Function recordDerivedEvidence

Parameters

• session: BinarySessionPort
• evidence: {
      authority:
          | "shipped-artifact"
          | "controlled-replay"
          | "historical-reference"
          | "external-service"
          | "analyst-inference";
      confidence: "observed"
      | "derived"
      | "inferred";
      environment:
          | {
              architecture: string;
              id: string;
              isolation: "process"
              | "none"
              | "container"
              | "virtual-machine";
              platform: string;
          }
          | null;
      evidence_id: string;
      evidence_links: string[];
      limitations: string[];
      locations: (
          | { address: string; kind: "address" }
          | { end: string; kind: "address-range"; start: string }
          | { kind: "artifact-path"; path: string }
          | { kind: "file-offset"; offset: number }
          | { end: number; kind: "file-offset-range"; start: number }
      )[];
      normalized_result: JSONType;
      operation: string;
      parameters: Record<string, JSONType>;
      predicate_type: string;
      provider: { id: string; name: string; version: string | null };
      raw_result: JSONType;
      schema_version: 2;
      subject:
          | {
              architecture: "x86"
              | "x86_64"
              | "arm"
              | "arm64"
              | null;
              digest: { sha256: string };
              format:
                  | "hopper"
                  | "mach-o"
                  | "elf"
                  | "pe"
                  | "zip"
                  | "ipa"
                  | "apk"
                  | "asar"
                  | "dmg"
                  | "pkg"
                  | "plist"
                  | "javascript"
                  | "source-map"
                  | "unknown"
                  | "file"
                  | "directory"
                  | "mach-o-universal"
                  | "javascript-bundle"
                  | "entitlements";
              local_path: string;
              name: string;
          }
          | null;
  }
• unknown:
      | {
          approved: true;
          contradicting_evidence_ids: string[];
          domain: string;
          question: string;
          recommended_probes: { operation: string; rationale: string }[];
          relationships: {
              type: "depends-on" | "related-to" | "contradicts";
              unknown_id: string;
          }[];
          required_authority: | "shipped-artifact"
          | "controlled-replay"
          | "historical-reference"
          | "external-service"
          | "analyst-inference"
          | null;
          required_confidence: "observed"
          | "derived"
          | "inferred";
          required_environment:
              | {
                  architecture: string
                  | null;
                  id: string | null;
                  isolation: "process" | "none" | "container" | "virtual-machine" | null;
                  platform: string | null;
              }
              | null;
          severity: "low"
          | "medium"
          | "high"
          | "critical";
          supporting_evidence_ids: string[];
      }
      | undefined