rea-agents 4.1.0 → 6.0.0

package/dist/application/{BinarySessionComposition.js → binary/BinarySessionComposition.js}

@@ -1,3 +1,4 @@
+import { InvestigationRecords } from "../investigation/InvestigationRecords.js";
 import { AnalysisProviderRegistry } from "./AnalysisProviderRegistry.js";
 import { BinarySession } from "./BinarySession.js";
 import { SessionProviderRouter } from "./SessionProviderRouter.js";
@@ -7,4 +8,4 @@ import { SessionProviderRouter } from "./SessionProviderRouter.js";
  */
 export const composeBinarySession = (registry, auxiliaryProviders = []) => new BinarySession(registry instanceof SessionProviderRouter
     ? registry
-    : SessionProviderRouter.selectable(registry, auxiliaryProviders));
+    : SessionProviderRouter.selectable(registry, auxiliaryProviders), new InvestigationRecords());

package/dist/application/{BinarySessionExecution.js → binary/BinarySessionExecution.js}

@@ -1,8 +1,8 @@
-import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
-import { NoBinaryOpenError } from "../domain/configurationErrors.js";
-import { ProviderAdapterError } from "../domain/providerAdapterError.js";
-import {} from "../domain/analysisErrorBase.js";
-import { err, ok } from "../domain/result.js";
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { NoBinaryOpenError } from "../../domain/configurationErrors.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
+import {} from "../../domain/analysisErrorBase.js";
+import { err, ok } from "../../domain/result.js";
 import { isSnapshotCacheable } from "./AnalysisSnapshotCache.js";
 /** Resolve capability, profile, and snapshot state before invoking a provider. */
 export const prepareSessionExecution = (input) => {
@@ -59,9 +59,11 @@ export const bindExecutionTarget = (result, operation, target) => {
     };
     if (result.value.subject !== null &&
         result.value.subject.sha256 !== target.sha256 &&
-        !isArtifactInventorySubject(operation, result.value.subject, target))
+        !isArtifactBundleSubject(operation, result.value.subject, target))
         return err(new ProviderAdapterError(result.value.provider.id, `${operation}:subject`));
     return ok({ ...result.value, subject: result.value.subject ?? subject });
 };
-const isArtifactInventorySubject = (operation, subject, target) => (operation === "inventory_artifact" || operation === "inspect_artifact") &&
+const isArtifactBundleSubject = (operation, subject, target) => (operation === "inventory_artifact" ||
+    operation === "inspect_artifact" ||
+    operation === "extract_artifact") &&
     subject.path === (target.sourcePath ?? target.path);

package/dist/application/{BinarySessionOpen.js → binary/BinarySessionOpen.js}

@@ -1,17 +1,21 @@
-import { snapshotMatchesBinding, snapshotMatchesTarget, snapshotTarget, } from "../domain/analysisSnapshot.js";
-import { parseBinaryTarget } from "./BinaryTargetResolver.js";
-import {} from "../domain/binaryTarget.js";
-import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
-import {} from "../domain/analysisErrorBase.js";
-import { err } from "../domain/result.js";
+import { snapshotMatchesBinding, snapshotMatchesTarget, snapshotTarget, } from "../../domain/analysisSnapshot.js";
+import { parseBinaryTarget } from "../BinaryTargetResolver.js";
+import {} from "../../domain/binaryTarget.js";
+import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
+import {} from "../../domain/analysisErrorBase.js";
+import { err } from "../../domain/result.js";
 import { SessionProviderRouter } from "./SessionProviderRouter.js";
 /** Parse a target, resolve its provider route, and validate snapshot binding. */
 export const resolveSessionOpen = async (input) => {
-    const { router, current, path, options, stagedSnapshotMatches } = input;
+    const { path, options } = input;
     const parsed = await parseBinaryTarget(path, process.cwd(), process.arch, options.targetKind, options.formatHint);
     if (!parsed.ok)
         return parsed;
-    const target = parsed.value;
+    return resolveSessionTarget({ ...input, target: parsed.value });
+};
+/** Resolve a known target's provider route and validate snapshot binding. */
+export const resolveSessionTarget = async (input) => {
+    const { router, current, target, options } = input;
     const sameTarget = current?.target.path === target.path &&
         snapshotMatchesTarget(snapshotTarget(current.target), target);
     const resolvedRoute = sameTarget && options.providerId === undefined && current !== undefined
@@ -19,7 +23,16 @@ export const resolveSessionOpen = async (input) => {
         : await router.resolve(target, options.providerId, options.signal);
     if (!resolvedRoute.ok)
         return resolvedRoute;
-    const route = resolvedRoute.value;
+    return validateResolvedSessionTarget({
+        ...input,
+        route: resolvedRoute.value,
+    });
+};
+/** Revalidate a previewed route against the current session and snapshot binding. */
+export const validateResolvedSessionTarget = (input) => {
+    const { current, target, route, options, stagedSnapshotMatches } = input;
+    const sameTarget = current?.target.path === target.path &&
+        snapshotMatchesTarget(snapshotTarget(current.target), target);
     const snapshotError = validateSnapshot({
         snapshot: options.snapshot,
         target,

package/dist/application/{BinarySessionRecords.js → binary/BinarySessionRecords.js}

@@ -1,43 +1,46 @@
-import { createEvidence } from "../domain/evidence.js";
-import { evidenceBundleForTarget } from "../domain/evidenceBundle.js";
-import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
-import {} from "../domain/analysisErrorBase.js";
-import {} from "../domain/unknownRegistryError.js";
-import { err, ok } from "../domain/result.js";
+import { evidenceBundleForTarget } from "../../domain/evidenceBundle.js";
+import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
+import {} from "../../domain/analysisErrorBase.js";
+import {} from "../../domain/unknownRegistryError.js";
+import { err, ok } from "../../domain/result.js";
 import { AnalysisSnapshotCache } from "./AnalysisSnapshotCache.js";
-import { EvidenceLedger } from "./EvidenceLedger.js";
-import { UNKNOWN_REGISTRY_PROVIDER, unknownEvidenceLinks, unknownMutationEvidence, } from "./UnknownEvidence.js";
-/** Owns session evidence, snapshots, and residual unknowns. */
+import { InvestigationRecords } from "../investigation/InvestigationRecords.js";
+/** Binary snapshot owner and compatibility facade for composed investigation records. */
 export class BinarySessionRecords {
-    #evidence = new EvidenceLedger();
+    #records;
     #snapshot = new AnalysisSnapshotCache();
     #snapshotInvalidated = false;
     #snapshotListeners = new Set();
+    constructor(records = new InvestigationRecords()) {
+        this.#records = records;
+    }
     /** Observe changes to the mutable current analysis snapshot resource. */
     onAnalysisSnapshotChanged(listener) {
         this.#snapshotListeners.add(listener);
         return () => this.#snapshotListeners.delete(listener);
     }
     recordEvidence(evidence) {
-        const recorded = this.#evidence.record(evidence);
+        const recorded = this.#records.recordEvidence(evidence);
         if (recorded.ok && recorded.value === "added")
             this.#emitSnapshotChanged();
         return recorded;
     }
     hasEvidence(evidenceId) {
-        return this.#evidence.has(evidenceId);
+        return this.#records.hasEvidence(evidenceId);
     }
     evidenceById(evidenceId) {
-        return this.#evidence.get(evidenceId);
+        return this.#records.evidenceById(evidenceId);
     }
     exportEvidenceBundle() {
-        return this.#evidence.export();
+        return this.#records.exportEvidenceBundle();
     }
     importEvidenceBundle(bundle) {
-        const imported = this.#evidence.import(bundle);
+        const imported = this.#records.mergeEvidenceBundle(bundle);
         if (!imported.ok)
             return imported;
-        if (imported.value.changed)
+        if (imported.value.metadataChanged)
+            this.invalidateSnapshot();
+        else if (imported.value.changed)
             this.#emitSnapshotChanged();
         return ok(imported.value.recordsAdded);
     }
@@ -50,8 +53,8 @@ export class BinarySessionRecords {
         if (target !== undefined && profile === undefined)
             return err(new EvidenceIntegrityError("Analysis snapshots require a concrete provider analysis profile"));
         return this.#snapshot.export(target, profile, target === undefined
-            ? this.#evidence.export()
-            : evidenceBundleForTarget(this.#evidence.export(), target.sha256));
+            ? this.#records.exportEvidenceBundle()
+            : evidenceBundleForTarget(this.#records.exportEvidenceBundle(), target.sha256));
     }
     importAnalysisSnapshot(snapshot) {
         const active = this.activeAnalysisBinding();
@@ -60,7 +63,7 @@ export class BinarySessionRecords {
         const imported = this.#snapshot.import(snapshot, active === undefined
             ? undefined
             : { target: active.target, profile: active.profile }, (bundle) => {
-            const imported = this.#evidence.import(bundle);
+            const imported = this.#records.mergeEvidenceBundle(bundle);
             return imported.ok ? ok(imported.value.recordsAdded) : imported;
         });
         if (imported.ok)
@@ -81,6 +84,26 @@ export class BinarySessionRecords {
         this.#snapshot.record(input);
         this.#emitSnapshotChanged();
     }
+    /** Retain one derived workflow result alongside its provider cache entries. */
+    recordWorkflowSnapshot(input) {
+        const active = this.activeAnalysisBinding();
+        if (active === undefined || active.profile === null)
+            return err(new EvidenceIntegrityError("Workflow snapshot entries require an active concrete provider profile"));
+        try {
+            this.#snapshot.recordWorkflow({
+                target: active.target,
+                profile: active.profile,
+                ...input,
+            });
+            this.#emitSnapshotChanged();
+            return ok(null);
+        }
+        catch (cause) {
+            return err(new EvidenceIntegrityError(cause instanceof Error
+                ? cause.message
+                : "Workflow snapshot entry validation failed", { cause }));
+        }
+    }
     invalidateSnapshot() {
         this.#snapshot.clear();
         this.#snapshotInvalidated = true;
@@ -97,7 +120,7 @@ export class BinarySessionRecords {
         this.#emitSnapshotChanged();
     }
     clearSessionRecords() {
-        this.#evidence.clear();
+        this.#records.clear();
         this.#snapshot.clear();
         this.#snapshotInvalidated = false;
         this.#emitSnapshotChanged();
@@ -121,43 +144,28 @@ export class BinarySessionRecords {
     }
     recordUnknown(input) {
         const target = this.activeAnalysisBinding()?.target;
-        const recorded = this.#evidence.recordUnknown(input, unknownMutationEvidence(target, input));
+        const recorded = this.#records.recordUnknown(input, target);
         if (recorded.ok)
             this.#emitSnapshotChanged();
         return recorded;
     }
     recordEvidenceWithUnknown(evidence, input) {
-        const recorded = this.#evidence.recordWithUnknown(evidence, input, unknownMutationEvidence(undefined, input));
+        const recorded = this.#records.recordEvidenceWithUnknown(evidence, input);
         if (recorded.ok)
             this.#emitSnapshotChanged();
         return recorded;
     }
     updateUnknown(input) {
         const target = this.activeAnalysisBinding()?.target;
-        const evidence = createEvidence(target, UNKNOWN_REGISTRY_PROVIDER, {
-            predicateType: "rea.residual-unknown-mutation",
-            operation: "update_unknown",
-            parameters: {
-                unknown_id: input.unknown_id,
-                expected_revision: input.expected_revision,
-            },
-            result: { action: "update", status: input.status },
-            confidence: "derived",
-            authority: "analyst-inference",
-            evidenceLinks: unknownEvidenceLinks(input),
-            limitations: [
-                "Registry mutation evidence records analyst intent, not proof of the answer.",
-            ],
-        });
-        const updated = this.#evidence.updateUnknown(input, evidence);
+        const updated = this.#records.updateUnknown(input, target);
         if (updated.ok)
             this.#emitSnapshotChanged();
         return updated;
     }
     listUnknowns(filters = {}) {
-        return this.#evidence.listUnknowns(filters);
+        return this.#records.listUnknowns(filters);
     }
     verifyUnknownResolution(unknownId) {
-        return this.#evidence.verifyUnknownResolution(unknownId);
+        return this.#records.verifyUnknownResolution(unknownId);
     }
 }

package/dist/application/{CompositeProvider.js → binary/CompositeProvider.js}

@@ -1,5 +1,5 @@
-import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
-import { err, ok } from "../domain/result.js";
+import { AnalysisCapabilityUnavailableError } from "../../domain/analysisErrorCore.js";
+import { err, ok } from "../../domain/result.js";
 import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
 /** Synthetic compatibility identity for a deterministic provider set. */
 export const compositeProviderIdentity = (identities) => ({

package/dist/application/{LazyAnalysisProvider.js → binary/LazyAnalysisProvider.js}

@@ -1,7 +1,7 @@
-import { AnalysisCancelledError } from "../domain/analysisErrorCore.js";
-import { AnalysisError } from "../domain/analysisErrorBase.js";
-import { ProviderAdapterError } from "../domain/providerAdapterError.js";
-import { err } from "../domain/result.js";
+import { AnalysisCancelledError } from "../../domain/analysisErrorCore.js";
+import { AnalysisError } from "../../domain/analysisErrorBase.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
+import { err } from "../../domain/result.js";
 import { ABORTED, waitForAbortable } from "./AbortablePromise.js";
 const isAborted = (signal) => signal?.aborted === true;
 /**
@@ -18,11 +18,11 @@ export class LazyAnalysisProvider {
         this.#capabilityDescriptors = options.capabilities;
         this.#loadProvider = options.load;
     }
-    /** Return generated provider identity without loading its implementation. */
+    /** Return source-declared provider identity without loading its implementation. */
     identity() {
         return this.#providerIdentity;
     }
-    /** Return generated capability metadata without loading its implementation. */
+    /** Return source-declared capability metadata without loading its implementation. */
     capabilities() {
         return this.#capabilityDescriptors;
     }

package/dist/application/{SessionProviderRouter.js → binary/SessionProviderRouter.js}

@@ -1,10 +1,10 @@
-import { analysisProfileSchema, } from "../domain/analysisProfile.js";
-import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, } from "../domain/analysisErrorCore.js";
-import { ProviderAdapterError } from "../domain/providerAdapterError.js";
-import { ProviderSelectionError } from "../domain/providerSelectionError.js";
-import {} from "../domain/analysisErrorBase.js";
-import { jsonObjectSchema } from "../domain/jsonValue.js";
-import { err, ok } from "../domain/result.js";
+import { analysisProfileSchema, } from "../../domain/analysisProfile.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, } from "../../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
+import { ProviderSelectionError } from "../../domain/providerSelectionError.js";
+import {} from "../../domain/analysisErrorBase.js";
+import { jsonObjectSchema } from "../../domain/jsonValue.js";
+import { err, ok } from "../../domain/result.js";
 import { AnalysisProviderRegistry, } from "./AnalysisProviderRegistry.js";
 import { ABORTED, waitForAbortable } from "./AbortablePromise.js";
 import { CompositeProvider, compositeProviderIdentity, } from "./CompositeProvider.js";

package/dist/application/binaryDiagnostics/BinaryLayoutService.js

@@ -0,0 +1,57 @@
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { inspectBinaryLayoutInputSchema, binaryLayoutSchema, } from "../../domain/native/binaryLayout.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+const OPERATION = "inspect_binary_layout";
+/** Shared CLI/MCP validation and Evidence composition for offline layout inspection. */
+export class BinaryLayoutService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Bind complete observations to the caller-selected artifact before creating Evidence. */
+    async inspect(rawInput, options) {
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const input = inspectBinaryLayoutInputSchema.safeParse(rawInput);
+        if (!input.success)
+            return err(new AnalysisInputError(OPERATION, { cause: input.error }, projectInputIssues(input.error.issues, rawInput)));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        const inspected = await this.provider.inspect(input.data, options);
+        if (!inspected.ok)
+            return inspected;
+        const diagnostics = binaryLayoutSchema.shape.diagnostics.safeParse(inspected.value.diagnostics);
+        const outputOptions = diagnostics.success
+            ? { capturedOutput: diagnostics.data }
+            : undefined;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION, outputOptions));
+        const report = binaryLayoutSchema.safeParse(inspected.value);
+        if (!report.success || report.data.artifact.path !== input.data.path)
+            return err(new AnalysisOutputError(OPERATION, "Binary layout provider returned malformed evidence or changed the selected artifact identity.", outputOptions));
+        const value = report.data;
+        return ok(createEvidence({
+            path: value.artifact.path,
+            format: "elf",
+            architecture: "x86_64",
+            sha256: value.artifact.sha256,
+        }, this.provider.identity, {
+            operation: OPERATION,
+            parameters: input.data,
+            result: value,
+            rawResult: value,
+            confidence: "observed",
+            limitations: value.limitations,
+            locations: [{ kind: "artifact-path", path: value.artifact.path }],
+        }));
+    }
+}

package/dist/application/binaryDiagnostics/RecordedCrashPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/binaryDiagnostics/RecordedCrashService.js

@@ -0,0 +1,60 @@
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { inspectRecordedCrashInputSchema, recordedCrashSchema, } from "../../domain/native/recordedCrash.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+const OPERATION = "inspect_recorded_crash";
+/** Shared CLI/MCP validation and Evidence composition for recorded crash inspection. */
+export class RecordedCrashService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Bind complete observations to the caller-selected artifact before creating Evidence. */
+    async inspect(rawInput, options) {
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const input = inspectRecordedCrashInputSchema.safeParse(rawInput);
+        if (!input.success)
+            return err(new AnalysisInputError(OPERATION, { cause: input.error }, projectInputIssues(input.error.issues, rawInput)));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        const inspected = await this.provider.inspect(input.data, options);
+        if (!inspected.ok)
+            return inspected;
+        const diagnostics = recordedCrashSchema.shape.diagnostics.safeParse(inspected.value.diagnostics);
+        const outputOptions = diagnostics.success
+            ? { capturedOutput: diagnostics.data }
+            : undefined;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION, outputOptions));
+        const report = recordedCrashSchema.safeParse(inspected.value);
+        if (!report.success ||
+            report.data.artifact.path !== input.data.path ||
+            (report.data.debugger.status === "available") !==
+                input.data.include_debugger_context)
+            return err(new AnalysisOutputError(OPERATION, "Recorded crash provider returned malformed evidence or changed the selected artifact identity.", outputOptions));
+        const value = report.data;
+        return ok(createEvidence({
+            path: value.artifact.path,
+            format: "elf",
+            architecture: "x86_64",
+            sha256: value.artifact.sha256,
+        }, this.provider.identity, {
+            operation: OPERATION,
+            parameters: input.data,
+            result: value,
+            rawResult: value,
+            confidence: value.debugger.status === "available" ? "derived" : "observed",
+            limitations: value.limitations,
+            locations: [{ kind: "artifact-path", path: value.artifact.path }],
+        }));
+    }
+}

package/dist/application/evm/EvmInterfacePort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/evm/EvmInterfaceService.js

@@ -0,0 +1,62 @@
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { inspectEvmInterfaceInputSchema, evmInterfaceSchema, } from "../../domain/evm/evmInterface.js";
+import { projectInputIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok } from "../../domain/result.js";
+const OPERATION = "inspect_evm_interface";
+const diagnosticsSchema = z.object({
+    diagnostics: evmInterfaceSchema.shape.diagnostics,
+});
+/** Shared carrier validation and typed inline Evidence for CLI/MCP. */
+export class EvmInterfaceService {
+    provider;
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Preserve selected byte identity while clearly labeling recovered ABI candidates as inferences. */
+    async inspect(rawInput, options) {
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const input = inspectEvmInterfaceInputSchema.safeParse(rawInput);
+        if (!input.success)
+            return err(new AnalysisInputError(OPERATION, { cause: input.error }, projectInputIssues(input.error.issues, rawInput)));
+        if (!isAbsolute(input.data.path))
+            return err(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        const inspected = await this.provider.inspect(input.data, options);
+        if (!inspected.ok)
+            return inspected;
+        const diagnostics = diagnosticsSchema.safeParse(inspected.value.result);
+        const outputOptions = diagnostics.success
+            ? { capturedOutput: diagnostics.data.diagnostics }
+            : undefined;
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION, outputOptions));
+        const execution = inspected.value;
+        const report = evmInterfaceSchema.safeParse(execution.result);
+        if (!report.success ||
+            report.data.artifact.path !== input.data.path ||
+            report.data.artifact.encoding !== input.data.encoding ||
+            execution.subject?.path !== input.data.path ||
+            execution.subject.sha256 !== report.data.artifact.sha256)
+            return err(new AnalysisOutputError(OPERATION, "Interface adapter returned malformed data or changed the selected carrier identity/encoding.", outputOptions));
+        return ok(createEvidence(execution.subject, execution.provider, {
+            operation: OPERATION,
+            parameters: input.data,
+            result: report.data,
+            ...(execution.rawResult === null
+                ? {}
+                : { rawResult: execution.rawResult }),
+            confidence: "inferred",
+            locations: execution.locations,
+            limitations: execution.limitations,
+        }));
+    }
+}

package/dist/application/firmware/FirmwareAnalysisPort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/{FirmwareAnalysisService.js → firmware/FirmwareAnalysisService.js}

@@ -1,8 +1,8 @@
-import { firmwareRequestSchema, } from "../domain/firmwareAnalysis.js";
-import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
-import { createEvidence } from "../domain/evidence.js";
-import { jsonObjectSchema } from "../domain/jsonValue.js";
-import { err, ok } from "../domain/result.js";
+import { firmwareRequestSchema, } from "../../domain/firmware/firmwareAnalysis.js";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../../domain/analysisErrorCore.js";
+import { createEvidence } from "../../domain/evidence.js";
+import { jsonObjectSchema } from "../../domain/jsonValue.js";
+import { err, ok } from "../../domain/result.js";
 /** Shared CLI/MCP validation and Evidence composition for arbitrary firmware files. */
 export class FirmwareAnalysisService {
     provider;

package/dist/application/{EvidenceLedger.js → investigation/EvidenceLedger.js}

@@ -1,10 +1,10 @@
 import canonicalize from "canonicalize";
-import { createEvidenceBundle, parseEvidenceBundle, validateResidualUnknownAddition, } from "../domain/evidenceBundle.js";
-import { EvidenceIntegrityError } from "../domain/evidenceErrors.js";
-import { UnknownRegistryError } from "../domain/unknownRegistryError.js";
-import { parseEvidence } from "../domain/evidence.js";
-import { createResidualUnknown, updateResidualUnknown, } from "../domain/residualUnknown.js";
-import { err, ok } from "../domain/result.js";
+import { createEvidenceBundle, parseEvidenceBundle, validateResidualUnknownAddition, } from "../../domain/evidenceBundle.js";
+import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
+import { UnknownRegistryError } from "../../domain/unknownRegistryError.js";
+import { parseEvidence } from "../../domain/evidence.js";
+import { createResidualUnknown, updateResidualUnknown, } from "../../domain/residualUnknown.js";
+import { err, ok } from "../../domain/result.js";
 /** Session-owned set of immutable evidence records. */
 export class EvidenceLedger {
     #records = new Map();
@@ -41,11 +41,47 @@ export class EvidenceLedger {
                 cause,
             }));
         }
+        // A record-only bundle cannot change the already-valid unknown graph. The
+        // bundle parser has validated every incoming record and its manifests, so
+        // checking ID conflicts and committing only the additions preserves the
+        // atomic merge without rebuilding and reparsing the entire ledger.
+        if (bundle.unknowns.length === 0) {
+            const additions = new Map();
+            const replacements = new Map();
+            let metadataChanged = false;
+            for (const evidence of bundle.records) {
+                const existing = this.#records.get(evidence.evidence_id);
+                if (existing !== undefined) {
+                    if (!recordsAgree(existing, evidence))
+                        return err(new EvidenceIntegrityError("Conflicting evidence record"));
+                    if (canonicalize(existing) !== canonicalize(evidence)) {
+                        replacements.set(evidence.evidence_id, evidence);
+                        metadataChanged = true;
+                    }
+                    continue;
+                }
+                additions.set(evidence.evidence_id, evidence);
+            }
+            for (const [id, evidence] of replacements)
+                this.#records.set(id, evidence);
+            for (const [id, evidence] of additions)
+                this.#records.set(id, evidence);
+            return ok({
+                recordsAdded: additions.size,
+                unknownsAdded: 0,
+                changed: additions.size > 0 || metadataChanged,
+                metadataChanged,
+            });
+        }
         const pending = new Map(this.#records);
+        let metadataChanged = false;
         for (const evidence of bundle.records) {
             const existing = pending.get(evidence.evidence_id);
             if (existing !== undefined && !recordsAgree(existing, evidence))
                 return err(new EvidenceIntegrityError("Conflicting evidence record"));
+            if (existing !== undefined &&
+                canonicalize(existing) !== canonicalize(evidence))
+                metadataChanged = true;
             pending.set(evidence.evidence_id, evidence);
         }
         const pendingUnknowns = new Map(this.#unknownRevisions);
@@ -73,7 +109,8 @@ export class EvidenceLedger {
         return ok({
             recordsAdded: added,
             unknownsAdded,
-            changed: added > 0 || unknownsAdded > 0,
+            changed: added > 0 || unknownsAdded > 0 || metadataChanged,
+            metadataChanged,
         });
     }
     /** Export records in deterministic, semantically irrelevant ID order. */

package/dist/application/investigation/InvestigationRecordPort.js

@@ -0,0 +1 @@
+export {};