rea-agents 6.4.0 → 6.7.0

package/dist/domain/rawBinary.js

@@ -0,0 +1,105 @@
+import { z } from "zod";
+import { err, ok } from "./result.js";
+/** Caller-visible CPU families admitted for headerless raw binaries. */
+export const BINARY_ARCHITECTURES = [
+    "x86",
+    "x86_64",
+    "arm",
+    "arm64",
+    "6502",
+    "m68k",
+];
+/** Provider-neutral CPU family for a caller-supplied raw-binary load. */
+export const binaryArchitectureSchema = z.enum(BINARY_ARCHITECTURES);
+const RAW_BINARY_ENTRY_POINT = /^0x[0-9A-Fa-f]{1,16}$/u;
+/** Hexadecimal load and entry address; file offset 0 is mapped here. */
+export const rawBinaryEntryPointSchema = z
+    .string()
+    .regex(RAW_BINARY_ENTRY_POINT, {
+    message: "entry_point must be a hexadecimal address of the form 0x…",
+});
+/** Parse a caller-supplied hex entry while preserving the source spelling. */
+export const parseRawBinaryEntryPoint = (value) => {
+    if (!RAW_BINARY_ENTRY_POINT.test(value))
+        return err("entry_point must be a hexadecimal address of the form 0x…");
+    const parsed = BigInt(value);
+    return ok({
+        source: value,
+        canonical: `0x${parsed.toString(16)}`,
+        value: parsed,
+    });
+};
+/** Reject empty or non-integral file extents for a headerless image. */
+export const validateRawBinaryLength = (length) => Number.isSafeInteger(length) && length >= 1
+    ? ok(null)
+    : err("raw-binary requires at least one file byte");
+const addressWidth = (architecture) => architecture === "6502"
+    ? 0xffffn
+    : architecture === "x86" ||
+        architecture === "arm" ||
+        architecture === "m68k"
+        ? 0xffffffffn
+        : 0xffffffffffffffffn;
+/** Validate architecture, entry, and that the mapped image fits the CPU width. */
+export const admitRawBinary = (input) => {
+    const architecture = binaryArchitectureSchema.safeParse(input.architecture);
+    if (!architecture.success)
+        return err({
+            reason: "raw-binary format requires architecture (x86, x86_64, arm, arm64, 6502, or m68k)",
+            constraint: "load_selection_rejected",
+        });
+    if (typeof input.entryPoint !== "string")
+        return err({
+            reason: "raw-binary format requires entry_point as a hexadecimal address of the form 0x…",
+            constraint: "load_selection_rejected",
+        });
+    const entry = parseRawBinaryEntryPoint(input.entryPoint);
+    if (!entry.ok)
+        return err({
+            reason: entry.error,
+            constraint: "load_selection_rejected",
+        });
+    if ((architecture.data === "arm" || architecture.data === "arm64") &&
+        entry.value.value % 4n !== 0n)
+        return err({
+            reason: `raw-binary ${architecture.data} entry_point ${entry.value.canonical} must be 4-byte aligned`,
+            constraint: "load_selection_rejected",
+        });
+    // 68000-family instruction words are fetched from even addresses.
+    if (architecture.data === "m68k" && entry.value.value % 2n !== 0n)
+        return err({
+            reason: `raw-binary m68k entry_point ${entry.value.canonical} must be 2-byte aligned`,
+            constraint: "load_selection_rejected",
+        });
+    const length = validateRawBinaryLength(input.fileBytes);
+    if (!length.ok)
+        return err({
+            reason: length.error,
+            constraint: "file_format_rejected",
+        });
+    const last = entry.value.value + BigInt(input.fileBytes) - 1n;
+    const max = addressWidth(architecture.data);
+    if (entry.value.value > max || last > max)
+        return err({
+            reason: `raw-binary mapping from ${entry.value.canonical} must fit in the ${architecture.data} address width`,
+            constraint: "load_selection_rejected",
+        });
+    return ok({
+        architecture: architecture.data,
+        entryPoint: entry.value.canonical,
+        entryPointSource: entry.value.source,
+    });
+};
+/** Describe the format/architecture/entry pairing without performing I/O. */
+export const rawBinarySelectionError = (input) => {
+    const hasArchitecture = input.architecture !== undefined;
+    const hasEntry = input.entryPoint !== undefined;
+    if (input.format === "raw-binary") {
+        if (!hasArchitecture || !hasEntry)
+            return "format=raw-binary requires architecture and entry_point";
+        return undefined;
+    }
+    if (hasArchitecture || hasEntry)
+        return "architecture and entry_point apply only with format=raw-binary";
+    return undefined;
+};

package/dist/domain/reconstructionCoverage.js

@@ -2,11 +2,11 @@ import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
 import { compareUnicodeCodePoints, compositeKey, } from "./unicodeCodePointOrder.js";
-import { evidenceBundleSchema, parseEvidenceBundle } from "./evidenceBundle.js";
+import { authenticateParsedEvidenceBundle, evidenceBundleSchema, } from "./evidenceBundle.js";
 import { evaluateReconstructionClaims, evaluateReconstructionPackageProofs, evaluateReconstructionSurfaces, evaluateReconstructionCoverageRisks, recommendedReconstructionProbes, } from "./reconstructionCoverageEvaluation.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
-import { offsetDateTimeSchema } from "./offsetDateTime.js";
+import { offsetDateTimeInstantFromEpochMilliseconds, offsetDateTimeSchema, } from "./offsetDateTime.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const stableIdSchema = z
     .string()
@@ -150,10 +150,11 @@ export const reconstructionCoverageDataSchema = z.strictObject({
     boundaries: z.array(boundarySchema),
 });
 /** Parse inline coverage data and validate every evidence and authority link. */
-export const createReconstructionCoverageData = (input) => {
+export const createReconstructionCoverageData = (input) => parseCoverageData(input).coverage;
+/** Retain authenticated Evidence facts alongside the validated coverage snapshot. */
+const parseCoverageData = (input) => {
     const coverage = reconstructionCoverageDataSchema.parse(input);
-    validateCoverageReferences(coverage);
-    return coverage;
+    return { coverage, ...validateCoverageReferences(coverage) };
 };
 const closureReasonSchema = z.strictObject({
     code: z.enum([
@@ -174,6 +175,7 @@ const closureReasonSchema = z.strictObject({
         "verifier-result-missing",
         "verifier-result-stale",
         "verifier-result-incompatible",
+        "verifier-result-ambiguous",
         "verifier-failed",
         "verifier-unknown",
         "active-unknown",
@@ -211,14 +213,16 @@ export const createReconstructionVerifierContract = (input) => {
 };
 /** Evaluate inline coverage data against one named fail-closed boundary. */
 export const evaluateReconstructionClosure = (coverageInput, boundaryId, nowEpochMs) => {
-    const coverage = createReconstructionCoverageData(coverageInput);
-    const boundary = coverage.boundaries.find(({ boundary_id: id }) => id === boundaryId);
+    const parsed = parseCoverageData(coverageInput);
+    const boundary = parsed.coverage.boundaries.find(({ boundary_id: id }) => id === boundaryId);
     if (boundary === undefined)
         throw new TypeError(`Unknown reconstruction boundary: ${boundaryId}`);
+    const nowInstant = offsetDateTimeInstantFromEpochMilliseconds(nowEpochMs);
     const context = {
-        coverage,
+        ...parsed,
         boundary,
         nowEpochMs,
+        nowInstant,
         reasons: [],
         evidenceIds: new Set(),
     };
@@ -241,16 +245,16 @@ export const evaluateReconstructionClosure = (coverageInput, boundaryId, nowEpoc
     });
 };
 const validateCoverageReferences = (workspace) => {
-    const evidenceBundle = parseEvidenceBundle(workspace.evidence_bundle);
-    const evidenceIds = new Set(evidenceBundle.records.map(({ evidence_id: id }) => id));
+    const evidenceBundle = authenticateParsedEvidenceBundle(workspace.evidence_bundle);
+    const evidenceById = new Map(evidenceBundle.records.map((record) => [record.evidence_id, record]));
     const unknownIds = new Set(evidenceBundle.unknowns.map(({ unknown_id: id }) => id));
-    const artifacts = assertUnique(workspace.artifacts, "artifact_id");
-    const surfaces = assertUnique(workspace.surfaces, "surface_id");
-    const claims = assertUnique(workspace.claims, "claim_id");
-    const contracts = assertUnique(workspace.verifier_contracts, "verifier_id");
-    assertUnique(workspace.contradictions, "contradiction_id");
-    assertUnique(workspace.package_proofs, "proof_id");
-    assertUnique(workspace.boundaries, "boundary_id");
+    const artifacts = indexUnique(workspace.artifacts, "artifact_id");
+    const surfaces = indexUnique(workspace.surfaces, "surface_id");
+    const claims = indexUnique(workspace.claims, "claim_id");
+    const contracts = indexUnique(workspace.verifier_contracts, "verifier_id");
+    indexUnique(workspace.contradictions, "contradiction_id");
+    indexUnique(workspace.package_proofs, "proof_id");
+    indexUnique(workspace.boundaries, "boundary_id");
     for (const contract of workspace.verifier_contracts) {
         const { contract_sha256: contractSha256, ...base } = contract;
         if (contractSha256 !== digest(verifierContractBaseSchema.parse(base)))
@@ -259,9 +263,16 @@ const validateCoverageReferences = (workspace) => {
     for (const surface of workspace.surfaces)
         if (!artifacts.has(surface.artifact_id))
             throw new TypeError(`Surface artifact is missing: ${surface.surface_id}`);
-    for (const owner of workspace.owners)
+    const ownersBySurface = new Map();
+    for (const owner of workspace.owners) {
         if (!surfaces.has(owner.surface_id))
             throw new TypeError(`Owner surface is missing: ${owner.surface_id}`);
+        const owners = ownersBySurface.get(owner.surface_id);
+        if (owners === undefined)
+            ownersBySurface.set(owner.surface_id, [owner]);
+        else
+            owners.push(owner);
+    }
     for (const claim of workspace.claims)
         if (claim.surface_ids.some((id) => !surfaces.has(id)))
             throw new TypeError(`Claim surface is missing: ${claim.claim_id}`);
@@ -278,18 +289,22 @@ const validateCoverageReferences = (workspace) => {
         ...workspace.contradictions.flatMap(({ evidence_ids: ids }) => ids),
         ...workspace.package_proofs.flatMap(({ evidence_ids: ids }) => ids),
     ];
-    const danglingEvidence = referencedEvidenceIds.find((id) => !evidenceIds.has(id));
+    const danglingEvidence = referencedEvidenceIds.find((id) => !evidenceById.has(id));
     if (danglingEvidence !== undefined)
         throw new TypeError(`Coverage workspace Evidence is missing: ${danglingEvidence}`);
     const danglingUnknown = workspace.residual_unknown_ids.find((id) => !unknownIds.has(id));
     if (danglingUnknown !== undefined)
         throw new TypeError(`Coverage workspace residual unknown is missing: ${danglingUnknown}`);
+    return { evidenceById, artifacts, surfaces, claims, ownersBySurface };
 };
-const assertUnique = (items, key) => {
-    const values = items.map((item) => item[key]);
-    if (new Set(values).size !== values.length)
-        throw new TypeError(`Duplicate reconstruction coverage ${String(key)}`);
-    return new Set(values);
+const indexUnique = (items, key) => {
+    const values = new Map();
+    for (const item of items) {
+        if (values.has(item[key]))
+            throw new TypeError(`Duplicate reconstruction coverage ${String(key)}`);
+        values.set(item[key], item);
+    }
+    return values;
 };
 const closureStatus = (reasons) => {
     if (reasons.length === 0)
@@ -306,6 +321,7 @@ const closureStatus = (reasons) => {
     if (reasons.some(({ code }) => [
         "verifier-result-stale",
         "verifier-result-incompatible",
+        "verifier-result-ambiguous",
         "verifier-unknown",
         "active-unknown",
         "owner-path-unknown",

package/dist/domain/reconstructionCoverageEvaluation.js

@@ -1,3 +1,6 @@
+import { packageProofHasComparableEvidence, verifierHasComparableEvidence, } from "./reconstructionCoverageEvidence.js";
+import { compareOffsetDateTimeInstants, offsetDateTimeInstantFromEpochMilliseconds, } from "./offsetDateTime.js";
+import { latestVerifierObservationsByVerifier, sameVerifierAssessment, } from "./reconstructionCoverageVerifierResults.js";
 export const recommendedReconstructionProbes = (reasons) => reasons.map((reason) => ({
     operation: probeOperation(reason.code),
     subject_id: reason.subject_id,
@@ -17,22 +20,21 @@ const probeOperation = (code) => {
     return "update_authoritative_inventory";
 };
 export const evaluateReconstructionSurfaces = (context) => {
-    const surfaces = indexUnique(context.coverage.surfaces, "surface_id");
     for (const surfaceId of context.boundary.required_surface_ids) {
-        const surface = surfaces.get(surfaceId);
+        const surface = context.surfaces.get(surfaceId);
         if (surface === undefined) {
             addReason(context, "surface-missing", surfaceId, "Required surface is absent from the authoritative inventory.");
             continue;
         }
         addEvidence(context, surface.evidence_ids);
         for (const dependencyId of surface.dependency_surface_ids)
-            if (!surfaces.has(dependencyId))
+            if (!context.surfaces.has(dependencyId))
                 addReason(context, "dependency-surface-missing", surfaceId, `Declared dependency surface is absent: ${dependencyId}`);
         evaluateOwner(context, surfaceId);
     }
 };
 const evaluateOwner = (context, surfaceId) => {
-    const owners = context.coverage.owners.filter(({ surface_id: id }) => id === surfaceId);
+    const owners = context.ownersBySurface.get(surfaceId) ?? [];
     if (owners.length === 0) {
         addReason(context, "owner-missing", surfaceId, "Required surface has no reconstructed owner or explicit disposition.");
         return;
@@ -86,10 +88,9 @@ const evaluateOwner = (context, surfaceId) => {
             addReason(context, code, surfaceId, detail);
 };
 export const evaluateReconstructionClaims = (context) => {
-    const claims = indexUnique(context.coverage.claims, "claim_id");
-    const indexes = createVerifierIndexes(context.coverage);
+    const indexes = createVerifierIndexes(context);
     for (const claimId of context.boundary.required_claim_ids) {
-        const claim = claims.get(claimId);
+        const claim = context.claims.get(claimId);
         if (claim === undefined) {
             addReason(context, "claim-missing", claimId, "Required finite claim is absent.");
             continue;
@@ -108,7 +109,8 @@ export const evaluateReconstructionClaims = (context) => {
             evaluateVerifierResult(context, claim, contract, indexes);
     }
 };
-const createVerifierIndexes = (coverage) => {
+const createVerifierIndexes = (context) => {
+    const { coverage } = context;
     const contractsByClaim = new Map();
     for (const contract of coverage.verifier_contracts)
         for (const claimId of new Set(contract.claim_ids)) {
@@ -116,44 +118,44 @@ const createVerifierIndexes = (coverage) => {
             contracts.push(contract);
             contractsByClaim.set(claimId, contracts);
         }
-    const latestResultsByVerifier = new Map();
-    for (const result of coverage.verifier_results) {
-        const latest = latestResultsByVerifier.get(result.verifier_id);
-        // Stable descending sort used to choose the first input record on ties.
-        if (latest === undefined ||
-            Date.parse(result.observed_at) > Date.parse(latest.observed_at))
-            latestResultsByVerifier.set(result.verifier_id, result);
-    }
-    const ownersBySurface = new Map();
-    for (const owner of coverage.owners) {
-        const owners = ownersBySurface.get(owner.surface_id) ?? [];
-        owners.push(owner);
-        ownersBySurface.set(owner.surface_id, owners);
-    }
     return {
         contractsByClaim,
-        latestResultsByVerifier,
+        latestResultsByVerifier: latestVerifierObservationsByVerifier(coverage.verifier_results),
         artifactDigests: new Set(coverage.artifacts.map(({ artifact_sha256: value }) => value)),
         ownerDigests: new Set(coverage.owners.flatMap(({ ownership }) => ownership.disposition === "implemented" ? [ownership.owner_sha256] : [])),
-        surfaces: indexUnique(coverage.surfaces, "surface_id"),
-        artifacts: indexUnique(coverage.artifacts, "artifact_id"),
-        ownersBySurface,
+        surfaces: context.surfaces,
+        artifacts: context.artifacts,
+        ownersBySurface: context.ownersBySurface,
     };
 };
 const evaluateVerifierResult = (context, claim, contract, indexes) => {
-    const result = indexes.latestResultsByVerifier.get(contract.verifier_id);
-    if (result === undefined) {
+    const latestResults = indexes.latestResultsByVerifier.get(contract.verifier_id);
+    if (latestResults === undefined) {
         addReason(context, "verifier-result-missing", claim.claim_id, "Verifier has no recorded result.");
         return;
     }
-    addEvidence(context, result.evidence_ids);
-    if (!verifierResultIsCompatible(claim, contract, result, indexes)) {
+    addEvidence(context, latestResults.flatMap(({ result }) => result.evidence_ids));
+    const latest = latestResults[0];
+    if (latest === undefined)
+        return;
+    if (!latestResults.every((candidate) => sameVerifierAssessment(latest.result, candidate.result))) {
+        addReason(context, "verifier-result-ambiguous", claim.claim_id, "Latest verifier observations have conflicting assessment content.");
+        return;
+    }
+    const comparable = latestResults.find(({ result }) => verifierHasComparableEvidence(result, contract, context.evidenceById));
+    if (comparable === undefined) {
+        addReason(context, "verifier-result-incompatible", claim.claim_id, `Latest verifier observation has no cited Evidence with comparable ${contract.authority} authority and confidence.`);
+        return;
+    }
+    const { result } = comparable;
+    if (!verifierResultMatchesContract(claim, contract, result, indexes)) {
         addReason(context, "verifier-result-incompatible", claim.claim_id, "Latest verifier result does not match current artifacts, owners, dimensions, authority, normalization, repeats, or contract.");
         return;
     }
-    const observedAt = Date.parse(result.observed_at);
-    if (observedAt > context.nowEpochMs ||
-        context.nowEpochMs - observedAt > contract.max_age_ms) {
+    const cutoffEpochMs = context.nowEpochMs - contract.max_age_ms;
+    if (compareOffsetDateTimeInstants(comparable.instant, context.nowInstant) > 0 ||
+        (cutoffEpochMs >= -Number.MAX_SAFE_INTEGER &&
+            compareOffsetDateTimeInstants(comparable.instant, offsetDateTimeInstantFromEpochMilliseconds(cutoffEpochMs)) < 0)) {
         addReason(context, "verifier-result-stale", claim.claim_id, "Latest compatible verifier result is stale.");
         return;
     }
@@ -162,7 +164,7 @@ const evaluateVerifierResult = (context, claim, contract, indexes) => {
     else if (result.status !== "pass")
         addReason(context, "verifier-unknown", claim.claim_id, `Latest compatible verifier result is ${result.status}.`);
 };
-const verifierResultIsCompatible = (claim, contract, result, indexes) => {
+const verifierResultMatchesContract = (claim, contract, result, indexes) => {
     const expectedArtifactDigests = claim.surface_ids.flatMap((surfaceId) => {
         const surface = indexes.surfaces.get(surfaceId);
         const artifact = surface === undefined
@@ -198,33 +200,34 @@ export const evaluateReconstructionCoverageRisks = (context) => {
         }
 };
 export const evaluateReconstructionPackageProofs = (context) => {
-    const surfaces = new Map(context.coverage.surfaces.map((surface) => [surface.surface_id, surface]));
-    const artifacts = new Map(context.coverage.artifacts.map((artifact) => [
-        artifact.artifact_id,
-        artifact,
-    ]));
     const requiredArtifactDigests = context.boundary.required_surface_ids.flatMap((surfaceId) => {
-        const surface = surfaces.get(surfaceId);
-        const artifact = surface === undefined ? undefined : artifacts.get(surface.artifact_id);
+        const surface = context.surfaces.get(surfaceId);
+        const artifact = surface === undefined
+            ? undefined
+            : context.artifacts.get(surface.artifact_id);
         return artifact === undefined ? [] : [artifact.artifact_sha256];
     });
     for (const kind of context.boundary.required_package_proof_kinds) {
         const proofs = context.coverage.package_proofs.filter((proof) => proof.kind === kind);
-        const passing = proofs.find(({ artifact_sha256s: digests, status }) => status === "pass" &&
-            requiredArtifactDigests.every((digest) => digests.includes(digest)));
+        const applicable = (proof) => requiredArtifactDigests.every((digest) => proof.artifact_sha256s.includes(digest)) && packageProofHasComparableEvidence(proof, context.evidenceById);
+        const passing = proofs.find((proof) => proof.status === "pass" && applicable(proof));
         if (passing !== undefined) {
             addEvidence(context, passing.evidence_ids);
             continue;
         }
-        if (proofs.some(({ status }) => status === "fail"))
+        const failing = proofs.find((proof) => proof.status === "fail" && applicable(proof));
+        if (failing !== undefined) {
+            addEvidence(context, failing.evidence_ids);
             addReason(context, "package-proof-failed", kind, "Required package or integration proof failed.");
-        else if (proofs.length > 0)
-            addReason(context, "package-proof-unknown", kind, "Required package or integration proof is not passing.");
+        }
+        else if (proofs.length > 0) {
+            addEvidence(context, proofs.flatMap(({ evidence_ids }) => evidence_ids));
+            addReason(context, "package-proof-unknown", kind, "Required package or integration proof has no qualifying passing Evidence.");
+        }
         else
             addReason(context, "package-proof-missing", kind, "Required package or integration proof is missing.");
     }
 };
-const indexUnique = (items, key) => new Map(items.map((item) => [item[key], item]));
 const addReason = (context, code, subjectId, detail) => {
     context.reasons.push({ code, subject_id: subjectId, detail });
 };

package/dist/domain/reconstructionCoverageEvidence.js

@@ -0,0 +1,26 @@
+const evidenceAuthorities = {
+    "shipped-artifact": ["shipped-artifact"],
+    "controlled-replay": ["controlled-replay"],
+    "live-observation": ["controlled-replay", "external-service"],
+    external: ["external-service"],
+};
+const packageAuthorities = {
+    build: ["live-observation"],
+    "clean-install": ["live-observation"],
+    "package-contents": ["shipped-artifact", "live-observation"],
+    "runtime-routing": ["live-observation"],
+    "authority-independence": ["shipped-artifact", "live-observation"],
+};
+/** Qualify only the Evidence cited by this verifier observation. */
+export const verifierHasComparableEvidence = (result, contract, records) => hasComparableEvidence(result.evidence_ids, [contract.authority], records);
+/** Runtime package claims need observations; static package audits can be derived. */
+export const packageProofHasComparableEvidence = (proof, records) => hasComparableEvidence(proof.evidence_ids, packageAuthorities[proof.kind], records);
+const hasComparableEvidence = (evidenceIds, requirements, records) => evidenceIds.some((id) => {
+    const evidence = records.get(id);
+    if (evidence === undefined)
+        return false;
+    return requirements.some((required) => evidenceAuthorities[required].includes(evidence.authority) &&
+        (evidence.confidence === "observed" ||
+            (required === "shipped-artifact" &&
+                evidence.confidence === "derived")));
+});

package/dist/domain/reconstructionCoverageVerifierResults.js

@@ -0,0 +1,35 @@
+import { uniqueSorted } from "./canonicalOrdering.js";
+import { compareOffsetDateTimeInstants, parseOffsetDateTimeInstant, } from "./offsetDateTime.js";
+/** Index each verifier's latest timestamp group without relying on array order. */
+export const latestVerifierObservationsByVerifier = (results) => {
+    const latestByVerifier = new Map();
+    for (const result of results) {
+        const observation = {
+            result,
+            instant: parseOffsetDateTimeInstant(result.observed_at),
+        };
+        const latest = latestByVerifier.get(result.verifier_id);
+        const latestInstant = latest?.[0]?.instant;
+        const comparison = latestInstant === undefined
+            ? 1
+            : compareOffsetDateTimeInstants(observation.instant, latestInstant);
+        if (latest === undefined || comparison > 0)
+            latestByVerifier.set(result.verifier_id, [observation]);
+        else if (comparison === 0)
+            latest.push(observation);
+    }
+    return latestByVerifier;
+};
+/** Compare assessment content while excluding timestamp spelling and provenance. */
+export const sameVerifierAssessment = (left, right) => verifierAssessmentIdentity(left) === verifierAssessmentIdentity(right);
+const verifierAssessmentIdentity = (result) => JSON.stringify({
+    verifier_id: result.verifier_id,
+    contract_sha256: result.contract_sha256,
+    status: result.status,
+    covered_claim_ids: uniqueSorted(result.covered_claim_ids),
+    covered_dimensions: uniqueSorted(result.covered_dimensions),
+    artifact_sha256s: uniqueSorted(result.artifact_sha256s),
+    owner_sha256s: uniqueSorted(result.owner_sha256s),
+    normalization_sha256: result.normalization_sha256,
+    repeats: result.repeats,
+});

package/dist/domain/reconstructionObligationLedgerIntegrity.js

@@ -0,0 +1,114 @@
+import { digestCanonicalValue } from "./canonicalDigest.js";
+import { canonicalJson } from "./comparisonSemantics.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
+/** Derive the ledger summary from the obligation facts. */
+export const summarizeReconstructionObligations = (obligations) => ({
+    total: obligations.length,
+    required: obligations.filter(({ required }) => required).length,
+    verified: obligations.filter(({ status }) => status === "verified").length,
+    required_open: obligations.filter(({ required, status }) => required && status !== "verified").length,
+    by_status: countBy(obligations, [
+        "unowned",
+        "characterized",
+        "implemented",
+        "verified",
+        "contradicted",
+        "blocked",
+        "out-of-scope",
+        "unknown",
+    ], ({ status }) => status),
+    by_application_layer: countBy(obligations, [
+        "cli",
+        "protocol",
+        "electron",
+        "persistence",
+        "process",
+        "runtime",
+        "packaging",
+        "native-abi",
+        "application",
+        "other",
+    ], ({ application_layer }) => application_layer),
+    by_evidence_authority: countBy(obligations, ["candidate", "observed", "reviewed", "unknown"], ({ source_state }) => source_state),
+});
+/** Derive closure status from required obligations and their diagnostic facts. */
+export const reconstructionObligationLedgerStatus = (obligations, limitations) => {
+    if (obligations.length === 0)
+        return "unknown";
+    const requiredOpen = obligations.filter(({ required, status }) => required && status !== "verified");
+    if (requiredOpen.some(({ status, diagnostics }) => status === "contradicted" ||
+        hasReconstructionObligationDiagnostic(diagnostics, "verifier-failed")))
+        return "failed";
+    if (limitations.length > 0)
+        return "unknown";
+    if (requiredOpen.some(({ status }) => status === "unknown"))
+        return "unknown";
+    return requiredOpen.length === 0 ? "ready" : "open";
+};
+export const reconstructionObligationCoverage = (limitations) => ({
+    status: limitations.length === 0 ? "complete" : "partial",
+});
+export const reconstructionObligationReports = (obligations) => ({
+    missing_owner_obligation_ids: obligationIdsWith(obligations, "missing-owner"),
+    missing_verifier_obligation_ids: obligationIdsWith(obligations, "missing-verifier"),
+    contradicted_obligation_ids: obligationIdsWith(obligations, "contradiction"),
+    residual_unknown_ids: [
+        ...new Set(obligations.flatMap(({ residual_unknown_ids: ids }) => ids)),
+    ].sort(compareUnicodeCodePoints),
+});
+export const reconstructionObligationOwnershipGraph = (obligations) => obligations
+    .flatMap((obligation) => obligation.binding === null
+    ? []
+    : [
+        {
+            obligation_id: obligation.obligation_id,
+            module_path: obligation.binding.owner.module_path,
+            symbol: obligation.binding.owner.symbol,
+        },
+    ])
+    .sort(obligationEdgeOrder);
+export const reconstructionObligationDependencyGraph = (obligations) => obligations
+    .flatMap((obligation) => obligation.dependency_obligation_ids.map((dependencyId) => ({
+    obligation_id: obligation.obligation_id,
+    depends_on_obligation_id: dependencyId,
+})))
+    .sort(obligationEdgeOrder);
+/** Evidence attached to facts serialized on an obligation. */
+export const reconstructionObligationEvidenceIds = (obligations) => [
+    ...new Set(obligations.flatMap((obligation) => [
+        ...obligation.authority_references.map(({ evidence_id: id }) => id),
+        ...obligation.observed_cases.map(({ evidence_id: id }) => id),
+        ...(obligation.binding === null
+            ? []
+            : [
+                ...obligation.binding.original_cases.map(({ evidence_id: id }) => id),
+                ...obligation.binding.fixtures.flatMap(({ evidence_ids: ids }) => ids),
+                ...(obligation.binding.verifier === null
+                    ? []
+                    : [obligation.binding.verifier.result_evidence_id]),
+            ]),
+    ])),
+].sort(compareUnicodeCodePoints);
+const obligationEdgeOrder = (left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right));
+const obligationIdsWith = (obligations, code) => obligations
+    .filter(({ diagnostics }) => hasReconstructionObligationDiagnostic(diagnostics, code))
+    .map(({ obligation_id: id }) => id)
+    .sort(compareUnicodeCodePoints);
+export const hasReconstructionObligationDiagnostic = (diagnostics, code) => diagnostics.some((diagnostic) => diagnostic.code === code);
+/** Recompute the closure commitment from the fields carried by a ledger. */
+export const reconstructionObligationLedgerClosureDigest = (ledger) => digestCanonicalValue({
+    schema: "ReconstructionObligationClosure",
+    status: ledger.status,
+    coverage: ledger.coverage,
+    summary: ledger.summary,
+    reports: ledger.reports,
+    ownership_graph: ledger.ownership_graph,
+    dependency_graph: ledger.dependency_graph,
+    obligations: ledger.obligations,
+    evidence_links: ledger.evidence_links,
+    limitations: ledger.limitations,
+}, "Reconstruction obligation ledger");
+const countBy = (items, values, valueFor) => values.map((value) => ({
+    key: value,
+    count: items.filter((item) => valueFor(item) === value).length,
+}));