@aikdna/kdna-studio-cli 0.11.0 → 0.13.0-rc.components.2

package/docs/CREATION_COMMAND_CONTRACT.md

@@ -1,235 +1,30 @@
-# Creation command contract
+# Current command boundary
 
-Status: unreleased source-candidate machine contract. It is for Host adapter
-implementers, not an ordinary-user questionnaire and not a published npm
-compatibility promise.
+Supported commands: `help`, `--help`, `--version`, `session`, `verify`, `read`. Unknown commands, repeated or unknown options fail before opening materials or output. Package exports expose metadata only; the supported executable is the bin. No deep path, alternate checkout, model, remote server or runtime fallback is selected.
 
-## Command set
+`session --out NEW_DIRECTORY` accepts repeated `--text FILE` and `--interview FILE`, `--synthetic-fixture`, and exactly one adoption mode. Human mode uses a controlling terminal or `--human-fd N`. Explicit delegated Agent mode requires both `--agent-adoption-fd N` and `--delegation-record FILE`. N is an integer at least 3. Human and Agent fd options cannot be combined. `session` additionally accepts `--password-fd N` (N an integer at least 3, distinct from the adoption fds): the password is read exactly once from that pipe fd. Password values are never accepted in process arguments, and the Agent stream is never the password channel. The delegation file contains only nonempty `coordinate` and `statement`; it is an explicit embedding claim, not an authenticated grant.
 
-```text
-guide-agent
-create-agent
-inventory-agent
-deliver-material
-resume
-status
-answer
-review
-try
-repair
-export-agent
-finalize-agent
-```
+The child owns its inherited adoption read endpoint, a TTY, pipe or socket; a regular file cannot stand in for a live reply channel. It cancels and releases only its own endpoint on completion or abandonment. The parent owns its writer. Both Agent JSONL and adoption endpoints must remain healthy; EOF/error before export terminates the workspace and late replies cannot revive it. There is no default timeout or manufactured reply. A slow active reviewer may continue deciding.
 
-Each command accepts `--json`. Private structured input uses `--input-file` or
-`--input-stdin`. Natural-language source or judgment content, passwords, and
-API keys are rejected from argv. The Host generates and privately persists
-machine fields such as `mode`, `workflow_mode`, `created_by`, `operation_id`,
-revision, and digest; it must not ask the user to fill them in.
+Frames are limited to 1 MiB. At most one complete next frame plus a bounded partial frame is held while an operation is pending; excess pipelining rejects `CLI_INPUT_QUEUE_LIMIT`. Each request id is unique; each interpretation names the one live reply ticket. Reuse or another operation during review rejects. Already-completed synchronous export is not undone by a later EOF.
 
-`guide-agent --action create` returns the current public create template.
-`guide-agent <workspace>` returns the exact next action and supported machine
-template. A Host must not inspect installed package source or private workspace
-JSON to reconstruct an undocumented action. If the guide reports an
-action-specific template or official adapter gap, that gap is a product
-blocker rather than permission to hand-compose internal receipts.
+`verify --bundle DIRECTORY` captures actual bytes, admits them with Core, requires the current private completion marker, and delegates evidence verification to Studio. `read --bundle DIRECTORY [--allow-read] [--judgment N] [--budget BYTES]` first admits its formal Read request, then verifies the current bundle, then invokes public Read. Invalid budgets reject before bundle I/O. Invalid Core bytes or evidence prevent later disclosure; a consistent bundle still needs explicit read permission. Catalog ordinal selection is Host navigation; closure and projection remain in Read.
 
-## Result envelope
+Private bundles contain `asset.kdna`, `creation-evidence.json`, `binding.json`, `verification.json`, and `complete.json`. The latter is `{kind:'private-studio-export-bundle',version:2}`, carrying a `protection` block when the export was protected. In a protected export the saved-byte completion still runs on the unprotected bytes, but only in an isolated transient area that is removed with the invocation: plaintext never appears at the delivery position, and the delivered `asset.kdna` is the deterministic post-verification derivative (`verification_basis:'pre_protection_plaintext'`) - a `kdna.envelope.aead` container with a password slot (argon2id) and a recovery slot (scrypt-sha256). The recovery code is displayed exactly once on stderr and must not be retained by the host. Static `verify` and `read` do not admit protected containers; consumer-side unlocking belongs to the reader path. A failed protection fails the whole export; Studio/Core protection codes pass through unchanged, and there is no silent fallback to an unprotected bundle. Output reservation is exclusive, saved bytes are re-captured and passed to Studio `completeSave`, then completion is written last. Existing outputs are never replaced. A partial reservation is removed only by its owning invocation. Persistent import/resume, overwritten outputs, external compiler callbacks, signing services, identity verification and action execution are unsupported.
 
-Success returns one JSON document on stdout. Diagnostics go to stderr. The
-envelope includes:
+Stdout is private machine JSON and may contain materials, evidence and disclosed content. Stderr contains prompts/previews or concise errors. Do not publish these streams. Errors do not echo raw frames, source paths, stacks or provider secrets. The password read is bounded (64 KiB), strictly UTF-8 with one trailing newline stripped, refuses a TTY fd, and zeroizes its buffer; empty, oversize or invalid-encoding input rejects before any bundle exists. Exit 0 denotes successful export/verification or ready Read; 2 denotes terminal, transport, operation or filesystem rejection; 3 denotes public admission, evidence or disclosure rejection.
 
-```json
-{
-  "document_type": "kdna.creation-command-result",
-  "workspace": {
-    "state": "in_progress",
-    "semantic_revision": 1
-  },
-  "readiness": {
-    "compile_ready": false,
-    "judgment_accepted": false,
-    "completion_gates": {
-      "format_valid": false,
-      "judgment_accepted": false,
-      "application_verified": false,
-      "creation_complete": false
-    }
-  },
-  "next_action": {
-    "action": "review_candidates",
-    "required_actor": "creating-agent",
-    "requires_user": false,
-    "unresolved_ids": []
-  }
-}
-```
+Studio format `kdna.studio-creation-evidence/2` and the exact current graph are required. The CLI does not implement another evidence canonicalizer, component interpreter or legacy branch. Static consistency cannot restore `accepted_with_live_context`: static status retains `creation_accepted:not_evaluated`, `live_context:unavailable`, `identity:not_verified` and `action_authorization:not_evaluated`. Role-specific adoption records do not authenticate a person or Agent.
 
-`compile_ready` is not `FORMAT_VALID`; it says only that the current judgment
-model may be compiled into a managed test candidate. `judgment_accepted` is the
-second gate, not Creation Complete. New schema output does not expose
-ambiguous legacy aliases.
+Before executing dependencies, the Host checks every member, path set, package version, mandatory resolution and unbound optional package against `src/public-bindings.json`. Archive equality is a local content observation; installation approval and process-origin trust remain external. Tests use explicit synthetic channels and do not prove actual Agent editorial decisions or publication readiness.
 
-Normal command output may contain private state and therefore is not a public
-log payload. It never contains raw material bodies, source absolute paths,
-passwords, decrypted Runtime payloads, role private keys, or provider response
-bodies.
 
-## Explicit execution and authority
+## Container support
 
-`workflow_mode` is `collaborative` or `autonomous`. Authority `mode` is one of:
-
-```text
-agent-authored
-human-confirmed
-organization-confirmed
-interpretive
-mixed-authorship
-```
-
-Human participation is a private receipt, not a sixth mode. Both fields are
-explicit for new workspaces; the CLI does not silently infer collaborative
-execution or authorship. The Host may derive a conservative proposal from the
-user's ordinary words, then asks only when representation or authorship is
-ambiguous.
-
-## Idempotency and recovery
-
-Every mutation has a caller-stable operation coordinate generated by the Host.
-An exact retry at the same semantic coordinate is inert. Reusing an operation
-ID with different input, bytes, destination, or state fails closed.
-
-Private saves are atomic. `resume` reports the next required actor/action and
-restores an interrupted managed-candidate or final-delivery transaction. A
-fresh Host does not need previous chat context. An outdated private workspace
-returns a specific schema migration requirement rather than guessing a new
-authority.
-
-## Material inventory
-
-`inventory-agent` accepts explicit files or directories. Before approval it
-does not read content and returns a public projection with:
-
-- relative display path and source kind;
-- `eligible`/`awaiting-approval`, excluded, unsupported, duplicate, uncertain,
-  or failed status;
-- extractor/Host-observation capability;
-- operation batch continuation;
-- inventory and processing-policy digests.
-
-The processing policy explicitly binds local-only execution, a named remote
-processor and boundary, or prohibited processing, plus
-`host-declared` or `verified-host-required` assurance. A caller-supplied
-capability digest is only a coordinate and never proves locality. The generic
-CLI refuses `verified-host-required` delivery unless a separately trusted Host
-adapter is available. Missing policy,
-destination drift, file drift, workspace overlap, or a symlink escape fails
-closed. An input directory may contain the private workspace; the exact
-workspace subtree is excluded. The workspace itself or a material root inside
-it is rejected.
-
-`deliver-material` releases only an approved entry through one Host-owned
-channel. A standard named-remote terminal Host uses
-`--private-output-file <precreated-mode-0600-system-temp-file>` and deletes the
-file in `finally`; a dedicated adapter may use `--private-output-fd 3`. The two
-options are mutually exclusive. A regular file/fd must be Host-owned, deny
-group/other access, avoid symlinks, and not alias stdout/stderr. The command
-verifies file identity and exact bytes again and clears transient buffers. Raw
-content is never returned in command JSON. The Host may place those bytes into
-the approved named model context under its declared retention boundary. This
-is Host-declared remote processing, not verified-local evidence or a claim
-that model input is log-free.
-
-Direct text is strict UTF-8 and untruncated. PDF/word-processing extraction is
-capability-probed. A Host-observed image/audio/video/binary uses an exact
-streamed source digest plus bounded observation text and a digest-bound
-observer/tool/coverage record. Large source media is not buffered merely to
-hash it.
-
-Exact byte duplicates are deduplicated across operations and batches. Existing
-unchanged materials do not consume the next continuation budget. Any new,
-changed, deleted, or reclassified entry requires a new content-free review.
-Directory continuation does not imply offset continuation inside one file.
-One text file above the direct-processing byte limit is
-`single-file-chunking-not-implemented`; the caller may provide an explicitly
-selected, ordered, full-coverage split copy or exclude it.
-
-## Mutation commands
-
-- `answer` requires explicit actor, subject, expected revision, and current
-  pre-answer semantic coordinate. Question-kind disposition decides whether
-  the issue is actually resolved; arbitrary prose does not close a conflict,
-  source-safety, test, or application failure.
-- `review` records source review (including `reviewed-no-change`), candidate
-  promotion/rejection, relation decisions, confirmation, import mapping, and
-  bounded uncertainty disposition.
-- `try` freezes and records semantic or application evidence in separate
-  ordered requests.
-- `repair` turns current failures into bounded repair items. A semantic repair
-  invalidates confirmations, tests, managed candidates, and application
-  evidence.
-
-## Coverage and stability
-
-Semantic and application plans derive required dimensions from declared
-structure and risk. A simple one-unit asset may use one applicable task and one
-boundary/exit task. Existing high-risk or unique units, global critical
-boundaries, conflicts, priority, exception, or authority-precedence must be
-covered; absent structures are not invented.
-
-The application contract is `application-adoption-fidelity`. Each task is
-`with-only` or `paired-diagnostic`. Only the latter has an isolated baseline
-lane. No observed difference is not a failure and is not causal proof.
-
-At least one pre-frozen core or highest-risk boundary scenario supplies the
-repeated evidence required for stable use. Each repetition binds actual
-Consumer output and per-task independent evaluation, and the Engine
-mechanically recomputes stability. Caller-provided `stable: true`, unrelated
-digests, missing rounds, changed order, or altered outputs cannot pass.
-
-## Managed candidate
-
-`export-agent` creates and verifies an exact managed test candidate inside the
-private workspace:
-
-```bash
-kdna-studio export-agent <workspace> --json
-```
-
-It takes no user `--out` path. The build receipt can establish `FORMAT_VALID`
-for exact bytes, including a technically valid encrypted container when the
-current caller lacks authorization. Actual authorized Runtime load and
-projection belong to `APPLICATION_VERIFIED`.
-
-The official Host, not the ordinary user, owns fresh Consumer/evaluator
-isolation, task delivery, signing, and receipt submission. The creating Agent
-cannot self-evaluate. A Host without a conforming orchestration adapter must
-report that blocker.
-
-## Final delivery
-
-`finalize-agent` is available only when all three gates bind the same semantic
-and asset digests:
-
-```bash
-kdna-studio finalize-agent <workspace> --out <file.kdna> --json
-```
-
-It verifies managed bytes against build/application/completion receipts and
-atomically copies those exact bytes without recompiling. It rejects a target
-inside the workspace, path aliases, symlink escapes, stale receipts, changed
-bytes, and partial transactions before leaving a target. Copying already
-verified encrypted bytes does not request a redundant password.
-
-Runtime `access: public` is an authorization mode: anyone possessing the file
-can load it without an additional KDNA secret. It is not an Internet
-publication action. Distribution and publication are separate caller actions
-and are never inferred by Creation.
-
-## Secret transport
-
-All secret-bearing stdin readers use a bounded, strict UTF-8 transport
-decoder. It removes at most one terminal LF or CRLF, preserves all other
-leading/trailing whitespace, rejects empty/oversize/invalid UTF-8 input, and
-clears transient buffers. Studio and Runtime must interpret the same
-authorized secret bytes.
+Studio session output uses container `0.5.0` and Read grammar `0.6.4`.
+The pinned Core/Read implementation versions also contain other public routes;
+sharing their package coordinates does not establish container interchange.
+NativeSections container `0.6.0` / Read `0.7.0` input, another CLI's output,
+persistent import and resume are not supported by this entry. Revisions operate
+on the current live Studio session before final confirmation. `verify` and
+`read` consume this entry's completed bundle under the boundaries above.

package/docs/TERMINAL_AGENT_CREATION.md

@@ -1,219 +1,36 @@
-# Terminal Agent Creation
+# Terminal Agent integration
 
-Status: unreleased source-candidate guide. The published package does not yet
-promise this flow, and a checked-in Skill is not proof that a particular Host
-can complete it.
+The live private Agent transport creates through Studio; it is not a public asset wire format. Keep stdin/stdout private. The Agent owns substantive authoring and interpretation of actual reviewer language. The CLI has no model or keyword classifier.
 
-## Start with the user's words
+Use an approved exact local installation. Start with explicit source files and a new output directory. Use a separately owned fd3 for either `--human-fd 3`, or `--agent-adoption-fd 3 --delegation-record FILE` when the Agent has express editorial authority. Preserve the actual actor. A delegated Agent must never be represented as a human. An interview reads the selected live adoption channel and records question plus answer as private material.
 
-A normal request can be:
+Each newline-terminated Agent frame has unique `id`, `op`, and `data`. Wait for a result or the live reply ticket. The first `ready` event provides the workspace and explicit materials. Material references are one-based ordinals; judgment, alternative and component references use stable local keys.
 
-> Create a small KDNA that keeps my new article titles to eight words or fewer.
-> Use `./title-notes.md`. This current remote Codex Host may process that file
-> under its named provider retention policy. Save the
-> final result as an ordinary local file; do not share or publish it.
+| op | data |
+| --- | --- |
+| brief | `{title,scope,highest_question}`; the one authored question this judgment answers |
+| interview | `{title,question}` |
+| propose | `{localKey,alternatives:[alternative,alternative,...]}` |
+| revise | `{localKey,baseRevision,alternatives,explanation}` |
+| review | `{}`; request actual selection or final adoption |
+| preview | `{}`; show complete current mapping before final adoption |
+| status | `{}` |
+| export | `{}`; save, re-capture and complete once, then exit; with `--password-fd` the delivered `asset.kdna` is the protected container |
 
-The Host translates that request into private machine input. It does not ask
-the user for a mode enum, workflow enum, Agent ID, operation ID, digest,
-schema, signing key, receipt, seed, or application matrix.
+Each alternative has `{localKey,title,subject,scope,statement,rationale,materials:[1]}`. At least two substantive alternatives are required. Optional fields are `method`, `formationRule`, `publicSources`, `publicNotices`; all other fields reject. `materials` is the only CLI adapter, converted to Studio material references. Never send protocol IDs, public profile definitions, native carriers, evidence digests or compiler context.
 
-Ask only when a meaningful fact is missing:
+`method` is `{method:{term},components?,bindings?}`. Its term must be one of the bound Core's published method kinds. A component has `{localKey,type,method:{term},role,content,statement}`; the component's declared basic method equals the judgment term, its role lies in that kind's published role family, and required roles must be covered by non-empty typed content. Content uses the exact current public item/edge/discriminator types. Types are taxonomy, candidate-set and discriminator-set; the latter uses `candidateSetLocalKey` within this judgment. `bindings` remains declared-empty on this path: native bindings are typed edges owned by the graph, not authored links back to the judgment. A missing method rejects (`CREATION_METHOD_REQUIRED`); missing own arrays mean undeclared; explicit `[]` means declared empty; null and owned undefined reject. Core alone determines content interpretation and valid shared grammar.
 
-- Is the judgment the user's or organization's represented judgment, an
-  interpretation of material, Agent-authored, or genuinely co-authored?
-- Which explicit file or directory may be considered?
-- Must material stay local-only, may it go to a named remote processor, and
-  does the user require a separately trusted Host attestation?
-- Should the final file be ordinary possession-load, protected, or remote?
+`formationRule:{conditions:[{kind:'interpreted',statement}]}` makes the authored statement a formation rule rather than an invented fixed result. An explicit empty condition set stays empty. Do not AND candidate-specific conditions into a global prerequisite. Public sources/notices are explicitly authored public identity and notice records, documented by Studio; private source paths and interview bodies must not be automatically published.
 
-In Runtime terminology, `access: public` means possession of the file is
-sufficient to load it. It does not publish the asset to the Internet. Creation
-never shares or publishes automatically.
+During `review`, the CLI emits `adoption_reply` with actual text, the current Studio review and a fresh `replyTo` ticket. Then send one interpretation:
 
-## Private workspace
-
-Choose one private workspace under the project root. The CLI excludes it from
-material inventory and protects it from accidental Git staging.
-
-```bash
-kdna-studio guide-agent --action create --json
-kdna-studio create-agent .kdna-creation/title-rule \
-  --input-file /private/path/to/host-generated-create-input.json --json
-```
-
-The path shown above is illustrative. Private structured input uses stdin or a
-mode-0600 file. Never place source text, judgments, passwords, or API keys in
-argv or shell history.
-
-If the workspace already exists:
-
-```bash
-kdna-studio guide-agent .kdna-creation/title-rule --json
+```json
+{"id":"choose-current","op":"interpret","data":{"replyTo":"COPY_CURRENT_TICKET","kind":"select","choices":[{"judgmentLocalKey":"observation","alternativeLocalKey":"preserve"}]}}
 ```
 
-The Host creates and persists technical actor and operation identifiers. The
-user does not supply them. Follow `next_action.required_actor` and
-`next_action.requires_user`; do not bypass an authority pause in prompt text.
-Run `guide-agent` after state changes to obtain the supported public command
-and template. Do not read package source or private workspace JSON to discover
-machine fields.
-
-## Material-first sequence
-
-Zero material is valid. For one or more explicit paths, no content may be read
-before inventory approval.
-
-1. Create a content-free preview:
-
-   ```bash
-   kdna-studio inventory-agent .kdna-creation/title-rule \
-     --material ./title-notes.md \
-     --input-file /private/path/to/processing-policy.json --json
-   ```
-
-2. Show the user relative paths, exclusions, unsupported items, duplicates,
-   batch continuation, the declared local or named-remote destination, and
-   whether the Host fact is caller-declared or separately attested.
-3. Bind the exact inventory digest through Host-owned private machine input.
-   When the user's original instruction already covers the displayed path,
-   processing destination, and boundary, this does not require a second
-   digest-oriented user question. Ask again only for an unexpected path,
-   sensitive item, unsupported coverage gap, destination drift, or genuine
-   ambiguity.
-4. The Host delivers only an accepted entry. A standard named-remote terminal
-   Host uses a pre-created mode-0600 system-temporary file; this is a Host
-   machine coordinate, not a user instruction:
-
-   ```bash
-   private_material_file="$(mktemp)"
-   chmod 600 "$private_material_file"
-   trap 'rm -f "$private_material_file"' EXIT INT TERM
-   kdna-studio deliver-material .kdna-creation/title-rule \
-     --input-file /private/path/to/delivery-request.json \
-     --private-output-file "$private_material_file" --json
-   ```
-
-The Host reads that temporary file into the explicitly approved named model
-context, subject to that provider's declared retention policy, and must delete
-the file in `finally`. A dedicated Host adapter may instead provide fd 3; a
-regular fd target must be mode 0600 or stricter and must not alias stdout or
-stderr. This path keeps content out of CLI JSON/stdout/stderr/workspace,
-but it is remote model processing—not “private model input”, log-free proof,
-or verified-local evidence. A caller-supplied capability digest is only
-`host-declared`; it cannot prove verified local-only processing. When verified
-assurance is required, a separately trusted Host adapter is mandatory and the
-generic CLI stops before reading.
-
-Directory previews exclude VCS metadata, dependencies, build/cache output,
-the Creation workspace, managed candidates, output paths, and secret-like
-files by default. Unsupported or failed items remain visible while usable
-items continue. File and byte limits are recoverable batch budgets; they are
-not minimums or maximum logical source counts.
-
-The current candidate does not provide offset continuation inside one text
-file above the direct-processing byte limit. That item is explicitly
-unsupported; the actionable fallback is an explicitly selected split copy
-whose parts preserve ordering and full coverage. The CLI does not falsely
-promise that resubmitting the same file advances an internal cursor.
-
-Text uses strict UTF-8 and no silent prefix truncation. PDF and word-processing
-capability is probed before delivery. Images, audio, video, and other
-Host-observed sources require an exact source digest plus a bounded
-observation that records tool/Host coordinate, coverage, uncertainty, and
-observation digest. The observation never represents the source author.
-
-## Build the bounded judgment
-
-A valid asset may contain one complete Judgment Unit and no relation:
-
-- statement and rationale;
-- when it applies;
-- when it does not apply or must exit;
-- misuse risk;
-- traceable source or explicit Agent inference;
-- bounded counterexample search and residual uncertainty;
-- explicit card type and confidence.
-
-Do not invent a worldview, value hierarchy, conflict, priority, exception,
-correction, or additional judgment to satisfy a sample shape. A current,
-digest-bound review may record `reviewed-no-change`.
-
-Use the structured machine actions returned by `resume`:
-
-```bash
-kdna-studio answer  <workspace> --input-file <private-answer.json> --json
-kdna-studio review  <workspace> --input-file <private-review.json> --json
-kdna-studio try     <workspace> --input-file <private-test.json> --json
-kdna-studio repair  <workspace> --input-file <private-repair.json> --json
-```
-
-Human and organization representation requires the corresponding current
-authority. Autonomous Agent-authored and interpretive work can continue with a
-distinct independent evaluator Agent. The creating Agent cannot accept its
-own held-out evaluation. Low confidence can be resolved through more evidence,
-an honest narrower scope, or an explicit bounded uncertainty; it must not
-deadlock merely because the workflow is autonomous.
-
-## Three gates
-
-Keep the status fields separate:
-
-- `JUDGMENT_ACCEPTED` — current, source- and authority-honest judgments have
-  applicable semantic and boundary evidence.
-- `FORMAT_VALID` — the exact managed candidate is a valid, compatible Runtime
-  asset container.
-- `APPLICATION_VERIFIED` — an official Host loads those exact bytes in a fresh
-  Consumer context and obtains independent applicable-dimension evaluation and
-  pre-frozen stability evidence.
-
-A loadable container without a current password may still be format-valid;
-authorization and actual load belong to the third gate. Likewise, semantic
-tests alone cannot establish Application Verified without actual Runtime
-loading and Consumer use.
-
-Coverage is based on the asset's structure and risk. It always proves
-application plus boundary or exit and prevents over-application. Priority,
-exception, conflict, authority-precedence, and high-risk cases are required
-only when declared or applicable. At least one core or highest-risk scenario
-has repeated stability evidence; every task does not need a fixed multi-seed
-matrix.
-
-## Managed candidate, verification, and delivery
-
-Create the exact private test candidate:
-
-```bash
-kdna-studio export-agent <workspace> --json
-```
-
-`export-agent` does not accept `--out` and does not create a user delivery.
-The official Host then orchestrates the required isolated Consumer and
-independent evaluator against those exact managed bytes. The ordinary user
-does not construct role keys, signatures, plans, or receipts. If the current
-Host lacks that official adapter, report the Host-integration blocker instead
-of using the creating Agent or a private benchmark as a substitute.
-
-Only after all three gates bind the same semantic and asset digests:
-
-```bash
-kdna-studio finalize-agent <workspace> --out ./title-rule.kdna --json
-```
-
-Finalization atomically copies the already verified bytes. It does not
-recompile, write inside the workspace, or ask for a redundant password just to
-copy verified ciphertext. Stale receipts, replaced candidates, path aliases,
-and partial transactions fail without leaving a target file.
-
-## Recovery and lifecycle
+Select chooses exactly one current alternative for every group. Other supported kinds are `note`, `reject`, `confirm`, without `choices`. To revise, record the actual feedback, send a current `revise` operation, select again, request a fresh preview, then obtain a fresh final reply. A final confirmation binds the exact current preview, alternatives, context and adoption channel. The Agent interprets real language; it cannot fabricate a reviewer reply, role, message/review id or final digest through its pipe.
 
-After a crash or Agent handoff, call `resume`. The workspace either reopens an
-authorized source capability and verifies the exact bytes or requests source
-reauthorization. Chat context is not recovery evidence.
+The pending review receives its final result after interpretation. There is no separate interpretation success reply. Reusing ids/tickets, changing role/channel, replacing the current review, EOF or input errors reject. Agent termination while waiting abandons the unexported session. Keep one request active; excess queued frames reject. No automatic decision or persistent replay/resume exists.
 
-The current local Creation lifecycle is create, resume, revise, invalidate
-stale confirmations/tests, retest, finalize, and recover the last valid state.
-Stopping retains the private workspace. The CLI does not yet expose a general
-workspace-abandon/delete command; application-attempt abandonment closes only
-one interrupted Consumer attempt. Sharing, publication, deprecation,
-revocation, marketplace distribution, and Studio App management are separate
-capabilities.
+Export creates one exclusive private bundle and obtains `accepted_with_live_context` only after actual saved-byte readback. Static `verify` always retains `live_context:unavailable` and `creation_accepted:not_evaluated`; it cannot resurrect the capability. Core/Read and static evidence consistency remain separate from actual Agent adoption, verified identity, action permission, Authoring Fit/G4B and publication readiness. Legacy format1 and old completion markers require their original accepted graph and cannot be relabeled current.

package/package.json

@@ -1,47 +1,43 @@
 {
   "name": "@aikdna/kdna-studio-cli",
-  "version": "0.11.0",
-  "description": "Official KDNA Studio command-line authoring entry for creating, reviewing, compiling, and exporting .kdna judgment assets through the KDNA toolchain.",
+  "version": "0.13.0-rc.components.2",
+  "description": "Terminal Host for current typed Studio creation and separate human or authorized Agent adoption channels.",
   "type": "commonjs",
   "bin": {
     "kdna-studio": "bin/kdna-studio.js"
   },
   "files": [
     "bin/kdna-studio.js",
-    "src/ai/index.js",
-    "src/ai/distill.js",
-    "src/ai/filter.js",
-    "src/ai/interview.js",
-    "src/creation-cli.js",
-    "src/application-host.js",
-    "src/llm/",
+    "src/terminal-workspace.js",
+    "src/public-bindings.json",
     "docs/CREATION_COMMAND_CONTRACT.md",
     "docs/TERMINAL_AGENT_CREATION.md",
     "LICENSE",
     "NOTICE",
-    "README.md"
+    "README.md",
+    "src/component-operations.js"
   ],
   "scripts": {
-    "lint": "node scripts/run-lint.js",
-    "pretest": "node scripts/acquire-trusted-npm-release.js",
-    "test": "node --test tests/*.test.js",
+    "lint": "node --check bin/kdna-studio.js && node --check src/terminal-workspace.js && node --check src/component-operations.js",
+    "test": "node --test tests/current-components/*.test.cjs tests/current/*.test.js",
     "test:all": "node scripts/run-test-all.js",
-    "test:runtime": "node scripts/run-product-tests.js",
-    "test:candidate-chain": "node scripts/verify-runtime-candidate-chain.js",
-    "verify:candidate-sources": "node scripts/verify-runtime-candidate-sources.js",
+    "test:candidate-chain": "node scripts/verify-current-candidate-chain.js",
+    "verify:candidate-sources": "node scripts/verify-current-candidate-sources.js",
     "check:protocol-names": "node scripts/check-current-protocol-names.js",
+    "check:publish-coordinates": "node scripts/check-publish-coordinates.js",
     "release:check": "node scripts/release-check.js",
     "release:generate-evidence": "node scripts/generate-release-evidence.js",
     "release:publish-verified": "node scripts/publish-verified-artifact.js",
-    "prepublishOnly": "node scripts/run-test-all.js && node scripts/verify-runtime-candidate-chain.js && node scripts/release-check.js"
+    "candidate:publish-verified": "node scripts/publish-candidate-artifact.js",
+    "prepublishOnly": "node scripts/check-publish-coordinates.js && node scripts/run-test-all.js && node scripts/verify-current-candidate-chain.js && node scripts/release-check.js",
+    "check:current-bindings": "node scripts/generate-current-bindings.js",
+    "candidate:generate-evidence": "node scripts/generate-candidate-evidence.js"
   },
   "keywords": [
     "kdna",
-    "kdna-studio",
-    "kdna-studio-cli",
-    "authoring",
-    "provenance",
-    "judgment-cards"
+    "agent-native",
+    "creation",
+    "terminal"
   ],
   "license": "Apache-2.0",
   "repository": {
@@ -53,17 +49,24 @@
     "url": "https://github.com/aikdna/kdna-studio-cli/issues"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "dependencies": {
-    "@aikdna/kdna-core": "0.21.0",
-    "@aikdna/kdna-studio-core": "3.0.0",
-    "ajv": "^8.20.0",
-    "ajv-formats": "^3.0.1",
-    "cbor-x": "^1.6.4"
+    "@aikdna/kdna-core": "0.37.1-rc.browser.1",
+    "@aikdna/kdna-read": "0.11.2-rc.browser.1",
+    "@aikdna/kdna-studio-core": "4.0.0-rc.components.2"
   },
   "directories": {
     "test": "tests"
   },
-  "author": ""
+  "author": "",
+  "overrides": {
+    "fast-uri": "3.1.8",
+    "@aikdna/kdna-core": "$@aikdna/kdna-core",
+    "@aikdna/kdna-read": "$@aikdna/kdna-read",
+    "@aikdna/kdna-studio-core": "$@aikdna/kdna-studio-core"
+  },
+  "exports": {
+    "./package.json": "./package.json"
+  }
 }

package/src/component-operations.js

@@ -0,0 +1,13 @@
+"use strict";
+// CLI-only material ordinal adapter. Shared component meaning remains upstream.
+function componentOperations(workspace,materialIds){
+ const fail=code=>{throw Object.assign(new Error(code),{code});};
+ function record(v,keys){if(!v||typeof v!=='object'||Array.isArray(v)||Object.keys(v).some(k=>!keys.includes(k))||keys.some(k=>!Object.hasOwn(v,k)))fail('CLI_COMPONENT_INPUT_INVALID');}
+ function authored(a){if(!a||!Array.isArray(a.materials)||Object.hasOwn(a,'materialRefs'))fail('CLI_COMPONENT_MATERIAL_INVALID');const ids=typeof materialIds==='function'?materialIds():materialIds;const x={...a,materialRefs:a.materials.map(n=>{if(!Number.isSafeInteger(n)||n<1||n>ids.length)fail('CLI_MATERIAL_UNKNOWN');return ids[n-1];})};delete x.materials;return x;}
+ return Object.freeze({
+  propose(data){record(data,['localKey','alternatives']);if(!Array.isArray(data.alternatives))fail('CLI_COMPONENT_INPUT_INVALID');return workspace.agent.propose({localKey:data.localKey,alternatives:data.alternatives.map(authored)});},
+  revise(data){record(data,['localKey','baseRevision','alternatives','explanation']);if(!Array.isArray(data.alternatives))fail('CLI_COMPONENT_INPUT_INVALID');return workspace.agent.revise(data.localKey,{baseRevision:data.baseRevision,alternatives:data.alternatives.map(authored),explanation:data.explanation});},
+  preview(){return workspace.agent.compilePreview();},review(){return workspace.receiveAdoptionReply();},completeSavedReadback(bytes){return workspace.completeSave(bytes);},abort(){return workspace.abort();}
+ });
+}
+module.exports={componentOperations};