction = (server, session, contract) => {
     });
 };
 const contractOptions = toolRegistrationOptions;
-const comparisonClosure = (comparisons) => uniqueIds(comparisons.flatMap((evidence) => [
-    evidence.evidence_id,
-    ...evidence.evidence_links,
-]));
-const functionEvidenceIds = (groups) => uniqueIds(groups.flatMap((group) => (Array.isArray(group) ? group : [group]).map(({ evidence_id: id }) => id)));
-const uniqueIds = (ids) => [...new Set(ids)].sort((left, right) => left.localeCompare(right));
-const evidenceClosure = (session, seedIds) => {
-    const records = new Map(session
-        .exportEvidenceBundle()
-        .records.map((evidence) => [evidence.evidence_id, evidence]));
-    const visited = new Set();
-    const pending = [...seedIds];
-    while (pending.length > 0) {
-        const evidenceId = pending.pop();
-        if (evidenceId === undefined || visited.has(evidenceId))
-            continue;
-        const evidence = records.get(evidenceId);
-        if (evidence === undefined)
-            return err(new EvidenceIntegrityError("Investigation input has a dangling Evidence link"));
-        visited.add(evidenceId);
-        pending.push(...evidence.evidence_links);
-    }
-    return ok(uniqueIds([...visited]));
-};
-const recordWorkflowEvidence = (...[session, evidence, approved, unresolved, input]) => {
-    if (approved !== true || !unresolved) {
-        return recordDerivedEvidence(session, evidence, undefined);
-    }
-    return recordDerivedEvidence(session, evidence, {
-        approved: true,
-        question: input.question,
-        severity: "high",
-        domain: input.domain,
-        supporting_evidence_ids: [evidence.evidence_id],
-        contradicting_evidence_ids: [],
-        required_authority: input.requiredAuthority,
-        required_confidence: input.requiredConfidence,
-        required_environment: null,
-        recommended_probes: [...input.probes],
-        relationships: [],
-    });
-};

package/dist/server/registerManagedWorkflowTools/compareManagedMembers.js

@@ -0,0 +1,65 @@
+import { compareManagedMembersEvidenceValidated } from "../../application/ManagedMemberComparisonService.js";
+import { compareManagedMembersReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { managedMemberComparisonResultSchema } from "../../domain/managedMemberComparison.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedEvidence } from "./evidence.js";
+const compareContract = managedWorkflowContract("compare_managed_members");
+/** Register the managed member comparison workflow tool. */
+export const registerCompareManagedMembers = (server, options) => {
+    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
+        const parsedInput = safeParseToolInput(compareManagedMembersReferenceInputSchema, input, compareContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, compareContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.left_evidence_id,
+            parsedInput.value.right_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, compareContract);
+        const [left, right] = resolved.value;
+        if (left === undefined || right === undefined)
+            throw new TypeError("Managed comparison Evidence resolution failed");
+        const { left_evidence_id: _leftEvidenceId, right_evidence_id: _rightEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, left, right };
+        const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareManagedMembersEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, compareContract);
+        const recorded = recordManagedSources(options.recordEvidence, [
+            parsed.left,
+            parsed.right,
+        ]);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, compareContract);
+        const comparison = managedMemberComparisonResultSchema.parse(result.value.normalized_result);
+        const unknown = comparison.summary.unknown > 0;
+        const output = parsed.unknown_registry_approved === true && unknown
+            ? options.recordEvidenceWithUnknown?.(result.value, {
+                approved: true,
+                question: "Which managed members remain unmatched or ambiguous across these versions?",
+                severity: "medium",
+                domain: "managed-member-comparison",
+                supporting_evidence_ids: [result.value.evidence_id],
+                contradicting_evidence_ids: [],
+                required_authority: "shipped-artifact",
+                required_confidence: "observed",
+                required_environment: null,
+                recommended_probes: [
+                    {
+                        operation: "inspect_managed_members",
+                        rationale: "Repeat static member inspection with complete pages and method bodies.",
+                    },
+                ],
+                relationships: [],
+            })
+            : options.recordEvidence?.(result.value);
+        if (output !== undefined && !output.ok)
+            return toCallToolResult(output, compareContract);
+        return toCallToolResult({ ok: true, value: result.value }, compareContract, {
+            evidenceResourcesAvailable: output !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/contract.js

@@ -0,0 +1,8 @@
+import { MANAGED_WORKFLOW_TOOL_CONTRACTS } from "../../contracts/managedWorkflowToolContracts.js";
+/** Locate one managed workflow tool contract by exact name. */
+export const managedWorkflowContract = (name) => {
+    const found = MANAGED_WORKFLOW_TOOL_CONTRACTS.find((candidate) => candidate.name === name);
+    if (found === undefined)
+        throw new Error(`Missing ${name} contract`);
+    return found;
+};

package/dist/server/registerManagedWorkflowTools/evidence.js

@@ -0,0 +1,43 @@
+import { resolveSessionEvidenceIds } from "../sessionEvidence.js";
+export const resolveManagedEvidence = (session, evidenceIds) => resolveSessionEvidenceIds(session, evidenceIds, {
+    operation: "inspect_managed_members",
+    predicate: "rea.analysis/v2",
+});
+export const resolveManagedArtifactEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
+    operation: "inspect_managed_artifact",
+    predicate: "rea.analysis/v2",
+});
+export const resolveManagedBoundaryEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
+    operation: "inspect_managed_native_boundaries",
+    predicate: "rea.analysis/v2",
+});
+export const resolveNativeEvidence = (session, evidenceIds) => {
+    const records = [];
+    for (const evidenceId of evidenceIds) {
+        const operation = session.evidenceById(evidenceId)?.operation;
+        const expectedOperation = operation === "inspect_macho" || operation === "analyze_function"
+            ? operation
+            : "inspect_macho or analyze_function";
+        const resolved = resolveSessionEvidenceIds(session, [evidenceId], {
+            operation: expectedOperation,
+            predicate: "rea.analysis/v2",
+        });
+        if (!resolved.ok)
+            return resolved;
+        records.push(...resolved.value);
+    }
+    return { ok: true, value: records };
+};
+export const recordManagedSources = (recordEvidence, sources) => {
+    for (const source of sources) {
+        const recorded = recordEvidence?.(source);
+        if (recorded !== undefined && !recorded.ok)
+            return recorded;
+    }
+    return { ok: true, value: null };
+};
+export const sourceEvidence = (input) => [
+    input.managed_artifact,
+    input.managed_members,
+    input.managed_native_boundaries,
+].filter((evidence) => evidence !== undefined);

package/dist/server/registerManagedWorkflowTools/importManagedReconstruction.js

@@ -0,0 +1,39 @@
+import { importManagedReconstructionEvidenceValidated } from "../../application/ManagedReconstructionService.js";
+import { managedReconstructionReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { resolveManagedEvidence } from "./evidence.js";
+const reconstructionContract = managedWorkflowContract("import_managed_reconstruction");
+/** Register the managed reconstruction import workflow tool. */
+export const registerImportManagedReconstruction = (server, options) => {
+    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedReconstructionReferenceInputSchema, input, reconstructionContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, reconstructionContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.static_members_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, reconstructionContract);
+        const staticMembers = resolved.value[0];
+        if (staticMembers === undefined)
+            throw new TypeError("Managed reconstruction Evidence resolution failed");
+        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, static_members: staticMembers };
+        const result = await logToolExecution(options.logger, reconstructionContract.name, () => Promise.resolve(importManagedReconstructionEvidenceValidated(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, reconstructionContract);
+        const recordedSource = options.recordEvidence?.(parsed.static_members);
+        if (recordedSource !== undefined && !recordedSource.ok)
+            return toCallToolResult(recordedSource, reconstructionContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, reconstructionContract);
+        return toCallToolResult(result, reconstructionContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/planManagedRuntimeCorrelation.js

@@ -0,0 +1,39 @@
+import { planManagedRuntimeCorrelationEvidenceValidated } from "../../application/ManagedRuntimeCorrelationService.js";
+import { managedRuntimeCorrelationReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { resolveManagedEvidence } from "./evidence.js";
+const runtimeContract = managedWorkflowContract("plan_managed_runtime_correlation");
+/** Register the managed runtime correlation planning workflow tool. */
+export const registerPlanManagedRuntimeCorrelation = (server, options) => {
+    server.registerTool(runtimeContract.name, toolRegistrationOptions(runtimeContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedRuntimeCorrelationReferenceInputSchema, input, runtimeContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, runtimeContract);
+        const resolved = resolveManagedEvidence(options.session, [
+            parsedInput.value.static_members_evidence_id,
+        ]);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, runtimeContract);
+        const staticMembers = resolved.value[0];
+        if (staticMembers === undefined)
+            throw new TypeError("Managed runtime Evidence resolution failed");
+        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
+        const parsed = { ...referencedInput, static_members: staticMembers };
+        const result = await logToolExecution(options.logger, runtimeContract.name, () => Promise.resolve(planManagedRuntimeCorrelationEvidenceValidated(options.runtime, parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, runtimeContract);
+        const recordedSource = options.recordEvidence?.(parsed.static_members);
+        if (recordedSource !== undefined && !recordedSource.ok)
+            return toCallToolResult(recordedSource, runtimeContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, runtimeContract);
+        return toCallToolResult(result, runtimeContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js

@@ -0,0 +1,52 @@
+import { projectManagedApplicationGraphEvidence } from "../../application/ManagedApplicationGraphService.js";
+import { managedApplicationGraphReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedArtifactEvidence, resolveManagedBoundaryEvidence, resolveManagedEvidence, sourceEvidence, } from "./evidence.js";
+const graphContract = managedWorkflowContract("project_managed_application_graph");
+/** Register the managed application graph projection workflow tool. */
+export const registerProjectManagedApplicationGraph = (server, options) => {
+    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedApplicationGraphReferenceInputSchema, input, graphContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, graphContract);
+        const managedArtifact = parsedInput.value.managed_artifact_evidence_id === undefined
+            ? undefined
+            : resolveManagedArtifactEvidence(options.session, parsedInput.value.managed_artifact_evidence_id);
+        if (managedArtifact !== undefined && !managedArtifact.ok)
+            return toCallToolResult(managedArtifact, graphContract);
+        const managedMembers = parsedInput.value.managed_members_evidence_id === undefined
+            ? undefined
+            : resolveManagedEvidence(options.session, [
+                parsedInput.value.managed_members_evidence_id,
+            ]);
+        if (managedMembers !== undefined && !managedMembers.ok)
+            return toCallToolResult(managedMembers, graphContract);
+        const managedBoundaries = parsedInput.value.managed_native_boundaries_evidence_id === undefined
+            ? undefined
+            : resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_native_boundaries_evidence_id);
+        if (managedBoundaries !== undefined && !managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, graphContract);
+        const parsed = {
+            limits: parsedInput.value.limits,
+            managed_artifact: managedArtifact?.value[0],
+            managed_members: managedMembers?.value[0],
+            managed_native_boundaries: managedBoundaries?.value[0],
+        };
+        const result = await logToolExecution(options.logger, graphContract.name, () => Promise.resolve(projectManagedApplicationGraphEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, graphContract);
+        const recordedSources = recordManagedSources(options.recordEvidence, sourceEvidence(parsed));
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, graphContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, graphContract);
+        return toCallToolResult(result, graphContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js

@@ -0,0 +1,75 @@
+import { verifyManagedNativeBoundariesEvidence } from "../../application/ManagedNativeVerificationService.js";
+import { managedNativeVerificationReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { managedNativeVerificationResultSchema } from "../../domain/managedNativeVerification.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedBoundaryEvidence, resolveNativeEvidence, } from "./evidence.js";
+const nativeVerificationContract = managedWorkflowContract("verify_managed_native_boundaries");
+/** Register the managed/native boundary verification workflow tool. */
+export const registerVerifyManagedNativeBoundaries = (server, options) => {
+    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedNativeVerificationReferenceInputSchema, input, nativeVerificationContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, nativeVerificationContract);
+        const managedBoundaries = resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_boundaries_evidence_id);
+        if (!managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, nativeVerificationContract);
+        const nativeObservations = resolveNativeEvidence(options.session, parsedInput.value.native_observation_evidence_ids);
+        if (!nativeObservations.ok)
+            return toCallToolResult(nativeObservations, nativeVerificationContract);
+        const managedBoundary = managedBoundaries.value[0];
+        if (managedBoundary === undefined)
+            throw new TypeError("Managed boundary Evidence resolution failed");
+        const { managed_boundaries_evidence_id: _managedBoundariesEvidenceId, native_observation_evidence_ids: _nativeObservationEvidenceIds, ...referencedInput } = parsedInput.value;
+        const parsed = {
+            ...referencedInput,
+            managed_boundaries: managedBoundary,
+            native_observations: nativeObservations.value,
+        };
+        const result = await logToolExecution(options.logger, nativeVerificationContract.name, () => Promise.resolve(verifyManagedNativeBoundariesEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, nativeVerificationContract);
+        const recordedSources = recordManagedSources(options.recordEvidence, [
+            parsed.managed_boundaries,
+            ...parsed.native_observations,
+        ]);
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, nativeVerificationContract);
+        const verification = managedNativeVerificationResultSchema.parse(result.value.normalized_result);
+        const unknown = verification.summary.unresolved > 0 ||
+            verification.summary.contradicted > 0 ||
+            verification.summary.native_body_unresolved > 0;
+        const output = parsed.unknown_registry_approved === true && unknown
+            ? options.recordEvidenceWithUnknown?.(result.value, {
+                approved: true,
+                question: "Which managed/native boundaries remain unresolved or contradicted by the supplied native Evidence?",
+                severity: "medium",
+                domain: "managed-native-verification",
+                supporting_evidence_ids: [result.value.evidence_id],
+                contradicting_evidence_ids: [],
+                required_authority: "shipped-artifact",
+                required_confidence: "observed",
+                required_environment: null,
+                recommended_probes: [
+                    {
+                        operation: "inspect_managed_native_boundaries",
+                        rationale: "Repeat managed boundary inspection with complete ModuleRef, ImplMap, and native implementation pages.",
+                    },
+                    {
+                        operation: "analyze_function",
+                        rationale: "Analyze the provider-resolved native function candidate for the declared export.",
+                    },
+                ],
+                relationships: [],
+            })
+            : options.recordEvidence?.(result.value);
+        if (output !== undefined && !output.ok)
+            return toCallToolResult(output, nativeVerificationContract);
+        return toCallToolResult(result, nativeVerificationContract, {
+            evidenceResourcesAvailable: output !== undefined,
+        });
+    });
+};