@interf/compiler 0.22.0 → 0.33.0

package/public-repo/README.md

@@ -1,325 +1,266 @@
 # Interf
 
-**Data preparation for agents.**
+**Interf prepares data for agents.**
 
-Agents miss things in files.
+This npm package ships the `interf` CLI and local Interf runtime for building
+task-specific Context Graphs from files.
 
-Interf builds verifiable context for agents from your files.
+Agents miss things in files. When agents answer from a folder, they first have
+to discover what is in it, decide what matters, extract evidence, and connect
+facts across files. That file-to-context step is hidden, inconsistent, and hard
+to inspect.
 
-It turns hidden file discovery into traceable artifacts with proof of how they were built.
-
-When agents answer from your files, they first have to discover what is in them. That context-building step is hidden, inconsistent, and hard to verify: you cannot see which files were checked, what was extracted, or what the agent skipped. When the agent misses a file or page, the output can sound confident but be wrong.
-
-Source discovery should be separate from agent work. Interf separates that step, builds verifiable context, and lets your agent work from traceable artifacts instead of rediscovering the files during the job.
+Interf separates that step. It makes users' agents build a Context Graph from
+their files. It has source coverage summaries, task-aware knowledge, artifact
+handoffs, and links back to sources. Your agent uses the prepared map instead
+of rediscovering the files during the task.
 
 ```text
-Source files                        Verifiable context agents use
+Source files                        Context Graph agents use
 
-bristol-office-market/              <context-locator>/
+bristol-office-market/              <context-graph>/
   q4-market-report.pdf                AGENTS.md
-  lease-comps.xlsx                    .interf/runtime/source-snapshot.json
-  planning-notes.md                   home.md
-  exports/availability.csv            summaries/
-                                      knowledge/
+  lease-comps.xlsx                    home.md
+  planning-notes.md                   summaries/
+  exports/availability.csv            knowledge/
+                                      artifacts/
+                                      traces/
 ```
 
-## What a Build Run Produces
+## What a Build Produces
 
-A Build run produces verifiable context plus proof of work. Verifiable context is what agents use. The proof shows which source files were assigned, which Build Plan stages ran, what each stage wrote, and whether required artifacts exist.
+A Build produces a Context Graph. The Context Graph is source-backed context
+built from files so agents can use prepared context instead of partial file
+reads.
 
-For the built-in `interf-default` Build Plan, a Build run looks like this:
+For a local Build, the Context Graph is an inspectable folder:
 
 ```text
-Source: bristol-office-market
-Build Plan: interf-default
-Requested Artifacts: atlas, summaries, knowledge, claims, indexes
-
-Build run
-  record source references
-  summarize -> summaries/
-  structure -> knowledge/
-  shape -> home.md and agent entrypoints
-  record proof -> processed files, stage outputs, required artifacts
-
-verifiable context
-  locator -> { kind: "local-path", value: "<local-path-returned-by-interf>" }
+<context-graph>/
+  AGENTS.md              # agent guidance
+  home.md                # overview and routes
+  artifacts/             # task-specific agent handoffs
+  summaries/             # source coverage proof
+  knowledge/             # navigation and drilldown
+  traces/                # links back to sources
 ```
 
-The output is not an answer. It is a prepared local folder with routes, artifacts, source snapshots, and agent instructions. Your runtime agent reads that folder when it does the actual agent work.
+The output is not an answer. It is a prepared map over the Source: artifact
+handoffs, summaries, knowledge notes, and links back to sources. The Source
+remains the ground truth. Agents start from `artifacts/`, use `summaries/` for
+coverage proof and `knowledge/` for drilldown, then follow source links when
+exact wording, table values, chart reads, or provenance-sensitive claims matter.
 
 ## Design Choices
 
-- `Preparation-scoped`: every Preparation starts from a specific Source, requested Artifacts, and agent job, not a generic index over all your files.
-- `Deterministic`: Interf runs each stage, an ordered phase of a Build Plan, and shows stage-by-stage proof of work: which files were processed, what each stage produced, and whether required outputs exist. Agents do not have to rebuild the full picture while they work.
-- `Local-first and private`: your files, readiness checks, and agent runs stay on your machine. No cloud, no uploads, no telemetry.
-- `Bring your own AI`: use Claude Code, Codex, or another local agent.
-- `File over app`: verifiable context is exposed as a local folder owned by the instance — no hidden store, no hidden index. Inspect it, diff it, version it.
-- `Readiness checks you control`: every build can be checked against gates you wrote from the files. If the context is `not ready`, `interf test` shows the readiness evidence behind that status.
+- `Project-scoped`: every Project starts from a specific Source and selected
+  Build Plan, not a generic index over every file.
+- `Inspectable`: Interf records what was built, which requested Artifacts exist,
+  and where source-backed traces live.
+- `Local-first`: local Builds keep Source files on your machine and read-only.
+- `Bring your own agent`: use Claude Code, Codex, or another registered
+  command-line agent.
+- `File over hidden index`: local Builds expose the Context Graph as a folder
+  agents can inspect.
+- `Context Checks you control`: every Build can be checked against
+  plain-English conditions such as "Every page is covered" or "Every figure
+  cites a source page."
 
 ## Why Not Just Ask Your Agent?
 
-You can. Interf can use Claude Code, Codex, or another local agent while it builds verifiable context.
+You can. Interf can use Claude Code, Codex, or another registered local agent
+while it builds the Context Graph.
 
-A one-off preprocessing prompt gives you another agent answer to trust. Interf puts that work inside a Build Plan you can inspect: requested artifacts, declared stages, stage-by-stage proof of work, and readiness checks that decide whether the context is `ready` or `not ready`.
+A one-off preprocessing prompt gives you another answer to trust. Interf puts
+the preparation step inside a Build Plan you can inspect: requested Artifacts,
+declared stages, Build evidence, Context Checks, and traces.
 
-The agent can still execute the stages. Interf shows what ran, which files were processed, what artifacts and evidence were produced, and whether the result is ready for the agent work.
+The agent can still execute the stages. Interf shows what was covered, what was
+produced, and whether the Context Graph is ready for the task.
 
 ## Install
 
 ```bash
 npm install -g @interf/compiler
-interf            # opens the wizard; start or connect an engine when needed
+interf            # opens the wizard
 ```
 
-Requires Node.js 20+ and a local coding agent such as Claude Code or Codex. Run `interf doctor --live` if the executor is not detected.
+Requires Node.js 20+ and a local agent CLI such as Claude Code, Codex, or
+another registered command-line agent. Run `interf doctor --live` if the
+executor is not detected.
 
 ## Quick Start
 
 ```bash
-interf web                                      # terminal 1: start the local engine
-interf prep create bristol \                    # terminal 2: save the source + requested Artifacts
-  --source ./bristol-office-market \
-  --about "Bristol annual take-up and availability chart lookup" \
-  --requested-artifacts-json '[{"title":"Guide to the report","checks":["Every page or file is listed.","Pages about Bristol and annual take-up are marked."]},{"title":"Annual take-up figures","checks":["Every figure has a source reference."]}]'
-interf build-plan draft bristol \                 # draft the Build Plan for review
-  --task "Bristol annual take-up and availability chart lookup"
-interf build bristol                            # build verifiable context, returns the locator
-interf test bristol                             # check readiness
+# terminal 1: start the local Interf runtime
+interf runtime
+
+# terminal 2: create a Project from a local Source
+interf project create bristol --source ./bristol-office-market
+
+# draft the Build Plan for review
+interf plan draft bristol \
+  --intent "Bristol annual take-up and availability chart lookup" \
+  --artifacts "Guide to the report; annual take-up figures with source references" \
+  --ready-when "Every page is listed and every figure has a source reference."
+
+# select the reviewed Build Plan
+interf plan select bristol <build-plan-id>
+
+# build the Context Graph
+interf build bristol
+
+# optional: benchmark/evaluate answers from the Source baseline, Context Graph, or both
+interf benchmark bristol
 ```
 
-`interf web` starts the engine in the foreground and writes the active
-connection record so subsequent CLI commands can connect. Agents can use
-`interf web start` for an explicit managed background engine, then
-`interf web stop` when their work is done. Mutating commands never implicitly
-auto-start an engine — if no instance is connected, they exit with a hint
-pointing at `interf web` / `interf web start` (local) or `interf login`
-(future cloud).
+`interf runtime` starts the local runtime in the foreground and writes the
+active connection record so subsequent CLI commands can connect. Agents can use
+`interf runtime start` for an explicit managed background runtime, then
+`interf runtime stop` when their task is done.
 
-`interf build` returns the artifact locator on success — for a local
-engine that's a `local-path` you can open with any tool. Point your agent at
-that path. There's no `--out` flag, no implicit copy, no hidden store: the
-instance owns the bytes and the API tells you where they are.
+Mutating commands never implicitly auto-start a runtime. If no instance is
+connected, they exit with a hint pointing at `interf runtime`,
+`interf runtime start`, or `interf login`.
 
-If you want a baseline before building verifiable context, run `interf test bristol --target source-files`. It is optional proof, not the main path.
+`interf build` returns the Context Graph locator on success. For local Builds,
+that locator points to a folder agents can inspect and continue from. There is
+no `--out` flag and no implicit copy of your Source folder.
 
-## Verifiable Context
+## Context Graph
 
-Verifiable context is the output Interf builds from your files for agents. The current local engine exposes it as a local folder. Do not hardcode its location. The API returns a typed locator (`{ kind: "local-path" | "remote-url", value }`); your agent reads from there.
+The Context Graph is the output Interf builds from your files for agents. It is
+a knowledge map over the Source, not a replacement for the Source.
 
-It gives agents evidence, structure, and cross-file connections for navigating the files. It is not a replacement for your files. For the built-in `interf-default`, it includes:
+It gives agents structure and source-backed routes for navigating files. For
+the built-in `interf-default`, it includes:
 
 ```text
-<context-locator>/
-  AGENTS.md       # agent-facing entry point and source-checking rules
+<context-graph>/
+  AGENTS.md       # agent-facing guidance and source-checking rules
   CLAUDE.md       # same guidance for Claude Code
-  .interf/
-    runtime/
-      source-snapshot.json  # source references captured for the latest run
-      stages/               # per-stage source input lists
-  home.md         # overview and routes for agents
-  summaries/      # one note per source file
-  knowledge/      # linked notes built from the files
+  home.md         # graph index
+  artifacts/      # task-specific handoffs for agents
+  summaries/      # one source-named folder per source file
+  knowledge/      # linked notes built from summaries and source refs
+  traces/         # source provenance for claims and checks
 ```
 
-The source files stay the source of truth. Interf writes verifiable context inside the instance's data dir; it does not modify the source.
-
-`AGENTS.md` tells agents how to use the verifiable context: start from the prepared outputs, follow the prepared routes, and use the recorded source references when exact source evidence matters.
-
-Interf also records stage-by-stage proof of work: which files were processed, what each stage produced, and whether required outputs were created.
+The source files stay the source of truth. Interf writes generated state inside
+the instance data directory and does not modify the Source.
 
-The returned local folder carries source references, not a mandatory copy of every source file. The source files remain where you keep them; Interf records which sources were assigned and what artifacts were produced from them.
+`AGENTS.md` tells agents how to use the Context Graph: start from the prepared
+outputs, follow the prepared routes, and use the recorded source references
+when exact source evidence matters.
 
 ## Build Plans
 
-A Build Plan tells Interf how to build requested Artifacts from your source files for the job agents need to do. It can start as a draft inside one Preparation, based on the user's instructions, the agent goal, and the described Source. If it works, save it and reuse it on another Source.
+A Build Plan tells Interf how to build requested Artifacts from your Source for
+the agent task. It also states the Context Checks the user can review before the
+Build.
 
-The built-in `interf-default` Build Plan ships with `interf`. Save your own local Build Plan with `interf build-plan save <path>`; draft new ones with `interf build-plan draft <prep-id>`.
+The built-in `interf-default` Build Plan ships with `interf`. Save your own
+local Build Plan with `interf plan save <path>`; draft new ones with
+`interf plan draft <project-id>`.
 
 ```text
 <build-plan-folder>/
   build-plan.json         # Build Plan definition: artifacts, stages, build rules
-  build-plan.schema.json  # output contract: required verifiable-context files and folders
-  README.md             # what this Build Plan is for
+  build-plan.schema.json  # output contract: required Context Graph files/folders
+  README.md               # what this Build Plan is for
   build/
     stages/
-      summarize/        # stage instructions Interf runs during the Build run
+      summarize/          # stage instructions Interf runs during the Build
       structure/
       shape/
   use/
-    query/              # how agents read the verifiable context
-  improve/              # how Interf revises this plan if readiness checks still fail
+    query/                # how agents read the Context Graph
+  improve/                # how Interf revises the plan if checks still fail
 ```
 
-- `build-plan.json` is the current technical filename for the Build Plan definition: source data, requested artifacts, stages, and how the files should be built.
-- `build-plan.schema.json` describes the output contract: what the verifiable context must contain. Interf enforces it when you run `interf build`.
-- `build/stages/<stage>/` is where you author one folder per stage — a small, specific phase like `summarize` or `structure`. You write the instructions; Interf runs them during the Build run.
-- `use/query/` holds the instructions agents follow when they read the verifiable context for live agent work.
-- `improve/` holds the instructions Interf follows when the first build misses and the Build Plan itself needs editing.
-
-A Build Plan defines the stages, output contract, proof requirements, and improvement instructions Interf runs on your files. The result is verifiable context your agents can read.
+- `build-plan.json` is the technical filename for the Build Plan definition:
+  requested Artifacts, stages, and how the files should be built.
+- `build-plan.schema.json` describes the output contract: what the Context Graph
+  must contain.
+- `build/stages/<stage>/` is where you author one folder per stage.
+- `use/query/` holds the instructions agents follow when they read the Context
+  Graph for the task.
+- `improve/` holds the instructions Interf follows when the first Build misses
+  and the Build Plan itself needs editing.
 
 ## Build Plan Improvement
 
-When the first Build run still misses readiness checks, Interf edits the Build Plan and builds again. Same files, same checks, improved plan and verifiable context. Run `interf build-plan improve <prep-id>` to invoke that loop manually.
-
-Interf saves every readiness-check run inside the returned local folder under `.interf/tests/`. You can inspect what changed and why a later Build run did better.
-
-## How Interf Builds
-
-You don't need to think about roles. By default Interf uses your active agent for every stage of every Build run. Roles are available for advanced users who want different agents per stage; defaults are good and stable.
-
-Interf treats connected agents as a first-class primitive and uses a small role taxonomy internally to route stages between them. The default behavior is single-active-agent — one installed agent runs everything — but you can opt into per-role specialization without changing any Build Plan.
-
-```text
-Connected agents             Role map (per-instance)
-  claude-code (active)         extractor   → claude-code
-  codex                        summarizer  → claude-code
-  pdf-extract (custom)         structurer  → claude-code
-                               verifier    → claude-code
-                               general     → claude-code
-
-A Build run
-  for each stage in the Build Plan
-    look up the stage's role in the role map
-    invoke the mapped agent on the prepared shell
-    record which agent ran which stage
-```
-
-Build Plans declare an optional `role` per stage — one of `extractor`, `summarizer`, `structurer`, `verifier`, or `general`. Custom role names are allowed; unknown roles fall through to `general`.
-
-The role map lives in the instance's agent settings. On a fresh install with one agent installed, every role maps to that agent and you get the same single-active-agent behavior 0.14 had. To change which agent runs which role:
+When the first Build is `not ready`, Interf can edit the Build Plan and build
+again. Same Source, same checks, improved Build Plan and Context Graph.
 
 ```bash
-interf agents ls
-interf agents register opencode --command "opencode --prompt"
-interf agents map structurer codex
-interf agents use claude-code   # set the active agent
-interf agents unmap structurer  # fall back to active
+interf plan improve <project-id>
 ```
 
-Or use the **Agents** tab in Interf UI. Either surface mutates the same instance agent settings through the local service.
-
-Readiness-check runs always resolve to the `verifier` role. Build Plan authoring runs ask the authoring agent to propose a `role` per stage based on the prompt content; missing roles default to `general`.
-
-## How the Pieces Fit
-
-The instance owns preparation state. A preparation declares a source binding (`{ kind: "local-folder", locator: <path> }`), requested artifacts, and a selected Build Plan. It stores preparation state and generated bytes in the instance data directory. A Build run processes the selected source files and produces the artifact locator the API returns. `interf test` checks source files and verifiable context against the same readiness checks.
+Interf records Build Plan improvement as a Run with the revised Build Plan,
+Build evidence, and resulting Context Graph.
 
-Readiness is one `ready` / `not ready` status, not a separate score. Interf builds it from evidence primitives: Build Plan Artifact checks, proof records, file coverage, artifact validation, and readiness checks.
+## Context Checks And Benchmarks
 
-`interf web` runs the local Interf instance and serves Interf UI. The UI reads local-service resources: Source, Preparations, Build Plans, Build runs, stages, proof, artifacts, readiness checks, and whether verifiable context is `ready` or `not ready`. It renders local instance state; it does not own Build Plan, proof, or readiness semantics.
+Context Checks are plain-English promises the user reviews before a Build.
+Requested Artifacts back those checks.
 
-Everywhere Interf shows a resource — Source, context output, Build Plan files, run artifacts — the API returns a single locator shape: `{ kind, value }`. `local-path` means the engine has filesystem access to the same host as the user; `remote-url` is a signed URL the UI opens in a browser tab; `api-served` is a relative API route the UI fetches and renders inline. Local engines today return `local-path`; the same shape carries forward unchanged when a remote instance fronts the API.
+Examples:
 
-## CLI Connection
+- every file in scope was processed
+- required pages or slides were inventoried
+- required outputs exist
+- every figure cites a source page
+- the Source has not changed since the Build
 
-The CLI is a thin authorized client of one connected instance. It carries one active connection record:
+Benchmarks are different. A benchmark asks saved questions and measures answer
+accuracy against an agent source-access baseline, the Context Graph, or both.
 
-```text
-{
-  "url": "http://127.0.0.1:4873",
-  "auth_token": null
-}
-```
-
-`interf web` and `interf web start` write that record on startup. `interf login --url <remote>` writes a remote one (the cloud backend ships in a future release; the wire shape and config layer ship now). `interf logout` clears it.
-
-If the connection is unreachable, every mutating command exits non-zero with:
-
-```text
-Not connected to any Interf instance.
-Start one with `interf web` or `interf web start`, or set --url / `interf login` for a remote one.
+```bash
+interf benchmark bristol
+interf benchmark bristol --target source-files
+interf benchmark bristol --target context-graph
 ```
 
-There is no implicit auto-start. There is no per-folder pointer file. One mental model: client connects to instance, explicitly starts one, or doesn't.
-
-## Readiness Checks
-
-There are two checks in the system, and they answer different questions.
-
-Build Plan Artifact checks check the build: did the plan produce the files, folders, Artifacts, and stage outputs it promised? Interf checks those while it builds.
-
-Readiness checks check the verifiable context: is this Preparation good enough for the specific agent work? They are the confidence layer on top of the context, not the product output.
-
-In the setup flow, readiness checks often look like plain question-and-answer pairs. On the API, they live under each preparation's `checks[]`. They help define whether the context is `ready` or `not ready`. A check should be a small, verifiable fact or condition you already know from the files:
-
-- one exact number from a chart, table, or filing
-- one short statement that should be true or false
-- one comparison across years, files, or sections
-
-Interf proposes an initial set from the files and the description of the job agents need to do. You confirm, edit, or replace them. `interf test` runs those checks through the configured local agent against source files, verifiable context, or both. The context itself does not answer; the agent answers while using it.
-
-A maintained readiness example in this repo uses one market report, two readiness checks, and two agents:
-
-<!-- PUBLIC_BENCHMARK_TABLE:START -->
-| Agent | Source files | Verifiable context |
-| --- | --- | --- |
-| Codex (GPT-5.4, xhigh) | `2/2` | `2/2` |
-| Claude Code (Claude Opus 4.6, max) | `0/2` | `2/2` |
-<!-- PUBLIC_BENCHMARK_TABLE:END -->
-
-Codex passed from the source files; Claude Code only passed when working from Interf's verifiable context. Both numbers come from the same readiness-check pass. That is evidence about whether this context is `ready` for this agent work.
-
-A maintained public test example uses this preparation:
-
-<!-- PUBLIC_TEST_CHECKS:START -->
-```text
-{
-  "id": "cbre-chart-sanity",
-  "source": { "kind": "local-folder", "locator": "./task-files" },
-  "build_plan_id": "interf-default",
-  "about": "Bristol historical take-up and availability chart lookup.",
-  "requested_artifacts": [
-    {
-      "title": "Guide to the report",
-      "checks": ["Every page is listed.", "Pages about Bristol charts are marked."]
-    },
-    {
-      "title": "Annual take-up and availability figures",
-      "checks": ["Every figure has a page reference.", "Approximate chart-derived reads are labelled."]
-    }
-  ],
-  "checks": [
-    {
-      "question": "What were Bristol's annual take-up values in 2018 and 2016?",
-      "answer": "Around half a million sq ft in 2018, roughly 0.45 to 0.6 million sq ft, and about 0.7 to 0.8 million sq ft in 2016. These are approximate chart-derived reads."
-    },
-    {
-      "question": "What were Bristol's availability values in 2018 and 2016?",
-      "answer": "About 0.55 to 0.6 million sq ft in 2018 and about 1.2 to 1.3 million sq ft in 2016. These are approximate chart-derived reads."
-    }
-  ]
-}
-```
-<!-- PUBLIC_TEST_CHECKS:END -->
+`interf benchmark` is optional evaluation. It is not the main readiness surface.
 
 ## What Interf Is Not
 
-- Not a second brain or memory product. One preparation per agent job; nothing global.
-- Not a vector store or RAG server. The context output is plain files.
-- Not a hosted data platform. The local instance runs on your machine; your bytes never leave it.
-- Not an agent harness. Interf builds verifiable context; your existing agent reads it.
+- Not a second brain or memory product. One Project starts from one Source and
+  agent task.
+- Not a vector store or hosted RAG server. The Context Graph is structured
+  source-backed context agents can inspect.
+- Not a hosted data platform by default. Local Builds run on your machine.
+- Not a generic agent task orchestrator. Interf prepares files into Context
+  Graphs for agents.
 
 ## Useful Commands
 
-- `interf web` — run the local engine in the foreground (Interf UI + API)
-- `interf web start` — start a managed background local engine for agent sessions
-- `interf web stop` — kill the running local engine
-- `interf prep ls / create / show / rm` — manage preparations
-- `interf build <prep-id>` — build verifiable context, returns the artifact locator
-- `interf test <prep-id>` — run readiness checks against source files and/or verifiable context
-- `interf build-plan list / show / save / draft / select / improve` — manage Build Plans
-- `interf agents ls / use / register / unregister / map / unmap` — manage connected agents and the role map
-- `interf runs ls / status / cancel / fetch` — inspect runs
-- `interf login / logout` — manage the active connection record (remote backend ships in a future release)
-- `interf status` — show the active connection and a preparation summary
-- `interf doctor --live` — check the local executor
+- `interf` / `interf init` - open the interactive wizard.
+- `interf runtime` - run the local Interf runtime in the foreground.
+- `interf runtime start` - start a managed background local runtime.
+- `interf runtime stop` - stop the running local runtime.
+- `interf project ls / create / show / rm` - manage Projects.
+- `interf plan list / show / save / draft / select / improve` - manage Build
+  Plans.
+- `interf build <project-id>` - Build the Context Graph for a Project.
+- `interf graphs ls --project <id>` / `show <graph-id> --project <id>` - inspect
+  Context Graphs.
+- `interf traces ls --project <id>` / `show <trace-kind> --project <id>` -
+  inspect Context Graph traces.
+- `interf runs ls --project <id>` / `status <run-id>` - inspect Runs.
+- `interf benchmark <project-id>` - run an optional benchmark/evaluation pass.
+- `interf agents ls / use / register / unregister / map / unmap` - configure
+  local agents and role mapping.
+- `interf login / logout` - connect the CLI to another Interf instance.
+- `interf status` - show the active connection and Project summary.
+- `interf doctor --live` - check the local executor before a Build.
 
 ## Public Assets
 
-- [skills/interf](./skills/interf/) — bundled agent Skill for Interf.
-- [plugins/interf](./plugins/interf/) — local MCP host bundle for agents that support local MCP servers.
-- [build-plans/interf-default](./build-plans/interf-default/) — default Build Plan that ships with `interf`.
+- [skills/interf](./skills/interf/) - bundled agent Skill for Interf.
+- [build-plans/interf-default](./build-plans/interf-default/) - default Build
+  Plan that ships with `interf`.
 
 Contributors: see [CONTRIBUTING.md](./CONTRIBUTING.md).
 

package/public-repo/SECURITY.md

@@ -4,7 +4,7 @@ We take security issues seriously. Thank you for helping keep Interf safe for th
 
 ## Supported Versions
 
-Only the latest published release of `@interf/compiler` on npm and the current `main` branch of [`interf-labs/interf`](https://github.com/interf-labs/interf) receive security fixes.
+Only the latest published release of `@interf/compiler` on npm and the current `main` branch of [`interf-labs/compiler`](https://github.com/interf-labs/compiler) receive security fixes.
 
 ## Reporting a Vulnerability
 
@@ -13,7 +13,7 @@ Only the latest published release of `@interf/compiler` on npm and the current `
 Preferred disclosure paths, in order:
 
 1. **Email**: [security@interf.com](mailto:security@interf.com) — primary contact for any security report
-2. **GitHub Security Advisories**: use [private vulnerability reporting](https://github.com/interf-labs/interf/security/advisories/new) on the `interf-labs/interf` repository
+2. **GitHub Security Advisories**: use [private vulnerability reporting](https://github.com/interf-labs/compiler/security/advisories/new) on the `interf-labs/compiler` repository
 3. **PGP**: encrypted reports accepted on request via the email above
 
 Please include:
@@ -46,7 +46,7 @@ Security reports are especially relevant for:
 - unsafe filesystem writes or path traversal
 - command execution boundaries (subprocess, agent shell-out)
 - accidental leakage of private local files or runtime artifacts
-- authentication or authorization bypasses on `interf web` / `/v1/*` endpoints
+- authentication or authorization bypasses on `interf runtime` / `/v1/*` endpoints
 - test or Build Plan files causing unintended code execution
 - supply-chain risks in dependencies
 
@@ -64,4 +64,3 @@ For our compliance posture, control attestations, and policy documentation see [
 - General inquiries: [info@interf.com](mailto:info@interf.com)
 - Trust Center: [trust.interf.com](https://trust.interf.com)
 - Trademark questions: see [TRADEMARKS.md](./TRADEMARKS.md)
-</content>

package/public-repo/build-plans/interf-default/README.md

@@ -1,33 +1,38 @@
 # Built-in Interf Build Plan
 
-Built-in file-processing Build Plan: build traceable artifacts with proof by summarizing source-grounded evidence, structuring cross-file connections, and shaping verifiable context around the saved readiness checks.
+Built-in Build Plan that builds a three-layer Context Graph from source files:
+summaries for coverage, knowledge for task-aware graph structure, and
+artifacts for downstream agent handoff with links back to sources.
 
 ## Purpose
 
-- General Build Plan implementation for building verifiable context agents can use.
-- Build mixed source files into evidence-backed summaries, cross-file structure, and a usable entrypoint for agents running the readiness checks this agent work depends on.
+- General Build Plan implementation for preparing data for agents from source files.
+- Build mixed source files into source coverage summaries, task-aware knowledge, Artifact handoffs, and links back to sources the downstream agent can use without rediscovering the Source.
 
 ## Artifacts
 
-- `summaries` — output directory at `summaries`
-- `knowledge-entities` — output directory at `knowledge/entities`
-- `knowledge-claims` — output directory at `knowledge/claims`
-- `knowledge-indexes` — output directory at `knowledge/indexes`
-- `atlas` — output file at `home.md` used as the primary entrypoint for this Build Plan
+- `summaries` — source coverage directory at `summaries`
+- `knowledge` — task-aware graph directory at `knowledge`; current default is
+  flat `knowledge/*.md`, not required `knowledge/entities/`,
+  `knowledge/claims/`, or `knowledge/indexes/` folders
+- `artifacts` — task-specific agent handoff directory at `artifacts`
+- `home` — Context Graph index file at `home.md`
 
 ## Stages
 
 Each stage is a folder with a `SKILL.md` file. Interf creates the stage shell,
 attaches source references and runtime context, runs the agent against that
-plain-text Skill, and records proof of what the stage wrote.
+plain-text Skill, and records evidence of what the stage wrote.
 
-- `summarize` — Turn source files into per-file summaries. (build-file-evidence; reads: none; writes: summaries)
-- `structure` — Build the cross-file knowledge structure from the summaries. (build-knowledge-structure; reads: summaries; writes: knowledge-entities, knowledge-claims, knowledge-indexes)
-- `shape` — Shape the final verifiable context around the saved task focus and readiness checks. (build-query-shape; reads: summaries, knowledge-entities, knowledge-claims, knowledge-indexes; writes: knowledge-indexes, atlas)
+- `summarize` — Turn source files into source-named coverage folders with source metadata. (build-file-evidence; reads: none; writes: summaries)
+- `structure` — Build the task-aware Context Graph structure from summaries, including entities, claims, topics, indexes, and links back to sources. (build-knowledge-structure; reads: summaries; writes: knowledge)
+- `shape` — Shape task-specific Artifact handoffs and the final Context Graph around the saved task focus and Context Checks. (build-query-shape; reads: summaries, knowledge; writes: knowledge, artifacts, home)
 
 ## Why `home.md` exists here
 
-This built-in Build Plan creates `home.md` as the main agent entrypoint for the verifiable context.
-That is behavior of the `interf-default` Build Plan implementation, not a local-engine rule.
+This built-in Build Plan creates `home.md` as the Context Graph index.
+Downstream agents should start from `artifacts/` for task handoffs and use
+`home.md` only to navigate the graph. That is behavior of the `interf-default`
+Build Plan implementation, not a local-service invariant.
 
 This package is the built-in seed for `interf-default`.