rea-agents 6.4.0 → 6.7.0

package/dist/domain/analysisSnapshot.js

@@ -1,27 +1,37 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
-import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
+import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
+import { localPathStringSchema } from "./localPath.js";
 import { analysisProfileSchema, analysisProfilesEqual, committedProviderSchema, } from "./analysisProfile.js";
-import { BINARY_ARCHITECTURES, } from "./binaryTargetTypes.js";
-import { evidenceBundleForTarget, evidenceBundleSchema, parseEvidenceBundle, } from "./evidenceBundle.js";
-import { evidenceLocationSchema, } from "./evidence.js";
+import { BINARY_ARCHITECTURES, RAW_ONLY_ARCHITECTURES, } from "./binaryTargetTypes.js";
+import { evidenceBundleForTarget, evidenceBundleSchema, parseEvidenceBundle, parseImmutableEvidenceBundle, } from "./evidenceBundle.js";
+import { evidenceLocationSchema, rebindEvidenceToTargetPath, } from "./evidence.js";
 import { jsonObjectSchema, jsonValueSchema, } from "./jsonValue.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { canonicalJsonDigestSteps } from "./canonicalJsonDigestSteps.js";
+import { freezeJsonSnapshot } from "./immutableJson.js";
+import { binaryArchitectureSchema, rawBinaryEntryPointSchema, } from "./rawBinary.js";
+import { relationshipCoverageSchema, } from "./relationshipCoverage.js";
 const architectureSchema = z.enum(BINARY_ARCHITECTURES);
 const formatSchema = z.enum([
     "analysis-database",
     "mach-o",
+    "mach-o-universal",
     "elf",
     "pe",
     "dos-mz",
     "dos-com",
+    "raw-binary",
     "zip",
     "ipa",
     "apk",
     "msix",
     "appx",
+    "hap",
+    "hsp",
+    "app-pack",
     "asar",
     "dmg",
     "pkg",
@@ -30,27 +40,51 @@ const formatSchema = z.enum([
     "source-map",
 ]);
 const kindSchema = z.enum(["executable", "database", "archive", "artifact"]);
-const subjectSchema = z.object({
-    path: z.string().min(1),
+const subjectBaseSchema = z.object({
+    path: localPathStringSchema,
     sha256: digestSchema,
-    format: z.enum([
-        ...formatSchema.options,
-        "hopper",
-        "directory",
-        "file",
-        "unknown",
-        "mach-o-universal",
-        "javascript-bundle",
-        "entitlements",
-    ]),
-    architecture: architectureSchema.nullable(),
 });
-const targetSchema = z.object({
+const subjectFormatSchema = z.enum([
+    ...formatSchema.options,
+    "hopper",
+    "directory",
+    "file",
+    "unknown",
+    "javascript-bundle",
+    "entitlements",
+]);
+// Snapshot entries retain the same raw-only architecture boundary as targets.
+const subjectSchema = z.discriminatedUnion("format", [
+    subjectBaseSchema.extend({
+        format: subjectFormatSchema.exclude(["raw-binary"]),
+        architecture: architectureSchema
+            .exclude([...RAW_ONLY_ARCHITECTURES])
+            .nullable(),
+    }),
+    subjectBaseSchema.extend({
+        format: z.literal("raw-binary"),
+        architecture: architectureSchema.nullable(),
+    }),
+]);
+const targetIdentitySchema = z.object({
     sha256: digestSchema,
     kind: kindSchema,
-    format: formatSchema,
     architecture: architectureSchema.nullable(),
 });
+const targetSchema = z.discriminatedUnion("format", [
+    targetIdentitySchema.extend({
+        format: z.enum(formatSchema.options.filter((format) => format !== "raw-binary")),
+        architecture: architectureSchema
+            .exclude([...RAW_ONLY_ARCHITECTURES])
+            .nullable(),
+    }),
+    targetIdentitySchema.extend({
+        format: z.literal("raw-binary"),
+        kind: z.literal("executable"),
+        architecture: binaryArchitectureSchema,
+        entry_point: rawBinaryEntryPointSchema,
+    }),
+]);
 const bindingSchema = z
     .object({
     provider: committedProviderSchema,
@@ -75,6 +109,7 @@ const entrySchema = z.object({
         raw_result: jsonValueSchema.nullable(),
         provider: committedProviderSchema,
         limitations: z.array(z.string()),
+        relationship_coverage: relationshipCoverageSchema.nullable(),
         locations: z.array(evidenceLocationSchema),
         subject: subjectSchema.nullable(),
     }),
@@ -89,6 +124,7 @@ const workflowEntrySchema = z.object({
         provider: committedProviderSchema,
         analysis_profile: analysisProfileSchema,
         limitations: z.array(z.string()),
+        relationship_coverage: relationshipCoverageSchema.nullable(),
         locations: z.array(evidenceLocationSchema),
         subject: subjectSchema.nullable(),
     }),
@@ -101,6 +137,95 @@ export const analysisSnapshotSchema = z.object({
     workflow_entries: z.array(workflowEntrySchema),
     evidence_bundle: evidenceBundleSchema,
 });
+// These handles only represent entries parsed in this realm. File readers can
+// release their payloads while retaining an authenticated comparison operand.
+const preparedEntryBrand = Symbol("prepared-snapshot-entry");
+const preparedEntries = new WeakMap();
+/** Capture a cache entry without retaining a second copy of its full payload. */
+export const prepareSnapshotEntry = (input, kind) => {
+    const handle = Object.freeze({
+        [preparedEntryBrand]: true,
+    });
+    if (kind === "provider") {
+        const entry = entrySchema.parse(input);
+        const { result, raw_result, ...execution } = entry.execution;
+        preparedEntries.set(handle, {
+            kind,
+            entry: { ...entry, execution },
+            digest: snapshotContentDigest(result, raw_result, execution),
+        });
+    }
+    else {
+        const entry = workflowEntrySchema.parse(input);
+        const { result, raw_result, ...execution } = entry.execution;
+        preparedEntries.set(handle, {
+            kind,
+            entry: { ...entry, execution },
+            digest: snapshotContentDigest(result, raw_result, execution),
+        });
+    }
+    return handle;
+};
+const snapshotFileHeaderSchema = z.object({
+    target: targetSchema,
+    binding: bindingSchema,
+    evidence_bundle: z.unknown(),
+});
+/** Reconstruct file entries only from fully authenticated matching Evidence. */
+export const parsePreparedAnalysisSnapshot = (input, entries, workflowEntries) => {
+    const header = snapshotFileHeaderSchema.parse(input);
+    const bundle = parseImmutableEvidenceBundle(header.evidence_bundle);
+    const providerRows = entries.map((handle) => {
+        const row = preparedEntries.get(handle);
+        if (row?.kind !== "provider")
+            throw new TypeError("Analysis snapshot entry was not parsed in this realm");
+        return row;
+    });
+    const workflowRows = workflowEntries.map((handle) => {
+        const row = preparedEntries.get(handle);
+        if (row?.kind !== "workflow")
+            throw new TypeError("Analysis snapshot workflow entry was not parsed in this realm");
+        return row;
+    });
+    const restored = sealSnapshot(restoreSnapshot(header, bundle, providerRows, workflowRows));
+    for (const handle of [...entries, ...workflowEntries])
+        preparedEntries.delete(handle);
+    return restored;
+};
+const contentDigest = (value) => {
+    const steps = canonicalJsonDigestSteps(value);
+    let step = steps.next();
+    while (!step.done)
+        step = steps.next();
+    return step.value;
+};
+const snapshotContentDigest = (result, rawResult, execution) => {
+    const metadata = jsonObjectSchema.parse({
+        limitations: execution.limitations,
+        locations: execution.locations,
+        subject: execution.subject === null
+            ? null
+            : {
+                local_path: execution.subject.path,
+                sha256: execution.subject.sha256,
+                format: execution.subject.format,
+                architecture: execution.subject.architecture,
+            },
+        relationship_coverage: execution.relationship_coverage,
+    });
+    return contentDigest({
+        ...metadata,
+        normalized_result: result,
+        raw_result: rawResult,
+    });
+};
+const evidenceContentDigest = (evidence) => {
+    return contentDigest({
+        ...jsonObjectSchema.parse(evidenceContentMetadata(evidence)),
+        normalized_result: evidence.normalized_result,
+        raw_result: evidence.raw_result,
+    });
+};
 const canonicalJson = (value) => {
     const json = jsonValueSchema.parse(value);
     const encoded = canonicalize(json);
@@ -109,12 +234,20 @@ const canonicalJson = (value) => {
     return encoded;
 };
 /** Project a binary into the path-free identity used for cache invalidation. */
-export const snapshotTarget = (target) => ({
-    sha256: target.sha256,
-    kind: target.kind,
-    format: target.format,
-    architecture: target.architecture ?? null,
-});
+export const snapshotTarget = (target) => target.format === "raw-binary"
+    ? {
+        sha256: target.sha256,
+        kind: target.kind,
+        architecture: target.architecture,
+        format: target.format,
+        entry_point: target.entryPoint,
+    }
+    : {
+        sha256: target.sha256,
+        kind: target.kind,
+        architecture: target.architecture ?? null,
+        format: target.format,
+    };
 /** Build the immutable provider/profile binding used by a cached snapshot. */
 export const snapshotBinding = (profile) => bindingSchema.parse({
     provider: profile.provider,
@@ -124,7 +257,10 @@ export const snapshotBinding = (profile) => bindingSchema.parse({
 export const snapshotMatchesTarget = (snapshot, target) => snapshot.sha256 === target.sha256 &&
     snapshot.kind === target.kind &&
     snapshot.format === target.format &&
-    snapshot.architecture === (target.architecture ?? null);
+    snapshot.architecture === (target.architecture ?? null) &&
+    (snapshot.format !== "raw-binary" ||
+        (target.format === "raw-binary" &&
+            snapshot.entry_point === target.entryPoint));
 /** Compare a snapshot binding with the selected concrete analysis profile. */
 export const snapshotMatchesProfile = (binding, profile) => binding.provider.id === profile.provider.id &&
     binding.provider.name === profile.provider.name &&
@@ -144,7 +280,7 @@ export const snapshotEvidenceForQuery = (snapshot, query) => {
     const workflowEntry = snapshot.workflow_entries.find((candidate) => candidate.query_id === queryId);
     if (entry === undefined && workflowEntry === undefined)
         return undefined;
-    return snapshot.evidence_bundle.records.find((record) => record.subject?.digest.sha256 === target.sha256 &&
+    const evidence = snapshot.evidence_bundle.records.find((record) => record.subject?.digest.sha256 === target.sha256 &&
         record.operation === operation &&
         record.provider.id === provider.id &&
         record.provider.name === provider.name &&
@@ -155,6 +291,9 @@ export const snapshotEvidenceForQuery = (snapshot, query) => {
         ((entry !== undefined && evidenceMatchesEntry(record, entry, snapshot)) ||
             (workflowEntry !== undefined &&
                 evidenceMatchesWorkflowEntry(record, workflowEntry, snapshot))));
+    return evidence === undefined
+        ? undefined
+        : rebindEvidenceToTargetPath(evidence, target);
 };
 /** Create one exact replay record for a derived application workflow result. */
 export const createAnalysisSnapshotWorkflowEntry = (input) => {
@@ -173,32 +312,22 @@ export const createAnalysisSnapshotWorkflowEntry = (input) => {
             provider: execution.analysisProfile.provider,
             analysis_profile: execution.analysisProfile,
             limitations: [...execution.limitations],
+            relationship_coverage: execution.relationshipCoverage ?? null,
             locations: [...execution.locations],
             subject: execution.subject === null
                 ? null
-                : {
+                : subjectSchema.parse({
                     ...execution.subject,
                     architecture: execution.subject.architecture ?? null,
-                },
+                }),
         },
     };
 };
 const evidenceMatchesEntry = (evidence, entry, snapshot) => isCorrespondingEvidence(evidence, snapshot) &&
-    canonicalJson({
-        query: evidenceQueryKey(evidence),
-        normalized_result: evidence.normalized_result,
-        raw_result: evidence.raw_result,
-        limitations: evidence.limitations,
-        locations: evidence.locations,
-        subject: evidence.subject === null
-            ? null
-            : {
-                local_path: evidence.subject.local_path,
-                sha256: evidence.subject.digest.sha256,
-                format: evidence.subject.format,
-                architecture: evidence.subject.architecture,
-            },
-    }) === entryEvidenceKey(entry, snapshot.binding);
+    compositeKey([
+        evidenceQueryKey(evidence),
+        evidenceContentDigest(evidence),
+    ]) === entryEvidenceKey(entry, snapshot.binding);
 /** Compute the stable lookup key for one provider/profile-specific query. */
 export const analysisQueryId = (target, binding, operation, parameters) => `query_${createHash("sha256")
     .update(canonicalJson({ target, binding, operation, parameters }))
@@ -221,71 +350,135 @@ export const createAnalysisSnapshotEntry = (input) => {
             raw_result: execution.rawResult,
             provider: binding.provider,
             limitations: [...execution.limitations],
+            relationship_coverage: execution.relationshipCoverage ?? null,
             locations: [...execution.locations],
             subject: execution.subject === null
                 ? null
-                : {
+                : subjectSchema.parse({
                     ...execution.subject,
                     architecture: execution.subject.architecture ?? null,
-                },
+                }),
         },
     };
 };
+const validatedSnapshots = new WeakMap();
 /** Parse a provider/profile-exact snapshot and verify its entries and evidence. */
 export const parseAnalysisSnapshot = (input) => {
+    if (typeof input === "object" && input !== null) {
+        const owned = validatedSnapshots.get(input);
+        if (owned !== undefined)
+            return owned;
+    }
     const parsed = analysisSnapshotSchema.parse(input);
-    parseEvidenceBundle(parsed.evidence_bundle);
-    const scopedEvidence = evidenceBundleForTarget(parsed.evidence_bundle, parsed.target.sha256);
-    // The validated canonical bundle is filtered, never extended. Equal counts
-    // establish that no record or unknown was removed without serializing results.
-    if (scopedEvidence.records.length !== parsed.evidence_bundle.records.length ||
-        scopedEvidence.unknowns.length !== parsed.evidence_bundle.unknowns.length)
+    restoreSnapshot(parsed, parseEvidenceBundle(parsed.evidence_bundle), parsed.entries.map((entry) => ({
+        kind: "provider",
+        entry,
+        digest: snapshotContentDigest(entry.execution.result, entry.execution.raw_result, entry.execution),
+    })), parsed.workflow_entries.map((entry) => ({
+        kind: "workflow",
+        entry,
+        digest: snapshotContentDigest(entry.execution.result, entry.execution.raw_result, entry.execution),
+    })));
+    return parsed;
+};
+/** Own an authenticated immutable cache while preserving mutable caller exports. */
+export const immutableAnalysisSnapshot = (input) => sealSnapshot(parseAnalysisSnapshot(input));
+const sealSnapshot = (snapshot) => {
+    for (const entry of [...snapshot.entries, ...snapshot.workflow_entries]) {
+        freezeJsonSnapshot(entry.execution.result);
+        freezeJsonSnapshot(entry.execution.raw_result);
+    }
+    freezeJsonSnapshot(snapshot);
+    validatedSnapshots.set(snapshot, snapshot);
+    return snapshot;
+};
+const restoreSnapshot = (header, bundle, providerRows, workflowRows) => {
+    const scopedEvidence = evidenceBundleForTarget(bundle, header.target.sha256);
+    if (scopedEvidence.records.length !== bundle.records.length ||
+        scopedEvidence.unknowns.length !== bundle.unknowns.length)
         throw new TypeError("Analysis snapshot evidence contains records for another target");
-    if (!hasCanonicalQueryOrder(parsed.entries))
+    if (!hasCanonicalQueryOrder(providerRows.map(({ entry }) => entry)))
         throw new TypeError("Analysis snapshot entries are not canonical");
-    if (!hasCanonicalQueryOrder(parsed.workflow_entries))
+    if (!hasCanonicalQueryOrder(workflowRows.map(({ entry }) => entry)))
         throw new TypeError("Analysis snapshot workflow entries are not canonical");
     const ids = new Set();
-    const index = createEvidenceIndex(parsed);
-    const workflowIndex = createWorkflowEvidenceIndex(parsed);
-    for (const entry of parsed.entries) {
-        if (entry.execution.provider.id !== parsed.binding.provider.id ||
-            entry.execution.provider.name !== parsed.binding.provider.name ||
-            entry.execution.provider.version !== parsed.binding.provider.version)
-            throw new TypeError("Analysis snapshot entry provider does not match");
-        const expected = analysisQueryId(parsed.target, parsed.binding, entry.operation, entry.parameters);
-        if (entry.query_id !== expected)
-            throw new TypeError("Analysis snapshot query identifier does not match");
-        if (ids.has(entry.query_id))
-            throw new TypeError("Analysis snapshot contains duplicate queries");
-        ids.add(entry.query_id);
-        if (!entryHasMatchingEvidence(entry, parsed, index)) {
-            if (entryHasCorrespondingEvidence(entry, parsed, index))
-                throw new TypeError(`Analysis snapshot entry ${entry.operation} differs from its Evidence record`);
-            throw new TypeError(`Analysis snapshot entry ${entry.operation} has no profile-bound Evidence record`);
-        }
+    const corresponding = new Set();
+    const matching = new Map();
+    for (const evidence of bundle.records) {
+        if (evidence.predicate_type !== "rea.analysis" ||
+            evidence.authority !== "shipped-artifact" ||
+            evidence.subject?.digest.sha256 !== header.target.sha256 ||
+            evidence.analysis_profile === null ||
+            (evidence.confidence !== "observed" && evidence.confidence !== "derived"))
+            continue;
+        if (evidence.confidence === "observed" &&
+            !isCorrespondingEvidence(evidence, header))
+            continue;
+        const query = compositeKey([
+            evidence.confidence,
+            evidenceQueryKey(evidence),
+        ]);
+        corresponding.add(query);
+        matching.set(compositeKey([query, evidenceContentDigest(evidence)]), evidence);
     }
-    for (const entry of parsed.workflow_entries) {
-        if (entry.execution.provider.id !==
-            entry.execution.analysis_profile.provider.id ||
-            entry.execution.provider.name !==
-                entry.execution.analysis_profile.provider.name ||
-            entry.execution.provider.version !==
-                entry.execution.analysis_profile.provider.version)
-            throw new TypeError("Analysis snapshot workflow entry provider does not match its profile");
-        const expected = analysisQueryId(parsed.target, parsed.binding, entry.operation, entry.parameters);
+    const find = (query, digest, label, operation) => {
+        const evidence = matching.get(compositeKey([query, digest]));
+        if (evidence !== undefined)
+            return evidence;
+        throw new TypeError(corresponding.has(query)
+            ? `Analysis snapshot ${label} ${operation} differs from its Evidence record`
+            : `Analysis snapshot ${label} ${operation} has no profile-bound Evidence record`);
+    };
+    const checkId = (entry, workflow) => {
+        const expected = analysisQueryId(header.target, header.binding, entry.operation, entry.parameters);
         if (entry.query_id !== expected)
-            throw new TypeError("Analysis snapshot workflow query identifier does not match");
+            throw new TypeError(workflow
+                ? "Analysis snapshot workflow query identifier does not match"
+                : "Analysis snapshot query identifier does not match");
         if (ids.has(entry.query_id))
             throw new TypeError("Analysis snapshot contains duplicate queries");
         ids.add(entry.query_id);
-        if (!workflowEntryHasMatchingEvidence(entry, workflowIndex)) {
-            if (workflowEntryHasCorrespondingEvidence(entry, workflowIndex))
-                throw new TypeError(`Analysis snapshot workflow entry ${entry.operation} differs from its Evidence record`);
-            throw new TypeError(`Analysis snapshot workflow entry ${entry.operation} has no profile-bound Evidence record`);
-        }
-    }
-    return parsed;
+    };
+    const entries = providerRows.map(({ entry, digest }) => {
+        if (entry.execution.provider.id !== header.binding.provider.id ||
+            entry.execution.provider.name !== header.binding.provider.name ||
+            entry.execution.provider.version !== header.binding.provider.version)
+            throw new TypeError("Analysis snapshot entry provider does not match");
+        checkId(entry, false);
+        const evidence = find(compositeKey(["observed", entryQueryKey(entry, header.binding)]), digest, "entry", entry.operation);
+        return {
+            ...entry,
+            execution: {
+                ...entry.execution,
+                result: evidence.normalized_result,
+                raw_result: evidence.raw_result,
+            },
+        };
+    });
+    const workflow_entries = workflowRows.map(({ entry, digest }) => {
+        const provider = entry.execution.analysis_profile.provider;
+        if (entry.execution.provider.id !== provider.id ||
+            entry.execution.provider.name !== provider.name ||
+            entry.execution.provider.version !== provider.version)
+            throw new TypeError("Analysis snapshot workflow entry provider does not match its profile");
+        checkId(entry, true);
+        const evidence = find(compositeKey(["derived", workflowEntryQueryKey(entry)]), digest, "workflow entry", entry.operation);
+        return {
+            ...entry,
+            execution: {
+                ...entry.execution,
+                result: evidence.normalized_result,
+                raw_result: evidence.raw_result,
+            },
+        };
+    });
+    return {
+        target: header.target,
+        binding: header.binding,
+        entries,
+        workflow_entries,
+        evidence_bundle: bundle,
+    };
 };
 const hasCanonicalQueryOrder = (entries) => {
     let previous;
@@ -297,89 +490,38 @@ const hasCanonicalQueryOrder = (entries) => {
     }
     return true;
 };
-const createEvidenceIndex = (snapshot) => {
-    const matching = new Set();
-    const corresponding = new Set();
-    for (const evidence of snapshot.evidence_bundle.records) {
-        if (!isCorrespondingEvidence(evidence, snapshot))
-            continue;
-        const query = evidenceQueryKey(evidence);
-        corresponding.add(query);
-        matching.add(canonicalJson({
-            query,
-            normalized_result: evidence.normalized_result,
-            raw_result: evidence.raw_result,
-            limitations: evidence.limitations,
-            locations: evidence.locations,
-            subject: evidence.subject === null
-                ? null
-                : {
-                    local_path: evidence.subject.local_path,
-                    sha256: evidence.subject.digest.sha256,
-                    format: evidence.subject.format,
-                    architecture: evidence.subject.architecture,
-                },
-        }));
-    }
-    const result = { matching, corresponding };
-    return result;
-};
-const entryHasMatchingEvidence = (entry, snapshot, index) => index.matching.has(entryEvidenceKey(entry, snapshot.binding));
-const entryHasCorrespondingEvidence = (entry, snapshot, index) => index.corresponding.has(entryQueryKey(entry, snapshot.binding));
 const isCorrespondingEvidence = (evidence, snapshot) => evidence.predicate_type === "rea.analysis" &&
     evidence.confidence === "observed" &&
     evidence.authority === "shipped-artifact" &&
     evidence.subject?.digest.sha256 === snapshot.target.sha256 &&
     evidence.analysis_profile !== null &&
     analysisProfilesEqual(evidence.analysis_profile, snapshot.binding.analysis_profile);
-const evidenceQueryKey = (evidence) => canonicalJson({
+const evidenceQueryKey = (evidence) => contentDigest({
     operation: evidence.operation,
     parameters: evidence.parameters,
     provider: evidence.provider,
     analysis_profile: evidence.analysis_profile,
 });
-const entryQueryKey = (entry, binding) => canonicalJson({
+const entryQueryKey = (entry, binding) => contentDigest({
     operation: entry.operation,
     parameters: entry.parameters,
     provider: entry.execution.provider,
     analysis_profile: binding.analysis_profile,
 });
-const entryEvidenceKey = (entry, binding) => canonicalJson({
-    query: entryQueryKey(entry, binding),
-    normalized_result: entry.execution.result,
-    raw_result: entry.execution.raw_result,
-    limitations: entry.execution.limitations,
-    locations: entry.execution.locations,
-    subject: entry.execution.subject === null
-        ? null
-        : {
-            local_path: entry.execution.subject.path,
-            sha256: entry.execution.subject.sha256,
-            format: entry.execution.subject.format,
-            architecture: entry.execution.subject.architecture,
-        },
-});
-const workflowEntryQueryKey = (entry) => canonicalJson({
+const entryEvidenceKey = (entry, binding) => compositeKey([
+    entryQueryKey(entry, binding),
+    snapshotContentDigest(entry.execution.result, entry.execution.raw_result, entry.execution),
+]);
+const workflowEntryQueryKey = (entry) => contentDigest({
     operation: entry.operation,
     parameters: entry.parameters,
     provider: entry.execution.provider,
     analysis_profile: entry.execution.analysis_profile,
 });
-const workflowEntryEvidenceKey = (entry) => canonicalJson({
-    query: workflowEntryQueryKey(entry),
-    normalized_result: entry.execution.result,
-    raw_result: entry.execution.raw_result,
-    limitations: entry.execution.limitations,
-    locations: entry.execution.locations,
-    subject: entry.execution.subject === null
-        ? null
-        : {
-            local_path: entry.execution.subject.path,
-            sha256: entry.execution.subject.sha256,
-            format: entry.execution.subject.format,
-            architecture: entry.execution.subject.architecture,
-        },
-});
+const workflowEntryEvidenceKey = (entry) => compositeKey([
+    workflowEntryQueryKey(entry),
+    snapshotContentDigest(entry.execution.result, entry.execution.raw_result, entry.execution),
+]);
 const isWorkflowEvidence = (evidence, snapshot, entry) => evidence.predicate_type === "rea.analysis" &&
     evidence.confidence === "derived" &&
     evidence.authority === "shipped-artifact" &&
@@ -389,40 +531,25 @@ const isWorkflowEvidence = (evidence, snapshot, entry) => evidence.predicate_typ
     evidence.provider.id === entry.execution.provider.id &&
     evidence.provider.name === entry.execution.provider.name &&
     evidence.provider.version === entry.execution.provider.version;
-const createWorkflowEvidenceIndex = (snapshot) => {
-    const matching = new Set();
-    const corresponding = new Set();
-    for (const evidence of snapshot.evidence_bundle.records) {
-        if (evidence.predicate_type !== "rea.analysis" ||
-            evidence.confidence !== "derived" ||
-            evidence.authority !== "shipped-artifact" ||
-            evidence.subject?.digest.sha256 !== snapshot.target.sha256 ||
-            evidence.analysis_profile === null)
-            continue;
-        corresponding.add(evidenceQueryKey(evidence));
-        matching.add(canonicalJson(evidenceContentProjection(evidence)));
-    }
-    return { matching, corresponding };
-};
-const workflowEntryHasMatchingEvidence = (entry, index) => index.matching.has(workflowEntryEvidenceKey(entry));
-const workflowEntryHasCorrespondingEvidence = (entry, index) => index.corresponding.has(workflowEntryQueryKey(entry));
 const evidenceMatchesWorkflowEntry = (evidence, entry, snapshot) => isWorkflowEvidence(evidence, snapshot, entry) &&
-    canonicalJson(evidenceContentProjection(evidence)) ===
-        workflowEntryEvidenceKey(entry);
-const evidenceContentProjection = (evidence) => ({
-    query: evidenceQueryKey(evidence),
-    normalized_result: evidence.normalized_result,
-    raw_result: evidence.raw_result,
-    limitations: evidence.limitations,
-    locations: evidence.locations,
-    subject: evidence.subject === null
-        ? null
-        : {
-            local_path: evidence.subject.local_path,
-            sha256: evidence.subject.digest.sha256,
-            format: evidence.subject.format,
-            architecture: evidence.subject.architecture,
-        },
-});
+    compositeKey([
+        evidenceQueryKey(evidence),
+        evidenceContentDigest(evidence),
+    ]) === workflowEntryEvidenceKey(entry);
+const evidenceContentMetadata = (evidence) => {
+    return {
+        limitations: evidence.limitations,
+        relationship_coverage: evidence.relationship_coverage,
+        locations: evidence.locations,
+        subject: evidence.subject === null
+            ? null
+            : {
+                local_path: evidence.subject.local_path,
+                sha256: evidence.subject.digest.sha256,
+                format: evidence.subject.format,
+                architecture: evidence.subject.architecture,
+            },
+    };
+};
 /** Serialize a validated snapshot with byte-stable canonical entry ordering. */
 export const serializeAnalysisSnapshot = (snapshot) => `${canonicalJson(parseAnalysisSnapshot(snapshot))}\n`;