rea-agents 6.4.0 → 6.5.0

package/dist/domain/electron/electronFuses.js

@@ -0,0 +1,360 @@
+import { z } from "zod";
+import { digestSchema } from "../digests.js";
+import { localPathStringSchema } from "../localPath.js";
+/** ASCII sentinel that introduces an Electron fuse wire in an Electron binary. */
+export const ELECTRON_FUSE_SENTINEL = "dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX";
+/** Wire bytes from the Electron fuse wire: disabled, enabled, and removed. */
+export const ELECTRON_FUSE_STATE_BYTES = {
+    disabled: 0x30,
+    enabled: 0x31,
+    removed: 0x72,
+};
+/**
+ * FuseV1 index order. An index past this table, or any index on another wire
+ * version, keeps a null name and its raw byte.
+ */
+export const ELECTRON_FUSE_V1_NAMES = [
+    "RunAsNode",
+    "EnableCookieEncryption",
+    "EnableNodeOptionsEnvironmentVariable",
+    "EnableNodeCliInspectArguments",
+    "EnableEmbeddedAsarIntegrityValidation",
+    "OnlyLoadAppFromAsar",
+    "LoadBrowserProcessSpecificV8Snapshot",
+    "GrantFileProtocolExtraPrivileges",
+    "WasmTrapHandlers",
+];
+const FUSE_IMPLICATIONS = [
+    {
+        subject: "node_cli_inspect_arguments",
+        fuseIndex: 3,
+        enabled: "honored",
+        inactive: "not_honored",
+    },
+    {
+        subject: "electron_run_as_node",
+        fuseIndex: 0,
+        enabled: "honored",
+        inactive: "not_honored",
+    },
+    {
+        subject: "embedded_asar_integrity_validation",
+        fuseIndex: 4,
+        enabled: "enforced",
+        inactive: "not_enforced",
+    },
+    {
+        subject: "only_load_app_from_asar",
+        fuseIndex: 5,
+        enabled: "restricted_to_app_asar",
+        inactive: "not_restricted_to_app_asar",
+    },
+];
+const OTHER_MEANS_LIMITATION = "Fuse state does not prove the application enables Inspector through other means, such as app.commandLine or a remote-debugging switch in application code.";
+const MISSING_SENTINEL_LIMITATION = "A missing sentinel means fuse state is unknown, not that every fuse is disabled.";
+const byteSchema = z.number().int().min(0).max(255);
+const fuseStateSchema = z.enum(["enabled", "disabled", "removed", "unknown"]);
+/** One fuse byte, with a version-1 name when the pinned table covers its index. */
+export const electronFuseSchema = z.strictObject({
+    index: z.number().int().nonnegative(),
+    name: z.string().min(1).nullable(),
+    state: fuseStateSchema,
+    raw_byte: byteSchema,
+});
+const electronFuseSentinelSchema = z.strictObject({
+    sentinel_offset: z.number().int().nonnegative(),
+    wire_version: byteSchema.nullable(),
+    declared_length: byteSchema.nullable(),
+    fuses: z.array(electronFuseSchema),
+    complete: z.boolean(),
+});
+const electronFuseSliceSchema = z.strictObject({
+    index: z.number().int().nonnegative(),
+    file_offset: z.number().int().nonnegative(),
+    size: z.number().int().nonnegative(),
+    architecture: z.string().min(1).nullable(),
+    sentinel_count: z.number().int().nonnegative(),
+    sentinels: z.array(electronFuseSentinelSchema),
+});
+const implicationLocation = {
+    relationship: z.literal("derivation"),
+    slice_index: z.number().int().nonnegative(),
+    sentinel_offset: z.number().int().nonnegative(),
+};
+/** Derived runtime meaning of one observed fuse byte. The fuse bytes stay observed. */
+export const electronFuseImplicationSchema = z.discriminatedUnion("subject", [
+    z.strictObject({
+        ...implicationLocation,
+        subject: z.literal("node_cli_inspect_arguments"),
+        fuse_index: z.literal(3),
+        outcome: z.enum(["honored", "not_honored", "unknown"]),
+    }),
+    z.strictObject({
+        ...implicationLocation,
+        subject: z.literal("electron_run_as_node"),
+        fuse_index: z.literal(0),
+        outcome: z.enum(["honored", "not_honored", "unknown"]),
+    }),
+    z.strictObject({
+        ...implicationLocation,
+        subject: z.literal("embedded_asar_integrity_validation"),
+        fuse_index: z.literal(4),
+        outcome: z.enum(["enforced", "not_enforced", "unknown"]),
+    }),
+    z.strictObject({
+        ...implicationLocation,
+        subject: z.literal("only_load_app_from_asar"),
+        fuse_index: z.literal(5),
+        outcome: z.enum([
+            "restricted_to_app_asar",
+            "not_restricted_to_app_asar",
+            "unknown",
+        ]),
+    }),
+]);
+/** Inline fuse observation for one selected app bundle or Electron executable. */
+export const electronFuseReportSchema = z
+    .strictObject({
+    artifact: z
+        .strictObject({
+        selected_path: localPathStringSchema,
+        resolved_path: localPathStringSchema,
+        sha256: digestSchema,
+        bytes: z.number().int().nonnegative(),
+        format: z.enum(["mach-o", "mach-o-universal", "pe", "elf"]),
+    })
+        .describe("Caller-selected path, resolved regular file, and the container that was read"),
+    slices: z
+        .array(electronFuseSliceSchema)
+        .describe("One entry per universal Mach-O slice, or a single entry for a thin Mach-O, PE, or ELF file. Sentinel offsets are file-absolute."),
+    runtime_implications: z
+        .array(electronFuseImplicationSchema)
+        .describe("Derivations from version-1 fuse bytes. Each entry names the fuse index it came from."),
+    limitations: z.array(z.string().min(1)),
+})
+    .superRefine((report, context) => {
+    validateReportBounds(report, context);
+});
+export const inspectElectronFusesInputSchema = z.strictObject({
+    path: localPathStringSchema.describe("Absolute filesystem path to a macOS .app bundle, Electron Framework binary, Windows PE executable, or Linux ELF executable"),
+});
+/** Decode one fuse wire byte. Any other value stays unknown and keeps the raw byte. */
+export const electronFuseState = (byte) => {
+    if (byte === ELECTRON_FUSE_STATE_BYTES.disabled)
+        return "disabled";
+    if (byte === ELECTRON_FUSE_STATE_BYTES.enabled)
+        return "enabled";
+    if (byte === ELECTRON_FUSE_STATE_BYTES.removed)
+        return "removed";
+    return "unknown";
+};
+/** Pinned version-1 name, or null when this wire version or index has no table entry. */
+export const electronFuseName = (wireVersion, index) => wireVersion === 1 ? (ELECTRON_FUSE_V1_NAMES[index] ?? null) : null;
+/**
+ * Attach derivations and reading limitations without choosing among multiple
+ * sentinels. Embedded ASAR integrity is compiled only for Mach-O and PE, so an
+ * ELF byte stays observed and its enforcement outcome stays unknown.
+ */
+export const describeElectronFuseFindings = (slices, container) => {
+    const runtime_implications = [];
+    const limitations = [OTHER_MEANS_LIMITATION, MISSING_SENTINEL_LIMITATION];
+    for (const slice of slices) {
+        if (slice.sentinel_count === 0)
+            limitations.push(`Slice ${slice.index} at file offset ${slice.file_offset} contains no Electron fuse sentinel; fuse state for that slice is unknown, not disabled.`);
+        else if (slice.sentinel_count > 1)
+            limitations.push(`Slice ${slice.index} at file offset ${slice.file_offset} contains ${slice.sentinel_count} Electron fuse sentinels; every sentinel is reported and none is selected.`);
+        for (const sentinel of slice.sentinels)
+            describeSentinel(slice.index, sentinel, container, runtime_implications, limitations);
+    }
+    return { runtime_implications, limitations };
+};
+/** Electron compiles this validation for macOS (Mach-O) and Windows (PE) only. */
+const embeddedAsarIntegrityApplies = (container) => container === "mach-o" ||
+    container === "mach-o-universal" ||
+    container === "pe";
+const describeSentinel = (sliceIndex, sentinel, container, implications, limitations) => {
+    if (!sentinel.complete)
+        limitations.push(`Electron fuse wire at file offset ${sentinel.sentinel_offset} is truncated; fuse bytes past the slice stay unknown.`);
+    if (sentinel.wire_version === null)
+        return;
+    if (sentinel.wire_version !== 1) {
+        limitations.push(`Electron fuse wire at file offset ${sentinel.sentinel_offset} uses wire version ${sentinel.wire_version}; version 1 is the only pinned name table, so runtime implications for this wire are unknown.`);
+        return;
+    }
+    for (const spec of FUSE_IMPLICATIONS) {
+        const fuse = sentinel.fuses.find((item) => item.index === spec.fuseIndex);
+        if (fuse === undefined) {
+            limitations.push(`Electron fuse wire at file offset ${sentinel.sentinel_offset} does not include fuse index ${spec.fuseIndex}; that runtime implication is unknown.`);
+            continue;
+        }
+        const applicabilityUnknown = spec.subject === "embedded_asar_integrity_validation" &&
+            !embeddedAsarIntegrityApplies(container);
+        if (applicabilityUnknown)
+            limitations.push(`Electron compiles embedded ASAR integrity validation only on macOS and Windows; the observed fuse byte at file offset ${sentinel.sentinel_offset} does not establish enforcement.`);
+        implications.push(implicationFor(spec, applicabilityUnknown ? "unknown" : fuse.state, {
+            slice_index: sliceIndex,
+            sentinel_offset: sentinel.sentinel_offset,
+        }));
+    }
+};
+const implicationFor = (spec, state, location) => {
+    const outcome = state === "enabled"
+        ? spec.enabled
+        : state === "unknown"
+            ? "unknown"
+            : spec.inactive;
+    return {
+        relationship: "derivation",
+        subject: spec.subject,
+        fuse_index: spec.fuseIndex,
+        outcome,
+        ...location,
+    };
+};
+const validateReportBounds = (report, context) => {
+    const size = report.artifact.bytes;
+    for (const [sliceIndex, slice] of report.slices.entries()) {
+        if (slice.index !== sliceIndex)
+            context.addIssue({
+                code: "custom",
+                path: ["slices", sliceIndex, "index"],
+                message: "Slice index does not match its position in the report.",
+            });
+        if (slice.sentinel_count !== slice.sentinels.length)
+            context.addIssue({
+                code: "custom",
+                path: ["slices", sliceIndex, "sentinel_count"],
+                message: "Sentinel count does not match the reported sentinels.",
+            });
+        if (slice.file_offset > size || slice.size > size - slice.file_offset)
+            context.addIssue({
+                code: "custom",
+                path: ["slices", sliceIndex],
+                message: "Slice range extends outside the selected artifact.",
+            });
+        for (const [sentinelIndex, sentinel] of slice.sentinels.entries())
+            validateSentinel(slice, sentinel, sliceIndex, sentinelIndex, context);
+    }
+    const expected = new Set(describeElectronFuseFindings(report.slices, report.artifact.format).runtime_implications.map(implicationKey));
+    for (const [index, implication] of report.runtime_implications.entries()) {
+        if (!expected.has(implicationKey(implication)))
+            context.addIssue({
+                code: "custom",
+                path: ["runtime_implications", index],
+                message: "Runtime implication is not supported by the reported fuse bytes and applicability.",
+            });
+        const slice = report.slices[implication.slice_index];
+        if (slice?.sentinels.some((sentinel) => sentinel.sentinel_offset === implication.sentinel_offset) !== true)
+            context.addIssue({
+                code: "custom",
+                path: ["runtime_implications", index],
+                message: "Runtime implication does not reference a reported sentinel.",
+            });
+    }
+};
+const implicationKey = (fact) => JSON.stringify([
+    fact.slice_index,
+    fact.sentinel_offset,
+    fact.subject,
+    fact.fuse_index,
+    fact.outcome,
+]);
+const validateSentinel = (slice, sentinel, sliceIndex, sentinelIndex, context) => {
+    const sentinelEnd = sentinel.sentinel_offset + ELECTRON_FUSE_SENTINEL.length;
+    const wireEnd = sentinelEnd +
+        (sentinel.wire_version === null ? 0 : 1) +
+        (sentinel.declared_length === null ? 0 : 1) +
+        sentinel.fuses.length;
+    if (wireEnd > slice.file_offset + slice.size)
+        context.addIssue({
+            code: "custom",
+            path: ["slices", sliceIndex, "sentinels", sentinelIndex],
+            message: "Reported wire header or fuse bytes extend outside the slice.",
+        });
+    if (sentinel.sentinel_offset < slice.file_offset ||
+        sentinelEnd > slice.file_offset + slice.size)
+        context.addIssue({
+            code: "custom",
+            path: [
+                "slices",
+                sliceIndex,
+                "sentinels",
+                sentinelIndex,
+                "sentinel_offset",
+            ],
+            message: "Sentinel is outside its slice.",
+        });
+    if (sentinel.wire_version === null && sentinel.declared_length !== null)
+        context.addIssue({
+            code: "custom",
+            path: [
+                "slices",
+                sliceIndex,
+                "sentinels",
+                sentinelIndex,
+                "declared_length",
+            ],
+            message: "A wire without a version byte cannot declare a fuse count.",
+        });
+    if (sentinel.complete &&
+        (sentinel.declared_length === null ||
+            sentinel.fuses.length !== sentinel.declared_length))
+        context.addIssue({
+            code: "custom",
+            path: ["slices", sliceIndex, "sentinels", sentinelIndex, "complete"],
+            message: "A complete wire must contain every declared fuse byte.",
+        });
+    if (!sentinel.complete &&
+        sentinel.declared_length !== null &&
+        sentinel.fuses.length >= sentinel.declared_length)
+        context.addIssue({
+            code: "custom",
+            path: ["slices", sliceIndex, "sentinels", sentinelIndex, "complete"],
+            message: "An incomplete wire must omit at least one declared fuse byte.",
+        });
+    for (const [fuseIndex, fuse] of sentinel.fuses.entries()) {
+        if (fuse.index !== fuseIndex)
+            context.addIssue({
+                code: "custom",
+                path: [
+                    "slices",
+                    sliceIndex,
+                    "sentinels",
+                    sentinelIndex,
+                    "fuses",
+                    fuseIndex,
+                    "index",
+                ],
+                message: "Fuse index does not match its wire position.",
+            });
+        if (fuse.state !== electronFuseState(fuse.raw_byte))
+            context.addIssue({
+                code: "custom",
+                path: [
+                    "slices",
+                    sliceIndex,
+                    "sentinels",
+                    sentinelIndex,
+                    "fuses",
+                    fuseIndex,
+                    "state",
+                ],
+                message: "Fuse state does not match its raw byte.",
+            });
+        if (sentinel.wire_version !== null &&
+            fuse.name !== electronFuseName(sentinel.wire_version, fuse.index))
+            context.addIssue({
+                code: "custom",
+                path: [
+                    "slices",
+                    sliceIndex,
+                    "sentinels",
+                    sentinelIndex,
+                    "fuses",
+                    fuseIndex,
+                    "name",
+                ],
+                message: "Fuse name does not match the pinned version-1 table.",
+            });
+    }
+};

package/dist/domain/elfFixedHeader.js

@@ -0,0 +1,42 @@
+import { err, ok } from "./result.js";
+/**
+ * Validate the common, fixed ELF header commitments.
+ *
+ * `bytes` may be a bounded prefix. `totalBytes` is the containing file size,
+ * so the declared header extent is checked against the file without requiring
+ * the whole declared extent to be present in this prefix.
+ */
+export const readElfFixedHeader = (bytes, totalBytes = bytes.length) => {
+    if (bytes.length >= 4 && bytes.toString("hex", 0, 4) !== "7f454c46")
+        return err("not an ELF image");
+    if (bytes.length < 16)
+        return err("ELF identification is truncated");
+    const classByte = bytes[4];
+    if (classByte !== 1 && classByte !== 2)
+        return err("unsupported ELF class");
+    const dataByte = bytes[5];
+    if (dataByte !== 1 && dataByte !== 2)
+        return err("unsupported ELF endianness");
+    if (bytes[6] !== 1)
+        return err("unsupported ELF identification version");
+    const elfClass = classByte === 1 ? 32 : 64;
+    const minimumSize = elfClass === 32 ? 52 : 64;
+    if (!Number.isSafeInteger(totalBytes) ||
+        totalBytes < bytes.length ||
+        totalBytes < minimumSize ||
+        bytes.length < minimumSize)
+        return err(`truncated ELF header: an ELF${elfClass} header needs ${minimumSize} bytes; the file has ${totalBytes}`);
+    const littleEndian = dataByte === 1;
+    const readU16 = (offset) => littleEndian ? bytes.readUInt16LE(offset) : bytes.readUInt16BE(offset);
+    const readU32 = (offset) => littleEndian ? bytes.readUInt32LE(offset) : bytes.readUInt32BE(offset);
+    if (readU32(20) !== 1)
+        return err("unsupported ELF header version");
+    const headerSize = readU16(elfClass === 32 ? 40 : 52);
+    if (headerSize < minimumSize || headerSize > totalBytes)
+        return err("invalid ELF header size");
+    return ok({
+        elfClass,
+        byteOrder: littleEndian ? "little" : "big",
+        headerSize,
+    });
+};

package/dist/domain/evidence.js

@@ -1,62 +1,82 @@
+import { basename } from "node:path";
 import { z } from "zod";
 import { digestCanonicalValue } from "./canonicalDigest.js";
 import { canonicalJsonDigestSteps } from "./canonicalJsonDigestSteps.js";
+import { nulFreeStringSchema } from "./localPath.js";
 import { analysisProfileSchema, } from "./analysisProfile.js";
 import { BINARY_ARCHITECTURES, } from "./binaryTargetTypes.js";
 import { jsonObjectSchema, jsonValueSchema, jsonValueValidationIssue, jsonValueValidationSteps, } from "./jsonValue.js";
 import { freezeJsonSnapshot, isImmutableJsonSnapshot, } from "./immutableJson.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { relationshipCoverageSchema, } from "./relationshipCoverage.js";
 /** Provider identity schema shared by evidence-bearing persistence formats. */
-export const providerSchema = z.object({
+export const providerSchema = z.strictObject({
     id: z.string().min(1),
     name: z.string().min(1),
     version: z.string().nullable(),
 });
-const subjectSchema = z.object({
+const subjectFormatSchema = z.enum([
+    "hopper",
+    "analysis-database",
+    "mach-o",
+    "elf",
+    "pe",
+    "dos-mz",
+    "dos-com",
+    "raw-binary",
+    "zip",
+    "ipa",
+    "apk",
+    "msix",
+    "appx",
+    "hap",
+    "hsp",
+    "app-pack",
+    "asar",
+    "dmg",
+    "pkg",
+    "plist",
+    "javascript",
+    "source-map",
+    "directory",
+    "file",
+    "unknown",
+    "mach-o-universal",
+    "javascript-bundle",
+    "entitlements",
+]);
+const subjectBaseSchema = z.strictObject({
     name: z.string().min(1),
-    digest: z.object({ sha256: digestSchema }),
-    format: z.enum([
-        "hopper",
-        "analysis-database",
-        "mach-o",
-        "elf",
-        "pe",
-        "dos-mz",
-        "dos-com",
-        "zip",
-        "ipa",
-        "apk",
-        "msix",
-        "appx",
-        "asar",
-        "dmg",
-        "pkg",
-        "plist",
-        "javascript",
-        "source-map",
-        "directory",
-        "file",
-        "unknown",
-        "mach-o-universal",
-        "javascript-bundle",
-        "entitlements",
-    ]),
-    architecture: z.enum(BINARY_ARCHITECTURES).nullable(),
-    local_path: z.string(),
+    digest: z.strictObject({ sha256: digestSchema }),
+    local_path: nulFreeStringSchema,
 });
+// The format owns the architecture claim, including nested Evidence subjects.
+const subjectSchema = z.discriminatedUnion("format", [
+    subjectBaseSchema.extend({
+        format: subjectFormatSchema.exclude(["raw-binary"]),
+        architecture: z.enum(BINARY_ARCHITECTURES).exclude(["6502"]).nullable(),
+    }),
+    subjectBaseSchema.extend({
+        format: z.literal("raw-binary"),
+        architecture: z.enum(BINARY_ARCHITECTURES).nullable(),
+    }),
+]);
 /** Source location attached to an evidence observation. */
 /** Source-location schema shared by evidence-bearing persistence formats. */
 export const evidenceLocationSchema = z.discriminatedUnion("kind", [
-    z.object({ kind: z.literal("address"), address: z.string().min(1) }),
-    z.object({
+    z.strictObject({ kind: z.literal("address"), address: z.string().min(1) }),
+    z.strictObject({
         kind: z.literal("address-range"),
         start: z.string().min(1),
         end: z.string().min(1),
     }),
-    z.object({ kind: z.literal("artifact-path"), path: z.string().min(1) }),
-    z.object({ kind: z.literal("file-offset"), offset: z.number().int().min(0) }),
-    z.object({
+    z.strictObject({ kind: z.literal("artifact-path"), path: z.string().min(1) }),
+    z.strictObject({
+        kind: z.literal("file-offset"),
+        offset: z.number().int().min(0),
+    }),
+    z.strictObject({
         kind: z.literal("file-offset-range"),
         start: z.number().int().min(0),
         end: z.number().int().min(0),
@@ -69,7 +89,7 @@ const evidenceAuthoritySchema = z.enum([
     "external-service",
     "analyst-inference",
 ]);
-const executionEnvironmentSchema = z.object({
+const executionEnvironmentSchema = z.strictObject({
     id: z.string().min(1),
     platform: z.string().min(1),
     architecture: z.string().min(1),
@@ -90,6 +110,7 @@ const evidenceBaseSchema = z
     authority: evidenceAuthoritySchema,
     environment: executionEnvironmentSchema.nullable(),
     limitations: z.array(z.string()),
+    relationship_coverage: relationshipCoverageSchema.nullable().default(null),
     locations: z.array(evidenceLocationSchema),
     evidence_links: z.array(prefixedDigestSchema("ev")),
 })
@@ -126,6 +147,12 @@ const immutableResultSchema = z
     if (issue !== undefined)
         context.addIssue({ code: "custom", message: issue });
 });
+/** Rebind a matching immutable artifact subject to the caller's selected path. */
+export const rebindEvidenceSubjectTargetPath = (subject, target) => subject.sha256 === target.sha256 &&
+    subject.format === target.format &&
+    (subject.architecture ?? null) === (target.architecture ?? null)
+    ? { ...subject, path: target.path }
+    : subject;
 const semanticProjection = (evidence) => ({
     subject: evidence.subject === null
         ? null
@@ -145,6 +172,9 @@ const semanticProjection = (evidence) => ({
     authority: evidence.authority,
     environment: evidence.environment,
     limitations: evidence.limitations,
+    ...(evidence.relationship_coverage === null
+        ? {}
+        : { relationship_coverage: evidence.relationship_coverage }),
     locations: evidence.locations,
     evidence_links: evidence.evidence_links,
 });
@@ -161,6 +191,38 @@ export const parseEvidence = (input) => {
 };
 /** Authenticate and seal a ledger-owned snapshot; external mutable values are copied first. */
 export const immutableEvidence = (input) => rememberImmutableEvidence(parseEvidence(input));
+/** Rebind display path metadata when an authenticated record names this target. */
+export const rebindEvidenceToTargetPath = (evidence, target) => {
+    const subject = evidence.subject;
+    if (subject === null)
+        return evidence;
+    const rebound = rebindEvidenceSubjectTargetPath({
+        path: subject.local_path,
+        sha256: subject.digest.sha256,
+        format: subject.format,
+        ...(subject.architecture === null
+            ? {}
+            : { architecture: subject.architecture }),
+    }, target);
+    if (rebound.path === subject.local_path)
+        return evidence;
+    const reboundSubject = subjectSchema.parse({
+        ...subject,
+        name: basename(target.path) || "artifact",
+        local_path: target.path,
+    });
+    const reboundEvidence = { ...evidence, subject: reboundSubject };
+    if (!isImmutableEvidence(evidence))
+        return immutableEvidence(reboundEvidence);
+    // The original authenticated Evidence owns immutable payloads. Only the
+    // small display subject and envelope are new, so preserve those payloads
+    // without reparsing a potentially large analysis result.
+    Object.freeze(reboundSubject.digest);
+    Object.freeze(reboundSubject);
+    Object.freeze(reboundEvidence);
+    immutableEvidenceSnapshots.set(reboundEvidence, reboundEvidence);
+    return reboundEvidence;
+};
 /** Recognize authenticated Evidence whose complete reachable JSON data is immutable. */
 export const isImmutableEvidence = (evidence) => immutableEvidenceSnapshots.has(evidence);
 const rememberImmutableEvidence = (evidence) => {
@@ -195,7 +257,7 @@ const normalizeEvidenceObservation = (target, provider, observation) => {
     const subject = target === undefined
         ? null
         : {
-            name: target.path.split("/").at(-1) || "artifact",
+            name: basename(target.path) || "artifact",
             digest: { sha256: target.sha256 },
             format: target.format,
             architecture: target.architecture ?? null,
@@ -232,6 +294,9 @@ const normalizeEvidenceObservation = (target, provider, observation) => {
                 : []),
             ...(observation.limitations ?? []),
         ],
+        ...(observation.relationshipCoverage === undefined
+            ? { relationship_coverage: null }
+            : { relationship_coverage: observation.relationshipCoverage }),
         locations: [...(observation.locations ?? [])],
         evidence_links: [...(observation.evidenceLinks ?? [])],
     };