fix: preserve capability and catalog invariants

Author: morluto

docs/product-catalog.json

@@ -680,10 +680,10 @@
       "mcp_resource_templates": 11
     },
     "digests": {
-      "tools_sha256": "b37a5ba0db422402418686d1361fa1bdbdf70ef456f7683fda540c04c8760100",
+      "tools_sha256": "80d39f080e18eea6fbb1522e589ea33d305f33a77542a21638cfbb29ccad1c24",
       "prompts_sha256": "3886a3bf55a448def79e3eb429e6a56eb2ba075423c5cb1e5747642b389ef8fe",
       "resources_sha256": "e0e872276ebf6f88e916ef24930a99eed27ce4c93e494e60820e9bd8cc8497c3",
-      "combined_sha256": "531d7e1c583aebd18306ad6d136418a43cfd2e0d215cf39c8224ee836ac76e21",
+      "combined_sha256": "2b9bd45a5c8c53a337a0cbf535ae9ba81f49ef971aeb6953f66c8e4ab08f92cf",
       "providers_sha256": "7446b51788734ebf6f4f702e3a5a8c9f0b61967490c245f30bd37b2060827e6b"
     }
   }

docs/verification/managed-conformance-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "manifest_id": "ecm_1fde266c466ffd6dde6f171e702f2929fc19ab8afb9958d3ae11a518133740da",
+  "manifest_id": "ecm_194d590d9c10d2fd18244ed32a0a8a2c35b68e725cc14e515c3898b7504290c1",
   "verifier": {
     "id": "rea-managed-conformance",
     "version": "1"
@@ -14,7 +14,7 @@
   "skill_digests": [
     {
       "skill_id": "reverse-engineer-anything",
-      "sha256": "44a7bc2732a693757d8c54a99362422111573fdb73bd61c562421c7787a87b1a"
+      "sha256": "ae81b854f73a9775e5a4dd84a276e7d0d4d81b1a20040f2b9742060ace59e6e2"
     }
   ],
   "claims": [

skills/reverse-engineer-anything/SKILL.md

@@ -4,7 +4,7 @@ description: Reverse engineer native, managed, Electron/JavaScript, packaged, an
 metadata:
   version: "23"
   tool_count: 116
-  catalog_digest: "531d7e1c583aebd18306ad6d136418a43cfd2e0d215cf39c8224ee836ac76e21"
+  catalog_digest: "2b9bd45a5c8c53a337a0cbf535ae9ba81f49ef971aeb6953f66c8e4ab08f92cf"
 ---
 
 # REA

src/config/browserScenario.ts

@@ -66,7 +66,7 @@ export const parseBrowserScenarioPolicy = (
     "REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON",
   );
   if (!allowedEnvironment.ok) return allowedEnvironment;
-  if (env.REA_BROWSER_SCENARIO_ENABLED === "false")
+  if (env.REA_BROWSER_SCENARIO_ENABLED !== "true")
     return ok({ status: "disabled" });
   const [firstOrigin, ...remainingOrigins] = allowedOrigins.value;
   if (firstOrigin === undefined)

src/config/electronAutomation.ts

@@ -28,7 +28,7 @@ export const parseElectronAutomationPolicy = (
     "REA_ELECTRON_AUTOMATE_APPLICATION_ROOTS_JSON",
   );
   if (!applicationRoots.ok) return applicationRoots;
-  if (env.REA_ELECTRON_AUTOMATE_ENABLED === "false")
+  if (env.REA_ELECTRON_AUTOMATE_ENABLED !== "true")
     return ok({ status: "disabled" });
   const [firstExecutableRoot, ...remainingExecutableRoots] =
     executableRoots.value;

src/config/javascriptReplay.ts

@@ -18,7 +18,7 @@ export const parseJavaScriptReplayPolicy = (
     "REA_JAVASCRIPT_REPLAY_ROOTS_JSON",
   );
   if (!roots.ok) return roots;
-  if (env.REA_JAVASCRIPT_REPLAY_ENABLED === "false")
+  if (env.REA_JAVASCRIPT_REPLAY_ENABLED !== "true")
     return ok({ status: "disabled" });
   const [firstRoot, ...remainingRoots] = roots.value;
   if (firstRoot === undefined)

src/config/managedRuntime.ts

@@ -10,7 +10,7 @@ export const parseManagedRuntimePolicy = (
   env: Environment,
   roots: readonly string[],
 ): Result<ManagedRuntimePolicy, ConfigurationError> => {
-  if (env.REA_MANAGED_RUNTIME_ENABLED === "false")
+  if (env.REA_MANAGED_RUNTIME_ENABLED !== "true")
     return ok({ status: "disabled" });
   const [firstRoot, ...remainingRoots] = roots;
   if (firstRoot === undefined)

src/config/passiveObservation.ts

@@ -126,7 +126,7 @@ const parseBrowserObservationPolicy = (
     32,
   );
   if (!origins.ok) return origins;
-  if (env.REA_BROWSER_OBSERVE_ENABLED === "false")
+  if (env.REA_BROWSER_OBSERVE_ENABLED !== "true")
     return ok({ status: "disabled" });
   const parsedEndpoints = requireFirst(
     endpoints.value,
@@ -157,7 +157,7 @@ const parseElectronObservationPolicy = (
   if (!endpoints.ok) return endpoints;
   const roots = parseElectronFileRoots(env.REA_ELECTRON_FILE_ROOTS_JSON);
   if (!roots.ok) return roots;
-  if (env.REA_ELECTRON_OBSERVE_ENABLED === "false")
+  if (env.REA_ELECTRON_OBSERVE_ENABLED !== "true")
     return ok({ status: "disabled" });
   const parsedEndpoints = requireFirst(
     endpoints.value,
@@ -198,7 +198,7 @@ const parseV8InspectorObservationPolicy = (
     32,
   );
   if (!origins.ok) return origins;
-  if (env.REA_V8_INSPECTOR_OBSERVE_ENABLED === "false")
+  if (env.REA_V8_INSPECTOR_OBSERVE_ENABLED !== "true")
     return ok({ status: "disabled" });
   const parsedEndpoints = requireFirst(
     endpoints.value,

src/config/processCapture.ts

@@ -28,7 +28,7 @@ export const parseProcessExecutionPolicy = (
     "REA_PROCESS_ALLOWED_ENV_JSON",
   );
   if (!allowedEnvironment.ok) return allowedEnvironment;
-  if (env.REA_PROCESS_CAPTURE_ENABLED === "false")
+  if (env.REA_PROCESS_CAPTURE_ENABLED !== "true")
     return ok({ status: "disabled" });
   const parsedExecutables = requireRoots(
     executableRoots.value,

src/contracts/managedWorkflowToolContracts.ts

@@ -96,26 +96,40 @@ export const managedNativeVerificationReferenceInputSchema = z
     }
   });
 
-/** MCP references for projecting managed Evidence into an application graph. */
+const managedApplicationGraphReferenceFacts = {
+  limits: projectManagedApplicationGraphInputSchema.shape.limits,
+} as const;
+
+/** MCP references requiring at least one managed Evidence source. */
 export const managedApplicationGraphReferenceInputSchema = z
-  .strictObject({
-    managed_artifact_evidence_id: managedArtifactEvidenceIdSchema.optional(),
-    managed_members_evidence_id: managedEvidenceIdSchema.optional(),
-    managed_native_boundaries_evidence_id:
-      managedBoundaryEvidenceIdSchema.optional(),
-    limits: projectManagedApplicationGraphInputSchema.shape.limits,
-  })
+  .union([
+    z.strictObject({
+      ...managedApplicationGraphReferenceFacts,
+      managed_artifact_evidence_id: managedArtifactEvidenceIdSchema,
+      managed_members_evidence_id: managedEvidenceIdSchema.optional(),
+      managed_native_boundaries_evidence_id:
+        managedBoundaryEvidenceIdSchema.optional(),
+    }),
+    z.strictObject({
+      ...managedApplicationGraphReferenceFacts,
+      managed_artifact_evidence_id: managedArtifactEvidenceIdSchema.optional(),
+      managed_members_evidence_id: managedEvidenceIdSchema,
+      managed_native_boundaries_evidence_id:
+        managedBoundaryEvidenceIdSchema.optional(),
+    }),
+    z.strictObject({
+      ...managedApplicationGraphReferenceFacts,
+      managed_artifact_evidence_id: managedArtifactEvidenceIdSchema.optional(),
+      managed_members_evidence_id: managedEvidenceIdSchema.optional(),
+      managed_native_boundaries_evidence_id: managedBoundaryEvidenceIdSchema,
+    }),
+  ])
   .superRefine((input, context) => {
     const ids = [
       input.managed_artifact_evidence_id,
       input.managed_members_evidence_id,
       input.managed_native_boundaries_evidence_id,
     ].filter((id): id is string => id !== undefined);
-    if (ids.length === 0)
-      context.addIssue({
-        code: "custom",
-        message: "At least one managed Evidence ID is required",
-      });
     if (new Set(ids).size !== ids.length)
       context.addIssue({
         code: "custom",