rea-agents 6.2.0 → 6.4.0

package/dist/domain/artifactIdentity.js

@@ -1,29 +1,57 @@
-import { canonicalDigest } from "./comparisonSemantics.js";
+import { posix } from "node:path";
+import { digestCanonicalValue } from "./canonicalDigest.js";
+/** NFC spelling of a logical archive path. Inventory and path joins share it. */
+export const logicalPathNfc = (value) => value.normalize("NFC");
+/**
+ * Lexical join against an inventoried logical path. The result is NFC.
+ * `"."` is the archive root. A path that escapes the root, or that contains
+ * NUL, is left in a form the caller can report; `logicalPathEscapesRoot`
+ * is then true.
+ */
+export const normalizeJoinedLogicalPath = (value) => {
+    if (value.includes("\0"))
+        return value;
+    return logicalPathNfc(posix.normalize(value.replaceAll("\\", "/")).replace(/^\.\//u, ""));
+};
+/** Whether a joined logical path leaves the archive root. */
+export const logicalPathEscapesRoot = (path) => path.includes("\0") ||
+    path === ".." ||
+    path.startsWith("../") ||
+    path.startsWith("/");
 /** Content-address an artifact independently of where it was observed. */
-export const artifactIdForContent = (sha256) => `art_${canonicalDigest({ sha256 }, "Artifact")}`;
+export const artifactIdForContent = (sha256) => `art_${digestCanonicalValue({ sha256 }, "Artifact")}`;
 /** Identify an occurrence by its root and exact logical location. */
 export const occurrenceIdForLocation = (input) => input.logicalPath === "."
-    ? `occ_${canonicalDigest({ root: input.rootArtifactId }, "Artifact")}`
-    : `occ_${canonicalDigest({
+    ? `occ_${digestCanonicalValue({ root: input.rootArtifactId }, "Artifact")}`
+    : `occ_${digestCanonicalValue({
         root_artifact_id: input.rootArtifactId,
         logical_path: input.logicalPath,
         entry_kind: input.entryKind,
     }, "Artifact")}`;
 /** Commit to graph members in the ordering established by the inventory owner. */
-export const artifactGraphDigest = (input) => canonicalDigest({
+export const artifactGraphDigest = (input) => digestCanonicalValue({
     nodes: input.nodes,
     occurrences: input.occurrences,
     edges: input.edges,
     integrity_contradictions: input.contradictions,
 }, "Artifact");
 /** Bind a root artifact to its graph commitment. */
-export const artifactManifestId = (rootArtifactId, graphSha256) => `agm_${canonicalDigest({ root_artifact_id: rootArtifactId, graph_sha256: graphSha256 }, "Artifact")}`;
+export const artifactManifestId = (rootArtifactId, graphSha256) => `agm_${digestCanonicalValue({ root_artifact_id: rootArtifactId, graph_sha256: graphSha256 }, "Artifact")}`;
 /** Identify one integrity disagreement at its observed logical path. */
-export const artifactContradictionId = (input) => `ic_${canonicalDigest({
+export const artifactContradictionId = (input) => `ic_${digestCanonicalValue({
     root_artifact_id: input.rootArtifactId,
     logical_path: input.logicalPath,
     declared_sha256: input.declaredSha256,
     observed_sha256: input.observedSha256,
 }, "Artifact")}`;
-/** Identify an edge by its semantic relationship and exact occurrence. */
-export const artifactEdgeId = (semantic) => `edge_${canonicalDigest(semantic, "Artifact")}`;
+/**
+ * Identify an edge by its semantic relationship and exact occurrence. The
+ * child artifact and logical path come from that occurrence.
+ */
+export const artifactEdgeId = (edge, occurrence) => `edge_${digestCanonicalValue({
+    parent_artifact_id: edge.parent_artifact_id,
+    child_artifact_id: occurrence.artifact_id,
+    relation: edge.relation,
+    occurrence_id: edge.occurrence_id,
+    logical_path: occurrence.logical_path,
+}, "Artifact")}`;

package/dist/domain/artifactInspection.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { artifactInventoryResultSchema, } from "./artifactGraph.js";
-import { canonicalDigest } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { jsonValueSchema } from "./jsonValue.js";
@@ -10,28 +10,11 @@ const evidenceIdSchema = prefixedDigestSchema("ev");
 const artifactIdSchema = prefixedDigestSchema("art");
 const inspectionObservationSchema = z.strictObject({
     observation_id: prefixedDigestSchema("aio"),
-    kind: z.enum(["root-manifest", "artifact", "occurrence", "integrity"]),
+    kind: z.enum(["root-manifest", "integrity"]),
     subject: textSchema,
     value: jsonValueSchema,
     evidence_id: evidenceIdSchema,
 });
-const inspectionRelationshipSchema = z.strictObject({
-    relationship_id: prefixedDigestSchema("air"),
-    relation: z.enum([
-        "contains",
-        "extracts",
-        "slice-of",
-        "embeds",
-        "loads",
-        "maps-source",
-        "derived-from",
-    ]),
-    source_artifact_id: artifactIdSchema,
-    target_artifact_id: artifactIdSchema,
-    occurrence_id: prefixedDigestSchema("occ"),
-    logical_path: textSchema.nullable(),
-    evidence_id: evidenceIdSchema,
-});
 const inspectionHypothesisSchema = z.strictObject({
     hypothesis_id: prefixedDigestSchema("aih"),
     statement: textSchema,
@@ -83,7 +66,6 @@ export const artifactInspectionResultSchema = z.strictObject({
     }))
         .min(1),
     observations: z.array(inspectionObservationSchema),
-    derived_relationships: z.array(inspectionRelationshipSchema),
     hypotheses: z.array(inspectionHypothesisSchema),
     contradictions: z.array(inspectionContradictionSchema),
     unexplored_branches: z.array(unexploredBranchSchema),
@@ -93,8 +75,6 @@ export const artifactInspectionResultSchema = z.strictObject({
         substeps_completed: z.literal(1),
         observations_retained: z.number().int().min(0),
         observations_omitted: z.number().int().min(0),
-        relationships_retained: z.number().int().min(0),
-        relationships_omitted: z.number().int().min(0),
         hypotheses_retained: z.number().int().min(0),
         hypotheses_omitted: z.number().int().min(0),
         unexplored_branches_retained: z.number().int().min(0),
@@ -110,20 +90,17 @@ export const createArtifactInspection = (inventoryInput) => {
     const inventoryEvidence = parseInventoryEvidence(inventoryInput);
     const inventory = artifactInventoryResultSchema.parse(inventoryEvidence.normalized_result);
     const observations = allObservations(inventory, inventoryEvidence.evidence_id);
-    const relationships = allRelationships(inventory, inventoryEvidence.evidence_id);
     const hypotheses = allHypotheses(inventory, inventoryEvidence.evidence_id);
     const nextProbes = probesFor(inventory);
     const branches = allUnexploredBranches(inventory, inventoryEvidence.evidence_id, nextProbes);
     const retained = {
         observations,
-        relationships,
         hypotheses,
         branches,
         probes: nextProbes,
     };
     const omissions = {
         observations: 0,
-        relationships: 0,
         hypotheses: 0,
         branches: 0,
         probes: 0,
@@ -137,7 +114,7 @@ export const createArtifactInspection = (inventoryInput) => {
         },
         substeps: [
             {
-                substep_id: `ais_${canonicalDigest({
+                substep_id: `ais_${digestCanonicalValue({
                     operation: "inventory_artifact",
                     evidence_id: inventoryEvidence.evidence_id,
                 }, "Artifact inspection")}`,
@@ -148,7 +125,6 @@ export const createArtifactInspection = (inventoryInput) => {
             },
         ],
         observations: retained.observations,
-        derived_relationships: retained.relationships,
         hypotheses: retained.hypotheses,
         contradictions: contradictions(inventory, inventoryEvidence.evidence_id),
         unexplored_branches: retained.branches,
@@ -158,8 +134,6 @@ export const createArtifactInspection = (inventoryInput) => {
             substeps_completed: 1,
             observations_retained: retained.observations.length,
             observations_omitted: omissions.observations,
-            relationships_retained: retained.relationships.length,
-            relationships_omitted: omissions.relationships,
             hypotheses_retained: retained.hypotheses.length,
             hypotheses_omitted: omissions.hypotheses,
             unexplored_branches_retained: retained.branches.length,
@@ -175,7 +149,7 @@ export const createArtifactInspection = (inventoryInput) => {
     };
     return artifactInspectionResultSchema.parse({
         ...semantic,
-        inspection_id: `ai_${canonicalDigest(semantic, "Artifact inspection")}`,
+        inspection_id: `ai_${digestCanonicalValue(semantic, "Artifact inspection")}`,
     });
 };
 const parseInventoryEvidence = (input) => {
@@ -184,10 +158,10 @@ const parseInventoryEvidence = (input) => {
         throw new TypeError("Artifact inspection substep requires inventory_artifact Evidence");
     return evidence;
 };
+// Artifact, occurrence, and edge records stay in the nested inventory Evidence;
+// restating each one here would repeat the complete graph in every result.
 const allObservations = (inventory, evidenceId) => [
     observation("root-manifest", inventory.manifest.root_artifact_id, inventory.manifest, evidenceId),
-    ...inventory.nodes.map((node) => observation("artifact", node.artifact_id, node, evidenceId)),
-    ...inventory.occurrences.map((occurrence) => observation("occurrence", occurrence.occurrence_id, occurrence, evidenceId)),
     ...inventory.integrity_contradictions.map((value) => observation("integrity", value.contradiction_id, value, evidenceId)),
 ];
 const observation = (kind, subject, value, evidenceId) => {
@@ -198,24 +172,10 @@ const observation = (kind, subject, value, evidenceId) => {
         evidence_id: evidenceId,
     };
     return {
-        observation_id: `aio_${canonicalDigest(semantic, "Artifact inspection")}`,
+        observation_id: `aio_${digestCanonicalValue(semantic, "Artifact inspection")}`,
         ...semantic,
     };
 };
-const allRelationships = (inventory, evidenceId) => inventory.edges.map((edge) => {
-    const semantic = {
-        relation: edge.relation,
-        source_artifact_id: edge.parent_artifact_id,
-        target_artifact_id: edge.child_artifact_id,
-        occurrence_id: edge.occurrence_id,
-        logical_path: edge.logical_path,
-        evidence_id: evidenceId,
-    };
-    return {
-        relationship_id: `air_${canonicalDigest(semantic, "Artifact inspection")}`,
-        ...semantic,
-    };
-});
 const allHypotheses = (inventory, evidenceId) => {
     const statements = inventory.manifest.root_format === "pe"
         ? [
@@ -234,7 +194,7 @@ const allHypotheses = (inventory, evidenceId) => {
             limitation: "Format classification proposes a bounded follow-up; it is not semantic proof.",
         };
         return {
-            hypothesis_id: `aih_${canonicalDigest(semantic, "Artifact inspection")}`,
+            hypothesis_id: `aih_${digestCanonicalValue(semantic, "Artifact inspection")}`,
             ...semantic,
         };
     });
@@ -248,7 +208,7 @@ const contradictions = (inventory, evidenceId) => inventory.integrity_contradict
         evidence_id: evidenceId,
     };
     return {
-        contradiction_id: `aic_${canonicalDigest(semantic, "Artifact inspection")}`,
+        contradiction_id: `aic_${digestCanonicalValue(semantic, "Artifact inspection")}`,
         ...semantic,
     };
 });
@@ -308,7 +268,7 @@ const branch = (reason, detail, nextProbe, evidenceId) => {
         evidence_id: evidenceId,
     };
     return {
-        branch_id: `aib_${canonicalDigest(semantic, "Artifact inspection")}`,
+        branch_id: `aib_${digestCanonicalValue(semantic, "Artifact inspection")}`,
         ...semantic,
     };
 };

package/dist/domain/artifactIntegrityPolicy.js

@@ -0,0 +1,10 @@
+import { z } from "zod";
+/**
+ * Caller choice for declared-versus-observed artifact integrity mismatches.
+ *
+ * `fail` rejects the operation; `record-and-continue` keeps the observed bytes
+ * as explicitly untrusted Evidence and reports each contradiction.
+ */
+export const artifactIntegrityPolicySchema = z
+    .enum(["fail", "record-and-continue"])
+    .default("fail");

package/dist/domain/artifactInventoryEvidence.js

@@ -1,5 +1,5 @@
 import { artifactInventoryResultSchema, } from "./artifactGraph.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { canonicalJson } from "./comparisonSemantics.js";
 import { artifactContradictionId, artifactEdgeId, artifactGraphDigest, artifactIdForContent, artifactManifestId, occurrenceIdForLocation, } from "./artifactIdentity.js";
 import { parseEvidence } from "./evidence.js";
@@ -68,9 +68,9 @@ const assembleInventorySet = (pages) => {
     return { evidence: pages.map(({ evidence }) => evidence), inventory };
 };
 const orderedInventory = (first, pages, values) => {
-    const nodes = [...values.nodes.values()].sort((left, right) => compareCodePoints(left.artifact_id, right.artifact_id));
-    const occurrences = [...values.occurrences.values()].sort((left, right) => compareCodePoints(left.logical_path, right.logical_path));
-    const edges = [...values.edges.values()].sort((left, right) => compareCodePoints(left.edge_id, right.edge_id));
+    const nodes = [...values.nodes.values()].sort((left, right) => compareUnicodeCodePoints(left.artifact_id, right.artifact_id));
+    const occurrences = [...values.occurrences.values()].sort((left, right) => compareUnicodeCodePoints(left.logical_path, right.logical_path));
+    const edges = [...values.edges.values()].sort((left, right) => compareUnicodeCodePoints(left.edge_id, right.edge_id));
     return {
         manifest: first.manifest,
         nodes,
@@ -79,7 +79,7 @@ const orderedInventory = (first, pages, values) => {
         integrityContradictions: first.integrity_contradictions,
         limitations: [
             ...new Set(pages.flatMap(({ inventory }) => inventory.limitations)),
-        ].sort(compareCodePoints),
+        ].sort(compareUnicodeCodePoints),
         complete: nodes.length === first.manifest.node_count &&
             occurrences.length === first.manifest.occurrence_count &&
             edges.length === first.manifest.edge_count,
@@ -97,8 +97,12 @@ const validateCompleteInventory = (inventory) => {
         throw new TypeError("Artifact root occurrence does not match its manifest representation");
     for (const occurrence of inventory.occurrences)
         validateOccurrence(occurrence, inventory, nodeIds, occurrenceIds);
+    const occurrencesById = new Map(inventory.occurrences.map((occurrence) => [
+        occurrence.occurrence_id,
+        occurrence,
+    ]));
     for (const edge of inventory.edges)
-        validateEdge(edge, nodeIds, occurrenceIds);
+        validateEdge(edge, nodeIds, occurrencesById);
     for (const contradiction of inventory.integrityContradictions) {
         if (!nodeIds.has(contradiction.parent_artifact_id) ||
             !occurrenceIds.has(contradiction.occurrence_id))
@@ -138,19 +142,14 @@ const validateOccurrence = (occurrence, inventory, nodeIds, occurrenceIds) => {
     if (occurrence.occurrence_id !== expectedId)
         throw new TypeError("Artifact occurrence ID does not match its identity");
 };
-const validateEdge = (edge, nodeIds, occurrenceIds) => {
+const validateEdge = (edge, nodeIds, occurrences) => {
+    const occurrence = occurrences.get(edge.occurrence_id);
     if (!nodeIds.has(edge.parent_artifact_id) ||
-        !nodeIds.has(edge.child_artifact_id) ||
-        !occurrenceIds.has(edge.occurrence_id))
+        occurrence?.artifact_id === null ||
+        occurrence === undefined ||
+        !nodeIds.has(occurrence.artifact_id))
         throw new TypeError("Artifact edge references a missing graph member");
-    const semantic = {
-        parent_artifact_id: edge.parent_artifact_id,
-        child_artifact_id: edge.child_artifact_id,
-        relation: edge.relation,
-        occurrence_id: edge.occurrence_id,
-        logical_path: edge.logical_path,
-    };
-    if (edge.edge_id !== artifactEdgeId(semantic))
+    if (edge.edge_id !== artifactEdgeId(edge, occurrence))
         throw new TypeError("Artifact edge ID does not match its identity");
 };
 const mergeExact = (output, key, value, label) => {

package/dist/domain/artifactPathSyntax.js

@@ -6,7 +6,7 @@
  * Policy divergence (deliberate, not yet unified):
  * - Local artifact paths resolve against an inventoried container root and
  *   report rejected | external | not-found. Confinement is lexical
- *   (posix.normalize must stay inside the root).
+ *   (normalizeJoinedLogicalPath must stay inside the root).
  * - Live DOM destinations resolve against the document base URL and report
  *   approved | outside_policy | unsupported against allowedOrigins
  *   (see CdpCaptureDocuments.domDestination).

package/dist/domain/binaryTarget.js

@@ -103,6 +103,20 @@ const parseElf = (bytes, fileSize) => {
     const architecture = elfArchitecture(machine);
     if (architecture === undefined)
         return err("unsupported ELF architecture");
+    if (architecture === "mips")
+        return ok({
+            format: "elf",
+            architecture,
+            availableArchitectures: [architecture],
+            mips: {
+                elfClass: bytes[4] === 1 ? 32 : 64,
+                byteOrder: little ? "little" : "big",
+                type: little ? bytes.readUInt16LE(16) : bytes.readUInt16BE(16),
+                flags: little
+                    ? bytes.readUInt32LE(bytes[4] === 1 ? 36 : 48)
+                    : bytes.readUInt32BE(bytes[4] === 1 ? 36 : 48),
+            },
+        });
     return ok({
         format: "elf",
         architecture,
@@ -197,6 +211,8 @@ const elfArchitecture = (machine) => {
             return "x86";
         case 62:
             return "x86_64";
+        case 8: // EM_MIPS: ISA, ABI and byte order remain separate ELF facts.
+            return "mips";
         case 40:
             return "arm";
         case 183:

package/dist/domain/binaryTargetTypes.js

@@ -1 +1,8 @@
-export {};
+/** Provider-neutral CPU families detected from supported executable headers. */
+export const BINARY_ARCHITECTURES = [
+    "x86",
+    "x86_64",
+    "arm",
+    "arm64",
+    "mips",
+];

package/dist/domain/browserCompleteness.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /** Stable browser sections used by coverage and omission accounting. */
 const browserSectionSchema = z.enum([
     "frames",
@@ -98,5 +99,5 @@ export const classifyBrowserCompleteness = (input) => {
     });
 };
 const sortedSections = (sections) => [...sections].sort();
-const canonicalExclusions = (exclusions) => [...exclusions].sort((left, right) => left.section.localeCompare(right.section) ||
-    left.reason.localeCompare(right.reason));
+const canonicalExclusions = (exclusions) => [...exclusions].sort((left, right) => compareUnicodeCodePoints(left.section, right.section) ||
+    compareUnicodeCodePoints(left.reason, right.reason));

package/dist/domain/browserObservationSchemas.js

@@ -159,11 +159,10 @@ const browserConsoleEventSchema = z.object({
         retained_bytes: z.number().int().min(0),
     }),
 });
-const browserWebSocketEventSchema = z.object({
-    request_id: z.string(),
+const browserWebSocketFrameSchema = z.object({
     direction: z.enum(["sent", "received"]),
     opcode: z.number().int().min(0),
-    payload_bytes: z.number().int().min(0),
+    payload_bytes: z.number().int().min(0).nullable(),
     payload_shape: z
         .object({
         format: z.enum(["json", "text", "binary"]),
@@ -171,6 +170,11 @@ const browserWebSocketEventSchema = z.object({
     })
         .nullable(),
 });
+const browserWebSocketConnectionSchema = z.object({
+    request_id: z.string(),
+    url: z.string(),
+    events: z.array(browserWebSocketFrameSchema),
+});
 const browserWorkerSchema = z.object({
     target_id: z.string(),
     type: z.string(),
@@ -275,7 +279,7 @@ export const webPageInspectionSchema = z.object({
     resources: z.array(browserResourceSchema),
     network: z.object({
         requests: z.array(browserNetworkRequestSchema),
-        websocket_events: z.array(browserWebSocketEventSchema),
+        websocket_connections: z.array(browserWebSocketConnectionSchema),
         coverage_started_at: z.iso.datetime(),
         prior_activity_available: z.literal(false),
     }),

package/dist/domain/browserScenarioCaptureValues.js

@@ -103,8 +103,8 @@ const eventBase = {
 const eventUrl = sanitizedBrowserUrlSchema.nullable();
 const networkEventShape = {
     ...eventBase,
-    transaction_id: z.string().min(1).optional(),
-    redirected_from_transaction_id: z.string().min(1).nullable().optional(),
+    transaction_id: z.string().min(1),
+    redirected_from_transaction_id: z.string().min(1).nullable(),
     method: z.string().min(1),
     url: sanitizedBrowserUrlSchema,
     resource_type: z.string().min(1),

package/dist/domain/browserScenarioNormalization.js

@@ -1,4 +1,4 @@
-import { canonicalDigest } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 const BUILT_IN_RULES = [
     "ignore_step_elapsed_ms",
     "ignore_event_sequence",
@@ -17,11 +17,11 @@ export const commitBrowserScenarioNormalization = (input) => {
     const commitment = { built_in_rules: [...BUILT_IN_RULES], rules };
     return {
         ...commitment,
-        sha256: canonicalDigest(commitment, "Browser scenario"),
+        sha256: digestCanonicalValue(commitment, "Browser scenario"),
     };
 };
 /** Digest one artifact after applying committed exact-literal rules. */
-export const digestNormalizedScenarioValue = (value, artifact, rules) => canonicalDigest(normalize(value, artifact, rules), "Browser scenario");
+export const digestNormalizedScenarioValue = (value, artifact, rules) => digestCanonicalValue(normalize(value, artifact, rules), "Browser scenario");
 const normalize = (value, artifact, rules) => {
     if (artifact === "screenshot")
         return value;

package/dist/domain/browserScenarioValues.js

@@ -1,10 +1,11 @@
 import { z } from "zod";
+import { isAbsolute } from "node:path";
 import { IDENTIFIER_PATTERN } from "./stringPatterns.js";
-import { isAbsoluteLocalPath, localPathStringSchema } from "./localPath.js";
+import { localPathStringSchema } from "./localPath.js";
 import { browserNetworkContentSelectionSchema } from "./browserNetworkEvidence.js";
 import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
 export const scenarioIdentifierSchema = z.string().regex(IDENTIFIER_PATTERN);
-const browserExecutablePathSchema = localPathStringSchema.refine(isAbsoluteLocalPath, {
+const browserExecutablePathSchema = localPathStringSchema.refine(isAbsolute, {
     message: "executable_path must be an absolute local filesystem path (for example /opt/chromium/chrome or C:\\chromium\\chrome.exe)",
 });
 const browserScenarioBaseUrlSchema = z

package/dist/domain/callPath.js

@@ -1,5 +1,6 @@
 import { callPathInputSchema, callPathResultSchema, parseCallPathAddress, } from "./callPathSchemas.js";
 import { parseFunctionEvidence, } from "./functionDossierEvidence.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 /** Minimal directed caller-to-callee adjacency for call-path search. */
 class CallGraph {
     successors = new Map();
@@ -76,7 +77,7 @@ export const buildCallPath = (input) => {
         goal: parsed.goal.address,
         explored: summarizeSearch(graph, search.reached),
         evidence_links: uniqueEvidence(snapshots.values()),
-        limitations: [...new Set(limitations)].sort((left, right) => left.localeCompare(right)),
+        limitations: [...new Set(limitations)].sort(compareUnicodeCodePoints),
     };
     const searchScope = { exhaustive };
     if (found)
@@ -111,9 +112,9 @@ const parseSnapshots = (groups) => {
     const snapshots = new Map();
     for (const group of groups) {
         const snapshot = parseFunctionEvidence(group);
-        const address = normalizeAddress(snapshot.dossier.procedure.address);
+        const address = parseCallPathAddress(snapshot.dossier.procedure.address);
         for (const callee of snapshot.dossier.callees)
-            normalizeAddress(callee.address);
+            parseCallPathAddress(callee.address);
         if (snapshots.has(address))
             throw new TypeError(`Duplicate function Evidence for ${address}`);
         snapshots.set(address, snapshot);
@@ -141,7 +142,7 @@ const createGraph = (snapshots) => {
     for (const [address, snapshot] of snapshots) {
         graph.mergeNode(address);
         for (const callee of snapshot.dossier.callees) {
-            const calleeAddress = normalizeAddress(callee.address);
+            const calleeAddress = parseCallPathAddress(callee.address);
             graph.mergeNode(calleeAddress);
             graph.mergeDirectedEdge(address, calleeAddress);
         }
@@ -174,9 +175,7 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
             limitations.push(`No analyze_function Evidence covers reachable function ${node}`);
             continue;
         }
-        const neighbors = graph
-            .outNeighbors(node)
-            .sort((left, right) => left.localeCompare(right));
+        const neighbors = graph.outNeighbors(node).sort(compareUnicodeCodePoints);
         for (const neighbor of neighbors)
             if (!reached.has(neighbor)) {
                 reached.set(neighbor, depth + 1);
@@ -203,7 +202,7 @@ const enumeratePaths = ({ graph, start, goal, goalDistances, }) => {
                 .outNeighbors(node)
                 .filter((neighbor) => distance !== undefined &&
                 goalDistances.get(neighbor) === distance - 1)
-                .sort((left, right) => left.localeCompare(right));
+                .sort(compareUnicodeCodePoints);
             neighbors.set(node, candidates);
         }
         return { neighbors: candidates, nextIndex: 0 };
@@ -270,5 +269,4 @@ const snapshotLinks = (snapshot) => {
 };
 const uniqueEvidence = (snapshots) => [
     ...new Set([...snapshots].flatMap((snapshot) => snapshotLinks(snapshot))),
-].sort((left, right) => left.localeCompare(right));
-const normalizeAddress = (input) => parseCallPathAddress(input);
+].sort(compareUnicodeCodePoints);

package/dist/domain/canonicalDigest.js

@@ -1,5 +1,10 @@
 import { createHash } from "node:crypto";
-/** Hash canonicalize-compatible JSON without assembling an aggregate string. */
+/**
+ * Streaming SHA-256 over canonical JSON. Hashing owner (avoids assembling
+ * aggregate strings); `comparisonSemantics.canonicalJson` (canonicalize lib)
+ * is the string-comparison owner. JSON object keys follow RFC 8785's UTF-16
+ * code-unit order in both; entity-list ordering is a separate concern.
+ */
 export const digestCanonicalValue = (value, context = "Comparison") => {
     const hash = createHash("sha256");
     // Batch small emitted parts to cut hash.update crossings.
@@ -54,6 +59,7 @@ const emitCanonical = (value, emit, ancestors) => {
         else {
             emit("{");
             let first = true;
+            // Match canonicalize/RFC 8785, including supplementary-plane keys.
             for (const key of Object.keys(value).sort()) {
                 if (Reflect.get(value, key) === undefined ||
                     typeof Reflect.get(value, key) === "symbol")

package/dist/domain/canonicalJsonDigestSteps.js

@@ -4,6 +4,9 @@ export function* canonicalJsonDigestSteps(value) {
     const hash = createHash("sha256");
     const ancestors = new Set();
     const stack = [{ kind: "value", value }];
+    const encodedKeys = new Map();
+    // Keep reusable key encodings within one existing digest-buffer quantum.
+    let remainingKeyCodeUnits = 8192;
     let buffered = "";
     let flushed = false;
     const emit = (part) => {
@@ -46,21 +49,22 @@ export function* canonicalJsonDigestSteps(value) {
                 stack.push(frame);
                 continue;
             }
+            let item;
             if (frame.kind === "array") {
                 if (frame.index === frame.length) {
                     emit("]");
                     ancestors.delete(frame.value);
                     continue;
                 }
-                const item = frame.value[frame.index];
-                if (item === undefined)
+                const element = frame.value[frame.index];
+                if (element === undefined)
                     throw new TypeError("Canonical JSON digest requires dense JSON arrays");
                 if (frame.index++ > 0)
                     emit(",");
-                stack.push(frame, { kind: "value", value: item });
-                continue;
+                stack.push(frame);
+                item = element;
             }
-            if (frame.kind === "object") {
+            else if (frame.kind === "object") {
                 if (frame.index === frame.keys.length) {
                     emit("}");
                     ancestors.delete(frame.value);
@@ -69,22 +73,39 @@ export function* canonicalJsonDigestSteps(value) {
                 const key = frame.keys[frame.index++];
                 if (key === undefined)
                     throw new TypeError("Canonical JSON object changed during hashing");
-                const item = frame.value[key];
-                if (item === undefined)
+                const property = frame.value[key];
+                if (property === undefined) {
+                    stack.push(frame);
                     continue;
+                }
                 if (frame.written++ > 0)
                     emit(",");
                 if (key.length > 8192) {
                     emit('"');
-                    stack.push(frame, { kind: "value", value: item }, { kind: "separator" }, { kind: "string", value: key, index: 0 });
+                    stack.push(frame, { kind: "value", value: property }, { kind: "separator" }, { kind: "string", value: key, index: 0 });
                     continue;
                 }
-                emit(JSON.stringify(key));
+                let encodedKey = encodedKeys.get(key);
+                if (encodedKey === undefined) {
+                    encodedKey = JSON.stringify(key);
+                    if (encodedKey.length <= remainingKeyCodeUnits) {
+                        encodedKeys.set(key, encodedKey);
+                        remainingKeyCodeUnits -= encodedKey.length;
+                    }
+                }
+                emit(encodedKey);
                 emit(":");
-                stack.push(frame, { kind: "value", value: item });
-                continue;
+                stack.push(frame);
+                item = property;
+            }
+            else {
+                item = frame.value;
+            }
+            // Resume containers directly; scalar members need no temporary value frame.
+            if (flushed) {
+                flushed = false;
+                yield;
             }
-            const item = frame.value;
             if (typeof item === "string" && item.length > 8192) {
                 emit('"');
                 stack.push({ kind: "string", value: item, index: 0 });
@@ -128,6 +149,7 @@ export function* canonicalJsonDigestSteps(value) {
     finally {
         stack.length = 0;
         ancestors.clear();
+        encodedKeys.clear();
         buffered = "";
     }
 }