rea-agents 2.0.0 → 2.2.0

package/dist/domain/managedNativeVerificationMatch.js

@@ -0,0 +1,272 @@
+import { createHash } from "node:crypto";
+import { basename } from "node:path";
+import canonicalize from "canonicalize";
+import { parseEvidence } from "./evidence.js";
+import { functionDossierSchema } from "./hopperValues.js";
+import { inspectMachoSchema } from "./nativeInspection.js";
+import { pinvokeVerificationSchema, } from "./managedNativeVerificationSchemas.js";
+const digest = (value) => {
+    const serialized = canonicalize(value);
+    if (serialized === undefined)
+        throw new TypeError("Managed/native verification canonicalization failed");
+    return createHash("sha256").update(serialized).digest("hex");
+};
+const moduleName = (evidence) => evidence.subject?.name ?? null;
+const modulePath = (evidence) => evidence.subject?.local_path ?? null;
+const symbolsForEvidence = (evidence) => {
+    if (evidence.operation === "inspect_macho") {
+        const result = inspectMachoSchema.parse(evidence.normalized_result);
+        return {
+            supported: true,
+            symbols: result.exports.items.map((symbol) => ({
+                evidence_id: evidence.evidence_id,
+                operation: evidence.operation,
+                name: symbol.name,
+                address: symbol.address,
+                module_name: moduleName(evidence),
+                module_path: modulePath(evidence),
+                source: "macho-export",
+            })),
+        };
+    }
+    if (evidence.operation === "analyze_function") {
+        const dossier = functionDossierSchema.parse(evidence.normalized_result);
+        return {
+            supported: true,
+            symbols: [
+                {
+                    evidence_id: evidence.evidence_id,
+                    operation: evidence.operation,
+                    name: dossier.procedure.name,
+                    address: dossier.procedure.address,
+                    module_name: moduleName(evidence),
+                    module_path: modulePath(evidence),
+                    source: "function-dossier",
+                },
+            ],
+        };
+    }
+    return { supported: false, symbols: [] };
+};
+export const collectNativeSymbols = (observations) => {
+    const symbols = [];
+    let accepted = 0;
+    let unsupported = 0;
+    for (const raw of observations) {
+        const evidence = parseEvidence(raw);
+        const extracted = symbolsForEvidence(evidence);
+        if (!extracted.supported) {
+            unsupported += 1;
+        }
+        else {
+            accepted += 1;
+            symbols.push(...extracted.symbols);
+        }
+    }
+    return { symbols, accepted, unsupported };
+};
+const normalizeSymbol = (value) => value.replace(/^_+/u, "").replace(/@\d+$/u, "").toLowerCase();
+const sameSymbolName = (left, right) => normalizeSymbol(left) === normalizeSymbol(right);
+const normalizeModule = (value) => basename(value)
+    .toLowerCase()
+    .replace(/^lib/u, "")
+    .replace(/\.(dll|dylib|so|node|exe)$/u, "");
+const moduleCompatible = (scope, symbol) => {
+    if (scope === null)
+        return true;
+    const expected = normalizeModule(scope);
+    return [symbol.module_name, symbol.module_path]
+        .filter((value) => value !== null)
+        .map(normalizeModule)
+        .some((value) => value === expected);
+};
+const candidateNames = (managed) => {
+    const names = new Set([managed.import_name]);
+    if (!managed.no_mangle) {
+        if (managed.char_set === "unicode")
+            names.add(`${managed.import_name}W`);
+        if (managed.char_set === "ansi")
+            names.add(`${managed.import_name}A`);
+        if (managed.call_convention === "stdcall") {
+            names.add(`_${managed.import_name}`);
+            names.add(`_${managed.import_name}@0`);
+        }
+    }
+    return [...names];
+};
+const selectCandidates = (managed, symbols, maxCandidates) => {
+    const names = candidateNames(managed);
+    const allCandidates = symbols.filter((symbol) => names.some((name) => sameSymbolName(name, symbol.name)));
+    const candidates = allCandidates.slice(0, maxCandidates);
+    const exact = candidates.find((symbol) => sameSymbolName(managed.import_name, symbol.name) &&
+        moduleCompatible(managed.import_scope_name, symbol));
+    const decorated = candidates.find((symbol) => moduleCompatible(managed.import_scope_name, symbol));
+    const selected = exact ?? decorated ?? candidates[0] ?? null;
+    return { allCandidates, candidates, selected, exact, decorated };
+};
+const basisAndStatus = (managed, selection, hasSupportedNativeEvidence) => {
+    const { selected, exact } = selection;
+    if (selected === null)
+        return {
+            basis: hasSupportedNativeEvidence
+                ? "no-native-candidate"
+                : "unsupported-native-evidence",
+            status: "unresolved",
+            confidence: "unknown",
+        };
+    if (!moduleCompatible(managed.import_scope_name, selected))
+        return {
+            basis: "module-mismatch",
+            status: "contradicted",
+            confidence: "unknown",
+        };
+    if (exact !== undefined)
+        return {
+            basis: selected.source === "macho-export"
+                ? "exact-export-name"
+                : "exact-function-name",
+            status: "verified",
+            confidence: "observed",
+        };
+    return {
+        basis: "decorated-name-candidate",
+        status: "inferred",
+        confidence: "inferred",
+    };
+};
+const pinvokeLimitations = (status, managed) => [
+    ...(managed.import_scope_name === null
+        ? ["Managed declaration does not name an import scope/module."]
+        : []),
+    ...(status === "inferred"
+        ? [
+            "Native symbol matched a decorated candidate rather than the exact declared import name.",
+        ]
+        : []),
+    ...(status === "contradicted"
+        ? [
+            "A symbol name candidate exists, but the supplied native Evidence module identity does not match the managed import scope.",
+        ]
+        : []),
+    ...(status === "unresolved"
+        ? [
+            "No supplied native export/function Evidence matched this declared import.",
+        ]
+        : []),
+];
+export const verifyPinvoke = ({ item, managedEvidenceId, symbols, hasSupportedNativeEvidence, input, }) => {
+    const managed = {
+        token: item.token,
+        member_token: item.member_token,
+        member_name: item.member_name,
+        import_name: item.import_name,
+        import_scope_name: item.import_scope_name,
+        no_mangle: item.no_mangle,
+        char_set: item.char_set,
+        call_convention: item.call_convention,
+        declaration_verification: item.verification,
+    };
+    const selection = selectCandidates(item, symbols, input.limits.max_candidates_per_import);
+    const { status, basis, confidence } = basisAndStatus(item, selection, hasSupportedNativeEvidence);
+    const limitations = pinvokeLimitations(status, item);
+    return {
+        verification: pinvokeVerificationSchema.parse({
+            item_id: `mnv_pinvoke_${digest({
+                managedEvidenceId,
+                token: item.token,
+                importName: item.import_name,
+                importScope: item.import_scope_name,
+                candidates: [...selection.candidates],
+            })}`,
+            managed,
+            status,
+            basis,
+            confidence,
+            matched_native: selection.selected,
+            candidates: selection.candidates,
+            evidence_links: [
+                managedEvidenceId,
+                ...new Set(selection.candidates.map(({ evidence_id: id }) => id)),
+            ],
+            limitations,
+        }),
+        omittedCandidates: Math.max(0, selection.allCandidates.length - selection.candidates.length),
+    };
+};
+const countStatuses = (items) => ({
+    verified: items.filter(({ status }) => status === "verified").length,
+    inferred: items.filter(({ status }) => status === "inferred").length,
+    unresolved: items.filter(({ status }) => status === "unresolved").length,
+    contradicted: items.filter(({ status }) => status === "contradicted").length,
+});
+export const buildVerificationResult = ({ managedEvidence, managed, native, pinvokeImports, verifiedPinvokes, input, }) => {
+    const counts = countStatuses(pinvokeImports);
+    const omittedNativeObservations = Math.max(0, input.native_observations.length - input.limits.max_native_observations);
+    const omittedCandidates = verifiedPinvokes.reduce((sum, item) => sum + item.omittedCandidates, 0);
+    const nativeBodyUnresolved = managed.native_implementations.items.filter(({ boundary_kind: kind }) => kind !== "pinvoke").length;
+    const coverageStatus = omittedNativeObservations > 0 || omittedCandidates > 0
+        ? "truncated"
+        : managed.coverage.state === "complete" && native.unsupported === 0
+            ? "complete-within-inputs"
+            : "partial";
+    return {
+        schema_version: 1,
+        algorithm: {
+            name: "rea-managed-native-verification",
+            version: 1,
+            token_identity: "build-local",
+            token_to_address_mapping: "not-inferred",
+        },
+        managed_boundary: {
+            evidence_id: managedEvidence.evidence_id,
+            artifact_sha256: managed.artifact.sha256,
+            artifact_path: managed.artifact.path,
+            mvid: managed.module?.mvid ?? null,
+            metadata_status: managed.metadata.status,
+            pinvoke_imports_total: managed.pinvoke_imports.total,
+            native_implementations_total: managed.native_implementations.total,
+            coverage_state: managed.coverage.state,
+        },
+        native_observations: {
+            total: input.native_observations.length,
+            accepted: native.accepted,
+            unsupported: native.unsupported,
+            symbols: native.symbols.length,
+            truncated: omittedNativeObservations > 0,
+        },
+        summary: {
+            ...counts,
+            native_body_unresolved: nativeBodyUnresolved,
+        },
+        pinvoke_imports: [...pinvokeImports],
+        native_implementations: {
+            unresolved: nativeBodyUnresolved,
+            reason: "Managed metadata tokens and RVAs are not translated to native provider addresses by this workflow; C++/CLI, ReadyToRun, and native-body mappings require explicit provider-supported bridge evidence.",
+        },
+        coverage: {
+            status: coverageStatus,
+            omitted_native_observations: omittedNativeObservations,
+            omitted_candidates: omittedCandidates,
+        },
+        evidence_links: [
+            managedEvidence.evidence_id,
+            ...input.native_observations
+                .slice(0, input.limits.max_native_observations)
+                .map(({ evidence_id: id }) => id),
+        ],
+        limitations: [
+            "P/Invoke verification checks declared import names against supplied native export or function-name Evidence only.",
+            "A matching native symbol verifies that a candidate export/function was observed; it does not prove CLR binding, marshaling behavior, call reachability, or runtime loading.",
+            "Missing supplied native symbols are reported as unresolved, not proof that a dependency cannot exist.",
+            "Managed metadata tokens and method RVAs are not interpreted as native addresses.",
+            ...(managed.coverage.state === "complete"
+                ? []
+                : ["Managed boundary input is partial or unavailable."]),
+            ...(native.unsupported === 0
+                ? []
+                : [
+                    "Some native Evidence operations were unsupported by this workflow.",
+                ]),
+        ],
+    };
+};

package/dist/domain/managedNativeVerificationSchemas.js

@@ -0,0 +1,141 @@
+import { z } from "zod";
+import { evidenceSchema } from "./evidence.js";
+import { cliMetadataGuidSchema } from "./managedArtifact.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
+const boundedTextSchema = z.string().min(1).max(4_096);
+const matchStatusSchema = z.enum([
+    "verified",
+    "inferred",
+    "unresolved",
+    "contradicted",
+]);
+const matchBasisSchema = z.enum([
+    "exact-export-name",
+    "exact-function-name",
+    "decorated-name-candidate",
+    "module-mismatch",
+    "no-native-candidate",
+    "unsupported-native-evidence",
+]);
+const nativeVerificationLimitsSchema = z.strictObject({
+    max_native_observations: z.number().int().min(1).max(50).default(20),
+    max_candidates_per_import: z.number().int().min(1).max(100).default(25),
+});
+const nativeSymbolSchema = z.strictObject({
+    evidence_id: evidenceIdSchema,
+    operation: z.string().min(1),
+    name: z.string().min(1),
+    address: z.string().nullable(),
+    module_name: z.string().nullable(),
+    module_path: z.string().nullable(),
+    source: z.enum(["macho-export", "function-dossier"]),
+});
+export const pinvokeVerificationSchema = z.strictObject({
+    item_id: z.string().regex(/^mnv_pinvoke_[a-f0-9]{64}$/u),
+    managed: z.strictObject({
+        token: tokenSchema,
+        member_token: tokenSchema.nullable(),
+        member_name: z.string().nullable(),
+        import_name: z.string().min(1),
+        import_scope_name: z.string().nullable(),
+        no_mangle: z.boolean(),
+        char_set: z.enum(["not-specified", "ansi", "unicode", "auto", "unknown"]),
+        call_convention: z.enum([
+            "not-specified",
+            "winapi",
+            "cdecl",
+            "stdcall",
+            "thiscall",
+            "fastcall",
+            "unknown",
+        ]),
+        declaration_verification: z.literal("managed-declaration-only"),
+    }),
+    status: matchStatusSchema,
+    basis: matchBasisSchema,
+    confidence: z.enum(["observed", "inferred", "unknown"]),
+    matched_native: nativeSymbolSchema.nullable(),
+    candidates: z.array(nativeSymbolSchema).max(100),
+    evidence_links: z.array(evidenceIdSchema).min(1).max(51),
+    limitations: z.array(boundedTextSchema).max(100),
+});
+/** Authenticated managed boundary Evidence plus native observations. */
+export const managedNativeVerificationInputSchema = z
+    .strictObject({
+    managed_boundaries: evidenceSchema,
+    native_observations: z.array(evidenceSchema).min(1).max(50),
+    limits: nativeVerificationLimitsSchema.default({
+        max_native_observations: 20,
+        max_candidates_per_import: 25,
+    }),
+    unknown_registry_approved: z.literal(true).optional(),
+})
+    .superRefine((input, context) => {
+    const ids = new Set();
+    for (const [index, evidence] of input.native_observations.entries()) {
+        if (evidence.evidence_id === input.managed_boundaries.evidence_id) {
+            context.addIssue({
+                code: "custom",
+                path: ["native_observations", index],
+                message: "Native observation Evidence must be distinct from managed boundary Evidence",
+            });
+        }
+        if (ids.has(evidence.evidence_id)) {
+            context.addIssue({
+                code: "custom",
+                path: ["native_observations", index],
+                message: "Native observation Evidence IDs must be unique",
+            });
+        }
+        ids.add(evidence.evidence_id);
+    }
+});
+/** Provider-neutral managed/native verification result. */
+export const managedNativeVerificationResultSchema = z.strictObject({
+    schema_version: z.literal(1),
+    verification_id: z.string().regex(/^mnv_[a-f0-9]{64}$/u),
+    algorithm: z.strictObject({
+        name: z.literal("rea-managed-native-verification"),
+        version: z.literal(1),
+        token_identity: z.literal("build-local"),
+        token_to_address_mapping: z.literal("not-inferred"),
+    }),
+    managed_boundary: z.strictObject({
+        evidence_id: evidenceIdSchema,
+        artifact_sha256: digestSchema,
+        artifact_path: z.string().min(1),
+        mvid: cliMetadataGuidSchema.nullable(),
+        metadata_status: z.enum(["absent", "complete", "partial", "malformed"]),
+        pinvoke_imports_total: z.number().int().min(0),
+        native_implementations_total: z.number().int().min(0),
+        coverage_state: z.enum(["complete", "partial", "unavailable"]),
+    }),
+    native_observations: z.strictObject({
+        total: z.number().int().min(1),
+        accepted: z.number().int().min(0),
+        unsupported: z.number().int().min(0),
+        symbols: z.number().int().min(0),
+        truncated: z.boolean(),
+    }),
+    summary: z.strictObject({
+        verified: z.number().int().min(0),
+        inferred: z.number().int().min(0),
+        unresolved: z.number().int().min(0),
+        contradicted: z.number().int().min(0),
+        native_body_unresolved: z.number().int().min(0),
+    }),
+    pinvoke_imports: z.array(pinvokeVerificationSchema).max(50_000),
+    native_implementations: z.strictObject({
+        unresolved: z.number().int().min(0),
+        reason: boundedTextSchema,
+    }),
+    coverage: z.strictObject({
+        status: z.enum(["complete-within-inputs", "partial", "truncated"]),
+        omitted_native_observations: z.number().int().min(0),
+        omitted_candidates: z.number().int().min(0),
+    }),
+    evidence_links: z.array(evidenceIdSchema).min(2).max(51),
+    limitations: z.array(boundedTextSchema).max(1_000),
+});

package/dist/domain/managedReconstruction.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
-import { managedMemberInspectionSchema } from "./managedArtifact.js";
+import { cliMetadataGuidSchema, managedMemberInspectionSchema, } from "./managedArtifact.js";
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
@@ -73,7 +73,7 @@ export const managedReconstructionImportResultSchema = z.strictObject({
         artifact_path: z.string().min(1),
         byte_length: z.number().int().min(0),
         module_name: z.string().nullable(),
-        mvid: z.string().uuid().nullable(),
+        mvid: cliMetadataGuidSchema.nullable(),
         metadata_status: z.enum(["absent", "complete", "partial", "malformed"]),
     }),
     decompiler: decompilerSchema.extend({
@@ -98,6 +98,82 @@ const sha256Json = (value) => {
         throw new TypeError("Managed reconstruction canonicalization failed");
     return createHash("sha256").update(serialized).digest("hex");
 };
+const countLines = (text) => text.length === 0 ? 0 : text.split(/\r\n|\r|\n/u).length;
+const findObservedMethod = (members, candidate) => members.methods.items.find((item) => item.token === candidate.token &&
+    item.signature.raw_sha256 === candidate.signature_sha256 &&
+    item.body.status === "present" &&
+    item.body.normalized_il_sha256 !== null &&
+    candidate.normalized_il_sha256 !== null &&
+    item.body.normalized_il_sha256 === candidate.normalized_il_sha256);
+const verifyTextSha256 = (candidate, textSha256) => {
+    if (candidate.reconstruction.text_sha256 !== undefined &&
+        candidate.reconstruction.text_sha256 !== textSha256)
+        throw new TypeError(`Reconstruction text hash mismatch for ${candidate.token}`);
+};
+const buildImportedMethod = (observed, candidate, textSha256) => ({
+    token: observed.token,
+    declaring_type: observed.declaring_type,
+    name: observed.name,
+    signature_sha256: observed.signature.raw_sha256,
+    normalized_il_sha256: observed.body.normalized_il_sha256,
+    body_sha256: observed.body.il_sha256,
+    il_size: observed.body.il_size,
+    reconstruction: {
+        kind: candidate.reconstruction.kind,
+        language: candidate.reconstruction.language,
+        text: candidate.reconstruction.text,
+        text_sha256: textSha256,
+        text_length: candidate.reconstruction.text.length,
+        line_count: countLines(candidate.reconstruction.text),
+        source_path: candidate.reconstruction.source_path ?? null,
+        start_line: candidate.reconstruction.start_line ?? null,
+        end_line: candidate.reconstruction.end_line ?? null,
+    },
+    validation: {
+        matched_static_member: true,
+        exact_build_required: true,
+        canonical_observation: false,
+        confidence_floor: "inference",
+    },
+});
+const buildReconstructionSummary = (methods) => ({
+    imported_methods: methods.length,
+    decompiled_csharp_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "decompiled-csharp").length,
+    decompiled_il_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "decompiled-il").length,
+    pseudocode_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "semantic-pseudocode").length,
+    total_text_bytes: methods.reduce((total, { reconstruction }) => total + reconstruction.text_length, 0),
+});
+const buildStaticObservation = (staticEvidence, members) => ({
+    evidence_id: staticEvidence.evidence_id,
+    artifact_sha256: members.artifact.sha256,
+    artifact_path: members.artifact.path,
+    byte_length: members.artifact.byte_length,
+    module_name: members.module?.name ?? null,
+    mvid: members.module?.mvid ?? null,
+    metadata_status: members.metadata.status,
+});
+const buildDecompilerRecord = (decompiler) => ({
+    ...decompiler,
+    options_sha256: sha256Json(decompiler.options),
+});
+const RECONSTRUCTION_LIMITATIONS = [
+    "Decompiler output is imported as reconstruction evidence and analyst inference; metadata and IL observations remain canonical.",
+    "This operation did not execute, load, reflect over, debug, instrument, patch, or decompile the target artifact.",
+    "The imported reconstruction is valid only for the exact artifact SHA-256, MVID, method signature, and normalized IL shape recorded here.",
+    "Obfuscated names, decompiler variables, and control-flow restructuring are not treated as proof without separate validation.",
+];
+const buildReconstructionWithoutId = (input, staticEvidence, members, methods) => ({
+    schema_version: 1,
+    phase: "reconstruction-import",
+    executed: false,
+    static_observation: buildStaticObservation(staticEvidence, members),
+    decompiler: buildDecompilerRecord(input.decompiler),
+    summary: buildReconstructionSummary(methods),
+    methods: [...methods],
+    notes: input.notes,
+    evidence_links: [staticEvidence.evidence_id],
+    limitations: RECONSTRUCTION_LIMITATIONS,
+});
 /** Authenticate decompiler reconstruction against static IL Evidence. */
 export const importManagedReconstruction = (input) => {
     const staticEvidence = parseEvidence(input.static_members);
@@ -105,79 +181,16 @@ export const importManagedReconstruction = (input) => {
         throw new TypeError("Evidence operation is not inspect_managed_members");
     const members = managedMemberInspectionSchema.parse(staticEvidence.normalized_result);
     const methods = input.methods.map((candidate) => {
-        const observed = members.methods.items.find((item) => item.token === candidate.token &&
-            item.signature.raw_sha256 === candidate.signature_sha256 &&
-            item.body.normalized_il_sha256 === candidate.normalized_il_sha256);
+        const observed = findObservedMethod(members, candidate);
         if (observed === undefined)
             throw new TypeError(`Reconstruction method lock ${candidate.token} does not match a static managed member observation`);
         const textSha256 = sha256Text(candidate.reconstruction.text);
-        if (candidate.reconstruction.text_sha256 !== undefined &&
-            candidate.reconstruction.text_sha256 !== textSha256)
-            throw new TypeError(`Reconstruction text hash mismatch for ${candidate.token}`);
-        return {
-            token: observed.token,
-            declaring_type: observed.declaring_type,
-            name: observed.name,
-            signature_sha256: observed.signature.raw_sha256,
-            normalized_il_sha256: observed.body.normalized_il_sha256,
-            body_sha256: observed.body.il_sha256,
-            il_size: observed.body.il_size,
-            reconstruction: {
-                kind: candidate.reconstruction.kind,
-                language: candidate.reconstruction.language,
-                text: candidate.reconstruction.text,
-                text_sha256: textSha256,
-                text_length: candidate.reconstruction.text.length,
-                line_count: countLines(candidate.reconstruction.text),
-                source_path: candidate.reconstruction.source_path ?? null,
-                start_line: candidate.reconstruction.start_line ?? null,
-                end_line: candidate.reconstruction.end_line ?? null,
-            },
-            validation: {
-                matched_static_member: true,
-                exact_build_required: true,
-                canonical_observation: false,
-                confidence_floor: "inference",
-            },
-        };
+        verifyTextSha256(candidate, textSha256);
+        return buildImportedMethod(observed, candidate, textSha256);
     });
-    const withoutId = {
-        schema_version: 1,
-        phase: "reconstruction-import",
-        executed: false,
-        static_observation: {
-            evidence_id: staticEvidence.evidence_id,
-            artifact_sha256: members.artifact.sha256,
-            artifact_path: members.artifact.path,
-            byte_length: members.artifact.byte_length,
-            module_name: members.module?.name ?? null,
-            mvid: members.module?.mvid ?? null,
-            metadata_status: members.metadata.status,
-        },
-        decompiler: {
-            ...input.decompiler,
-            options_sha256: sha256Json(input.decompiler.options),
-        },
-        summary: {
-            imported_methods: methods.length,
-            decompiled_csharp_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "decompiled-csharp").length,
-            decompiled_il_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "decompiled-il").length,
-            pseudocode_methods: methods.filter(({ reconstruction }) => reconstruction.kind === "semantic-pseudocode").length,
-            total_text_bytes: methods.reduce((total, { reconstruction }) => total + reconstruction.text_length, 0),
-        },
-        methods,
-        notes: input.notes,
-        evidence_links: [staticEvidence.evidence_id],
-        limitations: [
-            "Decompiler output is imported as reconstruction evidence and analyst inference; metadata and IL observations remain canonical.",
-            "This operation did not execute, load, reflect over, debug, instrument, patch, or decompile the target artifact.",
-            "The imported reconstruction is valid only for the exact artifact SHA-256, MVID, method signature, and normalized IL shape recorded here.",
-            "Obfuscated names, decompiler variables, and control-flow restructuring are not treated as proof without separate validation.",
-        ],
-    };
+    const withoutId = buildReconstructionWithoutId(input, staticEvidence, members, methods);
     return managedReconstructionImportResultSchema.parse({
         ...withoutId,
         reconstruction_id: `mre_${sha256Json(withoutId)}`,
     });
 };
-const countLines = (text) => text.length === 0 ? 0 : text.split(/\r\n|\r|\n/u).length;

package/dist/domain/managedRuntimeCorrelation.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
-import { managedMemberInspectionSchema } from "./managedArtifact.js";
+import { cliMetadataGuidSchema, managedMemberInspectionSchema, } from "./managedArtifact.js";
 const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
@@ -61,7 +61,7 @@ export const managedRuntimeCorrelationResultSchema = z.strictObject({
         artifact_path: z.string().min(1),
         byte_length: z.number().int().min(0),
         module_name: z.string().nullable(),
-        mvid: z.string().uuid().nullable(),
+        mvid: cliMetadataGuidSchema.nullable(),
         metadata_status: z.enum(["absent", "complete", "partial", "malformed"]),
     }),
     method_lock: z.strictObject({
@@ -72,7 +72,13 @@ export const managedRuntimeCorrelationResultSchema = z.strictObject({
         normalized_il_sha256: digestSchema.nullable(),
         body_sha256: digestSchema.nullable(),
         il_size: z.number().int().min(0),
-        body_status: z.enum(["present", "absent", "malformed", "too-large"]),
+        body_status: z.enum([
+            "present",
+            "partial",
+            "absent",
+            "malformed",
+            "too-large",
+        ]),
         exact_build_required: z.literal(true),
     }),
     requested_runtime: z.strictObject({
@@ -109,6 +115,9 @@ export const planManagedRuntimeCorrelation = (input, executablePath, permissionG
     const members = managedMemberInspectionSchema.parse(staticEvidence.normalized_result);
     const method = members.methods.items.find((item) => item.token === input.method.token &&
         item.signature.raw_sha256 === input.method.signature_sha256 &&
+        item.body.status === "present" &&
+        item.body.normalized_il_sha256 !== null &&
+        input.method.normalized_il_sha256 !== null &&
         item.body.normalized_il_sha256 === input.method.normalized_il_sha256);
     if (method === undefined)
         throw new TypeError("Requested method lock does not match a static managed member observation");