* feat(javascript)!: require the runtime parse-failure count and active Electron execution paths
The V8 Inspector projection always writes scripts.parse_failed_total and the
active Electron service always commits parameters.resolved_paths, so both are
now required. Runtime reconciliation reads the admitted execution paths only
and no longer falls back to request-spelled paths in parameters, and checks
the observed executable path against them on every capture.
JavaScriptStaticAnalysis.routes and module_runtime keep their omission, which
current producers still make (a checkpoint that cannot retain route facts; no
recovered factory runtime); their comments now say so instead of naming
historical analyses.
BREAKING CHANGE: JavaScript runtime observations without
scripts.parse_failed_total, and active Electron Evidence without
parameters.resolved_paths, are refused as malformed; recreate the observation.
* test(javascript): give the shared Node reconciliation fixture the required parse-failure count
* feat(browser)!: require browser observation facts their producers always write (#10991)
* feat(browser)!: require browser observation facts their producers always write
The source-map fetcher always writes effective_url (string or null), the web
bundle analyzer always writes schema_property_names_coverage, and the CDP
storage fingerprinter always marks IndexedDB schema fingerprints with
projection_version 2. Each is now required. The IndexedDB marker is tied to
its scope by a discriminated union and derived from the scope in the
producer, so compare_web_captures no longer carries the store-only
projection branch.
response_identity and the WebMCP consequential hint keep their omission,
which current producers still make (a body not fully read; an invalid
annotation); the guide no longer attributes it to historical captures.
BREAKING CHANGE: source-map items without effective_url, WebMCP declarations
without schema_property_names_coverage, and IndexedDB schema fingerprints
without projection_version are refused as malformed; recreate the capture.
* feat(managed)!: refuse members beside a null signature resolution (#10992)
* feat(managed)!: refuse members beside a null signature resolution
signature_resolution is null only when member decoding exceeded capacity,
and the capacity-recovery producer then examines no members. The managed
member inspection schema now enforces that: a null resolution with any
field, method, member reference, call edge or field access is malformed.
With that rule, every admitted inspection with members attests type-name
resolution, so the raw-digest fallback is unreachable and is deleted:
comparableSides, hasSignatureResolution, the comparison's
signatureResolutionExamined flag and the "does not attest" limitation. The
shared workflow example that carried resolved digests beside a null
attestation now attests resolution.
BREAKING CHANGE: managed member Evidence with a null signature_resolution
and any examined member is refused as malformed; recreate the observation.
* docs: describe historical Evidence by what the format revision now refuses (#10993)
SQLite worker_timeout_ms is required, so the SQLite guide no longer reads a
missing value as unknown settings. The IL2CPP, ESP image and process capture
guides now say that bundles exported without evidence_format are refused,
while a standalone record from an earlier release is still read with the
stated omission semantics (records carry no format marker yet). The route
inventory guide describes a parent without route_inventory by its meaning
rather than by its age.
* refactor(javascript): require static analysis coverage from the JavaScript worker (#11001)
* refactor(javascript): require static analysis coverage from the JavaScript worker
Both JavaScript static producers always write analysis_coverage: the
analyzer measures it on every parsed source and the failed-parse result
carries an unexamined coverage. The worker schema and the static analysis
type therefore require it, the preload-discovery checkpoint copies it
unconditionally, and ElectronBoundaryAnalysis reads Electron applicability
and examination limits from it alone. The fallback that re-derived Electron
use from semantic module links and retained references for analyses
without coverage is deleted, as are the graph and builder branches for a
missing coverage.
Retained Evidence graph observations are unchanged: the analysis view still
counts a stored JavaScript observation without analysis_coverage as
unmeasured, since standalone records carry no format marker yet.
The worker runs from the same build as its parent, so no external caller
sees the stricter reply schema.
* feat(browser)!: require storage fingerprint, Link context, mapping index and invalid-map identity facts (#11002)
* feat(browser)!: require storage fingerprint, Link context, mapping index and invalid-map identity facts
Each field is written by its only producer on every capture:
- The CDP storage capture always writes content_fingerprints,
fingerprint_algorithm and fingerprints_complete, so their schema defaults
are removed.
- The CDP Link header projection always writes context_url and
context_scope, so they are required.
- The source-map fetcher writes source_index and declaration_index on every
mapping row, so they are required.
- The fetcher judges a map invalid only after reading its complete body. A
separate invalidSourceMapItem builder now takes the response identity as a
required argument, and the schema's invalid member requires
response_identity; fetch_failed keeps it optional because those rows can
come from a body that was not fully read.
The browser and source-location guides no longer describe these fields as
optional for older saved captures.
BREAKING CHANGE: page inspections without the storage fingerprint fields or
Link context fields, source-map mapping rows without their indexes, and
invalid source-map items without response_identity are refused as malformed;
recreate the capture.
* test(browser): keep source-omission coverage on a still-defaulted field and refuse a missing fingerprint algorithm
* feat(browser)!: require web-bundle target origin, inspection producer facts, scenario redirect state and exclusion kind (#11014)
feat(browser)!: require web-bundle target origin, page inspection producer facts, scenario redirect state and exclusion kind
Each field is written by its only producer on every record:
- buildCaptureObservation always writes capture.target_origin (the validated
origin or null), so analyze_web_bundle Evidence and both web-bundle view
results require it; the view's conditional spread is gone.
- The CDP page capture always writes accessibility node states, script
frame_id (null when unattributed) and worker opener_target_id and
parent_frame_id, so their schema defaults are removed.
- PlaywrightScenarioNetwork writes redirected_from_transaction_state exactly
when the predecessor ID is null, so request events now require it there and
still refuse it on linked events.
- The reference-source importer writes entry_kind on every exclusion
(unknown when the kind was not observed), so it is required.
The browser scenario contract and CLI guide no longer describe older
captures or exclusions without these fields.
BREAKING CHANGE: web-bundle analyses without capture.target_origin, page
inspections without these script, accessibility or worker fields, scenario
network events with a null predecessor and no redirect state, and reference
source graphs whose exclusions lack entry_kind are refused as malformed;
recreate the capture or re-import the source.
* feat(evidence): read selected complete records without the whole bundle
get_evidence_bundle could discover a record by exact ID, but reading it
required the complete canonical bundle: complete + filters was rejected,
and inspect_analysis_view refuses parents without a view, such as
annotations, pseudocode sources and native traces.
- Add detail: records, a page (offset, limit; default 0, 8) of the
complete matching records in canonical bundle order. Records keep their
original IDs, subjects, providers and readback; missing_evidence_links
names direct links of the returned records that are not retained.
- The selection is labelled as historical and not an importable bundle;
complete keeps returning the canonical bundle, and offset/limit
require detail: records.
- Filters keep one owner shared by summary and records delivery, for the
MCP session and the CLI's inspect-evidence-bundle.
- An oversized record page now advises a smaller limit or one
evidence_id; whole-bundle overflow guidance mentions record reads.
Fixes#8307
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(evidence): compare record-selection guidance with its owners
Assert the record-selection limitations and oversized-page guidance
against their owning constants, and check the reported limit facts
separately, instead of pinning explanatory phrases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Page retained web-bundle endpoint observations and inferences through shared CLI/MCP projections, preserving source identities, scoped unknowns, coverage and complete Evidence access.
Based on HarsH’s original implementation in #7213 (6b1d5d42). Real Chromium/CLI/SDK verification and whole-task cost limits are recorded in docs/verification/web-bundle-paging-2026-10-26.md.
Explicit user authorization permits leaving human-readiness declarations unchecked and bypassing reproduced main failures (ADB listing fixture, package catalog expectation, untouched APK verifier formatting). No human-review attestation is made.
Co-authored-by: HarsH <harshasalkar7@gmail.com>
morluto