@aikdna/kdna-studio-cli 0.10.1 → 0.11.0

package/bin/kdna-studio.js

@@ -3,18 +3,109 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
+
 const zlib = require('zlib');
 const cbor = require('cbor-x');
 const { execFileSync } = require('child_process');
 
+function deterministicSourceDigest(paths) {
+  const files = [];
+  function visit(target, root) {
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink()) {
+      throw new Error('Studio Core source checkout contains a symbolic link.');
+    }
+    if (stat.isFile()) {
+      files.push({ target, relative: path.relative(root, target) });
+      return;
+    }
+    if (!stat.isDirectory()) return;
+    for (const entry of fs.readdirSync(target).sort()) {
+      visit(path.join(target, entry), root);
+    }
+  }
+  for (const target of paths) {
+    const absolute = path.resolve(target);
+    visit(absolute, path.dirname(absolute));
+  }
+  files.sort((left, right) => left.relative.localeCompare(right.relative));
+  const hash = crypto.createHash('sha256');
+  for (const file of files) {
+    hash.update(file.relative);
+    hash.update('\0');
+    hash.update(fs.readFileSync(file.target));
+    hash.update('\0');
+  }
+  return `sha256:${hash.digest('hex')}`;
+}
+
 function loadStudioCore() {
   const publishedCore = require('@aikdna/kdna-studio-core');
-  if (publishedCore.exportRuntime && publishedCore.protocolContract) return publishedCore;
+  const publishedVersion = require('@aikdna/kdna-studio-core/package.json').version;
+  if (
+    publishedCore.exportRuntime &&
+    publishedCore.protocolContract &&
+    publishedCore.creationEngine &&
+    publishedCore.creationEngine.SCHEMA_VERSION === '0.2.0' &&
+    typeof publishedCore.creationEngine.readManagedCandidate === 'function'
+  ) {
+    return {
+      ...publishedCore,
+      creationExportRuntime: publishedCore.exportRuntime,
+      creationStudioCoreCoordinate: {
+        package: '@aikdna/kdna-studio-core',
+        version: publishedVersion,
+        distribution: 'installed-package',
+      },
+    };
+  }
   try {
-    return require('../../kdna-studio-core/src');
-  } catch (_) {
-    return publishedCore;
+    const sourcePaths = [
+      path.join(__dirname, '../../kdna-studio-core/src'),
+      path.join(
+        __dirname,
+        '../../kdna-studio-core/schemas/creation-workspace.schema.json',
+      ),
+      path.join(__dirname, '../../kdna-studio-core/package.json'),
+      path.join(__dirname, '../../kdna-studio-core/package-lock.json'),
+    ].filter((target) => fs.existsSync(target));
+    const sourceDigestBeforeLoad = deterministicSourceDigest(sourcePaths);
+    const sourceCore = require('../../kdna-studio-core/src');
+    const sourceDigestAfterLoad = deterministicSourceDigest(sourcePaths);
+    if (sourceDigestBeforeLoad !== sourceDigestAfterLoad) {
+      throw new Error('Studio Core source changed while it was being loaded.');
+    }
+    if (
+      sourceCore.exportRuntime &&
+      sourceCore.protocolContract &&
+      sourceCore.creationEngine
+    ) {
+      // Keep the installed package as the binding for established expert
+      // commands. A sibling source checkout supplies only the unreleased
+      // Creation Engine and its matching exporter during coordinated
+      // development; it must not silently replace expert APIs.
+      return {
+        ...publishedCore,
+        creationEngine: sourceCore.creationEngine,
+        creationExportRuntime: sourceCore.exportRuntime,
+        creationStudioCoreCoordinate: {
+          package: '@aikdna/kdna-studio-core',
+          version: require('../../kdna-studio-core/package.json').version,
+          distribution: 'source-checkout',
+          source_tree_digest: sourceDigestAfterLoad,
+        },
+      };
+    }
+  } catch (error) {
+    if (
+      error?.code !== 'MODULE_NOT_FOUND' &&
+      error?.code !== 'ENOENT'
+    ) {
+      throw error;
+    }
+    // Installed packages do not have a sibling source checkout.
   }
+  return publishedCore;
 }
 
 const {
@@ -22,68 +113,93 @@ const {
   cards: cardApi,
   evidence: evidenceApi,
   compile: compileApi,
-  quality,
   creator: creatorApi,
   distillation: distillationApi,
   exportRuntime,
+  creationExportRuntime,
+  creationStudioCoreCoordinate,
   protocolContract,
+  creationEngine,
 } = loadStudioCore();
 
 const llm = require('../src/llm');
 
-// Bug (#1 UX): the LLM-requiring commands (distill, interview, feynman,
-// test) silently fail with a stack trace when no LLM is configured.
-// First-time users hit this and have no way to know what to do. The
-// fix routes every LLM call through this helper, which:
-//   1. Checks whether an LLM is configured at all
-//   2. If not and --no-llm is given, returns a static / synthesised
-//      result so the command can still be useful (5-minute path)
-//   3. If not and --no-llm is absent, exits with a clear
-//      "configure LLM with: kdna-studio llm config" message
-function cmdNeedsLlm(args, cmdName) {
-  const cfg = llm.config();
-  const hasLlm = cfg && cfg.provider && cfg.apiKey && cfg.model;
-  if (hasLlm) return { hasLlm: true, cfg };
-  if (args.includes('--no-llm')) {
-    return {
-      hasLlm: false,
-      cfg,
-      noLlm: true,
-      message: `${cmdName} invoked with --no-llm. Output will be static / synthesised; configure an LLM with \`kdna-studio llm config\` to enable real evaluation.`,
-    };
-  }
-  fail(
-    `${cmdName} requires an LLM. Configure one with:\n` +
-    `  kdna-studio llm config --provider openai --key <api-key> --model <model>\n` +
-    `Or set env vars: KDNA_LLM_PROVIDER, KDNA_LLM_API_KEY, KDNA_LLM_MODEL.\n` +
-    `Or run with --no-llm to get a static / synthesised result.`,
-  );
-}
 const ai = require('../src/ai');
+const {
+  CREATION_COMMANDS,
+  decodeSecretTransport,
+  executeCreationCommand,
+} = require('../src/creation-cli');
 
 const EXIT = { OK: 0, INPUT_ERROR: 2, HUMAN_LOCK_REQUIRED: 4, TRUST_FAILED: 5 };
+const SECRET_STDIN_LIMIT_BYTES = 64 * 1024;
 
-function usage() {
-  console.log(`kdna-studio — Studio-compatible KDNA authoring CLI
+function readBoundedSecretStdin(label) {
+  const storage = Buffer.alloc(SECRET_STDIN_LIMIT_BYTES + 1);
+  let length = 0;
+  try {
+    while (length < storage.length) {
+      const count = fs.readSync(
+        0,
+        storage,
+        length,
+        storage.length - length,
+        null,
+      );
+      if (count === 0) break;
+      length += count;
+    }
+    if (length > SECRET_STDIN_LIMIT_BYTES) {
+      throw new Error(`${label} exceeds the bounded secret input limit`);
+    }
+    return decodeSecretTransport(storage.subarray(0, length));
+  } finally {
+    storage.fill(0);
+  }
+}
 
-LLM (AI-powered authoring; every AI command accepts --no-llm for a static result):
+function usage() {
+  console.log(`kdna-studio — Agent-guided KDNA Creation Engine
+
+Create without schema editing:
+  kdna-studio guide-agent --action create|inventory --json
+  kdna-studio guide-agent <workspace> --json
+  kdna-studio create-agent <workspace> [--input-file <json> | --input-stdin] [--material <path>] [--password-stdin] [--operation-id <id>] [--json]
+  kdna-studio inventory-agent <material-file-or-directory> [--material <path>] [--workspace <existing-creation-workspace>] [--json]
+  kdna-studio deliver-material <workspace> (--private-output-fd 3 | --private-output-file <mode-0600-system-temp-file>) [--input-file <json> | --input-stdin] [--material <reauthorized-path>] [--json]
+  kdna-studio resume <workspace> [--input-file <json> | --input-stdin] [--material <path>] [--password-stdin] [--operation-id <id>] [--json]
+  kdna-studio status <workspace> [--json]
+  kdna-studio answer <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio review <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio try <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio verify-application-agent <workspace> [--password-stdin] [--json]
+  kdna-studio repair <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio export-agent <workspace> [--password-stdin] [--operation-id <id>] [--json]
+  kdna-studio finalize-agent <workspace> --out <file.kdna> [--operation-id <id>] [--json]
+
+The default Creation Engine speaks in purpose, material, judgment, boundary,
+example, confirmation, and export terms. Natural-language answers belong in
+stdin or an input file, never process arguments.
+
+Expert authoring:
+
+LLM configuration for expert AI-assisted authoring:
   kdna-studio llm config [--provider <name>] [--model <name>] [--key-pipe] [--url <base-url>]
   kdna-studio llm show
-  (run 'kdna-studio llm config --provider openai --key <key> --model gpt-4' to enable
-   feynman, distill --ai, interview, and test. With --no-llm these commands
-   still produce a structured but unsynthesised result.)
+  (pipe the key to 'kdna-studio llm config --provider openai --key-pipe --model gpt-4'
+   to enable distill --ai and interview.)
 
 Identity:
-  kdna-studio identity init [--name <display-name>]
+  kdna-studio identity init [--name <display-name>] [--passphrase-stdin]
   kdna-studio identity show
 
 Create (three entry paths):
-  kdna-studio create <project-dir> --name <@scope/name> [--author <name>]                        # blank
+  kdna-studio create <project-dir> --name <@scope/name> [--author <name>] [--use-local-identity] # blank
   kdna-studio create <project-dir> --from-kdna <file.kdna> --name <@scope/name>
   kdna-studio create <project-dir> --from-folder <source-dir> --name <@scope/name>
 
 Migrate (dev source or Studio project → canonical .kdna in one command):
-  kdna-studio migrate <source-dir|project> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--allow-incomplete] [--sign] [--passphrase <pw>|--passphrase-stdin]
+  kdna-studio migrate <source-dir|project> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--allow-incomplete] [--sign] [--use-local-identity] [--passphrase-stdin]
   kdna-studio migrate <source-dir> --check --name <@scope/name>   # pre-flight: report which fields would block the export without writing the .kdna
   kdna-studio audit-locks <project> [--type axiom|risk|stance|...] [--json]   # list cards with missing Human Lock fields (per-card-type, per-field)
 
@@ -95,10 +211,10 @@ Authoring:
   kdna-studio card add <project> <type> --field key=value [--field key=value] [--template <name>] [--no-strict]
   kdna-studio card update <project> <card-id> --field key=value
   kdna-studio card remove <project> <card-id>
-  kdna-studio card approve <project> <card-id|--all> --by <id> --statement <text> [--sign] [--passphrase <pass>]
+  kdna-studio card approve <project> <card-id|--all> --by <id> --statement <text> [--sign] [--passphrase-stdin]
   kdna-studio card unlock <project> <card-id> --by <id> --statement <text>
   kdna-studio compile <project> --out <dir>
-  kdna-studio export <project> --out <file.kdna> [--allow-incomplete] [--password <pw>|--password-stdin]
+  kdna-studio export <project> --out <file.kdna> [--allow-incomplete] [--password-stdin]
   kdna-studio export-route-card <domain-id> [--out=<path>]          # Export route-card sidecar skeleton
   kdna-studio export-consumer-index [--entries=<domain-ids>] [--out=<path>]     # Export consumer-index skeleton
 
@@ -106,8 +222,6 @@ AI Authoring (requires LLM config: kdna-studio llm config):
   kdna-studio distill <project> --ai                             # AI-driven candidate extraction from evidence
   kdna-studio distill <project> --candidates <file.json>          # load pre-generated AI candidates
   kdna-studio interview <project> [--stage <name>]               # 4-stage guided AI interview
-  kdna-studio feynman <project> <card-id>                        # AI Feynman evaluation (5-dimension)
-  kdna-studio test <project> --input "<text>" [--preset baseline|edge|contradiction]
 
 Distillation:
   kdna-studio target declare <project>                           # declare distillation target interactively
@@ -118,7 +232,6 @@ Distillation:
   kdna-studio candidate reject <project> <candidate-id>
   kdna-studio candidate override <project> <candidate-id>        # override scope gate
   kdna-studio candidate promote <project>                        # promote accepted+scope_fit → cards
-  kdna-studio report <project>
   kdna-studio audit-locks <project>            # list all axioms/risk/stance missing Human Lock fields
 
 Project may be a directory containing studio.project.json or a project JSON file.`);
@@ -159,64 +272,58 @@ function option(args, name, fallback = null) {
 }
 
 /**
- * Resolve a passphrase from CLI flags, environment, or stdin.
- *
- * SECURITY: passing a passphrase as `--passphrase <value>` exposes it in
- * `ps aux` output and shell history. The recommended path is one of:
- *   1. --passphrase-stdin  — read from stdin (pipe-friendly, no TTY hang)
- *   2. KDNA_PASSPHRASE env var (less secure but no process-list leak)
- *   3. --passphrase <pw>   — fallback only; prints a warning
+ * Resolve a passphrase from stdin. Secrets in argv are rejected.
  *
  * Returns the passphrase string, or null if none was provided.
  */
 function resolvePassphrase(args) {
+  if (
+    args.includes('--passphrase') ||
+    args.some((arg) => arg.startsWith('--passphrase='))
+  ) {
+    fail(
+      '--passphrase is not supported because it exposes secrets in process arguments. ' +
+      'Use --passphrase-stdin.'
+    );
+  }
   if (args.includes('--passphrase-stdin')) {
     if (process.stdin.isTTY) {
       fail(
         '--passphrase-stdin requires the passphrase to be piped in on stdin.\n' +
-        'Example:  read -s PW && echo "$PW" | kdna-studio export ... --sign --passphrase-stdin'
+        'Example:  read -r -s PW && printf "%s\\n" "$PW" | kdna-studio export ... --sign --passphrase-stdin'
       );
     }
     try {
-      return fs.readFileSync(0, 'utf8').trim();
+      return readBoundedSecretStdin('Passphrase');
     } catch (e) {
       fail(`Could not read passphrase from stdin: ${e.message}`);
     }
   }
-  if (process.env.KDNA_PASSPHRASE) return process.env.KDNA_PASSPHRASE;
-  const fromFlag = option(args, '--passphrase');
-  if (fromFlag) {
-    console.error('Warning: --passphrase <value> exposes the secret in `ps aux` and shell history. Prefer --passphrase-stdin or KDNA_PASSPHRASE env var.');
-    return fromFlag;
-  }
   return null;
 }
 
 function resolveApiKey(args) {
-  // 1. KDNA_API_KEY environment variable (preferred)
-  if (process.env.KDNA_API_KEY) return process.env.KDNA_API_KEY;
+  if (
+    args.includes('--key') ||
+    args.includes('-k') ||
+    args.some((arg) => arg.startsWith('--key='))
+  ) {
+    fail('API keys in process arguments are not supported. Use --key-pipe.');
+  }
 
-  // 2. Read from stdin via --key-pipe flag
   if (args.includes('--key-pipe')) {
     if (process.stdin.isTTY) {
-      console.error('Error: --key-pipe requires stdin to be piped. Example: echo $KDNA_API_KEY | kdna-studio llm config --key-pipe');
+      console.error('Error: --key-pipe requires the API key to be piped on stdin.');
       return null;
     }
     try {
-      return fs.readFileSync(0, 'utf8').trim();
+      return readBoundedSecretStdin('API key');
     } catch (e) {
       console.error('Error reading API key from stdin:', e.message);
       return null;
     }
   }
 
-  // 3. Deprecated --key / -k flag (backward compat)
-  const key = option(args, '--key', null) || option(args, '-k', null);
-  if (key) {
-    console.error('Warning: --key is deprecated and exposes secrets in shell history and ps output. Use KDNA_API_KEY env var or pipe via stdin (--key-pipe).');
-    return key;
-  }
-
   return null;
 }
 
@@ -366,12 +473,23 @@ function cleanFields(fields = {}) {
   return cleaned;
 }
 
+function importedFields(entry = {}, options = {}) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return {};
+  const fields = JSON.parse(JSON.stringify(entry));
+  for (const key of ['id', 'status', 'locked', 'human_lock', 'audit_log', 'source_authored']) {
+    delete fields[key];
+  }
+  if (options.keepType !== true) delete fields.type;
+  return cleanFields(fields);
+}
+
 function importedCard(type, fields = {}, id = null) {
-  try {
-    return cardApi.createCard(type, cleanFields(fields), id || null);
-  } catch (_) {
-    return null;
+  const card = cardApi.createCard(type, cleanFields(fields), id || null);
+  if (card === null) {
+    throw new Error(`failed to create card type="${type}" id="${id || '(auto)'}" — ` +
+      `the card type may require additional required fields or the fields may be malformed`);
   }
+  return card;
 }
 
 // Bug (#3 + #4 UX): payload.kdnab intentionally carries the same
@@ -401,8 +519,10 @@ function pushImportedCard(cards, type, fields = {}, id = null) {
     }
     return;
   }
-  if (id) _importedIds.add(id);
   const card = importedCard(type, fields, id);
+  // Register the id only after card creation succeeds; a failed creation
+  // must not consume the id and prevent retry.
+  if (card && id) _importedIds.add(id);
   if (card) cards.push(card);
 }
 
@@ -438,31 +558,22 @@ function cardsFromRuntimePayload(payload) {
   if (cards.length > 0) return cards;
 
   for (const ax of (Array.isArray(payload.core?.axioms) ? payload.core?.axioms : [])) {
-    pushImportedCard(cards, 'axiom', {
-      one_sentence: ax.one_sentence || '',
-      full_statement: ax.full_statement || '',
-      why: ax.why || '',
-      applies_when: ax.applies_when || [],
-      does_not_apply_when: ax.does_not_apply_when || [],
-      failure_risk: ax.failure_risk || '',
-      confidence: ax.confidence || '',
-      evidence_type: ax.evidence_type || '',
-    }, ax.id || null);
+    pushImportedCard(cards, 'axiom', importedFields(ax), ax.id || null);
   }
   for (const ont of (Array.isArray(payload.core?.ontology) ? payload.core?.ontology : [])) {
-    pushImportedCard(cards, 'ontology', ont, ont.id || null);
+    pushImportedCard(cards, 'ontology', importedFields(ont), ont.id || null);
   }
   for (const fw of (Array.isArray(payload.core?.frameworks) ? payload.core?.frameworks : [])) {
-    pushImportedCard(cards, 'framework', fw, fw.id || null);
+    pushImportedCard(cards, 'framework', importedFields(fw), fw.id || null);
   }
   for (const stance of (Array.isArray(payload.core?.stances) ? payload.core?.stances : [])) {
-    pushImportedCard(cards, 'stance', stance, stance.id || null);
+    pushImportedCard(cards, 'stance', importedFields(stance), stance.id || null);
   }
   for (const aesthetic of (Array.isArray(payload.core?.aesthetics) ? payload.core?.aesthetics : [])) {
-    pushImportedCard(cards, 'aesthetic', aesthetic, aesthetic.id || null);
+    pushImportedCard(cards, 'aesthetic', importedFields(aesthetic), aesthetic.id || null);
   }
   for (const boundary of (Array.isArray(payload.core?.boundaries) ? payload.core?.boundaries : [])) {
-    pushImportedCard(cards, 'boundary', boundary, boundary.id || null);
+    pushImportedCard(cards, 'boundary', importedFields(boundary), boundary.id || null);
   }
   // risk_model may be either an array of risk items (legacy) or
   // `{risks: [...]}` (current). Treat both shapes; ignore everything else
@@ -470,7 +581,7 @@ function cardsFromRuntimePayload(payload) {
   const riskModel = payload.core?.risk_model;
   const riskItems = Array.isArray(riskModel) ? riskModel : (riskModel?.risks || []);
   for (const risk of riskItems) {
-    pushImportedCard(cards, 'risk', risk, risk.id || null);
+    pushImportedCard(cards, 'risk', importedFields(risk), risk.id || null);
   }
   for (const pattern of (Array.isArray(payload.patterns) ? payload.patterns : [])) {
     // Bug (#146): prior version dropped any payload.patterns entry
@@ -500,19 +611,25 @@ function cardsFromRuntimePayload(payload) {
         );
         continue;
       }
-      fields = { ...pattern };
-      delete fields.type;
+      fields = importedFields(pattern);
     } else {
-      const { type: _stripped, ...rest } = pattern;
-      fields = rest;
+      fields = importedFields(pattern, { keepType: type === 'pattern' || LEGACY_PATTERN_SUBTYPES.has(type) });
+    }
+    if (LEGACY_PATTERN_SUBTYPES.has(type)) {
+      fields = {
+        ...fields,
+        type,
+        legacy_subtype: fields.legacy_subtype || type,
+      };
+      type = 'pattern';
     }
     pushImportedCard(cards, type, fields, pattern.id || null);
   }
   for (const scenario of (Array.isArray(payload.scenarios) ? payload.scenarios : [])) {
-    pushImportedCard(cards, 'scenario', scenario, scenario.id || null);
+    pushImportedCard(cards, 'scenario', importedFields(scenario), scenario.id || null);
   }
   for (const item of (Array.isArray(payload.cases) ? payload.cases : [])) {
-    pushImportedCard(cards, 'case', item, item.id || null);
+    pushImportedCard(cards, 'case', importedFields(item), item.id || null);
   }
   // The current payload contract has one self-check field. Refuse to infer a
   // parallel field name: Core validation owns format migration, while Studio
@@ -520,8 +637,8 @@ function cardsFromRuntimePayload(payload) {
   const rawSelfCheck = payload.reasoning?.self_check;
   const selfCheckArr = Array.isArray(rawSelfCheck) ? rawSelfCheck : [];
   for (const selfCheck of selfCheckArr) {
-    const fields = typeof selfCheck === 'string' ? { question: selfCheck } : selfCheck;
-    pushImportedCard(cards, 'self_check', fields, fields.id || null);
+    const fields = typeof selfCheck === 'string' ? { question: selfCheck } : importedFields(selfCheck);
+    pushImportedCard(cards, 'self_check', fields, typeof selfCheck === 'object' ? selfCheck.id || null : null);
   }
   for (const failureMode of (Array.isArray(payload.reasoning?.failure_modes) ? payload.reasoning?.failure_modes : [])) {
     // Bug (#145 follow-up): the prior version dropped three
@@ -530,7 +647,8 @@ function cardsFromRuntimePayload(payload) {
     // project that round-tripped through `migrate` lost
     // these fields every time. The fix reads them through, matching
     // the export-side map in kdna-studio-core's buildPayload.
-    pushImportedCard(cards, 'misunderstanding', {
+    const fields = {
+      ...importedFields(failureMode),
       wrong: failureMode.mode || failureMode.wrong || '',
       correct: failureMode.correct || '',
       key_distinction: failureMode.key_distinction || '',
@@ -538,7 +656,9 @@ function cardsFromRuntimePayload(payload) {
       failure_risk: failureMode.failure_risk || '',
       applies_when: Array.isArray(failureMode.applies_when) ? failureMode.applies_when : [],
       does_not_apply_when: Array.isArray(failureMode.does_not_apply_when) ? failureMode.does_not_apply_when : [],
-    }, failureMode.id || null);
+    };
+    delete fields.mode;
+    pushImportedCard(cards, 'misunderstanding', fields, failureMode.id || null);
   }
   for (const chain of (Array.isArray(payload.reasoning?.reasoning_chains) ? payload.reasoning?.reasoning_chains : [])) {
     // Bug (#4 UX): compile/index.js synthesises one reasoning chain
@@ -547,7 +667,7 @@ function cardsFromRuntimePayload(payload) {
     // doubled the card count on round-trip. The fix skips chains
     // that the producer explicitly marked as synthesised.
     if (chain.source_authored === false) continue;
-    pushImportedCard(cards, 'reasoning', chain, chain.id || null);
+    pushImportedCard(cards, 'reasoning', importedFields(chain), chain.id || null);
   }
   for (const stage of (Array.isArray(payload.evolution?.stages) ? payload.evolution?.stages : [])) {
     // Distinguish source-authored stages (preserved identity) from
@@ -556,7 +676,7 @@ function cardsFromRuntimePayload(payload) {
     // so the importer doesn't double-count what was already in the
     // locked judgment cards.
     if (stage.source_authored === true) {
-      pushImportedCard(cards, 'evolution_stage', stage, stage.id || null);
+      pushImportedCard(cards, 'evolution_stage', importedFields(stage), stage.id || null);
     }
   }
   return cards;
@@ -608,7 +728,7 @@ function buildManifest(project, name) {
     asset_uid: project.asset_uid || source.asset_uid || 'urn:uuid:' + crypto.randomUUID(),
     asset_type: project.type === 'cluster' ? 'cluster' : 'domain',
     source_asset_type: source.asset_type || null,
-    title: titleFromName(source.name || name || project.name, assetId),
+    title: source.title || project.title || titleFromName(source.name || name || project.name, assetId),
     version: semverValue(project.release?.version || source.version, '1.0.0'),
     judgment_version: semverValue(project.release?.judgment_version || source.judgment_version || source.version, '1.0.0'),
     created_at: isoDateTime(source.created_at || source.created || project.created),
@@ -663,8 +783,19 @@ function cmdCreate(args) {
   let lineage = null;
   let creatorIdentity = null;
 
-  // Load creator identity if available
-  try { creatorIdentity = creatorApi.loadIdentity(); } catch { /* no identity yet */ }
+  // A machine-local identity is never inherited implicitly. Creating for
+  // another person, an organization, or an interpretive source must not pick
+  // up whichever identity happens to be configured on this computer.
+  if (args.includes('--use-local-identity')) {
+    try {
+      creatorIdentity = creatorApi.loadIdentity();
+    } catch {
+      fail(
+        '--use-local-identity was requested, but no usable local identity is available.',
+        EXIT.TRUST_FAILED,
+      );
+    }
+  }
 
   if (fromKdna) {
     sourceMode = 'kdna_asset';
@@ -691,7 +822,13 @@ function cmdCreate(args) {
       if (kdnaData.source_patterns) project.source_patterns = kdnaData.source_patterns;
       if (kdnaData.source_reasoning) project.source_reasoning = kdnaData.source_reasoning;
       if (kdnaData.source_evolution) project.source_evolution = kdnaData.source_evolution;
+      if (kdnaData.source_core_structure) project.source_core_structure = kdnaData.source_core_structure;
       if (kdnaData.source_manifest) project.source_manifest = publicManifestMetadata(kdnaData.source_manifest);
+      if (kdnaData.source_manifest?.asset_uid) project.asset_uid = kdnaData.source_manifest.asset_uid;
+      if (kdnaData.source_manifest?.title) project.title = kdnaData.source_manifest.title;
+      if (kdnaData.source_manifest?.license) project.license = kdnaData.source_manifest.license;
+      if (kdnaData.source_manifest?.languages) project.languages = kdnaData.source_manifest.languages;
+      if (kdnaData.source_manifest?.language) project.default_language = kdnaData.source_manifest.language;
       if (kdnaData.source_manifest?.version) {
         if (!project.release) project.release = {};
         project.release.version = kdnaData.source_manifest.version;
@@ -700,9 +837,9 @@ function cmdCreate(args) {
         if (!project.release) project.release = {};
         project.release.judgment_version = kdnaData.source_manifest.judgment_version;
       }
-      if (kdnaData.source_manifest?.description) {
+      if (kdnaData.source_manifest?.description || kdnaData.source_manifest?.summary) {
         if (!project.release) project.release = {};
-        project.release.description = kdnaData.source_manifest.description;
+        project.release.description = kdnaData.source_manifest.description || kdnaData.source_manifest.summary;
       }
       if (project.stages?.judgment_cards) {
         project.stages.judgment_cards.total = kdnaData.cards.length;
@@ -756,6 +893,23 @@ function importFromKdna(kdnaPath) {
   if (stats.size > 50 * 1024 * 1024) {
     fail(`KDNA file too large (${(stats.size / (1024 * 1024)).toFixed(1)} MiB, max 50 MiB): ${absKdna}`);
   }
+
+  // Read the container before Core validation only to produce a stable
+  // profile error. Studio does not retain a second Runtime contract.
+  const zipBuf = fs.readFileSync(absKdna);
+  const entries = readZipEntries(zipBuf);
+  validateZipContainer(entries);
+  if (!entries.has('kdna.json')) fail('Not a valid .kdna asset: missing kdna.json');
+  if (!entries.has('payload.kdnab')) fail('Not a valid .kdna asset: missing payload.kdnab. Use --from-folder for legacy JSON source migration.');
+
+  const manifest = JSON.parse(entries.get('kdna.json').toString());
+  const payload = decodePayload(entries.get('payload.kdnab'), manifest);
+  const profile = payload?.profile;
+
+  if (profile !== 'kdna.payload.judgment') {
+    fail(`Unsupported payload profile "${profile || '(none)'}". Only kdna.payload.judgment is accepted for --from-kdna.`);
+  }
+
   let runtimeCore;
   try { runtimeCore = require('@aikdna/kdna-core'); } catch {
     fail('@aikdna/kdna-core is required to validate --from-kdna imports.');
@@ -764,11 +918,7 @@ function importFromKdna(kdnaPath) {
   if (!validation.overall_valid) {
     fail(`Not a current .kdna asset: ${(validation.problems || []).join('; ')}`);
   }
-  const zipBuf = fs.readFileSync(absKdna);
-  const entries = readZipEntries(zipBuf);
-  if (!entries.has('kdna.json')) fail('Not a valid .kdna asset: missing kdna.json');
 
-  const manifest = JSON.parse(entries.get('kdna.json').toString());
   const lineage = {
     type: 'fork',
     parent_name: packageNameFromManifest(manifest),
@@ -777,42 +927,275 @@ function importFromKdna(kdnaPath) {
     parent_asset_digest: manifest.content_digest || manifest.asset_digest || null,
   };
 
-  // Current assets carry strict-CBOR `payload.kdnab`. Legacy source folders
-  // are migrated explicitly with --from-folder; they are not runtime assets.
-  const importedCards = [];
-  let judgmentCore = null;
-  if (!entries.has('payload.kdnab')) {
-    fail('Not a current .kdna asset: missing payload.kdnab. Use --from-folder for legacy JSON source migration.');
-  }
+  let imported;
   try {
-    const payload = decodePayload(entries.get('payload.kdnab'), manifest);
-    importedCards.push(...cardsFromPayload(payload));
-    judgmentCore = judgmentCoreFromRuntimePayload(payload);
+    imported = importFromRuntimeContent(manifest, payload);
   } catch (e) {
     fail(`Could not import cards from payload.kdnab: ${e.message}`);
   }
 
-  if (importedCards.length === 0) {
+  if (imported.cards.length === 0) {
     fail(`No current judgment cards could be extracted from ${absKdna}.`);
   }
 
-  // Bug #15 / #28 follow-up: surface the source's KDNA_Patterns /
-  // KDNA_Reasoning / KDNA_Evolution entries so cmdCreate can store
-  // them on the project. The next export then forwards them to
-  // compileDomain via exportRuntimeAsset, which preserves
-  // changelog / version_notes / reasoning_chains / banned_terms
-  // through the round-trip.
   return {
     lineage,
-    cards: importedCards,
-    judgment_core: judgmentCore,
+    ...imported,
+  };
+}
+
+function importFromRuntimeContent(manifest, payload) {
+  if (payload?.profile !== 'kdna.payload.judgment') {
+    throw new Error(
+      `unsupported payload profile "${payload?.profile || '(none)'}"`,
+    );
+  }
+  resetImportedIds();
+  const cards = cardsFromPayload(payload);
+  const runtimeBoundaries = Array.isArray(payload.core?.boundaries)
+    ? payload.core.boundaries
+    : [];
+  const taskScopes = Array.from(new Set(
+    runtimeBoundaries
+      .map((boundary) => boundary?.scope)
+      .filter((scope) => typeof scope === 'string' && scope.trim().length > 0),
+  ));
+  const excludedAreas = runtimeBoundaries
+    .map((boundary) => boundary?.out_of_scope)
+    .filter((area) => typeof area === 'string' && area.trim().length > 0);
+  return {
+    cards,
+    judgment_core: judgmentCoreFromRuntimePayload(payload),
+    distillation_target: {
+      task_scope: taskScopes.length === 1 ? taskScopes[0] : null,
+      include_areas: taskScopes,
+      exclude_areas: excludedAreas,
+      load_condition:
+        typeof payload.core?.load_condition === 'string'
+          ? payload.core.load_condition
+          : null,
+    },
     source_manifest: manifest,
     source_patterns: null,
-    source_reasoning: null,
-    source_evolution: null,
+    source_reasoning: payload.reasoning && typeof payload.reasoning === 'object'
+      ? JSON.parse(JSON.stringify(payload.reasoning))
+      : null,
+    source_evolution: payload.evolution && typeof payload.evolution === 'object'
+      ? JSON.parse(JSON.stringify(payload.evolution))
+      : null,
+    source_core_structure: Array.isArray(payload.core?.core_structure)
+      ? JSON.parse(JSON.stringify(payload.core.core_structure))
+      : null,
   };
 }
 
+function importFromRuntimeCapsule(capsule) {
+  if (capsule?.type !== 'kdna.runtime-capsule' || capsule.profile !== 'full') {
+    throw new Error('A full Runtime Capsule is required for Studio re-import.');
+  }
+  const manifest = capsule.context?.manifest;
+  const payload = capsule.context?.payload;
+  if (!manifest || !payload) {
+    throw new Error(
+      'The Runtime Capsule does not contain current manifest and payload semantics.',
+    );
+  }
+  const imported = importFromRuntimeContent(manifest, payload);
+  if (imported.cards.length === 0) {
+    throw new Error('No current judgment cards could be re-imported.');
+  }
+  return imported;
+}
+
+const LEGACY_PATTERN_TYPE_MAP = {
+  term: 'term',
+  banned_term: 'banned_term',
+  misunderstanding: 'misunderstanding',
+  self_check: 'self_check',
+  scenario: 'scenario',
+  case: 'case',
+  reasoning: 'reasoning',
+  risk: 'risk',
+  axiom: 'axiom',
+  ontology: 'ontology',
+  framework: 'framework',
+  stance: 'stance',
+  aesthetic: 'aesthetic',
+  boundary: 'boundary',
+  evolution_stage: 'evolution_stage',
+};
+
+// Pattern subtypes that map to the generic 'pattern' card; the original
+// subtype is preserved in fields.legacy_subtype for audit and re-export.
+const LEGACY_PATTERN_SUBTYPES = new Set([
+  'failure_pattern', 'design_pattern', 'response_pattern',
+  'stopping_pattern', 'completion_pattern', 'decision_pattern',
+  'reasoning_pattern', 'action_pattern', 'recovery_pattern',
+  'responsibility_pattern',
+]);
+
+const MAX_ZIP_ENTRIES = 100;
+const MAX_SINGLE_ENTRY_UNCOMPRESSED = 10 * 1024 * 1024;
+const MAX_TOTAL_UNCOMPRESSED = 50 * 1024 * 1024;
+const REQUIRED_ZIP_ENTRIES = ['kdna.json', 'payload.kdnab', 'checksums.json', 'mimetype'];
+
+function validateZipContainer(entries) {
+  if (entries.size > MAX_ZIP_ENTRIES) {
+    fail(`ZIP container has too many entries (${entries.size}, max ${MAX_ZIP_ENTRIES})`);
+  }
+  for (const name of REQUIRED_ZIP_ENTRIES) {
+    if (!entries.has(name)) fail(`Not a valid .kdna container: missing required entry "${name}"`);
+  }
+  let totalSize = 0;
+  for (const [name, buf] of entries) {
+    if (path.isAbsolute(name) || name.includes('..') || name.includes('\\')) {
+      fail(`ZIP entry "${name}" has an unsafe path`);
+    }
+    if (Buffer.isBuffer(buf) && buf.length > MAX_SINGLE_ENTRY_UNCOMPRESSED) {
+      fail(`ZIP entry "${name}" is too large (${buf.length} bytes)`);
+    }
+    totalSize += Buffer.isBuffer(buf) ? buf.length : 0;
+  }
+  if (totalSize > MAX_TOTAL_UNCOMPRESSED) {
+    fail(`ZIP container total uncompressed size exceeds limit (${totalSize} bytes)`);
+  }
+}
+
+function judgmentCoreFromLegacyPayload(payload) {
+  const core = payload.core || {};
+  const result = {};
+  if (typeof core.highest_question === 'string' && core.highest_question) result.highest_question = core.highest_question;
+  if (Array.isArray(core.worldview) && core.worldview.length) result.worldview = core.worldview;
+  if (Array.isArray(core.value_order) && core.value_order.length) result.value_order = core.value_order;
+  if (core.judgment_role && typeof core.judgment_role === 'object' && Object.keys(core.judgment_role).length) result.judgment_role = core.judgment_role;
+  return Object.keys(result).length ? result : null;
+}
+
+function legacyStableId(type, fields, prefix) {
+  // Deterministic ID for legacy items that lack a declared id.
+  // Prefix is the parent scope (e.g. the asset name or domain id).
+  const sorted = JSON.stringify(Object.entries(fields).sort());
+  const h = require('crypto').createHash('sha256').update(`${type}:${sorted}`).digest('hex');
+  return `${prefix}_${h.slice(0, 12)}`;
+}
+
+const _legacyDedupIds = new Set();
+
+function _legacyDedupPush(cards, type, fields, id) {
+  // Deduplicate by id IF an id is declared. Items without ids are unique
+  // (deterministic by content). A second push with the same id merges.
+  if (!id) { pushImportedCard(cards, type, fields, null); return; }
+  if (_legacyDedupIds.has(id)) { pushImportedCard(cards, type, fields, id); return; }
+  _legacyDedupIds.add(id);
+  pushImportedCard(cards, type, fields, id);
+}
+
+function cardsFromLegacyPayload(payload) {
+  _legacyDedupIds.clear();
+  const cards = [];
+  const core = payload.core || {};
+
+  // axioms
+  for (const ax of (core.axioms || [])) {
+    _legacyDedupPush(cards, 'axiom', importedFields(ax), ax.id || null);
+  }
+
+  // ontology
+  for (const ont of (core.ontology || [])) {
+    pushImportedCard(cards, 'ontology', importedFields(ont), ont.id || null);
+  }
+
+  // frameworks
+  for (const fw of (core.frameworks || [])) {
+    pushImportedCard(cards, 'framework', importedFields(fw), fw.id || null);
+  }
+
+  // stances
+  for (const st of (core.stances || [])) {
+    const fields = typeof st === 'string' ? { statement: st } : importedFields(st);
+    pushImportedCard(cards, 'stance', fields, typeof st === 'object' ? st.id || null : null);
+  }
+
+  // boundaries
+  for (const bd of (core.boundaries || [])) {
+    pushImportedCard(cards, 'boundary', importedFields(bd), bd.id || null);
+  }
+
+  // risks
+  const legacyRisks = Array.isArray(core.risk_model)
+    ? core.risk_model
+    : (Array.isArray(core.risk_model?.risks) ? core.risk_model.risks : []);
+  for (const risk of legacyRisks) {
+    pushImportedCard(cards, 'risk', importedFields(risk.fields || risk), risk.id || null);
+  }
+
+  // patterns with explicit types (including legacy subtypes)
+  const patterns = payload.patterns || [];
+  for (const p of patterns) {
+    if (!p || typeof p !== 'object') continue;
+    const rawType = p.type;
+    if (!rawType) continue; // type-less items handled separately (misunderstandings below)
+
+    if (LEGACY_PATTERN_SUBTYPES.has(rawType)) {
+      pushImportedCard(cards, 'pattern', {
+        ...importedFields(p, { keepType: true }),
+        legacy_subtype: rawType,
+      }, p.id || null);
+    } else if (rawType === 'term') {
+      pushImportedCard(cards, 'term', importedFields(p), p.id || null);
+    } else if (rawType === 'banned_term') {
+      pushImportedCard(cards, 'banned_term', importedFields(p), p.id || null);
+    } else if (LEGACY_PATTERN_TYPE_MAP.hasOwnProperty(rawType)) {
+      pushImportedCard(cards, LEGACY_PATTERN_TYPE_MAP[rawType], importedFields(p), p.id || null);
+    } else {
+      fail(`Unknown legacy pattern type "${rawType}" for card "${p.id || '(no id)'}"`);
+    }
+  }
+
+  // misunderstandings: appear in patterns[] with no type and in
+  // reasoning.failure_modes[] with slightly different field names.
+  // Import from patterns[] (richer fields). The pushImportedCard
+  // dedup handles the failure_modes view via id matching.
+  for (const p of patterns) {
+    if (!p || typeof p !== 'object') continue;
+    if (p.type) continue; // already handled above
+    if (!p.wrong && !p.correct) continue;
+    pushImportedCard(cards, 'misunderstanding', importedFields(p), p.id || null);
+  }
+
+  // reasoning chains
+  for (const chain of (payload.reasoning?.reasoning_chains || [])) {
+    const fields = importedFields(chain);
+    pushImportedCard(cards, 'reasoning', fields, chain.id || null);
+  }
+
+  // self checks: array of plain strings in legacy payload
+  for (const check of (payload.reasoning?.self_check || [])) {
+    if (typeof check === 'string' && check.trim()) {
+      const fields = { question: check.trim() };
+      const id = legacyStableId('self_check', fields, 'legacy_sc');
+      pushImportedCard(cards, 'self_check', fields, id);
+    }
+  }
+
+  // scenarios
+  for (const sc of (payload.scenarios || [])) {
+    pushImportedCard(cards, 'scenario', importedFields(sc), sc.id || null);
+  }
+
+  // cases
+  for (const cs of (payload.cases || [])) {
+    pushImportedCard(cards, 'case', importedFields(cs), cs.id || null);
+  }
+
+  // evolution stages
+  for (const stage of (payload.evolution?.stages || [])) {
+    pushImportedCard(cards, 'evolution_stage', importedFields(stage), stage.id || null);
+  }
+
+  return cards;
+}
+
 /**
  * Import cards from a legacy source folder into a new Studio project.
  * Reads KDNA_*.json files and converts entries to draft judgment cards.
@@ -847,6 +1230,7 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     if (manifest.default_language) manifestData.default_language = manifest.default_language;
     if (manifest.description) manifestData.description = manifest.description;
     if (manifest.name) manifestData.name = manifest.name;
+    if (manifest.title) manifestData.title = manifest.title;
     if (manifest.keywords) manifestData.keywords = manifest.keywords;
     if (manifest.license) manifestData.license = manifest.license;
     if (manifest.author) manifestData.author = manifest.author;
@@ -887,25 +1271,17 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
 
   if (core) {
     for (const ax of (Array.isArray(core.axioms) ? core.axioms : [])) {
-      const fields = {};
+      const fields = importedFields(ax);
       for (const key of ['one_sentence', 'full_statement', 'why', 'applies_when', 'does_not_apply_when', 'failure_risk', 'confidence', 'evidence_type']) {
-        if (key in ax) fields[key] = ax[key];
-        else audit.missingFields.push(`axiom.${ax.id || '?'}.${key}`);
+        if (!(key in ax)) audit.missingFields.push(`axiom.${ax.id || '?'}.${key}`);
       }
       importedCards.push(cardApi.createCard('axiom', fields, ax.id || null));
     }
     for (const ont of (Array.isArray(core.ontology) ? core.ontology : [])) {
-      importedCards.push(cardApi.createCard('ontology', {
-        one_sentence: ont.one_sentence || ont.essence || '',
-        essence: ont.essence || '', boundary: ont.boundary || '',
-        trigger_signal: ont.trigger_signal || '',
-      }, ont.id || null));
+      importedCards.push(cardApi.createCard('ontology', importedFields(ont), ont.id || null));
     }
     for (const b of (Array.isArray(core.boundaries) ? core.boundaries : [])) {
-      importedCards.push(cardApi.createCard('boundary', {
-        scope: b.scope || '', out_of_scope: b.out_of_scope || '',
-        acceptable_exceptions: b.acceptable_exceptions || [],
-      }, b.id || null));
+      importedCards.push(cardApi.createCard('boundary', importedFields(b), b.id || null));
     }
     // Accept risks as a top-level array (`risks`) or wrapped in `risk_model`
     // (either as `{risks: [...]}` or as an array itself).
@@ -916,23 +1292,16 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
       else risksSource = [];
     }
     for (const r of risksSource) {
-      importedCards.push(cardApi.createCard('risk', r.fields || r, r.id || null));
+      importedCards.push(cardApi.createCard('risk', importedFields(r.fields || r), r.id || null));
     }
     // NEW: import stances
     for (const s of (Array.isArray(core.stances) ? core.stances : [])) {
-      const text = typeof s === 'string' ? s : s.statement || s.stance || '';
-      importedCards.push(cardApi.createCard('stance', {
-        statement: text,
-        applies_when: s.applies_when || [],
-        does_not_apply_when: s.does_not_apply_when || [],
-      }, typeof s === 'object' ? s.id || null : null));
+      const fields = typeof s === 'string' ? { statement: s } : importedFields(s);
+      importedCards.push(cardApi.createCard('stance', fields, typeof s === 'object' ? s.id || null : null));
     }
     // NEW: import frameworks
     for (const fw of (Array.isArray(core.frameworks) ? core.frameworks : [])) {
-      importedCards.push(cardApi.createCard('framework', {
-        name: fw.name || '', when_to_use: fw.when_to_use || '',
-        steps: fw.steps || [],
-      }, fw.id || null));
+      importedCards.push(cardApi.createCard('framework', importedFields(fw), fw.id || null));
     }
   }
 
@@ -940,27 +1309,25 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     // NEW: import terminology
     if (patterns.terminology) {
       for (const t of (Array.isArray(patterns.terminology.standard_terms) ? patterns.terminology.standard_terms : [])) {
-        importedCards.push(cardApi.createCard('term', {
-          term: t.term || '', definition: t.definition || '',
-        }, t.id || null));
+        importedCards.push(cardApi.createCard('term', importedFields(t), t.id || null));
       }
       for (const bt of (Array.isArray(patterns.terminology.banned_terms) ? patterns.terminology.banned_terms : [])) {
-        importedCards.push(cardApi.createCard('banned_term', {
-          term: bt.term || '', why: bt.why || '', replace_with: bt.replace_with || '',
-        }, bt.id || null));
+        importedCards.push(cardApi.createCard('banned_term', importedFields(bt), bt.id || null));
       }
     }
+    for (const pattern of (Array.isArray(patterns.patterns) ? patterns.patterns : [])) {
+      const fields = importedFields(pattern, { keepType: true });
+      if (!fields.type) fields.type = 'pattern';
+      importedCards.push(cardApi.createCard('pattern', fields, pattern.id || null));
+    }
     for (const ms of (Array.isArray(patterns.misunderstandings) ? patterns.misunderstandings : [])) {
-      importedCards.push(cardApi.createCard('misunderstanding', {
-        wrong: ms.wrong || '', correct: ms.correct || '',
-        key_distinction: ms.key_distinction || '', why: ms.why || '',
-      }, ms.id || null));
+      importedCards.push(cardApi.createCard('misunderstanding', importedFields(ms), ms.id || null));
     }
     for (const sc of (Array.isArray(patterns.self_check) ? patterns.self_check : [])) {
-      const q = typeof sc === 'string' ? sc : sc.question || '';
+      const fields = typeof sc === 'string' ? { question: sc } : importedFields(sc);
       importedCards.push(cardApi.createCard(
         'self_check',
-        { question: q },
+        fields,
         typeof sc === 'object' ? sc.id || null : null,
       ));
     }
@@ -973,7 +1340,7 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     for (const aesthetic of (Array.isArray(patterns.aesthetics) ? patterns.aesthetics : [])) {
       importedCards.push(cardApi.createCard(
         'aesthetic',
-        aesthetic.fields || aesthetic,
+        importedFields(aesthetic.fields || aesthetic),
         aesthetic.id || null,
       ));
     }
@@ -982,20 +1349,14 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
   // NEW: import scenarios
   if (scenarios && Array.isArray(scenarios.scenes)) {
     for (const scene of scenarios.scenes) {
-      importedCards.push(cardApi.createCard('scenario', {
-        name: scene.name || scene.id || '',
-        trigger: scene.trigger || '', action: scene.action || '',
-      }, scene.id || null));
+      importedCards.push(cardApi.createCard('scenario', importedFields(scene), scene.id || null));
     }
   }
 
   // NEW: import cases
   if (cases && Array.isArray(cases.cases)) {
     for (const c of cases.cases) {
-      importedCards.push(cardApi.createCard('case', {
-        title: c.title || c.id || '',
-        scenario: c.scenario || '', expected: c.expected || '',
-      }, c.id || null));
+      importedCards.push(cardApi.createCard('case', importedFields(c), c.id || null));
     }
   }
 
@@ -1008,26 +1369,14 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
   // identity.
   if (reasoning && Array.isArray(reasoning.reasoning_chains)) {
     for (const rc of reasoning.reasoning_chains) {
-      importedCards.push(cardApi.createCard('reasoning', {
-        axiom: rc.axiom || '',
-        one_sentence: rc.one_sentence || rc.conclusion || '',
-        chain: Array.isArray(rc.chain) ? rc.chain : (rc.logic || []),
-        principle: rc.principle || rc.name || '',
-        concrete_action: rc.concrete_action || rc.so_what || '',
-        so_what: rc.so_what || rc.concrete_action || '',
-        conclusion: rc.conclusion || '',
-      }, rc.id || null));
+      importedCards.push(cardApi.createCard('reasoning', importedFields(rc), rc.id || null));
     }
   }
 
   // NEW: import evolution stages
   if (evolution && Array.isArray(evolution.stages)) {
     for (const stage of evolution.stages) {
-      pushImportedCard(importedCards, 'evolution_stage', {
-        name: stage.name || stage.id || '',
-        level: stage.level != null ? stage.level : '',
-        description: stage.description || '',
-      }, stage.id || null);
+      pushImportedCard(importedCards, 'evolution_stage', importedFields(stage), stage.id || null);
     }
   }
 
@@ -1038,6 +1387,7 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     sourcePath: absSource,
     creatorIdentity: creatorIdentity || null,
     lineage: { type: 'migrated', parent_name: manifestData.name || null, parent_asset_uid: null, parent_version: manifestData.version || null, parent_asset_digest: null },
+    judgmentCore: judgmentCoreFromLegacyPayload({ core: core || {} }),
   });
   // Preserve manifest metadata
   if (manifestData.asset_uid) project.asset_uid = manifestData.asset_uid;
@@ -1053,11 +1403,18 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     if (!project.release) project.release = {};
     project.release.description = manifestData.description;
   }
+  if (manifestData.title) project.title = manifestData.title;
   if (manifestData.license) project.license = manifestData.license;
   if (manifestData.author) project.author = manifestData.author;
   if (manifestData.languages) project.languages = manifestData.languages;
   if (manifestData.default_language) project.default_language = manifestData.default_language;
   if (manifestData.raw) project.source_manifest = publicManifestMetadata(manifestData.raw);
+  if (patterns) project.source_patterns = JSON.parse(JSON.stringify(patterns));
+  if (reasoning) project.source_reasoning = JSON.parse(JSON.stringify(reasoning));
+  if (evolution) project.source_evolution = JSON.parse(JSON.stringify(evolution));
+  if (Array.isArray(core?.core_structure)) {
+    project.source_core_structure = JSON.parse(JSON.stringify(core.core_structure));
+  }
 
   project.cards = importedCards;
   if (project.stages?.judgment_cards) {
@@ -1074,10 +1431,12 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
 }
 
 /**
- * Minimal ZIP central directory parser — reads entries into a Map.
+ * Minimal ZIP central directory parser — validates every entry before decompressing.
  */
 function readZipEntries(buf) {
   const entries = new Map();
+  const metadata = [];
+
   // Find end-of-central-directory record
   let eocdOffset = buf.length - 22;
   while (eocdOffset >= 0) {
@@ -1089,6 +1448,8 @@ function readZipEntries(buf) {
   const centralDirOffset = buf.readUInt32LE(eocdOffset + 16);
   let offset = centralDirOffset;
 
+  // Pass 1: collect metadata, validate safety before any decompression
+  let totalUncomp = 0;
   while (offset < eocdOffset) {
     const sig = buf.readUInt32LE(offset);
     if (sig !== 0x02014b50) break;
@@ -1101,20 +1462,47 @@ function readZipEntries(buf) {
     const localOffset = buf.readUInt32LE(offset + 42);
     const name = buf.toString('utf8', offset + 46, offset + 46 + nameLen);
 
-    // Read local file header to get data
-    const localNameLen = buf.readUInt16LE(localOffset + 26);
-    const localExtraLen = buf.readUInt16LE(localOffset + 28);
-    const dataStart = localOffset + 30 + localNameLen + localExtraLen;
-
-    if (compMethod === 0) {
-      entries.set(name, buf.subarray(dataStart, dataStart + uncompSize));
-    } else if (compMethod === 8) {
-      entries.set(name, zlib.inflateRawSync(buf.subarray(dataStart, dataStart + compSize)));
+    // Security: path must not be absolute, must not escape
+    if (!name || name.startsWith('/') || name.includes('..') || name.includes('\\')) {
+      throw new Error(`ZIP entry "${name}" has an unsafe path`);
     }
-
+    // Duplicate detection
+    if (entries.has(name) || metadata.some(m => m.name === name)) {
+      throw new Error(`Duplicate ZIP entry: "${name}"`);
+    }
+    if (compMethod !== 0 && compMethod !== 8) {
+      throw new Error(`ZIP entry "${name}" uses unsupported compression method ${compMethod}`);
+    }
+    totalUncomp += uncompSize;
+    if (totalUncomp > MAX_TOTAL_UNCOMPRESSED) {
+      throw new Error(`ZIP total uncompressed size ${totalUncomp} exceeds limit`);
+    }
+    if (uncompSize > MAX_SINGLE_ENTRY_UNCOMPRESSED) {
+      throw new Error(`ZIP entry "${name}" declared size ${uncompSize} exceeds limit`);
+    }
+    const dataStart = localOffset + 30 + buf.readUInt16LE(localOffset + 26) + buf.readUInt16LE(localOffset + 28);
+    metadata.push({ name, compMethod, compSize, uncompSize, dataStart });
     offset += 46 + nameLen + extraLen + commentLen;
   }
 
+  if (metadata.length > MAX_ZIP_ENTRIES) {
+    throw new Error(`ZIP container has too many entries (${metadata.length}, max ${MAX_ZIP_ENTRIES})`);
+  }
+
+  // Pass 2: decompress into entries
+  for (const m of metadata) {
+    if (m.compMethod === 0) {
+      entries.set(m.name, buf.subarray(m.dataStart, m.dataStart + m.uncompSize));
+    } else {
+      const raw = buf.subarray(m.dataStart, m.dataStart + m.compSize);
+      const inflated = zlib.inflateRawSync(raw, { maxOutputLength: m.uncompSize });
+      if (inflated.length !== m.uncompSize) {
+        throw new Error(`ZIP entry "${m.name}" decompressed length ${inflated.length} != declared ${m.uncompSize}`);
+      }
+      entries.set(m.name, inflated);
+    }
+  }
+
   return entries;
 }
 
@@ -1535,7 +1923,7 @@ function cmdCard(args) {
         const passphrase = resolvePassphrase(args);
         try {
           if (identity.encrypted && !passphrase) {
-            errors.push(`${card.id}: Private key is encrypted — provide --passphrase-stdin or KDNA_PASSPHRASE`);
+            errors.push(`${card.id}: Private key is encrypted — provide --passphrase-stdin`);
             return null;
           }
           lockPayload.signature = creatorApi.signHumanLock(
@@ -1656,7 +2044,7 @@ function cmdMigrate(args) {
   const requestedName = option(args, '--name');
   let name = requestedName || path.basename(path.resolve(sourceDir || '.'));
   if (!sourceDir || (!out && !checkOnly) || (!by && !checkOnly) || (!statement && !checkOnly)) {
-    fail('Usage: kdna-studio migrate <source-dir> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--check] [--sign] [--passphrase <pw>|--passphrase-stdin]');
+    fail('Usage: kdna-studio migrate <source-dir> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--check] [--sign] [--passphrase-stdin]');
   }
 
   const sourcePath = path.resolve(sourceDir);
@@ -1676,7 +2064,16 @@ function cmdMigrate(args) {
   try {
   // Step 1: import dev source, or use an existing Studio project directly.
   let creatorIdentity = null;
-  try { creatorIdentity = creatorApi.loadIdentity(); } catch { /* proceed without */ }
+  if (args.includes('--use-local-identity')) {
+    try {
+      creatorIdentity = creatorApi.loadIdentity();
+    } catch {
+      fail(
+        '--use-local-identity was requested, but no usable local identity is available.',
+        EXIT.TRUST_FAILED,
+      );
+    }
+  }
   if (isStudioProject) {
     const loaded = readProject(sourcePath);
     project = loaded.project;
@@ -1887,20 +2284,21 @@ function cmdExport(args) {
     fail('The --format option is not supported. KDNA has one current asset format.');
   }
   if (args.includes('--sign')) {
-    fail('Asset signing is a separate runtime step. Export first, then run: kdna sign <asset.kdna>');
+    fail('Asset signatures are outside the current Preview contract.');
   }
   {
     const { project } = readProject(projectInput);
-    // BUG-11 (2026-06-27): previous logic required --password to be set
-    // before --password-stdin would take effect. That meant callers using
-    // `--password-stdin` alone (the recommended path) got `password = null`
-    // and the export ran unencrypted. Resolve the two flags independently:
-    //   - --password-stdin  → read password from stdin (preferred)
-    //   - --password <pw>   → take password from the flag (insecure)
-    //   - --passphrase <pw> → legacy alias for --password
-    // If both are given, --password-stdin wins (it is the explicit intent).
-    // Use args.includes() for --password-stdin since it is a boolean flag
-    // (option() rejects it for "missing value").
+    if (
+      args.includes('--password') ||
+      args.some((arg) => arg.startsWith('--password=')) ||
+      args.includes('--passphrase') ||
+      args.some((arg) => arg.startsWith('--passphrase='))
+    ) {
+      fail(
+        'Password and passphrase values in process arguments are not supported. ' +
+        'Use --password-stdin.'
+      );
+    }
     const useStdin = args.includes('--password-stdin');
     let password;
     if (useStdin) {
@@ -1910,25 +2308,15 @@ function cmdExport(args) {
       if (process.stdin.isTTY) {
         fail(
           '--password-stdin requires the password to be piped in on stdin.\n' +
-          'Example:  echo "$KDNA_PASSWORD" | kdna-studio export <project> --out <file.kdna> --password-stdin\n' +
+          'Example:  printf "%s\\n" "$KDNA_PASSWORD" | kdna-studio export <project> --out <file.kdna> --password-stdin\n' +
           'If you are running interactively, omit --password-stdin and you will be prompted.'
         );
       }
       try {
-        password = fs.readFileSync(0, 'utf8').trim();
+        password = readBoundedSecretStdin('Password');
       } catch (e) {
         fail(`Could not read password from stdin: ${e.message}`);
       }
-    } else {
-      // Bug (#55): prior version only consulted --password / --passphrase
-      // here, so a caller who set KDNA_PASSPHRASE for the signing path
-      // (works via resolvePassphrase) found that the runtime encryption
-      // password was silently null. Resolve from the same sources as
-      // the signing path so the two stay in sync.
-      password = process.env.KDNA_PASSPHRASE
-        || process.env.KDNA_PASSWORD
-        || option(args, '--password')
-        || option(args, '--passphrase');
     }
     exportProject(project, option(args, '--name') || project.name, path.resolve(out), {
       allowIncomplete: args.includes('--allow-incomplete'),
@@ -1944,7 +2332,9 @@ function cmdStudioInstall(args) {
   if (!target) fail('Usage: kdna-studio install <@scope/name|file.kdna>');
   try {
     const kdnaArgs = ['install', target, '--yes'];
-    if (args.includes('--trusted')) kdnaArgs.push('--trusted');
+    if (args.includes('--trusted')) {
+      fail('Asset signatures are outside the current Preview contract.');
+    }
     const result = require('child_process').spawnSync('kdna', kdnaArgs, {
       stdio: 'inherit', encoding: 'utf8',
     });
@@ -1998,6 +2388,77 @@ function cmdLlm(args) {
   fail('Usage: kdna-studio llm <config|show>');
 }
 
+// initIdentity fails for several distinct reasons and each needs a different
+// user message. A catch-all "Identity already exists." would lie about path
+// (ENOTDIR/ENOENT), permission (EACCES/EPERM), write, and KDF failures and
+// would send the user to `identity show`, which then reports no identity.
+function failIdentityInit(err) {
+  const code = err && err.code;
+  // Identity state is classified only by Studio Core's stable machine codes
+  // (or by stable OS error codes). Human-readable error text is diagnostic
+  // material, never a state oracle.
+  if (code === 'IDENTITY_ALREADY_EXISTS') {
+    fail(
+      `Identity already exists [${code}] and passed consistency verification. `
+      + "Use 'kdna-studio identity show' to view it."
+    );
+  }
+  if (code === 'IDENTITY_INCOMPLETE') {
+    fail(
+      `Identity is incomplete [${code}]: only part of the canonical three-file identity exists. `
+      + 'No existing file was changed or removed. Preserve the files and recover the identity manually.'
+    );
+  }
+  if (code === 'IDENTITY_CORRUPT') {
+    fail(
+      `Identity is corrupt [${code}]: all canonical files exist but failed consistency verification. `
+      + 'Do not sign with or use this identity. Preserve the files and recover from a trusted backup.'
+    );
+  }
+  if (code === 'IDENTITY_COMMITTED_DURABILITY_UNCONFIRMED'
+      && err.committed === true && err.identityVerified === true) {
+    fail(
+      `Identity committed, durability unconfirmed [${code}]: your identity was created, `
+      + 'but confirming it is fully durable on disk failed.\n'
+      + 'Do NOT re-run `kdna-studio identity init`.\n'
+      + '  1. Verify the identity with: kdna-studio identity show\n'
+      + '  2. Back up your private key promptly.'
+    );
+  }
+  if (code === 'IDENTITY_COMMITTED_INCONSISTENT') {
+    fail(
+      `Identity committed but inconsistent [${code}]: files reached the canonical identity directory, `
+      + 'but they did not pass post-commit consistency verification.\n'
+      + 'Do NOT sign with, show as valid, delete, or automatically retry this identity.\n'
+      + 'Preserve and restrict access to the directory, then recover from a trusted backup or have an '
+      + 'administrator inspect all three files.'
+    );
+  }
+  if (code === 'IDENTITY_COMMITTED_DURABILITY_UNCONFIRMED') {
+    fail(
+      'Identity init returned an invalid committed-state result '
+      + `[${code}]: verified identity evidence is missing. Do not retry or use the identity; recover manually.`
+    );
+  }
+  if (code === 'ENOTDIR' || code === 'ENOENT') {
+    fail(`Identity init failed — the identity path is not usable [${code}].`);
+  }
+  if (code === 'EACCES' || code === 'EPERM') {
+    fail(`Identity init failed — permission denied [${code}].`);
+  }
+  if (code === 'ENOSPC') {
+    fail(`Identity init failed — storage is full [${code}]. No identity was committed.`);
+  }
+  if (code === 'EIO') {
+    fail(`Identity init failed — storage I/O failed [${code}]. Do not assume an identity was created.`);
+  }
+  if (code === 'IDENTITY_KDF_FAILED') {
+    fail(`Identity init failed — key derivation failed [${code}]. No identity was committed.`);
+  }
+  const displayCode = typeof code === 'string' && /^[A-Z0-9_]+$/.test(code) ? code : 'UNKNOWN';
+  fail(`Identity init failed [${displayCode}]. No recognized identity state was reported.`);
+}
+
 function cmdIdentity(args) {
   const sub = args[0];
   if (sub === 'init') {
@@ -2016,7 +2477,7 @@ function cmdIdentity(args) {
         console.log(`  Private key is encrypted — keep your passphrase safe.`);
       }
     } catch (err) {
-      fail(`Identity already exists. Use 'kdna-studio identity show' to view. ${err.message}`);
+      failIdentityInit(err);
     }
     return;
   }
@@ -2034,22 +2495,14 @@ function cmdIdentity(args) {
   fail('Usage: kdna-studio identity <init|show>');
 }
 
-function cmdReport(args) {
-  const { project } = readProject(args[0]);
-  const readiness = quality.computeReadiness(project);
-  const gate = projectApi.checkHumanLockGate(project);
-  console.log(JSON.stringify({ readiness, human_lock_gate: gate }, null, 2));
-  process.exit(gate.blocked ? EXIT.HUMAN_LOCK_REQUIRED : EXIT.OK);
-}
-
 // Audit-locks: list every card that would fail the current Human Lock
 // gate because of missing or empty fields. Used during the
 // pre-migration review of source-tree assets (e.g. pro-20) so an
 // author can fill in the missing confidence / evidence_type / risk
 // description / stance statement BEFORE running `migrate`.
 //
-// Bug (UX pro-20 migration): prior version of `kdna-studio report`
-// returned a flat human_lock_gate.issues list, which mixed card
+// The earlier readiness output returned a flat human_lock_gate.issues list,
+// which mixed card
 // types and field names. An author migrating 20 source-tree
 // assets with 99 axioms + 140 risk cards + 70 stance cards had no
 // way to see, for a single asset, "which axioms are missing
@@ -2311,6 +2764,16 @@ async function cmdDistill(args) {
       suggested_card_type: c.type || c.suggested_card_type || 'axiom',
       supporting_evidence_ids: (c.evidence_ids || c.evidenceIds || c.supporting_evidence_ids || []).map(String),
       confidence: c.confidence || 'medium',
+      rationale: c.rationale || c.why || '',
+      applies_when: Array.isArray(c.applies_when) ? c.applies_when.map(String) : [],
+      does_not_apply_when: Array.isArray(c.does_not_apply_when)
+        ? c.does_not_apply_when.map(String)
+        : [],
+      misuse_risk: c.misuse_risk || c.failure_risk || '',
+      agent_inference: c.agent_inference === true,
+      fields: c.fields && typeof c.fields === 'object' && !Array.isArray(c.fields)
+        ? JSON.parse(JSON.stringify(c.fields))
+        : {},
       candidate_status: 'proposed',
       scope_fit: c.scope_fit ?? c.scopeFit ?? true,
     };
@@ -2369,36 +2832,68 @@ function cmdCandidate(args) {
   }
 
   if (sub === 'promote') {
-    const accepted = candidates.filter(c => c.candidate_status === 'accepted' && c.scope_fit !== false);
+    const accepted = candidates.filter(
+      c =>
+        c.candidate_status === 'accepted' &&
+        c.scope_fit !== false &&
+        !c.promoted_card_id,
+    );
     if (accepted.length === 0) fail('No candidates to promote. Accept some candidates first.');
 
+    const incomplete = [];
+    for (const candidate of accepted) {
+      const missing = [];
+      if (!String(candidate.one_sentence || '').trim()) missing.push('one_sentence');
+      if (!String(candidate.full_statement || '').trim()) missing.push('full_statement');
+      if (!String(candidate.rationale || candidate.why || '').trim()) missing.push('rationale');
+      if (!Array.isArray(candidate.applies_when) || candidate.applies_when.length === 0) {
+        missing.push('applies_when');
+      }
+      if (
+        !Array.isArray(candidate.does_not_apply_when) ||
+        candidate.does_not_apply_when.length === 0
+      ) {
+        missing.push('does_not_apply_when');
+      }
+      if (!String(candidate.misuse_risk || candidate.failure_risk || '').trim()) {
+        missing.push('misuse_risk');
+      }
+      if (missing.length > 0) incomplete.push(`${candidate.id}: ${missing.join(', ')}`);
+    }
+    if (incomplete.length > 0) {
+      fail(
+        `Accepted candidates are incomplete and were not promoted:\n  - ${incomplete.join(
+          '\n  - ',
+        )}\nRefine or re-distill them before promotion.`,
+      );
+    }
+
     for (const c of accepted) {
-      // Promote candidates to draft cards. For axioms we must populate every
-      // field the Human Lock gate and migrate path require — empty strings
-      // cause migrate to fail ("critical fields missing from axioms"). When
-      // a candidate lacks the field, fall back to the candidate's own
-      // one_sentence/full_statement so the lock gate at least has substance
-      // to verify. Authors are expected to enrich these fields before
-      // locking.
-      const fields = {};
+      // Candidate review is the place to resolve missing semantics. Promotion
+      // preserves the reviewed fields and never fabricates placeholder text.
+      const fields = {
+        ...(c.fields && typeof c.fields === 'object' ? c.fields : {}),
+        one_sentence: c.one_sentence,
+        full_statement: c.full_statement,
+        rationale: c.rationale || c.why,
+        applies_when: c.applies_when,
+        does_not_apply_when: c.does_not_apply_when,
+        misuse_risk: c.misuse_risk || c.failure_risk,
+        confidence: c.confidence || 'unknown',
+        evidence_type: c.agent_inference === true ? 'analogy' : 'practice',
+        agent_inference: c.agent_inference === true,
+      };
       if (c.suggested_card_type === 'axiom') {
-        fields.one_sentence = c.one_sentence || '';
-        fields.full_statement = c.full_statement || c.one_sentence || '<TBD: full_statement>';
-        fields.why = c.why || '<TBD: why>';
-        // applies_when / does_not_apply_when are arrays, not strings.
-        // Empty string is invalid; emit an empty array so checkRequiredFields
-        // (which treats `length === 0` as missing) correctly reports them.
-        fields.applies_when = Array.isArray(c.applies_when) ? c.applies_when : [];
-        fields.does_not_apply_when = Array.isArray(c.does_not_apply_when) ? c.does_not_apply_when : [];
-        fields.failure_risk = c.failure_risk || '<TBD: failure_risk>';
-      } else {
-        fields.one_sentence = c.one_sentence || '';
-        fields.full_statement = c.full_statement || c.one_sentence || '';
+        fields.why = c.rationale || c.why;
+        fields.failure_risk = c.misuse_risk || c.failure_risk;
       }
       const card = cardApi.createCard(c.suggested_card_type, fields);
-      card.evidence_refs = c.supporting_evidence_ids;
+      card.evidence_refs = Array.isArray(c.supporting_evidence_ids)
+        ? c.supporting_evidence_ids
+        : [];
       project.cards = project.cards || [];
       project.cards.push(card);
+      c.promoted_card_id = card.id;
     }
     if (project.stages?.judgment_cards) {
       project.stages.judgment_cards.total = project.cards.length;
@@ -2416,175 +2911,46 @@ async function cmdInterview(args) {
   const projectInput = args[0];
   const stage = option(args, '--stage');
   if (!projectInput) fail('Usage: kdna-studio interview <project> [--stage distill|clarify|correct|replay]');
-  const { project } = readProject(projectInput);
+  const { projectPath, project } = readProject(projectInput);
+  let results;
 
   if (stage) {
-    const result = await ai.interview.runInterview(llm.config(), project, stage, '', {});
+    const normalizedStage = ai.interview.normalizeInterviewStage(stage);
+    const result = await ai.interview.runInterview(
+      llm.config(),
+      project,
+      normalizedStage,
+      '',
+      {},
+    );
+    results = [result];
     console.log(`\n=== ${result.label} ===\n${result.content}`);
   } else {
-    await ai.interview.runInterviewInteractive(llm.config(), project, {});
+    results = await ai.interview.runInterviewInteractive(llm.config(), project, {});
   }
-}
-
-async function cmdFeynman(args) {
-  const projectInput = args[0];
-  const cardId = args[1];
-  if (!projectInput || !cardId) fail('Usage: kdna-studio feynman <project> <card-id>');
-  const useJson = args.includes('--json');
-  const { projectPath, project } = readProject(projectInput);
-  const cardIdx = (project.cards || []).findIndex(c => c.id === cardId);
-  if (cardIdx < 0) fail(`Card not found: ${cardId}`);
-  const card = project.cards[cardIdx];
-
-  // Canonical field name in the card schema is `feynman_restatement`, not
-  // `feynman_text`. The old check was dead code (nothing writes the wrong
-  // field) and made this command fail on every card.
-  //
-  // Bug (#62 + #68 follow-up): the prior `if (!card.feynman_restatement)
-  // fail(...)` block rejected every card that had no human-written
-  // restatement, even when the AI evaluator in feynman.js was
-  // prepared to auto-synthesise one. A caller without a configured
-  // LLM (no `KDNA_API_KEY`, no `kdna-studio llm config`) would
-  // get a `fail` instead of a structured note. The fix removes the
-  // guard: a missing restatement is now handed off to the evaluator
-  // (which either asks the LLM to evaluate a synthesised one or,
-  // without an LLM, returns a structured `synthesised_restatement`
-  // for the caller to use as a starting point). The error message
-  // is kept as a secondary path: only if the evaluator itself fails
-  // does the command exit non-zero, and only then with a clear
-  // pointer to the manual `card update` path.
-  //
-  // We do still need a restatement-shaped object to feed the
-  // evaluator, so we synthesise one in-memory when the card has
-  // none. This does NOT persist the synthesised restatement to the
-  // project (so the user still has to opt in via `card update` to
-  // keep one across runs), but it lets the no-LLM path return a
-  // useful result instead of a hard fail.
-  if (!card.feynman_restatement) {
-    const synthesised = ai.feynman.synthFeynmanRestatement(card.fields || {});
-    card.feynman_restatement = { text: synthesised, synthesised: true };
-    console.warn(`No feynman_restatement on ${cardId}; using synthesised:\n  "${synthesised}"`);
-  }
-
-  if (!useJson) console.log(`Evaluating Feynman restatement for card: ${cardId}`);
-
-  // Bug (#1 UX follow-up): if no LLM is configured and the caller
-  // did not pass --no-llm, route through cmdNeedsLlm which either
-  // gives a clear "configure LLM" error or accepts the --no-llm
-  // path. Without this branch, the no-LLM caller would fall
-  // through to the LLM call below and get a stack trace.
-  const llmGate = cmdNeedsLlm(args, 'feynmann');
-
-  let result;
-  if (llmGate.noLlm) {
-    // Static evaluation: every criterion is "unsure" (✗), score 0,
-    // but the command still produces a useful structured result and
-    // saves the synthesised restatement to the card.
-    result = {
-      score: 0,
-      criteria: Object.fromEntries(Object.keys(ai.feynman.CRITERIA).map(k => [k, false])),
-      explanations: { noLlm: llmGate.message },
-      suggestions: [
-        'No LLM configured — every criterion shows ✗. Run `kdna-studio llm config` and re-evaluate for a real score.',
-        'Or set the synthesised restatement via: kdna-studio card update <project> ' + cardId + ' --field feynman_restatement=\'{"text":"<your own restatement>"}\'',
-      ],
-    };
-  } else {
-    result = await ai.feynman.evaluate(llmGate.cfg, card, {});
-  }
-  const score = result.score || 0;
-  const passed = score >= 4;
-
-  if (useJson) {
-    console.log(JSON.stringify({
-      card_id: cardId,
-      score,
-      passed,
-      no_llm: !!llmGate.noLlm,
-      criteria: result.criteria || {},
-      suggestions: result.suggestions || [],
-      feynman_restatement: card.feynman_restatement,
-    }, null, 2));
-  } else {
-    console.log(`Score: ${score}/5 ${passed ? '✓ publishable' : '✗ below threshold (need 4/5)'}${llmGate.noLlm ? '  (--no-llm: static result)' : ''}`);
-    for (const [criterion, desc] of Object.entries(ai.feynman.CRITERIA)) {
-      const r = (result.criteria || {})[criterion] ? '✓' : '✗';
-      console.log(`  ${r} ${criterion}`);
-    }
-    if (result.suggestions && result.suggestions.length > 0) {
-      console.log('\nSuggestions:');
-      result.suggestions.forEach(s => console.log(`  - ${s}`));
-    }
+  project.interview_sessions = Array.isArray(project.interview_sessions)
+    ? project.interview_sessions
+    : [];
+  project.interview_sessions.push({
+    recorded_at: new Date().toISOString(),
+    results,
+  });
+  if (project.stages?.interview_room) {
+    project.stages.interview_room.status = 'in_progress';
+    project.stages.interview_room.questions_asked =
+      Number(project.stages.interview_room.questions_asked || 0) +
+      results.reduce(
+        (total, result) =>
+          total +
+          (Array.isArray(result.conversation)
+            ? result.conversation.filter(message => message.role === 'user').length
+            : 1),
+        0,
+      );
   }
-
-  card.feynman_evaluation = { score, criteria: result.criteria, suggestions: result.suggestions, evaluated_at: new Date().toISOString() };
-  project.cards[cardIdx] = card;
   writeProject(projectPath, project);
 }
 
-async function cmdTest(args) {
-  const projectInput = args[0];
-  const input = option(args, '--input');
-  const preset = option(args, '--preset', 'baseline');
-  if (!projectInput || !input) fail('Usage: kdna-studio test <project> --input "<text>" [--preset baseline|edge|contradiction]');
-  const { project } = readProject(projectInput);
-  const domainName = project.name || 'Untitled Project';
-  const domainPrompt = `Domain: ${domainName}\n${project.description || ''}`;
-
-  // Bug (#50): prior version hand-rolled the prompt for the 3 preset
-  // names and bypassed ai.testlab.testPreset entirely. The exported
-  // testPreset function was dead code, and the help text advertised
-  // names (baseline / edge / contradiction) that did not match the
-  // actual preset keys in testlab.js (baseline / edge_case /
-  // contradiction). Result: --preset edge silently ran the
-  // contradiction branch, and any caller that asked for "edge_case"
-  // fell through to the contradiction branch too.
-  //
-  // The fix routes the call through testPreset when a known preset is
-  // given, and accepts both help-text names (baseline / edge /
-  // contradiction) and the canonical testlab names (baseline / edge_case
-  // / contradiction).
-  const PRESET_ALIASES = {
-    baseline: 'baseline',
-    edge: 'edge_case',
-    edge_case: 'edge_case',
-    contradiction: 'contradiction',
-  };
-  const canonical = PRESET_ALIASES[preset] || 'baseline';
-  console.log(`Testing: ${domainName} [${preset}]`);
-
-  // Bug (#1 UX): gate LLM-requiring paths through cmdNeedsLlm.
-  // The test command always needs an LLM (it compares without/with
-  // the loaded domain). --no-llm gives a static "no-op" comparison
-  // that lists the cards that *would* be applied.
-  const llmGate = cmdNeedsLlm(args, 'test');
-  const cfg = llmGate.noLlm ? null : llmGate.cfg;
-
-  if (canonical === 'baseline') {
-    // Baseline is a single comparison: keep the prior single-result
-    // shape so existing parsers / consumers see the same output.
-    const prompt = `Test the core judgment: ${input}`;
-    if (cfg === null) {
-      // No-LLM static result
-      const cards = (project.cards || []).filter(c => c.locked).map(c => ({ type: c.type, id: c.id, one_sentence: c.fields?.one_sentence || c.fields?.question || '' }));
-      console.log(JSON.stringify({ no_llm: true, message: llmGate.message, would_apply: cards }, null, 2));
-      return;
-    }
-    const result = await ai.testlab.compare(cfg, domainName, prompt, domainPrompt, {});
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  // For non-baseline presets, run the preset + the baseline so the user
-  // can see both side by side. The preset prompt is the one in
-  // ai/testlab.js — that's the code path that was dead before.
-  if (cfg === null) {
-    console.log(JSON.stringify({ no_llm: true, message: llmGate.message }, null, 2));
-    return;
-  }
-  const result = await ai.testlab.testPreset(cfg, domainName, input, domainPrompt, {});
-  console.log(JSON.stringify(result[canonical] || result, null, 2));
-}
-
 const args = process.argv.slice(2);
 const cmd = args[0];
 if (!cmd || cmd === '--help' || cmd === '-h') {
@@ -2598,7 +2964,23 @@ if (cmd === '--version' || cmd === '-v') {
 
 (async () => {
 try {
-  if (cmd === 'create') cmdCreate(args.slice(1));
+  if (CREATION_COMMANDS.has(cmd)) {
+    const runtimeCore = require('@aikdna/kdna-core');
+    await executeCreationCommand(cmd, args.slice(1), {
+      creationEngine,
+      runtimeCore,
+      exportRuntime: creationExportRuntime || exportRuntime,
+      reimportCapsule: importFromRuntimeCapsule,
+      cliVersion:
+        `@aikdna/kdna-studio-cli@${require('../package.json').version}`,
+      studioCoreVersion:
+        creationStudioCoreCoordinate ||
+        `@aikdna/kdna-studio-core@${require('@aikdna/kdna-studio-core/package.json').version}`,
+      runtimeCoreVersion:
+        `@aikdna/kdna-core@${require('@aikdna/kdna-core/package.json').version}`,
+    });
+  }
+  else if (cmd === 'create') cmdCreate(args.slice(1));
   else if (cmd === 'migrate') cmdMigrate(args.slice(1));
   else if (cmd === 'import') cmdImport(args.slice(1));
   else if (cmd === 'filter') cmdFilter(args.slice(1));
@@ -2607,15 +2989,12 @@ try {
   else if (cmd === 'distill') await cmdDistill(args.slice(1));
   else if (cmd === 'candidate') cmdCandidate(args.slice(1));
   else if (cmd === 'interview') await cmdInterview(args.slice(1));
-  else if (cmd === 'feynman') await cmdFeynman(args.slice(1));
-  else if (cmd === 'test') await cmdTest(args.slice(1));
   else if (cmd === 'card') cmdCard(args.slice(1));
   else if (cmd === 'lock') cmdLock(args.slice(1));
   else if (cmd === 'compile') cmdCompile(args.slice(1));
   else if (cmd === 'export') cmdExport(args.slice(1));
   else if (cmd === 'llm') cmdLlm(args.slice(1));
   else if (cmd === 'identity') cmdIdentity(args.slice(1));
-  else if (cmd === 'report') cmdReport(args.slice(1));
   else if (cmd === 'audit-locks') cmdAuditLocks(args.slice(1));
   else if (cmd === 'install') cmdStudioInstall(args.slice(1));
   else if (cmd === 'update') cmdStudioUpdate(args.slice(1));