@aikdna/kdna-studio-cli 0.9.2 → 0.10.2

package/README.md

@@ -125,6 +125,11 @@ A KDNA runtime export contains only these top-level entries:
 - `payload.kdnab`
 - `checksums.json`
 
+The current producer writes `format_version: 0.1.0`, payload profile
+`kdna.payload.judgment` with `profile_version: 0.1.0`, and digest profile
+`kdna.digest-basis.runtime-entry-set` with `digest_profile_version: 0.1.0`.
+These compatibility coordinates are independent of package versions.
+
 Authoring/source entries such as `KDNA_Core.json`, `KDNA_Patterns.json`, and
 `source_cards` are not runtime distribution entries. They may exist in Studio
 compile output or legacy imports, but they must not be emitted by the runtime
@@ -161,6 +166,16 @@ kdna-studio create forked --from-kdna ./parent.kdna --name @scope/forked
 kdna-studio create migrated --from-folder ./old-domain-json --name @scope/migrated
 ```
 
+Current `.kdna` imports also preserve explicitly declared `highest_question`,
+`worldview`, ordered `value_order`, and `judgment_role` values in the editable
+project. Re-export writes those values back exactly; Studio does not infer a
+replacement judgment core from an axiom.
+
+Imports preserve authored source references, `core_structure` relations,
+pattern subtypes, scenario and case metadata, extended reasoning fields, and
+source-authored evolution. Studio-only card state and lock audit records remain
+authoring provenance and are not rewritten as Runtime judgment evolution.
+
 ## Related
 
 - [KDNA Core](https://github.com/aikdna/kdna) — Official format specification

package/bin/kdna-studio.js

@@ -9,7 +9,7 @@ const { execFileSync } = require('child_process');
 
 function loadStudioCore() {
   const publishedCore = require('@aikdna/kdna-studio-core');
-  if (publishedCore.exportRuntime) return publishedCore;
+  if (publishedCore.exportRuntime && publishedCore.protocolContract) return publishedCore;
   try {
     return require('../../kdna-studio-core/src');
   } catch (_) {
@@ -26,6 +26,7 @@ const {
   creator: creatorApi,
   distillation: distillationApi,
   exportRuntime,
+  protocolContract,
 } = loadStudioCore();
 
 const llm = require('../src/llm');
@@ -365,12 +366,23 @@ function cleanFields(fields = {}) {
   return cleaned;
 }
 
+function importedFields(entry = {}, options = {}) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return {};
+  const fields = JSON.parse(JSON.stringify(entry));
+  for (const key of ['id', 'status', 'locked', 'human_lock', 'audit_log', 'source_authored']) {
+    delete fields[key];
+  }
+  if (options.keepType !== true) delete fields.type;
+  return cleanFields(fields);
+}
+
 function importedCard(type, fields = {}, id = null) {
-  try {
-    return cardApi.createCard(type, cleanFields(fields), id || null);
-  } catch (_) {
-    return null;
+  const card = cardApi.createCard(type, cleanFields(fields), id || null);
+  if (card === null) {
+    throw new Error(`failed to create card type="${type}" id="${id || '(auto)'}" — ` +
+      `the card type may require additional required fields or the fields may be malformed`);
   }
+  return card;
 }
 
 // Bug (#3 + #4 UX): payload.kdnab intentionally carries the same
@@ -400,8 +412,10 @@ function pushImportedCard(cards, type, fields = {}, id = null) {
     }
     return;
   }
-  if (id) _importedIds.add(id);
   const card = importedCard(type, fields, id);
+  // Register the id only after card creation succeeds; a failed creation
+  // must not consume the id and prevent retry.
+  if (card && id) _importedIds.add(id);
   if (card) cards.push(card);
 }
 
@@ -437,31 +451,22 @@ function cardsFromRuntimePayload(payload) {
   if (cards.length > 0) return cards;
 
   for (const ax of (Array.isArray(payload.core?.axioms) ? payload.core?.axioms : [])) {
-    pushImportedCard(cards, 'axiom', {
-      one_sentence: ax.one_sentence || '',
-      full_statement: ax.full_statement || '',
-      why: ax.why || '',
-      applies_when: ax.applies_when || [],
-      does_not_apply_when: ax.does_not_apply_when || [],
-      failure_risk: ax.failure_risk || '',
-      confidence: ax.confidence || '',
-      evidence_type: ax.evidence_type || '',
-    }, ax.id || null);
+    pushImportedCard(cards, 'axiom', importedFields(ax), ax.id || null);
   }
   for (const ont of (Array.isArray(payload.core?.ontology) ? payload.core?.ontology : [])) {
-    pushImportedCard(cards, 'ontology', ont, ont.id || null);
+    pushImportedCard(cards, 'ontology', importedFields(ont), ont.id || null);
   }
   for (const fw of (Array.isArray(payload.core?.frameworks) ? payload.core?.frameworks : [])) {
-    pushImportedCard(cards, 'framework', fw, fw.id || null);
+    pushImportedCard(cards, 'framework', importedFields(fw), fw.id || null);
   }
   for (const stance of (Array.isArray(payload.core?.stances) ? payload.core?.stances : [])) {
-    pushImportedCard(cards, 'stance', stance, stance.id || null);
+    pushImportedCard(cards, 'stance', importedFields(stance), stance.id || null);
   }
   for (const aesthetic of (Array.isArray(payload.core?.aesthetics) ? payload.core?.aesthetics : [])) {
-    pushImportedCard(cards, 'aesthetic', aesthetic, aesthetic.id || null);
+    pushImportedCard(cards, 'aesthetic', importedFields(aesthetic), aesthetic.id || null);
   }
   for (const boundary of (Array.isArray(payload.core?.boundaries) ? payload.core?.boundaries : [])) {
-    pushImportedCard(cards, 'boundary', boundary, boundary.id || null);
+    pushImportedCard(cards, 'boundary', importedFields(boundary), boundary.id || null);
   }
   // risk_model may be either an array of risk items (legacy) or
   // `{risks: [...]}` (current). Treat both shapes; ignore everything else
@@ -469,7 +474,7 @@ function cardsFromRuntimePayload(payload) {
   const riskModel = payload.core?.risk_model;
   const riskItems = Array.isArray(riskModel) ? riskModel : (riskModel?.risks || []);
   for (const risk of riskItems) {
-    pushImportedCard(cards, 'risk', risk, risk.id || null);
+    pushImportedCard(cards, 'risk', importedFields(risk), risk.id || null);
   }
   for (const pattern of (Array.isArray(payload.patterns) ? payload.patterns : [])) {
     // Bug (#146): prior version dropped any payload.patterns entry
@@ -499,32 +504,34 @@ function cardsFromRuntimePayload(payload) {
         );
         continue;
       }
-      fields = { ...pattern };
-      delete fields.type;
+      fields = importedFields(pattern);
     } else {
-      const { type: _stripped, ...rest } = pattern;
-      fields = rest;
+      fields = importedFields(pattern, { keepType: type === 'pattern' || LEGACY_PATTERN_SUBTYPES.has(type) });
+    }
+    if (LEGACY_PATTERN_SUBTYPES.has(type)) {
+      fields = {
+        ...fields,
+        type,
+        legacy_subtype: fields.legacy_subtype || type,
+      };
+      type = 'pattern';
     }
     pushImportedCard(cards, type, fields, pattern.id || null);
   }
   for (const scenario of (Array.isArray(payload.scenarios) ? payload.scenarios : [])) {
-    pushImportedCard(cards, 'scenario', scenario, scenario.id || null);
+    pushImportedCard(cards, 'scenario', importedFields(scenario), scenario.id || null);
   }
   for (const item of (Array.isArray(payload.cases) ? payload.cases : [])) {
-    pushImportedCard(cards, 'case', item, item.id || null);
-  }
-  // Accept both `self_check` (canonical) and `self_checks` (legacy schema
-  // name) so we round-trip assets written by either version of the
-  // payload-profile schema. Bug (#53): prior version used
-  // `arr || []`, which would crash with "object is not iterable" if
-  // the field was a truthy non-array (e.g. a single `{question: ...}`
-  // object instead of an array). The fix guards with Array.isArray.
-  const rawSelfCheck = payload.reasoning?.self_check
-    || payload.reasoning?.self_checks;
+    pushImportedCard(cards, 'case', importedFields(item), item.id || null);
+  }
+  // The current payload contract has one self-check field. Refuse to infer a
+  // parallel field name: Core validation owns format migration, while Studio
+  // imports only the current validated payload shape.
+  const rawSelfCheck = payload.reasoning?.self_check;
   const selfCheckArr = Array.isArray(rawSelfCheck) ? rawSelfCheck : [];
   for (const selfCheck of selfCheckArr) {
-    const fields = typeof selfCheck === 'string' ? { question: selfCheck } : selfCheck;
-    pushImportedCard(cards, 'self_check', fields, fields.id || null);
+    const fields = typeof selfCheck === 'string' ? { question: selfCheck } : importedFields(selfCheck);
+    pushImportedCard(cards, 'self_check', fields, typeof selfCheck === 'object' ? selfCheck.id || null : null);
   }
   for (const failureMode of (Array.isArray(payload.reasoning?.failure_modes) ? payload.reasoning?.failure_modes : [])) {
     // Bug (#145 follow-up): the prior version dropped three
@@ -533,7 +540,8 @@ function cardsFromRuntimePayload(payload) {
     // project that round-tripped through `migrate` lost
     // these fields every time. The fix reads them through, matching
     // the export-side map in kdna-studio-core's buildPayload.
-    pushImportedCard(cards, 'misunderstanding', {
+    const fields = {
+      ...importedFields(failureMode),
       wrong: failureMode.mode || failureMode.wrong || '',
       correct: failureMode.correct || '',
       key_distinction: failureMode.key_distinction || '',
@@ -541,7 +549,9 @@ function cardsFromRuntimePayload(payload) {
       failure_risk: failureMode.failure_risk || '',
       applies_when: Array.isArray(failureMode.applies_when) ? failureMode.applies_when : [],
       does_not_apply_when: Array.isArray(failureMode.does_not_apply_when) ? failureMode.does_not_apply_when : [],
-    }, failureMode.id || null);
+    };
+    delete fields.mode;
+    pushImportedCard(cards, 'misunderstanding', fields, failureMode.id || null);
   }
   for (const chain of (Array.isArray(payload.reasoning?.reasoning_chains) ? payload.reasoning?.reasoning_chains : [])) {
     // Bug (#4 UX): compile/index.js synthesises one reasoning chain
@@ -550,7 +560,7 @@ function cardsFromRuntimePayload(payload) {
     // doubled the card count on round-trip. The fix skips chains
     // that the producer explicitly marked as synthesised.
     if (chain.source_authored === false) continue;
-    pushImportedCard(cards, 'reasoning', chain, chain.id || null);
+    pushImportedCard(cards, 'reasoning', importedFields(chain), chain.id || null);
   }
   for (const stage of (Array.isArray(payload.evolution?.stages) ? payload.evolution?.stages : [])) {
     // Distinguish source-authored stages (preserved identity) from
@@ -559,7 +569,7 @@ function cardsFromRuntimePayload(payload) {
     // so the importer doesn't double-count what was already in the
     // locked judgment cards.
     if (stage.source_authored === true) {
-      pushImportedCard(cards, 'evolution_stage', stage, stage.id || null);
+      pushImportedCard(cards, 'evolution_stage', importedFields(stage), stage.id || null);
     }
   }
   return cards;
@@ -567,12 +577,27 @@ function cardsFromRuntimePayload(payload) {
 
 function cardsFromPayload(payload) {
   if (!payload || typeof payload !== 'object') return [];
-  if (payload.profile === 'judgment-profile-v1' || payload.core || payload.source_cards) {
+  if (
+    payload.profile === protocolContract.PAYLOAD_PROFILE &&
+    payload.profile_version === protocolContract.PAYLOAD_PROFILE_VERSION
+  ) {
     return cardsFromRuntimePayload(payload);
   }
   return [];
 }
 
+function judgmentCoreFromRuntimePayload(payload) {
+  const core = payload?.core;
+  if (!core || typeof core !== 'object' || Array.isArray(core)) return null;
+  const declared = {};
+  for (const field of ['highest_question', 'worldview', 'value_order', 'judgment_role']) {
+    if (Object.hasOwn(core, field)) {
+      declared[field] = JSON.parse(JSON.stringify(core[field]));
+    }
+  }
+  return Object.keys(declared).length > 0 ? declared : null;
+}
+
 function buildManifest(project, name) {
   // Bug (#58): prior version was a hand-rolled manifest builder that
   // shared zero logic with the canonical buildManifest in
@@ -591,12 +616,12 @@ function buildManifest(project, name) {
   const assetId = assetIdFromName(name || source.name || project.name);
   const author = source.author || project.author || {};
   return {
-    kdna_version: '1.0',
+    format_version: protocolContract.FORMAT_VERSION,
     asset_id: assetId,
     asset_uid: project.asset_uid || source.asset_uid || 'urn:uuid:' + crypto.randomUUID(),
     asset_type: project.type === 'cluster' ? 'cluster' : 'domain',
     source_asset_type: source.asset_type || null,
-    title: titleFromName(source.name || name || project.name, assetId),
+    title: source.title || project.title || titleFromName(source.name || name || project.name, assetId),
     version: semverValue(project.release?.version || source.version, '1.0.0'),
     judgment_version: semverValue(project.release?.judgment_version || source.judgment_version || source.version, '1.0.0'),
     created_at: isoDateTime(source.created_at || source.created || project.created),
@@ -605,7 +630,11 @@ function buildManifest(project, name) {
       name: author.name || project.author?.name || 'Studio Export',
       id: author.id || project.author?.id || undefined,
     },
-    compatibility: { min_loader_version: '1.0.0', profile: 'judgment-profile-v1' },
+    compatibility: {
+      min_loader_version: '0.19.0',
+      profile: protocolContract.PAYLOAD_PROFILE,
+      profile_version: protocolContract.PAYLOAD_PROFILE_VERSION,
+    },
     payload: { path: 'payload.kdnab', encoding: 'cbor', encrypted: false },
     summary: source.core_insight || project.release?.description || source.description || '',
     description: source.description || project.release?.description || '',
@@ -664,6 +693,7 @@ function cmdCreate(args) {
         sourceMode,
         creatorIdentity,
         lineage,
+        judgmentCore: kdnaData.judgment_core,
       });
       project.cards = kdnaData.cards;
       // Bug #15 / #28 follow-up: store the source KDNA_* files on the
@@ -674,7 +704,13 @@ function cmdCreate(args) {
       if (kdnaData.source_patterns) project.source_patterns = kdnaData.source_patterns;
       if (kdnaData.source_reasoning) project.source_reasoning = kdnaData.source_reasoning;
       if (kdnaData.source_evolution) project.source_evolution = kdnaData.source_evolution;
+      if (kdnaData.source_core_structure) project.source_core_structure = kdnaData.source_core_structure;
       if (kdnaData.source_manifest) project.source_manifest = publicManifestMetadata(kdnaData.source_manifest);
+      if (kdnaData.source_manifest?.asset_uid) project.asset_uid = kdnaData.source_manifest.asset_uid;
+      if (kdnaData.source_manifest?.title) project.title = kdnaData.source_manifest.title;
+      if (kdnaData.source_manifest?.license) project.license = kdnaData.source_manifest.license;
+      if (kdnaData.source_manifest?.languages) project.languages = kdnaData.source_manifest.languages;
+      if (kdnaData.source_manifest?.language) project.default_language = kdnaData.source_manifest.language;
       if (kdnaData.source_manifest?.version) {
         if (!project.release) project.release = {};
         project.release.version = kdnaData.source_manifest.version;
@@ -683,9 +719,9 @@ function cmdCreate(args) {
         if (!project.release) project.release = {};
         project.release.judgment_version = kdnaData.source_manifest.judgment_version;
       }
-      if (kdnaData.source_manifest?.description) {
+      if (kdnaData.source_manifest?.description || kdnaData.source_manifest?.summary) {
         if (!project.release) project.release = {};
-        project.release.description = kdnaData.source_manifest.description;
+        project.release.description = kdnaData.source_manifest.description || kdnaData.source_manifest.summary;
       }
       if (project.stages?.judgment_cards) {
         project.stages.judgment_cards.total = kdnaData.cards.length;
@@ -739,19 +775,36 @@ function importFromKdna(kdnaPath) {
   if (stats.size > 50 * 1024 * 1024) {
     fail(`KDNA file too large (${(stats.size / (1024 * 1024)).toFixed(1)} MiB, max 50 MiB): ${absKdna}`);
   }
-  let runtimeCore;
-  try { runtimeCore = require('@aikdna/kdna-core'); } catch {
-    fail('@aikdna/kdna-core is required to validate --from-kdna imports.');
-  }
-  const validation = runtimeCore.validate(absKdna);
-  if (!validation.overall_valid) {
-    fail(`Not a current .kdna asset: ${(validation.problems || []).join('; ')}`);
-  }
+
+  // ── read ZIP before Core validation so the profile can branch ──
   const zipBuf = fs.readFileSync(absKdna);
   const entries = readZipEntries(zipBuf);
+  validateZipContainer(entries);
   if (!entries.has('kdna.json')) fail('Not a valid .kdna asset: missing kdna.json');
+  if (!entries.has('payload.kdnab')) fail('Not a valid .kdna asset: missing payload.kdnab. Use --from-folder for legacy JSON source migration.');
 
   const manifest = JSON.parse(entries.get('kdna.json').toString());
+  const payload = decodePayload(entries.get('payload.kdnab'), manifest);
+  const profile = payload?.profile;
+
+  // ── branch: current profile requires Core validate; legacy uses a frozen contract ──
+  let runtimeCore, isLegacy;
+  try { runtimeCore = require('@aikdna/kdna-core'); } catch {
+    fail('@aikdna/kdna-core is required to validate --from-kdna imports.');
+  }
+  if (profile === 'kdna.payload.judgment') {
+    const validation = runtimeCore.validate(absKdna);
+    if (!validation.overall_valid) {
+      fail(`Not a current .kdna asset: ${(validation.problems || []).join('; ')}`);
+    }
+    isLegacy = false;
+  } else if (profile === 'judgment-profile-v1') {
+    validateLegacyImportContract(manifest, payload);
+    isLegacy = true;
+  } else {
+    fail(`Unsupported payload profile "${profile || '(none)'}". Only kdna.payload.judgment and judgment-profile-v1 are accepted for --from-kdna.`);
+  }
+
   const lineage = {
     type: 'fork',
     parent_name: packageNameFromManifest(manifest),
@@ -760,15 +813,16 @@ function importFromKdna(kdnaPath) {
     parent_asset_digest: manifest.content_digest || manifest.asset_digest || null,
   };
 
-  // Current assets carry strict-CBOR `payload.kdnab`. Legacy source folders
-  // are migrated explicitly with --from-folder; they are not runtime assets.
   const importedCards = [];
-  if (!entries.has('payload.kdnab')) {
-    fail('Not a current .kdna asset: missing payload.kdnab. Use --from-folder for legacy JSON source migration.');
-  }
+  let judgmentCore = null;
   try {
-    const payload = decodePayload(entries.get('payload.kdnab'), manifest);
-    importedCards.push(...cardsFromPayload(payload));
+    if (isLegacy) {
+      importedCards.push(...cardsFromLegacyPayload(payload));
+      judgmentCore = judgmentCoreFromLegacyPayload(payload);
+    } else {
+      importedCards.push(...cardsFromPayload(payload));
+      judgmentCore = judgmentCoreFromRuntimePayload(payload);
+    }
   } catch (e) {
     fail(`Could not import cards from payload.kdnab: ${e.message}`);
   }
@@ -777,22 +831,239 @@ function importFromKdna(kdnaPath) {
     fail(`No current judgment cards could be extracted from ${absKdna}.`);
   }
 
-  // Bug #15 / #28 follow-up: surface the source's KDNA_Patterns /
-  // KDNA_Reasoning / KDNA_Evolution entries so cmdCreate can store
-  // them on the project. The next export then forwards them to
-  // compileDomain via exportRuntimeAsset, which preserves
-  // changelog / version_notes / reasoning_chains / banned_terms
-  // through the round-trip.
   return {
     lineage,
     cards: importedCards,
+    judgment_core: judgmentCore,
     source_manifest: manifest,
     source_patterns: null,
-    source_reasoning: null,
-    source_evolution: null,
+    source_reasoning: payload.reasoning && typeof payload.reasoning === 'object'
+      ? JSON.parse(JSON.stringify(payload.reasoning))
+      : null,
+    source_evolution: payload.evolution && typeof payload.evolution === 'object'
+      ? JSON.parse(JSON.stringify(payload.evolution))
+      : null,
+    source_core_structure: Array.isArray(payload.core?.core_structure)
+      ? JSON.parse(JSON.stringify(payload.core.core_structure))
+      : null,
   };
 }
 
+// ── legacy judgment-profile-v1 import support ───────────────────────────
+
+const LEGACY_PROFILE = 'judgment-profile-v1';
+
+const LEGACY_PATTERN_TYPE_MAP = {
+  term: 'term',
+  banned_term: 'banned_term',
+  misunderstanding: 'misunderstanding',
+  self_check: 'self_check',
+  scenario: 'scenario',
+  case: 'case',
+  reasoning: 'reasoning',
+  risk: 'risk',
+  axiom: 'axiom',
+  ontology: 'ontology',
+  framework: 'framework',
+  stance: 'stance',
+  aesthetic: 'aesthetic',
+  boundary: 'boundary',
+  evolution_stage: 'evolution_stage',
+};
+
+// Pattern subtypes that map to the generic 'pattern' card; the original
+// subtype is preserved in fields.legacy_subtype for audit and re-export.
+const LEGACY_PATTERN_SUBTYPES = new Set([
+  'failure_pattern', 'design_pattern', 'response_pattern',
+  'stopping_pattern', 'completion_pattern', 'decision_pattern',
+  'reasoning_pattern', 'action_pattern', 'recovery_pattern',
+  'responsibility_pattern',
+]);
+
+const MAX_ZIP_ENTRIES = 100;
+const MAX_SINGLE_ENTRY_UNCOMPRESSED = 10 * 1024 * 1024;
+const MAX_TOTAL_UNCOMPRESSED = 50 * 1024 * 1024;
+const REQUIRED_ZIP_ENTRIES = ['kdna.json', 'payload.kdnab', 'checksums.json', 'mimetype'];
+
+function validateZipContainer(entries) {
+  if (entries.size > MAX_ZIP_ENTRIES) {
+    fail(`ZIP container has too many entries (${entries.size}, max ${MAX_ZIP_ENTRIES})`);
+  }
+  for (const name of REQUIRED_ZIP_ENTRIES) {
+    if (!entries.has(name)) fail(`Not a valid .kdna container: missing required entry "${name}"`);
+  }
+  let totalSize = 0;
+  for (const [name, buf] of entries) {
+    if (path.isAbsolute(name) || name.includes('..') || name.includes('\\')) {
+      fail(`ZIP entry "${name}" has an unsafe path`);
+    }
+    if (Buffer.isBuffer(buf) && buf.length > MAX_SINGLE_ENTRY_UNCOMPRESSED) {
+      fail(`ZIP entry "${name}" is too large (${buf.length} bytes)`);
+    }
+    totalSize += Buffer.isBuffer(buf) ? buf.length : 0;
+  }
+  if (totalSize > MAX_TOTAL_UNCOMPRESSED) {
+    fail(`ZIP container total uncompressed size exceeds limit (${totalSize} bytes)`);
+  }
+}
+
+function validateLegacyImportContract(manifest, payload) {
+  // Frozen validation for judgment-profile-v1 assets.
+  if (!manifest || typeof manifest !== 'object') fail('Legacy asset manifest is missing or invalid');
+  if (manifest.kdna_version !== '1.0') fail(`Legacy asset must declare kdna_version "1.0", got "${manifest.kdna_version}"`);
+  if (!manifest.asset_id || typeof manifest.asset_id !== 'string') fail('Legacy asset_id is missing');
+  if (!manifest.compatibility || manifest.compatibility.profile !== LEGACY_PROFILE) {
+    fail(`Legacy asset compatibility.profile must be "${LEGACY_PROFILE}"`);
+  }
+  if (!manifest.payload || manifest.payload.path !== 'payload.kdnab') {
+    fail('Legacy asset payload.path must be "payload.kdnab"');
+  }
+  if (manifest.payload.encoding !== 'cbor') {
+    fail('Legacy asset payload.encoding must be "cbor"');
+  }
+  if (manifest.payload.encrypted) fail('Legacy asset must not be encrypted');
+  if (!payload || typeof payload !== 'object') fail('Legacy asset payload is missing or invalid');
+  if (payload.profile !== LEGACY_PROFILE) fail('Legacy payload must declare profile "judgment-profile-v1"');
+  if (!payload.core || typeof payload.core !== 'object') fail('Legacy payload must contain a "core" object');
+  if (!Array.isArray(payload.core.axioms)) fail('Legacy payload must contain axioms');
+  if (!payload.patterns || !Array.isArray(payload.patterns)) fail('Legacy payload must contain patterns');
+}
+
+function judgmentCoreFromLegacyPayload(payload) {
+  const core = payload.core || {};
+  const result = {};
+  if (typeof core.highest_question === 'string' && core.highest_question) result.highest_question = core.highest_question;
+  if (Array.isArray(core.worldview) && core.worldview.length) result.worldview = core.worldview;
+  if (Array.isArray(core.value_order) && core.value_order.length) result.value_order = core.value_order;
+  if (core.judgment_role && typeof core.judgment_role === 'object' && Object.keys(core.judgment_role).length) result.judgment_role = core.judgment_role;
+  return Object.keys(result).length ? result : null;
+}
+
+function legacyStableId(type, fields, prefix) {
+  // Deterministic ID for legacy items that lack a declared id.
+  // Prefix is the parent scope (e.g. the asset name or domain id).
+  const sorted = JSON.stringify(Object.entries(fields).sort());
+  const h = require('crypto').createHash('sha256').update(`${type}:${sorted}`).digest('hex');
+  return `${prefix}_${h.slice(0, 12)}`;
+}
+
+const _legacyDedupIds = new Set();
+
+function _legacyDedupPush(cards, type, fields, id) {
+  // Deduplicate by id IF an id is declared. Items without ids are unique
+  // (deterministic by content). A second push with the same id merges.
+  if (!id) { pushImportedCard(cards, type, fields, null); return; }
+  if (_legacyDedupIds.has(id)) { pushImportedCard(cards, type, fields, id); return; }
+  _legacyDedupIds.add(id);
+  pushImportedCard(cards, type, fields, id);
+}
+
+function cardsFromLegacyPayload(payload) {
+  _legacyDedupIds.clear();
+  const cards = [];
+  const core = payload.core || {};
+
+  // axioms
+  for (const ax of (core.axioms || [])) {
+    _legacyDedupPush(cards, 'axiom', importedFields(ax), ax.id || null);
+  }
+
+  // ontology
+  for (const ont of (core.ontology || [])) {
+    pushImportedCard(cards, 'ontology', importedFields(ont), ont.id || null);
+  }
+
+  // frameworks
+  for (const fw of (core.frameworks || [])) {
+    pushImportedCard(cards, 'framework', importedFields(fw), fw.id || null);
+  }
+
+  // stances
+  for (const st of (core.stances || [])) {
+    const fields = typeof st === 'string' ? { statement: st } : importedFields(st);
+    pushImportedCard(cards, 'stance', fields, typeof st === 'object' ? st.id || null : null);
+  }
+
+  // boundaries
+  for (const bd of (core.boundaries || [])) {
+    pushImportedCard(cards, 'boundary', importedFields(bd), bd.id || null);
+  }
+
+  // risks
+  const legacyRisks = Array.isArray(core.risk_model)
+    ? core.risk_model
+    : (Array.isArray(core.risk_model?.risks) ? core.risk_model.risks : []);
+  for (const risk of legacyRisks) {
+    pushImportedCard(cards, 'risk', importedFields(risk.fields || risk), risk.id || null);
+  }
+
+  // patterns with explicit types (including legacy subtypes)
+  const patterns = payload.patterns || [];
+  for (const p of patterns) {
+    if (!p || typeof p !== 'object') continue;
+    const rawType = p.type;
+    if (!rawType) continue; // type-less items handled separately (misunderstandings below)
+
+    if (LEGACY_PATTERN_SUBTYPES.has(rawType)) {
+      pushImportedCard(cards, 'pattern', {
+        ...importedFields(p, { keepType: true }),
+        legacy_subtype: rawType,
+      }, p.id || null);
+    } else if (rawType === 'term') {
+      pushImportedCard(cards, 'term', importedFields(p), p.id || null);
+    } else if (rawType === 'banned_term') {
+      pushImportedCard(cards, 'banned_term', importedFields(p), p.id || null);
+    } else if (LEGACY_PATTERN_TYPE_MAP.hasOwnProperty(rawType)) {
+      pushImportedCard(cards, LEGACY_PATTERN_TYPE_MAP[rawType], importedFields(p), p.id || null);
+    } else {
+      fail(`Unknown legacy pattern type "${rawType}" for card "${p.id || '(no id)'}"`);
+    }
+  }
+
+  // misunderstandings: appear in patterns[] with no type and in
+  // reasoning.failure_modes[] with slightly different field names.
+  // Import from patterns[] (richer fields). The pushImportedCard
+  // dedup handles the failure_modes view via id matching.
+  for (const p of patterns) {
+    if (!p || typeof p !== 'object') continue;
+    if (p.type) continue; // already handled above
+    if (!p.wrong && !p.correct) continue;
+    pushImportedCard(cards, 'misunderstanding', importedFields(p), p.id || null);
+  }
+
+  // reasoning chains
+  for (const chain of (payload.reasoning?.reasoning_chains || [])) {
+    const fields = importedFields(chain);
+    pushImportedCard(cards, 'reasoning', fields, chain.id || null);
+  }
+
+  // self checks: array of plain strings in legacy payload
+  for (const check of (payload.reasoning?.self_check || [])) {
+    if (typeof check === 'string' && check.trim()) {
+      const fields = { question: check.trim() };
+      const id = legacyStableId('self_check', fields, 'legacy_sc');
+      pushImportedCard(cards, 'self_check', fields, id);
+    }
+  }
+
+  // scenarios
+  for (const sc of (payload.scenarios || [])) {
+    pushImportedCard(cards, 'scenario', importedFields(sc), sc.id || null);
+  }
+
+  // cases
+  for (const cs of (payload.cases || [])) {
+    pushImportedCard(cards, 'case', importedFields(cs), cs.id || null);
+  }
+
+  // evolution stages
+  for (const stage of (payload.evolution?.stages || [])) {
+    pushImportedCard(cards, 'evolution_stage', importedFields(stage), stage.id || null);
+  }
+
+  return cards;
+}
+
 /**
  * Import cards from a legacy source folder into a new Studio project.
  * Reads KDNA_*.json files and converts entries to draft judgment cards.
@@ -827,6 +1098,7 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     if (manifest.default_language) manifestData.default_language = manifest.default_language;
     if (manifest.description) manifestData.description = manifest.description;
     if (manifest.name) manifestData.name = manifest.name;
+    if (manifest.title) manifestData.title = manifest.title;
     if (manifest.keywords) manifestData.keywords = manifest.keywords;
     if (manifest.license) manifestData.license = manifest.license;
     if (manifest.author) manifestData.author = manifest.author;
@@ -834,6 +1106,8 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     if (manifest.core_insight) manifestData.core_insight = manifest.core_insight;
     if (manifest.created_at || manifest.created) manifestData.created = manifest.created_at || manifest.created;
     if (manifest.updated_at || manifest.updated) manifestData.updated = manifest.updated_at || manifest.updated;
+    // legacy-migration bookkeeping only: preserved in the Studio project for
+    // issuer-scoped governance; the Core 0.20 export manifest never projects it
     if (manifest.risk_level) manifestData.risk_level = manifest.risk_level;
     if (manifest.fitness_for_purpose) manifestData.fitness_for_purpose = manifest.fitness_for_purpose;
   }
@@ -865,25 +1139,17 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
 
   if (core) {
     for (const ax of (Array.isArray(core.axioms) ? core.axioms : [])) {
-      const fields = {};
+      const fields = importedFields(ax);
       for (const key of ['one_sentence', 'full_statement', 'why', 'applies_when', 'does_not_apply_when', 'failure_risk', 'confidence', 'evidence_type']) {
-        if (key in ax) fields[key] = ax[key];
-        else audit.missingFields.push(`axiom.${ax.id || '?'}.${key}`);
+        if (!(key in ax)) audit.missingFields.push(`axiom.${ax.id || '?'}.${key}`);
       }
       importedCards.push(cardApi.createCard('axiom', fields, ax.id || null));
     }
     for (const ont of (Array.isArray(core.ontology) ? core.ontology : [])) {
-      importedCards.push(cardApi.createCard('ontology', {
-        one_sentence: ont.one_sentence || ont.essence || '',
-        essence: ont.essence || '', boundary: ont.boundary || '',
-        trigger_signal: ont.trigger_signal || '',
-      }, ont.id || null));
+      importedCards.push(cardApi.createCard('ontology', importedFields(ont), ont.id || null));
     }
     for (const b of (Array.isArray(core.boundaries) ? core.boundaries : [])) {
-      importedCards.push(cardApi.createCard('boundary', {
-        scope: b.scope || '', out_of_scope: b.out_of_scope || '',
-        acceptable_exceptions: b.acceptable_exceptions || [],
-      }, b.id || null));
+      importedCards.push(cardApi.createCard('boundary', importedFields(b), b.id || null));
     }
     // Accept risks as a top-level array (`risks`) or wrapped in `risk_model`
     // (either as `{risks: [...]}` or as an array itself).
@@ -894,23 +1160,16 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
       else risksSource = [];
     }
     for (const r of risksSource) {
-      importedCards.push(cardApi.createCard('risk', r.fields || r, r.id || null));
+      importedCards.push(cardApi.createCard('risk', importedFields(r.fields || r), r.id || null));
     }
     // NEW: import stances
     for (const s of (Array.isArray(core.stances) ? core.stances : [])) {
-      const text = typeof s === 'string' ? s : s.statement || s.stance || '';
-      importedCards.push(cardApi.createCard('stance', {
-        statement: text,
-        applies_when: s.applies_when || [],
-        does_not_apply_when: s.does_not_apply_when || [],
-      }, typeof s === 'object' ? s.id || null : null));
+      const fields = typeof s === 'string' ? { statement: s } : importedFields(s);
+      importedCards.push(cardApi.createCard('stance', fields, typeof s === 'object' ? s.id || null : null));
     }
     // NEW: import frameworks
     for (const fw of (Array.isArray(core.frameworks) ? core.frameworks : [])) {
-      importedCards.push(cardApi.createCard('framework', {
-        name: fw.name || '', when_to_use: fw.when_to_use || '',
-        steps: fw.steps || [],
-      }, fw.id || null));
+      importedCards.push(cardApi.createCard('framework', importedFields(fw), fw.id || null));
     }
   }
 
@@ -918,27 +1177,25 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     // NEW: import terminology
     if (patterns.terminology) {
       for (const t of (Array.isArray(patterns.terminology.standard_terms) ? patterns.terminology.standard_terms : [])) {
-        importedCards.push(cardApi.createCard('term', {
-          term: t.term || '', definition: t.definition || '',
-        }, t.id || null));
+        importedCards.push(cardApi.createCard('term', importedFields(t), t.id || null));
       }
       for (const bt of (Array.isArray(patterns.terminology.banned_terms) ? patterns.terminology.banned_terms : [])) {
-        importedCards.push(cardApi.createCard('banned_term', {
-          term: bt.term || '', why: bt.why || '', replace_with: bt.replace_with || '',
-        }, bt.id || null));
+        importedCards.push(cardApi.createCard('banned_term', importedFields(bt), bt.id || null));
       }
     }
+    for (const pattern of (Array.isArray(patterns.patterns) ? patterns.patterns : [])) {
+      const fields = importedFields(pattern, { keepType: true });
+      if (!fields.type) fields.type = 'pattern';
+      importedCards.push(cardApi.createCard('pattern', fields, pattern.id || null));
+    }
     for (const ms of (Array.isArray(patterns.misunderstandings) ? patterns.misunderstandings : [])) {
-      importedCards.push(cardApi.createCard('misunderstanding', {
-        wrong: ms.wrong || '', correct: ms.correct || '',
-        key_distinction: ms.key_distinction || '', why: ms.why || '',
-      }, ms.id || null));
+      importedCards.push(cardApi.createCard('misunderstanding', importedFields(ms), ms.id || null));
     }
     for (const sc of (Array.isArray(patterns.self_check) ? patterns.self_check : [])) {
-      const q = typeof sc === 'string' ? sc : sc.question || '';
+      const fields = typeof sc === 'string' ? { question: sc } : importedFields(sc);
       importedCards.push(cardApi.createCard(
         'self_check',
-        { question: q },
+        fields,
         typeof sc === 'object' ? sc.id || null : null,
       ));
     }
@@ -951,7 +1208,7 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     for (const aesthetic of (Array.isArray(patterns.aesthetics) ? patterns.aesthetics : [])) {
       importedCards.push(cardApi.createCard(
         'aesthetic',
-        aesthetic.fields || aesthetic,
+        importedFields(aesthetic.fields || aesthetic),
         aesthetic.id || null,
       ));
     }
@@ -960,20 +1217,14 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
   // NEW: import scenarios
   if (scenarios && Array.isArray(scenarios.scenes)) {
     for (const scene of scenarios.scenes) {
-      importedCards.push(cardApi.createCard('scenario', {
-        name: scene.name || scene.id || '',
-        trigger: scene.trigger || '', action: scene.action || '',
-      }, scene.id || null));
+      importedCards.push(cardApi.createCard('scenario', importedFields(scene), scene.id || null));
     }
   }
 
   // NEW: import cases
   if (cases && Array.isArray(cases.cases)) {
     for (const c of cases.cases) {
-      importedCards.push(cardApi.createCard('case', {
-        title: c.title || c.id || '',
-        scenario: c.scenario || '', expected: c.expected || '',
-      }, c.id || null));
+      importedCards.push(cardApi.createCard('case', importedFields(c), c.id || null));
     }
   }
 
@@ -986,26 +1237,14 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
   // identity.
   if (reasoning && Array.isArray(reasoning.reasoning_chains)) {
     for (const rc of reasoning.reasoning_chains) {
-      importedCards.push(cardApi.createCard('reasoning', {
-        axiom: rc.axiom || '',
-        one_sentence: rc.one_sentence || rc.conclusion || '',
-        chain: Array.isArray(rc.chain) ? rc.chain : (rc.logic || []),
-        principle: rc.principle || rc.name || '',
-        concrete_action: rc.concrete_action || rc.so_what || '',
-        so_what: rc.so_what || rc.concrete_action || '',
-        conclusion: rc.conclusion || '',
-      }, rc.id || null));
+      importedCards.push(cardApi.createCard('reasoning', importedFields(rc), rc.id || null));
     }
   }
 
   // NEW: import evolution stages
   if (evolution && Array.isArray(evolution.stages)) {
     for (const stage of evolution.stages) {
-      pushImportedCard(importedCards, 'evolution_stage', {
-        name: stage.name || stage.id || '',
-        level: stage.level != null ? stage.level : '',
-        description: stage.description || '',
-      }, stage.id || null);
+      pushImportedCard(importedCards, 'evolution_stage', importedFields(stage), stage.id || null);
     }
   }
 
@@ -1016,6 +1255,7 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     sourcePath: absSource,
     creatorIdentity: creatorIdentity || null,
     lineage: { type: 'migrated', parent_name: manifestData.name || null, parent_asset_uid: null, parent_version: manifestData.version || null, parent_asset_digest: null },
+    judgmentCore: judgmentCoreFromLegacyPayload({ core: core || {} }),
   });
   // Preserve manifest metadata
   if (manifestData.asset_uid) project.asset_uid = manifestData.asset_uid;
@@ -1031,11 +1271,18 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
     if (!project.release) project.release = {};
     project.release.description = manifestData.description;
   }
+  if (manifestData.title) project.title = manifestData.title;
   if (manifestData.license) project.license = manifestData.license;
   if (manifestData.author) project.author = manifestData.author;
   if (manifestData.languages) project.languages = manifestData.languages;
   if (manifestData.default_language) project.default_language = manifestData.default_language;
   if (manifestData.raw) project.source_manifest = publicManifestMetadata(manifestData.raw);
+  if (patterns) project.source_patterns = JSON.parse(JSON.stringify(patterns));
+  if (reasoning) project.source_reasoning = JSON.parse(JSON.stringify(reasoning));
+  if (evolution) project.source_evolution = JSON.parse(JSON.stringify(evolution));
+  if (Array.isArray(core?.core_structure)) {
+    project.source_core_structure = JSON.parse(JSON.stringify(core.core_structure));
+  }
 
   project.cards = importedCards;
   if (project.stages?.judgment_cards) {
@@ -1052,10 +1299,12 @@ function importFromFolder(sourceDir, projectDir, projectName, creatorIdentity, o
 }
 
 /**
- * Minimal ZIP central directory parser — reads entries into a Map.
+ * Minimal ZIP central directory parser — validates every entry before decompressing.
  */
 function readZipEntries(buf) {
   const entries = new Map();
+  const metadata = [];
+
   // Find end-of-central-directory record
   let eocdOffset = buf.length - 22;
   while (eocdOffset >= 0) {
@@ -1067,6 +1316,8 @@ function readZipEntries(buf) {
   const centralDirOffset = buf.readUInt32LE(eocdOffset + 16);
   let offset = centralDirOffset;
 
+  // Pass 1: collect metadata, validate safety before any decompression
+  let totalUncomp = 0;
   while (offset < eocdOffset) {
     const sig = buf.readUInt32LE(offset);
     if (sig !== 0x02014b50) break;
@@ -1079,20 +1330,47 @@ function readZipEntries(buf) {
     const localOffset = buf.readUInt32LE(offset + 42);
     const name = buf.toString('utf8', offset + 46, offset + 46 + nameLen);
 
-    // Read local file header to get data
-    const localNameLen = buf.readUInt16LE(localOffset + 26);
-    const localExtraLen = buf.readUInt16LE(localOffset + 28);
-    const dataStart = localOffset + 30 + localNameLen + localExtraLen;
-
-    if (compMethod === 0) {
-      entries.set(name, buf.subarray(dataStart, dataStart + uncompSize));
-    } else if (compMethod === 8) {
-      entries.set(name, zlib.inflateRawSync(buf.subarray(dataStart, dataStart + compSize)));
+    // Security: path must not be absolute, must not escape
+    if (!name || name.startsWith('/') || name.includes('..') || name.includes('\\')) {
+      throw new Error(`ZIP entry "${name}" has an unsafe path`);
     }
-
+    // Duplicate detection
+    if (entries.has(name) || metadata.some(m => m.name === name)) {
+      throw new Error(`Duplicate ZIP entry: "${name}"`);
+    }
+    if (compMethod !== 0 && compMethod !== 8) {
+      throw new Error(`ZIP entry "${name}" uses unsupported compression method ${compMethod}`);
+    }
+    totalUncomp += uncompSize;
+    if (totalUncomp > MAX_TOTAL_UNCOMPRESSED) {
+      throw new Error(`ZIP total uncompressed size ${totalUncomp} exceeds limit`);
+    }
+    if (uncompSize > MAX_SINGLE_ENTRY_UNCOMPRESSED) {
+      throw new Error(`ZIP entry "${name}" declared size ${uncompSize} exceeds limit`);
+    }
+    const dataStart = localOffset + 30 + buf.readUInt16LE(localOffset + 26) + buf.readUInt16LE(localOffset + 28);
+    metadata.push({ name, compMethod, compSize, uncompSize, dataStart });
     offset += 46 + nameLen + extraLen + commentLen;
   }
 
+  if (metadata.length > MAX_ZIP_ENTRIES) {
+    throw new Error(`ZIP container has too many entries (${metadata.length}, max ${MAX_ZIP_ENTRIES})`);
+  }
+
+  // Pass 2: decompress into entries
+  for (const m of metadata) {
+    if (m.compMethod === 0) {
+      entries.set(m.name, buf.subarray(m.dataStart, m.dataStart + m.uncompSize));
+    } else {
+      const raw = buf.subarray(m.dataStart, m.dataStart + m.compSize);
+      const inflated = zlib.inflateRawSync(raw, { maxOutputLength: m.uncompSize });
+      if (inflated.length !== m.uncompSize) {
+        throw new Error(`ZIP entry "${m.name}" decompressed length ${inflated.length} != declared ${m.uncompSize}`);
+      }
+      entries.set(m.name, inflated);
+    }
+  }
+
   return entries;
 }
 
@@ -1936,7 +2214,7 @@ function cmdStudioInstall(args) {
 function cmdStudioUpdate(args) {
   const target = args[0];
   if (!target) fail('Usage: kdna-studio update <@scope/name>');
-  // kdna update does not exist in kdna-cli v0.28.x. The correct
+  // kdna update does not exist in kdna-cli 0.28.x. The correct
   // path is to re-install via npm or use kdna install to pull
   // the latest published version of the asset.
   console.log(`To update ${target}, run:`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-studio-cli",
-  "version": "0.9.2",
+  "version": "0.10.2",
   "description": "Official KDNA Studio command-line authoring entry for creating, reviewing, compiling, and exporting .kdna judgment assets through the KDNA toolchain.",
   "type": "commonjs",
   "bin": {
@@ -14,11 +14,18 @@
     "README.md"
   ],
   "scripts": {
-    "lint": "node --check bin/kdna-studio.js && node --check tests/cli.test.js",
+    "lint": "node scripts/run-lint.js",
+    "pretest": "node scripts/acquire-trusted-npm-release.js",
     "test": "node --test tests/*.test.js",
-    "test:all": "npm run lint && npm test",
+    "test:all": "node scripts/run-test-all.js",
+    "test:runtime": "node scripts/run-product-tests.js",
+    "test:candidate-chain": "node scripts/verify-runtime-candidate-chain.js",
+    "verify:candidate-sources": "node scripts/verify-runtime-candidate-sources.js",
+    "check:protocol-names": "node scripts/check-current-protocol-names.js",
     "release:check": "node scripts/release-check.js",
-    "prepublishOnly": "npm test && npm run release:check"
+    "release:generate-evidence": "node scripts/generate-release-evidence.js",
+    "release:publish-verified": "node scripts/publish-verified-artifact.js",
+    "prepublishOnly": "node scripts/run-test-all.js && node scripts/verify-runtime-candidate-chain.js && node scripts/release-check.js"
   },
   "keywords": [
     "kdna",
@@ -41,13 +48,12 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@aikdna/kdna-core": "0.17.0",
-    "@aikdna/kdna-studio-core": "1.9.0",
+    "@aikdna/kdna-core": "0.20.0",
+    "@aikdna/kdna-studio-core": "2.0.2",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "cbor-x": "^1.6.4"
   },
-  "main": "index.js",
   "directories": {
     "test": "tests"
   },