@aikdna/kdna-studio-cli 0.13.0 → 0.14.0

package/README.md

@@ -1,6 +1,6 @@
 # KDNA Studio CLI — typed current creation
 
-Studio CLI `0.13.0` consumes Studio Core `4.0.0`, Core `0.37.2` and Read `0.11.3`. Ordinary prose and supported mechanism structures share container `0.5.0` / Read grammar `0.6.4`. Core/Read package versions identify implementation bytes and do not establish interchange with NativeSections container `0.6.0` / Read `0.7.0`, or import/reuse of another CLI's output. Installation acceptance is a separate Host decision; exact content checks do not authenticate a provider process.
+Studio CLI `0.14.0` consumes Studio Core `4.1.0`, Core `0.37.2` and Read `0.11.3`. Ordinary prose and supported mechanism structures share container `0.5.0` / Read grammar `0.6.4`. Core/Read package versions identify implementation bytes and do not establish interchange with NativeSections container `0.6.0` / Read `0.7.0`, or import/reuse of another CLI's output. Installation acceptance is a separate Host decision; exact content checks do not authenticate a provider process.
 
 An external Agent records materials and proposes judgment groups with at least two meaningful alternatives. Selection and final adoption arrive through a separately owned live channel. Human-declared review and expressly delegated Agent editorial adoption are distinct modes:
 
@@ -20,10 +20,13 @@ Export exclusively creates a new private directory. It writes exact Studio bytes
 ```text
 kdna-studio verify --bundle ./new-export
 kdna-studio read --bundle ./new-export --allow-read --judgment 1
+kdna-studio export06 --bundle ./new-export --kdna /path/to/kdna
 ```
 
 Static reopening keeps `creation_accepted:not_evaluated` and `live_context:unavailable`; JSON cannot restore a one-use capability. `read` requires explicit `--allow-read`, delegates request admission, scope, exact selection and byte budgets to public Read, and grants no action authority. Format1, format-absent legacy evidence and old completion sidecars are noncurrent. Preserve their original accepted releases; never relabel them to this graph.
 
+`export06` is the explicit bridge to container `0.6.0`: it invokes the published `kdna` CLI's `convert` on the bundle's `asset.kdna` and writes a new file — the sibling `./new-export.0.6.kdna` unless `--output` names another. `--kdna EXECUTABLE` or `KDNA_CLI_BIN` selects the CLI; when none is found the step is a named refusal with public acquisition guidance, never a fallback conversion path. The sealed bundle — the asset and all detached evidence — is never written, and the converted file belongs to the `0.6.0` read stack, not to this CLI's `read`.
+
 The full 12-package dependency graph uses exact registry coordinates and an integrity lock; the committed vendor archives anchor its member receipt. Before loading upstream code or materials, the CLI checks complete installed member sets, bytes, versions and one shared Core resolution, and rejects unbound optional addons. The exact archive/member declarations are in `src/public-bindings.json`.
 
 Install with registry access using the locked coordinates:
@@ -50,7 +53,7 @@ See [command contract](docs/CREATION_COMMAND_CONTRACT.md) and [Agent integration
 
 ## Source and release verification
 
-The dependency graph binds Studio Core `4.0.0`, Core `0.37.2`, Read
+The dependency graph binds Studio Core `4.1.0`, Core `0.37.2`, Read
 `0.11.3` and `fast-uri` `3.1.8`. The current source ledger is
 `fixtures/runtime-candidates/current-sources.json`; `npm run verify:candidate-sources`
 rebuilds its exact Git package trees and compares every installed tar member.
@@ -67,3 +70,13 @@ published, non-draft, non-prerelease event and exact registry dependency
 integrities. Prerelease evidence cannot enter that publisher. Local checks do
 not establish registry availability, verified editorial identity, real human
 acceptance or permission to publish.
+
+A stable release commit must already be accepted on `main`: the release gate
+runs `git merge-base --is-ancestor <release-commit> origin/main` and refuses by
+name when `origin/main` is unreadable (`RELEASE_MAIN_REF_UNREADABLE`) or the
+commit is not an ancestor (`RELEASE_COMMIT_NOT_ON_MAIN`). An earlier main commit
+remains acceptable; the current main tip is not required, and the reverse
+relation is never used. The publish workflow fetches `origin/main` explicitly
+before the gate and fails closed if that fetch fails. The candidate/preview
+channel keeps its existing release rule; this main-line requirement is stable
+publication only.

package/docs/CREATION_COMMAND_CONTRACT.md

@@ -1,6 +1,6 @@
 # Current command boundary
 
-Supported commands: `help`, `--help`, `--version`, `session`, `verify`, `read`. Unknown commands, repeated or unknown options fail before opening materials or output. Package exports expose metadata only; the supported executable is the bin. No deep path, alternate checkout, model, remote server or runtime fallback is selected.
+Supported commands: `help`, `--help`, `--version`, `session`, `verify`, `read`, `export06`. Unknown commands, repeated or unknown options fail before opening materials or output. `export06 --bundle DIRECTORY [--output FILE] [--kdna EXECUTABLE]` is the explicit conversion step to container `0.6.0`: it hashes the bundle's `asset.kdna` itself, invokes the published `kdna` CLI's `convert` with that binding and writes a new sibling file (`<bundle>.0.6.kdna` unless `--output` names another) that never replaces an existing file. The executable is resolved from `--kdna`, then `KDNA_CLI_BIN`, then `PATH`; when none is found the step is the named refusal `CLI_KDNA_CONVERT_MISSING` with public acquisition guidance, never a fallback conversion. Conversion rejections (`MIGRATION_SOURCE_*`, save failures) pass through with their original code and exit status. The sealed bundle is never written. Package exports expose metadata only; the supported executable is the bin. No deep path, alternate checkout, model, remote server or runtime fallback is selected.
 
 `session --out NEW_DIRECTORY` accepts repeated `--text FILE` and `--interview FILE`, `--synthetic-fixture`, and exactly one adoption mode. Human mode uses a controlling terminal or `--human-fd N`. Explicit delegated Agent mode requires both `--agent-adoption-fd N` and `--delegation-record FILE`. N is an integer at least 3. Human and Agent fd options cannot be combined. `session` additionally accepts `--password-fd N` (N an integer at least 3, distinct from the adoption fds): the password is read exactly once from that pipe fd. Password values are never accepted in process arguments, and the Agent stream is never the password channel. The delegation file contains only nonempty `coordinate` and `statement`; it is an explicit embedding claim, not an authenticated grant.
 

package/docs/TERMINAL_AGENT_CREATION.md

@@ -12,6 +12,7 @@ Each newline-terminated Agent frame has unique `id`, `op`, and `data`. Wait for
 | interview | `{title,question}` |
 | propose | `{localKey,alternatives:[alternative,alternative,...]}` |
 | revise | `{localKey,baseRevision,alternatives,explanation}` |
+| system | `{worldview?,value_order?,relations?,boundaries?}`; declares the system layer. `worldview`/`value_order` are `{statement,items:[text,...]}`; a relation is `{localKey,kind,from,to,statement}` with kind `support|qualify|conflict|complement` and the ordered role pair (support supporter→claim, qualify qualifier→qualified, complement supplement→base; conflict side_a→side_b). Keys resolve against the selected judgments at preview; unknown keys are `CREATION_SYSTEM_JUDGMENT_UNKNOWN`. `boundaries` is refused with `CREATION_BOUNDARIES_ACTOR_REQUIRED` until the actor face opens; nothing is silently dropped |
 | review | `{}`; request actual selection or final adoption |
 | preview | `{}`; show complete current mapping before final adoption |
 | status | `{}` |
@@ -34,3 +35,12 @@ Select chooses exactly one current alternative for every group. Other supported
 The pending review receives its final result after interpretation. There is no separate interpretation success reply. Reusing ids/tickets, changing role/channel, replacing the current review, EOF or input errors reject. Agent termination while waiting abandons the unexported session. Keep one request active; excess queued frames reject. No automatic decision or persistent replay/resume exists.
 
 Export creates one exclusive private bundle and obtains `accepted_with_live_context` only after actual saved-byte readback. Static `verify` always retains `live_context:unavailable` and `creation_accepted:not_evaluated`; it cannot resurrect the capability. Core/Read and static evidence consistency remain separate from actual Agent adoption, verified identity, action permission, Authoring Fit/G4B and publication readiness. Legacy format1 and old completion markers require their original accepted graph and cannot be relabeled current.
+
+## Export to 0.6: the explicit conversion step
+
+Container `0.6.0` is not produced by this CLI. The supported route from a delivered session bundle into `0.6.0` is the explicit step `kdna-studio export06`: it invokes the published `kdna` CLI's `convert` on the bundle's `asset.kdna` (this step supplies the `--expected-a` reading itself, writes a new file, and never changes an existing one) and passes the converter's named results and exit code through unchanged. There is no in-Studio rearrangement of container bytes.
+
+- CLI selection: `--kdna EXECUTABLE`, then `KDNA_CLI_BIN`, then `kdna` on `PATH`. When none is found the step is the named refusal `CLI_KDNA_CONVERT_MISSING` with public acquisition guidance; it never falls back to any private or self-implemented conversion path.
+- Default output is the new sibling file `<bundle>.0.6.kdna` (`--output` names another). The delivered bundle is a sealed read-only unit; `asset.kdna` and the detached evidence files are never written.
+- Converter refusals pass through by their own names, for example `MIGRATION_SOURCE_UNSUPPORTED_VERSION` (historical generations), `MIGRATION_SOURCE_PROTECTED_UNSUPPORTED` (protected containers) and `MIGRATION_SOURCE_EXTENSION_UNSUPPORTED` (member extensions such as `checksums.json`). An existing output is refused, not renamed (`KDNA_OUTPUT_EXISTS`).
+- The converted `0.6.0` file belongs to the `0.6.0` read stack (the published `kdna` CLI's `read` and `validate`). This CLI's own `read` remains the container `0.5.0` session path and does not consume the converted file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-studio-cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Terminal Host for current typed Studio creation and separate human or authorized Agent adoption channels.",
   "type": "commonjs",
   "bin": {
@@ -54,7 +54,7 @@
   "dependencies": {
     "@aikdna/kdna-core": "0.37.2",
     "@aikdna/kdna-read": "0.11.3",
-    "@aikdna/kdna-studio-core": "4.0.0"
+    "@aikdna/kdna-studio-core": "4.1.0"
   },
   "directories": {
     "test": "tests"

package/src/public-bindings.json

@@ -14,7 +14,7 @@
   "packages": {
     "@aikdna/kdna-core": "0.37.2",
     "@aikdna/kdna-read": "0.11.3",
-    "@aikdna/kdna-studio-core": "4.0.0"
+    "@aikdna/kdna-studio-core": "4.1.0"
   },
   "archives": [
     {
@@ -3387,7 +3387,7 @@
     },
     {
       "name": "@aikdna/kdna-studio-core",
-      "version": "4.0.0",
+      "version": "4.1.0",
       "files": [
         {
           "path": "LICENSE",
@@ -3404,20 +3404,20 @@
         {
           "path": "README.md",
           "mode": 420,
-          "bytes": 3191,
-          "sha256": "da1a21461c973a88a76b6ca4e312c13f2ae93b0afd118a515c9f78b80cbf4e82"
+          "bytes": 3831,
+          "sha256": "bfe5882f17675d6f9d46bc3fa8c8821462ebb5e0bf3dcd1cc7bdef772fd0e785"
         },
         {
           "path": "docs/CURRENT-CREATION-CONTRACT.md",
           "mode": 420,
-          "bytes": 17072,
-          "sha256": "ae98e176ce3131baddf498ef81593799c3b50945cbc056bc104480e6717326a5"
+          "bytes": 19874,
+          "sha256": "ca3fe7ace0410242bd20aac91d45fbd901f0b6863225fe9c3f6b63ac70492d7b"
         },
         {
           "path": "package.json",
           "mode": 420,
-          "bytes": 3028,
-          "sha256": "8840cd60ec17e0fd9e99aeffb72f3ec01b065c6e339603cf00c40a079278cdc6"
+          "bytes": 3058,
+          "sha256": "3f79d834c4b25ffaa48f6a33d47efc30ad4150a6bdb6e203d83f57c293666f00"
         },
         {
           "path": "src/compile/component-compiler.js",
@@ -3434,14 +3434,14 @@
         {
           "path": "src/compile/component-materialization.js",
           "mode": 420,
-          "bytes": 9616,
-          "sha256": "6ec948d78bf3a3f76d1a8c101703172f5e80181b4f986b8bac7a50c175395a92"
+          "bytes": 12082,
+          "sha256": "1279ef69ff9a02bb3ec3a6fd65ff37a9f7cb8e5c482f65612400ff9c9f4296a5"
         },
         {
           "path": "src/creation-engine/component-input.js",
           "mode": 420,
-          "bytes": 7630,
-          "sha256": "24310f87292a69b993870d93d51db9ccb14e57b56e581cc64d7a4b6092a9356b"
+          "bytes": 9498,
+          "sha256": "fc013a968f7242da85308d4f396d6cc2526207dfdded37cbb53a7087fde6dcc7"
         },
         {
           "path": "src/creation-engine/component-runtime-binding.js",
@@ -3458,8 +3458,8 @@
         {
           "path": "src/creation-engine/component-session.js",
           "mode": 420,
-          "bytes": 11729,
-          "sha256": "8a293e3661a2591061c8ddf15a7287890482bbeb34d8200d734c3b561c5f340a"
+          "bytes": 12341,
+          "sha256": "07e0ea153cca4bd20718ad526a1a57d260b5399bf769ce90768cd89c380e6116"
         },
         {
           "path": "src/creation-engine/creation-context.js",
@@ -3470,14 +3470,14 @@
         {
           "path": "src/evidence/component-audit.js",
           "mode": 420,
-          "bytes": 7516,
-          "sha256": "2eabf9957c1588c7d68159df8291839669358613d8587c9b03ebeff770706d18"
+          "bytes": 8089,
+          "sha256": "ea8f60a9f83848e5ea8482c9714a9c235db0d8f204ae7f533743d9d52f2918f1"
         },
         {
           "path": "src/evidence/component-evidence.js",
           "mode": 420,
-          "bytes": 6621,
-          "sha256": "c45199e0abc39c8ecf0d99829b2a1a8e5bf116939431a61b91865e78f13fa6ef"
+          "bytes": 7352,
+          "sha256": "93cf907c1d50b1ba978e7675b8bc0f82578ec22dcb06a164574f32121305930a"
         },
         {
           "path": "src/evidence/component-json.js",
@@ -3504,7 +3504,7 @@
           "sha256": "f32003db722d963a2a0fcbcc88954a4c73d75b6f82c46fd89e731f3db2b57f3f"
         }
       ],
-      "sha256": "062c35970e4c7e3ba49f8d9420f1e221a3ec007fac145d67c04fe5ee2e88be62",
+      "sha256": "76a5e7dcca71b28259e5058d241304912713d72e9defba98ce8a03f7e4d1e22a",
       "publicEntry": "src/index.js",
       "dependencies": {
         "cbor-x": "1.6.5",

package/src/terminal-workspace.js

@@ -8,6 +8,7 @@ const net = require('node:net');
 const os = require('node:os');
 const tty = require('node:tty');
 const { TextDecoder } = require('node:util');
+const { spawnSync } = require('node:child_process');
 const { createRequire } = require('node:module');
 const bindings = require('./public-bindings.json');
 const LIMIT = 1024 * 1024;
@@ -190,9 +191,10 @@ function dependencies() {
 
 function options(argv) {
   const command = argv[0] || 'help';
-  if (!['help', '--help', '--version', 'session', 'verify', 'read'].includes(command)) fail('CLI_COMMAND_UNSUPPORTED');
+  if (!['help', '--help', '--version', 'session', 'verify', 'read', 'export06'].includes(command)) fail('CLI_COMMAND_UNSUPPORTED');
   const opts = { command, materials: [] };
   const allowed = command === 'session' ? ['--out', '--human-fd', '--agent-adoption-fd', '--delegation-record', '--text', '--interview', '--synthetic-fixture', '--password-fd'] :
+    command === 'export06' ? ['--bundle', '--output', '--kdna'] :
     ['verify', 'read'].includes(command) ? ['--bundle', ...(command === 'read' ? ['--allow-read', '--budget', '--judgment'] : [])] : [];
   const seen = new Set();
   for (let i = 1; i < argv.length; i++) {
@@ -208,7 +210,7 @@ function options(argv) {
     else opts[flag] = value;
   }
   if (command === 'session' && !opts['--out']) fail('CLI_OUTPUT_REQUIRED');
-  if (['verify', 'read'].includes(command) && !opts['--bundle']) fail('CLI_BUNDLE_REQUIRED');
+  if (['verify', 'read', 'export06'].includes(command) && !opts['--bundle']) fail('CLI_BUNDLE_REQUIRED');
   if (opts['--human-fd'] && (!/^\d+$/.test(opts['--human-fd']) || Number(opts['--human-fd']) < 3)) fail('CLI_HUMAN_CHANNEL_INVALID');
   if (opts['--agent-adoption-fd'] && (!/^\d+$/.test(opts['--agent-adoption-fd']) || Number(opts['--agent-adoption-fd']) < 3)) fail('CLI_AGENT_ADOPTION_CHANNEL_INVALID');
   if (Boolean(opts['--agent-adoption-fd']) !== Boolean(opts['--delegation-record']) || (opts['--agent-adoption-fd'] && opts['--human-fd'])) fail('CLI_ADOPTION_OPTIONS_INVALID');
@@ -424,6 +426,7 @@ async function session(opts) {
         case 'brief': result = workspace.agent.setBrief(value.data); break;
         case 'propose': result = operations.propose(value.data); break;
         case 'revise': result = operations.revise(value.data); break;
+        case 'system': result = workspace.agent.declareSystem(value.data); break;
         case 'interview': {
           record(value.data, ['title', 'question']); const question = text(value.data.question);
           phase = 'human';
@@ -492,6 +495,51 @@ async function consume(opts) {
   if (result.channel !== 'read_envelope' || result.envelope.status !== 'ready') process.exitCode = 3;
 }
 
+const KDNA_CLI_GUIDANCE =
+  'kdna CLI not found: obtain it per the public instructions (the Git channel or the published exact coordinate) and pass --kdna EXECUTABLE or set KDNA_CLI_BIN. This step never falls back to a private conversion path.';
+
+function resolveKdnaCli(opts) {
+  const candidates = [];
+  if (opts['--kdna'] !== undefined) candidates.push(opts['--kdna']);
+  else if (process.env.KDNA_CLI_BIN) candidates.push(process.env.KDNA_CLI_BIN);
+  else for (const dir of (process.env.PATH || '').split(path.delimiter)) if (dir) candidates.push(path.join(dir, 'kdna'));
+  for (const candidate of candidates) {
+    try {
+      if (fs.statSync(candidate).isFile()) return candidate;
+    } catch { /* keep looking */ }
+  }
+  process.stderr.write(KDNA_CLI_GUIDANCE + '\n');
+  fail('CLI_KDNA_CONVERT_MISSING');
+}
+
+// Explicit export to the 0.6 container: the bundle is read-only here; the
+// conversion is the published kdna CLI's convert step, never a private path.
+function export06(opts) {
+  const bundle = path.resolve(opts['--bundle']);
+  const asset = path.join(bundle, 'asset.kdna');
+  let entry;
+  try { entry = fs.statSync(asset); } catch { fail('CLI_BUNDLE_ASSET_MISSING'); }
+  if (!entry.isFile()) fail('CLI_BUNDLE_ASSET_MISSING');
+  // The delivered bundle is a sealed read-only unit (directory and files);
+  // the converted file goes beside it, never inside.
+  const output = opts['--output'] === undefined ? bundle + '.0.6.kdna' : path.resolve(opts['--output']);
+  if (output === asset) fail('CLI_EXPORT06_OUTPUT_INVALID');
+  const kdna = resolveKdnaCli(opts);
+  const bytes = fs.readFileSync(asset);
+  const expected = 'sha256:' + crypto.createHash('sha256').update(bytes).digest('hex');
+  const result = spawnSync(kdna, ['convert', asset, '--expected-a', expected, '--output', output, '--allow-source', '--json'], {
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  if (result.error) {
+    if (result.error.code === 'ENOENT') { process.stderr.write(KDNA_CLI_GUIDANCE + '\n'); fail('CLI_KDNA_CONVERT_MISSING'); }
+    fail('CLI_EXPORT06_EXECUTION_FAILED');
+  }
+  if (typeof result.stdout === 'string' && result.stdout) process.stdout.write(result.stdout);
+  if (typeof result.stderr === 'string' && result.stderr) process.stderr.write(result.stderr);
+  process.exitCode = Number.isInteger(result.status) ? result.status : 1;
+}
+
 async function main(argv) {
   const opts = options(argv);
   if (opts.command === '--version') { process.stdout.write(require('../package.json').version + '\n'); return; }
@@ -499,9 +547,11 @@ async function main(argv) {
     process.stdout.write('kdna-studio session --out NEW_DIRECTORY [--text FILE] [--interview FILE] [--human-fd 3 | --agent-adoption-fd 3 --delegation-record FILE] [--password-fd N]\n' +
       '--password-fd N exports the bundle as a password-protected container; the password is read once from pipe fd N (never argv or the agent stream), and the recovery code is displayed exactly once on stderr.\n' +
       'kdna-studio verify --bundle DIRECTORY\nkdna-studio read --bundle DIRECTORY [--allow-read] [--judgment 1] [--budget BYTES]\n' +
+      'kdna-studio export06 --bundle DIRECTORY [--output FILE] [--kdna EXECUTABLE]\n' +
+      '  exports the bundle to the 0.6 container by explicitly invoking the kdna CLI convert step; the default output is the new sibling file DIRECTORY.0.6.kdna, and the sealed bundle contents are never written.\n' +
       'Agent operation JSONL uses stdin/stdout. Adoption replies use the terminal or a separate human/authorized-Agent fd, with explicit channel kind.\n' +
       'Ordinary and component-rich alternatives use the same current live creation graph. See docs/TERMINAL_AGENT_CREATION.md.\n'); return;
   }
-  if (opts.command === 'session') await session(opts); else await consume(opts);
+  if (opts.command === 'session') await session(opts); else if (opts.command === 'export06') export06(opts); else await consume(opts);
 }
 module.exports = { main };