{
  "evidence_id": "ev_4fbc9fa4bf566dd550b31995a58e80e879fc3c39d0287e5f6759c730e2952b51",
  "subject": {
    "name": "js-app",
    "digest": {
      "sha256": "bb9f726c3aafe026e6cc871b8de16cd81db9f03b4c2bab05f494307f8ebb42a2"
    },
    "local_path": "$CAPTURE/fixtures/js-app",
    "format": "directory",
    "architecture": null
  },
  "provider": {
    "id": "rea-analysis-view",
    "name": "REA analysis view projection",
    "version": "1"
  },
  "analysis_profile": null,
  "predicate_type": "rea.analysis-view",
  "operation": "inspect_analysis_view",
  "parameters": {
    "parent_evidence_id": "ev_14bd1d1e46ab803844822f975a9cbf59208285bb9afdd376fb3209539d2c8046",
    "view": {
      "kind": "summary"
    }
  },
  "raw_result": null,
  "normalized_result": {
    "kind": "summary",
    "view": {
      "kind": "summary"
    },
    "parent_evidence_id": "ev_14bd1d1e46ab803844822f975a9cbf59208285bb9afdd376fb3209539d2c8046",
    "parent_operation": "analyze_javascript_application",
    "parent_digest": "14bd1d1e46ab803844822f975a9cbf59208285bb9afdd376fb3209539d2c8046",
    "view_digest": "75abe91bb5886b082e03f5a7a46f129214d5064f4d5aa6eb45a17585b6013c78",
    "artifact": {
      "path": "$CAPTURE/fixtures/js-app",
      "sha256": "bb9f726c3aafe026e6cc871b8de16cd81db9f03b4c2bab05f494307f8ebb42a2"
    },
    "coverage": {
      "status": "complete-within-view",
      "examined": 15,
      "total": 42,
      "next_offset": null,
      "exhausted": true
    },
    "limitations": [
      "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
      "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
      "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
      "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
      "Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.",
      "Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.",
      "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
      "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
      "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
      "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
      "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
      "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
      "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
      "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
      "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
      "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
      "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
      "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code."
    ],
    "unknowns": [
      "118 semantic graph unknowns remain in the parent Evidence.",
      "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
      "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
      "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
      "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
      "Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.",
      "Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.",
      "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
      "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
      "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
      "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
      "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
      "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
      "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
      "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
      "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
      "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
      "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
      "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
      "semantic_graph.coverage.status is unknown"
    ],
    "summary": {
      "input_path": "$CAPTURE/fixtures/js-app",
      "format": "directory",
      "root_artifact_sha256": "bb9f726c3aafe026e6cc871b8de16cd81db9f03b4c2bab05f494307f8ebb42a2",
      "statistics": {
        "relevant_files": 6,
        "nested_asar_containers": 0,
        "text_bytes_read": 2888,
        "invalid_utf8_files": 0,
        "parsed_javascript_files": 4,
        "skipped_javascript_files": 0,
        "visited_ast_nodes": 424,
        "findings": 25,
        "modules": 0,
        "parse_failures": 0
      },
      "electron": {
        "browser_windows": 1,
        "explicit_web_preferences": 3,
        "preload_entrypoints": 1,
        "context_bridge_apis": 1,
        "exposed_api_members": 3,
        "ipc": {
          "operations": 6,
          "literal_channels": 3,
          "dynamic_channel_operations": 0,
          "renderer_transmissions": 3,
          "renderer_listeners": 0,
          "main_handlers": 3,
          "paired_renderer_transmissions": 3,
          "ambiguous_renderer_transmissions": 0,
          "unpaired_literal_renderer_transmissions": 0
        },
        "sender_validation_observations": 0,
        "utility_processes": 0,
        "resolved_utility_entrypoints": 0,
        "native_addon_bindings": 0,
        "resolved_native_addon_bindings": 0
      },
      "coverage": {
        "application": {
          "status": "complete",
          "truncated": false,
          "omitted_count": 0,
          "limits": []
        },
        "semantic": {
          "status": "unknown",
          "truncated": false,
          "omitted_nodes": 0,
          "omitted_relations": 0,
          "limits": [],
          "families": [
            {
              "family": "boundary",
              "status": "partial",
              "retained_relations": 0,
              "omitted_relations": 0,
              "unknown_count": 0
            },
            {
              "family": "call-flow",
              "status": "partial",
              "retained_relations": 12,
              "omitted_relations": 0,
              "unknown_count": 31
            },
            {
              "family": "child-process",
              "status": "partial",
              "retained_relations": 0,
              "omitted_relations": 0,
              "unknown_count": 0
            },
            {
              "family": "closure",
              "status": "partial",
              "retained_relations": 10,
              "omitted_relations": 0,
              "unknown_count": 0
            },
            {
              "family": "configuration",
              "status": "partial",
              "retained_relations": 0,
              "omitted_relations": 0,
              "unknown_count": 0
            },
            {
              "family": "data-flow",
              "status": "partial",
              "retained_relations": 177,
              "omitted_relations": 0,
              "unknown_count": 38
            },
            {
              "family": "event",
              "status": "partial",
              "retained_relations": 1,
              "omitted_relations": 0,
              "unknown_count": 0
            },
            {
              "family": "object-flow",
              "status": "partial",
              "retained_relations": 24,
              "omitted_relations": 0,
              "unknown_count": 43
            },
            {
              "family": "promise-ownership",
              "status": "partial",
              "retained_relations": 7,
              "omitted_relations": 0,
              "unknown_count": 6
            },
            {
              "family": "request",
              "status": "partial",
              "retained_relations": 2,
              "omitted_relations": 0,
              "unknown_count": 0
            },
            {
              "family": "resource-lifecycle",
              "status": "partial",
              "retained_relations": 0,
              "omitted_relations": 0,
              "unknown_count": 0
            },
            {
              "family": "timer",
              "status": "partial",
              "retained_relations": 0,
              "omitted_relations": 0,
              "unknown_count": 0
            }
          ]
        },
        "application_unknowns": 0,
        "semantic_unknowns": 118
      },
      "limitation_count": 7
    }
  },
  "confidence": "derived",
  "authority": "shipped-artifact",
  "environment": null,
  "limitations": [
    "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
    "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
    "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
    "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
    "Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.",
    "Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.",
    "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
    "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
    "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
    "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
    "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
    "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
    "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
    "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
    "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
    "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
    "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
    "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code."
  ],
  "relationship_coverage": null,
  "locations": [
    {
      "kind": "artifact-path",
      "path": "$CAPTURE/fixtures/js-app"
    }
  ],
  "evidence_links": [
    "ev_14bd1d1e46ab803844822f975a9cbf59208285bb9afdd376fb3209539d2c8046"
  ]
}