rea-agents 5.0.0 → 6.0.0

package/dist/application/DirectAnalysis.js

@@ -11,6 +11,7 @@ import { access } from "node:fs/promises";
 import { readAnalysisSnapshot, writeAnalysisSnapshot, } from "./binary/AnalysisSnapshotFiles.js";
 import { parseBinaryTarget } from "./BinaryTargetResolver.js";
 import { snapshotEvidenceForQuery, snapshotMatchesTarget, } from "../domain/analysisSnapshot.js";
+import { analysisProfileSchema, committedProviderSchema, } from "../domain/analysisProfile.js";
 import { err, ok } from "../domain/result.js";
 import { REA_WORKFLOW_PROVIDER, workflowAnalysisProfile, } from "./InvestigationProviders.js";
 import { artifactInspectionResultSchema } from "../domain/artifactInspection.js";
@@ -82,7 +83,42 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
         if (!prepared.ok)
             return cliError(prepared.error);
         const { snapshot } = prepared.value;
-        const opened = await session.open(path, {
+        let resolvedTarget;
+        if (snapshot !== undefined && prepared.value.target !== undefined) {
+            const preview = await session.previewTarget(prepared.value.target, {
+                signal,
+                snapshot,
+                ...(options.formatHint === undefined
+                    ? {}
+                    : { formatHint: options.formatHint }),
+                ...(options.providerId === undefined
+                    ? {}
+                    : { providerId: options.providerId }),
+            });
+            if (!preview.ok)
+                return cliError(preview.error);
+            resolvedTarget = preview.value;
+            const route = preview.value.route;
+            const bindingProfile = route.profile ?? undefined;
+            const evidenceProfile = analysisProfileForRoute(route, tool);
+            if (bindingProfile !== undefined &&
+                evidenceProfile !== undefined &&
+                allowsSnapshotReplay(route, tool)) {
+                const cached = snapshotEvidenceForQuery(snapshot, {
+                    target: preview.value.target,
+                    bindingProfile,
+                    operation: tool,
+                    parameters: arguments_,
+                    provider: isWorkflowEvidenceTool(tool)
+                        ? REA_WORKFLOW_PROVIDER
+                        : providerIdentityForRoute(route, tool),
+                    evidenceProfile,
+                });
+                if (cached !== undefined)
+                    return cached;
+            }
+        }
+        const openOptions = {
             signal,
             ...(options.formatHint === undefined
                 ? {}
@@ -91,26 +127,13 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
             ...(options.providerId === undefined
                 ? {}
                 : { providerId: options.providerId }),
-        });
+        };
+        const opened = resolvedTarget === undefined
+            ? await session.open(path, openOptions)
+            : await session.openResolvedTarget(resolvedTarget, openOptions);
         if (!opened.ok)
             return cliError(opened.error);
         const evidenceProfile = analysisProfileForEvidence(session, tool);
-        const bindingProfile = session.analysisProfile();
-        if (canReplayDirectTool(session, tool) &&
-            snapshot !== undefined &&
-            evidenceProfile !== undefined &&
-            bindingProfile !== undefined) {
-            const cached = snapshotEvidenceForQuery(snapshot, {
-                target: opened.value,
-                bindingProfile,
-                operation: tool,
-                parameters: arguments_,
-                provider: replayProviderFor(session, tool),
-                evidenceProfile,
-            });
-            if (cached !== undefined)
-                return cached;
-        }
         const { output, evidence } = await executeAnalysisTool({
             session,
             openedTarget: opened.value,
@@ -121,6 +144,37 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
         });
         if (evidence !== undefined)
             session.recordEvidence(evidence);
+        if (isWorkflowEvidenceTool(tool) &&
+            tool !== "trace_native_ui_action" &&
+            snapshotPath !== undefined &&
+            evidence !== undefined &&
+            "analysis_profile" in evidence &&
+            session.allowsSnapshotReplay(tool)) {
+            const recorded = session.recordWorkflowSnapshot({
+                operation: tool,
+                parameters: arguments_,
+                execution: {
+                    result: evidence.normalized_result,
+                    rawResult: evidence.raw_result,
+                    provider: committedProviderSchema.parse(evidence.provider),
+                    analysisProfile: analysisProfileSchema.parse(evidence.analysis_profile),
+                    limitations: evidence.limitations,
+                    locations: evidence.locations,
+                    subject: evidence.subject === null
+                        ? null
+                        : {
+                            path: evidence.subject.local_path,
+                            sha256: evidence.subject.digest.sha256,
+                            format: evidence.subject.format,
+                            ...(evidence.subject.architecture === null
+                                ? {}
+                                : { architecture: evidence.subject.architecture }),
+                        },
+                },
+            });
+            if (!recorded.ok)
+                return cliError(recorded.error);
+        }
         if (tool !== "trace_native_ui_action" &&
             snapshotPath !== undefined &&
             evidence !== undefined) {
@@ -137,7 +191,6 @@ const runAnalysis = async (dependencies, path, tool, arguments_, options) => {
         await session.close();
     }
 };
-const canReplayDirectTool = (session, tool) => tool !== "trace_native_ui_action" && session.allowsSnapshotReplay(tool);
 const executeAnalysisTool = async (input) => {
     const { session, tool, signal, evidenceProfile } = input;
     if (tool === "analyze_function") {
@@ -212,11 +265,32 @@ const prepareSnapshot = async (options) => {
         return target;
     if (!snapshotMatchesTarget(loaded.value.target, target.value))
         return err(new EvidenceIntegrityError("Analysis snapshot target does not match the requested binary"));
-    return ok({ snapshot: loaded.value });
+    return ok({ snapshot: loaded.value, target: target.value });
+};
+const allowsSnapshotReplay = (route, tool) => {
+    if (tool === "trace_native_ui_action")
+        return false;
+    const descriptor = route.capabilities?.get(tool);
+    return descriptor === undefined
+        ? ![...(route.capabilities?.values() ?? [])].some(({ cachePolicy }) => cachePolicy === "live")
+        : descriptor.cachePolicy !== "live";
+};
+const analysisProfileForRoute = (route, tool) => {
+    const profile = route.profile;
+    if (profile === null || profile === undefined)
+        return undefined;
+    if (isWorkflowEvidenceTool(tool))
+        return workflowAnalysisProfile(profile);
+    const provider = providerIdentityForRoute(route, tool);
+    return provider.id === profile.provider.id ? profile : undefined;
+};
+/** Mirror BinarySession.providerIdentity for a route not opened yet. */
+const providerIdentityForRoute = (route, operation) => {
+    const selected = route.capabilities?.get(operation)?.provider ?? route.identity;
+    return route.profile?.provider.id === selected.id
+        ? route.profile.provider
+        : selected;
 };
-const replayProviderFor = (session, tool) => isWorkflowEvidenceTool(tool)
-    ? REA_WORKFLOW_PROVIDER
-    : session.providerIdentity(tool);
 const analysisProfileForEvidence = (session, tool) => {
     if (!isWorkflowEvidenceTool(tool))
         return session.analysisProfile(tool);

package/dist/application/EvidenceBundleFiles.js

@@ -1,7 +1,7 @@
 import { parseEvidenceBundle, serializeEvidenceBundle, } from "../domain/evidenceBundle.js";
 import { EvidenceFileError, EvidenceIntegrityError, } from "../domain/evidenceErrors.js";
 import { err, ok } from "../domain/result.js";
-import { parseProcessCapture } from "../domain/processCapture.js";
+import { parseProcessCapture } from "../domain/process/processCapture.js";
 import { readJsonFile, writeTextFile } from "./JsonFiles.js";
 /** Read and validate an evidence bundle at the caller-supplied path. */
 export const readEvidenceBundle = async (path) => {

package/dist/application/ReconstructionObligationCandidates.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { parseEvidenceBundle, } from "../domain/evidenceBundle.js";
-import { parseProcessCapture } from "../domain/processCapture.js";
+import { parseProcessCapture } from "../domain/process/processCapture.js";
 import { parseApplicationGraphEvidence } from "./javascript/JavaScriptApplicationEvidenceGraph.js";
 import { applicationObligationPolicy, semanticObligationPolicy, } from "./ReconstructionObligationPolicies.js";
 /** Derive conservative candidates from graph, process, and reviewed inputs. */
@@ -101,6 +101,10 @@ const deriveProcessCandidate = (evidence, candidates, limitations) => {
                 ]
                 : []),
         ];
+        if (capture.manifest.executable_sha256 === null) {
+            limitations.add(`Process capture ${evidence.evidence_id} has no validated executable artifact identity; packaged-process lifecycle obligation was not bound to an artifact.`);
+            return;
+        }
         addCandidate(candidates, {
             obligation_id: obligationId(`process:${capture.manifest.executable_sha256}:${capture.manifest.full_scenario_sha256}`),
             obligation_version: 1,

package/dist/application/WebNetworkCapturePort.js

@@ -0,0 +1 @@
+export {};

package/dist/application/WebNetworkCaptureService.js

@@ -0,0 +1,132 @@
+import { redactExplicitFailure } from "../domain/explicitSensitiveFailure.js";
+import { excludeCaptureCoordinates } from "../domain/webNetworkCaptureCoordinates.js";
+import { redactExplicitText } from "../domain/explicitSensitiveValues.js";
+import { isAbsolute } from "node:path";
+import { AnalysisCancelledError, AnalysisInputError, AnalysisOutputError, } from "../domain/analysisErrorCore.js";
+import { createEvidence } from "../domain/evidence.js";
+import { projectInputIssues } from "../domain/inputIssueProjection.js";
+import { jsonObjectSchema } from "../domain/jsonValue.js";
+import { err, ok } from "../domain/result.js";
+import { inspectWebNetworkCaptureInputSchema, webNetworkCaptureSchema, } from "../domain/webNetworkCapture.js";
+const OPERATION = "inspect_web_network_capture";
+/** Shared CLI/MCP historical inspection preserves caller selection and producer record identity. */
+export class WebNetworkCaptureService {
+    port;
+    constructor(port) {
+        this.port = port;
+    }
+    /** Return selected complete records inline, without inventing live browser attribution. */
+    async inspect(rawInput, options) {
+        if (options?.signal?.aborted)
+            return err(new AnalysisCancelledError(OPERATION));
+        const declarations = inspectWebNetworkCaptureInputSchema.shape.sensitive_values.safeParse(typeof rawInput === "object" &&
+            rawInput !== null &&
+            "sensitive_values" in rawInput
+            ? rawInput.sensitive_values
+            : undefined);
+        const failure = (error) => err(redactExplicitFailure(error, declarations.success ? declarations.data : []));
+        const parsed = inspectWebNetworkCaptureInputSchema.safeParse(rawInput);
+        if (!parsed.success)
+            return failure(new AnalysisInputError(OPERATION, { cause: parsed.error }, projectInputIssues(parsed.error.issues, rawInput)));
+        const input = parsed.data;
+        if (!isAbsolute(input.capture_path))
+            return failure(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["capture_path"],
+                    reason: "invalid_format",
+                    message: "Expected an absolute filesystem path on this host.",
+                },
+            ]));
+        if (input.record_ordinals !== undefined &&
+            new Set(input.record_ordinals).size !== input.record_ordinals.length)
+            return failure(new AnalysisInputError(OPERATION, undefined, [
+                {
+                    path: ["record_ordinals"],
+                    reason: "invalid_format",
+                    message: "Each requested producer ordinal must occur once.",
+                },
+            ]));
+        const loaded = await this.port.inspect(input, options);
+        if (!loaded.ok)
+            return failure(loaded.error);
+        if (options?.signal?.aborted)
+            return failure(new AnalysisCancelledError(OPERATION));
+        const report = webNetworkCaptureSchema.safeParse(loaded.value);
+        if (!report.success)
+            return failure(new AnalysisOutputError(OPERATION, "Capture adapter returned malformed historical evidence."));
+        const value = report.data;
+        const artifactSha256 = value.artifact.sha256;
+        if (artifactSha256 === null)
+            return failure(new AnalysisOutputError(OPERATION, "Capture adapter omitted its observed artifact digest before explicit projection."));
+        if (value.artifact.path !== input.capture_path ||
+            value.format !== input.format ||
+            value.total_records !== value.records.length ||
+            value.records.some((record, index) => record.ordinal !== index))
+            return failure(new AnalysisOutputError(OPERATION, "Capture adapter changed the selected artifact, format or original record sequence."));
+        const safeValue = excludeCaptureCoordinates(value, input.sensitive_values);
+        const redactText = (text) => redactExplicitText(text, input.sensitive_values);
+        const selected = input.record_ordinals ?? value.records.map(({ ordinal }) => ordinal);
+        const records = [];
+        for (const ordinal of selected) {
+            const record = safeValue.records[ordinal];
+            if (record === undefined)
+                return failure(new AnalysisInputError(OPERATION, undefined, [
+                    {
+                        path: ["record_ordinals"],
+                        reason: "invalid_format",
+                        message: `Producer ordinal ${ordinal} is outside the retained capture (${value.total_records} records).`,
+                    },
+                ]));
+            records.push({
+                ...record,
+                limitations: record.limitations.map(redactText),
+            });
+        }
+        const safePath = input.sensitive_values.some((literal) => input.capture_path.includes(literal))
+            ? ""
+            : input.capture_path;
+        const safeSha256 = input.sensitive_values.some((literal) => artifactSha256.includes(literal))
+            ? null
+            : artifactSha256;
+        const subjectUnavailableReason = redactText("The explicitly sensitive artifact digest is excluded; its cryptographic identity is unknown in this Evidence.");
+        const limitations = [
+            ...safeValue.limitations,
+            ...(safePath === ""
+                ? [
+                    "The explicitly sensitive artifact path is excluded; its size remains available.",
+                ]
+                : []),
+        ].map(redactText);
+        const parameters = jsonObjectSchema.parse({
+            capture_path: safePath,
+            ...(input.sensitive_values.some((literal) => input.format.includes(literal))
+                ? {}
+                : { format: input.format }),
+            record_ordinals: selected,
+            sensitive_value_count: input.sensitive_values.length,
+        });
+        return ok(createEvidence(safeSha256 === null
+            ? undefined
+            : {
+                path: safePath,
+                sha256: safeSha256,
+                format: "file",
+            }, value.decoder, {
+            operation: OPERATION,
+            parameters,
+            result: {
+                ...safeValue,
+                artifact: { ...value.artifact, path: safePath, sha256: safeSha256 },
+                records,
+                limitations: safeSha256 === null
+                    ? [...limitations, subjectUnavailableReason]
+                    : limitations,
+            },
+            confidence: "observed",
+            authority: "historical-reference",
+            limitations,
+            ...(safeSha256 === null ? { subjectUnavailableReason } : {}),
+            locations: safePath === "" ? [] : [{ kind: "artifact-path", path: safePath }],
+        }));
+    }
+}

package/dist/application/WindowsCapabilities.js

@@ -3,7 +3,7 @@ import { mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { windowsNativeCapabilities, } from "../process/WindowsAuthority.js";
-import { probeProcessCaptureCapability, } from "./ProcessCaptureCapability.js";
+import { probeProcessCaptureCapability, } from "../process/capture/ProcessCaptureCapability.js";
 /** Probe named prerequisites without converting missing controls into support. */
 export const probeWindowsCapabilities = async (dependencies = systemDependencies()) => {
     const [symlinkCreation, pty] = await Promise.all([

package/dist/application/binary/AnalysisSnapshotCache.js

@@ -2,7 +2,7 @@ import { EvidenceIntegrityError } from "../../domain/evidenceErrors.js";
 import { NoBinaryOpenError } from "../../domain/configurationErrors.js";
 import {} from "../../domain/analysisErrorBase.js";
 import { err, ok } from "../../domain/result.js";
-import { analysisQueryId, createAnalysisSnapshotEntry, snapshotBinding, snapshotMatchesProfile, snapshotMatchesTarget, snapshotTarget, parseAnalysisSnapshot, } from "../../domain/analysisSnapshot.js";
+import { analysisQueryId, createAnalysisSnapshotEntry, createAnalysisSnapshotWorkflowEntry, snapshotBinding, snapshotMatchesProfile, snapshotMatchesTarget, snapshotTarget, parseAnalysisSnapshot, } from "../../domain/analysisSnapshot.js";
 import { OFFICIAL_TOOL_CONTRACTS } from "../../contracts/officialToolContracts.js";
 const STATEFUL_OPERATIONS = new Set([
     "health",
@@ -24,6 +24,8 @@ const CURSOR_DEFAULT_OPERATIONS = new Set([
 const DOCUMENT_SCOPED_OPERATIONS = new Set(OFFICIAL_TOOL_CONTRACTS.map(({ name }) => name).filter((name) => name !== "current_document" &&
     name !== "list_documents" &&
     name !== "set_current_document"));
+/** Maximum duplicated result bindings retained across direct and workflow queries. */
+export const SNAPSHOT_CACHE_ENTRY_CEILING = 10_000;
 /** Whether an operation is immutable and independent of provider UI state. */
 export const isSnapshotCacheable = (operation, descriptor, parameters) => !STATEFUL_OPERATIONS.has(operation) &&
     (!DOCUMENT_SCOPED_OPERATIONS.has(operation) ||
@@ -37,6 +39,7 @@ export const isSnapshotCacheable = (operation, descriptor, parameters) => !STATE
 /** Bounded in-memory cache for one immutable binary identity. */
 export class AnalysisSnapshotCache {
     #entries = new Map();
+    #workflowEntries = new Map();
     #target;
     #binding;
     /** Whether staged entries belong to the supplied target and profile. */
@@ -51,7 +54,7 @@ export class AnalysisSnapshotCache {
     /** Replace cache state when the target or selected profile changes. */
     select(target, profile) {
         if (!this.matches(target, profile))
-            this.#entries.clear();
+            this.#clearEntries();
         this.#target = snapshotTarget(target);
         this.#binding = snapshotBinding(profile);
     }
@@ -61,15 +64,22 @@ export class AnalysisSnapshotCache {
             JSON.stringify(this.#target) !== JSON.stringify(snapshot.target)) ||
             (this.#binding !== undefined &&
                 !snapshotMatchesProfile(this.#binding, snapshot.binding.analysis_profile)))
-            this.#entries.clear();
+            this.#clearEntries();
         this.#target = structuredClone(snapshot.target);
         this.#binding = structuredClone(snapshot.binding);
         let imported = 0;
         for (const entry of snapshot.entries) {
+            if (!this.#entries.has(entry.query_id) && !this.#hasCapacity())
+                continue;
             if (!this.#entries.has(entry.query_id))
                 imported += 1;
             this.#entries.set(entry.query_id, structuredClone(entry));
         }
+        for (const entry of snapshot.workflow_entries ?? []) {
+            if (!this.#workflowEntries.has(entry.query_id) && !this.#hasCapacity())
+                continue;
+            this.#workflowEntries.set(entry.query_id, structuredClone(entry));
+        }
         return imported;
     }
     /** Build a complete snapshot for an active target. */
@@ -84,6 +94,9 @@ export class AnalysisSnapshotCache {
                 target: snapshotTargetIdentity,
                 binding,
                 entries: this.entries(),
+                ...(this.workflowEntries().length === 0
+                    ? {}
+                    : { workflow_entries: this.workflowEntries() }),
                 evidence_bundle: retainedEvidence,
             }));
         }
@@ -117,6 +130,27 @@ export class AnalysisSnapshotCache {
             .sort((left, right) => left.query_id.localeCompare(right.query_id))
             .map((entry) => structuredClone(entry));
     }
+    /** Return canonical composed-workflow entries for persistence. */
+    workflowEntries() {
+        return [...this.#workflowEntries.values()]
+            .sort((left, right) => left.query_id.localeCompare(right.query_id))
+            .map((entry) => structuredClone(entry));
+    }
+    /** Record one exact derived workflow result unless the shared cache is full. */
+    recordWorkflow(input) {
+        this.select(input.target, input.profile);
+        const queryId = analysisQueryId(snapshotTarget(input.target), snapshotBinding(input.profile), input.operation, input.parameters);
+        if (!this.#workflowEntries.has(queryId) && !this.#hasCapacity())
+            return;
+        const entry = createAnalysisSnapshotWorkflowEntry({
+            target: snapshotTarget(input.target),
+            binding: snapshotBinding(input.profile),
+            operation: input.operation,
+            parameters: input.parameters,
+            execution: input.execution,
+        });
+        this.#workflowEntries.set(entry.query_id, entry);
+    }
     /** Replay an exact provider-specific query, marking its cached provenance. */
     lookup(target, profile, operation, parameters) {
         const queryId = analysisQueryId(snapshotTarget(target), snapshotBinding(profile), operation, parameters);
@@ -153,9 +187,10 @@ export class AnalysisSnapshotCache {
     /** Record one successful immutable call unless the cache is full. */
     record(input) {
         const { target, profile, operation, parameters, execution } = input;
-        if (this.#entries.size >= 10_000)
-            return;
         this.select(target, profile);
+        const queryId = analysisQueryId(snapshotTarget(target), snapshotBinding(profile), operation, parameters);
+        if (!this.#entries.has(queryId) && !this.#hasCapacity())
+            return;
         const entry = createAnalysisSnapshotEntry({
             target: snapshotTarget(target),
             binding: snapshotBinding(profile),
@@ -167,8 +202,16 @@ export class AnalysisSnapshotCache {
     }
     /** Forget all target-bound entries. */
     clear() {
-        this.#entries.clear();
+        this.#clearEntries();
         this.#target = undefined;
         this.#binding = undefined;
     }
+    #clearEntries() {
+        this.#entries.clear();
+        this.#workflowEntries.clear();
+    }
+    #hasCapacity() {
+        return (this.#entries.size + this.#workflowEntries.size <
+            SNAPSHOT_CACHE_ENTRY_CEILING);
+    }
 }

package/dist/application/binary/BinarySession.js

@@ -10,7 +10,7 @@ import { SessionProviderRouter, } from "./SessionProviderRouter.js";
 import { InvestigationRecords } from "../investigation/InvestigationRecords.js";
 import { BinarySessionRecords } from "./BinarySessionRecords.js";
 import { binarySessionStatus } from "./BinarySessionStatus.js";
-import { resolveSessionOpen, } from "./BinarySessionOpen.js";
+import { resolveSessionOpen, resolveSessionTarget, validateResolvedSessionTarget, } from "./BinarySessionOpen.js";
 import { bindExecutionTarget, commitExecutionProfile, prepareSessionExecution, } from "./BinarySessionExecution.js";
 import { closeAnalysisClient } from "./AnalysisClientCleanup.js";
 const OFFICIAL_OPERATIONS = new Set(OFFICIAL_TOOL_CONTRACTS.map(({ name }) => name));
@@ -88,21 +88,47 @@ export class BinarySession extends BinarySessionRecords {
         this.#availabilityListeners.add(listener);
         return () => this.#availabilityListeners.delete(listener);
     }
+    /** Resolve a target and provider profile without creating a provider client. */
+    previewTarget(target, options = {}) {
+        if (isAborted(options.signal))
+            return Promise.resolve(err(new AnalysisCancelledError("open_binary")));
+        return resolveSessionTarget({
+            router: this.#providerRouter,
+            current: this.#active,
+            target,
+            options,
+            stagedSnapshotMatches: (target, profile) => this.matchesSnapshot(target, profile),
+        }).then((resolved) => isAborted(options.signal)
+            ? err(new AnalysisCancelledError("open_binary"))
+            : resolved);
+    }
     /**
      * Open or switch targets after draining calls against the current target.
      * Returns the switch failure even if best-effort restoration also fails.
      */
     open(path, options = {}) {
+        return this.#open(() => resolveSessionOpen({
+            router: this.#providerRouter,
+            current: this.#active,
+            path,
+            options,
+            stagedSnapshotMatches: (target, profile) => this.matchesSnapshot(target, profile),
+        }), options);
+    }
+    /** Open a previewed target without repeating parsing or provider profile discovery. */
+    openResolvedTarget(resolved, options = {}) {
+        return this.#open(() => Promise.resolve(validateResolvedSessionTarget({
+            ...resolved,
+            current: this.#active,
+            options,
+            stagedSnapshotMatches: (target, profile) => this.matchesSnapshot(target, profile),
+        })), options);
+    }
+    #open(resolve, options) {
         return this.#serialize(async () => {
             if (isAborted(options.signal))
                 return err(new AnalysisCancelledError("open_binary"));
-            const resolved = await resolveSessionOpen({
-                router: this.#providerRouter,
-                current: this.#active,
-                path,
-                options,
-                stagedSnapshotMatches: (target, profile) => this.matchesSnapshot(target, profile),
-            });
+            const resolved = await resolve();
             if (!resolved.ok)
                 return resolved;
             const { target, route, sameTarget } = resolved.value;
@@ -232,7 +258,8 @@ export class BinarySession extends BinarySessionRecords {
             unboundOperationError: (operation, route) => this.#providerRouter.unboundOperationError(operation, route),
             lookupSnapshot: (target, profile, operation, parameters) => operation === "decode_interface_builder" ||
                 operation === "inspect_asset_catalog" ||
-                operation === "inspect_keyed_archive"
+                operation === "inspect_keyed_archive" ||
+                operation === "trace_dylib_resolution"
                 ? undefined
                 : this.lookupSnapshot(target, profile, operation, parameters),
         });
@@ -252,7 +279,8 @@ export class BinarySession extends BinarySessionRecords {
                 profile !== undefined &&
                 name !== "decode_interface_builder" &&
                 name !== "inspect_asset_catalog" &&
-                name !== "inspect_keyed_archive") {
+                name !== "inspect_keyed_archive" &&
+                name !== "trace_dylib_resolution") {
                 const evidence = createEvidence(profiled.value.subject ?? active.target, profiled.value.provider, {
                     operation: name,
                     parameters: arguments_,

package/dist/application/binary/BinarySessionOpen.js

@@ -7,11 +7,15 @@ import { err } from "../../domain/result.js";
 import { SessionProviderRouter } from "./SessionProviderRouter.js";
 /** Parse a target, resolve its provider route, and validate snapshot binding. */
 export const resolveSessionOpen = async (input) => {
-    const { router, current, path, options, stagedSnapshotMatches } = input;
+    const { path, options } = input;
     const parsed = await parseBinaryTarget(path, process.cwd(), process.arch, options.targetKind, options.formatHint);
     if (!parsed.ok)
         return parsed;
-    const target = parsed.value;
+    return resolveSessionTarget({ ...input, target: parsed.value });
+};
+/** Resolve a known target's provider route and validate snapshot binding. */
+export const resolveSessionTarget = async (input) => {
+    const { router, current, target, options } = input;
     const sameTarget = current?.target.path === target.path &&
         snapshotMatchesTarget(snapshotTarget(current.target), target);
     const resolvedRoute = sameTarget && options.providerId === undefined && current !== undefined
@@ -19,7 +23,16 @@ export const resolveSessionOpen = async (input) => {
         : await router.resolve(target, options.providerId, options.signal);
     if (!resolvedRoute.ok)
         return resolvedRoute;
-    const route = resolvedRoute.value;
+    return validateResolvedSessionTarget({
+        ...input,
+        route: resolvedRoute.value,
+    });
+};
+/** Revalidate a previewed route against the current session and snapshot binding. */
+export const validateResolvedSessionTarget = (input) => {
+    const { current, target, route, options, stagedSnapshotMatches } = input;
+    const sameTarget = current?.target.path === target.path &&
+        snapshotMatchesTarget(snapshotTarget(current.target), target);
     const snapshotError = validateSnapshot({
         snapshot: options.snapshot,
         target,

package/dist/application/binary/BinarySessionRecords.js

@@ -84,6 +84,26 @@ export class BinarySessionRecords {
         this.#snapshot.record(input);
         this.#emitSnapshotChanged();
     }
+    /** Retain one derived workflow result alongside its provider cache entries. */
+    recordWorkflowSnapshot(input) {
+        const active = this.activeAnalysisBinding();
+        if (active === undefined || active.profile === null)
+            return err(new EvidenceIntegrityError("Workflow snapshot entries require an active concrete provider profile"));
+        try {
+            this.#snapshot.recordWorkflow({
+                target: active.target,
+                profile: active.profile,
+                ...input,
+            });
+            this.#emitSnapshotChanged();
+            return ok(null);
+        }
+        catch (cause) {
+            return err(new EvidenceIntegrityError(cause instanceof Error
+                ? cause.message
+                : "Workflow snapshot entry validation failed", { cause }));
+        }
+    }
     invalidateSnapshot() {
         this.#snapshot.clear();
         this.#snapshotInvalidated = true;

package/dist/application/binaryDiagnostics/BinaryLayoutPort.js

@@ -0,0 +1 @@
+export {};