rea-agents 6.3.0 → 6.4.0

package/dist/domain/apple/appleBundleAnatomy.js

@@ -42,6 +42,42 @@ export const isSidecar = (path) => {
     return (segments.includes("__MACOSX") || (segments.at(-1) ?? "").startsWith("._"));
 };
 export const isWithin = (path, root) => root === "." || path === root || path.startsWith(`${root}/`);
+/**
+ * English (en-US) case fold used only for Apple's fixed anatomy vocabulary.
+ * Reported paths keep the archive spelling. Inventory identity stays case-sensitive.
+ */
+export const anatomyNameIs = (actual, expected) => actual.toLocaleLowerCase("en-US") === expected.toLocaleLowerCase("en-US");
+/** Directory entry that folds to one vocabulary word. The exact spelling wins. */
+export const anatomyChild = (names, expected) => {
+    if (names === undefined)
+        return null;
+    let exact;
+    let folded;
+    for (const name of names) {
+        if (name === expected)
+            exact = name;
+        else if (anatomyNameIs(name, expected) &&
+            (folded === undefined || compare(name, folded) < 0))
+            folded = name;
+    }
+    return exact ?? folded ?? null;
+};
+/**
+ * Whether `path`'s tail matches anatomy vocabulary. `*` matches one segment
+ * that is not itself a vocabulary comparison.
+ */
+export const anatomyTailMatches = (path, expected) => {
+    const actual = path.split("/");
+    if (actual.length < expected.length)
+        return false;
+    const tail = actual.slice(-expected.length);
+    return expected.every((name, index) => {
+        const segment = tail[index];
+        if (segment === undefined || segment.length === 0)
+            return false;
+        return name === "*" || anatomyNameIs(segment, name);
+    });
+};
 /**
  * Outermost iOS (`Payload/X.app`) and macOS (`X.app/Contents/…`) applications.
  * An inventoried `.app` directory is its own root, `.`.
@@ -55,13 +91,16 @@ export const applicationRoots = (entries, subject) => {
     for (const { path } of entries) {
         if (isSidecar(path))
             continue;
-        const ios = /^(Payload\/[^/]+\.app)(?:\/|$)/u.exec(path);
-        if (ios?.[1] !== undefined) {
-            found.add(ios[1]);
+        const segments = path.split("/");
+        const app = segments[1];
+        if (anatomyNameIs(segments[0] ?? "", "Payload") &&
+            app !== undefined &&
+            /\.app$/iu.test(app)) {
+            found.add(`${segments[0]}/${app}`);
             continue;
         }
-        const segments = path.split("/");
-        const index = segments.findIndex((segment, position) => /\.app$/iu.test(segment) && segments[position + 1] === "Contents");
+        const index = segments.findIndex((segment, position) => /\.app$/iu.test(segment) &&
+            anatomyNameIs(segments[position + 1] ?? "", "Contents"));
         if (index >= 0)
             found.add(segments.slice(0, index + 1).join("/"));
     }
@@ -142,9 +181,9 @@ const enclosingBundle = (path, bundles) => {
 };
 const bundleLayout = (bundle, tree) => {
     const names = tree.children.get(directoryOf(bundle));
-    if (names?.has("Contents") === true)
+    if (anatomyChild(names, "Contents") !== null)
         return "macos-deep";
-    if (names?.has("Versions") === true)
+    if (anatomyChild(names, "Versions") !== null)
         return "versioned-framework";
     return "shallow";
 };
@@ -163,15 +202,18 @@ const bundleRole = (bundle) => {
     if (name.endsWith(".dext"))
         return "driver-extension";
     if (name.endsWith(".bundle")) {
-        if (container === "PlugIns")
+        if (anatomyNameIs(container ?? "", "PlugIns"))
             return "plug-in";
-        return container === "Resources" ? "resource-bundle" : "bundle";
+        return anatomyNameIs(container ?? "", "Resources")
+            ? "resource-bundle"
+            : "bundle";
     }
     if (!name.endsWith(".app"))
         return "plug-in";
-    if (container === "LoginItems" && segments.at(-3) === "Library")
+    if (anatomyNameIs(container ?? "", "LoginItems") &&
+        anatomyNameIs(segments.at(-3) ?? "", "Library"))
         return "login-item";
-    if (container === "Helpers")
+    if (anatomyNameIs(container ?? "", "Helpers"))
         return "helper-application";
     return "nested-application";
 };
@@ -183,42 +225,67 @@ const directFiles = (directory, tree) => [...(tree.children.get(directory) ?? []
 /** Content directories; `Versions/Current` is a symlink outside the inventory. */
 const contentDirectories = (bundle, layout, tree) => {
     const directory = directoryOf(bundle);
-    if (layout === "macos-deep")
-        return [joinPath(directory, "Contents")];
+    if (layout === "macos-deep") {
+        const contents = namedChild(tree, directory, "Contents");
+        return contents === null ? [] : [contents];
+    }
     if (layout === "shallow")
         return [directory];
-    const versions = joinPath(directory, "Versions");
+    const versions = namedChild(tree, directory, "Versions");
+    if (versions === null)
+        return [];
     // Only real version directories count: Current is a symlink, and files
     // such as .DS_Store are not versions.
     return [...(tree.children.get(versions) ?? [])]
-        .filter((version) => version !== "Current")
+        .filter((version) => !anatomyNameIs(version, "Current"))
         .map((version) => joinPath(versions, version))
         .filter((version) => tree.directories.has(version))
         .sort(compare);
 };
+/** Child path using the archive's spelling of one anatomy name. */
+const namedChild = (tree, directory, expected) => {
+    const name = anatomyChild(tree.children.get(directory), expected);
+    return name === null ? null : joinPath(directory, name);
+};
 const infoPlistPath = (bundle, layout, tree) => {
     const directories = contentDirectories(bundle, layout, tree);
     // With several real versions, Versions/Current (a symlink outside the
     // inventory) decides which plist applies, so the plist stays unknown.
     if (directories.length !== 1)
         return null;
-    const candidates = directories
-        .map((directory) => joinPath(directory, layout === "versioned-framework"
-        ? "Resources/Info.plist"
-        : "Info.plist"))
-        .filter((path) => tree.files.has(path));
-    return candidates.length === 1 ? (candidates[0] ?? null) : null;
+    const directory = directories[0];
+    if (directory === undefined)
+        return null;
+    const parent = layout === "versioned-framework"
+        ? namedChild(tree, directory, "Resources")
+        : directory;
+    if (parent === null)
+        return null;
+    const info = namedChild(tree, parent, "Info.plist");
+    return info !== null && tree.files.has(info) ? info : null;
 };
 const executableCandidates = (bundle, layout, tree) => contentDirectories(bundle, layout, tree)
-    .flatMap((directory) => directFiles(layout === "macos-deep" ? joinPath(directory, "MacOS") : directory, tree))
+    .flatMap((directory) => {
+    const executableDirectory = layout === "macos-deep"
+        ? namedChild(tree, directory, "MacOS")
+        : directory;
+    return executableDirectory === null
+        ? []
+        : directFiles(executableDirectory, tree);
+})
     .filter((path) => MACH_O_FORMATS.includes(tree.files.get(path)?.format ?? ""));
 const signingPaths = (bundle, layout, tree) => contentDirectories(bundle, layout, tree)
-    .flatMap((directory) => [
-    joinPath(directory, "_CodeSignature/CodeResources"),
-    joinPath(directory, "embedded.provisionprofile"),
-    joinPath(directory, "embedded.mobileprovision"),
-])
-    .filter((path) => tree.files.has(path))
+    .flatMap((directory) => {
+    const signature = namedChild(tree, directory, "_CodeSignature");
+    return [
+        signature === null
+            ? null
+            : namedChild(tree, signature, "CodeResources"),
+        namedChild(tree, directory, "embedded.provisionprofile"),
+        namedChild(tree, directory, "embedded.mobileprovision"),
+    ];
+})
+    .filter((path) => path !== null && tree.files.has(path))
     .sort(compare);
 /** Platforms of application roots whose layout was observed, not assumed. */
 export const platformsOf = (bundles) => [

package/dist/domain/apple/dyldPaths.js

@@ -11,6 +11,8 @@ export const resolveTreePath = async (view, input) => {
     let hops = 0;
     while (pending.length > 0) {
         const segment = pending.shift() ?? "";
+        if (segment === ".")
+            continue;
         if (segment === "..") {
             if (resolved.length === 0)
                 return { kind: "escapes" };
@@ -40,7 +42,13 @@ export const resolveTreePath = async (view, input) => {
         ? { kind: "file", path: resolved.join("/") }
         : { kind: "not-file" };
 };
-const segmentsOf = (path) => path.split("/").filter((segment) => segment !== "" && segment !== ".");
+const segmentsOf = (path) => {
+    const segments = path.split("/").filter((segment) => segment !== "");
+    // a trailing slash requires a directory, just like a final dot component.
+    if (path.endsWith("/"))
+        segments.push(".");
+    return segments;
+};
 export const directoryOf = (path) => {
     const index = path.lastIndexOf("/");
     return index < 0 ? "" : path.slice(0, index);

package/dist/domain/apple/dylibResolution.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { compatibleSlice, directoryOf, expandPrefix, joinPath, resolveTreePath, } from "./dyldPaths.js";
+import { compatibleSlice, directoryOf, expandPrefix, resolveTreePath, } from "./dyldPaths.js";
 import { digestSchema } from "../digests.js";
 import { hasApplicableDyldOverrides, embeddedDyldOverrides, } from "./dyldEnvironment.js";
 import { DYLIB_RESOLUTION_LIMITATIONS, deriveFindings, } from "./dylibResolutionFindings.js";
@@ -169,7 +169,7 @@ const candidateTemplates = (dependency, loader, context) => {
             scope: base.scope,
             path: base.scope === "outside"
                 ? `${base.path.replace(/\/+$/u, "")}/${rest}`
-                : joinPath(base.path, rest),
+                : `${base.path}${base.path === "" ? "" : "/"}${rest}`,
         };
         return { expansion, source: "rpath", rpath, rpathOwner: owner };
     }));

package/dist/domain/apple/interfaceBuilderGraph.js

@@ -30,13 +30,16 @@ export const buildInterfaceBuilderAnalysis = (input) => {
     let omittedHierarchyReferences = 0;
     for (const document of input.documents.slice(0, input.limits.max_documents)) {
         const parsed = parseInterfaceBuilderRecords(document.raw);
-        const prefix = `ib:${document.relativePath}:`;
+        const prefix = `ib:${JSON.stringify(document.relativePath)}:`;
+        const graphId = (kind, parts = []) => `${prefix}${kind}:${JSON.stringify(parts)}`;
         const rootId = `${prefix}root`;
         const objectIds = new Set(parsed.objects.map(({ id }) => id));
         const evidenceFor = (description) => [
             {
                 kind: "interface_builder_resource",
-                description: `${document.relativePath}: ${description}`,
+                // artifact_path names the archive; repeating it here cost a path per
+                // node and edge.
+                description,
                 location: { address: null, file_offset: null },
                 artifact_path: document.relativePath,
                 artifact_sha256: document.archiveSha256,
@@ -66,7 +69,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
         addNode(rootNode);
         let documentObjectCount = 0;
         for (const object of parsed.objects.slice(0, input.limits.max_objects)) {
-            const id = `${prefix}object:${object.id}`;
+            const id = graphId("object", [object.id]);
             const kind = object.kind === "other" ? "unknown" : object.kind;
             if (!addNode({
                 id,
@@ -88,7 +91,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
         let hierarchyEdgeCount = 0;
         let documentOmittedConnections = 0;
         let documentOmittedHierarchyEdges = 0;
-        const objectNodeId = (objectId) => `${prefix}object:${objectId}`;
+        const objectNodeId = (objectId) => graphId("object", [objectId]);
         const addEdge = (edge, isHierarchy) => {
             if (isHierarchy
                 ? hierarchyEdgeCount >= input.limits.max_objects
@@ -181,7 +184,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                     const known = objectIds.has(objectId);
                     const childId = known
                         ? objectNodeId(objectId)
-                        : `${prefix}unknown:${objectId}`;
+                        : graphId("unknown", [objectId]);
                     if (!known &&
                         !addNode({
                             id: childId,
@@ -192,7 +195,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                             evidence: evidenceFor(`hierarchy item ${objectId}`),
                         }))
                         hierarchyTruncated = true;
-                    connect(`${prefix}hierarchy:${parentId}:${childId}`, parentId, childId, "contains", `hierarchy ${objectId}`);
+                    connect(graphId("hierarchy", [parentId, childId]), parentId, childId, "contains", `hierarchy ${objectId}`);
                     nextParent = childId;
                     hierarchyCount += 1;
                 }
@@ -216,10 +219,10 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                 });
             const destinationId = item.destination_id === null ? null : objectNodeId(item.destination_id);
             if (item.kind === "action") {
-                const actionId = `${prefix}action:${item.id}`;
+                const actionId = graphId("action", [item.id]);
                 const selectorId = item.label === null
                     ? null
-                    : `${prefix}selector:${item.destination_id ?? "unknown"}:${item.label}`;
+                    : graphId("selector", [item.destination_id, item.label]);
                 addNode({
                     id: actionId,
                     kind: "action",
@@ -232,7 +235,7 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                     },
                     evidence: evidenceFor(`action ${item.id}`),
                 });
-                connect(`${actionId}:source`, sourceId, actionId, "target_action", `action source ${item.source_id}`);
+                connect(graphId("action-edge", [item.id, "source"]), sourceId, actionId, "target_action", `action source ${item.source_id}`);
                 if (selectorId !== null) {
                     addNode({
                         id: selectorId,
@@ -242,15 +245,15 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                         attributes: { destination_id: item.destination_id },
                         evidence: evidenceFor(`selector ${item.label}`),
                     });
-                    connect(`${actionId}:selector`, actionId, selectorId, "target_action", `selector ${item.label}`);
+                    connect(graphId("action-edge", [item.id, "selector"]), actionId, selectorId, "target_action", `selector ${item.label}`);
                 }
                 if (destinationId === null || !nodes.has(destinationId))
-                    connect(`${actionId}:destination`, actionId, null, "target_action", `action destination ${item.destination_id ?? "missing"}`, "destination_object_missing_or_external");
+                    connect(graphId("action-edge", [item.id, "destination"]), actionId, null, "target_action", `action destination ${item.destination_id ?? "missing"}`, "destination_object_missing_or_external");
                 else
-                    connect(`${actionId}:destination`, actionId, destinationId, "target_action", `action destination ${item.destination_id}`);
+                    connect(graphId("action-edge", [item.id, "destination"]), actionId, destinationId, "target_action", `action destination ${item.destination_id}`);
             }
             else if (item.kind === "outlet") {
-                const outletId = `${prefix}outlet:${item.id}`;
+                const outletId = graphId("outlet", [item.id]);
                 addNode({
                     id: outletId,
                     kind: "outlet",
@@ -259,20 +262,20 @@ export const buildInterfaceBuilderAnalysis = (input) => {
                     attributes: item.attributes,
                     evidence: evidenceFor(`outlet ${item.id}`),
                 });
-                connect(`${outletId}:source`, sourceId, outletId, "contains", `outlet source ${item.source_id}`);
+                connect(graphId("outlet-edge", [item.id, "source"]), sourceId, outletId, "contains", `outlet source ${item.source_id}`);
                 if (destinationId === null || !nodes.has(destinationId))
-                    connect(`${outletId}:destination`, outletId, null, "outlet_to", `outlet ${item.label ?? item.id}`, "destination_object_missing_or_external");
+                    connect(graphId("outlet-edge", [item.id, "destination"]), outletId, null, "outlet_to", `outlet ${item.label ?? item.id}`, "destination_object_missing_or_external");
                 else
-                    connect(`${outletId}:destination`, outletId, destinationId, "outlet_to", `outlet ${item.label ?? item.id}`);
+                    connect(graphId("outlet-edge", [item.id, "destination"]), outletId, destinationId, "outlet_to", `outlet ${item.label ?? item.id}`);
             }
             else if (item.kind === "segue") {
                 if (destinationId === null || !nodes.has(destinationId))
-                    connect(`${prefix}segue:${index}`, sourceId, null, "segue_to", `segue ${item.label ?? item.id}`, "destination_scene_missing");
+                    connect(graphId("segue", [index]), sourceId, null, "segue_to", `segue ${item.label ?? item.id}`, "destination_scene_missing");
                 else
-                    connect(`${prefix}segue:${index}`, sourceId, destinationId, "segue_to", `segue ${item.label ?? item.id}`);
+                    connect(graphId("segue", [index]), sourceId, destinationId, "segue_to", `segue ${item.label ?? item.id}`);
             }
             else {
-                connect(`${prefix}unknown-connection:${index}`, sourceId, null, "contains", `connection type ${item.kind}`, "unsupported_connection_type");
+                connect(graphId("unknown-connection", [index]), sourceId, null, "contains", `connection type ${item.kind}`, "unsupported_connection_type");
             }
         }
         const objectsTruncated = parsed.omittedObjects > 0 || parsed.objects.length > documentObjectCount;

package/dist/domain/apple/interfaceBuilderKeyedArchive.js

@@ -44,12 +44,21 @@ export const parseInterfaceBuilderRecords = (value) => {
         const attributes = record(raw);
         const className = firstString(attributes["customClass"], attributes["class"], attributes["isa"]);
         const label = firstString(attributes["label"], attributes["title"], attributes["name"], className);
+        // class_name, name, and id already carry these values; repeating them in
+        // attributes doubled them on every graph node.
+        const carried = new Set();
+        if (attributes["customClass"] === className)
+            carried.add("customClass");
+        if (attributes["label"] === label)
+            carried.add("label");
+        if (attributes["objectID"] === id)
+            carried.add("objectID");
         objects.push(objectNode.parse({
             id,
             kind: classifyObject(className),
             class_name: className,
             name: label ?? id,
-            attributes: jsonSafeRecord(attributes),
+            attributes: jsonSafeRecord(Object.fromEntries(Object.entries(attributes).filter(([key]) => !carried.has(key)))),
         }));
     }
     for (const [sourceId, rawConnections] of Object.entries(connectionsRaw)) {

package/dist/domain/artifactComparison.js

@@ -5,6 +5,7 @@ import { evidenceSchema } from "./evidence.js";
 import { parseArtifactInventoryEvidence, } from "./artifactInventoryEvidence.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 import { canonicalJson } from "./comparisonSemantics.js";
+import { ZIP_NON_ENTRY_TAIL_LIMITATION } from "./zipPackageFormat.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const comparisonStatusSchema = z.enum([
     "unchanged",
@@ -95,6 +96,12 @@ export const compareArtifacts = (leftEvidence, rightEvidence) => {
         ...left.evidence.map(({ evidence_id: id }) => id),
         ...right.evidence.map(({ evidence_id: id }) => id),
     ], leftCovered && rightCovered);
+    const rootChange = rootHashChange(left.inventory, right.inventory, changes, [
+        ...left.evidence.map(({ evidence_id: id }) => id),
+        ...right.evidence.map(({ evidence_id: id }) => id),
+    ]);
+    if (rootChange !== null)
+        changes.push(rootChange);
     const summary = summarize(left.inventory, right.inventory, changes, leftCovered && rightCovered);
     return artifactComparisonResultSchema.parse({
         status: !leftComplete || !rightComplete
@@ -251,18 +258,20 @@ const relationsByPath = (inventory) => {
     const output = new Map();
     const occurrences = new Map(inventory.occurrences.map((item) => [item.occurrence_id, item]));
     for (const edge of inventory.edges) {
-        const path = edge.logical_path ?? ".";
-        const values = output.get(path);
         const occurrence = occurrences.get(edge.occurrence_id);
+        // An incomplete inventory can omit the occurrence that names the child.
+        if (occurrence?.artifact_id === null || occurrence === undefined)
+            continue;
+        const path = occurrence.logical_path;
+        const values = output.get(path);
         const projection = {
-            parent_logical_path: occurrence?.parent_occurrence_id === null ||
-                occurrence?.parent_occurrence_id === undefined
+            parent_logical_path: occurrence.parent_occurrence_id === null
                 ? null
                 : (occurrences.get(occurrence.parent_occurrence_id)?.logical_path ??
                     null),
-            child_artifact_id: edge.child_artifact_id,
+            child_artifact_id: occurrence.artifact_id,
             relation: edge.relation,
-            logical_path: edge.logical_path,
+            logical_path: occurrence.logical_path,
             producer: edge.producer,
         };
         if (values === undefined)
@@ -302,4 +311,23 @@ const summarize = (left, right, changes, covered) => {
                 counts.contradiction),
     };
 };
-const hasCoverageLimitation = (limitations) => limitations.some((limitation) => !/integrity contradiction\(s\) were recorded/u.test(limitation));
+const hasCoverageLimitation = (limitations) => limitations.some((limitation) => limitation !== ZIP_NON_ENTRY_TAIL_LIMITATION &&
+    !/integrity contradiction\(s\) were recorded/u.test(limitation));
+const rootHashChange = (left, right, changes, evidenceLinks) => {
+    if (left.manifest.root_sha256 === right.manifest.root_sha256)
+        return null;
+    if (changes.some((change) => change.logical_path === "." && change.dimensions.includes("content")))
+        return null;
+    const leftRoot = left.occurrences.find((occurrence) => occurrence.logical_path === ".");
+    const rightRoot = right.occurrences.find((occurrence) => occurrence.logical_path === ".");
+    return {
+        classification: "changed",
+        logical_path: ".",
+        dimensions: ["content"],
+        left_occurrence_id: leftRoot?.occurrence_id ?? null,
+        right_occurrence_id: rightRoot?.occurrence_id ?? null,
+        left_artifact_id: leftRoot?.artifact_id ?? null,
+        right_artifact_id: rightRoot?.artifact_id ?? null,
+        evidence_links: [...evidenceLinks],
+    };
+};

package/dist/domain/artifactGraph.js

@@ -134,12 +134,14 @@ export const integrityContradictionSchema = z.object({
     provenance: z.literal("container-integrity-metadata-versus-observed-bytes"),
     limitations: z.array(z.string()).min(1),
 });
-/** Parent-child derivation relation between two content-addressed artifacts. */
+/**
+ * Parent-child derivation relation between two content-addressed artifacts.
+ * The child artifact and its logical path are those of the edge's occurrence.
+ */
 const artifactEdgeSchema = z.object({
     edge_id: edgeIdSchema,
     ordinal: z.number().int().min(0),
     parent_artifact_id: artifactIdSchema,
-    child_artifact_id: artifactIdSchema,
     relation: z.enum([
         "contains",
         "extracts",
@@ -150,7 +152,6 @@ const artifactEdgeSchema = z.object({
         "derived-from",
     ]),
     occurrence_id: occurrenceIdSchema,
-    logical_path: boundedRelativePathSchema.nullable(),
     producer: artifactCommandSchema.nullable(),
 });
 /** Stable cryptographic commitment and counts for a complete artifact graph. */
@@ -203,5 +204,6 @@ export const artifactExtractionResultSchema = z.object({
         residual_paths: z.array(boundedRelativePathSchema),
     }),
     provenance: z.array(artifactCommandSchema),
+    integrity_contradictions: z.array(integrityContradictionSchema),
     limitations: z.array(z.string()),
 });

package/dist/domain/artifactIdentity.js

@@ -1,4 +1,23 @@
+import { posix } from "node:path";
 import { digestCanonicalValue } from "./canonicalDigest.js";
+/** NFC spelling of a logical archive path. Inventory and path joins share it. */
+export const logicalPathNfc = (value) => value.normalize("NFC");
+/**
+ * Lexical join against an inventoried logical path. The result is NFC.
+ * `"."` is the archive root. A path that escapes the root, or that contains
+ * NUL, is left in a form the caller can report; `logicalPathEscapesRoot`
+ * is then true.
+ */
+export const normalizeJoinedLogicalPath = (value) => {
+    if (value.includes("\0"))
+        return value;
+    return logicalPathNfc(posix.normalize(value.replaceAll("\\", "/")).replace(/^\.\//u, ""));
+};
+/** Whether a joined logical path leaves the archive root. */
+export const logicalPathEscapesRoot = (path) => path.includes("\0") ||
+    path === ".." ||
+    path.startsWith("../") ||
+    path.startsWith("/");
 /** Content-address an artifact independently of where it was observed. */
 export const artifactIdForContent = (sha256) => `art_${digestCanonicalValue({ sha256 }, "Artifact")}`;
 /** Identify an occurrence by its root and exact logical location. */
@@ -25,5 +44,14 @@ export const artifactContradictionId = (input) => `ic_${digestCanonicalValue({
     declared_sha256: input.declaredSha256,
     observed_sha256: input.observedSha256,
 }, "Artifact")}`;
-/** Identify an edge by its semantic relationship and exact occurrence. */
-export const artifactEdgeId = (semantic) => `edge_${digestCanonicalValue(semantic, "Artifact")}`;
+/**
+ * Identify an edge by its semantic relationship and exact occurrence. The
+ * child artifact and logical path come from that occurrence.
+ */
+export const artifactEdgeId = (edge, occurrence) => `edge_${digestCanonicalValue({
+    parent_artifact_id: edge.parent_artifact_id,
+    child_artifact_id: occurrence.artifact_id,
+    relation: edge.relation,
+    occurrence_id: edge.occurrence_id,
+    logical_path: occurrence.logical_path,
+}, "Artifact")}`;

package/dist/domain/artifactInspection.js

@@ -10,28 +10,11 @@ const evidenceIdSchema = prefixedDigestSchema("ev");
 const artifactIdSchema = prefixedDigestSchema("art");
 const inspectionObservationSchema = z.strictObject({
     observation_id: prefixedDigestSchema("aio"),
-    kind: z.enum(["root-manifest", "artifact", "occurrence", "integrity"]),
+    kind: z.enum(["root-manifest", "integrity"]),
     subject: textSchema,
     value: jsonValueSchema,
     evidence_id: evidenceIdSchema,
 });
-const inspectionRelationshipSchema = z.strictObject({
-    relationship_id: prefixedDigestSchema("air"),
-    relation: z.enum([
-        "contains",
-        "extracts",
-        "slice-of",
-        "embeds",
-        "loads",
-        "maps-source",
-        "derived-from",
-    ]),
-    source_artifact_id: artifactIdSchema,
-    target_artifact_id: artifactIdSchema,
-    occurrence_id: prefixedDigestSchema("occ"),
-    logical_path: textSchema.nullable(),
-    evidence_id: evidenceIdSchema,
-});
 const inspectionHypothesisSchema = z.strictObject({
     hypothesis_id: prefixedDigestSchema("aih"),
     statement: textSchema,
@@ -83,7 +66,6 @@ export const artifactInspectionResultSchema = z.strictObject({
     }))
         .min(1),
     observations: z.array(inspectionObservationSchema),
-    derived_relationships: z.array(inspectionRelationshipSchema),
     hypotheses: z.array(inspectionHypothesisSchema),
     contradictions: z.array(inspectionContradictionSchema),
     unexplored_branches: z.array(unexploredBranchSchema),
@@ -93,8 +75,6 @@ export const artifactInspectionResultSchema = z.strictObject({
         substeps_completed: z.literal(1),
         observations_retained: z.number().int().min(0),
         observations_omitted: z.number().int().min(0),
-        relationships_retained: z.number().int().min(0),
-        relationships_omitted: z.number().int().min(0),
         hypotheses_retained: z.number().int().min(0),
         hypotheses_omitted: z.number().int().min(0),
         unexplored_branches_retained: z.number().int().min(0),
@@ -110,20 +90,17 @@ export const createArtifactInspection = (inventoryInput) => {
     const inventoryEvidence = parseInventoryEvidence(inventoryInput);
     const inventory = artifactInventoryResultSchema.parse(inventoryEvidence.normalized_result);
     const observations = allObservations(inventory, inventoryEvidence.evidence_id);
-    const relationships = allRelationships(inventory, inventoryEvidence.evidence_id);
     const hypotheses = allHypotheses(inventory, inventoryEvidence.evidence_id);
     const nextProbes = probesFor(inventory);
     const branches = allUnexploredBranches(inventory, inventoryEvidence.evidence_id, nextProbes);
     const retained = {
         observations,
-        relationships,
         hypotheses,
         branches,
         probes: nextProbes,
     };
     const omissions = {
         observations: 0,
-        relationships: 0,
         hypotheses: 0,
         branches: 0,
         probes: 0,
@@ -148,7 +125,6 @@ export const createArtifactInspection = (inventoryInput) => {
             },
         ],
         observations: retained.observations,
-        derived_relationships: retained.relationships,
         hypotheses: retained.hypotheses,
         contradictions: contradictions(inventory, inventoryEvidence.evidence_id),
         unexplored_branches: retained.branches,
@@ -158,8 +134,6 @@ export const createArtifactInspection = (inventoryInput) => {
             substeps_completed: 1,
             observations_retained: retained.observations.length,
             observations_omitted: omissions.observations,
-            relationships_retained: retained.relationships.length,
-            relationships_omitted: omissions.relationships,
             hypotheses_retained: retained.hypotheses.length,
             hypotheses_omitted: omissions.hypotheses,
             unexplored_branches_retained: retained.branches.length,
@@ -184,10 +158,10 @@ const parseInventoryEvidence = (input) => {
         throw new TypeError("Artifact inspection substep requires inventory_artifact Evidence");
     return evidence;
 };
+// Artifact, occurrence, and edge records stay in the nested inventory Evidence;
+// restating each one here would repeat the complete graph in every result.
 const allObservations = (inventory, evidenceId) => [
     observation("root-manifest", inventory.manifest.root_artifact_id, inventory.manifest, evidenceId),
-    ...inventory.nodes.map((node) => observation("artifact", node.artifact_id, node, evidenceId)),
-    ...inventory.occurrences.map((occurrence) => observation("occurrence", occurrence.occurrence_id, occurrence, evidenceId)),
     ...inventory.integrity_contradictions.map((value) => observation("integrity", value.contradiction_id, value, evidenceId)),
 ];
 const observation = (kind, subject, value, evidenceId) => {
@@ -202,20 +176,6 @@ const observation = (kind, subject, value, evidenceId) => {
         ...semantic,
     };
 };
-const allRelationships = (inventory, evidenceId) => inventory.edges.map((edge) => {
-    const semantic = {
-        relation: edge.relation,
-        source_artifact_id: edge.parent_artifact_id,
-        target_artifact_id: edge.child_artifact_id,
-        occurrence_id: edge.occurrence_id,
-        logical_path: edge.logical_path,
-        evidence_id: evidenceId,
-    };
-    return {
-        relationship_id: `air_${digestCanonicalValue(semantic, "Artifact inspection")}`,
-        ...semantic,
-    };
-});
 const allHypotheses = (inventory, evidenceId) => {
     const statements = inventory.manifest.root_format === "pe"
         ? [

package/dist/domain/artifactIntegrityPolicy.js

@@ -0,0 +1,10 @@
+import { z } from "zod";
+/**
+ * Caller choice for declared-versus-observed artifact integrity mismatches.
+ *
+ * `fail` rejects the operation; `record-and-continue` keeps the observed bytes
+ * as explicitly untrusted Evidence and reports each contradiction.
+ */
+export const artifactIntegrityPolicySchema = z
+    .enum(["fail", "record-and-continue"])
+    .default("fail");