@aikdna/kdna-cli 0.17.0 → 0.19.0

package/README.md

@@ -1,14 +1,18 @@
 # @aikdna/kdna-cli
 
+> **KDNA Ecosystem:** [`kdna`](https://github.com/aikdna/kdna) — the protocol. [KDNAChat](https://github.com/AhaSparkCoach/kdnachat) — the consumption client. [KDNaStudio](https://github.com/AhaSparkCoach/kdnastudio) — the authoring tool. [KDNAWork](https://github.com/AhaSparkCoach/kdnawork) — the workbench. **You are here → kdna-cli** — the toolchain. [Registry](https://github.com/aikdna/kdna-registry) — the catalog.
+
+**Role**: kdna-cli is the **runtime control plane** — the official reference implementation for domain validation, loading, packaging, comparison, and agent-facing runtime workflows. It bridges Studio output to Chat/Work consumption.
+
 **KDNA CLI is the official open-source reference implementation for KDNA validation, loading, packaging, comparison, registry access, and agent-facing runtime workflows.**
 
 It is the runtime control plane for loading, validating, composing, testing, and governing domain judgment for AI agents.
 
 KDNA CLI 是 KDNA 验证、加载、打包、比较、注册表访问和 Agent 运行时工作流的官方开源参考实现，也是 AI Agent 加载、验证、组合、测试和治理领域判断的运行控制平面。
 
-The CLI is how a KDNA cognitive kernel becomes usable by agents. It installs KDNA domains, verifies their structure and trust metadata, loads them into agent-readable form, compares judgment paths with and without KDNA, and records traces for audit.
+The CLI is how a KDNA domain judgment package becomes usable by agents. It installs KDNA domains, verifies their structure and trust metadata, loads them into agent-readable form, compares judgment paths with and without KDNA, and records traces for audit.
 
-KDNA CLI 让一个认知内核真正被 Agent 使用。它负责安装 KDNA、验证结构与信任信息、把 KDNA 转换成 Agent 可加载的形式、对比加载前后的判断路径，并记录可审计的使用痕迹。
+KDNA CLI 让一个领域判断资产真正被 Agent 使用。它负责安装 KDNA、验证结构与信任信息、把 KDNA 转换成 Agent 可加载的形式、对比加载前后的判断路径，并记录可审计的使用痕迹。
 
 Part of the [KDNA](https://github.com/aikdna/kdna) ecosystem.
 
@@ -30,109 +34,122 @@ kdna compare @aikdna/writing --input "help me improve this post"
 kdna doctor --agents
 ```
 
-## Commands by Role
+## The 6 Commands You Actually Need
+
+| Command                               | What it does                                       |
+| ------------------------------------- | -------------------------------------------------- |
+| `kdna setup`                          | Initialize ~/.kdna, install the agent skill loader |
+| `kdna install <domain>`               | Install a domain from the registry                 |
+| `kdna list`                           | Show installed domains with quality info           |
+| `kdna verify <domain>`                | 3-layer check: structure + trust + judgment        |
+| `kdna compare <domain> --input "..."` | Compare with/without KDNA judgment                 |
+| `kdna doctor --agents`                | Check agent integration health                     |
+
+## All Commands by Role
 
 ### Domain Authoring
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna init <name>` | Beta | Scaffold a new domain from template |
-| `kdna validate <path>` | Stable | Validate domain structure |
-| `kdna validate --schema <path>` | Stable | Schema-only validation |
-| `kdna pack <path>` | Beta | Pack into .kdna container |
-| `kdna pack <path> --encrypt --license <file>` | Beta | Pack encrypted .kdnae container |
-| `kdna unpack <file>` | Beta | Unpack .kdna or .kdnae container |
-| `kdna inspect <path>` | Beta | Inspect domain or .kdna file |
-| `kdna publish <path>` | Experimental | Pack + sign + publish to registry |
-| `kdna publish --check <path>` | Experimental | Quality gate check only |
-| `kdna version bump <level> [path]` | Beta | Bump domain version |
+| Command                            | Status       | Description                                     |
+| ---------------------------------- | ------------ | ----------------------------------------------- |
+| `kdna init <name>`                 | Beta         | Scaffold a new domain from template             |
+| `kdna dev validate <path>`         | Stable       | Validate a non-canonical dev source directory   |
+| `kdna dev pack <path>`             | Beta         | Build a dev source directory into a .kdna asset |
+| `kdna dev unpack <file>`           | Beta         | Unpack .kdna into a dev source directory        |
+| `kdna dev inspect <path>`          | Beta         | Inspect a non-canonical dev source directory    |
+| `kdna dev card <path>`             | Beta         | Display KDNA Card from a dev source directory   |
+| `kdna inspect <file.kdna>`         | Beta         | Inspect a .kdna asset                           |
+| `kdna publish <path>`              | Experimental | Pack + sign + publish to registry               |
+| `kdna publish --check <path>`      | Experimental | Quality gate check only                         |
+| `kdna version bump <level> [path]` | Beta         | Bump domain version                             |
 
 ### Agent Runtime
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna available [--json]` | Beta | List installed domains with v2.1 fields |
-| `kdna match "<task>" [--json]` | Beta | Signal matching — find relevant domains |
-| `kdna load <name> [--as=prompt\|json\|raw]` | Beta | Emit domain in agent-ready format |
-| `kdna postvalidate <name> --output <file>` | Beta | Post-generation judgment check |
+| Command                                                | Status | Description                             |
+| ------------------------------------------------------ | ------ | --------------------------------------- |
+| `kdna available [--json]`                              | Beta   | List installed domains with v2.1 fields |
+| `kdna match "<task>" [--json]`                         | Beta   | Signal matching — find relevant domains |
+| `kdna load <name\|file.kdna> [--as=prompt\|json\|raw]` | Beta   | Emit asset in agent-ready format        |
+| `kdna postvalidate <name> --output <file>`             | Beta   | Post-generation judgment check          |
 
 ### Testing & Verification
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna verify <name>` | Beta | 3-layer: structure + trust + judgment |
-| `kdna compare <name> --input "..."` | Beta | With/without KDNA reasoning diff |
-| `kdna compare <name> --input "..." --report-md` | Beta | Markdown report with scoring |
-| `kdna compare <name> --input "..." --report-json` | Beta | JSON report with scoring |
-| `kdna diff <name>@<v1> <name>@<v2>` | Beta | Judgment-level diff between versions |
+| Command                                                      | Status | Description                           |
+| ------------------------------------------------------------ | ------ | ------------------------------------- |
+| `kdna verify <name\|file.kdna>`                              | Beta   | 3-layer: structure + trust + judgment |
+| `kdna compare <name\|file.kdna> --input "..."`               | Beta   | With/without KDNA reasoning diff      |
+| `kdna compare <name\|file.kdna> --input "..." --report-md`   | Beta   | Markdown report with scoring          |
+| `kdna compare <name\|file.kdna> --input "..." --report-json` | Beta   | JSON report with scoring              |
+| `kdna diff <name>@<v1> <name>@<v2>`                          | Beta   | Judgment-level diff between versions  |
 
 ### Diagnostics & Trace
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna doctor` | Beta | System health check |
-| `kdna doctor --agents` | Beta | Agent integration check (Codex/Claude/OpenCode/Cursor/Gemini) |
-| `kdna doctor --json` | Beta | Machine-readable health report |
-| `kdna trace` | Experimental | View recent load/postvalidate traces |
-| `kdna trace --json` | Experimental | Machine-readable trace output |
-| `kdna trace --export <file>` | Experimental | Export traces for audit |
-| `kdna trace --since 7d\|30d\|90d` | Experimental | Filter by time range |
-| `kdna history` | Experimental | Recent domain usage (last 20) |
-| `kdna history --stats` | Experimental | Aggregate by domain and agent |
-| `kdna history --domain <name>` | Experimental | Filter by domain |
+| Command                           | Status       | Description                                                   |
+| --------------------------------- | ------------ | ------------------------------------------------------------- |
+| `kdna doctor`                     | Beta         | System health check                                           |
+| `kdna doctor --agents`            | Beta         | Agent integration check (Codex/Claude/OpenCode/Cursor/Gemini) |
+| `kdna doctor --json`              | Beta         | Machine-readable health report                                |
+| `kdna trace`                      | Experimental | View recent load/postvalidate traces                          |
+| `kdna trace --json`               | Experimental | Machine-readable trace output                                 |
+| `kdna trace --export <file>`      | Experimental | Export traces for audit                                       |
+| `kdna trace --since 7d\|30d\|90d` | Experimental | Filter by time range                                          |
+| `kdna history`                    | Experimental | Recent domain usage (last 20)                                 |
+| `kdna history --stats`            | Experimental | Aggregate by domain and agent                                 |
+| `kdna history --domain <name>`    | Experimental | Filter by domain                                              |
 
 ### License & Authorization
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna license generate <domain> --to <email>` | Experimental | Generate signed license |
-| `kdna license install <license.json>` | Experimental | Register license for auto-decrypt |
-| `kdna license verify <license.json>` | Experimental | Verify license signature and validity |
-| `kdna license bind <license.json>` | Experimental | Bind license to this machine |
-| `kdna license show <license.json>` | Experimental | Display license details |
+| Command                                                     | Status       | Description                                                    |
+| ----------------------------------------------------------- | ------------ | -------------------------------------------------------------- |
+| `kdna license generate <domain> --to <email>`               | Experimental | Generate signed license                                        |
+| `kdna license install <license.json>`                       | Experimental | Register license for auto-decrypt                              |
+| `kdna license activate <domain> --key <key> --server <url>` | Experimental | Activate a license from entitlement source                     |
+| `kdna license sync [domain] [--server <url>]`               | Experimental | Refresh entitlement and revocation status                      |
+| `kdna license verify <license.json>`                        | Experimental | Verify license signature and validity                          |
+| `kdna license bind <license.json>`                          | Experimental | Bind license to this machine                                   |
+| `kdna license show <license.json>`                          | Experimental | Display license details                                        |
+| `kdna license status [domain] [--json]`                     | Experimental | Show installed license activation status without exposing keys |
 
 ### Cluster Composition
 
-| Command | Status | Description |
-|---------|--------|-------------|
+| Command                    | Status  | Description               |
+| -------------------------- | ------- | ------------------------- |
 | `kdna cluster lint <path>` | Planned | Validate cluster manifest |
 
 ### Registry & Distribution
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna install <name>` | Beta | Install domain from registry |
-| `kdna install ./file.kdna` | Beta | Install from local .kdna file |
-| `kdna install ./file.kdnae` | Beta | Install from encrypted .kdnae (auto-decrypt with license) |
-| `kdna remove <name>` | Beta | Uninstall a domain |
-| `kdna update <name>` | Beta | Update installed domain |
-| `kdna info <name>` | Beta | Show domain metadata and trust status |
-| `kdna list [--available]` | Beta | List installed or available domains |
-| `kdna search <keyword>` | Beta | Search registry |
-| `kdna registry refresh` | Beta | Refresh registry cache |
+| Command                   | Status | Description                           |
+| ------------------------- | ------ | ------------------------------------- |
+| `kdna install <name>`     | Beta   | Install domain from registry          |
+| `kdna install file.kdna`  | Beta   | Install from local .kdna asset        |
+| `kdna remove <name>`      | Beta   | Uninstall a domain                    |
+| `kdna update <name>`      | Beta   | Update installed domain               |
+| `kdna info <name>`        | Beta   | Show domain metadata and trust status |
+| `kdna list [--available]` | Beta   | List installed or available domains   |
+| `kdna search <keyword>`   | Beta   | Search registry                       |
+| `kdna registry refresh`   | Beta   | Refresh registry cache                |
 
 ### Identity & Signing
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna identity init` | Experimental | Generate Ed25519 signing key |
-| `kdna identity show` | Experimental | Display public key and buyer ID |
-| `kdna identity export [--out]` | Experimental | Backup private key (encrypted) |
-| `kdna identity import <file>` | Experimental | Restore identity from backup |
+| Command                        | Status       | Description                     |
+| ------------------------------ | ------------ | ------------------------------- |
+| `kdna identity init`           | Experimental | Generate Ed25519 signing key    |
+| `kdna identity show`           | Experimental | Display public key and buyer ID |
+| `kdna identity export [--out]` | Experimental | Backup private key (encrypted)  |
+| `kdna identity import <file>`  | Experimental | Restore identity from backup    |
 
 ### Setup
 
-| Command | Status | Description |
-|---------|--------|-------------|
-| `kdna setup` | Beta | One-command setup: CLI + skill + data root |
+| Command      | Status | Description                                |
+| ------------ | ------ | ------------------------------------------ |
+| `kdna setup` | Beta   | One-command setup: CLI + skill + data root |
 
 ---
 
 ## SPEC Compatibility
 
-KDNA CLI follows the canonical KDNA domain structure defined in [`aikdna/kdna`](https://github.com/aikdna/kdna).
+KDNA CLI follows the canonical KDNA asset structure defined in [`aikdna/kdna`](https://github.com/aikdna/kdna).
 
-A valid KDNA domain is a lowercase `snake_case` folder. A complete domain may include up to six files:
+A valid KDNA domain is a `.kdna` asset. The internal tree of that asset may include up to six standard KDNA judgment files:
 
 - `KDNA_Core.json`
 - `KDNA_Patterns.json`
@@ -141,18 +158,20 @@ A valid KDNA domain is a lowercase `snake_case` folder. A complete domain may in
 - `KDNA_Reasoning.json`
 - `KDNA_Evolution.json`
 
-The minimum valid domain requires:
+The minimum valid `.kdna` asset requires these internal entries:
 
 - `KDNA_Core.json`
 - `KDNA_Patterns.json`
 
-Each file must include `meta.version`, `meta.domain`, `meta.created`, `meta.purpose`, and `meta.load_condition`.
+Each KDNA judgment file must include `meta.version`, `meta.domain`, `meta.created`, `meta.purpose`, and `meta.load_condition`.
+
+Source directories are dev-only authoring workspaces. Public install, inspect, verify, load, compare, and agent-facing commands consume `.kdna` assets or installed asset names, not source directories.
 
 ---
 
 ## Default Registry
 
-By default, KDNA CLI uses the official KDNA registry. Users may override it with `KDNA_REGISTRY_URL`.
+By default, KDNA CLI uses the official KDNA registry. Registry schema v3 is asset-first: installable entries must publish `asset_url`, `asset_digest`, signature metadata, trust snapshot/timestamp metadata, and revocations. Expired, yanked, revoked, or digest-mismatched assets are rejected. Users may override the registry with `KDNA_REGISTRY_URL`.
 
 ```bash
 # Use the official registry (default)
@@ -178,33 +197,33 @@ Commercial or hosted layers may include:
 - Team collaboration in KDNA Studio
 - Licensed/private judgment asset distribution
 
-KDNA supports both open judgment assets and licensed/private judgment assets. Open domains remain the default path for community adoption, while encrypted containers and licenses support professional and enterprise distribution.
+KDNA supports both open judgment assets and licensed/private judgment assets. Open assets remain the default path for community adoption. Licensed assets still use the `.kdna` extension; protected entries are decrypted only in memory after local license activation.
 
-KDNA 同时支持开放判断资产和授权/私有判断资产。开放 domain 是社区采用的默认路径；加密容器和 license 用于专业资产与企业分发。
+KDNA 同时支持开放判断资产和授权/私有判断资产。开放资产是社区采用的默认路径；授权资产仍然使用 `.kdna` 后缀，受保护条目只会在本地 license activation 通过后以内存方式解密。
 
 ---
 
 ## Environment Variables
 
-| Variable | Purpose |
-|----------|---------|
-| `KDNA_AGENT` | Override agent name in trace logs (e.g. `claude_code`, `codex`, `opencode`) |
-| `KDNA_REGISTRY_URL` | Override canonical registry URL |
-| `KDNA_IDENTITY_DIR` | Override identity key directory |
+| Variable            | Purpose                                                                     |
+| ------------------- | --------------------------------------------------------------------------- |
+| `KDNA_AGENT`        | Override agent name in trace logs (e.g. `claude_code`, `codex`, `opencode`) |
+| `KDNA_REGISTRY_URL` | Override canonical registry URL                                             |
+| `KDNA_IDENTITY_DIR` | Override identity key directory                                             |
 
 ## Exit Codes
 
-| Code | Name | Meaning |
-|------|------|---------|
-| 0 | `OK` | Success |
-| 1 | `VALIDATION_FAILED` | Structure or schema validation failed |
-| 2 | `INPUT_ERROR` | Invalid input, missing argument, not found |
-| 3 | `TRUST_FAILED` | Signature or trust verification failed |
-| 4 | `JUDGMENT_QUALITY_FAILED` | Judgment governance fields missing or insufficient |
-| 5 | `REGISTRY_ERROR` | Registry lookup or network error |
-| 6 | `PROVIDER_ERROR` | LLM provider (API key, rate limit) error |
-| 7 | `POLICY_VIOLATION` | Publishing or governance policy violation |
-| 8 | `HUMAN_LOCK_REQUIRED` | Human lock required but not present |
+| Code | Name                      | Meaning                                            |
+| ---- | ------------------------- | -------------------------------------------------- |
+| 0    | `OK`                      | Success                                            |
+| 1    | `VALIDATION_FAILED`       | Structure or schema validation failed              |
+| 2    | `INPUT_ERROR`             | Invalid input, missing argument, not found         |
+| 3    | `TRUST_FAILED`            | Signature or trust verification failed             |
+| 4    | `JUDGMENT_QUALITY_FAILED` | Judgment governance fields missing or insufficient |
+| 5    | `REGISTRY_ERROR`          | Registry lookup or network error                   |
+| 6    | `PROVIDER_ERROR`          | LLM provider (API key, rate limit) error           |
+| 7    | `POLICY_VIOLATION`        | Publishing or governance policy violation          |
+| 8    | `HUMAN_LOCK_REQUIRED`     | Human lock required but not present                |
 
 ## JSON Output
 
@@ -221,15 +240,15 @@ kdna license verify --json <file>
 
 ## Product Matrix
 
-| Layer | Product | Responsibility |
-|-------|---------|---------------|
-| Protocol | KDNA SPEC | Define judgment asset format |
-| Core Library | @aikdna/kdna-core | load / validate / compose / render |
-| Runtime | @aikdna/kdna-cli | Agent runtime + compile + verify + test + publish + license |
-| Authoring | KDNA Studio | Human-led judgment production |
-| Consumption | KDNAChat | Load, use, compare |
-| Governance | KDNA Governance Console | Approve, release, audit |
-| Distribution | Registry | Discover, install, license, distribute |
+| Layer        | Product                 | Responsibility                                              |
+| ------------ | ----------------------- | ----------------------------------------------------------- |
+| Protocol     | KDNA SPEC               | Define judgment asset format                                |
+| Core Library | @aikdna/kdna-core       | load / validate / compose / render                          |
+| Runtime      | @aikdna/kdna-cli        | Agent runtime + compile + verify + test + publish + license |
+| Authoring    | KDNA Studio             | Human-led judgment production                               |
+| Consumption  | KDNAChat                | Load, use, compare                                          |
+| Governance   | KDNA Governance Console | Approve, release, audit                                     |
+| Distribution | Registry                | Discover, install, license, distribute                      |
 
 ## Development
 

package/SECURITY.md

@@ -31,7 +31,7 @@ We will acknowledge within 5 business days and provide a timeline for a fix.
 
 ## Out of Scope
 
-- Domain content files (KDNA_*.json) — these are user-authored judgment assets
+- Domain content files (KDNA\_\*.json) — these are user-authored judgment assets
 - Network-level attacks (man-in-the-middle on registry fetch) — use HTTPS
 - Local filesystem access — CLI runs with user privileges
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aikdna/kdna-cli",
-  "version": "0.17.0",
-  "description": "KDNA CLI — create, validate, install, and manage domain cognition packages for AI agents.",
+  "version": "0.19.0",
+  "description": "KDNA CLI — create, validate, install, and manage domain judgment packages for AI agents.",
   "type": "commonjs",
   "bin": {
     "kdna": "src/cli.js",
@@ -24,13 +24,15 @@
     "test": "node --test tests/v07-commands.test.js tests/v012-commands.test.js",
     "test:integration": "node --test tests/integration.test.js",
     "test:all": "node --test tests/*.test.js",
+    "release:preflight": "node scripts/release-preflight.js",
     "pretest": "npm install --ignore-scripts"
   },
   "keywords": [
     "kdna",
     "kdna-cli",
     "ai-agent",
-    "domain-cognition",
+    "domain-judgment",
+    "judgment-protocol",
     "cli"
   ],
   "license": "Apache-2.0",
@@ -46,7 +48,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@aikdna/kdna-core": "^0.4.0"
+    "@aikdna/kdna-core": "^0.6.0"
   },
   "optionalDependencies": {
     "ajv": "^8.17.1",

package/skills/kdna-loader/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: kdna-loader
-description: Discover and load KDNA judgment frameworks from ~/.kdna/domains/ when the task requires domain-specific judgment (review, diagnosis, critique, classification, strategy) where the same input could legitimately be interpreted multiple ways. Skip for pure formatting, factual lookup, code execution, or mechanical transformations. This skill is the entire interface to KDNA — domains themselves are not separate skills.
+description: Discover and load KDNA judgment frameworks from installed .kdna assets when the task requires domain-specific judgment (review, diagnosis, critique, classification, strategy) where the same input could legitimately be interpreted multiple ways. Skip for pure formatting, factual lookup, code execution, or mechanical transformations. This skill is the entire interface to KDNA — domains themselves are not separate skills.
 ---
 
 # KDNA Loader
@@ -17,7 +17,7 @@ this skill provides the **routing and protocol**, KDNA provides the
 **judgment material**.
 
 This skill is the **only** KDNA-related skill. Domains themselves are
-not registered as skills — they live in `~/.kdna/domains/` as data and
+not registered as skills — they live as `.kdna` assets under `~/.kdna/packages/` and
 are discovered on demand. Whether the user has 1 domain installed or
 100, this skill is the single entry point.
 
@@ -68,8 +68,8 @@ Returns a compact JSON array — one entry per installed domain — with:
 axioms), `does_not_apply_when` (flattened), `failure_risks`. Yanked
 domains are excluded automatically.
 
-This is your **only** discovery interface. Do not `ls ~/.kdna/domains/`
-or `cat` the JSON files directly — the CLI is the supported contract
+This is your **only** discovery interface. Do not inspect `~/.kdna/packages/` manually, unzip `.kdna` files,
+or `cat` internal JSON entries directly — the CLI is the supported contract
 between this skill and the KDNA file format. The on-disk layout may
 change; `kdna available` will not.
 
@@ -135,7 +135,7 @@ After evaluating, you should usually have:
   > "Two installed domains could apply here: @aikdna/writing
   > (structural diagnosis) and @yourorg/copy_polish (line-level
   > polish). Which judgment frame should I use?"
-  Do **not** silently blend.
+  > Do **not** silently blend.
 
 Never load more than one domain as primary. A secondary domain can
 constrain (e.g. `@aikdna/agent_safety` always advises on irreversible
@@ -181,8 +181,8 @@ stages.
 You have now internalized the domain's judgment surface. From this
 point on:
 
-1. **Adopt the axioms as your reasoning frame** — reason *from*
-   them, not *around* them.
+1. **Adopt the axioms as your reasoning frame** — reason _from_
+   them, not _around_ them.
 2. **Honour the boundaries** — for each axiom you'd apply, confirm
    the task is in `applies_when` AND not in `does_not_apply_when`.
 3. **Pre-check failure_risk** — before producing output, ask:
@@ -222,6 +222,7 @@ KDNA domains influence agent judgment. The loader MUST apply safety rules before
 ### Loading Priority
 
 When KDNA is loaded, the agent MUST respect this priority order:
+
 1. System safety policy (highest — cannot be overridden)
 2. Legal and compliance requirements
 3. User's explicit intent
@@ -234,12 +235,12 @@ KDNA MUST NOT override system safety policies, legal requirements, or the user's
 
 Before loading a KDNA domain, check its risk level in `kdna.json` or `KDNA_CARD.json`:
 
-| Risk Level | Loading Behavior |
-|-----------|-----------------|
-| **R0** (Low) | Load silently |
-| **R1** (Medium) | Load silently; log |
-| **R2** (High) | Warn user before loading; require confirmation |
-| **R3** (Restricted) | Reject loading unless explicitly authorized |
+| Risk Level          | Loading Behavior                               |
+| ------------------- | ---------------------------------------------- |
+| **R0** (Low)        | Load silently                                  |
+| **R1** (Medium)     | Load silently; log                             |
+| **R2** (High)       | Warn user before loading; require confirmation |
+| **R3** (Restricted) | Reject loading unless explicitly authorized    |
 
 ### Signature & Trust Checks
 
@@ -251,6 +252,7 @@ Before loading a KDNA domain, check its risk level in `kdna.json` or `KDNA_CARD.
 ### Runtime Logging
 
 Every KDNA load MUST be logged with:
+
 - Domain name and version
 - Risk level
 - Signature status
@@ -262,13 +264,13 @@ This enables audit and accountability.
 
 ## Failure handling
 
-| Situation | What to do |
-|---|---|
-| `kdna` CLI not installed | Skip KDNA. Answer normally. Mention installation only if user asks about KDNA itself. |
-| `kdna available --json` returns `[]` | No domains installed. Skip KDNA. |
-| `kdna load <name>` exits non-zero | That domain is broken (yanked, missing files, parse error). Try next candidate or skip KDNA. The error message tells you why. |
-| User explicitly asks for a domain that isn't installed | Tell them, suggest `kdna install <name>`. Do not fabricate the domain. |
-| Two domains' stances directly conflict on the task | Surface to user. Do not blend. |
+| Situation                                              | What to do                                                                                                                    |
+| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- |
+| `kdna` CLI not installed                               | Skip KDNA. Answer normally. Mention installation only if user asks about KDNA itself.                                         |
+| `kdna available --json` returns `[]`                   | No domains installed. Skip KDNA.                                                                                              |
+| `kdna load <name>` exits non-zero                      | That domain is broken (yanked, missing files, parse error). Try next candidate or skip KDNA. The error message tells you why. |
+| User explicitly asks for a domain that isn't installed | Tell them, suggest `kdna install <name>`. Do not fabricate the domain.                                                        |
+| Two domains' stances directly conflict on the task     | Surface to user. Do not blend.                                                                                                |
 
 ---
 
@@ -291,8 +293,7 @@ Otherwise, stay silent about the loading mechanics.
 
 ## What this skill is NOT
 
-- Not a list of available KDNA domains (those live in
-  `~/.kdna/domains/`, discovered on demand)
+- Not a list of available KDNA domains (those are installed `.kdna` assets, discovered on demand)
 - Not a registry browser (use `kdna list --available` CLI)
 - Not a domain creator (use `kdna init <name>` CLI)
 - Not an auto-loader that runs on every request — you decide per