rea-agents 6.1.0 → 6.3.0

package/dist/domain/callPath.js

@@ -1,6 +1,6 @@
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
-export { callPathInputSchema, callPathResultSchema };
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /** Minimal directed caller-to-callee adjacency for call-path search. */
 class CallGraph {
     successors = new Map();
@@ -77,7 +77,7 @@ export const buildCallPath = (input) => {
         goal: parsed.goal.address,
         explored: summarizeSearch(graph, search.reached),
         evidence_links: uniqueEvidence(snapshots.values()),
-        limitations: [...new Set(limitations)].sort((left, right) => left.localeCompare(right)),
+        limitations: [...new Set(limitations)].sort(compareUnicodeCodePoints),
     };
     const searchScope = { exhaustive };
     if (found)
@@ -112,9 +112,9 @@ const parseSnapshots = (groups) => {
     const snapshots = new Map();
     for (const group of groups) {
         const snapshot = parseFunctionEvidence(group);
-        const address = normalizeAddress(snapshot.procedure.address);
-        for (const callee of snapshot.collections.callees.items)
-            normalizeAddress(callee.address);
+        const address = parseCallPathAddress(snapshot.dossier.procedure.address);
+        for (const callee of snapshot.dossier.callees)
+            parseCallPathAddress(callee.address);
         if (snapshots.has(address))
             throw new TypeError(`Duplicate function Evidence for ${address}`);
         snapshots.set(address, snapshot);
@@ -131,9 +131,9 @@ const assertCompatible = (snapshots) => {
             snapshot.subject.format !== first.subject.format ||
             snapshot.subject.architecture !== first.subject.architecture)
             throw new TypeError("Call-path Evidence mixes artifact subjects");
-        if (snapshot.provider.id !== first.provider.id ||
-            snapshot.provider.name !== first.provider.name ||
-            snapshot.provider.version !== first.provider.version)
+        if (snapshot.evidence.provider.id !== first.evidence.provider.id ||
+            snapshot.evidence.provider.name !== first.evidence.provider.name ||
+            snapshot.evidence.provider.version !== first.evidence.provider.version)
             throw new TypeError("Call-path Evidence mixes providers");
     }
 };
@@ -141,8 +141,8 @@ const createGraph = (snapshots) => {
     const graph = new CallGraph();
     for (const [address, snapshot] of snapshots) {
         graph.mergeNode(address);
-        for (const callee of snapshot.collections.callees.items) {
-            const calleeAddress = normalizeAddress(callee.address);
+        for (const callee of snapshot.dossier.callees) {
+            const calleeAddress = parseCallPathAddress(callee.address);
             graph.mergeNode(calleeAddress);
             graph.mergeDirectedEdge(address, calleeAddress);
         }
@@ -175,9 +175,7 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
             limitations.push(`No analyze_function Evidence covers reachable function ${node}`);
             continue;
         }
-        const neighbors = graph
-            .outNeighbors(node)
-            .sort((left, right) => left.localeCompare(right));
+        const neighbors = graph.outNeighbors(node).sort(compareUnicodeCodePoints);
         for (const neighbor of neighbors)
             if (!reached.has(neighbor)) {
                 reached.set(neighbor, depth + 1);
@@ -204,7 +202,7 @@ const enumeratePaths = ({ graph, start, goal, goalDistances, }) => {
                 .outNeighbors(node)
                 .filter((neighbor) => distance !== undefined &&
                 goalDistances.get(neighbor) === distance - 1)
-                .sort((left, right) => left.localeCompare(right));
+                .sort(compareUnicodeCodePoints);
             neighbors.set(node, candidates);
         }
         return { neighbors: candidates, nextIndex: 0 };
@@ -249,7 +247,7 @@ const citePath = (addresses, snapshots) => {
             (index > 0 ? snapshots.get(addresses[index - 1] ?? "") : undefined);
         return {
             address,
-            name: snapshot?.procedure.name ?? null,
+            name: snapshot?.dossier.procedure.name ?? null,
             evidence_links: snapshotLinks(supporting),
         };
     });
@@ -267,9 +265,8 @@ const citePath = (addresses, snapshots) => {
 const snapshotLinks = (snapshot) => {
     if (snapshot === undefined)
         throw new TypeError("Every call-path claim requires supporting Evidence");
-    return snapshot.evidence.map(({ evidence_id }) => evidence_id);
+    return [snapshot.evidence.evidence_id];
 };
 const uniqueEvidence = (snapshots) => [
     ...new Set([...snapshots].flatMap((snapshot) => snapshotLinks(snapshot))),
-].sort((left, right) => left.localeCompare(right));
-const normalizeAddress = (input) => parseCallPathAddress(input);
+].sort(compareUnicodeCodePoints);

package/dist/domain/callPathSchemas.js

@@ -4,10 +4,10 @@ import { evidenceSchema } from "./evidence.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const addressSchema = z
     .string()
-    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9A-F]{2})+:)?0x(?:0|[1-9a-f][0-9a-f]*)$/u);
+    .regex(/^(?:(?:[A-Za-z0-9._~\x2d]|%[0-9A-F]{2})+:)?0x(?:0|[1-9a-f][0-9a-f]*)$/u);
 const inputAddressSchema = z
     .string()
-    .regex(/^(?:(?:[A-Za-z0-9._~-]|%[0-9a-fA-F]{2})+:)?0[xX][0-9a-fA-F]+$/u)
+    .regex(/^(?:(?:[A-Za-z0-9._~\x2d]|%[0-9a-fA-F]{2})+:)?0[xX][0-9a-fA-F]+$/u)
     .transform((address) => {
     const separator = address.lastIndexOf(":") + 1;
     const space = address

package/dist/domain/canonicalDigest.js

@@ -1,5 +1,10 @@
 import { createHash } from "node:crypto";
-/** Hash canonicalize-compatible JSON without assembling an aggregate string. */
+/**
+ * Streaming SHA-256 over canonical JSON. Hashing owner (avoids assembling
+ * aggregate strings); `comparisonSemantics.canonicalJson` (canonicalize lib)
+ * is the string-comparison owner. JSON object keys follow RFC 8785's UTF-16
+ * code-unit order in both; entity-list ordering is a separate concern.
+ */
 export const digestCanonicalValue = (value, context = "Comparison") => {
     const hash = createHash("sha256");
     // Batch small emitted parts to cut hash.update crossings.
@@ -54,6 +59,7 @@ const emitCanonical = (value, emit, ancestors) => {
         else {
             emit("{");
             let first = true;
+            // Match canonicalize/RFC 8785, including supplementary-plane keys.
             for (const key of Object.keys(value).sort()) {
                 if (Reflect.get(value, key) === undefined ||
                     typeof Reflect.get(value, key) === "symbol")

package/dist/domain/canonicalOrdering.js

@@ -1,15 +1,3 @@
 import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
-/**
- * Canonical code-point ordering shared across domain and application layers.
- *
- * Compares strings by Unicode code point so graph ordering, fingerprints, and
- * deterministic tie-breaks stay stable regardless of locale. Prefer this over
- * `String.prototype.localeCompare`, which is locale-dependent.
- *
- * Ordering by code point differs from ordering by UTF-16 code unit for astral
- * code points (above U+FFFF), whose lead surrogate is numerically below the
- * BMP tail U+E000-U+FFFF.
- */
-export const compareCodePoints = (left, right) => compareUnicodeCodePoints(left, right);
 /** Deduplicate and sort strings with canonical code-point ordering. */
-export const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);
+export const uniqueSorted = (values) => [...new Set(values)].sort(compareUnicodeCodePoints);

package/dist/domain/changedBehavior.js

@@ -1,11 +1,12 @@
 import { z } from "zod";
 import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
+import { compositeKey, compareUnicodeCodePoints, } from "./unicodeCodePointOrder.js";
 import { comparisonSourceEvidenceIds } from "./comparisonSourceEvidence.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
-import { functionComparisonResultSchema } from "./functionComparison.js";
+import { functionComparisonResultSchema } from "./functionComparisonSchemas.js";
 import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
-import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processCapture.js";
+import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processComparison.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Input for aggregating existing comparison Evidence. */
@@ -209,7 +210,7 @@ const functionFindings = (evidence) => {
                 dimension: dimension.dimension,
                 scope: "static_candidate",
                 status: dimension.status,
-                classification: dimension.status === "unknown" || dimension.status === "truncated"
+                classification: dimension.status === "unknown"
                     ? "unresolved_branch"
                     : dimension.conclusion_kind,
                 limitations: dimension.limitations,
@@ -274,9 +275,7 @@ const behaviorStatus = (statuses) => {
 const isChange = (status) => status === "added" || status === "removed" || status === "changed";
 const count = (findings, classification) => findings.filter((finding) => finding.classification === classification)
     .length;
-const compareFindings = (left, right) => [left.scope, left.dimension, left.source_comparison_id]
-    .join("\0")
-    .localeCompare([right.scope, right.dimension, right.source_comparison_id].join("\0"), "en");
+const compareFindings = (left, right) => compareUnicodeCodePoints(compositeKey([left.scope, left.dimension, left.source_comparison_id]), compositeKey([right.scope, right.dimension, right.source_comparison_id]));
 const assertUnique = (values, label) => {
     if (new Set(values).size !== values.length)
         throw new TypeError(`Changed-behavior analysis rejects duplicate ${label}`);

package/dist/domain/comparisonSemantics.js

@@ -1,13 +1,8 @@
 import canonicalize from "canonicalize";
-import { digestCanonicalValue } from "./canonicalDigest.js";
 /** Whether an inventory can support a claim that an item is absent. */
 export const absenceClaimable = (coverage) => coverage.status === "complete" &&
     coverage.truncated !== true &&
     (coverage.omitted_count === undefined || coverage.omitted_count === 0);
-/** SHA-256 of canonical JSON for stable, provider-neutral comparison IDs. */
-export const canonicalDigest = (value, context = "Comparison") => {
-    return digestCanonicalValue(value, context);
-};
 /** Canonical JSON used for deterministic tie breaking and stable digests. */
 export const canonicalJson = (value, context = "Comparison") => {
     const encoded = canonicalize(value);

package/dist/domain/completionLedgerGeneration.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { createEvidenceCompletionLedger, evidenceCompletionRecordSchema, } from "./evidenceCompletionLedger.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
-const identifierSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const identifierSchema = z.string().regex(IDENTIFIER_PATTERN);
 const identitySchema = z.strictObject({
     id: identifierSchema,
     version: z.string().min(1),

package/dist/domain/configurationErrors.js

@@ -2,6 +2,11 @@ import { AnalysisError, } from "./analysisErrorBase.js";
 /** Runtime configuration could not be parsed safely. */
 export class ConfigurationError extends AnalysisError {
     _tag = "ConfigurationError";
+    settings;
+    constructor(message, options) {
+        super(message, options);
+        this.settings = (options?.settings ?? []).map(({ setting, constraint }) => ({ setting, constraint }));
+    }
 }
 /** No app or binary session exists for an analysis request. */
 export class NoBinaryOpenError extends AnalysisError {
@@ -16,10 +21,17 @@ export class BinaryTargetError extends AnalysisError {
     reason;
     _tag = "BinaryTargetError";
     constraint;
+    /** The OS read-permission code of the cause, when the host denied access. */
+    systemCode;
     constructor(path, reason, options) {
         super(`Cannot open artifact: ${reason}`, options);
         this.path = path;
         this.reason = reason;
         this.constraint = options?.constraint;
+        this.systemCode = readPermissionCode(options?.cause);
     }
 }
+const readPermissionCode = (cause) => {
+    const code = cause instanceof Error ? Reflect.get(cause, "code") : undefined;
+    return code === "EACCES" || code === "EPERM" ? code : undefined;
+};

package/dist/domain/conformancePackage.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { evidenceEnvelopeSchema } from "./evidence.js";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
+import { evidenceSchema } from "./evidence.js";
 import { evidenceBundleSchema } from "./evidenceBundle.js";
 import { err, ok } from "./result.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const conformancePackageIdSchema = prefixedDigestSchema("cp");
-const scenarioIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const scenarioIdSchema = z.string().regex(IDENTIFIER_PATTERN);
 const scenarioManifestSchema = z.strictObject({
     scenario_id: scenarioIdSchema,
     name: z.string().min(1),
@@ -45,7 +46,7 @@ const shimPlanSchema = z.strictObject({
 const expectedEvidenceSchema = z.strictObject({
     scenario_id: scenarioIdSchema,
     /** Expected evidence envelopes. */
-    envelopes: z.array(evidenceEnvelopeSchema),
+    envelopes: z.array(evidenceSchema),
     /** Expected evidence bundle. */
     bundle: evidenceBundleSchema.nullable(),
     /** Required dimensions that must be present in the evidence. */

package/dist/domain/digests.js

@@ -25,6 +25,3 @@ export const prefixedDigestSchema = (prefix) => z
     .regex(new RegExp(`^${prefix}_[a-f0-9]{64}$`, "u"), `Expected a ${prefix}_ prefixed lowercase sha256 digest`);
 /** True when `value` is a bare digest. */
 export const isDigest = (value) => typeof value === "string" && SHA256_PATTERN.test(value);
-/** True when `value` is a digest carrying `prefix`. */
-export const isPrefixedDigest = (value, prefix) => typeof value === "string" &&
-    prefixedDigestSchema(prefix).safeParse(value).success;

package/dist/domain/evidence.js

@@ -79,6 +79,7 @@ const evidenceBaseSchema = z
     evidence_id: prefixedDigestSchema("ev"),
     subject: subjectSchema.nullable(),
     provider: providerSchema,
+    analysis_profile: analysisProfileSchema.nullable(),
     predicate_type: z.string().min(1),
     operation: z.string().min(1),
     parameters: jsonObjectSchema,
@@ -92,13 +93,10 @@ const evidenceBaseSchema = z
     evidence_links: z.array(prefixedDigestSchema("ev")),
 })
     .strict();
-/** Object envelope used to specialize caller-visible Evidence result schemas. */
-export const evidenceEnvelopeSchema = evidenceBaseSchema.extend({
-    analysis_profile: analysisProfileSchema.optional(),
-});
-const validateAnalysisProfileProvider = (evidence, context) => {
+/** Require a reported analysis profile to identify the observation provider. */
+export const validateAnalysisProfileProvider = (evidence, context) => {
     const profile = evidence.analysis_profile;
-    if (profile !== undefined &&
+    if (profile !== null &&
         (profile.provider.id !== evidence.provider.id ||
             profile.provider.name !== evidence.provider.name ||
             profile.provider.version !== evidence.provider.version))
@@ -109,15 +107,16 @@ const validateAnalysisProfileProvider = (evidence, context) => {
         });
 };
 /** Strict, provider-neutral record for one successful public observation. */
-export const evidenceSchema = evidenceEnvelopeSchema.superRefine(validateAnalysisProfileProvider);
-const profiledEvidenceSchema = evidenceBaseSchema
-    .extend({ analysis_profile: analysisProfileSchema })
-    .superRefine(validateAnalysisProfileProvider);
-/** JSON-exact union used where Evidence participates in larger schemas. */
-export const evidenceRecordSchema = z.union([
-    profiledEvidenceSchema,
-    evidenceBaseSchema,
-]);
+export const evidenceSchema = evidenceBaseSchema.superRefine(validateAnalysisProfileProvider);
+const authenticatedEvidenceSchema = evidenceSchema.superRefine((evidence, context) => {
+    const { evidence_id: evidenceId, ...withoutId } = evidence;
+    if (computeEvidenceId(withoutId) !== evidenceId)
+        context.addIssue({
+            code: "custom",
+            path: ["evidence_id"],
+            message: "Evidence semantic identifier does not match its record",
+        });
+});
 const immutableEvidenceSnapshots = new WeakMap();
 const immutableResultSchema = z
     .custom(isImmutableJsonSnapshot)
@@ -135,9 +134,7 @@ const semanticProjection = (evidence) => ({
             architecture: evidence.subject.architecture,
         },
     provider: evidence.provider,
-    ...(!("analysis_profile" in evidence)
-        ? {}
-        : { analysis_profile: evidence.analysis_profile }),
+    analysis_profile: evidence.analysis_profile,
     predicate_type: evidence.predicate_type,
     operation: evidence.operation,
     parameters: evidence.parameters,
@@ -159,17 +156,7 @@ export const parseEvidence = (input) => {
         : undefined;
     if (immutable !== undefined)
         return immutable;
-    // Select the producer's envelope before traversing its payload. A legacy
-    // record cannot satisfy the required-profile branch, whose failed parse
-    // would otherwise clone the entire normalized result before trying legacy.
-    const schema = typeof input === "object" && input !== null && "analysis_profile" in input
-        ? profiledEvidenceSchema
-        : evidenceBaseSchema;
-    const evidence = schema.parse(input);
-    const { evidence_id: evidenceId, ...withoutId } = evidence;
-    if (computeEvidenceId(withoutId) !== evidenceId)
-        throw new TypeError("Evidence semantic identifier does not match its record");
-    return evidence;
+    return authenticatedEvidenceSchema.parse(input);
 };
 /** Authenticate and seal a ledger-owned snapshot; external mutable values are copied first. */
 export const immutableEvidence = (input) => rememberImmutableEvidence(parseEvidence(input));
@@ -226,9 +213,7 @@ const normalizeEvidenceObservation = (target, provider, observation) => {
             name: provider.name,
             version: provider.version,
         },
-        ...(observation.analysisProfile === undefined
-            ? {}
-            : { analysis_profile: observation.analysisProfile }),
+        analysis_profile: observation.analysisProfile ?? null,
         predicate_type: observation.predicateType ?? "rea.analysis",
         operation: observation.operation,
         parameters: observation.parameters,
@@ -249,18 +234,12 @@ const normalizeEvidenceObservation = (target, provider, observation) => {
         locations: [...(observation.locations ?? [])],
         evidence_links: [...(observation.evidenceLinks ?? [])],
     };
-    // Select the known envelope before parsing. A union otherwise traverses and
-    // clones a legacy result for the profiled branch before rejecting its absent
-    // profile and trying the legacy branch.
-    const schema = observation.analysisProfile === undefined
-        ? evidenceBaseSchema
-        : profiledEvidenceSchema;
     const sharedResult = typeof observation.result === "object" &&
         observation.result !== null &&
         isImmutableJsonSnapshot(observation.result);
     const selectedSchema = sharedResult
-        ? schema.safeExtend({ normalized_result: immutableResultSchema })
-        : schema;
+        ? evidenceSchema.safeExtend({ normalized_result: immutableResultSchema })
+        : evidenceSchema;
     const normalized = selectedSchema.parse({
         ...semantic,
         evidence_id: `ev_${"0".repeat(64)}`,

package/dist/domain/evidenceBundle.js

@@ -1,24 +1,23 @@
 import { z } from "zod";
 import canonicalize from "canonicalize";
-import { evidenceEnvelopeSchema, evidenceRecordSchema, immutableEvidence, parseEvidence, providerSchema, } from "./evidence.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
+import { evidenceSchema, immutableEvidence, parseEvidence, providerSchema, } from "./evidence.js";
 import { residualUnknownSchema, } from "./residualUnknown.js";
 import { freezeJsonSnapshot } from "./immutableJson.js";
-const artifactManifestSchema = evidenceEnvelopeSchema.shape.subject
-    .unwrap()
-    .pick({
+const artifactManifestSchema = evidenceSchema.shape.subject.unwrap().pick({
     digest: true,
     format: true,
     architecture: true,
 });
 const providerManifestSchema = providerSchema;
-const environmentManifestSchema = evidenceEnvelopeSchema.shape.environment.unwrap();
+const environmentManifestSchema = evidenceSchema.shape.environment.unwrap();
 const scenarioManifestSchema = z.object({
-    evidence_id: evidenceEnvelopeSchema.shape.evidence_id,
+    evidence_id: evidenceSchema.shape.evidence_id,
     operation: z.string().min(1),
     authority: z.literal("controlled-replay"),
 });
 const captureManifestSchema = z.object({
-    evidence_id: evidenceEnvelopeSchema.shape.evidence_id,
+    evidence_id: evidenceSchema.shape.evidence_id,
     predicate_type: z.string().min(1),
 });
 export const evidenceBundleSchema = z.object({
@@ -28,7 +27,7 @@ export const evidenceBundleSchema = z.object({
     scenarios: z.array(scenarioManifestSchema),
     captures: z.array(captureManifestSchema),
     unknowns: z.array(residualUnknownSchema),
-    records: z.array(evidenceRecordSchema),
+    records: z.array(evidenceSchema),
 });
 const immutableBundles = new WeakMap();
 /** Build and authenticate a sealed bundle while reusing immutable Evidence records. */
@@ -45,7 +44,7 @@ export const createImmutableEvidenceBundle = (records, unknowns = []) => {
 };
 /** Project records into a deterministic bundle whose order has no semantics. */
 export const createEvidenceBundle = (records, unknowns = []) => {
-    const sortedRecords = [...records].sort((left, right) => left.evidence_id.localeCompare(right.evidence_id));
+    const sortedRecords = [...records].sort((left, right) => compareUnicodeCodePoints(left.evidence_id, right.evidence_id));
     return {
         artifacts: uniqueSorted(sortedRecords.flatMap(({ subject }) => subject === null
             ? []
@@ -75,55 +74,60 @@ export const createEvidenceBundle = (records, unknowns = []) => {
                 },
             ]
             : []),
-        unknowns: [...unknowns].sort((left, right) => left.unknown_id.localeCompare(right.unknown_id) ||
+        unknowns: [...unknowns].sort((left, right) => compareUnicodeCodePoints(left.unknown_id, right.unknown_id) ||
             left.revision - right.revision),
         records: sortedRecords,
     };
 };
-/** Restrict a bundle to records and complete unknown histories for one artifact. */
+/** Retain target records and eligible complete unknown histories with their mutation evidence. */
 export const evidenceBundleForTarget = (bundle, sha256) => {
     const recordsById = new Map(bundle.records.map((record) => [record.evidence_id, record]));
-    const candidates = bundle.unknowns.filter(({ scope_digest: scopeDigest }) => scopeDigest === sha256);
+    const histories = new Map();
+    for (const unknown of bundle.unknowns) {
+        const history = histories.get(unknown.unknown_id) ?? [];
+        history.push(unknown);
+        histories.set(unknown.unknown_id, history);
+    }
     const retained = new Set();
-    const revisionsById = new Map();
     const dependents = new Map();
-    for (const unknown of candidates) {
-        const mutationEvidenceIds = new Set(unknown.mutation_evidence_ids);
-        const evidenceAvailable = referencedEvidenceIds(unknown).every((id) => {
-            const record = recordsById.get(id);
-            return (record?.subject?.digest.sha256 === sha256 ||
-                (mutationEvidenceIds.has(id) &&
-                    record?.subject === null &&
-                    record.predicate_type === "rea.residual-unknown-mutation"));
+    const relationships = new Map();
+    for (const [id, history] of histories) {
+        const eligible = history.every((unknown) => {
+            if (unknown.scope_digest !== sha256)
+                return false;
+            const mutationEvidenceIds = new Set(unknown.mutation_evidence_ids);
+            return referencedEvidenceIds(unknown).every((evidenceId) => {
+                const record = recordsById.get(evidenceId);
+                // Mutation subjects record the target active at the time of an edit,
+                // which need not be the question's immutable investigation scope.
+                return (record?.subject?.digest.sha256 === sha256 ||
+                    (mutationEvidenceIds.has(evidenceId) &&
+                        record?.predicate_type === "rea.residual-unknown-mutation"));
+            });
         });
-        if (!evidenceAvailable)
+        if (!eligible)
             continue;
-        retained.add(unknown);
-        revisionsById.set(unknown.unknown_id, (revisionsById.get(unknown.unknown_id) ?? 0) + 1);
-        for (const relatedId of new Set(unknown.relationships.map(({ unknown_id: id }) => id))) {
+        retained.add(id);
+        const relatedIds = new Set(history.flatMap((unknown) => unknown.relationships.map(({ unknown_id }) => unknown_id)));
+        relationships.set(id, relatedIds);
+        for (const relatedId of relatedIds) {
             const references = dependents.get(relatedId) ?? new Set();
-            references.add(unknown);
+            references.add(id);
             dependents.set(relatedId, references);
         }
     }
     const pending = [];
-    for (const unknown of retained)
-        if (unknown.relationships.some(({ unknown_id: id }) => !revisionsById.has(id)))
-            pending.push(unknown);
+    for (const [id, relatedIds] of relationships)
+        if ([...relatedIds].some((relatedId) => !retained.has(relatedId)))
+            pending.push(id);
     for (let index = 0; index < pending.length; index += 1) {
-        const unknown = pending[index];
-        if (unknown === undefined || !retained.delete(unknown))
+        const id = pending[index];
+        if (id === undefined || !retained.delete(id))
             continue;
-        const remaining = (revisionsById.get(unknown.unknown_id) ?? 1) - 1;
-        if (remaining > 0) {
-            revisionsById.set(unknown.unknown_id, remaining);
-            continue;
-        }
-        revisionsById.delete(unknown.unknown_id);
-        for (const dependent of dependents.get(unknown.unknown_id) ?? [])
+        for (const dependent of dependents.get(id) ?? [])
             pending.push(dependent);
     }
-    const unknowns = candidates.filter((unknown) => retained.has(unknown));
+    const unknowns = bundle.unknowns.filter((unknown) => retained.has(unknown.unknown_id));
     const mutationIds = new Set(unknowns.flatMap(({ mutation_evidence_ids: ids }) => ids));
     return createEvidenceBundle(bundle.records.filter((record) => record.subject?.digest.sha256 === sha256 ||
         mutationIds.has(record.evidence_id)), unknowns);
@@ -139,7 +143,7 @@ const referencedEvidenceIds = (unknown) => [
  * Evidence record, such as one command result, is not a bundle.
  */
 export const describeEvidenceBundleFailure = (input, cause) => {
-    const record = evidenceRecordSchema.safeParse(input);
+    const record = evidenceSchema.safeParse(input);
     if (record.success)
         return `Expected an Evidence bundle with records and manifest arrays, but this JSON is one Evidence record (${record.data.evidence_id}). Export a session bundle with the MCP export_evidence_bundle tool and supply that file.`;
     return cause instanceof z.ZodError
@@ -168,7 +172,19 @@ export const parseEvidenceBundle = (input) => {
     if (new Set(recordIds).size !== recordIds.length)
         throw new TypeError("Evidence bundle contains duplicate record IDs");
     validateUnknownGraph(parsed.unknowns, parsed.records);
-    const canonical = createEvidenceBundle(parsed.records.map(parseEvidence), parsed.unknowns);
+    const canonical = createEvidenceBundle(parsed.records.map((record, index) => {
+        try {
+            return parseEvidence(record);
+        }
+        catch (cause) {
+            if (cause instanceof z.ZodError)
+                throw new z.ZodError(cause.issues.map((issue) => ({
+                    ...issue,
+                    path: ["records", index, ...issue.path],
+                })));
+            throw cause;
+        }
+    }), parsed.unknowns);
     if (JSON.stringify(parsed) !== JSON.stringify(canonical))
         throw new TypeError("Evidence bundle manifests are not canonical");
     return canonical;
@@ -366,6 +382,6 @@ const uniqueSorted = (values) => {
     for (const value of values)
         unique.set(JSON.stringify(value), value);
     return [...unique.entries()]
-        .sort(([left], [right]) => left.localeCompare(right))
+        .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
         .map(([, value]) => value);
 };

package/dist/domain/evidenceCompletionLedger.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
-const claimIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
+const claimIdSchema = z.string().regex(IDENTIFIER_PATTERN);
 /** Terminal outcome recorded for one verifier claim. */
 export const evidenceCompletionStatusSchema = z.enum([
     "pass",

package/dist/domain/firmware/firmwareAnalysis.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
+import { isAbsolute } from "node:path";
 import { digestSchema } from "../digests.js";
 import { jsonValueSchema } from "../jsonValue.js";
-import { isAbsoluteLocalPath, localPathStringSchema } from "../localPath.js";
+import { localPathStringSchema } from "../localPath.js";
 const bytes = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
 const range = z.strictObject({ offset: bytes, length: bytes.positive() });
 const target = {
     path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "path must be an absolute local filesystem path (for example /tmp/firmware.bin or C:\\firmware\\firmware.bin)",
     })
         .describe("Absolute local firmware file; never executed. Relative paths are rejected."),
@@ -17,7 +18,7 @@ export const firmwareInputSchemas = {
     extract_firmware: z.strictObject({
         ...target,
         output_directory: localPathStringSchema
-            .refine(isAbsoluteLocalPath, {
+            .refine(isAbsolute, {
             message: "output_directory must be an absolute local filesystem path",
         })
             .describe("Absolute, absent output directory; parent must exist"),

package/dist/domain/functionComparison.js

@@ -1,18 +1,18 @@
 import { canonicalJson } from "./comparisonSemantics.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { parseFunctionEvidence } from "./functionDossierEvidence.js";
 import { functionMatch } from "./functionComparisonNormalization.js";
 import { functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
 import { overallStatus, summarize } from "./functionComparisonResults.js";
 import { compareDimensions } from "./functionComparisonDimensions.js";
-export { functionComparisonInputSchema, functionComparisonResultSchema, } from "./functionComparisonSchemas.js";
 /** Compare two complete function Evidence records without fuzzy matching. */
 export const compareFunctions = (leftInput, rightInput) => {
     const left = parseFunctionEvidence(leftInput);
     const right = parseFunctionEvidence(rightInput);
-    const links = [left.evidence[0].evidence_id, right.evidence[0].evidence_id];
-    const providersDiffer = canonicalJson(left.provider, "Function comparison") !==
-        canonicalJson(right.provider, "Function comparison");
-    const dimensions = compareDimensions(left, right, links, providersDiffer);
+    const links = [left.evidence.evidence_id, right.evidence.evidence_id];
+    const providersDiffer = canonicalJson(left.evidence.provider, "Function comparison") !==
+        canonicalJson(right.evidence.provider, "Function comparison");
+    const dimensions = compareDimensions(left, right, { links, providersDiffer });
     const match = functionMatch(left, right);
     const changes = dimensions.filter(({ status }) => status !== "unchanged");
     return functionComparisonResultSchema.parse({
@@ -33,6 +33,6 @@ export const compareFunctions = (leftInput, rightInput) => {
                     ]
                     : []),
             ]),
-        ].sort((a, b) => a.localeCompare(b)),
+        ].sort((a, b) => compareUnicodeCodePoints(a, b)),
     });
 };