@aikdna/kdna-studio-cli 0.10.2 → 0.11.0

package/bin/kdna-studio.js

@@ -3,18 +3,109 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
+
 const zlib = require('zlib');
 const cbor = require('cbor-x');
 const { execFileSync } = require('child_process');
 
+function deterministicSourceDigest(paths) {
+  const files = [];
+  function visit(target, root) {
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink()) {
+      throw new Error('Studio Core source checkout contains a symbolic link.');
+    }
+    if (stat.isFile()) {
+      files.push({ target, relative: path.relative(root, target) });
+      return;
+    }
+    if (!stat.isDirectory()) return;
+    for (const entry of fs.readdirSync(target).sort()) {
+      visit(path.join(target, entry), root);
+    }
+  }
+  for (const target of paths) {
+    const absolute = path.resolve(target);
+    visit(absolute, path.dirname(absolute));
+  }
+  files.sort((left, right) => left.relative.localeCompare(right.relative));
+  const hash = crypto.createHash('sha256');
+  for (const file of files) {
+    hash.update(file.relative);
+    hash.update('\0');
+    hash.update(fs.readFileSync(file.target));
+    hash.update('\0');
+  }
+  return `sha256:${hash.digest('hex')}`;
+}
+
 function loadStudioCore() {
   const publishedCore = require('@aikdna/kdna-studio-core');
-  if (publishedCore.exportRuntime && publishedCore.protocolContract) return publishedCore;
+  const publishedVersion = require('@aikdna/kdna-studio-core/package.json').version;
+  if (
+    publishedCore.exportRuntime &&
+    publishedCore.protocolContract &&
+    publishedCore.creationEngine &&
+    publishedCore.creationEngine.SCHEMA_VERSION === '0.2.0' &&
+    typeof publishedCore.creationEngine.readManagedCandidate === 'function'
+  ) {
+    return {
+      ...publishedCore,
+      creationExportRuntime: publishedCore.exportRuntime,
+      creationStudioCoreCoordinate: {
+        package: '@aikdna/kdna-studio-core',
+        version: publishedVersion,
+        distribution: 'installed-package',
+      },
+    };
+  }
   try {
-    return require('../../kdna-studio-core/src');
-  } catch (_) {
-    return publishedCore;
+    const sourcePaths = [
+      path.join(__dirname, '../../kdna-studio-core/src'),
+      path.join(
+        __dirname,
+        '../../kdna-studio-core/schemas/creation-workspace.schema.json',
+      ),
+      path.join(__dirname, '../../kdna-studio-core/package.json'),
+      path.join(__dirname, '../../kdna-studio-core/package-lock.json'),
+    ].filter((target) => fs.existsSync(target));
+    const sourceDigestBeforeLoad = deterministicSourceDigest(sourcePaths);
+    const sourceCore = require('../../kdna-studio-core/src');
+    const sourceDigestAfterLoad = deterministicSourceDigest(sourcePaths);
+    if (sourceDigestBeforeLoad !== sourceDigestAfterLoad) {
+      throw new Error('Studio Core source changed while it was being loaded.');
+    }
+    if (
+      sourceCore.exportRuntime &&
+      sourceCore.protocolContract &&
+      sourceCore.creationEngine
+    ) {
+      // Keep the installed package as the binding for established expert
+      // commands. A sibling source checkout supplies only the unreleased
+      // Creation Engine and its matching exporter during coordinated
+      // development; it must not silently replace expert APIs.
+      return {
+        ...publishedCore,
+        creationEngine: sourceCore.creationEngine,
+        creationExportRuntime: sourceCore.exportRuntime,
+        creationStudioCoreCoordinate: {
+          package: '@aikdna/kdna-studio-core',
+          version: require('../../kdna-studio-core/package.json').version,
+          distribution: 'source-checkout',
+          source_tree_digest: sourceDigestAfterLoad,
+        },
+      };
+    }
+  } catch (error) {
+    if (
+      error?.code !== 'MODULE_NOT_FOUND' &&
+      error?.code !== 'ENOENT'
+    ) {
+      throw error;
+    }
+    // Installed packages do not have a sibling source checkout.
   }
+  return publishedCore;
 }
 
 const {
@@ -22,68 +113,93 @@ const {
   cards: cardApi,
   evidence: evidenceApi,
   compile: compileApi,
-  quality,
   creator: creatorApi,
   distillation: distillationApi,
   exportRuntime,
+  creationExportRuntime,
+  creationStudioCoreCoordinate,
   protocolContract,
+  creationEngine,
 } = loadStudioCore();
 
 const llm = require('../src/llm');
 
-// Bug (#1 UX): the LLM-requiring commands (distill, interview, feynman,
-// test) silently fail with a stack trace when no LLM is configured.
-// First-time users hit this and have no way to know what to do. The
-// fix routes every LLM call through this helper, which:
-//   1. Checks whether an LLM is configured at all
-//   2. If not and --no-llm is given, returns a static / synthesised
-//      result so the command can still be useful (5-minute path)
-//   3. If not and --no-llm is absent, exits with a clear
-//      "configure LLM with: kdna-studio llm config" message
-function cmdNeedsLlm(args, cmdName) {
-  const cfg = llm.config();
-  const hasLlm = cfg && cfg.provider && cfg.apiKey && cfg.model;
-  if (hasLlm) return { hasLlm: true, cfg };
-  if (args.includes('--no-llm')) {
-    return {
-      hasLlm: false,
-      cfg,
-      noLlm: true,
-      message: `${cmdName} invoked with --no-llm. Output will be static / synthesised; configure an LLM with \`kdna-studio llm config\` to enable real evaluation.`,
-    };
-  }
-  fail(
-    `${cmdName} requires an LLM. Configure one with:\n` +
-    `  kdna-studio llm config --provider openai --key <api-key> --model <model>\n` +
-    `Or set env vars: KDNA_LLM_PROVIDER, KDNA_LLM_API_KEY, KDNA_LLM_MODEL.\n` +
-    `Or run with --no-llm to get a static / synthesised result.`,
-  );
-}
 const ai = require('../src/ai');
+const {
+  CREATION_COMMANDS,
+  decodeSecretTransport,
+  executeCreationCommand,
+} = require('../src/creation-cli');
 
 const EXIT = { OK: 0, INPUT_ERROR: 2, HUMAN_LOCK_REQUIRED: 4, TRUST_FAILED: 5 };
+const SECRET_STDIN_LIMIT_BYTES = 64 * 1024;
 
-function usage() {
-  console.log(`kdna-studio — Studio-compatible KDNA authoring CLI
+function readBoundedSecretStdin(label) {
+  const storage = Buffer.alloc(SECRET_STDIN_LIMIT_BYTES + 1);
+  let length = 0;
+  try {
+    while (length < storage.length) {
+      const count = fs.readSync(
+        0,
+        storage,
+        length,
+        storage.length - length,
+        null,
+      );
+      if (count === 0) break;
+      length += count;
+    }
+    if (length > SECRET_STDIN_LIMIT_BYTES) {
+      throw new Error(`${label} exceeds the bounded secret input limit`);
+    }
+    return decodeSecretTransport(storage.subarray(0, length));
+  } finally {
+    storage.fill(0);
+  }
+}
 
-LLM (AI-powered authoring; every AI command accepts --no-llm for a static result):
+function usage() {
+  console.log(`kdna-studio — Agent-guided KDNA Creation Engine
+
+Create without schema editing:
+  kdna-studio guide-agent --action create|inventory --json
+  kdna-studio guide-agent <workspace> --json
+  kdna-studio create-agent <workspace> [--input-file <json> | --input-stdin] [--material <path>] [--password-stdin] [--operation-id <id>] [--json]
+  kdna-studio inventory-agent <material-file-or-directory> [--material <path>] [--workspace <existing-creation-workspace>] [--json]
+  kdna-studio deliver-material <workspace> (--private-output-fd 3 | --private-output-file <mode-0600-system-temp-file>) [--input-file <json> | --input-stdin] [--material <reauthorized-path>] [--json]
+  kdna-studio resume <workspace> [--input-file <json> | --input-stdin] [--material <path>] [--password-stdin] [--operation-id <id>] [--json]
+  kdna-studio status <workspace> [--json]
+  kdna-studio answer <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio review <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio try <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio verify-application-agent <workspace> [--password-stdin] [--json]
+  kdna-studio repair <workspace> [--input-file <json> | --input-stdin] [--operation-id <id>] [--json]
+  kdna-studio export-agent <workspace> [--password-stdin] [--operation-id <id>] [--json]
+  kdna-studio finalize-agent <workspace> --out <file.kdna> [--operation-id <id>] [--json]
+
+The default Creation Engine speaks in purpose, material, judgment, boundary,
+example, confirmation, and export terms. Natural-language answers belong in
+stdin or an input file, never process arguments.
+
+Expert authoring:
+
+LLM configuration for expert AI-assisted authoring:
   kdna-studio llm config [--provider <name>] [--model <name>] [--key-pipe] [--url <base-url>]
   kdna-studio llm show
-  (run 'kdna-studio llm config --provider openai --key <key> --model gpt-4' to enable
-   feynman, distill --ai, interview, and test. With --no-llm these commands
-   still produce a structured but unsynthesised result.)
+  (pipe the key to 'kdna-studio llm config --provider openai --key-pipe --model gpt-4'
+   to enable distill --ai and interview.)
 
 Identity:
-  kdna-studio identity init [--name <display-name>]
+  kdna-studio identity init [--name <display-name>] [--passphrase-stdin]
   kdna-studio identity show
 
 Create (three entry paths):
-  kdna-studio create <project-dir> --name <@scope/name> [--author <name>]                        # blank
+  kdna-studio create <project-dir> --name <@scope/name> [--author <name>] [--use-local-identity] # blank
   kdna-studio create <project-dir> --from-kdna <file.kdna> --name <@scope/name>
   kdna-studio create <project-dir> --from-folder <source-dir> --name <@scope/name>
 
 Migrate (dev source or Studio project → canonical .kdna in one command):
-  kdna-studio migrate <source-dir|project> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--allow-incomplete] [--sign] [--passphrase <pw>|--passphrase-stdin]
+  kdna-studio migrate <source-dir|project> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--allow-incomplete] [--sign] [--use-local-identity] [--passphrase-stdin]
   kdna-studio migrate <source-dir> --check --name <@scope/name>   # pre-flight: report which fields would block the export without writing the .kdna
   kdna-studio audit-locks <project> [--type axiom|risk|stance|...] [--json]   # list cards with missing Human Lock fields (per-card-type, per-field)
 
@@ -95,10 +211,10 @@ Authoring:
   kdna-studio card add <project> <type> --field key=value [--field key=value] [--template <name>] [--no-strict]
   kdna-studio card update <project> <card-id> --field key=value
   kdna-studio card remove <project> <card-id>
-  kdna-studio card approve <project> <card-id|--all> --by <id> --statement <text> [--sign] [--passphrase <pass>]
+  kdna-studio card approve <project> <card-id|--all> --by <id> --statement <text> [--sign] [--passphrase-stdin]
   kdna-studio card unlock <project> <card-id> --by <id> --statement <text>
   kdna-studio compile <project> --out <dir>
-  kdna-studio export <project> --out <file.kdna> [--allow-incomplete] [--password <pw>|--password-stdin]
+  kdna-studio export <project> --out <file.kdna> [--allow-incomplete] [--password-stdin]
   kdna-studio export-route-card <domain-id> [--out=<path>]          # Export route-card sidecar skeleton
   kdna-studio export-consumer-index [--entries=<domain-ids>] [--out=<path>]     # Export consumer-index skeleton
 
@@ -106,8 +222,6 @@ AI Authoring (requires LLM config: kdna-studio llm config):
   kdna-studio distill <project> --ai                             # AI-driven candidate extraction from evidence
   kdna-studio distill <project> --candidates <file.json>          # load pre-generated AI candidates
   kdna-studio interview <project> [--stage <name>]               # 4-stage guided AI interview
-  kdna-studio feynman <project> <card-id>                        # AI Feynman evaluation (5-dimension)
-  kdna-studio test <project> --input "<text>" [--preset baseline|edge|contradiction]
 
 Distillation:
   kdna-studio target declare <project>                           # declare distillation target interactively
@@ -118,7 +232,6 @@ Distillation:
   kdna-studio candidate reject <project> <candidate-id>
   kdna-studio candidate override <project> <candidate-id>        # override scope gate
   kdna-studio candidate promote <project>                        # promote accepted+scope_fit → cards
-  kdna-studio report <project>
   kdna-studio audit-locks <project>            # list all axioms/risk/stance missing Human Lock fields
 
 Project may be a directory containing studio.project.json or a project JSON file.`);
@@ -159,64 +272,58 @@ function option(args, name, fallback = null) {
 }
 
 /**
- * Resolve a passphrase from CLI flags, environment, or stdin.
- *
- * SECURITY: passing a passphrase as `--passphrase <value>` exposes it in
- * `ps aux` output and shell history. The recommended path is one of:
- *   1. --passphrase-stdin  — read from stdin (pipe-friendly, no TTY hang)
- *   2. KDNA_PASSPHRASE env var (less secure but no process-list leak)
- *   3. --passphrase <pw>   — fallback only; prints a warning
+ * Resolve a passphrase from stdin. Secrets in argv are rejected.
  *
  * Returns the passphrase string, or null if none was provided.
  */
 function resolvePassphrase(args) {
+  if (
+    args.includes('--passphrase') ||
+    args.some((arg) => arg.startsWith('--passphrase='))
+  ) {
+    fail(
+      '--passphrase is not supported because it exposes secrets in process arguments. ' +
+      'Use --passphrase-stdin.'
+    );
+  }
   if (args.includes('--passphrase-stdin')) {
     if (process.stdin.isTTY) {
       fail(
         '--passphrase-stdin requires the passphrase to be piped in on stdin.\n' +
-        'Example:  read -s PW && echo "$PW" | kdna-studio export ... --sign --passphrase-stdin'
+        'Example:  read -r -s PW && printf "%s\\n" "$PW" | kdna-studio export ... --sign --passphrase-stdin'
       );
     }
     try {
-      return fs.readFileSync(0, 'utf8').trim();
+      return readBoundedSecretStdin('Passphrase');
     } catch (e) {
       fail(`Could not read passphrase from stdin: ${e.message}`);
     }
   }
-  if (process.env.KDNA_PASSPHRASE) return process.env.KDNA_PASSPHRASE;
-  const fromFlag = option(args, '--passphrase');
-  if (fromFlag) {
-    console.error('Warning: --passphrase <value> exposes the secret in `ps aux` and shell history. Prefer --passphrase-stdin or KDNA_PASSPHRASE env var.');
-    return fromFlag;
-  }
   return null;
 }
 
 function resolveApiKey(args) {
-  // 1. KDNA_API_KEY environment variable (preferred)
-  if (process.env.KDNA_API_KEY) return process.env.KDNA_API_KEY;
+  if (
+    args.includes('--key') ||
+    args.includes('-k') ||
+    args.some((arg) => arg.startsWith('--key='))
+  ) {
+    fail('API keys in process arguments are not supported. Use --key-pipe.');
+  }
 
-  // 2. Read from stdin via --key-pipe flag
   if (args.includes('--key-pipe')) {
     if (process.stdin.isTTY) {
-      console.error('Error: --key-pipe requires stdin to be piped. Example: echo $KDNA_API_KEY | kdna-studio llm config --key-pipe');
+      console.error('Error: --key-pipe requires the API key to be piped on stdin.');
       return null;
     }
     try {
-      return fs.readFileSync(0, 'utf8').trim();
+      return readBoundedSecretStdin('API key');
     } catch (e) {
       console.error('Error reading API key from stdin:', e.message);
       return null;
     }
   }
 
-  // 3. Deprecated --key / -k flag (backward compat)
-  const key = option(args, '--key', null) || option(args, '-k', null);
-  if (key) {
-    console.error('Warning: --key is deprecated and exposes secrets in shell history and ps output. Use KDNA_API_KEY env var or pipe via stdin (--key-pipe).');
-    return key;
-  }
-
   return null;
 }
 
@@ -676,8 +783,19 @@ function cmdCreate(args) {
   let lineage = null;
   let creatorIdentity = null;
 
-  // Load creator identity if available
-  try { creatorIdentity = creatorApi.loadIdentity(); } catch { /* no identity yet */ }
+  // A machine-local identity is never inherited implicitly. Creating for
+  // another person, an organization, or an interpretive source must not pick
+  // up whichever identity happens to be configured on this computer.
+  if (args.includes('--use-local-identity')) {
+    try {
+      creatorIdentity = creatorApi.loadIdentity();
+    } catch {
+      fail(
+        '--use-local-identity was requested, but no usable local identity is available.',
+        EXIT.TRUST_FAILED,
+      );
+    }
+  }
 
   if (fromKdna) {
     sourceMode = 'kdna_asset';
@@ -776,7 +894,8 @@ function importFromKdna(kdnaPath) {
     fail(`KDNA file too large (${(stats.size / (1024 * 1024)).toFixed(1)} MiB, max 50 MiB): ${absKdna}`);
   }
 
-  // ── read ZIP before Core validation so the profile can branch ──
+  // Read the container before Core validation only to produce a stable
+  // profile error. Studio does not retain a second Runtime contract.
   const zipBuf = fs.readFileSync(absKdna);
   const entries = readZipEntries(zipBuf);
   validateZipContainer(entries);
@@ -787,22 +906,17 @@ function importFromKdna(kdnaPath) {
   const payload = decodePayload(entries.get('payload.kdnab'), manifest);
   const profile = payload?.profile;
 
-  // ── branch: current profile requires Core validate; legacy uses a frozen contract ──
-  let runtimeCore, isLegacy;
+  if (profile !== 'kdna.payload.judgment') {
+    fail(`Unsupported payload profile "${profile || '(none)'}". Only kdna.payload.judgment is accepted for --from-kdna.`);
+  }
+
+  let runtimeCore;
   try { runtimeCore = require('@aikdna/kdna-core'); } catch {
     fail('@aikdna/kdna-core is required to validate --from-kdna imports.');
   }
-  if (profile === 'kdna.payload.judgment') {
-    const validation = runtimeCore.validate(absKdna);
-    if (!validation.overall_valid) {
-      fail(`Not a current .kdna asset: ${(validation.problems || []).join('; ')}`);
-    }
-    isLegacy = false;
-  } else if (profile === 'judgment-profile-v1') {
-    validateLegacyImportContract(manifest, payload);
-    isLegacy = true;
-  } else {
-    fail(`Unsupported payload profile "${profile || '(none)'}". Only kdna.payload.judgment and judgment-profile-v1 are accepted for --from-kdna.`);
+  const validation = runtimeCore.validate(absKdna);
+  if (!validation.overall_valid) {
+    fail(`Not a current .kdna asset: ${(validation.problems || []).join('; ')}`);
   }
 
   const lineage = {
@@ -813,28 +927,54 @@ function importFromKdna(kdnaPath) {
     parent_asset_digest: manifest.content_digest || manifest.asset_digest || null,
   };
 
-  const importedCards = [];
-  let judgmentCore = null;
+  let imported;
   try {
-    if (isLegacy) {
-      importedCards.push(...cardsFromLegacyPayload(payload));
-      judgmentCore = judgmentCoreFromLegacyPayload(payload);
-    } else {
-      importedCards.push(...cardsFromPayload(payload));
-      judgmentCore = judgmentCoreFromRuntimePayload(payload);
-    }
+    imported = importFromRuntimeContent(manifest, payload);
   } catch (e) {
     fail(`Could not import cards from payload.kdnab: ${e.message}`);
   }
 
-  if (importedCards.length === 0) {
+  if (imported.cards.length === 0) {
     fail(`No current judgment cards could be extracted from ${absKdna}.`);
   }
 
   return {
     lineage,
-    cards: importedCards,
-    judgment_core: judgmentCore,
+    ...imported,
+  };
+}
+
+function importFromRuntimeContent(manifest, payload) {
+  if (payload?.profile !== 'kdna.payload.judgment') {
+    throw new Error(
+      `unsupported payload profile "${payload?.profile || '(none)'}"`,
+    );
+  }
+  resetImportedIds();
+  const cards = cardsFromPayload(payload);
+  const runtimeBoundaries = Array.isArray(payload.core?.boundaries)
+    ? payload.core.boundaries
+    : [];
+  const taskScopes = Array.from(new Set(
+    runtimeBoundaries
+      .map((boundary) => boundary?.scope)
+      .filter((scope) => typeof scope === 'string' && scope.trim().length > 0),
+  ));
+  const excludedAreas = runtimeBoundaries
+    .map((boundary) => boundary?.out_of_scope)
+    .filter((area) => typeof area === 'string' && area.trim().length > 0);
+  return {
+    cards,
+    judgment_core: judgmentCoreFromRuntimePayload(payload),
+    distillation_target: {
+      task_scope: taskScopes.length === 1 ? taskScopes[0] : null,
+      include_areas: taskScopes,
+      exclude_areas: excludedAreas,
+      load_condition:
+        typeof payload.core?.load_condition === 'string'
+          ? payload.core.load_condition
+          : null,
+    },
     source_manifest: manifest,
     source_patterns: null,
     source_reasoning: payload.reasoning && typeof payload.reasoning === 'object'
@@ -849,9 +989,23 @@ function importFromKdna(kdnaPath) {
   };
 }
 
-// ── legacy judgment-profile-v1 import support ───────────────────────────
-
-const LEGACY_PROFILE = 'judgment-profile-v1';
+function importFromRuntimeCapsule(capsule) {
+  if (capsule?.type !== 'kdna.runtime-capsule' || capsule.profile !== 'full') {
+    throw new Error('A full Runtime Capsule is required for Studio re-import.');
+  }
+  const manifest = capsule.context?.manifest;
+  const payload = capsule.context?.payload;
+  if (!manifest || !payload) {
+    throw new Error(
+      'The Runtime Capsule does not contain current manifest and payload semantics.',
+    );
+  }
+  const imported = importFromRuntimeContent(manifest, payload);
+  if (imported.cards.length === 0) {
+    throw new Error('No current judgment cards could be re-imported.');
+  }
+  return imported;
+}
 
 const LEGACY_PATTERN_TYPE_MAP = {
   term: 'term',
@@ -907,28 +1061,6 @@ function validateZipContainer(entries) {
   }
 }
 
-function validateLegacyImportContract(manifest, payload) {
-  // Frozen validation for judgment-profile-v1 assets.
-  if (!manifest || typeof manifest !== 'object') fail('Legacy asset manifest is missing or invalid');
-  if (manifest.kdna_version !== '1.0') fail(`Legacy asset must declare kdna_version "1.0", got "${manifest.kdna_version}"`);
-  if (!manifest.asset_id || typeof manifest.asset_id !== 'string') fail('Legacy asset_id is missing');
-  if (!manifest.compatibility || manifest.compatibility.profile !== LEGACY_PROFILE) {
-    fail(`Legacy asset compatibility.profile must be "${LEGACY_PROFILE}"`);
-  }
-  if (!manifest.payload || manifest.payload.path !== 'payload.kdnab') {
-    fail('Legacy asset payload.path must be "payload.kdnab"');
-  }
-  if (manifest.payload.encoding !== 'cbor') {
-    fail('Legacy asset payload.encoding must be "cbor"');
-  }
-  if (manifest.payload.encrypted) fail('Legacy asset must not be encrypted');
-  if (!payload || typeof payload !== 'object') fail('Legacy asset payload is missing or invalid');
-  if (payload.profile !== LEGACY_PROFILE) fail('Legacy payload must declare profile "judgment-profile-v1"');
-  if (!payload.core || typeof payload.core !== 'object') fail('Legacy payload must contain a "core" object');
-  if (!Array.isArray(payload.core.axioms)) fail('Legacy payload must contain axioms');
-  if (!payload.patterns || !Array.isArray(payload.patterns)) fail('Legacy payload must contain patterns');
-}
-
 function judgmentCoreFromLegacyPayload(payload) {
   const core = payload.core || {};
   const result = {};
@@ -1791,7 +1923,7 @@ function cmdCard(args) {
         const passphrase = resolvePassphrase(args);
         try {
           if (identity.encrypted && !passphrase) {
-            errors.push(`${card.id}: Private key is encrypted — provide --passphrase-stdin or KDNA_PASSPHRASE`);
+            errors.push(`${card.id}: Private key is encrypted — provide --passphrase-stdin`);
             return null;
           }
           lockPayload.signature = creatorApi.signHumanLock(
@@ -1912,7 +2044,7 @@ function cmdMigrate(args) {
   const requestedName = option(args, '--name');
   let name = requestedName || path.basename(path.resolve(sourceDir || '.'));
   if (!sourceDir || (!out && !checkOnly) || (!by && !checkOnly) || (!statement && !checkOnly)) {
-    fail('Usage: kdna-studio migrate <source-dir> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--check] [--sign] [--passphrase <pw>|--passphrase-stdin]');
+    fail('Usage: kdna-studio migrate <source-dir> --out <file.kdna> --name <@scope/name> --by <id> --statement <text> [--check] [--sign] [--passphrase-stdin]');
   }
 
   const sourcePath = path.resolve(sourceDir);
@@ -1932,7 +2064,16 @@ function cmdMigrate(args) {
   try {
   // Step 1: import dev source, or use an existing Studio project directly.
   let creatorIdentity = null;
-  try { creatorIdentity = creatorApi.loadIdentity(); } catch { /* proceed without */ }
+  if (args.includes('--use-local-identity')) {
+    try {
+      creatorIdentity = creatorApi.loadIdentity();
+    } catch {
+      fail(
+        '--use-local-identity was requested, but no usable local identity is available.',
+        EXIT.TRUST_FAILED,
+      );
+    }
+  }
   if (isStudioProject) {
     const loaded = readProject(sourcePath);
     project = loaded.project;
@@ -2143,20 +2284,21 @@ function cmdExport(args) {
     fail('The --format option is not supported. KDNA has one current asset format.');
   }
   if (args.includes('--sign')) {
-    fail('Asset signing is a separate runtime step. Export first, then run: kdna sign <asset.kdna>');
+    fail('Asset signatures are outside the current Preview contract.');
   }
   {
     const { project } = readProject(projectInput);
-    // BUG-11 (2026-06-27): previous logic required --password to be set
-    // before --password-stdin would take effect. That meant callers using
-    // `--password-stdin` alone (the recommended path) got `password = null`
-    // and the export ran unencrypted. Resolve the two flags independently:
-    //   - --password-stdin  → read password from stdin (preferred)
-    //   - --password <pw>   → take password from the flag (insecure)
-    //   - --passphrase <pw> → legacy alias for --password
-    // If both are given, --password-stdin wins (it is the explicit intent).
-    // Use args.includes() for --password-stdin since it is a boolean flag
-    // (option() rejects it for "missing value").
+    if (
+      args.includes('--password') ||
+      args.some((arg) => arg.startsWith('--password=')) ||
+      args.includes('--passphrase') ||
+      args.some((arg) => arg.startsWith('--passphrase='))
+    ) {
+      fail(
+        'Password and passphrase values in process arguments are not supported. ' +
+        'Use --password-stdin.'
+      );
+    }
     const useStdin = args.includes('--password-stdin');
     let password;
     if (useStdin) {
@@ -2166,25 +2308,15 @@ function cmdExport(args) {
       if (process.stdin.isTTY) {
         fail(
           '--password-stdin requires the password to be piped in on stdin.\n' +
-          'Example:  echo "$KDNA_PASSWORD" | kdna-studio export <project> --out <file.kdna> --password-stdin\n' +
+          'Example:  printf "%s\\n" "$KDNA_PASSWORD" | kdna-studio export <project> --out <file.kdna> --password-stdin\n' +
           'If you are running interactively, omit --password-stdin and you will be prompted.'
         );
       }
       try {
-        password = fs.readFileSync(0, 'utf8').trim();
+        password = readBoundedSecretStdin('Password');
       } catch (e) {
         fail(`Could not read password from stdin: ${e.message}`);
       }
-    } else {
-      // Bug (#55): prior version only consulted --password / --passphrase
-      // here, so a caller who set KDNA_PASSPHRASE for the signing path
-      // (works via resolvePassphrase) found that the runtime encryption
-      // password was silently null. Resolve from the same sources as
-      // the signing path so the two stay in sync.
-      password = process.env.KDNA_PASSPHRASE
-        || process.env.KDNA_PASSWORD
-        || option(args, '--password')
-        || option(args, '--passphrase');
     }
     exportProject(project, option(args, '--name') || project.name, path.resolve(out), {
       allowIncomplete: args.includes('--allow-incomplete'),
@@ -2200,7 +2332,9 @@ function cmdStudioInstall(args) {
   if (!target) fail('Usage: kdna-studio install <@scope/name|file.kdna>');
   try {
     const kdnaArgs = ['install', target, '--yes'];
-    if (args.includes('--trusted')) kdnaArgs.push('--trusted');
+    if (args.includes('--trusted')) {
+      fail('Asset signatures are outside the current Preview contract.');
+    }
     const result = require('child_process').spawnSync('kdna', kdnaArgs, {
       stdio: 'inherit', encoding: 'utf8',
     });
@@ -2254,6 +2388,77 @@ function cmdLlm(args) {
   fail('Usage: kdna-studio llm <config|show>');
 }
 
+// initIdentity fails for several distinct reasons and each needs a different
+// user message. A catch-all "Identity already exists." would lie about path
+// (ENOTDIR/ENOENT), permission (EACCES/EPERM), write, and KDF failures and
+// would send the user to `identity show`, which then reports no identity.
+function failIdentityInit(err) {
+  const code = err && err.code;
+  // Identity state is classified only by Studio Core's stable machine codes
+  // (or by stable OS error codes). Human-readable error text is diagnostic
+  // material, never a state oracle.
+  if (code === 'IDENTITY_ALREADY_EXISTS') {
+    fail(
+      `Identity already exists [${code}] and passed consistency verification. `
+      + "Use 'kdna-studio identity show' to view it."
+    );
+  }
+  if (code === 'IDENTITY_INCOMPLETE') {
+    fail(
+      `Identity is incomplete [${code}]: only part of the canonical three-file identity exists. `
+      + 'No existing file was changed or removed. Preserve the files and recover the identity manually.'
+    );
+  }
+  if (code === 'IDENTITY_CORRUPT') {
+    fail(
+      `Identity is corrupt [${code}]: all canonical files exist but failed consistency verification. `
+      + 'Do not sign with or use this identity. Preserve the files and recover from a trusted backup.'
+    );
+  }
+  if (code === 'IDENTITY_COMMITTED_DURABILITY_UNCONFIRMED'
+      && err.committed === true && err.identityVerified === true) {
+    fail(
+      `Identity committed, durability unconfirmed [${code}]: your identity was created, `
+      + 'but confirming it is fully durable on disk failed.\n'
+      + 'Do NOT re-run `kdna-studio identity init`.\n'
+      + '  1. Verify the identity with: kdna-studio identity show\n'
+      + '  2. Back up your private key promptly.'
+    );
+  }
+  if (code === 'IDENTITY_COMMITTED_INCONSISTENT') {
+    fail(
+      `Identity committed but inconsistent [${code}]: files reached the canonical identity directory, `
+      + 'but they did not pass post-commit consistency verification.\n'
+      + 'Do NOT sign with, show as valid, delete, or automatically retry this identity.\n'
+      + 'Preserve and restrict access to the directory, then recover from a trusted backup or have an '
+      + 'administrator inspect all three files.'
+    );
+  }
+  if (code === 'IDENTITY_COMMITTED_DURABILITY_UNCONFIRMED') {
+    fail(
+      'Identity init returned an invalid committed-state result '
+      + `[${code}]: verified identity evidence is missing. Do not retry or use the identity; recover manually.`
+    );
+  }
+  if (code === 'ENOTDIR' || code === 'ENOENT') {
+    fail(`Identity init failed — the identity path is not usable [${code}].`);
+  }
+  if (code === 'EACCES' || code === 'EPERM') {
+    fail(`Identity init failed — permission denied [${code}].`);
+  }
+  if (code === 'ENOSPC') {
+    fail(`Identity init failed — storage is full [${code}]. No identity was committed.`);
+  }
+  if (code === 'EIO') {
+    fail(`Identity init failed — storage I/O failed [${code}]. Do not assume an identity was created.`);
+  }
+  if (code === 'IDENTITY_KDF_FAILED') {
+    fail(`Identity init failed — key derivation failed [${code}]. No identity was committed.`);
+  }
+  const displayCode = typeof code === 'string' && /^[A-Z0-9_]+$/.test(code) ? code : 'UNKNOWN';
+  fail(`Identity init failed [${displayCode}]. No recognized identity state was reported.`);
+}
+
 function cmdIdentity(args) {
   const sub = args[0];
   if (sub === 'init') {
@@ -2272,7 +2477,7 @@ function cmdIdentity(args) {
         console.log(`  Private key is encrypted — keep your passphrase safe.`);
       }
     } catch (err) {
-      fail(`Identity already exists. Use 'kdna-studio identity show' to view. ${err.message}`);
+      failIdentityInit(err);
     }
     return;
   }
@@ -2290,22 +2495,14 @@ function cmdIdentity(args) {
   fail('Usage: kdna-studio identity <init|show>');
 }
 
-function cmdReport(args) {
-  const { project } = readProject(args[0]);
-  const readiness = quality.computeReadiness(project);
-  const gate = projectApi.checkHumanLockGate(project);
-  console.log(JSON.stringify({ readiness, human_lock_gate: gate }, null, 2));
-  process.exit(gate.blocked ? EXIT.HUMAN_LOCK_REQUIRED : EXIT.OK);
-}
-
 // Audit-locks: list every card that would fail the current Human Lock
 // gate because of missing or empty fields. Used during the
 // pre-migration review of source-tree assets (e.g. pro-20) so an
 // author can fill in the missing confidence / evidence_type / risk
 // description / stance statement BEFORE running `migrate`.
 //
-// Bug (UX pro-20 migration): prior version of `kdna-studio report`
-// returned a flat human_lock_gate.issues list, which mixed card
+// The earlier readiness output returned a flat human_lock_gate.issues list,
+// which mixed card
 // types and field names. An author migrating 20 source-tree
 // assets with 99 axioms + 140 risk cards + 70 stance cards had no
 // way to see, for a single asset, "which axioms are missing
@@ -2567,6 +2764,16 @@ async function cmdDistill(args) {
       suggested_card_type: c.type || c.suggested_card_type || 'axiom',
       supporting_evidence_ids: (c.evidence_ids || c.evidenceIds || c.supporting_evidence_ids || []).map(String),
       confidence: c.confidence || 'medium',
+      rationale: c.rationale || c.why || '',
+      applies_when: Array.isArray(c.applies_when) ? c.applies_when.map(String) : [],
+      does_not_apply_when: Array.isArray(c.does_not_apply_when)
+        ? c.does_not_apply_when.map(String)
+        : [],
+      misuse_risk: c.misuse_risk || c.failure_risk || '',
+      agent_inference: c.agent_inference === true,
+      fields: c.fields && typeof c.fields === 'object' && !Array.isArray(c.fields)
+        ? JSON.parse(JSON.stringify(c.fields))
+        : {},
       candidate_status: 'proposed',
       scope_fit: c.scope_fit ?? c.scopeFit ?? true,
     };
@@ -2625,36 +2832,68 @@ function cmdCandidate(args) {
   }
 
   if (sub === 'promote') {
-    const accepted = candidates.filter(c => c.candidate_status === 'accepted' && c.scope_fit !== false);
+    const accepted = candidates.filter(
+      c =>
+        c.candidate_status === 'accepted' &&
+        c.scope_fit !== false &&
+        !c.promoted_card_id,
+    );
     if (accepted.length === 0) fail('No candidates to promote. Accept some candidates first.');
 
+    const incomplete = [];
+    for (const candidate of accepted) {
+      const missing = [];
+      if (!String(candidate.one_sentence || '').trim()) missing.push('one_sentence');
+      if (!String(candidate.full_statement || '').trim()) missing.push('full_statement');
+      if (!String(candidate.rationale || candidate.why || '').trim()) missing.push('rationale');
+      if (!Array.isArray(candidate.applies_when) || candidate.applies_when.length === 0) {
+        missing.push('applies_when');
+      }
+      if (
+        !Array.isArray(candidate.does_not_apply_when) ||
+        candidate.does_not_apply_when.length === 0
+      ) {
+        missing.push('does_not_apply_when');
+      }
+      if (!String(candidate.misuse_risk || candidate.failure_risk || '').trim()) {
+        missing.push('misuse_risk');
+      }
+      if (missing.length > 0) incomplete.push(`${candidate.id}: ${missing.join(', ')}`);
+    }
+    if (incomplete.length > 0) {
+      fail(
+        `Accepted candidates are incomplete and were not promoted:\n  - ${incomplete.join(
+          '\n  - ',
+        )}\nRefine or re-distill them before promotion.`,
+      );
+    }
+
     for (const c of accepted) {
-      // Promote candidates to draft cards. For axioms we must populate every
-      // field the Human Lock gate and migrate path require — empty strings
-      // cause migrate to fail ("critical fields missing from axioms"). When
-      // a candidate lacks the field, fall back to the candidate's own
-      // one_sentence/full_statement so the lock gate at least has substance
-      // to verify. Authors are expected to enrich these fields before
-      // locking.
-      const fields = {};
+      // Candidate review is the place to resolve missing semantics. Promotion
+      // preserves the reviewed fields and never fabricates placeholder text.
+      const fields = {
+        ...(c.fields && typeof c.fields === 'object' ? c.fields : {}),
+        one_sentence: c.one_sentence,
+        full_statement: c.full_statement,
+        rationale: c.rationale || c.why,
+        applies_when: c.applies_when,
+        does_not_apply_when: c.does_not_apply_when,
+        misuse_risk: c.misuse_risk || c.failure_risk,
+        confidence: c.confidence || 'unknown',
+        evidence_type: c.agent_inference === true ? 'analogy' : 'practice',
+        agent_inference: c.agent_inference === true,
+      };
       if (c.suggested_card_type === 'axiom') {
-        fields.one_sentence = c.one_sentence || '';
-        fields.full_statement = c.full_statement || c.one_sentence || '<TBD: full_statement>';
-        fields.why = c.why || '<TBD: why>';
-        // applies_when / does_not_apply_when are arrays, not strings.
-        // Empty string is invalid; emit an empty array so checkRequiredFields
-        // (which treats `length === 0` as missing) correctly reports them.
-        fields.applies_when = Array.isArray(c.applies_when) ? c.applies_when : [];
-        fields.does_not_apply_when = Array.isArray(c.does_not_apply_when) ? c.does_not_apply_when : [];
-        fields.failure_risk = c.failure_risk || '<TBD: failure_risk>';
-      } else {
-        fields.one_sentence = c.one_sentence || '';
-        fields.full_statement = c.full_statement || c.one_sentence || '';
+        fields.why = c.rationale || c.why;
+        fields.failure_risk = c.misuse_risk || c.failure_risk;
       }
       const card = cardApi.createCard(c.suggested_card_type, fields);
-      card.evidence_refs = c.supporting_evidence_ids;
+      card.evidence_refs = Array.isArray(c.supporting_evidence_ids)
+        ? c.supporting_evidence_ids
+        : [];
       project.cards = project.cards || [];
       project.cards.push(card);
+      c.promoted_card_id = card.id;
     }
     if (project.stages?.judgment_cards) {
       project.stages.judgment_cards.total = project.cards.length;
@@ -2672,175 +2911,46 @@ async function cmdInterview(args) {
   const projectInput = args[0];
   const stage = option(args, '--stage');
   if (!projectInput) fail('Usage: kdna-studio interview <project> [--stage distill|clarify|correct|replay]');
-  const { project } = readProject(projectInput);
+  const { projectPath, project } = readProject(projectInput);
+  let results;
 
   if (stage) {
-    const result = await ai.interview.runInterview(llm.config(), project, stage, '', {});
+    const normalizedStage = ai.interview.normalizeInterviewStage(stage);
+    const result = await ai.interview.runInterview(
+      llm.config(),
+      project,
+      normalizedStage,
+      '',
+      {},
+    );
+    results = [result];
     console.log(`\n=== ${result.label} ===\n${result.content}`);
   } else {
-    await ai.interview.runInterviewInteractive(llm.config(), project, {});
+    results = await ai.interview.runInterviewInteractive(llm.config(), project, {});
   }
-}
-
-async function cmdFeynman(args) {
-  const projectInput = args[0];
-  const cardId = args[1];
-  if (!projectInput || !cardId) fail('Usage: kdna-studio feynman <project> <card-id>');
-  const useJson = args.includes('--json');
-  const { projectPath, project } = readProject(projectInput);
-  const cardIdx = (project.cards || []).findIndex(c => c.id === cardId);
-  if (cardIdx < 0) fail(`Card not found: ${cardId}`);
-  const card = project.cards[cardIdx];
-
-  // Canonical field name in the card schema is `feynman_restatement`, not
-  // `feynman_text`. The old check was dead code (nothing writes the wrong
-  // field) and made this command fail on every card.
-  //
-  // Bug (#62 + #68 follow-up): the prior `if (!card.feynman_restatement)
-  // fail(...)` block rejected every card that had no human-written
-  // restatement, even when the AI evaluator in feynman.js was
-  // prepared to auto-synthesise one. A caller without a configured
-  // LLM (no `KDNA_API_KEY`, no `kdna-studio llm config`) would
-  // get a `fail` instead of a structured note. The fix removes the
-  // guard: a missing restatement is now handed off to the evaluator
-  // (which either asks the LLM to evaluate a synthesised one or,
-  // without an LLM, returns a structured `synthesised_restatement`
-  // for the caller to use as a starting point). The error message
-  // is kept as a secondary path: only if the evaluator itself fails
-  // does the command exit non-zero, and only then with a clear
-  // pointer to the manual `card update` path.
-  //
-  // We do still need a restatement-shaped object to feed the
-  // evaluator, so we synthesise one in-memory when the card has
-  // none. This does NOT persist the synthesised restatement to the
-  // project (so the user still has to opt in via `card update` to
-  // keep one across runs), but it lets the no-LLM path return a
-  // useful result instead of a hard fail.
-  if (!card.feynman_restatement) {
-    const synthesised = ai.feynman.synthFeynmanRestatement(card.fields || {});
-    card.feynman_restatement = { text: synthesised, synthesised: true };
-    console.warn(`No feynman_restatement on ${cardId}; using synthesised:\n  "${synthesised}"`);
-  }
-
-  if (!useJson) console.log(`Evaluating Feynman restatement for card: ${cardId}`);
-
-  // Bug (#1 UX follow-up): if no LLM is configured and the caller
-  // did not pass --no-llm, route through cmdNeedsLlm which either
-  // gives a clear "configure LLM" error or accepts the --no-llm
-  // path. Without this branch, the no-LLM caller would fall
-  // through to the LLM call below and get a stack trace.
-  const llmGate = cmdNeedsLlm(args, 'feynmann');
-
-  let result;
-  if (llmGate.noLlm) {
-    // Static evaluation: every criterion is "unsure" (✗), score 0,
-    // but the command still produces a useful structured result and
-    // saves the synthesised restatement to the card.
-    result = {
-      score: 0,
-      criteria: Object.fromEntries(Object.keys(ai.feynman.CRITERIA).map(k => [k, false])),
-      explanations: { noLlm: llmGate.message },
-      suggestions: [
-        'No LLM configured — every criterion shows ✗. Run `kdna-studio llm config` and re-evaluate for a real score.',
-        'Or set the synthesised restatement via: kdna-studio card update <project> ' + cardId + ' --field feynman_restatement=\'{"text":"<your own restatement>"}\'',
-      ],
-    };
-  } else {
-    result = await ai.feynman.evaluate(llmGate.cfg, card, {});
-  }
-  const score = result.score || 0;
-  const passed = score >= 4;
-
-  if (useJson) {
-    console.log(JSON.stringify({
-      card_id: cardId,
-      score,
-      passed,
-      no_llm: !!llmGate.noLlm,
-      criteria: result.criteria || {},
-      suggestions: result.suggestions || [],
-      feynman_restatement: card.feynman_restatement,
-    }, null, 2));
-  } else {
-    console.log(`Score: ${score}/5 ${passed ? '✓ publishable' : '✗ below threshold (need 4/5)'}${llmGate.noLlm ? '  (--no-llm: static result)' : ''}`);
-    for (const [criterion, desc] of Object.entries(ai.feynman.CRITERIA)) {
-      const r = (result.criteria || {})[criterion] ? '✓' : '✗';
-      console.log(`  ${r} ${criterion}`);
-    }
-    if (result.suggestions && result.suggestions.length > 0) {
-      console.log('\nSuggestions:');
-      result.suggestions.forEach(s => console.log(`  - ${s}`));
-    }
+  project.interview_sessions = Array.isArray(project.interview_sessions)
+    ? project.interview_sessions
+    : [];
+  project.interview_sessions.push({
+    recorded_at: new Date().toISOString(),
+    results,
+  });
+  if (project.stages?.interview_room) {
+    project.stages.interview_room.status = 'in_progress';
+    project.stages.interview_room.questions_asked =
+      Number(project.stages.interview_room.questions_asked || 0) +
+      results.reduce(
+        (total, result) =>
+          total +
+          (Array.isArray(result.conversation)
+            ? result.conversation.filter(message => message.role === 'user').length
+            : 1),
+        0,
+      );
   }
-
-  card.feynman_evaluation = { score, criteria: result.criteria, suggestions: result.suggestions, evaluated_at: new Date().toISOString() };
-  project.cards[cardIdx] = card;
   writeProject(projectPath, project);
 }
 
-async function cmdTest(args) {
-  const projectInput = args[0];
-  const input = option(args, '--input');
-  const preset = option(args, '--preset', 'baseline');
-  if (!projectInput || !input) fail('Usage: kdna-studio test <project> --input "<text>" [--preset baseline|edge|contradiction]');
-  const { project } = readProject(projectInput);
-  const domainName = project.name || 'Untitled Project';
-  const domainPrompt = `Domain: ${domainName}\n${project.description || ''}`;
-
-  // Bug (#50): prior version hand-rolled the prompt for the 3 preset
-  // names and bypassed ai.testlab.testPreset entirely. The exported
-  // testPreset function was dead code, and the help text advertised
-  // names (baseline / edge / contradiction) that did not match the
-  // actual preset keys in testlab.js (baseline / edge_case /
-  // contradiction). Result: --preset edge silently ran the
-  // contradiction branch, and any caller that asked for "edge_case"
-  // fell through to the contradiction branch too.
-  //
-  // The fix routes the call through testPreset when a known preset is
-  // given, and accepts both help-text names (baseline / edge /
-  // contradiction) and the canonical testlab names (baseline / edge_case
-  // / contradiction).
-  const PRESET_ALIASES = {
-    baseline: 'baseline',
-    edge: 'edge_case',
-    edge_case: 'edge_case',
-    contradiction: 'contradiction',
-  };
-  const canonical = PRESET_ALIASES[preset] || 'baseline';
-  console.log(`Testing: ${domainName} [${preset}]`);
-
-  // Bug (#1 UX): gate LLM-requiring paths through cmdNeedsLlm.
-  // The test command always needs an LLM (it compares without/with
-  // the loaded domain). --no-llm gives a static "no-op" comparison
-  // that lists the cards that *would* be applied.
-  const llmGate = cmdNeedsLlm(args, 'test');
-  const cfg = llmGate.noLlm ? null : llmGate.cfg;
-
-  if (canonical === 'baseline') {
-    // Baseline is a single comparison: keep the prior single-result
-    // shape so existing parsers / consumers see the same output.
-    const prompt = `Test the core judgment: ${input}`;
-    if (cfg === null) {
-      // No-LLM static result
-      const cards = (project.cards || []).filter(c => c.locked).map(c => ({ type: c.type, id: c.id, one_sentence: c.fields?.one_sentence || c.fields?.question || '' }));
-      console.log(JSON.stringify({ no_llm: true, message: llmGate.message, would_apply: cards }, null, 2));
-      return;
-    }
-    const result = await ai.testlab.compare(cfg, domainName, prompt, domainPrompt, {});
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  // For non-baseline presets, run the preset + the baseline so the user
-  // can see both side by side. The preset prompt is the one in
-  // ai/testlab.js — that's the code path that was dead before.
-  if (cfg === null) {
-    console.log(JSON.stringify({ no_llm: true, message: llmGate.message }, null, 2));
-    return;
-  }
-  const result = await ai.testlab.testPreset(cfg, domainName, input, domainPrompt, {});
-  console.log(JSON.stringify(result[canonical] || result, null, 2));
-}
-
 const args = process.argv.slice(2);
 const cmd = args[0];
 if (!cmd || cmd === '--help' || cmd === '-h') {
@@ -2854,7 +2964,23 @@ if (cmd === '--version' || cmd === '-v') {
 
 (async () => {
 try {
-  if (cmd === 'create') cmdCreate(args.slice(1));
+  if (CREATION_COMMANDS.has(cmd)) {
+    const runtimeCore = require('@aikdna/kdna-core');
+    await executeCreationCommand(cmd, args.slice(1), {
+      creationEngine,
+      runtimeCore,
+      exportRuntime: creationExportRuntime || exportRuntime,
+      reimportCapsule: importFromRuntimeCapsule,
+      cliVersion:
+        `@aikdna/kdna-studio-cli@${require('../package.json').version}`,
+      studioCoreVersion:
+        creationStudioCoreCoordinate ||
+        `@aikdna/kdna-studio-core@${require('@aikdna/kdna-studio-core/package.json').version}`,
+      runtimeCoreVersion:
+        `@aikdna/kdna-core@${require('@aikdna/kdna-core/package.json').version}`,
+    });
+  }
+  else if (cmd === 'create') cmdCreate(args.slice(1));
   else if (cmd === 'migrate') cmdMigrate(args.slice(1));
   else if (cmd === 'import') cmdImport(args.slice(1));
   else if (cmd === 'filter') cmdFilter(args.slice(1));
@@ -2863,15 +2989,12 @@ try {
   else if (cmd === 'distill') await cmdDistill(args.slice(1));
   else if (cmd === 'candidate') cmdCandidate(args.slice(1));
   else if (cmd === 'interview') await cmdInterview(args.slice(1));
-  else if (cmd === 'feynman') await cmdFeynman(args.slice(1));
-  else if (cmd === 'test') await cmdTest(args.slice(1));
   else if (cmd === 'card') cmdCard(args.slice(1));
   else if (cmd === 'lock') cmdLock(args.slice(1));
   else if (cmd === 'compile') cmdCompile(args.slice(1));
   else if (cmd === 'export') cmdExport(args.slice(1));
   else if (cmd === 'llm') cmdLlm(args.slice(1));
   else if (cmd === 'identity') cmdIdentity(args.slice(1));
-  else if (cmd === 'report') cmdReport(args.slice(1));
   else if (cmd === 'audit-locks') cmdAuditLocks(args.slice(1));
   else if (cmd === 'install') cmdStudioInstall(args.slice(1));
   else if (cmd === 'update') cmdStudioUpdate(args.slice(1));