rea-agents 2.3.0 → 2.5.0

package/dist/domain/processReactiveTransition.js

@@ -75,7 +75,15 @@ const applyProcessReactiveTransition = (input) => {
             record,
         };
 };
-const effectObservationMatchesAction = (action, observation) => {
+const terminalControlObservationMatches = (action, payload) => {
+    if (action.type === "resize")
+        return (payload["type"] === "resize" &&
+            payload["data"] === `${String(action.columns)}x${String(action.rows)}`);
+    if (action.type === "close_stdin")
+        return payload["type"] === "stdin_close" && payload["data"] === "";
+    return payload["type"] === "signal" && payload["data"] === action.signal;
+};
+const effectObservationMatchesAction = (action, observation, committedSensitiveInputs) => {
     const payload = typeof observation.payload === "object" &&
         observation.payload !== null &&
         !Array.isArray(observation.payload)
@@ -98,14 +106,13 @@ const effectObservationMatchesAction = (action, observation) => {
     if (action.type === "send_input")
         return (payload["type"] === "input" &&
             payload["data"] ===
-                (action.sensitive
-                    ? `<redacted-input:${String(Buffer.byteLength(action.data))}-bytes>`
-                    : action.data));
-    if (action.type === "resize")
-        return (payload["type"] === "resize" &&
-            payload["data"] === `${String(action.columns)}x${String(action.rows)}`);
-    return payload["type"] === "signal" && payload["data"] === action.signal;
+                expectedInputEvidence(action.data, action.sensitive, committedSensitiveInputs));
+    return terminalControlObservationMatches(action, payload);
 };
+const expectedInputEvidence = (data, sensitive, committedSensitiveInput) => !sensitive ||
+    (committedSensitiveInput && /^<redacted-input:\d+-bytes>$/.test(data))
+    ? data
+    : `<redacted-input:${String(Buffer.byteLength(data))}-bytes>`;
 const failedProposal = (proposed, outcome) => ({
     kind: "finished",
     outcome,
@@ -113,7 +120,7 @@ const failedProposal = (proposed, outcome) => ({
     snapshot: { ...proposed.snapshot, status: "finished", outcome },
 });
 /** Commit a proposal only after the host reports every effect as successful. */
-export const commitProcessReactiveProposal = (scenario, proposed, results) => {
+export const commitProcessReactiveProposal = (scenario, proposed, results, options = {}) => {
     if (results.some(({ status }) => status === "target_lost"))
         return failedProposal(proposed, "target_lost");
     const state = scenario.states.find(({ id }) => id === proposed.snapshot.active_state);
@@ -137,7 +144,7 @@ export const commitProcessReactiveProposal = (scenario, proposed, results) => {
         const action = transition.actions[index];
         const effectObservation = result.observation;
         if (action === undefined ||
-            !effectObservationMatchesAction(action, effectObservation) ||
+            !effectObservationMatchesAction(action, effectObservation, options.committedSensitiveInputs ?? false) ||
             !Number.isSafeInteger(effectObservation.capture_order) ||
             effectObservation.capture_order <= previousOrder ||
             knownEventIds.has(effectObservation.event_id))

package/dist/domain/processScenario.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { processReactiveScenarioSchema, } from "./processReactiveScenario.js";
 import { replayMachineSchema } from "./replayMachine.js";
 const positiveBudget = z.number().int().positive();
 const timedEventBase = { at_ms: z.number().int().nonnegative() };
@@ -44,6 +45,23 @@ export const digestProcessCommitment = (value) => {
         throw new TypeError("Process capture commitment is not canonical JSON");
     return createHash("sha256").update(serialized).digest("hex");
 };
+const reactiveScenarioCommitment = (scenario) => scenario === null
+    ? null
+    : {
+        ...scenario,
+        states: scenario.states.map((state) => ({
+            ...state,
+            on: state.on.map((transition) => ({
+                ...transition,
+                actions: transition.actions.map((action) => action.type === "send_input" && action.sensitive
+                    ? {
+                        ...action,
+                        data: `<redacted-input:${String(Buffer.byteLength(action.data))}-bytes>`,
+                    }
+                    : action),
+            })),
+        })),
+    };
 /** Build the secret-safe scenario projection committed by Process Capture v4. */
 export const processScenarioCommitment = (scenario, executableSha256) => ({
     ...scenario,
@@ -51,6 +69,7 @@ export const processScenarioCommitment = (scenario, executableSha256) => ({
         name,
         scenario.secret_aliases.includes(name) ? "<redacted-secret>" : value,
     ])),
+    reactive: reactiveScenarioCommitment(scenario.reactive),
     unknown_registry_approved: scenario.unknown_registry_approved === true,
     executable_sha256: executableSha256 ?? null,
 });
@@ -71,6 +90,7 @@ export const processComparisonContract = (scenario) => ({
     normalization: scenario.normalization,
     command_shims: scenario.command_shims,
     replay: scenario.replay,
+    reactive: reactiveScenarioCommitment(scenario.reactive),
 });
 /**
  * Boundary schema for one explicitly approved, bounded process experiment.
@@ -258,6 +278,7 @@ export const processScenarioSchema = z
         websocket_messages: [],
         websocket_connections: [],
     }),
+    reactive: processReactiveScenarioSchema.nullable().default(null),
 })
     .strict()
     .superRefine((scenario, context) => {

package/dist/domain/providerCleanupError.js

@@ -0,0 +1,11 @@
+import { ProviderAdapterError } from "./errors.js";
+/** Provider resources could not be proven closed after bounded cleanup. */
+export class ProviderCleanupError extends ProviderAdapterError {
+    cleanupIncomplete = true;
+    cleanupResources;
+    userMessage = "Provider cleanup could not be fully confirmed. Review the reported local resources before opening another target.";
+    constructor(providerId, resources, diagnostics, options) {
+        super(providerId, "close_binary", { ...options, diagnostics });
+        this.cleanupResources = [...resources];
+    }
+}

package/dist/domain/reconstructionObligationLedgerSchemas.js

@@ -0,0 +1,278 @@
+import canonicalize from "canonicalize";
+import { z } from "zod";
+import { evidenceBundleSchema } from "./evidenceBundle.js";
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+const stableIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._:/-]{0,199}$/u);
+const boundedTextSchema = z.string().trim().min(1).max(4_096);
+export const obligationStatusSchema = z.enum([
+    "unowned",
+    "characterized",
+    "implemented",
+    "verified",
+    "contradicted",
+    "blocked",
+    "out-of-scope",
+    "unknown",
+]);
+export const obligationLayerSchema = z.enum([
+    "cli",
+    "protocol",
+    "electron",
+    "persistence",
+    "process",
+    "runtime",
+    "packaging",
+    "native-abi",
+    "application",
+    "other",
+]);
+export const obligationCaseKindSchema = z.enum([
+    "positive",
+    "negative",
+    "malformed",
+    "cancellation",
+    "teardown",
+]);
+export const obligationProofAuthoritySchema = z.enum([
+    "unit",
+    "integration",
+    "protocol",
+    "renderer",
+    "packaged-process",
+    "native-abi",
+    "live-observation",
+    "external",
+]);
+export const obligationOriginalAuthoritySchema = z.enum([
+    "static",
+    "runtime",
+    "process",
+    "external",
+]);
+const obligationTargetSchema = z.strictObject({
+    artifact_sha256: digestSchema.nullable(),
+    application_node_id: z
+        .string()
+        .regex(/^jag_node_[a-f0-9]{64}$/u)
+        .nullable(),
+    semantic_node_id: z
+        .string()
+        .regex(/^jsrg_node_[a-f0-9]{64}$/u)
+        .nullable(),
+    location: boundedTextSchema,
+});
+const authorityReferenceSchema = z.strictObject({
+    evidence_id: evidenceIdSchema,
+    authority: z.enum([
+        "shipped-artifact",
+        "controlled-replay",
+        "historical-reference",
+        "external-service",
+        "analyst-inference",
+    ]),
+    state: z.enum(["candidate", "observed", "reviewed", "unknown"]),
+    location: boundedTextSchema,
+});
+const observedCaseSchema = z.strictObject({
+    kind: obligationCaseKindSchema,
+    evidence_id: evidenceIdSchema,
+    location: boundedTextSchema,
+});
+const ownerBindingSchema = z.strictObject({
+    module_path: boundedTextSchema,
+    symbol: z.string().trim().min(1).max(1_024),
+    owner_sha256: digestSchema,
+});
+const parserTypeBindingSchema = z.strictObject({
+    parser: boundedTextSchema,
+    schema: boundedTextSchema,
+    domain_type: boundedTextSchema,
+});
+const fixtureBindingSchema = z.strictObject({
+    fixture_id: stableIdSchema,
+    case_kind: obligationCaseKindSchema,
+    authority: obligationProofAuthoritySchema,
+    evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+});
+const nondeterminismSchema = z.strictObject({
+    mode: z.enum(["total-order", "partial-order", "finite-traces"]),
+    specification: boundedTextSchema,
+});
+const verifierBindingSchema = z.strictObject({
+    verifier_id: stableIdSchema,
+    claim_id: stableIdSchema,
+    command: boundedTextSchema,
+    authority: obligationProofAuthoritySchema,
+    status: z.enum(["pass", "fail", "unknown", "unsupported", "skipped"]),
+    result_evidence_id: evidenceIdSchema,
+    enumerated_obligation_ids: z.array(stableIdSchema).min(1).max(10_000),
+    nondeterminism: nondeterminismSchema,
+});
+export const reconstructionObligationManifestBindingSchema = z.strictObject({
+    obligation_id: stableIdSchema,
+    owner: ownerBindingSchema,
+    parser_type: parserTypeBindingSchema.nullable(),
+    original_cases: z.array(observedCaseSchema).max(100),
+    fixtures: z.array(fixtureBindingSchema).max(100),
+    verifier: verifierBindingSchema.nullable(),
+});
+export const reconstructionObligationManifestSchema = z.strictObject({
+    schema_version: z.literal(1),
+    bindings: z.array(reconstructionObligationManifestBindingSchema).max(10_000),
+    contradictions: z
+        .array(z.strictObject({
+        obligation_id: stableIdSchema,
+        evidence_ids: z.array(evidenceIdSchema).min(2).max(100),
+    }))
+        .max(10_000),
+});
+export const reviewedReconstructionObligationSchema = z.strictObject({
+    obligation_id: stableIdSchema,
+    obligation_version: z.number().int().min(1),
+    title: z.string().trim().min(1).max(500),
+    application_layer: obligationLayerSchema,
+    family: z.string().trim().min(1).max(100),
+    target: obligationTargetSchema,
+    required: z.boolean(),
+    required_case_kinds: z.array(obligationCaseKindSchema).min(1).max(5),
+    required_original_authority: obligationOriginalAuthoritySchema,
+    required_fixture_authority: obligationProofAuthoritySchema,
+    required_verifier_authority: obligationProofAuthoritySchema,
+    requires_parser_type: z.boolean(),
+    dependency_obligation_ids: z.array(stableIdSchema).max(1_000),
+    residual_unknown_ids: z.array(stableIdSchema).max(1_000),
+    unavailable_authority: z.array(boundedTextSchema).max(100),
+    required_next_evidence: z.array(boundedTextSchema).max(100),
+    disposition: z.enum(["active", "blocked", "out-of-scope"]),
+    review_evidence_ids: z.array(evidenceIdSchema).min(1).max(100),
+});
+const diagnosticSchema = z.strictObject({
+    code: z.enum([
+        "duplicate-definition",
+        "missing-owner",
+        "ambiguous-owner",
+        "missing-parser-type",
+        "missing-original-case",
+        "weak-original-case-authority",
+        "missing-case",
+        "weak-fixture-authority",
+        "missing-verifier",
+        "verifier-does-not-enumerate",
+        "missing-verifier-result",
+        "weak-verifier-authority",
+        "verifier-failed",
+        "static-only",
+        "contradiction",
+        "contradiction-evidence-missing",
+        "residual-unknown",
+        "dependency-missing",
+        "dependency-open",
+        "unavailable-authority",
+        "blocked",
+        "out-of-scope",
+    ]),
+    detail: boundedTextSchema,
+});
+export const reconstructionObligationSchema = z.strictObject({
+    obligation_id: stableIdSchema,
+    obligation_version: z.number().int().min(1),
+    title: z.string().trim().min(1).max(500),
+    origin: z.enum(["generated", "reviewed"]),
+    application_layer: obligationLayerSchema,
+    family: z.string().trim().min(1).max(100),
+    target: obligationTargetSchema,
+    authority_references: z.array(authorityReferenceSchema).min(1).max(1_000),
+    source_state: z.enum(["candidate", "observed", "reviewed", "unknown"]),
+    observed_cases: z.array(observedCaseSchema).max(100),
+    required: z.boolean(),
+    required_case_kinds: z.array(obligationCaseKindSchema).min(1).max(5),
+    required_original_authority: obligationOriginalAuthoritySchema,
+    required_fixture_authority: obligationProofAuthoritySchema,
+    required_verifier_authority: obligationProofAuthoritySchema,
+    requires_parser_type: z.boolean(),
+    dependency_obligation_ids: z.array(stableIdSchema).max(1_000),
+    residual_unknown_ids: z.array(stableIdSchema).max(1_000),
+    unavailable_authority: z.array(boundedTextSchema).max(100),
+    required_next_evidence: z.array(boundedTextSchema).max(100),
+    binding: reconstructionObligationManifestBindingSchema.nullable(),
+    status: obligationStatusSchema,
+    diagnostics: z.array(diagnosticSchema).max(1_000),
+});
+const countBySchema = (key) => z.array(z.strictObject({
+    key,
+    count: z.number().int().min(0),
+}));
+export const reconstructionObligationLedgerSchema = z.strictObject({
+    schema: z.literal("ReconstructionObligationLedger"),
+    schema_version: z.literal(1),
+    ledger_id: z.string().regex(/^rol_[a-f0-9]{64}$/u),
+    closure_digest: digestSchema,
+    status: z.enum(["ready", "open", "failed", "unknown"]),
+    coverage: z.strictObject({
+        status: z.enum(["complete", "partial"]),
+        truncated: z.boolean(),
+        omitted_count: z.number().int().min(0),
+        max_obligations: z.number().int().min(1),
+    }),
+    summary: z.strictObject({
+        total: z.number().int().min(0),
+        required: z.number().int().min(0),
+        verified: z.number().int().min(0),
+        required_open: z.number().int().min(0),
+        by_status: countBySchema(obligationStatusSchema),
+        by_application_layer: countBySchema(obligationLayerSchema),
+        by_evidence_authority: countBySchema(z.enum(["candidate", "observed", "reviewed", "unknown"])),
+    }),
+    reports: z.strictObject({
+        missing_owner_obligation_ids: z.array(stableIdSchema),
+        missing_verifier_obligation_ids: z.array(stableIdSchema),
+        contradicted_obligation_ids: z.array(stableIdSchema),
+        residual_unknown_ids: z.array(stableIdSchema),
+    }),
+    ownership_graph: z.array(z.strictObject({
+        obligation_id: stableIdSchema,
+        module_path: boundedTextSchema,
+        symbol: z.string().trim().min(1).max(1_024),
+    })),
+    dependency_graph: z.array(z.strictObject({
+        obligation_id: stableIdSchema,
+        depends_on_obligation_id: stableIdSchema,
+    })),
+    obligations: z.array(reconstructionObligationSchema).max(10_000),
+    evidence_links: z.array(evidenceIdSchema).max(100_000),
+    limitations: z.array(boundedTextSchema).max(1_000),
+});
+export const reconstructionObligationLedgerInputSchema = z.strictObject({
+    evidence_bundle: evidenceBundleSchema,
+    reviewed_obligations: z
+        .array(reviewedReconstructionObligationSchema)
+        .max(10_000),
+    manifest: reconstructionObligationManifestSchema,
+    limits: z.strictObject({
+        max_obligations: z.number().int().min(1).max(10_000),
+    }),
+    page: z.strictObject({
+        offset: z.number().int().min(0).max(10_000),
+        limit: z.number().int().min(1).max(100),
+    }),
+});
+export const reconstructionObligationLedgerPageSchema = z.strictObject({
+    ...reconstructionObligationLedgerSchema.omit({ obligations: true }).shape,
+    page: z.strictObject({
+        offset: z.number().int().min(0),
+        limit: z.number().int().min(1).max(100),
+        total: z.number().int().min(0),
+        returned: z.number().int().min(0),
+        next_offset: z.number().int().min(0).nullable(),
+    }),
+    obligations: z.array(reconstructionObligationSchema).max(100),
+});
+/** Parse and canonically serialize one complete reconstruction obligation ledger. */
+export const serializeReconstructionObligationLedger = (input) => {
+    const ledger = reconstructionObligationLedgerSchema.parse(input);
+    const encoded = canonicalize(ledger);
+    if (encoded === undefined)
+        throw new TypeError("Reconstruction obligation ledger is not canonical JSON");
+    return encoded;
+};

package/dist/domain/reconstructionReadiness.js

@@ -0,0 +1,121 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { parseEvidenceBundle } from "./evidenceBundle.js";
+import { readinessFindingOrder } from "./reconstructionReadinessFindingHelpers.js";
+import { READINESS_STAGE_IDS, readinessJourneyFindings, } from "./reconstructionReadinessJourneyFindings.js";
+import { readinessIntegrityFindings } from "./reconstructionReadinessIntegrityFindings.js";
+import { reconstructionReadinessInputSchema, reconstructionReadinessReportSchema, } from "./reconstructionReadinessSchemas.js";
+/** Evaluate one public-contract journey into a deterministic fail-closed report. */
+export const createReconstructionReadinessReport = (inputValue) => {
+    const input = reconstructionReadinessInputSchema.parse(inputValue);
+    const sourceDigest = digest(sourceValue(input));
+    const evidenceIds = new Set(parseEvidenceBundle(input.evidence_bundle).records.map(({ evidence_id: evidenceId }) => evidenceId));
+    const findings = [
+        ...readinessJourneyFindings(input, evidenceIds),
+        ...readinessIntegrityFindings(input, evidenceIds, sourceDigest),
+    ].sort(readinessFindingOrder);
+    const stages = effectiveStages(input, findings);
+    const status = aggregateStatus(stages);
+    const semantic = {
+        source_digest: sourceDigest,
+        status,
+        summary: {
+            stages: stages.length,
+            required_stages: stages.filter(({ required }) => required).length,
+            passed_required_stages: stages.filter(({ required, status: stageStatus }) => required && stageStatus === "pass").length,
+            findings: findings.length,
+            failed_findings: findings.filter(({ status: findingStatus }) => findingStatus === "fail").length,
+            unknown_findings: findings.filter(({ status: findingStatus }) => findingStatus === "unknown").length,
+        },
+        metrics: readinessMetrics(input),
+        stages,
+        findings,
+        evidence_links: [...evidenceIds].sort(),
+        snapshot: input,
+    };
+    const reportDigest = digest({
+        schema: "rea.reconstruction-readiness-report/v1",
+        ...semantic,
+    });
+    return reconstructionReadinessReportSchema.parse({
+        schema: "ReconstructionReadinessReport",
+        schema_version: 1,
+        report_id: `rr_${reportDigest}`,
+        report_digest: reportDigest,
+        ...semantic,
+    });
+};
+const effectiveStages = (input, findings) => READINESS_STAGE_IDS.map((stageId) => {
+    const stage = input.stages.find(({ stage_id: id }) => id === stageId);
+    const stageFindings = findings.filter(({ stage_id: id }) => id === stageId);
+    const status = stageFindings.some(({ status: findingStatus }) => findingStatus === "fail")
+        ? "fail"
+        : stage !== undefined && stage.status !== "pass"
+            ? stage.status
+            : stageFindings.length > 0
+                ? "unknown"
+                : (stage?.status ?? "fail");
+    return stage === undefined
+        ? {
+            stage_id: stageId,
+            required: true,
+            status,
+            capability_issue: null,
+            next_action: "Supply the missing conformance stage.",
+            evidence_ids: [],
+            checks: [],
+        }
+        : { ...stage, required: true, status };
+});
+const aggregateStatus = (stages) => {
+    const required = stages.filter(({ required }) => required);
+    if (required.some(({ status }) => status === "fail"))
+        return "fail";
+    if (required.every(({ status }) => status === "pass"))
+        return "pass";
+    for (const status of [
+        "unknown",
+        "truncated",
+        "unsupported",
+        "skipped",
+    ])
+        if (required.some(({ status: stageStatus }) => stageStatus === status))
+            return status;
+    return "unknown";
+};
+const readinessMetrics = (input) => {
+    const selectedFixtures = input.fixtures.filter((fixture) => input.workflow_candidates.some(({ fixture_id: fixtureId, selected, compatibility }) => fixtureId === fixture.fixture_id &&
+        selected &&
+        compatibility === "compatible")).length;
+    const prerequisiteFailures = input.operation_outcomes.filter(({ call_kind: kind, expected_success: success }) => !success && ["setup", "permission"].includes(kind));
+    const localized = input.comparisons.filter(({ deliberate_divergence_ref: expected, divergence_refs: observed }) => expected !== null && observed.includes(expected)).length;
+    const deliberate = input.comparisons.filter(({ deliberate_divergence_ref: expected }) => expected !== null).length;
+    const falseEquivalence = input.comparisons.filter((comparison) => comparison.verdict === "equivalent" &&
+        (comparison.truncated ||
+            comparison.unavailable_authority ||
+            comparison.unstable ||
+            comparison.contradiction_ids.length > 0)).length;
+    return {
+        first_valid_workflow_selection_rate: ratio(selectedFixtures, input.fixtures.length),
+        malformed_or_over_limit_call_rate: ratio(input.operation_outcomes.filter(({ call_kind: kind }) => ["malformed", "over-limit"].includes(kind)).length, input.operation_outcomes.length),
+        incompatible_provider_invocations: input.workflow_candidates.filter(({ invoked, compatibility }) => invoked && compatibility !== "compatible").length,
+        failed_calls_before_prerequisites: prerequisiteFailures.length,
+        recovery_rate: ratio(prerequisiteFailures.filter(({ recovered }) => recovered).length, prerequisiteFailures.length),
+        divergence_localization_precision: ratio(localized, deliberate),
+        false_equivalence_count: falseEquivalence,
+        unowned_obligation_count: input.obligation_ledger.reports.missing_owner_obligation_ids.length,
+        cleanup_leak_count: input.cleanup.filter(({ owned_resources_remaining: remaining }) => remaining > 0).length,
+        nondeterministic_replay_count: input.replay.deterministic ? 0 : 1,
+    };
+};
+const sourceValue = (input) => ({
+    ...input,
+    replay: { ...input.replay, expected_source_digest: null },
+});
+const ratio = (numerator, denominator) => denominator === 0 ? 1 : numerator / denominator;
+const digest = (value) => {
+    const encoded = canonicalize(value);
+    if (encoded === undefined)
+        throw new TypeError("Reconstruction readiness value is not canonical JSON");
+    return createHash("sha256").update(encoded).digest("hex");
+};

package/dist/domain/reconstructionReadinessFindingHelpers.js

@@ -0,0 +1,17 @@
+export const addMissingEvidenceFindings = (findings, stageId, referencedIds, availableIds) => {
+    for (const evidenceId of new Set(referencedIds))
+        if (!availableIds.has(evidenceId))
+            findings.push(readinessFinding("referenced-evidence-missing", stageId, "unknown", `Referenced Evidence is absent from the bundle: ${evidenceId}.`));
+};
+export const readinessFinding = (...[code, stageId, status, detail, evidenceIds = []]) => ({
+    code,
+    stage_id: stageId,
+    status,
+    detail,
+    evidence_ids: [...new Set(evidenceIds)].sort(),
+});
+export const readinessFindingOrder = (left, right) => {
+    const leftKey = `${left.stage_id}:${left.code}:${left.detail}`;
+    const rightKey = `${right.stage_id}:${right.code}:${right.detail}`;
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+};

package/dist/domain/reconstructionReadinessIntegrityFindings.js

@@ -0,0 +1,118 @@
+import { addMissingEvidenceFindings, readinessFinding as finding, } from "./reconstructionReadinessFindingHelpers.js";
+export const readinessIntegrityFindings = (input, evidenceIds, sourceDigest) => [
+    ...comparisonFindings(input, evidenceIds),
+    ...contradictionFindings(input, evidenceIds),
+    ...closureFindings(input, evidenceIds),
+    ...cleanupFindings(input, evidenceIds),
+    ...replayFindings(input, evidenceIds, sourceDigest),
+];
+const comparisonFindings = (input, evidenceIds) => {
+    const findings = [];
+    for (const comparison of input.comparisons) {
+        const unsafeEquivalent = comparison.verdict === "equivalent" &&
+            (comparison.truncated ||
+                comparison.unavailable_authority ||
+                comparison.unstable ||
+                comparison.contradiction_ids.length > 0);
+        if (unsafeEquivalent)
+            findings.push(finding("false-equivalence", "compare-authority-candidate", "fail", `${comparison.comparison_id} claims equivalence across incomplete or contradicted Evidence.`, comparison.evidence_ids));
+        if (comparison.concurrent &&
+            comparison.schedule_semantics === "total-order")
+            findings.push(finding("unsafe-concurrency-semantics", "compare-authority-candidate", "fail", `${comparison.comparison_id} uses total-order semantics for concurrent behavior.`, comparison.evidence_ids));
+        if (comparison.deliberate_divergence_ref !== null &&
+            !comparison.divergence_refs.includes(comparison.deliberate_divergence_ref))
+            findings.push(finding("divergence-not-localized", "compare-authority-candidate", "fail", `${comparison.comparison_id} did not localize its deliberate primary divergence.`, comparison.evidence_ids));
+        addMissingEvidenceFindings(findings, "compare-authority-candidate", comparison.evidence_ids, evidenceIds);
+    }
+    return findings;
+};
+const contradictionFindings = (input, evidenceIds) => {
+    const findings = [];
+    const comparisons = new Map(input.comparisons.map((comparison) => [
+        comparison.comparison_id,
+        comparison,
+    ]));
+    for (const contradiction of input.contradictions) {
+        if (contradiction.declared_sha256 === contradiction.observed_sha256 ||
+            new Set(contradiction.evidence_ids).size < 2)
+            findings.push(finding("contradiction-proof-incomplete", "preserve-contradictions", "fail", `${contradiction.contradiction_id} must preserve distinct hashes and Evidence records.`, contradiction.evidence_ids));
+        for (const comparisonId of contradiction.affected_comparison_ids) {
+            const comparison = comparisons.get(comparisonId);
+            if (comparison === undefined)
+                findings.push(finding("contradiction-comparison-missing", "preserve-contradictions", "unknown", `Contradiction references missing comparison ${comparisonId}.`, contradiction.evidence_ids));
+            else if (comparison.verdict === "equivalent" ||
+                !comparison.contradiction_ids.includes(contradiction.contradiction_id))
+                findings.push(finding("contradiction-equivalence-not-blocked", "preserve-contradictions", "fail", `${comparisonId} does not preserve contradiction ${contradiction.contradiction_id}.`, contradiction.evidence_ids));
+        }
+        addMissingEvidenceFindings(findings, "preserve-contradictions", contradiction.evidence_ids, evidenceIds);
+    }
+    return findings;
+};
+const closureFindings = (input, evidenceIds) => {
+    const findings = [];
+    if (input.obligation_ledger.summary.required === 0)
+        findings.push(finding("reconstruction-obligations-empty", "verify-reconstruction-closure", "unknown", "A ready ledger must include at least one required reconstruction obligation."));
+    if (input.obligation_ledger.status !== "ready" ||
+        input.obligation_ledger.summary.required_open > 0)
+        findings.push(finding("reconstruction-closure-open", "verify-reconstruction-closure", "unknown", `Obligation ledger is ${input.obligation_ledger.status} with ${String(input.obligation_ledger.summary.required_open)} required obligations open.`, input.obligation_ledger.evidence_links));
+    addMissingEvidenceFindings(findings, "verify-reconstruction-closure", input.obligation_ledger.evidence_links, evidenceIds);
+    evaluateClosureHistory(input, findings, evidenceIds);
+    for (const check of input.delegation_checks) {
+        if (check.delegates_to_authority)
+            findings.push(finding("candidate-delegates-to-authority", "verify-reconstruction-closure", "fail", `${check.candidate_id} delegates behavior back to the authority.`, check.evidence_ids));
+        addMissingEvidenceFindings(findings, "verify-reconstruction-closure", check.evidence_ids, evidenceIds);
+    }
+    return findings;
+};
+const evaluateClosureHistory = (input, findings, evidenceIds) => {
+    const history = [...input.closure_history].sort((left, right) => left.sequence - right.sequence);
+    if (new Set(history.map(({ sequence }) => sequence)).size !== history.length ||
+        history.at(-1)?.ledger_digest !== input.obligation_ledger.closure_digest)
+        findings.push(finding("closure-history-identity-mismatch", "verify-reconstruction-closure", "fail", "Closure history sequences must be unique and end at the supplied ledger digest."));
+    if (history[0]?.required_open === 0 ||
+        history.at(-1)?.required_open !== 0 ||
+        history.at(-1)?.status !== "ready")
+        findings.push(finding("incremental-closure-history-missing", "verify-reconstruction-closure", "unknown", "Closure history must begin partial and end ready with zero required obligations open."));
+    for (const [index, observation] of history.entries()) {
+        const previous = history[index - 1];
+        if (previous !== undefined &&
+            (observation.required_open > previous.required_open ||
+                observation.newly_verified_obligation_ids.length !==
+                    previous.required_open - observation.required_open))
+            findings.push(finding("invalid-obligation-closure-transition", "verify-reconstruction-closure", "fail", `Closure observation ${String(observation.sequence)} does not match its newly verified obligations.`, observation.evidence_ids));
+        if (observation.newly_verified_obligation_ids.some((obligationId) => !input.obligation_ledger.obligations.some(({ obligation_id: candidateId, status }) => candidateId === obligationId && status === "verified")))
+            findings.push(finding("closure-obligation-proof-missing", "verify-reconstruction-closure", "fail", `Closure observation ${String(observation.sequence)} names an obligation without verified ledger proof.`, observation.evidence_ids));
+        addMissingEvidenceFindings(findings, "verify-reconstruction-closure", observation.evidence_ids, evidenceIds);
+    }
+};
+const cleanupFindings = (input, evidenceIds) => {
+    const findings = [];
+    for (const cleanup of input.cleanup) {
+        if (cleanup.owned_resources_remaining > 0)
+            findings.push(finding("owned-resource-leak", "reactive-scenarios", "fail", `${cleanup.run_id} retained ${String(cleanup.owned_resources_remaining)} owned resources.`, cleanup.diagnostic_evidence_ids));
+        if (cleanup.cancelled && cleanup.diagnostic_evidence_ids.length === 0)
+            findings.push(finding("cancelled-diagnostic-evidence-missing", "reactive-scenarios", "unknown", `${cleanup.run_id} cancellation retained no diagnostic Evidence.`));
+        addMissingEvidenceFindings(findings, "reactive-scenarios", cleanup.diagnostic_evidence_ids, evidenceIds);
+    }
+    for (const grant of input.grants) {
+        if (["denied", "cancelled"].includes(grant.decision) &&
+            grant.launched_process)
+            findings.push(finding("denied-authority-launched-process", "acquire-authority", "fail", `${grant.grant_id} launched a process after ${grant.decision}.`, grant.evidence_ids));
+        addMissingEvidenceFindings(findings, "acquire-authority", grant.evidence_ids, evidenceIds);
+    }
+    return findings;
+};
+const replayFindings = (input, evidenceIds, sourceDigest) => {
+    const findings = [];
+    if (!input.replay.deterministic)
+        findings.push(finding("replay-nondeterministic", "export-replay", "fail", "Clean replay did not reproduce the same semantic report.", input.replay.evidence_ids));
+    if (!input.replay.tamper_detected)
+        findings.push(finding("tamper-not-detected", "export-replay", "fail", "The conformance replay did not reject a tampered input.", input.replay.evidence_ids));
+    if (!input.replay.stale_input_detected)
+        findings.push(finding("stale-input-not-detected", "export-replay", "fail", "The conformance replay did not reject a stale digest.", input.replay.evidence_ids));
+    if (input.replay.expected_source_digest !== null &&
+        input.replay.expected_source_digest !== sourceDigest)
+        findings.push(finding("replay-source-digest-mismatch", "export-replay", "fail", `Expected ${input.replay.expected_source_digest}; observed ${sourceDigest}.`, input.replay.evidence_ids));
+    addMissingEvidenceFindings(findings, "export-replay", input.replay.evidence_ids, evidenceIds);
+    return findings;
+};