rea-agents 2.0.0 → 2.2.0

package/dist/server/registerManagedWorkflowTools/projectManagedApplicationGraph.js

@@ -0,0 +1,52 @@
+import { projectManagedApplicationGraphEvidence } from "../../application/ManagedApplicationGraphService.js";
+import { managedApplicationGraphReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedArtifactEvidence, resolveManagedBoundaryEvidence, resolveManagedEvidence, sourceEvidence, } from "./evidence.js";
+const graphContract = managedWorkflowContract("project_managed_application_graph");
+/** Register the managed application graph projection workflow tool. */
+export const registerProjectManagedApplicationGraph = (server, options) => {
+    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedApplicationGraphReferenceInputSchema, input, graphContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, graphContract);
+        const managedArtifact = parsedInput.value.managed_artifact_evidence_id === undefined
+            ? undefined
+            : resolveManagedArtifactEvidence(options.session, parsedInput.value.managed_artifact_evidence_id);
+        if (managedArtifact !== undefined && !managedArtifact.ok)
+            return toCallToolResult(managedArtifact, graphContract);
+        const managedMembers = parsedInput.value.managed_members_evidence_id === undefined
+            ? undefined
+            : resolveManagedEvidence(options.session, [
+                parsedInput.value.managed_members_evidence_id,
+            ]);
+        if (managedMembers !== undefined && !managedMembers.ok)
+            return toCallToolResult(managedMembers, graphContract);
+        const managedBoundaries = parsedInput.value.managed_native_boundaries_evidence_id === undefined
+            ? undefined
+            : resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_native_boundaries_evidence_id);
+        if (managedBoundaries !== undefined && !managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, graphContract);
+        const parsed = {
+            limits: parsedInput.value.limits,
+            managed_artifact: managedArtifact?.value[0],
+            managed_members: managedMembers?.value[0],
+            managed_native_boundaries: managedBoundaries?.value[0],
+        };
+        const result = await logToolExecution(options.logger, graphContract.name, () => Promise.resolve(projectManagedApplicationGraphEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, graphContract);
+        const recordedSources = recordManagedSources(options.recordEvidence, sourceEvidence(parsed));
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, graphContract);
+        const recorded = options.recordEvidence?.(result.value);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, graphContract);
+        return toCallToolResult(result, graphContract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/registerManagedWorkflowTools/verifyManagedNativeBoundaries.js

@@ -0,0 +1,75 @@
+import { verifyManagedNativeBoundariesEvidence } from "../../application/ManagedNativeVerificationService.js";
+import { managedNativeVerificationReferenceInputSchema } from "../../contracts/managedWorkflowToolContracts.js";
+import { managedNativeVerificationResultSchema } from "../../domain/managedNativeVerification.js";
+import { logToolExecution } from "../toolLogging.js";
+import { toCallToolResult } from "../toolResult.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { managedWorkflowContract } from "./contract.js";
+import { recordManagedSources, resolveManagedBoundaryEvidence, resolveNativeEvidence, } from "./evidence.js";
+const nativeVerificationContract = managedWorkflowContract("verify_managed_native_boundaries");
+/** Register the managed/native boundary verification workflow tool. */
+export const registerVerifyManagedNativeBoundaries = (server, options) => {
+    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
+        const parsedInput = safeParseToolInput(managedNativeVerificationReferenceInputSchema, input, nativeVerificationContract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, nativeVerificationContract);
+        const managedBoundaries = resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_boundaries_evidence_id);
+        if (!managedBoundaries.ok)
+            return toCallToolResult(managedBoundaries, nativeVerificationContract);
+        const nativeObservations = resolveNativeEvidence(options.session, parsedInput.value.native_observation_evidence_ids);
+        if (!nativeObservations.ok)
+            return toCallToolResult(nativeObservations, nativeVerificationContract);
+        const managedBoundary = managedBoundaries.value[0];
+        if (managedBoundary === undefined)
+            throw new TypeError("Managed boundary Evidence resolution failed");
+        const { managed_boundaries_evidence_id: _managedBoundariesEvidenceId, native_observation_evidence_ids: _nativeObservationEvidenceIds, ...referencedInput } = parsedInput.value;
+        const parsed = {
+            ...referencedInput,
+            managed_boundaries: managedBoundary,
+            native_observations: nativeObservations.value,
+        };
+        const result = await logToolExecution(options.logger, nativeVerificationContract.name, () => Promise.resolve(verifyManagedNativeBoundariesEvidence(parsed)));
+        if (!result.ok)
+            return toCallToolResult(result, nativeVerificationContract);
+        const recordedSources = recordManagedSources(options.recordEvidence, [
+            parsed.managed_boundaries,
+            ...parsed.native_observations,
+        ]);
+        if (!recordedSources.ok)
+            return toCallToolResult(recordedSources, nativeVerificationContract);
+        const verification = managedNativeVerificationResultSchema.parse(result.value.normalized_result);
+        const unknown = verification.summary.unresolved > 0 ||
+            verification.summary.contradicted > 0 ||
+            verification.summary.native_body_unresolved > 0;
+        const output = parsed.unknown_registry_approved === true && unknown
+            ? options.recordEvidenceWithUnknown?.(result.value, {
+                approved: true,
+                question: "Which managed/native boundaries remain unresolved or contradicted by the supplied native Evidence?",
+                severity: "medium",
+                domain: "managed-native-verification",
+                supporting_evidence_ids: [result.value.evidence_id],
+                contradicting_evidence_ids: [],
+                required_authority: "shipped-artifact",
+                required_confidence: "observed",
+                required_environment: null,
+                recommended_probes: [
+                    {
+                        operation: "inspect_managed_native_boundaries",
+                        rationale: "Repeat managed boundary inspection with complete ModuleRef, ImplMap, and native implementation pages.",
+                    },
+                    {
+                        operation: "analyze_function",
+                        rationale: "Analyze the provider-resolved native function candidate for the declared export.",
+                    },
+                ],
+                relationships: [],
+            })
+            : options.recordEvidence?.(result.value);
+        if (output !== undefined && !output.ok)
+            return toCallToolResult(output, nativeVerificationContract);
+        return toCallToolResult(result, nativeVerificationContract, {
+            evidenceResourcesAvailable: output !== undefined,
+        });
+    });
+};

package/dist/server/registerManagedWorkflowTools.js

@@ -1,277 +1,13 @@
-import { compareManagedMembersEvidenceValidated } from "../application/ManagedMemberComparisonService.js";
-import { projectManagedApplicationGraphEvidence } from "../application/ManagedApplicationGraphService.js";
-import { verifyManagedNativeBoundariesEvidence } from "../application/ManagedNativeVerificationService.js";
-import { importManagedReconstructionEvidenceValidated } from "../application/ManagedReconstructionService.js";
-import { planManagedRuntimeCorrelationEvidenceValidated, } from "../application/ManagedRuntimeCorrelationService.js";
-import { compareManagedMembersReferenceInputSchema, managedApplicationGraphReferenceInputSchema, managedNativeVerificationReferenceInputSchema, managedReconstructionReferenceInputSchema, managedRuntimeCorrelationReferenceInputSchema, MANAGED_WORKFLOW_TOOL_CONTRACTS, } from "../contracts/managedWorkflowToolContracts.js";
-import { managedMemberComparisonResultSchema } from "../domain/managedMemberComparison.js";
-import { managedNativeVerificationResultSchema } from "../domain/managedNativeVerification.js";
-import { logToolExecution } from "./toolLogging.js";
-import { toCallToolResult } from "./toolResult.js";
-import { toolRegistrationOptions } from "./toolRegistrationOptions.js";
-import { safeParseToolInput } from "./toolInputValidation.js";
-import { resolveSessionEvidenceIds } from "./sessionEvidence.js";
+import { registerCompareManagedMembers } from "./registerManagedWorkflowTools/compareManagedMembers.js";
+import { registerVerifyManagedNativeBoundaries } from "./registerManagedWorkflowTools/verifyManagedNativeBoundaries.js";
+import { registerImportManagedReconstruction } from "./registerManagedWorkflowTools/importManagedReconstruction.js";
+import { registerPlanManagedRuntimeCorrelation } from "./registerManagedWorkflowTools/planManagedRuntimeCorrelation.js";
+import { registerProjectManagedApplicationGraph } from "./registerManagedWorkflowTools/projectManagedApplicationGraph.js";
 /** Register provider-neutral managed-code workflows. */
 export const registerManagedWorkflowTools = (server, options) => {
-    const compareContract = contract("compare_managed_members");
-    const nativeVerificationContract = contract("verify_managed_native_boundaries");
-    const reconstructionContract = contract("import_managed_reconstruction");
-    const runtimeContract = contract("plan_managed_runtime_correlation");
-    const graphContract = contract("project_managed_application_graph");
-    server.registerTool(compareContract.name, toolRegistrationOptions(compareContract), async (input) => {
-        const parsedInput = safeParseToolInput(compareManagedMembersReferenceInputSchema, input, compareContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, compareContract);
-        const resolved = resolveManagedEvidence(options.session, [
-            parsedInput.value.left_evidence_id,
-            parsedInput.value.right_evidence_id,
-        ]);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, compareContract);
-        const [left, right] = resolved.value;
-        if (left === undefined || right === undefined)
-            throw new TypeError("Managed comparison Evidence resolution failed");
-        const { left_evidence_id: _leftEvidenceId, right_evidence_id: _rightEvidenceId, ...referencedInput } = parsedInput.value;
-        const parsed = { ...referencedInput, left, right };
-        const result = await logToolExecution(options.logger, compareContract.name, () => Promise.resolve(compareManagedMembersEvidenceValidated(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, compareContract);
-        const recorded = recordSources(options.recordEvidence, [
-            parsed.left,
-            parsed.right,
-        ]);
-        if (!recorded.ok)
-            return toCallToolResult(recorded, compareContract);
-        const comparison = managedMemberComparisonResultSchema.parse(result.value.normalized_result);
-        const unknown = comparison.summary.unknown > 0;
-        const output = parsed.unknown_registry_approved === true && unknown
-            ? options.recordEvidenceWithUnknown?.(result.value, {
-                approved: true,
-                question: "Which managed members remain unmatched or ambiguous across these versions?",
-                severity: "medium",
-                domain: "managed-member-comparison",
-                supporting_evidence_ids: [result.value.evidence_id],
-                contradicting_evidence_ids: [],
-                required_authority: "shipped-artifact",
-                required_confidence: "observed",
-                required_environment: null,
-                recommended_probes: [
-                    {
-                        operation: "inspect_managed_members",
-                        rationale: "Repeat static member inspection with complete pages and method bodies.",
-                    },
-                ],
-                relationships: [],
-            })
-            : options.recordEvidence?.(result.value);
-        if (output !== undefined && !output.ok)
-            return toCallToolResult(output, compareContract);
-        return toCallToolResult({ ok: true, value: result.value }, compareContract, {
-            evidenceResourcesAvailable: output !== undefined,
-        });
-    });
-    server.registerTool(nativeVerificationContract.name, toolRegistrationOptions(nativeVerificationContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedNativeVerificationReferenceInputSchema, input, nativeVerificationContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, nativeVerificationContract);
-        const managedBoundaries = resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_boundaries_evidence_id);
-        if (!managedBoundaries.ok)
-            return toCallToolResult(managedBoundaries, nativeVerificationContract);
-        const nativeObservations = resolveNativeEvidence(options.session, parsedInput.value.native_observation_evidence_ids);
-        if (!nativeObservations.ok)
-            return toCallToolResult(nativeObservations, nativeVerificationContract);
-        const managedBoundary = managedBoundaries.value[0];
-        if (managedBoundary === undefined)
-            throw new TypeError("Managed boundary Evidence resolution failed");
-        const { managed_boundaries_evidence_id: _managedBoundariesEvidenceId, native_observation_evidence_ids: _nativeObservationEvidenceIds, ...referencedInput } = parsedInput.value;
-        const parsed = {
-            ...referencedInput,
-            managed_boundaries: managedBoundary,
-            native_observations: nativeObservations.value,
-        };
-        const result = await logToolExecution(options.logger, nativeVerificationContract.name, () => Promise.resolve(verifyManagedNativeBoundariesEvidence(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, nativeVerificationContract);
-        const recordedSources = recordSources(options.recordEvidence, [
-            parsed.managed_boundaries,
-            ...parsed.native_observations,
-        ]);
-        if (!recordedSources.ok)
-            return toCallToolResult(recordedSources, nativeVerificationContract);
-        const verification = managedNativeVerificationResultSchema.parse(result.value.normalized_result);
-        const unknown = verification.summary.unresolved > 0 ||
-            verification.summary.contradicted > 0 ||
-            verification.summary.native_body_unresolved > 0;
-        const output = parsed.unknown_registry_approved === true && unknown
-            ? options.recordEvidenceWithUnknown?.(result.value, {
-                approved: true,
-                question: "Which managed/native boundaries remain unresolved or contradicted by the supplied native Evidence?",
-                severity: "medium",
-                domain: "managed-native-verification",
-                supporting_evidence_ids: [result.value.evidence_id],
-                contradicting_evidence_ids: [],
-                required_authority: "shipped-artifact",
-                required_confidence: "observed",
-                required_environment: null,
-                recommended_probes: [
-                    {
-                        operation: "inspect_managed_native_boundaries",
-                        rationale: "Repeat managed boundary inspection with complete ModuleRef, ImplMap, and native implementation pages.",
-                    },
-                    {
-                        operation: "analyze_function",
-                        rationale: "Analyze the provider-resolved native function candidate for the declared export.",
-                    },
-                ],
-                relationships: [],
-            })
-            : options.recordEvidence?.(result.value);
-        if (output !== undefined && !output.ok)
-            return toCallToolResult(output, nativeVerificationContract);
-        return toCallToolResult(result, nativeVerificationContract, {
-            evidenceResourcesAvailable: output !== undefined,
-        });
-    });
-    server.registerTool(reconstructionContract.name, toolRegistrationOptions(reconstructionContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedReconstructionReferenceInputSchema, input, reconstructionContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, reconstructionContract);
-        const resolved = resolveManagedEvidence(options.session, [
-            parsedInput.value.static_members_evidence_id,
-        ]);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, reconstructionContract);
-        const staticMembers = resolved.value[0];
-        if (staticMembers === undefined)
-            throw new TypeError("Managed reconstruction Evidence resolution failed");
-        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
-        const parsed = { ...referencedInput, static_members: staticMembers };
-        const result = await logToolExecution(options.logger, reconstructionContract.name, () => Promise.resolve(importManagedReconstructionEvidenceValidated(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, reconstructionContract);
-        const recordedSource = options.recordEvidence?.(parsed.static_members);
-        if (recordedSource !== undefined && !recordedSource.ok)
-            return toCallToolResult(recordedSource, reconstructionContract);
-        const recorded = options.recordEvidence?.(result.value);
-        if (recorded !== undefined && !recorded.ok)
-            return toCallToolResult(recorded, reconstructionContract);
-        return toCallToolResult(result, reconstructionContract, {
-            evidenceResourcesAvailable: recorded !== undefined,
-        });
-    });
-    server.registerTool(runtimeContract.name, toolRegistrationOptions(runtimeContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedRuntimeCorrelationReferenceInputSchema, input, runtimeContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, runtimeContract);
-        const resolved = resolveManagedEvidence(options.session, [
-            parsedInput.value.static_members_evidence_id,
-        ]);
-        if (!resolved.ok)
-            return toCallToolResult(resolved, runtimeContract);
-        const staticMembers = resolved.value[0];
-        if (staticMembers === undefined)
-            throw new TypeError("Managed runtime Evidence resolution failed");
-        const { static_members_evidence_id: _staticMembersEvidenceId, ...referencedInput } = parsedInput.value;
-        const parsed = { ...referencedInput, static_members: staticMembers };
-        const result = await logToolExecution(options.logger, runtimeContract.name, () => planManagedRuntimeCorrelationEvidenceValidated(options.runtime, parsed));
-        if (!result.ok)
-            return toCallToolResult(result, runtimeContract);
-        const recordedSource = options.recordEvidence?.(parsed.static_members);
-        if (recordedSource !== undefined && !recordedSource.ok)
-            return toCallToolResult(recordedSource, runtimeContract);
-        const recorded = options.recordEvidence?.(result.value);
-        if (recorded !== undefined && !recorded.ok)
-            return toCallToolResult(recorded, runtimeContract);
-        return toCallToolResult(result, runtimeContract, {
-            evidenceResourcesAvailable: recorded !== undefined,
-        });
-    });
-    server.registerTool(graphContract.name, toolRegistrationOptions(graphContract), async (input) => {
-        const parsedInput = safeParseToolInput(managedApplicationGraphReferenceInputSchema, input, graphContract.name);
-        if (!parsedInput.ok)
-            return toCallToolResult(parsedInput, graphContract);
-        const managedArtifact = parsedInput.value.managed_artifact_evidence_id === undefined
-            ? undefined
-            : resolveManagedArtifactEvidence(options.session, parsedInput.value.managed_artifact_evidence_id);
-        if (managedArtifact !== undefined && !managedArtifact.ok)
-            return toCallToolResult(managedArtifact, graphContract);
-        const managedMembers = parsedInput.value.managed_members_evidence_id === undefined
-            ? undefined
-            : resolveManagedEvidence(options.session, [
-                parsedInput.value.managed_members_evidence_id,
-            ]);
-        if (managedMembers !== undefined && !managedMembers.ok)
-            return toCallToolResult(managedMembers, graphContract);
-        const managedBoundaries = parsedInput.value.managed_native_boundaries_evidence_id === undefined
-            ? undefined
-            : resolveManagedBoundaryEvidence(options.session, parsedInput.value.managed_native_boundaries_evidence_id);
-        if (managedBoundaries !== undefined && !managedBoundaries.ok)
-            return toCallToolResult(managedBoundaries, graphContract);
-        const parsed = {
-            limits: parsedInput.value.limits,
-            managed_artifact: managedArtifact?.value[0],
-            managed_members: managedMembers?.value[0],
-            managed_native_boundaries: managedBoundaries?.value[0],
-        };
-        const result = await logToolExecution(options.logger, graphContract.name, () => Promise.resolve(projectManagedApplicationGraphEvidence(parsed)));
-        if (!result.ok)
-            return toCallToolResult(result, graphContract);
-        const recordedSources = recordSources(options.recordEvidence, sourceEvidence(parsed));
-        if (!recordedSources.ok)
-            return toCallToolResult(recordedSources, graphContract);
-        const recorded = options.recordEvidence?.(result.value);
-        if (recorded !== undefined && !recorded.ok)
-            return toCallToolResult(recorded, graphContract);
-        return toCallToolResult(result, graphContract, {
-            evidenceResourcesAvailable: recorded !== undefined,
-        });
-    });
+    registerCompareManagedMembers(server, options);
+    registerVerifyManagedNativeBoundaries(server, options);
+    registerImportManagedReconstruction(server, options);
+    registerPlanManagedRuntimeCorrelation(server, options);
+    registerProjectManagedApplicationGraph(server, options);
 };
-const contract = (name) => {
-    const found = MANAGED_WORKFLOW_TOOL_CONTRACTS.find((candidate) => candidate.name === name);
-    if (found === undefined)
-        throw new Error(`Missing ${name} contract`);
-    return found;
-};
-const resolveManagedEvidence = (session, evidenceIds) => resolveSessionEvidenceIds(session, evidenceIds, {
-    operation: "inspect_managed_members",
-    predicate: "rea.analysis/v2",
-});
-const resolveManagedArtifactEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
-    operation: "inspect_managed_artifact",
-    predicate: "rea.analysis/v2",
-});
-const resolveManagedBoundaryEvidence = (session, evidenceId) => resolveSessionEvidenceIds(session, [evidenceId], {
-    operation: "inspect_managed_native_boundaries",
-    predicate: "rea.analysis/v2",
-});
-const resolveNativeEvidence = (session, evidenceIds) => {
-    const records = [];
-    for (const evidenceId of evidenceIds) {
-        const operation = session.evidenceById(evidenceId)?.operation;
-        const expectedOperation = operation === "inspect_macho" || operation === "analyze_function"
-            ? operation
-            : "inspect_macho or analyze_function";
-        const resolved = resolveSessionEvidenceIds(session, [evidenceId], {
-            operation: expectedOperation,
-            predicate: "rea.analysis/v2",
-        });
-        if (!resolved.ok)
-            return resolved;
-        records.push(...resolved.value);
-    }
-    return { ok: true, value: records };
-};
-const recordSources = (recordEvidence, sources) => {
-    for (const source of sources) {
-        const recorded = recordEvidence?.(source);
-        if (recorded !== undefined && !recorded.ok)
-            return recorded;
-    }
-    return { ok: true, value: null };
-};
-const sourceEvidence = (input) => [
-    input.managed_artifact,
-    input.managed_members,
-    input.managed_native_boundaries,
-].filter((evidence) => evidence !== undefined);

package/dist/server/registerOfficialTools.js

@@ -25,70 +25,84 @@ const registerOfficialTool = (server, analysis, contract, registration) => {
             return toCallToolResult(parsedInput, contract);
         const arguments_ = projectOfficialArguments(contract, parsedInput.value);
         const progress = mcpProgressReporter(context);
-        await progress.report({
-            phase: contract.name,
-            completed: 0,
-            total: 1,
-            message: "started",
-        });
-        const result = await logToolExecution(registration.logger, contract.name, () => analysis.execute(contract.name, arguments_, {
+        const result = await runOfficialOperation(analysis, contract, arguments_, {
+            logger: registration.logger,
             signal: context.mcpReq.signal,
             progress,
-        }));
-        await progress.report({
-            phase: contract.name,
-            completed: 1,
-            total: 1,
-            message: result.ok ? "completed" : "failed",
-            terminal: true,
         });
-        if (result.ok) {
-            const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
-                operation: contract.name,
-                parameters: arguments_,
-                result: result.value.result,
-                ...(result.value.analysisProfile === undefined
-                    ? {}
-                    : { analysisProfile: result.value.analysisProfile }),
-                rawResult: result.value.rawResult,
-                limitations: result.value.limitations,
-                locations: result.value.locations,
-            });
-            const recorded = registration.recordEvidence?.(evidence);
-            if (recorded !== undefined && !recorded.ok)
-                return toCallToolResult(recorded, contract);
-            return toCallToolResult({ ok: true, value: evidence }, contract, {
-                evidenceResourcesAvailable: recorded !== undefined,
-            });
-        }
-        if (result.error instanceof AnalysisCapabilityUnavailableError &&
-            approvedUnknownTracking(input) &&
-            registration.recordUnknown !== undefined) {
-            const unknown = registration.recordUnknown({
-                approved: true,
-                question: "The requested analysis is unavailable for the current target.",
-                severity: "medium",
-                domain: "analysis-capability",
-                supporting_evidence_ids: [],
-                contradicting_evidence_ids: [],
-                required_authority: "shipped-artifact",
-                required_confidence: "observed",
-                required_environment: null,
-                recommended_probes: [
-                    {
-                        operation: contract.name,
-                        rationale: "Choose another analysis or target that can answer this question.",
-                    },
-                ],
-                relationships: [],
-            });
-            if (!unknown.ok &&
-                !(unknown.error instanceof UnknownRegistryError &&
-                    unknown.error.reason === "already-exists"))
-                return toCallToolResult(unknown, contract);
+        if (!result.ok) {
+            const unknownError = recordOfficialUnknown(input, result.error, contract, registration.recordUnknown);
+            if (unknownError !== undefined)
+                return toCallToolResult(unknownError, contract);
+            return toCallToolResult(result, contract);
         }
-        return toCallToolResult(result, contract);
+        const evidence = createEvidence(result.value.subject ?? registration.activeTarget?.(), result.value.provider, {
+            operation: contract.name,
+            parameters: arguments_,
+            result: result.value.result,
+            ...(result.value.analysisProfile === undefined
+                ? {}
+                : { analysisProfile: result.value.analysisProfile }),
+            rawResult: result.value.rawResult,
+            limitations: result.value.limitations,
+            locations: result.value.locations,
+        });
+        const recorded = registration.recordEvidence?.(evidence);
+        if (recorded !== undefined && !recorded.ok)
+            return toCallToolResult(recorded, contract);
+        return toCallToolResult({ ok: true, value: evidence }, contract, {
+            evidenceResourcesAvailable: recorded !== undefined,
+        });
+    });
+};
+const runOfficialOperation = async (analysis, contract, arguments_, execution) => {
+    await execution.progress.report({
+        phase: contract.name,
+        completed: 0,
+        total: 1,
+        message: "started",
+    });
+    const result = await logToolExecution(execution.logger, contract.name, () => analysis.execute(contract.name, arguments_, {
+        signal: execution.signal,
+        progress: execution.progress,
+    }));
+    await execution.progress.report({
+        phase: contract.name,
+        completed: 1,
+        total: 1,
+        message: result.ok ? "completed" : "failed",
+        terminal: true,
+    });
+    return result;
+};
+const recordOfficialUnknown = (input, error, contract, recordUnknown) => {
+    if (!(error instanceof AnalysisCapabilityUnavailableError) ||
+        !approvedUnknownTracking(input) ||
+        recordUnknown === undefined)
+        return undefined;
+    const unknown = recordUnknown({
+        approved: true,
+        question: "The requested analysis is unavailable for the current target.",
+        severity: "medium",
+        domain: "analysis-capability",
+        supporting_evidence_ids: [],
+        contradicting_evidence_ids: [],
+        required_authority: "shipped-artifact",
+        required_confidence: "observed",
+        required_environment: null,
+        recommended_probes: [
+            {
+                operation: contract.name,
+                rationale: "Choose another analysis or target that can answer this question.",
+            },
+        ],
+        relationships: [],
     });
+    if (!unknown.ok &&
+        !(unknown.error instanceof UnknownRegistryError &&
+            unknown.error.reason === "already-exists"))
+        return unknown;
+    return undefined;
 };
 const projectOfficialArguments = (contract, input) => {
     const parsed = jsonObjectSchema.parse(input);