docs(mcp): qualify evidence view guidance

docs/mcp-contracts.md

@@ -325,9 +325,10 @@ To discover existing records without their large payloads, call
 `get_evidence_bundle` with `detail: "summary"`. Its `result.records` contain
 Evidence IDs, artifact/provider identities, analysis-profile digests and native
 procedure metadata. Optional `filters` match exact `evidence_id`, `operation`,
-`target_sha256`, `analysis_profile_digest` or `procedure_address`. Use a discovered
-ID with `inspect_analysis_view`; neither discovery nor retained selection starts
-a provider. `retention: "complete-record"` describes stored Evidence, while
+`target_sha256`, `analysis_profile_digest` or `procedure_address`. For a supported parent operation, use a discovered ID with
+`inspect_analysis_view`; its tool description lists supported operations. For
+other records, export the complete bundle to a caller-selected path. Neither
+discovery nor retained selection starts a provider. `retention: "complete-record"` describes stored Evidence, while
 `native_dossier.value_flow` independently reports truncation, unavailable or
 unknown metadata. Missing omission counts remain null. Summary output carries
 every matching record; actual transport admission still applies. Omitted

src/contracts/native/binaryDiagnosticsToolContracts.ts

@@ -227,7 +227,7 @@ export const BINARY_DIAGNOSTICS_TOOL_CONTRACTS = [
     ...toolContractMetadata("inspect_native_exports"),
     kind: "native-provider",
     description:
-      "Inspect one explicit local PE or ELF image's export table without executing it or opening an engine: PE export-directory names, ordinals, addresses and forwarders, or ELF defined default/protected global, weak and unique .dynsym symbols with type, binding, visibility and symbol version. Visibility does not establish a runtime binding; omission in older Evidence means unrecorded. Ordinal-only, forwarded and hidden-version exports stay distinct. Portable on any supported host. Coverage is partial when table entries are unreadable and unsupported when ELF dynamic symbols cannot be enumerated from the available section metadata; an empty complete inventory means the image declares no exports. Mach-O exports use inspect_macho. Omitted/complete detail preserves inline delivery. Select detail summary to retain complete Evidence and return identity, counts and source coverage. Query inspect_analysis_view kind native-exports, collection exports or issues, with exact names/original indices, fields and matching-row pagination. Names return every version or alias; source_index is scoped to the parent Evidence. ELF name projections keep raw-byte and encoding qualifications.",
+      "Inspect one explicit local PE or ELF image's export table without executing it or opening an engine: PE export-directory names, ordinals, addresses and forwarders, or ELF defined default/protected global, weak and unique .dynsym symbols with type, binding and symbol version. Ordinal-only, forwarded and hidden-version exports stay distinct. Portable on any supported host. Coverage is partial when table entries are unreadable and unsupported when ELF dynamic symbols cannot be enumerated from the available section metadata; an empty complete inventory means the image declares no exports. Mach-O exports use inspect_macho. Omitted/complete detail preserves inline delivery. Select detail summary to retain complete Evidence and return identity, counts and source coverage. Query inspect_analysis_view kind native-exports, collection exports or issues, with exact names/original indices, fields and matching-row pagination. Names return every version or alias; source_index is scoped to the parent Evidence. ELF name projections keep raw-byte and encoding qualifications.",
     inputSchema: inspectNativeExportsRequestSchema,
     outputSchema: analysisDetailOutputSchemaOf(
       nativeExportsSchema,

src/contracts/sessionToolContracts.ts

@@ -173,7 +173,7 @@ export const SESSION_TOOL_CONTRACTS = [
   ),
   session(
     "get_evidence_bundle",
-    "Return every retained Evidence record and residual unknown as a complete canonical bundle by default. detail=summary discovers retained records without copying or transferring their payloads; optionally filter by exact Evidence ID, operation, target SHA-256, analysis-profile digest or canonical native procedure address. Metadata distinguishes complete record retention from native value-flow truncation or unavailable/unknown coverage. Use a discovered evidence_id with inspect_analysis_view without restarting a provider. Filters apply only to summary delivery.",
+    "Return every retained Evidence record and residual unknown as a complete canonical bundle by default. detail=summary discovers retained records without copying or transferring their payloads; optionally filter by exact Evidence ID, operation, target SHA-256, analysis-profile digest or canonical native procedure address. Metadata distinguishes complete record retention from native value-flow truncation or unavailable/unknown coverage. For supported parent operations, use a discovered evidence_id with inspect_analysis_view without restarting a provider; consult its description for supported operations. Export the bundle to access complete records without an analysis view. Filters apply only to summary delivery.",
     getEvidenceBundleInputSchema,
   ),
   {

src/domain/analysisView/nativeExportsView.ts

@@ -247,14 +247,6 @@ export const projectNativeExportsView = (
                 : row.name !== null && names.has(row.name))),
           projectRow,
         );
-  if (
-    report.format === "elf" &&
-    columns.has("visibility") &&
-    selected.rows.some((row) => !("visibility" in row))
-  )
-    shared.unknowns.push(
-      "ELF symbol visibility was not recorded for some selected rows; omission means unknown.",
-    );
   return ok({
     ...shared,
     kind: "native-exports" as const,

src/domain/native/nativeExports.ts

@@ -72,12 +72,6 @@ const elfExportSchema = z.strictObject({
   size: z.string().regex(/^[0-9]+$/u),
   type: z.enum(["function", "ifunc", "object", "tls", "other"]),
   binding: z.enum(["global", "weak", "unique"]),
-  visibility: z
-    .enum(["default", "protected"])
-    .exactOptional()
-    .describe(
-      "ELF symbol visibility as recorded in st_other. Omission means visibility was not recorded; it is not evidence of default visibility or a runtime binding.",
-    ),
   version: z.union([
     z.null(),
     z.literal("unknown"),

src/native/exports/NativeExportParser.ts

@@ -742,7 +742,6 @@ function* parseElfExports(
       size: symbol.size.toString(),
       type: ELF_TYPES[symbol.type] ?? "other",
       binding,
-      visibility: visibility === 0 ? "default" : "protected",
       version,
     });
   }

tests/acceptance/applications/nativeExportsViews.test.ts

@@ -4,13 +4,9 @@ import { expect } from "vitest";
 import { z } from "zod";
 import { readEvidenceBundle } from "../../../src/application/EvidenceBundleFiles.js";
 import { toolContract } from "../../../src/contracts/toolContracts.js";
-import {
-  createEvidence,
-  evidenceSchema,
-} from "../../../src/domain/evidence.js";
+import { evidenceSchema } from "../../../src/domain/evidence.js";
 import { digestCanonicalValue } from "../../../src/domain/canonicalDigest.js";
 import { analysisViewResultSchema } from "../../../src/domain/analysisView/analysisView.js";
-import { nativeExportsSchema } from "../../../src/domain/native/nativeExports.js";
 import { connectLocalToolsMcp } from "../../fixtures/localToolsMcp.js";
 import {
   elfExportImage,
@@ -22,54 +18,6 @@ import { cliTest } from "../../support/cli/cliFixture.js";
 const exportsContract = toolContract("inspect_native_exports");
 const viewContract = toolContract("inspect_analysis_view");
 
-const checkElfVisibility = async (
-  call: Awaited<ReturnType<typeof connectLocalToolsMcp>>["call"],
-  parent: z.infer<typeof evidenceSchema>,
-) => {
-  const view = {
-    kind: "native-exports",
-    collection: "exports",
-    names: ["selected"],
-    fields: ["visibility"],
-    offset: 1,
-    limit: 1,
-  };
-  const visibility = await call("inspect_analysis_view", {
-    source: { kind: "retained-evidence", evidence_id: parent.evidence_id },
-    view,
-  });
-  expect(visibility.isError).not.toBe(true);
-  expect(
-    viewContract.outputSchema.parse(visibility.structuredContent)
-      .normalized_result,
-  ).toMatchObject({
-    items: [{ source_index: 1, visibility: "protected" }],
-    unknowns: [],
-  });
-  const report = nativeExportsSchema.parse(parent.normalized_result);
-  if (report.format !== "elf") throw new Error("Expected ELF report");
-  const historical = createEvidence(undefined, parent.provider, {
-    operation: "inspect_native_exports",
-    parameters: {},
-    result: {
-      ...report,
-      exports: report.exports.map(({ visibility: _visibility, ...row }) => row),
-    },
-  });
-  const oldView = await call("inspect_analysis_view", {
-    source: { kind: "inline", evidence: historical },
-    view,
-  });
-  expect(oldView.isError).not.toBe(true);
-  const oldResult = viewContract.outputSchema.parse(
-    oldView.structuredContent,
-  ).normalized_result;
-  expect(oldResult).toHaveProperty("items", [{ source_index: 1 }]);
-  expect(oldResult).toMatchObject({
-    unknowns: [expect.stringContaining("visibility was not recorded")],
-  });
-};
-
 cliTest.for(["pe", "elf"] as const)(
   "queries retained %s exports through CLI and actual stdio MCP after the source is deleted",
   { timeout: 60_000 },
@@ -88,7 +36,7 @@ cliTest.for(["pe", "elf"] as const)(
         : elfExportImage({
             symbols: [
               { name: "selected", version: 2 },
-              { name: "selected", version: 0x8002, visibility: 3 },
+              { name: "selected", version: 0x8002 },
             ],
             versionDefinitions: ["fixture", "V1"],
           });
@@ -99,14 +47,6 @@ cliTest.for(["pe", "elf"] as const)(
     });
     expect(complete.exitCode, complete.stderr).toBe(0);
     const parent = exportsContract.outputSchema.parse(complete.json);
-    if (format === "elf") {
-      const exports = nativeExportsSchema.parse(parent.normalized_result);
-      expect(exports.format).toBe("elf");
-      expect(exports.exports).toMatchObject([
-        { visibility: "default" },
-        { visibility: "protected" },
-      ]);
-    }
     const bundle = join(root, "complete.bundle.json");
     const summarized = await run({
       arguments: [
@@ -204,7 +144,6 @@ cliTest.for(["pe", "elf"] as const)(
     ]);
     const { view_digest, ...content } = projectedView;
     expect(view_digest).toBe(digestCanonicalValue(content, "Analysis view"));
-    if (format === "elf") await checkElfVisibility(call, parent);
   },
 );