morluto
835904e4ee
Carry the final artifact inspection's exact nested source Evidence through AnalysisExecution. Derive links in the shared Evidence builder instead of reparsing the result in CLI and MCP adapters. Retain validation for unknown and historical Evidence inputs. Move the shared source recorder into application ownership and migrate its consumers. Record sources before parents; keep source recording failures from publishing summaries. Decline snapshot entries whose source closure the current entry format cannot represent, while retaining investigation Evidence. Validation: actual ASAR regression failed before the change with missing links and passes afterward; exact nested identity, source recorder refusal, final-close cancellation and cleanup failure, historical authentication, snapshot controls and public CLI/MCP workflows. Fresh runtime/catalog build, full static/docs, discovery and duplication checks pass. Installed native providers and platform-specific skipped cases remain unverified.
93 lines
3.7 KiB
TypeScript
93 lines
3.7 KiB
TypeScript
import { workflowUnknownInput } from "../../application/investigation/WorkflowUnknown.js";
|
|
import type { EvidenceMcpServer } from "../EvidenceMcpServer.js";
|
|
import { runAdmittedToolOperation } from "../admittedToolOperation.js";
|
|
import { recordEvidenceSources } from "../../application/investigation/recordEvidenceSources.js";
|
|
|
|
import { executeManagedNativeBoundaries } from "../../application/managed/ManagedNativeVerificationService.js";
|
|
import { logToolExecution } from "../toolLogging.js";
|
|
import { toolRegistrationOptions } from "../toolRegistrationOptions.js";
|
|
import { toolContract } from "../../contracts/toolContracts.js";
|
|
import type { ManagedWorkflowToolRegistration } from "./types.js";
|
|
|
|
const nativeVerificationContract = toolContract(
|
|
"verify_managed_native_boundaries",
|
|
);
|
|
|
|
/** Register the managed/native boundary verification workflow tool. */
|
|
export const registerVerifyManagedNativeBoundaries = (
|
|
server: EvidenceMcpServer,
|
|
options: ManagedWorkflowToolRegistration,
|
|
): void => {
|
|
server.registerTool(
|
|
nativeVerificationContract.name,
|
|
toolRegistrationOptions(nativeVerificationContract),
|
|
async (input, context) =>
|
|
runAdmittedToolOperation(
|
|
server,
|
|
options.withAdmittedAnalysis,
|
|
nativeVerificationContract.name,
|
|
context.mcpReq.signal,
|
|
async () => {
|
|
const result = await logToolExecution(
|
|
options.logger,
|
|
nativeVerificationContract.name,
|
|
() => Promise.resolve(executeManagedNativeBoundaries(input)),
|
|
);
|
|
if (!result.ok)
|
|
return server.delivery.toCallToolResult(
|
|
result,
|
|
nativeVerificationContract,
|
|
);
|
|
const execution = result.value;
|
|
const recordedSources = recordEvidenceSources(
|
|
options.recordEvidence,
|
|
execution.sourceEvidence,
|
|
);
|
|
if (!recordedSources.ok)
|
|
return server.delivery.toCallToolResult(
|
|
recordedSources,
|
|
nativeVerificationContract,
|
|
);
|
|
const unknownInput = execution.hasUnknowns
|
|
? workflowUnknownInput(execution.evidence.evidence_id, {
|
|
question:
|
|
"Which managed/native boundaries remain unresolved or contradicted by the supplied native Evidence?",
|
|
severity: "medium",
|
|
domain: "managed-native-verification",
|
|
required_authority: "shipped-artifact",
|
|
required_confidence: "observed",
|
|
required_environment: null,
|
|
recommended_probes: [
|
|
{
|
|
operation: "inspect_managed_native_boundaries",
|
|
rationale:
|
|
"Review the inspection Evidence coverage and limit diagnostics; this operation has no page override, so unresolved declarations must remain unknown.",
|
|
},
|
|
{
|
|
operation: "analyze_function",
|
|
rationale:
|
|
"Analyze the provider-resolved native function candidate for the declared export.",
|
|
},
|
|
],
|
|
relationships: [],
|
|
})
|
|
: undefined;
|
|
const output =
|
|
unknownInput === undefined
|
|
? options.recordEvidence?.(execution.evidence)
|
|
: unknownInput.ok
|
|
? options.recordEvidenceWithUnknown?.(
|
|
execution.evidence,
|
|
unknownInput.value,
|
|
)
|
|
: unknownInput;
|
|
return server.delivery.toEvidenceToolResult(
|
|
execution.evidence,
|
|
nativeVerificationContract,
|
|
output,
|
|
);
|
|
},
|
|
),
|
|
);
|
|
};
|