@aikdna/kdna-cli 0.16.1 → 0.16.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-cli",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "KDNA CLI — create, validate, install, and manage domain cognition packages for AI agents.",
   "type": "commonjs",
   "bin": {

package/skills/kdna-loader/SKILL.md

@@ -215,6 +215,51 @@ KDNA does not override:
 
 ---
 
+## Safety & Governance
+
+KDNA domains influence agent judgment. The loader MUST apply safety rules before loading any domain.
+
+### Loading Priority
+
+When KDNA is loaded, the agent MUST respect this priority order:
+1. System safety policy (highest — cannot be overridden)
+2. Legal and compliance requirements
+3. User's explicit intent
+4. KDNA domain judgment
+5. Tool/skill instructions (lowest)
+
+KDNA MUST NOT override system safety policies, legal requirements, or the user's explicit refusal to apply domain judgment.
+
+### Risk-Level Checks
+
+Before loading a KDNA domain, check its risk level in `kdna.json` or `KDNA_CARD.json`:
+
+| Risk Level | Loading Behavior |
+|-----------|-----------------|
+| **R0** (Low) | Load silently |
+| **R1** (Medium) | Load silently; log |
+| **R2** (High) | Warn user before loading; require confirmation |
+| **R3** (Restricted) | Reject loading unless explicitly authorized |
+
+### Signature & Trust Checks
+
+- Yanked domains: **REJECT** loading (domain has been withdrawn for safety)
+- Deprecated domains: warn; suggest replacement if `replaced_by` is set
+- Unsigned domains: warn; load only if user confirms
+- Unknown scope domains: warn; load only if user confirms
+
+### Runtime Logging
+
+Every KDNA load MUST be logged with:
+- Domain name and version
+- Risk level
+- Signature status
+- Which axioms were triggered
+- Which misunderstandings were avoided
+- Self-check pass rate
+
+This enables audit and accountability.
+
 ## Failure handling
 
 | Situation | What to do |

package/src/agent.js

@@ -371,7 +371,12 @@ function cmdLoad(input, args = []) {
   // JSON format
   if (format === 'json') {
     process.stdout.write(JSON.stringify({ manifest, core, patterns: pat }, null, 2) + '\n');
-    recordTrace({ timestamp: new Date().toISOString(), agent: detectAgent(), domain: parsed.full, format: 'json' });
+    recordTrace({
+      timestamp: new Date().toISOString(),
+      agent: detectAgent(),
+      domain: parsed.full,
+      format: 'json',
+    });
     return;
   }
 
@@ -384,20 +389,35 @@ function cmdLoad(input, args = []) {
         process.stdout.write(fs.readFileSync(p, 'utf8'));
       }
     }
-    recordTrace({ timestamp: new Date().toISOString(), agent: detectAgent(), domain: parsed.full, format: 'raw' });
+    recordTrace({
+      timestamp: new Date().toISOString(),
+      agent: detectAgent(),
+      domain: parsed.full,
+      format: 'raw',
+    });
     return;
   }
 
   // Load profiles
   if (profile) {
     emitProfile(parsed, manifest, core, pat, profile, profileInput);
-    recordTrace({ timestamp: new Date().toISOString(), agent: detectAgent(), domain: parsed.full, format: `profile:${profile}` });
+    recordTrace({
+      timestamp: new Date().toISOString(),
+      agent: detectAgent(),
+      domain: parsed.full,
+      format: `profile:${profile}`,
+    });
     return;
   }
 
   // Default: --as=prompt — compact text optimized for system-prompt injection.
   emitCompact(parsed, manifest, core, pat);
-  recordTrace({ timestamp: new Date().toISOString(), agent: detectAgent(), domain: parsed.full, format: 'prompt' });
+  recordTrace({
+    timestamp: new Date().toISOString(),
+    agent: detectAgent(),
+    domain: parsed.full,
+    format: 'prompt',
+  });
 }
 
 // ─── Load profiles ─────────────────────────────────────────────────────
@@ -420,7 +440,8 @@ function emitProfile(parsed, manifest, core, pat, profile, input) {
         for (const a of axioms) {
           lines.push(`- ${a.one_sentence}`);
           if (a.applies_when?.length) lines.push(`  APPLIES: ${a.applies_when.join('; ')}`);
-          if (a.does_not_apply_when?.length) lines.push(`  NOT: ${a.does_not_apply_when.join('; ')}`);
+          if (a.does_not_apply_when?.length)
+            lines.push(`  NOT: ${a.does_not_apply_when.join('; ')}`);
         }
         lines.push('');
       }
@@ -434,7 +455,11 @@ function emitProfile(parsed, manifest, core, pat, profile, input) {
         const taskTokens = tokenize(input || '');
         const relevant = axioms.filter((a) => {
           if (!a.applies_when?.length) return false;
-          const combinedText = [...a.applies_when, a.one_sentence || '', a.full_statement || ''].join(' ');
+          const combinedText = [
+            ...a.applies_when,
+            a.one_sentence || '',
+            a.full_statement || '',
+          ].join(' ');
           const score = overlapScore(taskTokens, combinedText);
           return score.hits >= 1 || score.coverage >= 0.1;
         });
@@ -603,7 +628,9 @@ function cmdSelect(args = []) {
 
   if (!input) {
     if (wantJson) {
-      console.log(JSON.stringify({ error: 'Usage: kdna select --input "<task>" [--max-domains=N] [--json]' }));
+      console.log(
+        JSON.stringify({ error: 'Usage: kdna select --input "<task>" [--max-domains=N] [--json]' }),
+      );
       process.exit(2);
     }
     console.error('Usage: kdna select --input "<task>" [--max-domains=N] [--json]');
@@ -664,12 +691,18 @@ function cmdSelect(args = []) {
   const selected = scores.slice(0, maxDomains);
 
   if (wantJson) {
-    console.log(JSON.stringify({
-      input: input.slice(0, 200),
-      selected,
-      max_domains: maxDomains,
-      total_candidates: scores.length,
-    }, null, 2));
+    console.log(
+      JSON.stringify(
+        {
+          input: input.slice(0, 200),
+          selected,
+          max_domains: maxDomains,
+          total_candidates: scores.length,
+        },
+        null,
+        2,
+      ),
+    );
     return;
   }
 
@@ -775,7 +808,9 @@ function cmdPostvalidate(args = []) {
     for (const sc of selfChecks) {
       const text = typeof sc === 'string' ? sc : sc.question;
       if (text) {
-        const keywords = tokenize(text).filter((t) => t.length > 3).slice(0, 3);
+        const keywords = tokenize(text)
+          .filter((t) => t.length > 3)
+          .slice(0, 3);
         const found = keywords.some((k) => agentOutput.toLowerCase().includes(k));
         if (found) foundChecks++;
       }
@@ -794,7 +829,9 @@ function cmdPostvalidate(args = []) {
     for (const notApply of ax.does_not_apply_when || []) {
       if (overlapScore(tokenize(agentOutput), notApply).hits >= 2) {
         boundaryViolations++;
-        results.violations.push(`boundary violation: ${ax.id} (should not apply when "${notApply.slice(0, 80)}")`);
+        results.violations.push(
+          `boundary violation: ${ax.id} (should not apply when "${notApply.slice(0, 80)}")`,
+        );
         break;
       }
     }
@@ -828,14 +865,20 @@ function cmdPostvalidate(args = []) {
       agent: detectAgent(),
       domain: parsed.full,
       type: 'postvalidate',
-      postvalidate: { result: results.violations.length ? 'fail' : 'pass', violations: results.violations.length, passed: results.passed.length },
+      postvalidate: {
+        result: results.violations.length ? 'fail' : 'pass',
+        violations: results.violations.length,
+        passed: results.passed.length,
+      },
     });
     process.exit(results.violations.length ? 1 : 0);
   }
 
   console.log(`Post-validation: ${parsed.full}`);
   console.log('');
-  console.log(`  Violations: ${results.violations.length}  Warnings: ${results.warnings.length}  Passed: ${results.passed.length}`);
+  console.log(
+    `  Violations: ${results.violations.length}  Warnings: ${results.warnings.length}  Passed: ${results.passed.length}`,
+  );
   console.log('');
 
   if (results.violations.length) {
@@ -858,7 +901,11 @@ function cmdPostvalidate(args = []) {
     agent: detectAgent(),
     domain: parsed.full,
     type: 'postvalidate',
-    postvalidate: { result: results.violations.length ? 'fail' : 'pass', violations: results.violations.length, passed: results.passed.length },
+    postvalidate: {
+      result: results.violations.length ? 'fail' : 'pass',
+      violations: results.violations.length,
+      passed: results.passed.length,
+    },
   });
   process.exit(results.violations.length ? 1 : 0);
 }

package/src/cmds/doctor.js

@@ -9,7 +9,11 @@ const AGENTS = [
   { name: 'Codex', dir: path.join(process.env.HOME || '', '.codex'), skillsDir: 'skills' },
   { name: 'Claude Code', dir: path.join(process.env.HOME || '', '.claude'), skillsDir: 'skills' },
   { name: 'Cursor', dir: path.join(process.env.HOME || '', '.cursor'), skillsDir: 'skills' },
-  { name: 'Gemini Antigravity', dir: path.join(process.env.HOME || '', '.gemini', 'antigravity'), skillsDir: 'skills' },
+  {
+    name: 'Gemini Antigravity',
+    dir: path.join(process.env.HOME || '', '.gemini', 'antigravity'),
+    skillsDir: 'skills',
+  },
 ];
 
 const V2_1_MARKER = 'kdna available';
@@ -91,7 +95,11 @@ function cmdDoctor(args) {
         detail: `${domains} domain${domains !== 1 ? 's' : ''} installed`,
       });
     } else {
-      checks.push({ name: 'Domains directory', status: 'warn', detail: '~/.kdna/domains/ not found' });
+      checks.push({
+        name: 'Domains directory',
+        status: 'warn',
+        detail: '~/.kdna/domains/ not found',
+      });
     }
   }
 
@@ -100,7 +108,9 @@ function cmdDoctor(args) {
     const detected = detectAgents();
     for (const agent of AGENTS) {
       const agentDirExists = fs.existsSync(agent.dir);
-      const skill = agentDirExists ? checkAgentSkill(agent) : { installed: false, version: null, path: null };
+      const skill = agentDirExists
+        ? checkAgentSkill(agent)
+        : { installed: false, version: null, path: null };
 
       let status, detail;
       if (!agentDirExists) {
@@ -159,7 +169,11 @@ function cmdDoctor(args) {
         checks.push({ name: 'Registry cache', status: 'warn', detail: 'cannot read cache' });
       }
     } else {
-      checks.push({ name: 'Registry cache', status: 'warn', detail: 'not cached (run: kdna registry refresh)' });
+      checks.push({
+        name: 'Registry cache',
+        status: 'warn',
+        detail: 'not cached (run: kdna registry refresh)',
+      });
     }
 
     // 8. Schema files available
@@ -184,7 +198,11 @@ function cmdDoctor(args) {
     if (fs.existsSync(projectConfig)) {
       checks.push({ name: 'Project config', status: 'ok', detail: projectConfig });
     } else {
-      checks.push({ name: 'Project config', status: 'warn', detail: 'No .kdna/config.json in current project' });
+      checks.push({
+        name: 'Project config',
+        status: 'warn',
+        detail: 'No .kdna/config.json in current project',
+      });
     }
   }
 
@@ -196,7 +214,11 @@ function cmdDoctor(args) {
         name: c.name,
         status: c.status,
         detail: c.detail,
-        ...(c.agent && { agent: c.agent, skillInstalled: c.skillInstalled, skillVersion: c.skillVersion }),
+        ...(c.agent && {
+          agent: c.agent,
+          skillInstalled: c.skillInstalled,
+          skillVersion: c.skillVersion,
+        }),
       })),
       ok: checks.filter((c) => c.status === 'ok').length,
       warnings: checks.filter((c) => c.status === 'warn').length,
@@ -218,9 +240,13 @@ function cmdDoctor(args) {
     const fails = checks.filter((c) => c.status === 'fail').length;
     console.log('');
     if (fails > 0) {
-      console.log(`${ok}/${checks.length} checks passed (${fails} failure${fails !== 1 ? 's' : ''}, ${warns} warning${warns !== 1 ? 's' : ''})`);
+      console.log(
+        `${ok}/${checks.length} checks passed (${fails} failure${fails !== 1 ? 's' : ''}, ${warns} warning${warns !== 1 ? 's' : ''})`,
+      );
     } else if (warns > 0) {
-      console.log(`${ok}/${checks.length} checks passed (${warns} warning${warns !== 1 ? 's' : ''})`);
+      console.log(
+        `${ok}/${checks.length} checks passed (${warns} warning${warns !== 1 ? 's' : ''})`,
+      );
     } else {
       console.log(`${ok}/${checks.length} checks passed`);
     }

package/src/cmds/domain.js

@@ -656,6 +656,19 @@ function cmdInspect(dir, jsonMode = false) {
       },
       axioms: (c.axioms || []).map((a) => a.one_sentence || null).filter(Boolean),
     };
+
+    // Governance metadata (KDNA_CARD.json)
+    const card = readJson(path.join(abs, 'KDNA_CARD.json'));
+    if (card) {
+      result.governance = {
+        risk_level: card.risk_level || null,
+        review_status: card.review_status || null,
+        intended_use: card.intended_use || [],
+        out_of_scope: card.out_of_scope || [],
+        known_limitations: card.known_limitations || [],
+        requires_expert_review: card.requires_expert_review || false,
+      };
+    }
     console.log(JSON.stringify(result, null, 2));
     return;
   }
@@ -703,7 +716,20 @@ function cmdInspect(dir, jsonMode = false) {
 
   if (rea) console.log(`  Reasoning chains:   ${(rea.reasoning_chains || []).length}`);
 
-  if (evo) console.log(`  Evolution stages:   ${(evo.stages || []).length}`);
+  if (evo)   console.log(`  Evolution stages:   ${(evo.stages || []).length}`);
+
+  // Governance metadata
+  const kdnaCard = readJson(path.join(abs, 'KDNA_CARD.json'));
+  if (kdnaCard) {
+    console.log('');
+    console.log('  ── Governance ──');
+    console.log(`  Risk level:     ${kdnaCard.risk_level || '?'}`);
+    console.log(`  Review status:  ${kdnaCard.review_status || '?'}`);
+    if (kdnaCard.intended_use?.length) console.log(`  Intended use:   ${kdnaCard.intended_use[0]}${kdnaCard.intended_use.length > 1 ? ` (+${kdnaCard.intended_use.length - 1} more)` : ''}`);
+    if (kdnaCard.out_of_scope?.length) console.log(`  Out of scope:   ${kdnaCard.out_of_scope[0]}${kdnaCard.out_of_scope.length > 1 ? ` (+${kdnaCard.out_of_scope.length - 1} more)` : ''}`);
+    if (kdnaCard.known_limitations?.length) console.log(`  Limitations:    ${kdnaCard.known_limitations[0]}${kdnaCard.known_limitations.length > 1 ? ` (+${kdnaCard.known_limitations.length - 1} more)` : ''}`);
+    if (kdnaCard.requires_expert_review) console.log(`  ⚠ Expert review required`);
+  }
 
   console.log('');
   console.log('  ── Axioms ──');

package/src/cmds/encrypt.js

@@ -49,23 +49,32 @@ function machineFingerprint() {
       const uuid = execSync('ioreg -d2 -c IOPlatformExpertDevice | grep IOPlatformUUID', {
         encoding: 'utf8',
         timeout: 3000,
-      }).match(/"[A-F0-9-]{36}"/)?.[0]?.replace(/"/g, '');
+      })
+        .match(/"[A-F0-9-]{36}"/)?.[0]
+        ?.replace(/"/g, '');
       if (uuid) parts.push(uuid);
     }
     if (os.platform() === 'linux') {
       try {
         const mid = require('fs').readFileSync('/etc/machine-id', 'utf8').trim();
         if (mid) parts.push(mid);
-      } catch { /* ignore */ }
+      } catch {
+        /* ignore */
+      }
     }
-  } catch { /* non-critical */ }
+  } catch {
+    /* non-critical */
+  }
   return crypto.createHash('sha256').update(parts.join('|')).digest('hex');
 }
 
 // ─── Key Derivation ─────────────────────────────────────────────────────
 
 function deriveKey(licenseKey, fingerprint) {
-  const salt = crypto.createHash('sha256').update(fingerprint || machineFingerprint()).digest();
+  const salt = crypto
+    .createHash('sha256')
+    .update(fingerprint || machineFingerprint())
+    .digest();
   return crypto.pbkdf2Sync(licenseKey, salt, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha512');
 }
 
@@ -103,7 +112,7 @@ function isEncryptedContainer(filePath) {
 function createLicense(domain, options = {}) {
   const {
     issuedTo = 'licensee@example.com',
-    expiresAt = null,       // ISO date or null for perpetual
+    expiresAt = null, // ISO date or null for perpetual
     maxAgents = 1,
     requireMachineBinding = true,
     requireOnlineCheck = false,

package/src/cmds/license.js

@@ -11,9 +11,19 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { EXIT, error } = require('./_common');
-const { createLicense, signLicense, verifyLicense, verifyLicenseSignature, machineFingerprint } = require('./encrypt');
-
-const IDENTITY_DIR = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.kdna', 'identity');
+const {
+  createLicense,
+  signLicense,
+  verifyLicense,
+  verifyLicenseSignature,
+  machineFingerprint,
+} = require('./encrypt');
+
+const IDENTITY_DIR = path.join(
+  process.env.HOME || process.env.USERPROFILE || '.',
+  '.kdna',
+  'identity',
+);
 const PRIVATE_KEY_PATH = path.join(IDENTITY_DIR, 'kdna.key');
 const PUBLIC_KEY_PATH = path.join(IDENTITY_DIR, 'kdna.pub');
 
@@ -29,7 +39,11 @@ function readIdentity() {
 
 function cmdLicenseGenerate(args) {
   const domain = args[0];
-  if (!domain) error('Usage: kdna license generate <domain> --to <email> [--expires <date>] [--max-agents <n>]', EXIT.INPUT_ERROR);
+  if (!domain)
+    error(
+      'Usage: kdna license generate <domain> --to <email> [--expires <date>] [--max-agents <n>]',
+      EXIT.INPUT_ERROR,
+    );
 
   const emailIdx = args.indexOf('--to');
   const email = emailIdx >= 0 ? args[emailIdx + 1] : null;
@@ -82,7 +96,7 @@ function cmdLicenseGenerate(args) {
 
 function cmdLicenseVerify(args) {
   const jsonMode = args.includes('--json');
-  const filtered = args.filter(a => !a.startsWith('--'));
+  const filtered = args.filter((a) => !a.startsWith('--'));
   const licensePath = filtered[0];
   if (!licensePath) error('Usage: kdna license verify <license.json>', EXIT.INPUT_ERROR);
 
@@ -99,15 +113,21 @@ function cmdLicenseVerify(args) {
   const result = verifyLicense(license, publicKey, fp);
 
   if (jsonMode) {
-    console.log(JSON.stringify({
-      domain: license.domain,
-      license_id: license.license_id,
-      issued_to: license.issued_to,
-      signature_valid: signatureValid,
-      valid: result.valid,
-      issues: result.issues,
-      fingerprint: license.require_machine_binding ? fp : 'not required',
-    }, null, 2));
+    console.log(
+      JSON.stringify(
+        {
+          domain: license.domain,
+          license_id: license.license_id,
+          issued_to: license.issued_to,
+          signature_valid: signatureValid,
+          valid: result.valid,
+          issues: result.issues,
+          fingerprint: license.require_machine_binding ? fp : 'not required',
+        },
+        null,
+        2,
+      ),
+    );
   } else {
     console.log(`License: ${license.license_id}`);
     console.log(`Domain:  ${license.domain}`);
@@ -124,7 +144,7 @@ function cmdLicenseVerify(args) {
     if (result.issues.length) {
       console.log('');
       console.log('Issues:');
-      result.issues.forEach(i => console.log(`  ✗ ${i}`));
+      result.issues.forEach((i) => console.log(`  ✗ ${i}`));
     } else {
       console.log('');
       console.log('✓ License valid');
@@ -135,7 +155,7 @@ function cmdLicenseVerify(args) {
 }
 
 function cmdLicenseBind(args) {
-  const filtered = args.filter(a => !a.startsWith('--'));
+  const filtered = args.filter((a) => !a.startsWith('--'));
   const licensePath = filtered[0];
   if (!licensePath) error('Usage: kdna license bind <license.json>', EXIT.INPUT_ERROR);
 
@@ -166,7 +186,7 @@ function cmdLicenseBind(args) {
 }
 
 function cmdLicenseShow(args) {
-  const filtered = args.filter(a => !a.startsWith('--'));
+  const filtered = args.filter((a) => !a.startsWith('--'));
   const licensePath = filtered[0];
   if (!licensePath) {
     const local = path.join(process.cwd(), 'license.json');
@@ -189,7 +209,11 @@ function cmdLicenseInstall(args) {
 
   if (!license.domain) error('License missing domain field', EXIT.INPUT_ERROR);
 
-  const licenseDir = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.kdna', 'licenses');
+  const licenseDir = path.join(
+    process.env.HOME || process.env.USERPROFILE || '.',
+    '.kdna',
+    'licenses',
+  );
   fs.mkdirSync(licenseDir, { recursive: true });
 
   const safeName = license.domain.replace(/^@/, '').replace('/', '-');
@@ -204,4 +228,10 @@ function cmdLicenseInstall(args) {
   console.log(`Now install the domain: kdna install ${license.domain}`);
 }
 
-module.exports = { cmdLicenseGenerate, cmdLicenseVerify, cmdLicenseBind, cmdLicenseShow, cmdLicenseInstall };
+module.exports = {
+  cmdLicenseGenerate,
+  cmdLicenseVerify,
+  cmdLicenseBind,
+  cmdLicenseShow,
+  cmdLicenseInstall,
+};

package/src/cmds/trace.js

@@ -20,7 +20,10 @@ function todayFile() {
 
 function traceFiles(sinceDate) {
   ensureTracesDir();
-  let files = fs.readdirSync(TRACES_DIR).filter((f) => f.endsWith('.jsonl')).sort();
+  let files = fs
+    .readdirSync(TRACES_DIR)
+    .filter((f) => f.endsWith('.jsonl'))
+    .sort();
   if (sinceDate) {
     const since = sinceDate instanceof Date ? sinceDate : new Date(sinceDate);
     files = files.filter((f) => {
@@ -45,9 +48,13 @@ function readAllTraces(opts = {}) {
           if (agent && entry.agent !== agent) continue;
           if (domain && entry.domain !== domain) continue;
           entries.push(entry);
-        } catch { /* skip malformed lines */ }
+        } catch {
+          /* skip malformed lines */
+        }
       }
-    } catch { /* skip unreadable files */ }
+    } catch {
+      /* skip unreadable files */
+    }
   }
   return entries;
 }
@@ -129,14 +136,18 @@ function cmdTrace(args) {
   console.log(`${'Timestamp'.padEnd(20)} ${'Agent'.padEnd(15)} ${'Domain'.padEnd(25)} ${'Result'}`);
   console.log('-'.repeat(75));
   for (const e of entries.slice(-50).reverse()) {
-    const ts = e.timestamp ? new Date(e.timestamp).toISOString().replace('T', ' ').slice(0, 19) : 'unknown';
+    const ts = e.timestamp
+      ? new Date(e.timestamp).toISOString().replace('T', ' ').slice(0, 19)
+      : 'unknown';
     const agent = (e.agent || 'unknown').padEnd(15);
     const domain = (e.domain || '(none)').padEnd(25);
     const result = e.postvalidate?.result || 'loaded';
     console.log(`${ts} ${agent} ${domain} ${result}`);
   }
   console.log('');
-  console.log(`${entries.length} entries total. --export <file> for audit export. --clear to reset.`);
+  console.log(
+    `${entries.length} entries total. --export <file> for audit export. --clear to reset.`,
+  );
 }
 
 function cmdHistory(args) {
@@ -166,13 +177,19 @@ function cmdHistory(args) {
     }
 
     if (json) {
-      console.log(JSON.stringify({
-        total,
-        skipped,
-        domainCounts,
-        agentCounts,
-        skipRate: total > 0 ? Math.round((skipped / total) * 100) : 0,
-      }, null, 2));
+      console.log(
+        JSON.stringify(
+          {
+            total,
+            skipped,
+            domainCounts,
+            agentCounts,
+            skipRate: total > 0 ? Math.round((skipped / total) * 100) : 0,
+          },
+          null,
+          2,
+        ),
+      );
     } else {
       console.log(`Total KDNA loads: ${total}`);
       console.log(`Skipped (no domain): ${skipped}`);
@@ -208,10 +225,14 @@ function cmdHistory(args) {
     process.exit(EXIT.OK);
   }
 
-  console.log(`${'Timestamp'.padEnd(20)} ${'Agent'.padEnd(15)} ${'Domain'.padEnd(28)} ${'Result'.padEnd(10)} ${'Score'}`);
+  console.log(
+    `${'Timestamp'.padEnd(20)} ${'Agent'.padEnd(15)} ${'Domain'.padEnd(28)} ${'Result'.padEnd(10)} ${'Score'}`,
+  );
   console.log('-'.repeat(85));
   for (const e of recent) {
-    const ts = e.timestamp ? new Date(e.timestamp).toISOString().replace('T', ' ').slice(0, 19) : 'unknown';
+    const ts = e.timestamp
+      ? new Date(e.timestamp).toISOString().replace('T', ' ').slice(0, 19)
+      : 'unknown';
     const agent = (e.agent || 'unknown').padEnd(15);
     const domain = (e.domain || '(none)').padEnd(28);
     const result = (e.postvalidate?.result || 'loaded').padEnd(10);
@@ -219,7 +240,9 @@ function cmdHistory(args) {
     console.log(`${ts} ${agent} ${domain} ${result} ${score}`);
   }
   console.log('');
-  console.log(`Showing ${recent.length} of ${entries.length} total entries. --stats for summary. --domain <name> to filter.`);
+  console.log(
+    `Showing ${recent.length} of ${entries.length} total entries. --stats for summary. --domain <name> to filter.`,
+  );
 }
 
 module.exports = { cmdTrace, cmdHistory, recordTrace, readAllTraces };

package/src/compare.js

@@ -299,17 +299,21 @@ function emitMarkdownReport(parsed, manifest, core, pat, responseA, responseB, d
   const domainScore = scoreDiff(axes);
   const axioms = core.axioms || [];
   const selfChecks = pat.self_check || [];
-  const bannedTerms = (pat.terminology?.banned_terms || []).map(t => typeof t === 'string' ? t : t.term);
+  const bannedTerms = (pat.terminology?.banned_terms || []).map((t) =>
+    typeof t === 'string' ? t : t.term,
+  );
   const misunderstandings = pat.misunderstandings || [];
 
   const lines = [];
   lines.push('# KDNA Judgment Comparison Report');
   lines.push('');
   lines.push(`**Domain:** ${parsed.full} (v${manifest.version || '?'})`);
-  lines.push(`**Input:** "${(args => {
-    const i = args.indexOf('--input');
-    return i >= 0 ? args[i + 1].slice(0, 120) : '?';
-  })(process.argv.slice(2))}"`);
+  lines.push(
+    `**Input:** "${((args) => {
+      const i = args.indexOf('--input');
+      return i >= 0 ? args[i + 1].slice(0, 120) : '?';
+    })(process.argv.slice(2))}"`,
+  );
   lines.push(`**Model:** ${llm.provider} / ${llm.model}`);
   lines.push(`**Date:** ${new Date().toISOString()}`);
   lines.push('');
@@ -318,7 +322,14 @@ function emitMarkdownReport(parsed, manifest, core, pat, responseA, responseB, d
   lines.push('## Without KDNA');
   lines.push('');
   lines.push('### Judgment Path');
-  lines.push(responseA.split('\n').filter(l => l.trim()).slice(0, 3).map(l => `- ${l}`).join('\n'));
+  lines.push(
+    responseA
+      .split('\n')
+      .filter((l) => l.trim())
+      .slice(0, 3)
+      .map((l) => `- ${l}`)
+      .join('\n'),
+  );
   lines.push('');
   lines.push('### Key Deficiencies');
   lines.push('- No domain-specific diagnosis applied');
@@ -331,12 +342,21 @@ function emitMarkdownReport(parsed, manifest, core, pat, responseA, responseB, d
   lines.push(`### Domain Loaded`);
   lines.push(`- Name: ${parsed.full}`);
   lines.push(`- Axioms applied: ${axioms.length} total`);
-  lines.push(`- Frameworks: ${(core.frameworks || []).map(f => f.id).join(', ') || 'none declared'}`);
+  lines.push(
+    `- Frameworks: ${(core.frameworks || []).map((f) => f.id).join(', ') || 'none declared'}`,
+  );
   lines.push(`- Self-checks: ${selfChecks.length} items`);
   lines.push(`- Banned terms: ${bannedTerms.length}`);
   lines.push('');
   lines.push('### Judgment Path');
-  lines.push(responseB.split('\n').filter(l => l.trim()).slice(0, 3).map(l => `- ${l}`).join('\n'));
+  lines.push(
+    responseB
+      .split('\n')
+      .filter((l) => l.trim())
+      .slice(0, 3)
+      .map((l) => `- ${l}`)
+      .join('\n'),
+  );
   lines.push('');
   lines.push('---');
   lines.push('');
@@ -354,9 +374,13 @@ function emitMarkdownReport(parsed, manifest, core, pat, responseA, responseB, d
   for (const d of dims) {
     const v = axes[d.axis];
     const changed = v && v.toUpperCase() !== 'SAME';
-    lines.push(`| **${d.name}** | Generic | Domain-specific | **${changed ? 'Improved' : 'Same'}** |`);
+    lines.push(
+      `| **${d.name}** | Generic | Domain-specific | **${changed ? 'Improved' : 'Same'}** |`,
+    );
   }
-  lines.push(`| **Self-check rate** | N/A | ${selfChecks.length > 0 ? 'Domain applied' : 'N/A'} | **Improved** |`);
+  lines.push(
+    `| **Self-check rate** | N/A | ${selfChecks.length > 0 ? 'Domain applied' : 'N/A'} | **Improved** |`,
+  );
   lines.push('');
   lines.push(`**Verdict:** ${verdict.replace(/_/g, ' ')}`);
   lines.push('');
@@ -366,27 +390,47 @@ function emitMarkdownReport(parsed, manifest, core, pat, responseA, responseB, d
   lines.push('');
   lines.push(`| D# | Dimension | Score (0-10) |`);
   lines.push('|----|-----------|:-----------:|');
-  lines.push(`| D1 | Diagnostic depth | ${domainScore.changed.includes('diagnosis') ? '8' : '5'} |`);
-  lines.push(`| D2 | Terminology precision | ${domainScore.changed.includes('terminology') ? '8' : '5'} |`);
+  lines.push(
+    `| D1 | Diagnostic depth | ${domainScore.changed.includes('diagnosis') ? '8' : '5'} |`,
+  );
+  lines.push(
+    `| D2 | Terminology precision | ${domainScore.changed.includes('terminology') ? '8' : '5'} |`,
+  );
   lines.push(`| D3 | Misunderstanding detection | 5 |`);
   lines.push(`| D4 | Axiom alignment | ${domainScore.score} |`);
   lines.push(`| D5 | Self-check pass rate | ${selfChecks.length > 0 ? '100%' : 'N/A'} |`);
-  lines.push(`| D6 | Boundary respect | ${domainScore.changed.includes('boundary') ? 'Pass' : 'N/A'} |`);
+  lines.push(
+    `| D6 | Boundary respect | ${domainScore.changed.includes('boundary') ? 'Pass' : 'N/A'} |`,
+  );
   lines.push(`| D7 | Risk avoidance | ${axes.failure ? 'Pass' : 'N/A'} |`);
   lines.push('');
   lines.push('---');
   lines.push('');
   lines.push('## Summary');
   lines.push('');
-  const changedDims = domainScore.changed.map(c => `**${c}**`).join(', ');
-  lines.push(`Loading \`${parsed.full}\` changed the agent's response across ${domainScore.changed.length} dimensions: ${changedDims || 'no significant change'}. ${verdict.includes('changed') ? 'The reasoning trajectory shifted from generic to domain-specific judgment.' : 'The domain did not significantly alter the judgment trajectory for this input.'}`);
+  const changedDims = domainScore.changed.map((c) => `**${c}**`).join(', ');
+  lines.push(
+    `Loading \`${parsed.full}\` changed the agent's response across ${domainScore.changed.length} dimensions: ${changedDims || 'no significant change'}. ${verdict.includes('changed') ? 'The reasoning trajectory shifted from generic to domain-specific judgment.' : 'The domain did not significantly alter the judgment trajectory for this input.'}`,
+  );
   lines.push('');
-  lines.push('*Generated by kdna compare. Copy-pasteable as a GitHub comment, Slack message, or tweet.*');
+  lines.push(
+    '*Generated by kdna compare. Copy-pasteable as a GitHub comment, Slack message, or tweet.*',
+  );
 
   return lines.join('\n');
 }
 
-function emitJsonReport(parsed, manifest, core, pat, responseA, responseB, diffText, llm, userInput) {
+function emitJsonReport(
+  parsed,
+  manifest,
+  core,
+  pat,
+  responseA,
+  responseB,
+  diffText,
+  llm,
+  userInput,
+) {
   const { axes, verdict } = parseDiffText(diffText);
   const domainScore = scoreDiff(axes);
   const axioms = core.axioms || [];
@@ -442,7 +486,10 @@ async function cmdCompare(input, args = []) {
   const outputFile = args.includes('--output') ? args[args.indexOf('--output') + 1] : null;
   const idxInput = args.indexOf('--input');
   if (idxInput < 0 || !args[idxInput + 1]) {
-    error('Usage: kdna compare <name> --input "<text>" [--report-md|--report-json] [--output <file>]', EXIT.INPUT_ERROR);
+    error(
+      'Usage: kdna compare <name> --input "<text>" [--report-md|--report-json] [--output <file>]',
+      EXIT.INPUT_ERROR,
+    );
   }
   const userInput = args[idxInput + 1];
 
@@ -477,11 +524,13 @@ async function cmdCompare(input, args = []) {
 
   if (!jsonMode && !reportMd && !reportJson) console.log('[1/3] Running baseline (no KDNA)...');
   const responseA = await callLlm(llm, BASELINE_SYSTEM, userInput);
-  if (!jsonMode && !reportMd && !reportJson) console.log(`      ${responseA.length} chars returned`);
+  if (!jsonMode && !reportMd && !reportJson)
+    console.log(`      ${responseA.length} chars returned`);
 
   if (!jsonMode && !reportMd && !reportJson) console.log('[2/3] Running with KDNA loaded...');
   const responseB = await callLlm(llm, TREATMENT_SYSTEM, userInput);
-  if (!jsonMode && !reportMd && !reportJson) console.log(`      ${responseB.length} chars returned`);
+  if (!jsonMode && !reportMd && !reportJson)
+    console.log(`      ${responseB.length} chars returned`);
 
   if (!jsonMode && !reportMd && !reportJson) console.log('[3/3] Diffing reasoning trajectories...');
   const diffPrompt = makeDiffPrompt(userInput, responseA, responseB);
@@ -508,7 +557,17 @@ async function cmdCompare(input, args = []) {
   }
 
   if (reportJson) {
-    const report = emitJsonReport(parsed, manifest, core, pat, responseA, responseB, diff, llm, userInput);
+    const report = emitJsonReport(
+      parsed,
+      manifest,
+      core,
+      pat,
+      responseA,
+      responseB,
+      diff,
+      llm,
+      userInput,
+    );
     if (outputFile) {
       fs.writeFileSync(outputFile, JSON.stringify(report, null, 2) + '\n');
       console.log(`Report saved to ${outputFile}`);

package/src/install.js

@@ -20,7 +20,13 @@ const crypto = require('crypto');
 const { execSync, execFileSync } = require('child_process');
 const { RegistryResolver, parseName } = require('./registry');
 const { EXIT, error } = require('./cmds/_common');
-const { decrypt, deriveKey, machineFingerprint, isEncryptedContainer, ENCRYPTED_FILES } = require('./cmds/encrypt');
+const {
+  decrypt,
+  deriveKey,
+  machineFingerprint,
+  isEncryptedContainer,
+  ENCRYPTED_FILES,
+} = require('./cmds/encrypt');
 
 const USER_KDNA_DIR = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.kdna');
 const INSTALL_DIR = path.join(USER_KDNA_DIR, 'domains');
@@ -306,11 +312,16 @@ function extractAndDecrypt(kdnaPath, destDir, licenseKey) {
 
 function findLicense(domainName) {
   const licenseDir = path.join(USER_KDNA_DIR, 'licenses');
-  const licensePath = path.join(licenseDir, `${domainName.replace(/^@/, '').replace('/', '-')}.json`);
+  const licensePath = path.join(
+    licenseDir,
+    `${domainName.replace(/^@/, '').replace('/', '-')}.json`,
+  );
   if (fs.existsSync(licensePath)) {
     try {
       return JSON.parse(fs.readFileSync(licensePath, 'utf8'));
-    } catch { /* invalid license */ }
+    } catch {
+      /* invalid license */
+    }
   }
   return null;
 }
@@ -325,7 +336,11 @@ function findLicenseForDomain(domainFull) {
   for (const c of candidates) {
     const p = path.join(licenseDir, `${c}.json`);
     if (fs.existsSync(p)) {
-      try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { /* skip */ }
+      try {
+        return JSON.parse(fs.readFileSync(p, 'utf8'));
+      } catch {
+        /* skip */
+      }
     }
   }
   return null;
@@ -362,7 +377,10 @@ function verifySignature({ destDir, scope, entry, lenient = true }) {
 
   // Author pubkey fingerprint must match scope trust_pubkey
   if (manifest.author?.pubkey !== trustKey) {
-    error(`${entry.name}: author.pubkey does not match scope trust key. Refusing to install.`, EXIT.TRUST_FAILED);
+    error(
+      `${entry.name}: author.pubkey does not match scope trust key. Refusing to install.`,
+      EXIT.TRUST_FAILED,
+    );
   }
 
   // Full Ed25519 verify (requires public_key_pem embedded in the package)
@@ -414,7 +432,10 @@ function verifySignature({ destDir, scope, entry, lenient = true }) {
     const publicKey = crypto.createPublicKey(pem);
     const ok = crypto.verify(null, Buffer.from(payload), publicKey, Buffer.from(sigHex, 'hex'));
     if (!ok) {
-      error(`${entry.name}: Ed25519 signature INVALID. Package may be tampered. Refusing.`, EXIT.TRUST_FAILED);
+      error(
+        `${entry.name}: Ed25519 signature INVALID. Package may be tampered. Refusing.`,
+        EXIT.TRUST_FAILED,
+      );
     }
     console.log('  ✓ Signature OK (Ed25519 verified)');
   } catch (e) {
@@ -510,7 +531,10 @@ function installFromRegistry(parsed, yes, jsonMode = false) {
     }
   }
   if (entry.access && entry.access !== 'open') {
-    error(`${entry.name} requires "${entry.access}" access. Not installable via CLI yet.`, EXIT.POLICY_VIOLATION);
+    error(
+      `${entry.name} requires "${entry.access}" access. Not installable via CLI yet.`,
+      EXIT.POLICY_VIOLATION,
+    );
   }
 
   if (entry.type === 'cluster') {
@@ -587,13 +611,15 @@ function installSingleFromUrl({ entry, scope }, jsonMode = false) {
   fs.writeFileSync(path.join(dest, 'kdna.json'), JSON.stringify(manifest, null, 2) + '\n');
 
   if (jsonMode) {
-    console.log(JSON.stringify({
-      name: entry.name,
-      version: entry.version,
-      installed: true,
-      path: dest,
-      type: entry.type || 'domain',
-    }));
+    console.log(
+      JSON.stringify({
+        name: entry.name,
+        version: entry.version,
+        installed: true,
+        path: dest,
+        type: entry.type || 'domain',
+      }),
+    );
   } else {
     console.log(`✓ Installed ${entry.name}@${entry.version}`);
     console.log(`  Location: ${dest}`);
@@ -643,14 +669,16 @@ function installCluster(clusterEntry, resolver, _yes, jsonMode = false) {
   );
 
   if (jsonMode) {
-    console.log(JSON.stringify({
-      name: clusterEntry.name,
-      version: clusterEntry.version,
-      type: 'cluster',
-      installed: true,
-      path: clusterDest,
-      subdomains: subdomains.length,
-    }));
+    console.log(
+      JSON.stringify({
+        name: clusterEntry.name,
+        version: clusterEntry.version,
+        type: 'cluster',
+        installed: true,
+        path: clusterDest,
+        subdomains: subdomains.length,
+      }),
+    );
   } else {
     console.log('');
     console.log(`✓ Cluster ${clusterEntry.name} installed`);
@@ -677,7 +705,9 @@ function installFromLocalFile(filePath, _yes, jsonMode = false) {
       try {
         const lic = JSON.parse(fs.readFileSync(licenseFromArgs, 'utf8'));
         licenseKey = lic.license_id;
-      } catch { /* invalid license file */ }
+      } catch {
+        /* invalid license file */
+      }
     }
 
     if (!licenseKey) {
@@ -734,14 +764,16 @@ function installFromLocalFile(filePath, _yes, jsonMode = false) {
   fs.writeFileSync(path.join(dest, 'kdna.json'), JSON.stringify(destManifest, null, 2) + '\n');
 
   if (jsonMode) {
-    console.log(JSON.stringify({
-      name: declared,
-      installed: true,
-      path: dest,
-      source: 'local-file',
-      source_path: abs,
-      encrypted: isEncrypted,
-    }));
+    console.log(
+      JSON.stringify({
+        name: declared,
+        installed: true,
+        path: dest,
+        source: 'local-file',
+        source_path: abs,
+        encrypted: isEncrypted,
+      }),
+    );
   } else {
     console.log(`✓ Installed ${declared} from ${isEncrypted ? 'encrypted' : 'local'} file`);
     console.log(`  Location: ${dest}`);
@@ -770,13 +802,15 @@ function installFromLocalDir(dirPath, _yes, jsonMode = false) {
   fs.writeFileSync(path.join(dest, 'kdna.json'), JSON.stringify(destManifest, null, 2) + '\n');
 
   if (jsonMode) {
-    console.log(JSON.stringify({
-      name: declared,
-      installed: true,
-      path: dest,
-      source: 'local-dir',
-      source_path: abs,
-    }));
+    console.log(
+      JSON.stringify({
+        name: declared,
+        installed: true,
+        path: dest,
+        source: 'local-dir',
+        source_path: abs,
+      }),
+    );
   } else {
     console.log(`✓ Installed ${declared} from local directory (dev mode)`);
     console.log(`  Location: ${dest}`);