rea-agents 2.4.0 → 3.0.0

package/dist/server/createServer.js

@@ -1,25 +1,37 @@
 import { randomBytes } from "node:crypto";
 import { CLIENT_CAPABILITIES_META_KEY, createRequestStateCodec, McpServer, PROTOCOL_VERSION_META_KEY, } from "@modelcontextprotocol/server";
 import { PRODUCT_IDENTITY } from "../identity.js";
-import { registerEnhancedTools } from "./registerEnhancedTools.js";
-import { registerOfficialTools } from "./registerOfficialTools.js";
-import { registerSessionTools } from "./registerSessionTools.js";
-import { registerNativeTools } from "./registerNativeTools.js";
-import { registerArtifactTools } from "./registerArtifactTools.js";
-import { registerManagedTools } from "./registerManagedTools.js";
-import { registerManagedWorkflowTools } from "./registerManagedWorkflowTools.js";
 import { silentLogger } from "../logger.js";
 import { registerGuidedPrompts } from "./registerPrompts.js";
 import { registerEvidenceResources } from "./registerEvidenceResources.js";
-import { createServerIdentity } from "../serverIdentity.js";
-import { registerBrowserTools } from "./registerBrowserTools.js";
-import { registerElectronTools } from "./registerElectronTools.js";
-import { registerApplicationTools } from "./registerApplicationTools.js";
-const TARGET_FREE_INSTRUCTIONS = "REA analyzes shipped artifacts. Route: ASAR/JavaScript -> analyze_javascript_application (configured root required); archive/package -> inventory_artifact; managed PE/CLI -> inspect_managed_artifact; browser/Electron runtime -> list_browser_targets/list_electron_targets; native binary/database -> open_binary, then binary_overview. Check binary_session for policy. Start with summaries and cite Evidence IDs. Never repeat identical analysis or read full Evidence without a specific need.";
+import { sessionAvailabilityPolicy } from "./sessionAvailabilityPolicy.js";
+import { DENY_EVIDENCE_FILE_POLICY, DENY_PROCESS_POLICY, } from "./sessionToolPolicies.js";
+import { installDynamicToolAvailability } from "./DynamicToolAvailability.js";
+const TARGET_FREE_INSTRUCTIONS = "ASAR/JavaScript -> analyze_javascript_application; archive/package -> open_binary(path), then inspect_artifact/inventory_artifact (active target); managed PE/CLI -> inspect_managed_artifact; passive browser/Electron -> list_browser_targets/list_electron_targets; approved browser interaction -> capture_browser_scenario; Node/Electron Inspector -> list_javascript_runtime_targets; native binary/database -> open_binary, then binary_overview. Start with binary_session; call only tools in tools/list. Hidden routes: binary_session detail=capabilities. Use summaries, cite Evidence IDs. Never repeat identical analysis or read full Evidence.";
 const ACTIVE_TARGET_INSTRUCTIONS = "REA analyzes the active reverse-engineering target. Start native analysis with binary_overview, then narrow with analyze_function, literal search, callers, callees, and xrefs. Prefer summary views, never repeat an identical call, and read full Evidence only when the task requires it.";
-import { LinuxJavaScriptReplayRunner } from "../replay/LinuxJavaScriptReplayRunner.js";
-import { SystemJavaScriptReplayHost } from "../replay/SystemJavaScriptReplayHost.js";
 import { PROCESS_CAPTURE_ELICITATION_POLICY, } from "./ProcessCaptureElicitation.js";
+import { LazyToolCatalog } from "./LazyToolCatalog.js";
+const installSessionToolAvailability = (server, session, options) => {
+    if (session === undefined)
+        return undefined;
+    const policy = sessionAvailabilityPolicy(options.availabilityPolicy, {
+        processPolicy: options.processPolicy ?? DENY_PROCESS_POLICY,
+        evidenceFilePolicy: options.evidenceFilePolicy ?? DENY_EVIDENCE_FILE_POLICY,
+        investigationInputRoots: options.investigationInputRoots ?? [],
+        optionalFeatures: {
+            browserObservationEnabled: options.browserObservation !== undefined,
+            browserScenarioEnabled: options.browserScenarioCapture !== undefined,
+            electronObservationEnabled: options.electronObservation !== undefined,
+            v8InspectorObservationEnabled: options.javascriptRuntimeObservation !== undefined,
+            javascriptReplayEnabled: options.javascriptReplayPolicy?.enabled ?? false,
+            managedRuntimeEnabled: options.managedRuntimePolicy?.enabled ?? false,
+        },
+    });
+    return {
+        policy,
+        controller: installDynamicToolAvailability(server, session, policy),
+    };
+};
 /**
  * Construct one MCP server without acquiring subprocess resources.
  * Supplying a session adds target lifecycle tools; omitting it retains the
@@ -39,7 +51,7 @@ export const createServer = (analysis, session, options = {}) => {
     }, {
         capabilities: {
             tools: { listChanged: true },
-            resources: { listChanged: true },
+            resources: { listChanged: true, subscribe: true },
         },
         inputRequired: {
             maxRounds: 3,
@@ -50,50 +62,81 @@ export const createServer = (analysis, session, options = {}) => {
             ? ACTIVE_TARGET_INSTRUCTIONS
             : TARGET_FREE_INSTRUCTIONS,
     });
+    const dynamicTools = installSessionToolAvailability(server, session, options);
     server.server.onclose = () => {
         permissionAuthority?.clearSessionGrants();
     };
+    if (dynamicTools !== undefined)
+        server.server.oninitialized = () => server.sendToolListChanged();
     session?.onAvailabilityChanged?.(() => server.sendToolListChanged());
     registerServerIdentityResource(server, startedAt);
     const toolLogger = logger.child({ layer: "server" });
     const { activeTarget, recordEvidence, recordEvidenceWithUnknown } = createSessionRecorders(server, session);
-    const toolContext = {
-        server,
-        analysis,
-        session,
-        options,
-        logger: toolLogger,
-        permissionAuthority,
-        activeTarget,
-        recordEvidence,
-        recordEvidenceWithUnknown,
+    const processCaptureElicitation = {
+        stateCodec: processCaptureStateCodec,
+        supported: (context) => {
+            const envelope = context.mcpReq.envelope;
+            const version = envelope?.[PROTOCOL_VERSION_META_KEY];
+            const capabilities = envelope?.[CLIENT_CAPABILITIES_META_KEY];
+            return (typeof version === "string" &&
+                PROCESS_CAPTURE_ELICITATION_POLICY.protocolVersions.some((supported) => supported === version) &&
+                isRecord(capabilities) &&
+                isRecord(capabilities.elicitation) &&
+                capabilities.elicitation.form !== undefined);
+        },
+        now: Date.now,
+        consumedNonces: new Map(),
     };
-    registerBinaryAnalysisTools(toolContext);
-    registerObservationTools(toolContext);
+    let optionalProviders;
+    const loadOptionalProviders = () => {
+        optionalProviders ??= options
+            .loadOptionalProviders?.()
+            .catch((cause) => {
+            optionalProviders = undefined;
+            throw cause;
+        });
+        return optionalProviders;
+    };
+    const lazyTools = new LazyToolCatalog(server, async (kind) => {
+        const needsObservationProviders = kind === "browser-provider" ||
+            kind === "electron-provider" ||
+            kind === "runtime-provider";
+        const [{ hydrateServerToolFamily }, loadedOptionalProviders] = await Promise.all([
+            import("./hydrateServerTools.js"),
+            needsObservationProviders ? loadOptionalProviders() : undefined,
+        ]);
+        const hydratedOptions = loadedOptionalProviders === undefined
+            ? options
+            : { ...options, ...loadedOptionalProviders };
+        await hydrateServerToolFamily({
+            kind,
+            server,
+            analysis,
+            session,
+            options: hydratedOptions,
+            context: {
+                logger: toolLogger,
+                permissionAuthority,
+                activeTarget,
+                recordEvidence,
+                recordEvidenceWithUnknown,
+                availabilityPolicy: dynamicTools?.policy,
+                startedAt,
+                processCaptureElicitation,
+            },
+        });
+    }, session !== undefined);
+    lazyTools.register();
     registerGuidedPrompts(server, analysis, session);
     if (session !== undefined) {
         registerEvidenceResources(server, session);
-        registerSessionTools(server, session, toolLogger, {
-            ...options,
-            ...(permissionAuthority === undefined ? {} : { permissionAuthority }),
-            startedAt,
-            processCaptureElicitation: {
-                stateCodec: processCaptureStateCodec,
-                supported: (context) => {
-                    const envelope = context.mcpReq.envelope;
-                    const version = envelope?.[PROTOCOL_VERSION_META_KEY];
-                    const capabilities = envelope?.[CLIENT_CAPABILITIES_META_KEY];
-                    return (typeof version === "string" &&
-                        PROCESS_CAPTURE_ELICITATION_POLICY.protocolVersions.some((supported) => supported === version) &&
-                        isRecord(capabilities) &&
-                        isRecord(capabilities.elicitation) &&
-                        capabilities.elicitation.form !== undefined);
-                },
-                now: Date.now,
-                consumedNonces: new Map(),
-            },
-        });
     }
+    dynamicTools?.controller.synchronize();
+    const close = server.close.bind(server);
+    server.close = async () => {
+        await lazyTools.close();
+        await close();
+    };
     return server;
 };
 const createSessionRecorders = (server, session) => ({
@@ -102,16 +145,12 @@ const createSessionRecorders = (server, session) => ({
         ? undefined
         : (evidence) => {
             const recorded = session.recordEvidence(evidence);
-            if (recorded.ok && recorded.value === "added")
-                server.sendResourceListChanged();
             return recorded;
         },
     recordEvidenceWithUnknown: session === undefined
         ? undefined
         : (evidence, input) => {
             const recorded = session.recordEvidenceWithUnknown(evidence, input);
-            if (recorded.ok)
-                server.sendResourceListChanged();
             return recorded;
         },
 });
@@ -120,7 +159,8 @@ const registerServerIdentityResource = (server, startedAt) => {
         title: "REA server identity",
         description: "Live package, SDK, protocol, and catalog identity.",
         mimeType: "application/json",
-    }, (uri) => {
+    }, async (uri) => {
+        const { createServerIdentity } = await import("../serverIdentity.js");
         const client = server.server.getClientVersion();
         const protocolVersion = server.server.getNegotiatedProtocolVersion();
         return {
@@ -138,106 +178,4 @@ const registerServerIdentityResource = (server, startedAt) => {
         };
     });
 };
-const registerBinaryAnalysisTools = ({ server, analysis, session, options, logger, permissionAuthority, activeTarget, recordEvidence, recordEvidenceWithUnknown, }) => {
-    const recordUnknown = session === undefined
-        ? undefined
-        : (input) => session.recordUnknown(input);
-    registerOfficialTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-        recordUnknown,
-    });
-    registerEnhancedTools(server, analysis, {
-        logger,
-        activeTarget,
-        analysisProfile: session === undefined ? undefined : () => session.analysisProfile(),
-        recordEvidence,
-        recordUnknown,
-    });
-    registerNativeTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-    });
-    registerArtifactTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-        ...(permissionAuthority === undefined ? {} : { permissionAuthority }),
-    });
-    registerManagedTools(server, analysis, {
-        logger,
-        activeTarget,
-        recordEvidence,
-        session,
-    });
-    if (session !== undefined)
-        registerManagedWorkflowTools(server, {
-            logger,
-            recordEvidence,
-            recordEvidenceWithUnknown,
-            session,
-            runtime: {
-                policy: options.managedRuntimePolicy ?? {
-                    enabled: false,
-                    roots: [],
-                    executablePath: "/usr/bin/dotnet",
-                },
-                authority: permissionAuthority,
-            },
-        });
-};
-const registerObservationTools = ({ server, session, options, logger, permissionAuthority, recordEvidence, recordEvidenceWithUnknown, }) => {
-    registerBrowserTools(server, {
-        logger,
-        browser: options.browserObservation,
-        permissionAuthority,
-        recordEvidence,
-    });
-    registerElectronTools(server, {
-        logger,
-        electron: options.electronObservation,
-        permissionAuthority,
-        recordEvidence,
-    });
-    registerApplicationTools(server, {
-        logger,
-        recordEvidence,
-        recordEvidenceWithUnknown,
-        evidenceLookup: session === undefined
-            ? undefined
-            : (evidenceId) => session.evidenceById(evidenceId),
-        evidenceFilePolicy: options.evidenceFilePolicy ?? {
-            roots: [],
-            maxBytes: 1,
-            maxDepth: 1,
-            maxStringLength: 1,
-            maxNodes: 1,
-        },
-        permissionAuthority,
-        retainCoverageWorkspace: session === undefined
-            ? undefined
-            : (workspace) => {
-                const retained = session.retainReconstructionCoverageWorkspace(workspace);
-                if (retained === "added")
-                    server.sendResourceListChanged();
-                return retained;
-            },
-        replay: {
-            policy: options.javascriptReplayPolicy ?? {
-                enabled: false,
-                roots: [],
-                nodePath: process.execPath,
-                bubblewrapPath: "/usr/bin/bwrap",
-                systemdRunPath: "/usr/bin/systemd-run",
-                systemctlPath: "/usr/bin/systemctl",
-                shellPath: "/usr/bin/bash",
-            },
-            host: options.javascriptReplayHost ?? new SystemJavaScriptReplayHost(),
-            runner: options.javascriptReplayRunner ?? new LinuxJavaScriptReplayRunner(),
-            authority: permissionAuthority,
-        },
-    });
-};
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/server/hydrateServerTools.js

@@ -0,0 +1,191 @@
+/**
+ * Install production callbacks on generated lazy tool registrations.
+ */
+export const hydrateServerToolFamily = async ({ kind, server, analysis, session, options, context, }) => {
+    const toolContext = {
+        server,
+        analysis,
+        session,
+        options,
+        logger: context.logger,
+        permissionAuthority: context.permissionAuthority,
+        activeTarget: context.activeTarget,
+        recordEvidence: context.recordEvidence,
+        recordEvidenceWithUnknown: context.recordEvidenceWithUnknown,
+    };
+    switch (kind) {
+        case "official-proxy": {
+            const { registerOfficialTools } = await import("./registerOfficialTools.js");
+            registerOfficialTools(server, analysis, analysisOptions(toolContext));
+            return;
+        }
+        case "enhanced": {
+            const { registerEnhancedTools } = await import("./registerEnhancedTools.js");
+            registerEnhancedTools(server, analysis, enhancedOptions(toolContext));
+            return;
+        }
+        case "native-provider": {
+            const { registerNativeTools } = await import("./registerNativeTools.js");
+            registerNativeTools(server, analysis, evidenceOptions(toolContext));
+            return;
+        }
+        case "artifact-provider": {
+            const { registerArtifactTools } = await import("./registerArtifactTools.js");
+            registerArtifactTools(server, analysis, {
+                ...evidenceOptions(toolContext),
+                ...(context.permissionAuthority === undefined
+                    ? {}
+                    : { permissionAuthority: context.permissionAuthority }),
+            });
+            return;
+        }
+        case "managed-provider": {
+            const { registerManagedTools } = await import("./registerManagedTools.js");
+            registerManagedTools(server, analysis, {
+                ...evidenceOptions(toolContext),
+                session,
+            });
+            return;
+        }
+        case "application":
+            await registerApplicationFamily(toolContext);
+            return;
+        case "browser-provider":
+        case "electron-provider":
+        case "runtime-provider": {
+            await hydrateObservationFamily(kind, toolContext);
+            return;
+        }
+        case "session": {
+            if (session === undefined)
+                throw new TypeError("Session tools require a binary session");
+            const { registerSessionTools } = await import("./registerSessionTools.js");
+            registerSessionTools(server, session, context.logger, {
+                ...options,
+                ...(context.availabilityPolicy === undefined
+                    ? {}
+                    : { availabilityPolicy: context.availabilityPolicy }),
+                ...(context.permissionAuthority === undefined
+                    ? {}
+                    : { permissionAuthority: context.permissionAuthority }),
+                startedAt: context.startedAt,
+                processCaptureElicitation: context.processCaptureElicitation,
+            });
+        }
+    }
+};
+const hydrateObservationFamily = async (kind, context) => {
+    const common = {
+        logger: context.logger,
+        permissionAuthority: context.permissionAuthority,
+        recordEvidence: context.recordEvidence,
+    };
+    if (kind === "browser-provider") {
+        const [{ registerBrowserTools }, { registerBrowserScenarioTool }] = await Promise.all([
+            import("./registerBrowserTools.js"),
+            import("./registerBrowserScenarioTool.js"),
+        ]);
+        registerBrowserTools(context.server, {
+            ...common,
+            browser: context.options.browserObservation,
+        });
+        registerBrowserScenarioTool(context.server, {
+            ...common,
+            provider: context.options.browserScenarioCapture,
+        });
+        return;
+    }
+    if (kind === "electron-provider") {
+        const { registerElectronTools } = await import("./registerElectronTools.js");
+        registerElectronTools(context.server, {
+            ...common,
+            electron: context.options.electronObservation,
+        });
+        return;
+    }
+    const { registerJavaScriptRuntimeObservationTools } = await import("./registerJavaScriptRuntimeObservationTools.js");
+    registerJavaScriptRuntimeObservationTools(context.server, {
+        ...common,
+        runtime: context.options.javascriptRuntimeObservation,
+    });
+};
+const analysisOptions = ({ logger, activeTarget, recordEvidence, session, }) => {
+    const recordUnknown = session === undefined
+        ? undefined
+        : (input) => session.recordUnknown(input);
+    return {
+        logger,
+        activeTarget,
+        recordEvidence,
+        recordUnknown,
+    };
+};
+const enhancedOptions = (context) => ({
+    ...analysisOptions(context),
+    analysisProfile: context.session === undefined
+        ? undefined
+        : () => context.session?.analysisProfile(),
+});
+const evidenceOptions = ({ logger, activeTarget, recordEvidence, }) => ({
+    logger,
+    activeTarget,
+    recordEvidence,
+});
+const registerApplicationFamily = async ({ server, session, options, logger, permissionAuthority, recordEvidence, recordEvidenceWithUnknown, }) => {
+    const [{ registerApplicationTools }, { registerManagedWorkflowTools }, { LinuxJavaScriptReplayRunner }, { SystemJavaScriptReplayHost },] = await Promise.all([
+        import("./registerApplicationTools.js"),
+        import("./registerManagedWorkflowTools.js"),
+        import("../replay/LinuxJavaScriptReplayRunner.js"),
+        import("../replay/SystemJavaScriptReplayHost.js"),
+    ]);
+    if (session !== undefined)
+        registerManagedWorkflowTools(server, {
+            logger,
+            recordEvidence,
+            recordEvidenceWithUnknown,
+            session,
+            runtime: {
+                policy: options.managedRuntimePolicy ?? {
+                    enabled: false,
+                    roots: [],
+                    executablePath: "/usr/bin/dotnet",
+                },
+                authority: permissionAuthority,
+            },
+        });
+    registerApplicationTools(server, {
+        logger,
+        recordEvidence,
+        recordEvidenceWithUnknown,
+        evidenceLookup: session === undefined
+            ? undefined
+            : (evidenceId) => session.evidenceById(evidenceId),
+        evidenceFilePolicy: options.evidenceFilePolicy ?? {
+            roots: [],
+            maxBytes: 1,
+            maxDepth: 1,
+            maxStringLength: 1,
+            maxNodes: 1,
+        },
+        permissionAuthority,
+        retainCoverageWorkspace: session === undefined
+            ? undefined
+            : (workspace) => {
+                return session.retainReconstructionCoverageWorkspace(workspace);
+            },
+        replay: {
+            policy: options.javascriptReplayPolicy ?? {
+                enabled: false,
+                roots: [],
+                nodePath: process.execPath,
+                bubblewrapPath: "/usr/bin/bwrap",
+                systemdRunPath: "/usr/bin/systemd-run",
+                systemctlPath: "/usr/bin/systemctl",
+                shellPath: "/usr/bin/bash",
+            },
+            host: options.javascriptReplayHost ?? new SystemJavaScriptReplayHost(),
+            runner: options.javascriptReplayRunner ?? new LinuxJavaScriptReplayRunner(),
+            authority: permissionAuthority,
+        },
+    });
+};

package/dist/server/lifecycleProgress.js

@@ -0,0 +1,10 @@
+/** Report one lifecycle operation start through the shared monotonic boundary. */
+export const reportLifecycleStart = (progress, phase, message = "started") => progress.report({ phase, completed: 0, total: 1, message });
+/** Report one lifecycle operation's terminal disposition. */
+export const reportLifecycleEnd = (progress, phase, succeeded) => progress.report({
+    phase,
+    completed: 1,
+    total: 1,
+    message: succeeded ? "completed" : "failed",
+    terminal: true,
+});

package/dist/server/permissionFailure.js

@@ -0,0 +1,12 @@
+import { AnalysisProtocolError, PermissionRequiredError, } from "../domain/errors.js";
+import { err } from "../domain/result.js";
+/** Preserve a typed permission denial or contain an unexpected authority error. */
+export const permissionFailure = (failure) => {
+    if (failure.ok)
+        return err(new AnalysisProtocolError("Expected a denied permission"));
+    return err(failure.error instanceof PermissionRequiredError
+        ? failure.error
+        : new AnalysisProtocolError(failure.error.message, {
+            cause: failure.error,
+        }));
+};

package/dist/server/registerApplicationTools/compareSourceToBundle.js

@@ -0,0 +1,35 @@
+import { compareSourceToBundleEvidenceValidated } from "../../application/JavaScriptApplicationWorkflowService.js";
+import { resolveCompareSourceToBundleRequestValidated } from "../../application/ApplicationWorkflowEvidenceResolver.js";
+import { applicationToolContract } from "../../contracts/applicationToolContracts.js";
+import { compareSourceToBundleRequestSchema } from "../../contracts/applicationWorkflowInputContracts.js";
+import { sourceToBundleComparisonResultSchema } from "../../domain/sourceToBundleComparisonSchemas.js";
+import { logToolExecution } from "../toolLogging.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { toCallToolResult } from "../toolResult.js";
+import { recordResult, recordSources } from "./helpers.js";
+const contract = applicationToolContract("compare_source_to_bundle");
+/** Register conservative historical-source to bundle comparison. */
+export const registerCompareSourceToBundleTool = (server, options) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input) => {
+        const parsedInput = safeParseToolInput(compareSourceToBundleRequestSchema, input, contract.name);
+        if (!parsedInput.ok)
+            return toCallToolResult(parsedInput, contract);
+        const resolved = resolveCompareSourceToBundleRequestValidated(parsedInput.value, options.evidenceLookup);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, contract);
+        const result = await logToolExecution(options.logger, contract.name, () => Promise.resolve(compareSourceToBundleEvidenceValidated(resolved.value)));
+        if (!result.ok)
+            return toCallToolResult(result, contract);
+        const recorded = recordSources(options.recordEvidence, [
+            resolved.value.application,
+        ]);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, contract);
+        const comparison = sourceToBundleComparisonResultSchema.parse(result.value.normalized_result);
+        return recordResult(options, contract, result.value, resolved.value.unknown_registry_approved === true &&
+            comparison.summary.unknown > 0
+            ? "source-to-bundle-comparison"
+            : undefined);
+    });
+};

package/dist/server/registerApplicationTools/helpers.js

@@ -23,7 +23,9 @@ const unknownRegistration = (evidence, kind) => ({
     approved: true,
     question: kind === "application-version-comparison"
         ? "Which application entities remain unmatched or ambiguous across these versions?"
-        : "Which selected JavaScript export return shapes remain dynamic, incomplete, or ambiguously paired?",
+        : kind === "source-to-bundle-comparison"
+            ? "Which historical source files remain unmatched or ambiguously mapped to the shipped bundle?"
+            : "Which selected JavaScript export return shapes remain dynamic, incomplete, or ambiguously paired?",
     severity: "medium",
     domain: kind,
     supporting_evidence_ids: [evidence.evidence_id],
@@ -43,12 +45,14 @@ const unknownRegistration = (evidence, kind) => ({
                     rationale: "Add approved passive runtime Evidence without promoting it to static fact.",
                 },
             ]
-            : [
-                {
-                    operation: "run_controlled_replay",
-                    rationale: "Validate exact approved module behavior separately when runtime semantics are required.",
-                },
-            ]),
+            : kind === "source-to-bundle-comparison"
+                ? []
+                : [
+                    {
+                        operation: "run_controlled_replay",
+                        rationale: "Validate exact approved module behavior separately when runtime semantics are required.",
+                    },
+                ]),
     ],
     relationships: [],
 });

package/dist/server/registerApplicationTools/obligationLedger.js

@@ -0,0 +1,27 @@
+import { buildReconstructionObligationLedgerEvidenceValidated, resolveReconstructionObligationLedgerRequest, } from "../../application/ReconstructionObligationLedgerService.js";
+import { applicationToolContract } from "../../contracts/applicationToolContracts.js";
+import { reconstructionObligationLedgerInputSchema } from "../../domain/reconstructionObligationLedgerSchemas.js";
+import { logToolExecution } from "../toolLogging.js";
+import { safeParseToolInput } from "../toolInputValidation.js";
+import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
+import { toCallToolResult } from "../toolResult.js";
+import { recordResult, recordSources } from "./helpers.js";
+const contract = applicationToolContract("build_reconstruction_obligation_ledger");
+/** Register conservative reconstruction-obligation generation and closure. */
+export const registerReconstructionObligationLedgerTool = (server, options) => {
+    server.registerTool(contract.name, toolRegistrationOptions(contract), async (input) => {
+        const parsed = safeParseToolInput(reconstructionObligationLedgerInputSchema, input, contract.name);
+        if (!parsed.ok)
+            return toCallToolResult(parsed, contract);
+        const resolved = resolveReconstructionObligationLedgerRequest(parsed.value);
+        if (!resolved.ok)
+            return toCallToolResult(resolved, contract);
+        const result = await logToolExecution(options.logger, contract.name, () => Promise.resolve(buildReconstructionObligationLedgerEvidenceValidated(resolved.value)));
+        if (!result.ok)
+            return toCallToolResult(result, contract);
+        const recorded = recordSources(options.recordEvidence, resolved.value.evidence_bundle.records);
+        if (!recorded.ok)
+            return toCallToolResult(recorded, contract);
+        return recordResult(options, contract, result.value);
+    });
+};