@aikdna/kdna-studio-cli 0.1.3 → 0.2.0

package/bin/kdna-studio.js

@@ -11,6 +11,7 @@ const {
   evidence: evidenceApi,
   compile: compileApi,
   quality,
+  creator: creatorApi,
 } = require('@aikdna/kdna-studio-core');
 
 const EXIT = { OK: 0, INPUT_ERROR: 2, HUMAN_LOCK_REQUIRED: 4, TRUST_FAILED: 5 };
@@ -18,12 +19,20 @@ const EXIT = { OK: 0, INPUT_ERROR: 2, HUMAN_LOCK_REQUIRED: 4, TRUST_FAILED: 5 };
 function usage() {
   console.log(`kdna-studio — Studio-compatible KDNA authoring CLI
 
-Usage:
-  kdna-studio create <project-dir> [--name <@scope/name|name>]
+Identity:
+  kdna-studio identity init [--name <display-name>]
+  kdna-studio identity show
+
+Create (three entry paths):
+  kdna-studio create <project-dir> --name <@scope/name>                       # blank
+  kdna-studio create <project-dir> --from-kdna <file.kdna> --name <@scope/name>
+  kdna-studio create <project-dir> --from-folder <source-dir> --name <@scope/name>
+
+Authoring:
   kdna-studio import <project> <source-file>
   kdna-studio card list <project>
   kdna-studio card add <project> <type> --field key=value [--field key=value]
-  kdna-studio card approve <project> <card-id> --by <id> --statement <text>
+  kdna-studio card approve <project> <card-id> --by <id> --statement <text> [--sign]
   kdna-studio lock <project>
   kdna-studio compile <project> --out <dir>
   kdna-studio export <project> --out <file.kdna> [--sign]
@@ -110,18 +119,267 @@ function parseFields(args) {
 
 function cmdCreate(args) {
   const dir = args[0];
-  if (!dir) fail('Usage: kdna-studio create <project-dir> [--name <name>]');
+  if (!dir) fail('Usage: kdna-studio create <project-dir> --name <name> [--from-kdna <file> | --from-folder <dir>]');
   const abs = path.resolve(dir);
   if (fs.existsSync(abs)) fail(`Directory already exists: ${abs}`);
+
   const name = option(args, '--name', path.basename(abs));
+  const fromKdna = option(args, '--from-kdna');
+  const fromFolder = option(args, '--from-folder');
+
+  let sourceMode = 'blank';
+  let lineage = null;
+  let creatorIdentity = null;
+
+  // Load creator identity if available
+  try { creatorIdentity = creatorApi.loadIdentity(); } catch { /* no identity yet */ }
+
+  if (fromKdna) {
+    sourceMode = 'kdna_asset';
+    const kdnaData = importFromKdna(fromKdna);
+    lineage = kdnaData.lineage;
+    if (kdnaData.cards) {
+      const project = projectApi.createProject(name, 'domain', {
+        author: { name: option(args, '--author-name', ''), id: option(args, '--author-id', '') },
+        sourceMode,
+        creatorIdentity,
+        lineage,
+      });
+      project.cards = kdnaData.cards;
+      if (project.stages?.judgment_cards) {
+        project.stages.judgment_cards.total = kdnaData.cards.length;
+        project.stages.judgment_cards.status = 'in_progress';
+      }
+      fs.mkdirSync(abs, { recursive: true });
+      writeProject(path.join(abs, 'studio.project.json'), project);
+      console.log(`Created Studio project (source_mode: ${sourceMode}, imported: ${kdnaData.cards.length} cards): ${abs}`);
+      return;
+    }
+  } else if (fromFolder) {
+    sourceMode = 'source_folder';
+    importFromFolder(fromFolder, abs, name);
+    return;
+  }
+
   const project = projectApi.createProject(name, 'domain', {
     author: { name: option(args, '--author-name', ''), id: option(args, '--author-id', '') },
+    sourceMode,
+    creatorIdentity,
+    lineage,
+    sourcePath: fromFolder ? path.resolve(fromFolder) : null,
   });
+
+  if (fromKdna || fromFolder) {
+    fs.mkdirSync(abs, { recursive: true });
+    writeProject(path.join(abs, 'studio.project.json'), project);
+    if (fromFolder) {
+      // Cards were already added by importFromFolder
+    }
+    console.log(`Created Studio project (source_mode: ${sourceMode}): ${abs}`);
+    return;
+  }
+
   fs.mkdirSync(abs, { recursive: true });
   writeProject(path.join(abs, 'studio.project.json'), project);
   console.log(`Created Studio project: ${abs}`);
 }
 
+/**
+ * Import cards from an existing .kdna asset into a new Studio project.
+ * Cards are imported as draft — they do NOT inherit trust from the source.
+ */
+function importFromKdna(kdnaPath) {
+  const absKdna = path.resolve(kdnaPath);
+  if (!fs.existsSync(absKdna)) fail(`KDNA asset not found: ${absKdna}`);
+  if (!absKdna.endsWith('.kdna')) fail('--from-kdna requires a .kdna file');
+
+  const zipBuf = fs.readFileSync(absKdna);
+  const entries = readZipEntries(zipBuf);
+  if (!entries.has('kdna.json')) fail('Not a valid .kdna asset: missing kdna.json');
+
+  const manifest = JSON.parse(entries.get('kdna.json').toString());
+  const lineage = {
+    type: 'fork',
+    parent_name: manifest.name || null,
+    parent_asset_uid: manifest.asset_uid || null,
+    parent_version: manifest.version || null,
+    parent_asset_digest: manifest.content_digest || null,
+  };
+
+  // Extract cards from KDNA files
+  const importedCards = [];
+  if (entries.has('KDNA_Core.json')) {
+    const core = JSON.parse(entries.get('KDNA_Core.json').toString());
+    for (const ax of (core.axioms || [])) {
+      const fields = {};
+      for (const k of ['one_sentence','full_statement','why','applies_when','does_not_apply_when','failure_risk']) {
+        if (k in ax) fields[k] = ax[k];
+      }
+      importedCards.push(cardApi.createCard('axiom', fields));
+    }
+    for (const ont of (core.ontology || [])) {
+      importedCards.push(cardApi.createCard('ontology', {
+        one_sentence: ont.one_sentence || ont.essence || '',
+        essence: ont.essence || '', boundary: ont.boundary || '',
+        trigger_signal: ont.trigger_signal || '',
+      }));
+    }
+    for (const b of (core.boundaries || [])) {
+      importedCards.push(cardApi.createCard('boundary', {
+        scope: b.scope || '', out_of_scope: b.out_of_scope || '',
+        acceptable_exceptions: b.acceptable_exceptions || [],
+      }));
+    }
+  }
+  if (entries.has('KDNA_Patterns.json')) {
+    const pat = JSON.parse(entries.get('KDNA_Patterns.json').toString());
+    for (const ms of (pat.misunderstandings || [])) {
+      importedCards.push(cardApi.createCard('misunderstanding', {
+        wrong: ms.wrong || '', correct: ms.correct || '',
+        key_distinction: ms.key_distinction || '', why: ms.why || '',
+      }));
+    }
+    for (const sc of (pat.self_check || [])) {
+      const q = typeof sc === 'string' ? sc : sc.question || '';
+      importedCards.push(cardApi.createCard('self_check', { question: q }));
+    }
+  }
+
+  return { lineage, cards: importedCards };
+}
+
+/**
+ * Import cards from a legacy source folder into a new Studio project.
+ * Reads KDNA_*.json files and converts entries to draft judgment cards.
+ * Outputs a schema audit report.
+ */
+function importFromFolder(sourceDir, projectDir, projectName) {
+  const absSource = path.resolve(sourceDir);
+  if (!fs.existsSync(absSource)) fail(`Source folder not found: ${absSource}`);
+  if (!fs.statSync(absSource).isDirectory()) fail('--from-folder requires a directory');
+
+  const audit = { filesFound: [], cardsImported: 0, missingFields: [], schemaWarnings: [] };
+  const importedCards = [];
+
+  function loadJson(filename) {
+    const p = path.join(absSource, filename);
+    if (!fs.existsSync(p)) return null;
+    audit.filesFound.push(filename);
+    try { return JSON.parse(fs.readFileSync(p, 'utf8')); }
+    catch { audit.schemaWarnings.push(`${filename}: invalid JSON`); return null; }
+  }
+
+  const core = loadJson('KDNA_Core.json');
+  const patterns = loadJson('KDNA_Patterns.json');
+  const scenarios = loadJson('KDNA_Scenarios.json');
+  const cases = loadJson('KDNA_Cases.json');
+  const reasoning = loadJson('KDNA_Reasoning.json');
+  const evolution = loadJson('KDNA_Evolution.json');
+
+  if (core) {
+    for (const ax of (core.axioms || [])) {
+      const fields = {};
+      for (const key of ['one_sentence', 'full_statement', 'why', 'applies_when', 'does_not_apply_when', 'failure_risk']) {
+        if (key in ax) fields[key] = ax[key];
+        else audit.missingFields.push(`axiom.${ax.id || '?'}.${key}`);
+      }
+      importedCards.push(cardApi.createCard('axiom', fields));
+    }
+    for (const ont of (core.ontology || [])) {
+      importedCards.push(cardApi.createCard('ontology', {
+        one_sentence: ont.one_sentence || ont.essence || '',
+        essence: ont.essence || '', boundary: ont.boundary || '',
+        trigger_signal: ont.trigger_signal || '',
+      }));
+    }
+    for (const b of (core.boundaries || [])) {
+      importedCards.push(cardApi.createCard('boundary', {
+        scope: b.scope || '', out_of_scope: b.out_of_scope || '',
+        acceptable_exceptions: b.acceptable_exceptions || [],
+      }));
+    }
+    for (const r of (core.risks || core.risk_model || [])) {
+      importedCards.push(cardApi.createCard('risk', r.fields || r));
+    }
+  }
+
+  if (patterns) {
+    for (const ms of (patterns.misunderstandings || [])) {
+      importedCards.push(cardApi.createCard('misunderstanding', {
+        wrong: ms.wrong || '', correct: ms.correct || '',
+        key_distinction: ms.key_distinction || '', why: ms.why || '',
+      }));
+    }
+    for (const sc of (patterns.self_check || [])) {
+      const q = typeof sc === 'string' ? sc : sc.question || '';
+      importedCards.push(cardApi.createCard('self_check', { question: q }));
+    }
+  }
+
+  audit.cardsImported = importedCards.length;
+
+  const project = projectApi.createProject(projectName, 'domain', {
+    sourceMode: 'source_folder',
+    sourcePath: absSource,
+    creatorIdentity: null,
+    lineage: { type: 'migrated', parent_name: null, parent_asset_uid: null, parent_version: null, parent_asset_digest: null },
+  });
+  project.cards = importedCards;
+  if (project.stages?.judgment_cards) {
+    project.stages.judgment_cards.total = importedCards.length;
+    project.stages.judgment_cards.status = 'in_progress';
+  }
+
+  fs.mkdirSync(projectDir, { recursive: true });
+  writeProject(path.join(projectDir, 'studio.project.json'), project);
+  console.log(JSON.stringify({ audit, imported: importedCards.length, source_mode: 'source_folder' }, null, 2));
+}
+
+/**
+ * Minimal ZIP central directory parser — reads entries into a Map.
+ */
+function readZipEntries(buf) {
+  const entries = new Map();
+  // Find end-of-central-directory record
+  let eocdOffset = buf.length - 22;
+  while (eocdOffset >= 0) {
+    if (buf.readUInt32LE(eocdOffset) === 0x06054b50) break;
+    eocdOffset--;
+  }
+  if (eocdOffset < 0) throw new Error('Not a valid ZIP file');
+
+  const centralDirOffset = buf.readUInt32LE(eocdOffset + 16);
+  let offset = centralDirOffset;
+
+  while (offset < eocdOffset) {
+    const sig = buf.readUInt32LE(offset);
+    if (sig !== 0x02014b50) break;
+    const nameLen = buf.readUInt16LE(offset + 28);
+    const extraLen = buf.readUInt16LE(offset + 30);
+    const commentLen = buf.readUInt16LE(offset + 32);
+    const compMethod = buf.readUInt16LE(offset + 10);
+    const compSize = buf.readUInt32LE(offset + 20);
+    const uncompSize = buf.readUInt32LE(offset + 24);
+    const localOffset = buf.readUInt32LE(offset + 42);
+    const name = buf.toString('utf8', offset + 46, offset + 46 + nameLen);
+
+    // Read local file header to get data
+    const localNameLen = buf.readUInt16LE(localOffset + 26);
+    const localExtraLen = buf.readUInt16LE(localOffset + 28);
+    const dataStart = localOffset + 30 + localNameLen + localExtraLen;
+
+    if (compMethod === 0) {
+      entries.set(name, buf.subarray(dataStart, dataStart + uncompSize));
+    } else if (compMethod === 8) {
+      entries.set(name, zlib.inflateRawSync(buf.subarray(dataStart, dataStart + compSize)));
+    }
+
+    offset += 46 + nameLen + extraLen + commentLen;
+  }
+
+  return entries;
+}
+
 function cmdImport(args) {
   const [projectInput, source] = args;
   if (!projectInput || !source) fail('Usage: kdna-studio import <project> <source-file>');
@@ -163,7 +421,7 @@ function cmdCard(args) {
     const projectInput = args[1];
     const cardId = args[2];
     if (!projectInput || !cardId) {
-      fail('Usage: kdna-studio card approve <project> <card-id> --by <id> --statement <text>');
+      fail('Usage: kdna-studio card approve <project> <card-id> --by <id> --statement <text> [--sign]');
     }
     const by = option(args, '--by');
     const statement = option(args, '--statement');
@@ -173,17 +431,35 @@ function cmdCard(args) {
     if (idx < 0) fail(`Card not found: ${cardId}`);
     let card = project.cards[idx];
     if (card.status === 'draft') card = cardApi.transitionCard(card, 'revised', { by });
-    project.cards[idx] = cardApi.lockCard(card, {
+
+    const lockPayload = {
       by,
       statement,
       checked: { applies_when: true, does_not_apply_when: true, failure_risk: true },
-    });
+    };
+
+    // Sign Human Lock with creator identity if --sign is passed
+    if (args.includes('--sign')) {
+      const identity = creatorApi.loadIdentity();
+      if (!identity) fail('No creator identity. Run: kdna-studio identity init --name "Your Name"', EXIT.TRUST_FAILED);
+      lockPayload.creator_id = identity.creator_id;
+      try {
+        lockPayload.signature = creatorApi.signHumanLock(
+          cardId, statement, cardApi.cardJudgmentFingerprint(card),
+        );
+      } catch (e) {
+        fail(`Failed to sign Human Lock: ${e.message}`, EXIT.TRUST_FAILED);
+      }
+    }
+
+    project.cards[idx] = cardApi.lockCard(card, lockPayload);
     if (project.stages?.judgment_cards) {
       project.stages.judgment_cards.locked = project.cards.filter((c) => c.locked).length;
       project.stages.judgment_cards.total = project.cards.length;
     }
     writeProject(projectPath, project);
-    console.log(`Approved and Human Locked: ${cardId}`);
+    const signed = lockPayload.signature ? ' (signed)' : '';
+    console.log(`Approved and Human Locked: ${cardId}${signed}`);
     return;
   }
   fail('Usage: kdna-studio card <list|add|approve> ...');
@@ -320,6 +596,7 @@ function manifestForSigning(manifest) {
   delete copy.signature;
   delete copy.asset_digest;
   delete copy.container_sha256;
+  delete copy.content_digest;
   return copy;
 }
 
@@ -372,21 +649,48 @@ function cmdExport(args) {
   const files = { ...result.files };
   files['README.md'] = compileApi.generateReadme(project);
   files.LICENSE = project.license?.type || 'UNSPECIFIED';
+  files.mimetype = 'application/vnd.aikdna.kdna+zip';
+
+  // Recompute content_digest after README.md / LICENSE / mimetype are added
+  // so that manifest, receipt, and provenance report all agree with the final ZIP contents.
+  const finalDigest = compileApi.computeContentDigest(files);
+  result.identity.content_digest = finalDigest;
+
+  // Update kdna.json manifest with final digest
+  const manifest = JSON.parse(files['kdna.json']);
+  manifest.content_digest = finalDigest;
+  if (manifest.authoring) manifest.authoring.content_digest = finalDigest;
+  files['kdna.json'] = JSON.stringify(manifest, null, 2);
+
+  // Update build-receipt.json
+  let receiptData = JSON.parse(files['build-receipt.json']);
+  receiptData.content_digest = finalDigest;
+  files['build-receipt.json'] = JSON.stringify(receiptData, null, 2);
+
+  // Update provenance report
+  const provenance = JSON.parse(files['reports/provenance-report.json']);
+  provenance.content_digest = finalDigest;
+  provenance.content_fingerprint = finalDigest;
+  files['reports/provenance-report.json'] = JSON.stringify(provenance, null, 2);
+
   if (args.includes('--sign')) applySignature(files);
 
-  const entries = [['mimetype', 'application/vnd.aikdna.kdna+zip']];
-  for (const name of Object.keys(files).sort()) entries.push([name, files[name]]);
+  const entries = [['mimetype', files.mimetype]];
+  for (const name of Object.keys(files).filter(k => k !== 'mimetype').sort()) {
+    entries.push([name, files[name]]);
+  }
   const zip = buildZip(entries);
   const outPath = path.resolve(out);
   fs.mkdirSync(path.dirname(outPath), { recursive: true });
   fs.writeFileSync(outPath, zip);
 
   const assetDigest = `sha256:${crypto.createHash('sha256').update(zip).digest('hex')}`;
-  const receipt = JSON.parse(files['build-receipt.json']);
-  receipt.asset_path = outPath;
-  receipt.asset_digest = assetDigest;
-  receipt.signature_status = args.includes('--sign') ? 'signed' : 'unsigned';
-  fs.writeFileSync(path.join(path.dirname(outPath), 'build-receipt.json'), JSON.stringify(receipt, null, 2));
+  receiptData = JSON.parse(files['build-receipt.json']);
+  receiptData.asset_path = outPath;
+  receiptData.asset_digest = assetDigest;
+  receiptData.signature_status = args.includes('--sign') ? 'signed' : 'unsigned';
+  fs.writeFileSync(path.join(path.dirname(outPath), 'build-receipt.json'), JSON.stringify(receiptData, null, 2));
+  fs.writeFileSync(path.join(path.dirname(outPath), 'kdna.json'), files['kdna.json']);
   fs.writeFileSync(path.join(path.dirname(outPath), 'provenance-report.json'), files['reports/provenance-report.json']);
   fs.writeFileSync(path.join(path.dirname(outPath), 'quality-gate-report.json'), files['reports/quality-gate-report.json']);
   fs.writeFileSync(path.join(path.dirname(outPath), 'human-lock-report.json'), files['reports/human-lock-report.json']);
@@ -396,6 +700,37 @@ function cmdExport(args) {
   console.log(`Build ID: ${result.identity.build_id}`);
 }
 
+function cmdIdentity(args) {
+  const sub = args[0];
+  if (sub === 'init') {
+    const name = option(args, '--name', process.env.USER || process.env.USERNAME || '');
+    try {
+      const identity = creatorApi.initIdentity(name);
+      console.log(`Creator identity initialized:`);
+      console.log(`  creator_id: ${identity.creator_id}`);
+      console.log(`  display_name: ${identity.display_name}`);
+      console.log(`  identity_dir: ${identity.identity_dir}`);
+      console.log(`  public_key saved: ${identity.public_key_path}`);
+      console.log(`\nBack up your private key at: ${creatorApi.privateKeyPath()}`);
+    } catch (err) {
+      fail(`Identity already exists. Use 'kdna-studio identity show' to view. ${err.message}`);
+    }
+    return;
+  }
+  if (sub === 'show') {
+    const identity = creatorApi.loadIdentity();
+    if (!identity) fail('No identity found. Run: kdna-studio identity init --name "Your Name"');
+    console.log(JSON.stringify({
+      creator_id: identity.creator_id,
+      display_name: identity.display_name,
+      verified: identity.verified || false,
+      created_at: identity.created_at,
+    }, null, 2));
+    return;
+  }
+  fail('Usage: kdna-studio identity <init|show>');
+}
+
 function cmdReport(args) {
   const { project } = readProject(args[0]);
   const readiness = quality.computeReadiness(project);
@@ -418,6 +753,7 @@ try {
   else if (cmd === 'lock') cmdLock(args.slice(1));
   else if (cmd === 'compile') cmdCompile(args.slice(1));
   else if (cmd === 'export') cmdExport(args.slice(1));
+  else if (cmd === 'identity') cmdIdentity(args.slice(1));
   else if (cmd === 'report') cmdReport(args.slice(1));
   else {
     usage();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-studio-cli",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Official KDNA Studio command-line authoring entry for creating, locking, compiling, and exporting trusted .kdna assets.",
   "type": "commonjs",
   "bin": {
@@ -37,6 +37,6 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@aikdna/kdna-studio-core": "^1.3.3"
+    "@aikdna/kdna-studio-core": "^1.4.0"
   }
 }

package/tests/cli.test.js

@@ -14,6 +14,7 @@ function run(args, options = {}) {
     env: {
       ...process.env,
       KDNA_IDENTITY_DIR: path.join(options.tmp || os.tmpdir(), 'no-identity'),
+      ...(options.env || {}),
     },
     encoding: 'utf8',
   });
@@ -43,6 +44,10 @@ function createLockedProject(t) {
     '--field',
     'one_sentence=Prefer specific evidence over broad claims',
     '--field',
+    'full_statement=When evaluating a claim the agent must weigh the specificity of the supporting evidence. A narrow claim backed by concrete data should be preferred over a broad claim supported only by general principles.',
+    '--field',
+    'why=Without this axiom the agent may accept broad plausible-sounding claims as equally credible as narrow evidence-backed ones leading to false balance.',
+    '--field',
     'applies_when=["reviewing content"]',
     '--field',
     'does_not_apply_when=["pure formatting"]',
@@ -146,6 +151,11 @@ test('runs the trusted authoring workflow through compile and export', (t) => {
   assert.equal(manifest.authoring.human_confirmed, true);
   assert.ok(manifest.authoring.human_lock_count >= 1);
 
+  // Content digest must be present and non-trivial
+  assert.ok(manifest.content_digest, 'manifest must have content_digest');
+  assert.match(manifest.content_digest, /^sha256:[0-9a-f]{64}$/);
+  assert.ok(manifest.authoring.content_digest, 'authoring must have content_digest');
+
   const outFile = path.join(tmp, 'dist', 'example.kdna');
   result = run(['export', projectDir, '--out', outFile], { tmp });
   assert.equal(result.status, 0, result.stderr);
@@ -155,6 +165,19 @@ test('runs the trusted authoring workflow through compile and export', (t) => {
   const receipt = JSON.parse(fs.readFileSync(path.join(tmp, 'dist', 'build-receipt.json'), 'utf8'));
   assert.equal(receipt.signature_status, 'unsigned');
   assert.match(receipt.asset_digest, /^sha256:/);
+
+  // ── Digest chain consistency ──────────────────────────────────
+  // All three sources MUST agree on content_digest.
+  const exportedManifest = JSON.parse(fs.readFileSync(path.join(tmp, 'dist', 'kdna.json'), 'utf8'));
+  const exportedProvenance = JSON.parse(fs.readFileSync(path.join(tmp, 'dist', 'provenance-report.json'), 'utf8'));
+  assert.equal(exportedManifest.content_digest, receipt.content_digest,
+    'manifest.content_digest !== build-receipt.content_digest');
+  assert.equal(exportedProvenance.content_digest, receipt.content_digest,
+    'provenance-report.content_digest !== build-receipt.content_digest');
+  assert.ok(exportedManifest.content_digest.startsWith('sha256:'),
+    'content_digest must be sha256: prefix');
+  assert.equal(exportedManifest.content_digest.length, 71,
+    'content_digest must be sha256: + 64 hex chars');
 });
 
 test('refuses signing without runtime identity keys', (t) => {
@@ -164,3 +187,262 @@ test('refuses signing without runtime identity keys', (t) => {
   assert.equal(result.status, 5);
   assert.match(result.stderr, /Signing requires KDNA identity keys/);
 });
+
+// ── Identity ────────────────────────────────────────────────────────
+
+test('identity init creates local creator identity', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+  const identityDir = path.join(tmp, 'identity');
+
+  const result = run(['identity', 'init', '--name', 'Test Creator'], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: identityDir },
+  });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /Creator identity initialized/);
+  assert.match(result.stdout, /kdna:creator:ed25519:/);
+
+  // Verify files were created
+  assert.ok(fs.existsSync(path.join(identityDir, 'kdna.key')));
+  assert.ok(fs.existsSync(path.join(identityDir, 'kdna.pub')));
+  assert.ok(fs.existsSync(path.join(identityDir, 'creator.json')));
+  const creatorJson = JSON.parse(fs.readFileSync(path.join(identityDir, 'creator.json'), 'utf8'));
+  assert.match(creatorJson.creator_id, /^kdna:creator:ed25519:/);
+  assert.equal(creatorJson.display_name, 'Test Creator');
+  assert.equal(creatorJson.verified, false);
+
+  // Double init should fail
+  const result2 = run(['identity', 'init', '--name', 'Duplicate'], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: identityDir },
+  });
+  assert.equal(result2.status, 2);
+  assert.match(result2.stderr, /already exists/);
+});
+
+test('identity show displays current identity', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+  const identityDir = path.join(tmp, 'identity');
+
+  // Init first
+  run(['identity', 'init', '--name', 'Test User'], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: identityDir },
+  });
+
+  const result = run(['identity', 'show'], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: identityDir },
+  });
+  assert.equal(result.status, 0, result.stderr);
+  const info = JSON.parse(result.stdout);
+  assert.match(info.creator_id, /^kdna:creator:ed25519:/);
+  assert.equal(info.display_name, 'Test User');
+});
+
+test('identity show fails when not initialized', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+
+  const result = run(['identity', 'show'], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: path.join(tmp, 'no-such') },
+  });
+  assert.equal(result.status, 2);
+  assert.match(result.stderr, /No identity found/);
+});
+
+// ── Create from folder ──────────────────────────────────────────────
+
+test('create --from-folder imports legacy JSON source, outputs audit', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+
+  const sourceDir = path.join(tmp, 'legacy-source');
+  fs.mkdirSync(sourceDir, { recursive: true });
+
+  // Create legacy KDNA files
+  const core = {
+    meta: { domain: 'test', version: '0.1.0', created: '2026-01-01', purpose: 'test', load_condition: 'always' },
+    axioms: [{
+      id: 'ax_legacy',
+      one_sentence: 'Test axiom from legacy folder.',
+      full_statement: 'A complete testable explanation from a legacy source folder.',
+      why: 'Without this legacy axiom, agent judgment defaults to untrained behavior.',
+      applies_when: ['testing legacy import'],
+      does_not_apply_when: ['production'],
+      failure_risk: 'May produce incorrect results from untrained judgment.',
+    }],
+    ontology: [{ id: 'ont_legacy', one_sentence: 'Legacy concept.', essence: 'Operational meaning.', boundary: 'Not the opposite.', trigger_signal: 'keyword' }],
+    boundaries: [{ id: 'bnd_legacy', scope: 'Legacy scope.', out_of_scope: 'Not covered by legacy.', acceptable_exceptions: [] }],
+    stances: [],
+  };
+  fs.writeFileSync(path.join(sourceDir, 'KDNA_Core.json'), JSON.stringify(core));
+  fs.writeFileSync(path.join(sourceDir, 'KDNA_Patterns.json'), JSON.stringify({
+    meta: { domain: 'test', version: '0.1.0', created: '2026-01-01', purpose: 'patterns', load_condition: 'always' },
+    misunderstandings: [{ id: 'ms_legacy', wrong: 'Legacy wrong belief.', correct: 'Correct understanding.', key_distinction: 'The key distinction between wrong and correct.' }],
+    self_check: ['Did I verify the legacy import?'],
+  }));
+
+  const projectDir = path.join(tmp, 'project');
+  const result = run(['create', projectDir, '--from-folder', sourceDir, '--name', '@test/legacy-import'], { tmp });
+  assert.equal(result.status, 0, result.stderr);
+
+  const output = JSON.parse(result.stdout);
+  assert.ok(output.audit, 'must have audit info');
+  assert.ok(output.audit.filesFound.includes('KDNA_Core.json'));
+  assert.ok(output.audit.filesFound.includes('KDNA_Patterns.json'));
+  assert.ok(output.imported > 0, `imported cards: ${output.imported}`);
+  assert.equal(output.source_mode, 'source_folder');
+
+  // Read project and verify cards were imported
+  const projectPath = path.join(projectDir, 'studio.project.json');
+  assert.ok(fs.existsSync(projectPath));
+  const project = JSON.parse(fs.readFileSync(projectPath, 'utf8'));
+  assert.equal(project.source_mode, 'source_folder');
+  assert.ok(project.cards.length > 0);
+  assert.equal(project.lineage.type, 'migrated');
+});
+
+// ── Create from KDNA ────────────────────────────────────────────────
+
+test('create --from-kdna forks an existing .kdna asset', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+
+  // First create and export a "parent" project
+  const parentTmp = tmpDir();
+  t.after(() => fs.rmSync(parentTmp, { recursive: true, force: true }));
+  const { projectDir: parentDir } = createLockedProject(t);
+  const parentDist = path.join(parentTmp, 'dist');
+  fs.mkdirSync(parentDist, { recursive: true });
+  const parentKdna = path.join(parentDist, 'parent.kdna');
+  run(['export', parentDir, '--out', parentKdna], { tmp: parentTmp });
+
+  // Now fork from that .kdna
+  const projectDir = path.join(tmp, 'forked-project');
+  const result = run(['create', projectDir, '--from-kdna', parentKdna, '--name', '@test/fork'], { tmp });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /Created Studio project/);
+  assert.match(result.stdout, /kdna_asset/);
+
+  const projectPath = path.join(projectDir, 'studio.project.json');
+  assert.ok(fs.existsSync(projectPath));
+  const project = JSON.parse(fs.readFileSync(projectPath, 'utf8'));
+  assert.equal(project.source_mode, 'kdna_asset');
+  assert.ok(project.lineage, 'must have lineage');
+  assert.equal(project.lineage.type, 'fork');
+  assert.ok(project.lineage.parent_name, 'must record parent name');
+});
+
+// ── Card approve --sign ─────────────────────────────────────────────
+
+test('card approve --sign binds Human Lock to creator identity', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+  const identityDir = path.join(tmp, 'identity');
+
+  // Initialize creator identity
+  const init = run(['identity', 'init', '--name', 'Signer'], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: identityDir },
+  });
+  assert.equal(init.status, 0, init.stderr);
+
+  // Create project with an axiom
+  const projectDir = path.join(tmp, 'project');
+  let result = run(['create', projectDir, '--name', '@test/signed'], { tmp });
+  assert.equal(result.status, 0, result.stderr);
+
+  result = run([
+    'card', 'add', projectDir, 'axiom',
+    '--field', 'one_sentence=Prefer specific evidence over broad claims',
+    '--field', 'full_statement=When evaluating a claim the agent must weigh the specificity of the supporting evidence. A narrow claim backed by concrete data should be preferred.',
+    '--field', 'why=Without this axiom the agent may accept broad plausible-sounding claims as equally credible as narrow evidence-backed ones.',
+    '--field', 'applies_when=["reviewing content"]',
+    '--field', 'does_not_apply_when=["pure formatting"]',
+    '--field', 'failure_risk=generic advice',
+  ], { tmp });
+  assert.equal(result.status, 0, result.stderr);
+  const cardId = result.stdout.match(/Added card: (\S+)/)?.[1];
+
+  // Approve with --sign
+  result = run([
+    'card', 'approve', projectDir, cardId,
+    '--by', 'signer',
+    '--statement', 'I confirm this judgment with my creator identity.',
+    '--sign',
+  ], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: identityDir },
+  });
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /signed/);
+
+  // Verify human_lock has creator_id and signature
+  const project = JSON.parse(fs.readFileSync(path.join(projectDir, 'studio.project.json'), 'utf8'));
+  const lockedCard = project.cards.find(c => c.id === cardId);
+  assert.ok(lockedCard.human_lock, 'must have human_lock');
+  assert.ok(lockedCard.human_lock.creator_id, 'must have creator_id');
+  assert.match(lockedCard.human_lock.creator_id, /^kdna:creator:ed25519:/);
+  assert.ok(lockedCard.human_lock.signature, 'must have signature');
+  assert.match(lockedCard.human_lock.signature, /^ed25519:/);
+});
+
+// ── Blank create with default source_mode ───────────────────────────
+
+test('create (blank) sets source_mode=blank by default', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+  const projectDir = path.join(tmp, 'project');
+
+  const result = run(['create', projectDir, '--name', '@test/blank'], { tmp });
+  assert.equal(result.status, 0, result.stderr);
+
+  const project = JSON.parse(fs.readFileSync(path.join(projectDir, 'studio.project.json'), 'utf8'));
+  assert.equal(project.source_mode, 'blank');
+});
+
+// ── export includes creator/lineage in manifest ─────────────────────
+
+test('export includes creator and lineage in kdna.json', (t) => {
+  const tmp = tmpDir();
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }));
+  const identityDir = path.join(tmp, 'identity');
+
+  // Init identity
+  run(['identity', 'init', '--name', 'Exporter'], {
+    tmp,
+    env: { ...process.env, KDNA_IDENTITY_DIR: identityDir },
+  });
+
+  // Create, add axiom, approve
+  const projectDir = path.join(tmp, 'project');
+  run(['create', projectDir, '--name', '@test/exported'], { tmp });
+  run([
+    'card', 'add', projectDir, 'axiom',
+    '--field', 'one_sentence=Test axiom for lineage.',
+    '--field', 'full_statement=This is a complete testable explanation for the agent to apply in judgment scenarios.',
+    '--field', 'why=Without this axiom the agent would make incorrect judgment calls.',
+    '--field', 'applies_when=["testing"]',
+    '--field', 'does_not_apply_when=["not testing"]',
+    '--field', 'failure_risk=test may pass incorrectly',
+  ], { tmp });
+  let result = run(['card', 'list', projectDir], { tmp });
+  const cardId = result.stdout.match(/(\S+)\s+axiom/)?.[1];
+  run(['card', 'approve', projectDir, cardId, '--by', 'tester', '--statement', 'Verified.'], { tmp });
+  run(['lock', projectDir], { tmp });
+
+  const distDir = path.join(tmp, 'dist');
+  const outFile = path.join(distDir, 'exported.kdna');
+  result = run(['export', projectDir, '--out', outFile], { tmp });
+  assert.equal(result.status, 0, result.stderr);
+
+  // Check exported kdna.json has new fields
+  const exportedManifest = JSON.parse(fs.readFileSync(path.join(distDir, 'kdna.json'), 'utf8'));
+  assert.equal(exportedManifest.authoring.source_mode, 'blank');
+  assert.ok(exportedManifest.lineage, 'must have lineage');
+  assert.equal(exportedManifest.lineage.type, 'original');
+});