perf(native): record macOS command provenance once in its Evidence (#1430)

inspect_macho, inspect_signature, inspect_plist, list_architectures and
demangle_swift already return their command provenance inside the
normalized result. The provider also copied the same array into
raw_result, so every response carried it twice. raw_result now stays
null, as docs/mcp-contracts.md describes for results without a distinct
provider representation.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

src/native/NativeMacOSProvider.ts

@@ -233,7 +233,6 @@ class NativeMacOSClient implements AnalysisClient {
       return observation.ok
         ? ok(
             createAnalysisExecution(observation.value.result, IDENTITY, {
-              rawResult: { provenance: observation.value.provenance },
               limitations: observation.value.limitations,
               locations: observation.value.locations,
             }),
@@ -317,7 +316,6 @@ class NativeMacOSClient implements AnalysisClient {
     });
     return ok({
       result: jsonValueSchema.parse(result),
-      provenance,
       limitations: [],
       locations: architectureLocations(result.architectures.items),
     });
@@ -351,7 +349,6 @@ class NativeMacOSClient implements AnalysisClient {
     });
     return ok({
       result: jsonValueSchema.parse(result),
-      provenance,
       limitations: [],
       locations: [],
     });
@@ -448,7 +445,6 @@ class NativeMacOSClient implements AnalysisClient {
     });
     return ok({
       result: jsonValueSchema.parse(result),
-      provenance,
       limitations: result.limitations,
       locations: [],
     });
@@ -611,7 +607,6 @@ class NativeMacOSClient implements AnalysisClient {
     });
     return ok({
       result: jsonValueSchema.parse(result),
-      provenance,
       limitations: parsed.value.limitations,
       locations: [{ kind: "artifact-path", path: plist.value }],
     });
@@ -659,7 +654,6 @@ class NativeMacOSClient implements AnalysisClient {
 
 interface NativeObservation {
   readonly result: JsonValue;
-  readonly provenance: readonly NativeCommandInvocation[];
   readonly limitations: readonly string[];
   readonly locations: readonly EvidenceLocation[];
 }

src/native/NativeMachoInspection.ts

@@ -15,7 +15,6 @@ import { parseOtoolLoadCommands } from "./parsers/otool.js";
 
 interface NativeMachoObservation {
   readonly result: JsonValue;
-  readonly provenance: readonly NativeCommandInvocation[];
   readonly limitations: readonly string[];
   readonly locations: readonly EvidenceLocation[];
 }
@@ -116,7 +115,6 @@ export const inspectNativeMacho = async (
       : normalized;
   return ok({
     result: jsonValueSchema.parse(result),
-    provenance: result.provenance,
     limitations: result.limitations,
     locations: fileOffsetLocations(result, segmentOffset),
   });

tests/boundary/providers/native/nativeProvider.test.ts

@@ -552,6 +552,43 @@ describe("native macOS provider inspection", () => {
   });
 });
 
+describe("native macOS provider raw results", () => {
+  it("records command provenance once, in the normalized result", async () => {
+    directory = await createTestTempDirectory("rea-native-");
+    const app = join(directory, "Fixture.app");
+    const executable = join(app, "Contents/MacOS/Fixture");
+    await mkdir(join(app, "Contents/MacOS"), { recursive: true });
+    await writeFile(executable, "fixture");
+    await writeFile(join(app, "Contents/Info.plist"), "fixture");
+    const client = new NativeMacOSProvider(
+      {},
+      new FixtureRunner(),
+      "darwin",
+    ).createClient(await nativeMachoTargetForFile(executable, app));
+    const requests: readonly (readonly [
+      Parameters<typeof client.execute>[0],
+      Parameters<typeof client.execute>[1],
+    ])[] = [
+      ["inspect_macho", {}],
+      ["list_architectures", {}],
+      ["inspect_signature", {}],
+      ["inspect_plist", {}],
+      ["demangle_swift", { symbols: ["$s4Test3fooyyF", "plain_symbol"] }],
+    ];
+
+    for (const [operation, parameters] of requests) {
+      const execution = await client.execute(operation, parameters);
+      if (!execution.ok) throw execution.error;
+      expect(execution.value.rawResult, operation).toBeNull();
+      expect(execution.value.result, operation).toMatchObject({
+        provenance: expect.arrayContaining([
+          expect.objectContaining({ tool: expect.any(String) }),
+        ]),
+      });
+    }
+  });
+});
+
 describe("native plist defaults for iOS-style bundles", () => {
   it("defaults to the Info.plist the bundle program was resolved from", async () => {
     directory = await createTestTempDirectory("rea-native-flat-");