@carllee1983/dbcli 2.1.0 → 3.0.0

package/.cursor/skills/dbcli/reference.md

@@ -1573,7 +1573,7 @@ Opt-in flag trio that persists a **VerificationArtifact JSON** (schema v1) under
 
 **Planned vs Result evidence.** `dbcli skill tasks plan safe-backfill-verify --format json` returns a plan containing a `verification` block with `status: "planned"`. That block is the **planned** evidence definition — it describes which check will run. Running `assert --write-verification-artifact` on the actual data produces **result** evidence (`status: "verified"` or `status: "not_verified"`). The two records are distinct; `"planned"` does **not** indicate that verification has run or passed.
 
-> **Casting note:** Postgres returns `count(*)` and `sum()` as bigint (a string in the result set). `value ==` uses strict equality, so `"0" == 0` is false. Cast to `::int` (`count(*)::int`) to ensure numeric comparison works correctly.
+> **Numeric note:** Postgres returns `count(*)` and `sum()` as bigint, which arrives as a string. A numeric expectation is compared numerically, so `value == 0` matches it without a cast. A quoted expectation stays a text comparison: `value == "0"` matches the text, not the number. The `::int` casts in the examples below are harmless and no longer required.
 
 ```bash
 dbcli assert "SELECT count(*)::int FROM orders WHERE status IS NULL" \
@@ -2721,7 +2721,7 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 
 | Flag | Purpose | Default |
 |---|---|---|
-| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. | — |
+| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. A blacklisted identifier has to appear as an identifier — a term like `id` matches `orders.id` but not the word "identifier" — and the refusal names the field, never the matched term. | — |
 | `--verification <selector...>` | One or more verification artifact ids, unique prefixes, filenames, or in-bounds paths. | none |
 | `--audit <selector...>` | One or more audit ids or unique prefixes (minimum four characters) from the active connection. | none |
 | `--receipt <path...>` | Explicit workspace-relative receipt path(s). Receipts contribute safe provenance only; they are not execution approval. | none |
@@ -2729,8 +2729,11 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 | `--format <json\|markdown>` | Compose receipt format printed to stdout. | `json` |
 
 At least one `--verification`, `--audit`, or `--receipt` reference is required. The resulting pack
-contains a canonical SHA-256 integrity digest and `coverage.completeForDeclaredEvidence:
-true` for its explicitly selected references.
+carries a canonical SHA-256 digest over its content, and its `id` is derived from that digest, so
+composing the same claims and references twice produces the same pack. `createdAt` records when the
+pack was written and is deliberately outside the digest — it is the one field a restamp can change
+without breaking validation. Whether a referenced source is still resolvable is reported by
+`evidence validate`, not stored in the pack.
 
 #### `evidence validate`
 

package/.github/skills/dbcli/reference.md

@@ -1573,7 +1573,7 @@ Opt-in flag trio that persists a **VerificationArtifact JSON** (schema v1) under
 
 **Planned vs Result evidence.** `dbcli skill tasks plan safe-backfill-verify --format json` returns a plan containing a `verification` block with `status: "planned"`. That block is the **planned** evidence definition — it describes which check will run. Running `assert --write-verification-artifact` on the actual data produces **result** evidence (`status: "verified"` or `status: "not_verified"`). The two records are distinct; `"planned"` does **not** indicate that verification has run or passed.
 
-> **Casting note:** Postgres returns `count(*)` and `sum()` as bigint (a string in the result set). `value ==` uses strict equality, so `"0" == 0` is false. Cast to `::int` (`count(*)::int`) to ensure numeric comparison works correctly.
+> **Numeric note:** Postgres returns `count(*)` and `sum()` as bigint, which arrives as a string. A numeric expectation is compared numerically, so `value == 0` matches it without a cast. A quoted expectation stays a text comparison: `value == "0"` matches the text, not the number. The `::int` casts in the examples below are harmless and no longer required.
 
 ```bash
 dbcli assert "SELECT count(*)::int FROM orders WHERE status IS NULL" \
@@ -2721,7 +2721,7 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 
 | Flag | Purpose | Default |
 |---|---|---|
-| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. | — |
+| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. A blacklisted identifier has to appear as an identifier — a term like `id` matches `orders.id` but not the word "identifier" — and the refusal names the field, never the matched term. | — |
 | `--verification <selector...>` | One or more verification artifact ids, unique prefixes, filenames, or in-bounds paths. | none |
 | `--audit <selector...>` | One or more audit ids or unique prefixes (minimum four characters) from the active connection. | none |
 | `--receipt <path...>` | Explicit workspace-relative receipt path(s). Receipts contribute safe provenance only; they are not execution approval. | none |
@@ -2729,8 +2729,11 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 | `--format <json\|markdown>` | Compose receipt format printed to stdout. | `json` |
 
 At least one `--verification`, `--audit`, or `--receipt` reference is required. The resulting pack
-contains a canonical SHA-256 integrity digest and `coverage.completeForDeclaredEvidence:
-true` for its explicitly selected references.
+carries a canonical SHA-256 digest over its content, and its `id` is derived from that digest, so
+composing the same claims and references twice produces the same pack. `createdAt` records when the
+pack was written and is deliberately outside the digest — it is the one field a restamp can change
+without breaking validation. Whether a referenced source is still resolvable is reported by
+`evidence validate`, not stored in the pack.
 
 #### `evidence validate`
 

package/CHANGELOG.md

@@ -5,6 +5,42 @@ All notable changes to dbcli are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.0] - 2026-08-16 - Evidence that could not reproduce itself, and a hash that hid nothing
+
+The evidence subsystem shipped in v1.53.0 and, until this week, nobody had composed a pack outside its own tests. The first real use — a `verify safe-backfill --after-write` against a live PostgreSQL — came back `not_verified` on data that was correct, and the audit that followed found three more defects of the same kind: an evidence pack whose digest covered a random UUID, so the same claims never produced the same pack twice; a receipt "fingerprint" that was an unsalted SHA-256 over eight possible values; and a blacklist comparison with no identifier boundaries, so a protected column named `id` refused any claim containing the word "identifier". Fixing them changes both published formats, which is what makes this a major release: **packs written by 2.x will fail validation under 3.0.0, and `observation.fingerprint` no longer exists.** The reversal that authorized the repairs — known defects get fixed whether or not anyone is using the code — is recorded in `docs/adr/0012-known-defects-get-fixed-whether-or-not-anyone-is-using-the-code.md`, superseding ADR 0011.
+
+### Changed
+
+- **BREAKING: an evidence pack's digest now covers only its content, so equivalent input produces the same pack.** The digest was taken over the whole pack including `id`, which was `evp_${randomUUID()}`, and a millisecond `createdAt` — so composing the same claims twice yielded two unrelated digests and cross-run comparison was not merely hard but undefined. The digest now covers `version` / `subject` / `claims`; `id` is derived from its first 32 characters, so equivalent input yields an identical pack down to the identifier, and `parse` checks that the two agree. `createdAt` sits outside the digest and is documented, in the type and in `reference.md`, as the one field that can be restamped without breaking verification — leaving that unsaid would be selling tamper-evidence that isn't. `canonicalizeWithoutDigest` was `JSON.stringify`, so "canonical" rested on the build and parse paths hand-maintaining the same key insertion order; it is now a real canonicalization that sorts keys recursively. The format is changed in place with no v2 fallback and no compatibility layer: existing packs fail validation, which is correct, because their digests were computed under rules that no longer hold (#116).
+
+- **BREAKING: a receipt states its observation instead of hashing it.** `observation.fingerprint` was an unsalted SHA-256 over a preimage space of eight values for `verify` (four `VerificationStatus` × an `artifactPersisted` boolean) and 2^(n+1) for an `assert` with n checks, in a fixed public serialization — a dictionary attack measured in milliseconds. Everything it covered already appeared in plaintext in `outcome`, so the only thing it protected was the per-check pass bit pattern, and the only reader it stopped was an honest one; being deterministic, it also let receipts be grouped by result across files, which is the property the old test suite was asserting. `verify` now records `{ kind: 'verify-outcome', status }` and `assert` records `{ kind: 'assert-verdict', checksPassed, checksTotal }` — counts, not positions, so *which* check failed still does not leave the receipt, and less leaks than before, since anyone willing to invert the old hash recovered the full bit pattern. `parseObservation` validates the field shape per operation and rejects `checksPassed > checksTotal` (#118).
+
+- **`evidence` no longer means three incompatible things.** `VerificationStatus` (`verified` / `not_verified` / `indeterminate` / `blocked`), `EvidenceItem.status` (`ok` / `no-data` / `skipped` / `error` / `timeout`) and `WorkloadEvidence.state` (`available` / `absent` / `invalid` / `unavailable`) are a verdict on a subject, whether a diagnostic ran, and whether a source file is usable — three vocabularies that cannot be mapped onto each other, all filed under one word, all string unions the type system cannot keep apart. `EvidenceItem` is now `ReportFinding` and `WorkloadEvidence` is `WorkloadSource` (with `WorkloadEvidenceState`, `LoadWorkloadEvidenceOptions`, `loadWorkloadEvidence` and the command layer's `loadObservedWorkloadEvidence` renamed to match). The values are unchanged and `VerificationStatus` is untouched, being part of a published JSON contract. `CONTEXT.md` gains an "Outcome vocabularies" section stating that they do not map — but the rename is what stops the mistake at the call site, since nobody reads `CONTEXT.md` while writing a comparison (#114).
+
+### Added
+
+- **`scripts/check-plan-acceptance.ts` makes an acceptance criterion say whether anything proved it.** The 2026-08-08 backlog's eight tickets shipped with v1.53.0 and still read `Status: Proposed`, and two of their criteria described behavior the code structurally could not produce. Nothing caught either, because plan documents are prose and prose drifts silently. Every numbered acceptance criterion under `docs/plans/*.md` must now end in `— covered by:` (naming a test file that exists), `— unverified:` (admitting nothing proves it), or `— known deviation:` (deliberately unmet, with a reason). The gate forces disclosure, not coverage — marking all thirty criteria `unverified` would pass — because a gate demanding real tests gets nagged into a rubber stamp, while the count stays visible in review, and eighteen of thirty unverified is its own pressure. The one substantive check is that a cited test file exists, that being the half that is cheap to check and the failure mode the gate exists to stop; prose criteria with no numbered list count as a violation, so reformatting cannot route around it. `docs/plans/done/` is not scanned, since rewriting closed plans to suit a later convention destroys the record this protects. `PLAN_ACCEPTANCE_EXEMPTIONS` is a ratchet shaped after `check-core-no-stdout.ts`: it may only shrink, and a contract test fails when an entry stops being needed (#113).
+
+### Removed
+
+- **The `coverage` field is gone from the evidence pack rather than made writable.** Both writers hardcoded an empty gap list and the parser rejected a non-empty one, so the ticket's promise that an expired reference produces a coverage gap could never fire. A pack is immutable and a reference expires after composition, so the value could not be written back even in principle; `evidence validate` already reports staleness, and that is where a reader can act on it. A field that can never change says nothing (#116).
+
+### Fixed
+
+- **`value == count` was never true on PostgreSQL, so `verify --after-write` could not report `verified` there.** `firstScalar` returned the driver's value as-is and `compare` used `===`, but pg returns `bigint` / `numeric` / `int8` as strings, so `"0" === 0` was permanently false — and a read-back after a write is almost always a count. The asymmetry is what made it hard to see: `>` and `<` went through JS coercion and passed, so on the same column `value > 5` worked while `value == 6` did not, with the output cheerfully printing `expected: "value == 6"`, `actual: "6"`, `pass: false`. Found by dogfooding a real backfill on PostgreSQL 16, where six rows were correctly updated and the assertion still said no (#115).
+
+- **Blacklist matching in evidence content is bounded to whole identifiers, and its refusal says where.** Blocked terms were compared with `includes()` — no boundary, no minimum length — so a protected column named `id` refused any claim containing "identifier", "considered" or "valid", and the message was one line reading `evidence content contains a blocked identifier`, naming neither the field nor what it hit. A term now matches only when neither neighbour is a letter, digit or underscore, so `id` still hits `orders.id` and a bare `id` but not `identifier`, and regex metacharacters in a term are escaped, so `a.c` no longer matches `abc`. The keys of `blacklist.columns` — table names — were never collected into the term list at all, a silent hole in the other direction, and are now included. The error names the offending field (`subject.kind`, `claim 2 text`) and still does not name the term, since printing a protected identifier into a message the author may paste elsewhere is the thing the blacklist exists to prevent; claims are located by ordinal because the id may itself be the blocked string. Two limits are documented rather than papered over: `secret_customer` written as "secret customer" still gets through, which identifier matching against free prose cannot honestly promise to catch, and reference fields (audit `command`, receipt `path`) are not checked at all yet (#117).
+
+- **The Elasticsearch integration suite had never asserted anything, on any machine.** It reported "container not running on port 9201" against a healthy container answering `200`: Elasticsearch's `GET /` carries no CORS headers, happy-dom's `fetch` drops a header-less response under the same-origin policy, `beforeAll` swallowed the error and every test returned early. It is the only adapter over HTTP, so it was the only casualty. Removing the global preload was tried and reverted — `tests/integration/ui-render-smoke.test.tsx` depends on it, and a per-file import leaks across the files Bun runs in one process, making the outcome depend on file order. `setup-happy-dom.ts` now saves the runtime `fetch` before `GlobalRegistrator.register()` and restores it after, exporting `runtimeFetch` so a test can pin the contract. Only `fetch` is restored: happy-dom's `window` / `document` / `Element` have no runtime counterpart to shadow, and no adapter touches `Request` or `XMLHttpRequest` (#109, #110).
+
+- **A negative test asserting that extra fields are rejected no longer breaks `typecheck:tests`.** The object deliberately carrying a field the validator must refuse was written against a type that does not admit it, which `bun test` never sees and CI's `tsc` step fails on across all ten matrix jobs (#118).
+
+### Documentation
+
+- **ADR 0005's `deferred` described the feature, not the decision.** Of ten ADRs it was the only one not `accepted`, so every inventory picked it back up as an open question — while its content is a settled fail-closed policy with a reopen checklist and a falsification condition already attached. What is deferred is SQD-05 / SQD-06. It is now `accepted`, with a paragraph separating "the policy is settled" from "provider generation is authorized", the latter having not happened — without it, a reader seeing `remain deferred` in the title over an `accepted` status would plausibly "fix" the status (#111).
+
+- **The 2026-08-08 evidence backlog now matches what shipped.** Eight tickets read `Status: Proposed` under a spec header saying no implementation was authorized, a week after all of it went out in v1.53.0. Checking all thirty acceptance criteria against the test files found eleven genuinely asserted, eighteen unproven — mostly asserted halfway — and one structurally impossible. Tickets are marked Delivered with their known deviations and unverified criteria listed per line, and `CONTEXT.md` gains `Known deviation` (deliberately unmet) and `Unverified` (nobody proved it) as distinct terms, because merging them dilutes the first into "everything imperfect" (#112).
+
 ## [2.1.0] - 2026-08-16 - The gate asked the wrong question, and one route never reached it
 
 2.0.0 put a two-tier gate in front of raw SQL. This release is what measuring that gate against real servers found: one entire route into the database bypassed it, its qualification criterion asked whether a `WHERE` existed rather than whether it narrowed anything, and its notion of "what kind of statement is this" was the leading keyword — so a full-table delete wearing an `INSERT` or `WITH` in front of it was treated as routine. Each of the three is a way a statement that empties a table reached the database unattended, and each is closed here. The measurement the gate's own ADR bets on is now a command rather than a `jq` invocation somebody has to remember.

package/assets/reference.md

@@ -1573,7 +1573,7 @@ Opt-in flag trio that persists a **VerificationArtifact JSON** (schema v1) under
 
 **Planned vs Result evidence.** `dbcli skill tasks plan safe-backfill-verify --format json` returns a plan containing a `verification` block with `status: "planned"`. That block is the **planned** evidence definition — it describes which check will run. Running `assert --write-verification-artifact` on the actual data produces **result** evidence (`status: "verified"` or `status: "not_verified"`). The two records are distinct; `"planned"` does **not** indicate that verification has run or passed.
 
-> **Casting note:** Postgres returns `count(*)` and `sum()` as bigint (a string in the result set). `value ==` uses strict equality, so `"0" == 0` is false. Cast to `::int` (`count(*)::int`) to ensure numeric comparison works correctly.
+> **Numeric note:** Postgres returns `count(*)` and `sum()` as bigint, which arrives as a string. A numeric expectation is compared numerically, so `value == 0` matches it without a cast. A quoted expectation stays a text comparison: `value == "0"` matches the text, not the number. The `::int` casts in the examples below are harmless and no longer required.
 
 ```bash
 dbcli assert "SELECT count(*)::int FROM orders WHERE status IS NULL" \
@@ -2721,7 +2721,7 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 
 | Flag | Purpose | Default |
 |---|---|---|
-| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. | — |
+| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. A blacklisted identifier has to appear as an identifier — a term like `id` matches `orders.id` but not the word "identifier" — and the refusal names the field, never the matched term. | — |
 | `--verification <selector...>` | One or more verification artifact ids, unique prefixes, filenames, or in-bounds paths. | none |
 | `--audit <selector...>` | One or more audit ids or unique prefixes (minimum four characters) from the active connection. | none |
 | `--receipt <path...>` | Explicit workspace-relative receipt path(s). Receipts contribute safe provenance only; they are not execution approval. | none |
@@ -2729,8 +2729,11 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 | `--format <json\|markdown>` | Compose receipt format printed to stdout. | `json` |
 
 At least one `--verification`, `--audit`, or `--receipt` reference is required. The resulting pack
-contains a canonical SHA-256 integrity digest and `coverage.completeForDeclaredEvidence:
-true` for its explicitly selected references.
+carries a canonical SHA-256 digest over its content, and its `id` is derived from that digest, so
+composing the same claims and references twice produces the same pack. `createdAt` records when the
+pack was written and is deliberately outside the digest — it is the one field a restamp can change
+without breaking validation. Whether a referenced source is still resolvable is reported by
+`evidence validate`, not stored in the pack.
 
 #### `evidence validate`
 

package/dist/cli-runtime.mjs

@@ -51,7 +51,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@carllee1983/dbcli",
-    version: "2.1.0",
+    version: "3.0.0",
     description: "Database CLI for AI agents",
     type: "module",
     publishConfig: {
@@ -133,6 +133,7 @@ var init_package = __esm(() => {
       "platform:check": "bun run scripts/check-platform-parity.ts",
       "agent-core:check": "bun run scripts/check-agent-core-purity.ts",
       "core-stdout:check": "bun run scripts/check-core-no-stdout.ts",
+      "plan:check": "bun run scripts/check-plan-acceptance.ts",
       typecheck: "tsc --noEmit --pretty false",
       "typecheck:tests": "tsc --noEmit --pretty false -p tsconfig.tests.json",
       "test:perf": "bun test ./tests/perf/*.bench.ts",
@@ -41525,20 +41526,39 @@ var init_grammar = __esm(() => {
 });
 
 // src/core/assert/evaluator.ts
+function numeric(value) {
+  if (typeof value === "number")
+    return Number.isNaN(value) ? null : value;
+  const trimmed = value.trim();
+  if (trimmed === "")
+    return null;
+  const parsed = Number(trimmed);
+  return Number.isNaN(parsed) ? null : parsed;
+}
 function compare(a, op, b) {
+  let left = a;
+  let right = b;
+  if (typeof a !== typeof b) {
+    const na = numeric(a);
+    const nb = numeric(b);
+    if (na !== null && nb !== null) {
+      left = na;
+      right = nb;
+    }
+  }
   switch (op) {
     case ">":
-      return a > b;
+      return left > right;
     case ">=":
-      return a >= b;
+      return left >= right;
     case "<":
-      return a < b;
+      return left < right;
     case "<=":
-      return a <= b;
+      return left <= right;
     case "==":
-      return a === b;
+      return left === right;
     case "!=":
-      return a !== b;
+      return left !== right;
   }
 }
 function firstScalar(result) {
@@ -41591,7 +41611,10 @@ function evaluateExpect(node, result) {
     };
   }
   if (pred.type === "between") {
-    const bad2 = nonNull.filter((v) => typeof v !== "number" || v < pred.low || v > pred.high);
+    const bad2 = nonNull.filter((v) => {
+      const n = numeric(v);
+      return n === null || n < pred.low || n > pred.high;
+    });
     return {
       name: `col:${column} between ${pred.low} and ${pred.high}`,
       expected: "0 out of range",
@@ -41622,7 +41645,7 @@ function compareVs(a, b, mode) {
     name: "vs:value",
     expected: String(bv),
     actual: String(av),
-    pass: av !== null && bv !== null && av === bv
+    pass: av !== null && bv !== null && compare(av, "==", bv)
   };
 }
 var AssertShapeError;
@@ -41695,7 +41718,7 @@ function canonicalizeEvidenceReceiptCommand(command, operation = "assert") {
 function sha2563(value) {
   return `sha256:${createHash5("sha256").update(value).digest("hex")}`;
 }
-function verdictFingerprint(verdict2) {
+function verdictObservation(verdict2) {
   if (!record3(verdict2) || typeof verdict2.pass !== "boolean" || !Array.isArray(verdict2.checks) || verdict2.checks.length > 1000) {
     throw new EvidenceReceiptValidationError("verdict must contain bounded pass bits");
   }
@@ -41705,26 +41728,30 @@ function verdictFingerprint(verdict2) {
     }
     return check.pass;
   });
-  return sha2563(JSON.stringify({ pass: verdict2.pass, checks: bits }));
+  return {
+    kind: "assert-verdict",
+    checksPassed: bits.filter(Boolean).length,
+    checksTotal: bits.length
+  };
 }
-function verificationOutcomeFingerprint(status2, artifactPersisted) {
+function verificationObservation(status2, artifactPersisted) {
   if (!isVerificationStatus(status2)) {
     throw new EvidenceReceiptValidationError("verificationStatus must be a verification status");
   }
   if (typeof artifactPersisted !== "boolean") {
     throw new EvidenceReceiptValidationError("verificationArtifactPersisted must be a boolean");
   }
-  return sha2563(JSON.stringify({ status: status2, artifactPersisted }));
+  return { kind: "verify-outcome", status: status2 };
 }
 function buildEvidenceReceipt(input, options = {}) {
   const operation = input.operation === "verify" ? "verify" : "assert";
   const command = canonicalizeEvidenceReceiptCommand(input.command, operation);
   const context = parseContext2(input.context);
-  const { observationFingerprint, outcome } = input.operation === "verify" ? {
-    observationFingerprint: verificationOutcomeFingerprint(input.verificationStatus, input.verificationArtifactPersisted),
+  const { observation, outcome } = input.operation === "verify" ? {
+    observation: verificationObservation(input.verificationStatus, input.verificationArtifactPersisted),
     outcome: input.verificationStatus === "verified" && input.verificationArtifactPersisted ? "succeeded" : "failed"
   } : {
-    observationFingerprint: verdictFingerprint(input.verdict),
+    observation: verdictObservation(input.verdict),
     outcome: input.verdict.pass ? "succeeded" : "failed"
   };
   const receipt = {
@@ -41741,10 +41768,7 @@ function buildEvidenceReceipt(input, options = {}) {
       verificationArtifactRef: input.verificationArtifactRef === undefined ? null : nullableId(input.verificationArtifactRef, "verificationArtifactRef")
     },
     replay: { status: "context-required" },
-    observation: {
-      kind: operation === "assert" ? "assert-verdict" : "verify-outcome",
-      fingerprint: observationFingerprint
-    }
+    observation
   };
   return receipt;
 }
@@ -41789,9 +41813,7 @@ function parseEvidenceReceipt(raw) {
     throw new EvidenceReceiptValidationError("command provenance hash mismatch");
   if (!record3(raw.replay) || raw.replay.status !== "context-required" || Object.keys(raw.replay).length !== 1)
     throw new EvidenceReceiptValidationError("replay must be context-required");
-  if (!record3(raw.observation) || raw.observation.kind !== (operation === "assert" ? "assert-verdict" : "verify-outcome") || Object.keys(raw.observation).length !== 2)
-    throw new EvidenceReceiptValidationError("observation must match receipt operation");
-  const observationKind = operation === "assert" ? "assert-verdict" : "verify-outcome";
+  const observation = parseObservation(raw.observation, operation);
   return {
     version: EVIDENCE_RECEIPT_VERSION,
     id: safeId(raw.id, "id"),
@@ -41806,10 +41828,26 @@ function parseEvidenceReceipt(raw) {
       verificationArtifactRef: nullableId(raw.provenance.verificationArtifactRef, "provenance.verificationArtifactRef")
     },
     replay: { status: "context-required" },
-    observation: {
-      kind: observationKind,
-      fingerprint: fingerprint(raw.observation.fingerprint, "observation.fingerprint")
-    }
+    observation
+  };
+}
+function parseObservation(raw, operation) {
+  if (!record3(raw))
+    throw new EvidenceReceiptValidationError("observation must be an object");
+  if (operation === "verify") {
+    exact(raw, ["kind", "status"], "observation");
+    if (raw.kind !== "verify-outcome" || !isVerificationStatus(raw.status))
+      throw new EvidenceReceiptValidationError("observation must match receipt operation");
+    return { kind: "verify-outcome", status: raw.status };
+  }
+  exact(raw, ["kind", "checksPassed", "checksTotal"], "observation");
+  const { kind, checksPassed, checksTotal } = raw;
+  if (kind !== "assert-verdict" || !Number.isSafeInteger(checksPassed) || !Number.isSafeInteger(checksTotal) || checksPassed < 0 || checksTotal < checksPassed)
+    throw new EvidenceReceiptValidationError("observation must match receipt operation");
+  return {
+    kind: "assert-verdict",
+    checksPassed,
+    checksTotal
   };
 }
 function inside(root, target) {
@@ -49868,11 +49906,19 @@ function assertVerificationSubjects(subject, claims) {
     throw new EvidencePackValidationError("verification evidence must match the claims subject kind");
   }
 }
-function canonicalizeWithoutDigest(pack) {
-  return JSON.stringify(pack);
+function canonicalize(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value))
+    return `[${value.map(canonicalize).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, v]) => `${JSON.stringify(key)}:${canonicalize(v)}`);
+  return `{${entries.join(",")}}`;
 }
-function digest(pack) {
-  return createHash8("sha256").update(canonicalizeWithoutDigest(pack)).digest("hex");
+function digest(content) {
+  return createHash8("sha256").update(canonicalize(content)).digest("hex");
+}
+function packId(contentDigest) {
+  return `evp_${contentDigest.slice(0, 32)}`;
 }
 function parseEvidenceClaimsInput(raw) {
   if (!isRecord4(raw))
@@ -49907,49 +49953,52 @@ function buildEvidencePack(input, references, options = {}) {
   if (evidence2.some((reference) => reference.kind === "verification-artifact" && reference.subjectKind !== normalized2.subject.kind)) {
     throw new EvidencePackValidationError("verification evidence must match the claims subject kind");
   }
-  const base = {
+  const content = {
     version: EVIDENCE_PACK_VERSION,
-    id: id(options.idFactory?.() ?? `evp_${randomUUID6()}`, "pack.id"),
-    createdAt: (options.now?.() ?? new Date).toISOString(),
     subject: normalized2.subject,
-    claims: normalized2.claims.map((claim) => ({ ...claim, evidence: evidence2 })),
-    coverage: { completeForDeclaredEvidence: true, gaps: [] }
+    claims: normalized2.claims.map((claim) => ({ ...claim, evidence: evidence2 }))
+  };
+  const contentDigest = digest(content);
+  return {
+    ...content,
+    id: packId(contentDigest),
+    createdAt: (options.now?.() ?? new Date).toISOString(),
+    integrity: { algorithm: "sha256", digest: contentDigest }
   };
-  return { ...base, integrity: { algorithm: "sha256", digest: digest(base) } };
 }
 function parseEvidencePack(raw) {
   if (!isRecord4(raw))
     throw new EvidencePackValidationError("evidence pack must be an object");
-  requireExactKeys(raw, ["version", "id", "createdAt", "subject", "claims", "coverage", "integrity"], "evidence pack");
+  requireExactKeys(raw, ["version", "id", "createdAt", "subject", "claims", "integrity"], "evidence pack");
   if (raw.version !== EVIDENCE_PACK_VERSION) {
     throw new EvidencePackValidationError(`evidence pack version must be ${EVIDENCE_PACK_VERSION}`);
   }
-  if (!isRecord4(raw.coverage))
-    throw new EvidencePackValidationError("coverage must be an object");
-  requireExactKeys(raw.coverage, ["completeForDeclaredEvidence", "gaps"], "coverage");
-  if (raw.coverage.completeForDeclaredEvidence !== true || !Array.isArray(raw.coverage.gaps) || raw.coverage.gaps.length !== 0) {
-    throw new EvidencePackValidationError("v1 coverage must be complete for declared evidence with no gaps");
-  }
   if (!isRecord4(raw.integrity))
     throw new EvidencePackValidationError("integrity must be an object");
   requireExactKeys(raw.integrity, ["algorithm", "digest"], "integrity");
   if (raw.integrity.algorithm !== "sha256")
     throw new EvidencePackValidationError("integrity.algorithm must be sha256");
-  const base = {
+  const content = {
     version: EVIDENCE_PACK_VERSION,
-    id: id(raw.id, "pack.id"),
-    createdAt: iso(raw.createdAt, "pack.createdAt"),
     subject: parseSubject(raw.subject),
-    claims: parseClaims(raw.claims, true),
-    coverage: { completeForDeclaredEvidence: true, gaps: [] }
+    claims: parseClaims(raw.claims, true)
   };
-  assertVerificationSubjects(base.subject, base.claims);
+  assertVerificationSubjects(content.subject, content.claims);
   const actualDigest = text4(raw.integrity.digest, "integrity.digest", 128);
   if (!/^[a-f0-9]{64}$/.test(actualDigest))
     throw new EvidencePackValidationError("integrity.digest must be sha256 hex");
-  if (actualDigest !== digest(base))
+  const expectedDigest = digest(content);
+  if (actualDigest !== expectedDigest)
     throw new EvidencePackValidationError("evidence pack digest mismatch");
-  return { ...base, integrity: { algorithm: "sha256", digest: actualDigest } };
+  const packIdentity = id(raw.id, "pack.id");
+  if (packIdentity !== packId(expectedDigest))
+    throw new EvidencePackValidationError("evidence pack id does not match its content digest");
+  return {
+    ...content,
+    id: packIdentity,
+    createdAt: iso(raw.createdAt, "pack.createdAt"),
+    integrity: { algorithm: "sha256", digest: actualDigest }
+  };
 }
 function isInside(root, target) {
   const relativePath = relative5(root, target);
@@ -50072,7 +50121,9 @@ var init_evidence_pack = __esm(() => {
 // src/commands/evidence.ts
 var exports_evidence = {};
 __export(exports_evidence, {
-  evidenceCommand: () => evidenceCommand
+  evidenceCommand: () => evidenceCommand,
+  containsBlockedTerm: () => containsBlockedTerm,
+  blockedTerms: () => blockedTerms
 });
 import { join as join42, relative as relative6, resolve as resolve12, sep as sep8 } from "path";
 import { realpath as realpath3 } from "fs/promises";
@@ -50095,24 +50146,34 @@ async function readClaimsInput(filePath) {
 function blockedTerms(config) {
   return [
     ...config.blacklist?.tables ?? [],
+    ...Object.keys(config.blacklist?.columns ?? {}),
     ...Object.values(config.blacklist?.columns ?? {}).flat()
   ].map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0);
 }
-function assertNoBlockedText(value, terms) {
+function containsBlockedTerm(value, terms) {
+  const normalized2 = value.toLowerCase();
+  return terms.some((term) => {
+    const trimmed = term.trim().toLowerCase();
+    if (trimmed.length === 0)
+      return false;
+    const escaped = trimmed.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(?<![A-Za-z0-9_])${escaped}(?![A-Za-z0-9_])`).test(normalized2);
+  });
+}
+function assertNoBlockedText(value, terms, field) {
   if (!value)
     return;
-  const normalized2 = value.toLowerCase();
-  if (terms.some((term) => normalized2.includes(term))) {
-    throw new EvidencePackValidationError("evidence content contains a blocked identifier");
+  if (containsBlockedTerm(value, terms)) {
+    throw new EvidencePackValidationError(`${field} contains a blocked identifier`);
   }
 }
 function assertClaimsSafe(raw, terms) {
   const input = parseEvidenceClaimsInput(raw);
-  assertNoBlockedText(input.subject.kind, terms);
-  assertNoBlockedText(input.subject.name, terms);
-  for (const claim of input.claims) {
-    assertNoBlockedText(claim.id, terms);
-    assertNoBlockedText(claim.text, terms);
+  assertNoBlockedText(input.subject.kind, terms, "subject.kind");
+  assertNoBlockedText(input.subject.name, terms, "subject.name");
+  for (const [index, claim] of input.claims.entries()) {
+    assertNoBlockedText(claim.id, terms, `claim ${index + 1} id`);
+    assertNoBlockedText(claim.text, terms, `claim ${index + 1} text`);
   }
 }
 function sameReference(left, right) {
@@ -51302,7 +51363,7 @@ var init_change_set = __esm(() => {
 import { createReadStream } from "fs";
 import { lstat as lstat7 } from "fs/promises";
 import { createInterface as createInterface3 } from "readline";
-async function loadWorkloadEvidence(options) {
+async function loadWorkloadSource(options) {
   const now = options.now ?? new Date;
   let info;
   try {
@@ -51683,7 +51744,7 @@ function semanticSchema(schema, blocked) {
   }
   return result;
 }
-async function loadObservedWorkloadEvidence(path4, workspaceRoot, blocked) {
+async function loadObservedWorkloadSource(path4, workspaceRoot, blocked) {
   if (path4 === undefined) {
     return {
       state: "absent",
@@ -51693,7 +51754,7 @@ async function loadObservedWorkloadEvidence(path4, workspaceRoot, blocked) {
       issues: []
     };
   }
-  return loadWorkloadEvidence({ path: resolve14(workspaceRoot, path4), blockedIdentifiers: blocked });
+  return loadWorkloadSource({ path: resolve14(workspaceRoot, path4), blockedIdentifiers: blocked });
 }
 function shouldFail(report, failOn) {
   if (failOn === "never")
@@ -51831,7 +51892,7 @@ var init_impact2 = __esm(() => {
       const contracts = await loadContractEvidence(workspaceRoot, semantic, baseline, savedQueries, blockedIdentifiers);
       const dataAccess = await loadDataAccessEvidence(workspaceRoot, semantic, baseline, savedQueries, blockedIdentifiers);
       const verifications = await loadVerificationEvidence(workspaceRoot, blockedIdentifiers);
-      const observedWorkload = await loadObservedWorkloadEvidence(options.events, workspaceRoot, blockedIdentifiers);
+      const observedWorkload = await loadObservedWorkloadSource(options.events, workspaceRoot, blockedIdentifiers);
       const report = assessImpact({
         changes,
         semantic,

package/dist/cli.mjs

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@carllee1983/dbcli",
-  version: "2.1.0",
+  version: "3.0.0",
   description: "Database CLI for AI agents",
   type: "module",
   publishConfig: {
@@ -85,6 +85,7 @@ var package_default = {
     "platform:check": "bun run scripts/check-platform-parity.ts",
     "agent-core:check": "bun run scripts/check-agent-core-purity.ts",
     "core-stdout:check": "bun run scripts/check-core-no-stdout.ts",
+    "plan:check": "bun run scripts/check-plan-acceptance.ts",
     typecheck: "tsc --noEmit --pretty false",
     "typecheck:tests": "tsc --noEmit --pretty false -p tsconfig.tests.json",
     "test:perf": "bun test ./tests/perf/*.bench.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "2.1.0",
+  "version": "3.0.0",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {
@@ -82,6 +82,7 @@
     "platform:check": "bun run scripts/check-platform-parity.ts",
     "agent-core:check": "bun run scripts/check-agent-core-purity.ts",
     "core-stdout:check": "bun run scripts/check-core-no-stdout.ts",
+    "plan:check": "bun run scripts/check-plan-acceptance.ts",
     "typecheck": "tsc --noEmit --pretty false",
     "typecheck:tests": "tsc --noEmit --pretty false -p tsconfig.tests.json",
     "test:perf": "bun test ./tests/perf/*.bench.ts",

package/plugins/dbcli-agent/skills/dbcli/reference.md

@@ -1573,7 +1573,7 @@ Opt-in flag trio that persists a **VerificationArtifact JSON** (schema v1) under
 
 **Planned vs Result evidence.** `dbcli skill tasks plan safe-backfill-verify --format json` returns a plan containing a `verification` block with `status: "planned"`. That block is the **planned** evidence definition — it describes which check will run. Running `assert --write-verification-artifact` on the actual data produces **result** evidence (`status: "verified"` or `status: "not_verified"`). The two records are distinct; `"planned"` does **not** indicate that verification has run or passed.
 
-> **Casting note:** Postgres returns `count(*)` and `sum()` as bigint (a string in the result set). `value ==` uses strict equality, so `"0" == 0` is false. Cast to `::int` (`count(*)::int`) to ensure numeric comparison works correctly.
+> **Numeric note:** Postgres returns `count(*)` and `sum()` as bigint, which arrives as a string. A numeric expectation is compared numerically, so `value == 0` matches it without a cast. A quoted expectation stays a text comparison: `value == "0"` matches the text, not the number. The `::int` casts in the examples below are harmless and no longer required.
 
 ```bash
 dbcli assert "SELECT count(*)::int FROM orders WHERE status IS NULL" \
@@ -2721,7 +2721,7 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 
 | Flag | Purpose | Default |
 |---|---|---|
-| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. | — |
+| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. A blacklisted identifier has to appear as an identifier — a term like `id` matches `orders.id` but not the word "identifier" — and the refusal names the field, never the matched term. | — |
 | `--verification <selector...>` | One or more verification artifact ids, unique prefixes, filenames, or in-bounds paths. | none |
 | `--audit <selector...>` | One or more audit ids or unique prefixes (minimum four characters) from the active connection. | none |
 | `--receipt <path...>` | Explicit workspace-relative receipt path(s). Receipts contribute safe provenance only; they are not execution approval. | none |
@@ -2729,8 +2729,11 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 | `--format <json\|markdown>` | Compose receipt format printed to stdout. | `json` |
 
 At least one `--verification`, `--audit`, or `--receipt` reference is required. The resulting pack
-contains a canonical SHA-256 integrity digest and `coverage.completeForDeclaredEvidence:
-true` for its explicitly selected references.
+carries a canonical SHA-256 digest over its content, and its `id` is derived from that digest, so
+composing the same claims and references twice produces the same pack. `createdAt` records when the
+pack was written and is deliberately outside the digest — it is the one field a restamp can change
+without breaking validation. Whether a referenced source is still resolvable is reported by
+`evidence validate`, not stored in the pack.
 
 #### `evidence validate`
 

package/skills/dbcli/reference.md

@@ -1573,7 +1573,7 @@ Opt-in flag trio that persists a **VerificationArtifact JSON** (schema v1) under
 
 **Planned vs Result evidence.** `dbcli skill tasks plan safe-backfill-verify --format json` returns a plan containing a `verification` block with `status: "planned"`. That block is the **planned** evidence definition — it describes which check will run. Running `assert --write-verification-artifact` on the actual data produces **result** evidence (`status: "verified"` or `status: "not_verified"`). The two records are distinct; `"planned"` does **not** indicate that verification has run or passed.
 
-> **Casting note:** Postgres returns `count(*)` and `sum()` as bigint (a string in the result set). `value ==` uses strict equality, so `"0" == 0` is false. Cast to `::int` (`count(*)::int`) to ensure numeric comparison works correctly.
+> **Numeric note:** Postgres returns `count(*)` and `sum()` as bigint, which arrives as a string. A numeric expectation is compared numerically, so `value == 0` matches it without a cast. A quoted expectation stays a text comparison: `value == "0"` matches the text, not the number. The `::int` casts in the examples below are harmless and no longer required.
 
 ```bash
 dbcli assert "SELECT count(*)::int FROM orders WHERE status IS NULL" \
@@ -2721,7 +2721,7 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 
 | Flag | Purpose | Default |
 |---|---|---|
-| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. | — |
+| `--claims <file>` | Required JSON file with exactly `subject` and `claims`; every claim has an `id` and plain-language `text`. SQL-shaped text, credentials, error content, and blacklisted identifiers are rejected. A blacklisted identifier has to appear as an identifier — a term like `id` matches `orders.id` but not the word "identifier" — and the refusal names the field, never the matched term. | — |
 | `--verification <selector...>` | One or more verification artifact ids, unique prefixes, filenames, or in-bounds paths. | none |
 | `--audit <selector...>` | One or more audit ids or unique prefixes (minimum four characters) from the active connection. | none |
 | `--receipt <path...>` | Explicit workspace-relative receipt path(s). Receipts contribute safe provenance only; they are not execution approval. | none |
@@ -2729,8 +2729,11 @@ dbcli evidence compose --claims ./claims.json --verification ver_abcd --audit 1a
 | `--format <json\|markdown>` | Compose receipt format printed to stdout. | `json` |
 
 At least one `--verification`, `--audit`, or `--receipt` reference is required. The resulting pack
-contains a canonical SHA-256 integrity digest and `coverage.completeForDeclaredEvidence:
-true` for its explicitly selected references.
+carries a canonical SHA-256 digest over its content, and its `id` is derived from that digest, so
+composing the same claims and references twice produces the same pack. `createdAt` records when the
+pack was written and is deliberately outside the digest — it is the one field a restamp can change
+without breaking validation. Whether a referenced source is still resolvable is reported by
+`evidence validate`, not stored in the pack.
 
 #### `evidence validate`