reverseport 0.0.0-stage → 1.2.0

package/dist/domain/managed/managedMemberComparisonMatch.js

@@ -0,0 +1,204 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { managedMemberInspectionSchema, } from "./managedArtifact.js";
+import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
+export const sha256 = (value) => {
+    const serialized = canonicalize(value);
+    if (serialized === undefined)
+        throw new TypeError("Managed comparison canonicalization failed");
+    return createHash("sha256").update(serialized).digest("hex");
+};
+const keyMethod = (item) => ({
+    item,
+    exactKey: item.body.status === "present" && item.body.normalized_il_sha256 !== null
+        ? sha256([
+            "method-exact",
+            item.signature.raw_sha256,
+            item.body.normalized_il_sha256,
+        ])
+        : null,
+    // The raw blob is the exact signature; decoding only feeds shape keys.
+    signatureKey: sha256([
+        "method-signature",
+        item.declaring_type,
+        item.name,
+        item.signature.raw_sha256,
+    ]),
+    structuralKey: item.signature.parse_status === "decoded" && item.body.status === "present"
+        ? sha256([
+            "method-structural",
+            item.signature.kind,
+            item.signature.calling_convention,
+            item.signature.generic_parameter_count,
+            item.signature.parameter_count,
+            item.signature.return_type,
+            item.signature.parameter_types,
+            item.body.status,
+            item.body.header_format,
+            item.body.il_size,
+            item.body.max_stack,
+            item.body.init_locals,
+            item.body.opcode_counts,
+            item.body.anchors.map(({ opcode, operand_kind }) => [
+                opcode,
+                operand_kind,
+            ]),
+            item.body.exception_regions.map((region) => [
+                region.flags,
+                region.try_length,
+                region.handler_length,
+                region.class_token === null ? null : "type-token",
+                region.filter_offset === null ? null : "filter",
+            ]),
+        ])
+        : null,
+});
+const keyField = (item) => ({
+    item,
+    exactKey: item.signature.parse_status === "decoded"
+        ? sha256(["field-exact", item.signature.raw_sha256])
+        : null,
+    // Only an undecoded field reaches this round: a decoded field with the
+    // same raw signature already met its counterpart in the exact round.
+    signatureKey: sha256([
+        "field-signature",
+        item.declaring_type,
+        item.name,
+        item.signature.raw_sha256,
+    ]),
+    structuralKey: sha256([
+        "field-structural",
+        item.signature.kind,
+        item.signature.field_type,
+        item.flags,
+    ]),
+});
+const matchMethods = (left, right) => matchByKeys({
+    left,
+    right,
+    exactBasis: "exact-il-signature",
+    fallbackBases: [
+        {
+            basis: "exact-signature",
+            key: ({ signatureKey }) => signatureKey,
+        },
+        {
+            basis: "structural-method-shape",
+            key: ({ structuralKey }) => structuralKey,
+        },
+    ],
+});
+const matchFields = (left, right) => matchByKeys({
+    left,
+    right,
+    exactBasis: "field-signature",
+    fallbackBases: [
+        {
+            basis: "exact-signature",
+            key: ({ signatureKey }) => signatureKey,
+        },
+    ],
+});
+const matchByKeys = ({ left, right, exactBasis, fallbackBases, }) => {
+    const usedLeft = new Set();
+    const usedRight = new Set();
+    const pairs = [];
+    const ambiguous = [];
+    const rounds = [
+        { basis: exactBasis, key: ({ exactKey }) => exactKey },
+        ...fallbackBases,
+    ];
+    for (const round of rounds) {
+        const leftGroups = groupBy(left.filter((item) => !usedLeft.has(item)), round.key);
+        const rightGroups = groupBy(right.filter((item) => !usedRight.has(item)), round.key);
+        for (const [key, leftItems] of leftGroups) {
+            const rightItems = rightGroups.get(key);
+            if (rightItems === undefined)
+                continue;
+            if (leftItems.length === 1 && rightItems.length === 1) {
+                const [leftItem] = leftItems;
+                const [rightItem] = rightItems;
+                if (leftItem === undefined || rightItem === undefined)
+                    continue;
+                usedLeft.add(leftItem);
+                usedRight.add(rightItem);
+                pairs.push({
+                    left: leftItem,
+                    right: rightItem,
+                    basis: round.basis,
+                    confidence: round.basis === "exact-il-signature" ||
+                        round.basis === "exact-signature" ||
+                        round.basis === "field-signature"
+                        ? "exact"
+                        : "high",
+                });
+            }
+            else {
+                for (const item of leftItems)
+                    usedLeft.add(item);
+                for (const item of rightItems)
+                    usedRight.add(item);
+                ambiguous.push({
+                    left: leftItems,
+                    right: rightItems,
+                    basis: round.basis,
+                });
+            }
+        }
+    }
+    return {
+        pairs,
+        ambiguous,
+        leftOnly: left.filter((item) => !usedLeft.has(item)),
+        rightOnly: right.filter((item) => !usedRight.has(item)),
+    };
+};
+const groupBy = (items, keyOf) => {
+    const grouped = new Map();
+    for (const item of items) {
+        const key = keyOf(item);
+        if (key === null)
+            continue;
+        const bucket = grouped.get(key) ?? [];
+        bucket.push(item);
+        grouped.set(key, bucket);
+    }
+    return grouped;
+};
+/** Whether a side's inventory observed members of this declaring type. */
+const observedBy = (side) => ({ declaring_type }) => side.result.selection === null ||
+    (declaring_type !== null &&
+        side.result.selection.type_names.includes(declaring_type));
+/**
+ * Pair only members whose declaring type both sides observed. A member outside
+ * the other side's selection stays one-sided, so a type selection never yields
+ * a remap to a member of a type the other side did not inspect.
+ */
+const matchObserved = (left, right, sides, match, key) => {
+    const matched = match(left.filter(sides.inRight).map(key), right.filter(sides.inLeft).map(key));
+    return {
+        ...matched,
+        leftOnly: [
+            ...matched.leftOnly,
+            ...left.filter((item) => !sides.inRight(item)).map(key),
+        ],
+        rightOnly: [
+            ...matched.rightOnly,
+            ...right.filter((item) => !sides.inLeft(item)).map(key),
+        ],
+    };
+};
+export const keyMembers = (left, right) => {
+    const sides = { inLeft: observedBy(left), inRight: observedBy(right) };
+    return {
+        methodMatches: matchObserved(left.result.methods, right.result.methods, sides, matchMethods, keyMethod),
+        fieldMatches: matchObserved(left.result.fields, right.result.fields, sides, matchFields, keyField),
+    };
+};
+export const parseManagedMemberEvidence = (evidence) => {
+    const parsed = parseManagedInspectionEvidence(evidence, "inspect_managed_members", managedMemberInspectionSchema);
+    return {
+        evidenceId: parsed.evidence.evidence_id,
+        result: parsed.result,
+    };
+};

package/dist/domain/managed/managedNativeVerification.js

@@ -0,0 +1,35 @@
+import { createHash } from "node:crypto";
+import canonicalize from "canonicalize";
+import { managedNativeBoundaryInspectionSchema, } from "./managedArtifact.js";
+import { parseManagedInspectionEvidence } from "./managedInspectionEvidence.js";
+import { managedNativeVerificationResultSchema, } from "./managedNativeVerificationSchemas.js";
+import { buildVerificationResult, collectNativeSymbols, verifyPinvoke, } from "./managedNativeVerificationMatch.js";
+const sha256 = (value) => {
+    const serialized = canonicalize(value);
+    if (serialized === undefined)
+        throw new TypeError("Managed/native verification canonicalization failed");
+    return createHash("sha256").update(serialized).digest("hex");
+};
+const parseManagedBoundary = (input) => parseManagedInspectionEvidence(input.managed_boundaries, "inspect_managed_native_boundaries", managedNativeBoundaryInspectionSchema);
+/** Verify managed P/Invoke declarations against authenticated native Evidence. */
+export const verifyManagedNativeBoundaries = (input) => {
+    const { evidence: managedEvidence, result: managed } = parseManagedBoundary(input);
+    const native = collectNativeSymbols(input.native_observations);
+    const verifiedPinvokes = managed.pinvoke_imports.map((item) => verifyPinvoke({
+        item,
+        managedEvidenceId: managedEvidence.evidence_id,
+        native,
+    }));
+    const pinvokeImports = verifiedPinvokes.map(({ verification }) => verification);
+    const withoutId = buildVerificationResult({
+        managedEvidence,
+        managed,
+        native,
+        pinvokeImports,
+        input,
+    });
+    return managedNativeVerificationResultSchema.parse({
+        ...withoutId,
+        verification_id: `mnv_${sha256(withoutId)}`,
+    });
+};

package/dist/domain/managed/managedNativeVerificationMatch.js

@@ -0,0 +1,276 @@
+import { createHash } from "node:crypto";
+import { basename } from "node:path";
+import canonicalize from "canonicalize";
+import { parseEvidence } from "../evidence.js";
+import { functionDossierSchema } from "../hopperValues.js";
+import { inspectMachoSchema } from "../native/nativeInspection.js";
+import { pinvokeVerificationSchema, } from "./managedNativeVerificationSchemas.js";
+const digest = (value) => {
+    const serialized = canonicalize(value);
+    if (serialized === undefined)
+        throw new TypeError("Managed/native verification canonicalization failed");
+    return createHash("sha256").update(serialized).digest("hex");
+};
+const moduleName = (evidence) => evidence.subject?.name ?? null;
+const modulePath = (evidence) => evidence.subject?.local_path ?? null;
+const symbolsForEvidence = (evidence) => {
+    if (evidence.operation === "inspect_macho") {
+        const result = inspectMachoSchema.parse(evidence.normalized_result);
+        return {
+            supported: true,
+            symbols: result.exports.items.map((symbol) => ({
+                evidence_id: evidence.evidence_id,
+                operation: evidence.operation,
+                name: symbol.name,
+                address: symbol.address,
+                module_name: moduleName(evidence),
+                module_path: modulePath(evidence),
+                source: "macho-export",
+            })),
+        };
+    }
+    if (evidence.operation === "analyze_function") {
+        const dossier = functionDossierSchema.parse(evidence.normalized_result);
+        return {
+            supported: true,
+            symbols: [
+                {
+                    evidence_id: evidence.evidence_id,
+                    operation: evidence.operation,
+                    name: dossier.procedure.name,
+                    address: dossier.procedure.address,
+                    module_name: moduleName(evidence),
+                    module_path: modulePath(evidence),
+                    source: "function-dossier",
+                },
+            ],
+        };
+    }
+    return { supported: false, symbols: [] };
+};
+export const collectNativeSymbols = (observations) => {
+    const symbols = [];
+    let accepted = 0;
+    let unsupported = 0;
+    for (const raw of observations) {
+        const evidence = parseEvidence(raw);
+        const extracted = symbolsForEvidence(evidence);
+        if (!extracted.supported) {
+            unsupported += 1;
+        }
+        else {
+            accepted += 1;
+            symbols.push(...extracted.symbols);
+        }
+    }
+    return { symbols, accepted, unsupported };
+};
+const sameSymbolName = (expected, native) => expected ===
+    (native.source === "macho-export" && native.name.startsWith("_")
+        ? native.name.slice(1)
+        : native.name);
+const normalizeModule = (value) => basename(value)
+    .toLowerCase()
+    .replace(/\.(dll|dylib|so|node|exe)$/u, "");
+const nativeModuleIdentities = (value) => {
+    const filename = basename(value).toLowerCase();
+    const stem = normalizeModule(filename);
+    const identities = new Set([stem]);
+    if (/\.(dylib|so)$/u.test(filename) && stem.startsWith("lib"))
+        identities.add(stem.slice("lib".length));
+    return identities;
+};
+const moduleCompatible = (scope, symbol) => {
+    if (scope === null)
+        return true;
+    const expected = normalizeModule(scope);
+    return [symbol.module_name, symbol.module_path]
+        .filter((value) => value !== null)
+        .some((value) => nativeModuleIdentities(value).has(expected));
+};
+const candidateNames = (managed) => {
+    const names = new Set([managed.import_name]);
+    if (!managed.no_mangle) {
+        if (managed.char_set === "unicode")
+            names.add(`${managed.import_name}W`);
+        if (managed.char_set === "ansi")
+            names.add(`${managed.import_name}A`);
+        if (managed.call_convention === "stdcall") {
+            names.add(`_${managed.import_name}`);
+            names.add(`_${managed.import_name}@0`);
+        }
+    }
+    return [...names];
+};
+const matchPinvoke = (managed, symbols, supportedNativeEvidence) => {
+    const names = candidateNames(managed);
+    const allCandidates = symbols.filter((symbol) => names.some((name) => sameSymbolName(name, symbol)));
+    const [first, ...remaining] = allCandidates;
+    if (first === undefined)
+        return {
+            match: {
+                status: "unresolved",
+                basis: supportedNativeEvidence > 0
+                    ? "no-native-candidate"
+                    : "unsupported-native-evidence",
+                confidence: "unknown",
+                matched_native: null,
+                candidates: [],
+            },
+        };
+    const candidates = [first, ...remaining];
+    const exact = candidates.find((symbol) => managed.import_name === symbol.name &&
+        moduleCompatible(managed.import_scope_name, symbol));
+    const decorated = candidates.find((symbol) => moduleCompatible(managed.import_scope_name, symbol));
+    const selected = exact ?? decorated ?? first;
+    if (!moduleCompatible(managed.import_scope_name, selected))
+        return {
+            match: {
+                status: "contradicted",
+                basis: "module-mismatch",
+                confidence: "unknown",
+                matched_native: selected,
+                candidates,
+            },
+        };
+    if (exact !== undefined)
+        return {
+            match: {
+                status: "verified",
+                basis: selected.source === "macho-export"
+                    ? "exact-export-name"
+                    : "exact-function-name",
+                confidence: "observed",
+                matched_native: selected,
+                candidates,
+            },
+        };
+    return {
+        match: {
+            basis: "decorated-name-candidate",
+            status: "inferred",
+            confidence: "inferred",
+            matched_native: selected,
+            candidates,
+        },
+    };
+};
+const pinvokeLimitations = (status, managed) => [
+    ...(managed.import_scope_name === null
+        ? ["Managed declaration does not name an import scope/module."]
+        : []),
+    ...(status === "inferred"
+        ? [
+            "Native symbol matched a decorated candidate rather than the exact declared import name.",
+        ]
+        : []),
+    ...(status === "contradicted"
+        ? [
+            "A symbol name candidate exists, but the supplied native Evidence module identity does not match the managed import scope.",
+        ]
+        : []),
+    ...(status === "unresolved"
+        ? [
+            "No supplied native export/function Evidence matched this declared import.",
+        ]
+        : []),
+];
+export const verifyPinvoke = ({ item, managedEvidenceId, native, }) => {
+    const managed = {
+        token: item.token,
+        member_token: item.member_token,
+        member_name: item.member_name,
+        import_name: item.import_name,
+        import_scope_name: item.import_scope_name,
+        no_mangle: item.no_mangle,
+        char_set: item.char_set,
+        call_convention: item.call_convention,
+        declaration_verification: item.verification,
+    };
+    const selection = matchPinvoke(item, native.symbols, native.accepted);
+    const limitations = pinvokeLimitations(selection.match.status, item);
+    return {
+        verification: pinvokeVerificationSchema.parse({
+            item_id: `mnv_pinvoke_${digest({
+                managedEvidenceId,
+                token: item.token,
+                importName: item.import_name,
+                importScope: item.import_scope_name,
+                candidates: selection.match.candidates,
+            })}`,
+            managed,
+            ...selection.match,
+            evidence_links: [
+                managedEvidenceId,
+                ...new Set(selection.match.candidates.map(({ evidence_id: id }) => id)),
+            ],
+            limitations,
+        }),
+    };
+};
+const countStatuses = (items) => ({
+    verified: items.filter(({ status }) => status === "verified").length,
+    inferred: items.filter(({ status }) => status === "inferred").length,
+    unresolved: items.filter(({ status }) => status === "unresolved").length,
+    contradicted: items.filter(({ status }) => status === "contradicted").length,
+});
+export const buildVerificationResult = ({ managedEvidence, managed, native, pinvokeImports, input, }) => {
+    const counts = countStatuses(pinvokeImports);
+    const nativeBodyUnresolved = managed.native_implementations.filter(({ boundary_kind: kind }) => kind !== "pinvoke").length;
+    const coverage = {
+        status: managed.coverage.state === "complete" && native.unsupported === 0
+            ? "complete-within-inputs"
+            : "partial",
+    };
+    return {
+        algorithm: {
+            name: "rea-managed-native-verification",
+            token_identity: "build-local",
+            token_to_address_mapping: "not-inferred",
+        },
+        managed_boundary: {
+            evidence_id: managedEvidence.evidence_id,
+            artifact_sha256: managed.artifact.sha256,
+            artifact_path: managed.artifact.path,
+            mvid: managed.module?.mvid ?? null,
+            metadata_status: managed.metadata.status,
+            pinvoke_imports_total: managed.pinvoke_imports.length,
+            native_implementations_total: managed.native_implementations.length,
+            coverage_state: managed.coverage.state,
+        },
+        native_observations: {
+            total: input.native_observations.length,
+            accepted: native.accepted,
+            unsupported: native.unsupported,
+            symbols: native.symbols.length,
+        },
+        summary: {
+            ...counts,
+            native_body_unresolved: nativeBodyUnresolved,
+        },
+        pinvoke_imports: [...pinvokeImports],
+        native_implementations: {
+            unresolved: nativeBodyUnresolved,
+            reason: "Managed metadata tokens and RVAs are not translated to native provider addresses by this workflow; C++/CLI, ReadyToRun, and native-body mappings require explicit provider-supported bridge evidence.",
+        },
+        coverage,
+        evidence_links: [
+            managedEvidence.evidence_id,
+            ...input.native_observations.map(({ evidence_id: id }) => id),
+        ],
+        limitations: [
+            "P/Invoke verification checks declared import names against supplied native export or function-name Evidence only.",
+            "A matching native symbol verifies that a candidate export/function was observed; it does not prove CLR binding, marshaling behavior, call reachability, or runtime loading.",
+            "Missing supplied native symbols are reported as unresolved, not proof that a dependency cannot exist.",
+            "Managed metadata tokens and method RVAs are not interpreted as native addresses.",
+            ...(managed.coverage.state === "complete"
+                ? []
+                : ["Managed boundary input is partial or unavailable."]),
+            ...(native.unsupported === 0
+                ? []
+                : [
+                    "Some native Evidence operations were unsupported by this workflow.",
+                ]),
+        ],
+    };
+};

package/dist/domain/managed/managedNativeVerificationSchemas.js

@@ -0,0 +1,180 @@
+import { z } from "zod";
+import { emptyArraySchema } from "../emptyArraySchema.js";
+import { evidenceSchema } from "../evidence.js";
+import { cliMetadataGuidSchema } from "./managedArtifact.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
+const tokenSchema = z.string().regex(/^0x[0-9a-f]{8}$/u);
+const textSchema = z.string().min(1);
+const nativeSymbolSchema = z.strictObject({
+    evidence_id: evidenceIdSchema,
+    operation: z.string().min(1),
+    name: z.string().min(1),
+    address: z.string().nullable(),
+    module_name: z.string().nullable(),
+    module_path: z.string().nullable(),
+    source: z.enum(["macho-export", "function-dossier"]),
+});
+const pinvokeVerificationContextShape = {
+    item_id: prefixedDigestSchema("mnv_pinvoke"),
+    managed: z.strictObject({
+        token: tokenSchema,
+        member_token: tokenSchema.nullable(),
+        member_name: z.string().nullable(),
+        import_name: z.string().min(1),
+        import_scope_name: z.string().nullable(),
+        no_mangle: z.boolean(),
+        char_set: z.enum(["not-specified", "ansi", "unicode", "auto", "unknown"]),
+        call_convention: z.enum([
+            "not-specified",
+            "winapi",
+            "cdecl",
+            "stdcall",
+            "thiscall",
+            "fastcall",
+            "unknown",
+        ]),
+        declaration_verification: z.literal("managed-declaration-only"),
+    }),
+    evidence_links: z.array(evidenceIdSchema).min(1),
+    limitations: z.array(textSchema),
+};
+const observedCandidatesSchema = z
+    .tuple([nativeSymbolSchema])
+    .rest(nativeSymbolSchema);
+export const pinvokeVerificationSchema = z.discriminatedUnion("status", [
+    z.strictObject({
+        ...pinvokeVerificationContextShape,
+        status: z.literal("verified"),
+        basis: z.enum(["exact-export-name", "exact-function-name"]),
+        confidence: z.literal("observed"),
+        matched_native: nativeSymbolSchema,
+        candidates: observedCandidatesSchema,
+    }),
+    z.strictObject({
+        ...pinvokeVerificationContextShape,
+        status: z.literal("inferred"),
+        basis: z.literal("decorated-name-candidate"),
+        confidence: z.literal("inferred"),
+        matched_native: nativeSymbolSchema,
+        candidates: observedCandidatesSchema,
+    }),
+    z.strictObject({
+        ...pinvokeVerificationContextShape,
+        status: z.literal("unresolved"),
+        basis: z.enum(["no-native-candidate", "unsupported-native-evidence"]),
+        confidence: z.literal("unknown"),
+        matched_native: z.null(),
+        candidates: emptyArraySchema,
+    }),
+    z.strictObject({
+        ...pinvokeVerificationContextShape,
+        status: z.literal("contradicted"),
+        basis: z.literal("module-mismatch"),
+        confidence: z.literal("unknown"),
+        matched_native: nativeSymbolSchema,
+        candidates: observedCandidatesSchema,
+    }),
+]);
+/** Authenticated managed boundary Evidence plus native observations. */
+export const managedNativeVerificationInputSchema = z
+    .strictObject({
+    managed_boundaries: evidenceSchema,
+    native_observations: z.array(evidenceSchema).min(1),
+})
+    .superRefine((input, context) => {
+    const ids = new Set();
+    for (const [index, evidence] of input.native_observations.entries()) {
+        if (evidence.evidence_id === input.managed_boundaries.evidence_id) {
+            context.addIssue({
+                code: "custom",
+                path: ["native_observations", index],
+                message: "Native observation Evidence must be distinct from managed boundary Evidence",
+            });
+        }
+        if (ids.has(evidence.evidence_id)) {
+            context.addIssue({
+                code: "custom",
+                path: ["native_observations", index],
+                message: "Native observation Evidence IDs must be unique",
+            });
+        }
+        ids.add(evidence.evidence_id);
+    }
+});
+const verificationCoverageSchema = z.strictObject({
+    status: z.enum(["complete-within-inputs", "partial"]),
+});
+/** Provider-neutral managed/native verification result. */
+export const managedNativeVerificationResultSchema = z
+    .strictObject({
+    verification_id: prefixedDigestSchema("mnv"),
+    algorithm: z.strictObject({
+        name: z.literal("rea-managed-native-verification"),
+        token_identity: z.literal("build-local"),
+        token_to_address_mapping: z.literal("not-inferred"),
+    }),
+    managed_boundary: z.strictObject({
+        evidence_id: evidenceIdSchema,
+        artifact_sha256: digestSchema,
+        artifact_path: z.string().min(1),
+        mvid: cliMetadataGuidSchema.nullable(),
+        metadata_status: z.enum(["absent", "complete", "partial", "malformed"]),
+        pinvoke_imports_total: z.number().int().min(0),
+        native_implementations_total: z.number().int().min(0),
+        coverage_state: z.enum(["complete", "partial", "unavailable"]),
+    }),
+    native_observations: z.strictObject({
+        total: z.number().int().min(1),
+        accepted: z.number().int().min(0),
+        unsupported: z.number().int().min(0),
+        symbols: z.number().int().min(0),
+    }),
+    summary: z.strictObject({
+        verified: z.number().int().min(0),
+        inferred: z.number().int().min(0),
+        unresolved: z.number().int().min(0),
+        contradicted: z.number().int().min(0),
+        native_body_unresolved: z.number().int().min(0),
+    }),
+    pinvoke_imports: z.array(pinvokeVerificationSchema),
+    native_implementations: z.strictObject({
+        unresolved: z.number().int().min(0),
+        reason: textSchema,
+    }),
+    coverage: verificationCoverageSchema,
+    evidence_links: z.array(evidenceIdSchema).min(2),
+    limitations: z.array(textSchema),
+})
+    .superRefine((result, context) => {
+    const observedNativeCount = result.native_observations.accepted +
+        result.native_observations.unsupported;
+    if (observedNativeCount !== result.native_observations.total)
+        context.addIssue({
+            code: "custom",
+            path: ["native_observations"],
+            message: "Native observation counts must account for the total input",
+        });
+    for (const status of [
+        "verified",
+        "inferred",
+        "unresolved",
+        "contradicted",
+    ])
+        if (result.summary[status] !==
+            result.pinvoke_imports.filter((item) => item.status === status).length)
+            context.addIssue({
+                code: "custom",
+                path: ["summary", status],
+                message: `P/Invoke ${status} count must match the item results`,
+            });
+    if (result.summary.native_body_unresolved !==
+        result.native_implementations.unresolved)
+        context.addIssue({
+            code: "custom",
+            path: ["summary", "native_body_unresolved"],
+            message: "Native body summary must match unresolved implementations",
+        });
+})
+    .describe("Counts must agree across the result: native accepted plus unsupported equals total; each P/Invoke summary count equals the number of items with that status; and native_body_unresolved equals native_implementations.unresolved. REA checks these cross-field invariants after constructing the result.");