{
  "analysis": {
    "evidence_id": "ev_71b06427c5042af11709fcc0bd3e0af9f56a57e138c310f5647ea94269ab9fa8",
    "subject": {
      "name": "rea-crypto-focused",
      "digest": {
        "sha256": "820342e8738258538d7f522e1104645c27b9ba414f6a6542173947e4699e1790"
      },
      "format": "directory",
      "architecture": null,
      "local_path": "/Users/duoduo/Documents/Codex/2026-10-13/https-github-com-morluto-rea-https/work/rea-crypto-focused"
    },
    "provider": {
      "id": "rea-analysis-view",
      "name": "REA analysis view projection",
      "version": "1"
    },
    "analysis_profile": null,
    "predicate_type": "rea.analysis-view",
    "operation": "inspect_analysis_view",
    "parameters": {
      "parent_evidence_id": "ev_6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81",
      "view": {
        "kind": "summary"
      }
    },
    "raw_result": null,
    "normalized_result": {
      "kind": "summary",
      "view": {
        "kind": "summary"
      },
      "summary": {
        "input_path": "/Users/duoduo/Documents/Codex/2026-10-13/https-github-com-morluto-rea-https/work/rea-crypto-focused",
        "format": "directory",
        "root_artifact_sha256": "820342e8738258538d7f522e1104645c27b9ba414f6a6542173947e4699e1790",
        "statistics": {
          "relevant_files": 1,
          "nested_asar_containers": 0,
          "text_bytes_read": 4515,
          "invalid_utf8_files": 0,
          "parsed_javascript_files": 1,
          "visited_ast_nodes": 1691,
          "findings": 28,
          "modules": 0,
          "parse_failures": 0
        },
        "electron": {
          "browser_windows": 0,
          "explicit_web_preferences": 0,
          "preload_entrypoints": 0,
          "context_bridge_apis": 0,
          "exposed_api_members": 0,
          "ipc": {
            "operations": 0,
            "literal_channels": 0,
            "dynamic_channel_operations": 0,
            "renderer_transmissions": 0,
            "renderer_listeners": 0,
            "main_handlers": 0,
            "paired_renderer_transmissions": 0,
            "ambiguous_renderer_transmissions": 0,
            "unpaired_literal_renderer_transmissions": 0
          },
          "sender_validation_observations": 0,
          "utility_processes": 0,
          "resolved_utility_entrypoints": 0,
          "native_addon_bindings": 0,
          "resolved_native_addon_bindings": 0
        },
        "coverage": {
          "application": {
            "status": "complete",
            "truncated": false,
            "omitted_count": 0,
            "limits": []
          },
          "semantic": {
            "status": "unknown",
            "truncated": false,
            "omitted_nodes": 0,
            "omitted_relations": 0,
            "limits": [],
            "families": [
              {
                "family": "boundary",
                "status": "partial",
                "retained_relations": 6,
                "omitted_relations": 0,
                "unknown_count": 0
              },
              {
                "family": "call-flow",
                "status": "partial",
                "retained_relations": 127,
                "omitted_relations": 0,
                "unknown_count": 78
              },
              {
                "family": "child-process",
                "status": "partial",
                "retained_relations": 0,
                "omitted_relations": 0,
                "unknown_count": 0
              },
              {
                "family": "closure",
                "status": "partial",
                "retained_relations": 71,
                "omitted_relations": 0,
                "unknown_count": 0
              },
              {
                "family": "configuration",
                "status": "partial",
                "retained_relations": 0,
                "omitted_relations": 0,
                "unknown_count": 0
              },
              {
                "family": "data-flow",
                "status": "partial",
                "retained_relations": 1039,
                "omitted_relations": 0,
                "unknown_count": 181
              },
              {
                "family": "event",
                "status": "partial",
                "retained_relations": 0,
                "omitted_relations": 0,
                "unknown_count": 0
              },
              {
                "family": "object-flow",
                "status": "partial",
                "retained_relations": 59,
                "omitted_relations": 0,
                "unknown_count": 106
              },
              {
                "family": "promise-ownership",
                "status": "partial",
                "retained_relations": 15,
                "omitted_relations": 0,
                "unknown_count": 13
              },
              {
                "family": "request",
                "status": "partial",
                "retained_relations": 0,
                "omitted_relations": 0,
                "unknown_count": 0
              },
              {
                "family": "resource-lifecycle",
                "status": "partial",
                "retained_relations": 0,
                "omitted_relations": 0,
                "unknown_count": 0
              },
              {
                "family": "timer",
                "status": "partial",
                "retained_relations": 0,
                "omitted_relations": 0,
                "unknown_count": 0
              }
            ]
          },
          "application_unknowns": 0,
          "semantic_unknowns": 378
        },
        "limitation_count": 5
      },
      "parent_evidence_id": "ev_6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81",
      "parent_operation": "analyze_javascript_application",
      "parent_digest": "6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81",
      "view_digest": "aaa09c0dcf963be6625c13c692e468549f1ecec5967c8d2fcb3b49ec53011e5d",
      "artifact": {
        "path": "/Users/duoduo/Documents/Codex/2026-10-13/https-github-com-morluto-rea-https/work/rea-crypto-focused",
        "sha256": "820342e8738258538d7f522e1104645c27b9ba414f6a6542173947e4699e1790"
      },
      "coverage": {
        "status": "complete-within-view",
        "examined": 29,
        "total": 30,
        "next_offset": null,
        "exhausted": true
      },
      "limitations": [
        "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
        "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
        "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
        "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
        "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
        "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
        "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
        "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
        "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
        "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
        "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
        "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
        "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
        "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
        "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
        "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code."
      ],
      "unknowns": [
        "378 semantic graph unknowns remain in the parent Evidence.",
        "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
        "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
        "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
        "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
        "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
        "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
        "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
        "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
        "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
        "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
        "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
        "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
        "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
        "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
        "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
        "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.",
        "semantic_graph.coverage.status is unknown"
      ]
    },
    "confidence": "derived",
    "authority": "shipped-artifact",
    "environment": null,
    "limitations": [
      "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
      "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
      "CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.",
      "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
      "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
      "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
      "JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.",
      "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
      "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
      "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
      "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
      "Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.",
      "Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.",
      "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
      "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation.",
      "Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code."
    ],
    "locations": [
      {
        "kind": "artifact-path",
        "path": "/Users/duoduo/Documents/Codex/2026-10-13/https-github-com-morluto-rea-https/work/rea-crypto-focused"
      }
    ],
    "evidence_links": [
      "ev_6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81"
    ]
  },
  "trace": {
    "evidence_id": "ev_59287b517efcb7619fc6bffadf40d3a4be7fae388c623421c57b8f5fdae9dde2",
    "subject": null,
    "provider": {
      "id": "rea-javascript-application-workflows",
      "name": "REA JavaScript application workflows",
      "version": "1"
    },
    "analysis_profile": null,
    "predicate_type": "rea.javascript-semantic-trace",
    "operation": "trace_javascript_semantics",
    "parameters": {
      "application_evidence_id": "ev_6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81",
      "query": {
        "seed": {
          "kind": "property",
          "name": "hmacMessage"
        },
        "direction": "forward-influence",
        "allowed_relations": [
          "defines",
          "reads",
          "aliases",
          "destructures",
          "argument-to-parameter",
          "calls",
          "captures",
          "supplies-request-field"
        ],
        "include_ambiguous_dynamic_edges": false,
        "expected": null
      }
    },
    "raw_result": null,
    "normalized_result": {
      "query_id": "jsrq_e4cf1a9c9224812fdd17dc914a2093c91e64db4b8ed1abe574d1aba17dd97707",
      "source_graph_id": "jsrg_34699ca838514fd512da0ac916c2c3827432fc190ffe3a9a7e20238a3f23ef34",
      "seed": {
        "kind": "property",
        "name": "hmacMessage"
      },
      "direction": "forward-influence",
      "status": "partial",
      "seed_node_ids": [],
      "evidence_contexts": [],
      "nodes": [],
      "relations": [],
      "unknowns": [],
      "expected_match_node_ids": [],
      "summary": {
        "total_seed_matches": 0,
        "traversed_nodes": 0,
        "traversed_relations": 0,
        "traversed_functions": 0,
        "traversed_modules": 0,
        "relevant_unknowns": 0
      },
      "coverage": {
        "status": "partial"
      },
      "limitations": [
        "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
        "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
        "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
        "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
        "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
        "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
        "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
        "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
        "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
        "Semantic graph reachability is a static inference and does not prove runtime execution.",
        "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
        "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation."
      ],
      "source_evidence_id": "ev_6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81",
      "evidence_links": [
        "ev_6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81"
      ]
    },
    "confidence": "inferred",
    "authority": "analyst-inference",
    "environment": null,
    "limitations": [
      "Artifact identity is unavailable for this observation.",
      "Boundary extraction covers unshadowed JSON/global coercions plus parse and validation method candidates.",
      "Child-process extraction covers asynchronous node:child_process creation, literal argv/env/stdio options, exit/error listeners, and kill signals.",
      "Configuration extraction covers process.env, process.argv, node:fs reads, and direct logical defaults.",
      "Event extraction covers EventEmitter-style literal registrations, removals, and dispatch candidates; dynamic names remain unknown.",
      "Function fingerprints are static candidates; equal digests can remain ambiguous and do not prove behavioral equivalence.",
      "Local data flow does not claim control-flow-sensitive reaching definitions or arbitrary dynamic property resolution.",
      "Promise ownership covers explicit unshadowed Promise construction, static factories, aggregation, chaining, and await syntax only.",
      "Request extraction covers fetch, WebSocket, node:http/node:https construction, direct option fields, and exact local response consumers.",
      "Resource extraction covers built-in filesystem/network acquisition and exact local close/destroy/end handles.",
      "Semantic graph reachability is a static inference and does not prove runtime execution.",
      "The semantic graph contains static syntax observations and conservative relationship candidates; it does not claim runtime execution.",
      "Timer extraction covers global or node:timers scheduling and exact local-handle cancellation."
    ],
    "locations": [],
    "evidence_links": [
      "ev_6bb3772834e04c1db9c1ee3b52889a193d32e67c39b99d25b6ff6020594bed81"
    ]
  }
}