@meetless/mla 0.1.4

package/dist/lib/render.js

@@ -0,0 +1,611 @@
+"use strict";
+// Plain-text ReviewPacket renderer per §5.3 + §6.
+// Used by `mla review [--plain]`. ANSI colors stripped when --plain.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderPacket = renderPacket;
+exports.renderCaseRow = renderCaseRow;
+exports.fmtCaseShow = fmtCaseShow;
+exports.renderKbAddReceipt = renderKbAddReceipt;
+exports.renderKbShow = renderKbShow;
+exports.renderKbForgetReceipt = renderKbForgetReceipt;
+exports.renderKbReingestReceipt = renderKbReingestReceipt;
+exports.renderKbPurgeReceipt = renderKbPurgeReceipt;
+const temporal_1 = require("./temporal");
+function fmtEvidenceRef(ev) {
+    if (typeof ev !== "string")
+        return null;
+    const s = ev.trim();
+    return s.length ? s : null;
+}
+function fmtList(items) {
+    if (!items || items.length === 0)
+        return "  (none)";
+    return items.map((i) => `  - ${i}`).join("\n");
+}
+function fmtFacts(facts) {
+    if (!facts)
+        return "  (deterministic facts not yet populated)";
+    const lines = [];
+    if (facts.branch)
+        lines.push(`  branch: ${facts.branch}`);
+    if (facts.lastCommit)
+        lines.push(`  last commit: ${facts.lastCommit}`);
+    const ds = facts.diffStat;
+    if (ds) {
+        lines.push(`  diffStat: files=${ds.filesChanged ?? 0} +${ds.insertions ?? 0} -${ds.deletions ?? 0}`);
+    }
+    const changed = facts.changedFiles;
+    if (changed && changed.length > 0) {
+        lines.push(`  changed files (${changed.length}):`);
+        for (const f of changed.slice(0, 50))
+            lines.push(`    - ${f}`);
+        if (changed.length > 50)
+            lines.push(`    ... +${changed.length - 50} more`);
+    }
+    const cls = facts.classifications;
+    if (cls) {
+        const counts = {};
+        for (const c of Object.values(cls))
+            counts[c] = (counts[c] ?? 0) + 1;
+        const summary = Object.entries(counts)
+            .map(([k, v]) => `${k}=${v}`)
+            .join(", ");
+        if (summary)
+            lines.push(`  classifications: ${summary}`);
+    }
+    return lines.length ? lines.join("\n") : "  (empty)";
+}
+function fmtBashEvents(events) {
+    if (!events || events.length === 0)
+        return "  (none observed)";
+    const lines = [];
+    for (const e of events.slice(0, 30)) {
+        const ev = e;
+        const cmd = (ev.command || "").replace(/\s+/g, " ").slice(0, 120);
+        lines.push(`  [${ev.category || "unknown"}] exit=${ev.exitCode ?? "?"}  ${cmd}`);
+    }
+    if (events.length > 30)
+        lines.push(`  ... +${events.length - 30} more`);
+    return lines.join("\n");
+}
+// Capture-count rollup. This is the §10 Phase 1 "print capture counts" block:
+// the deterministic shape of what the run captured, NOT a verdict on it. Phase 1
+// has no claim/decision/contradiction extraction (that lands with the per-turn
+// extraction substrate, RCA Phase 3), so we count only what is captured
+// deterministically: changed files, observed bash events, missing-evidence
+// flags, and whether the agent left a verbatim self-report.
+function fmtCaptureSummary(packet) {
+    const ds = (packet.facts?.diffStat ?? {});
+    const changedFiles = packet.facts?.changedFiles?.length ?? ds.filesChanged ?? 0;
+    const bashCount = packet.bashEvents?.length ?? 0;
+    const missingCount = packet.missingEvidence?.length ?? 0;
+    const selfReport = !!(packet.agentClaimsRaw && packet.agentClaimsRaw.trim().length > 0);
+    const lines = [
+        `  changed files:          ${changedFiles}`,
+        `  observed bash events:   ${bashCount}`,
+        `  missing-evidence flags: ${missingCount}`,
+        `  agent self-report:      ${selfReport ? "captured (unverified)" : "none"}`,
+    ];
+    return lines.join("\n");
+}
+// INV-T3 / §5.3 / §5.4: this surface renders NO verdict, recommendation, or
+// approve/reject for an agent-session capture. A captured run is a deterministic
+// ledger of what the agent did and self-reported, never an independent review.
+// The renderer DELIBERATELY ignores any recommendation / verification / risks /
+// summary / LLM-trace fields the wire may still carry (e.g. a packet written by
+// an older control build), so the false-authority line cannot reappear by data
+// alone. The reviewable artifacts (relationship candidates, claims) live in the
+// Console queues; this block is a convenience snapshot of capture, not a sign-off.
+function renderPacket(packet) {
+    const out = [];
+    const isStale = typeof packet.staleEventCount === "number" && packet.staleEventCount > 0;
+    out.push(`╭─ Meetless Capture Ledger ────────────────────────────────────────────╮`);
+    out.push(`  packet id:   ${packet.id}`);
+    out.push(`  run id:      ${packet.runId}`);
+    out.push(`  status:      ${packet.status}`);
+    out.push(`  note:        this is a capture ledger, not a sign-off. No verdict is rendered here.`);
+    out.push(`────────────────────────────────────────────────────────────────────────`);
+    if (isStale) {
+        const n = packet.staleEventCount;
+        const since = packet.staleSince ? ` (${packet.staleSince})` : "";
+        const latest = packet.latestEventAt ? `; latest at ${packet.latestEventAt}` : "";
+        out.push(``);
+        out.push(`⚠ STALE LEDGER`);
+        out.push(`  ${n} event(s) were recorded on this run AFTER this ledger was built${since}${latest}.`);
+        out.push(`  This run is still live (one long-lived / continued session). The facts`);
+        out.push(`  below reflect the session at build time and may be incomplete for the work since.`);
+        out.push(`  Regenerate: end the session (SessionEnd) to finalize a fresh ledger, then re-run mla review.`);
+        out.push(`  Inspect raw turns now: mla session show`);
+    }
+    if (packet.warnings && packet.warnings.length > 0) {
+        out.push(`\nWarnings`);
+        out.push(fmtList(packet.warnings));
+    }
+    out.push(`\nCapture summary`);
+    out.push(fmtCaptureSummary(packet));
+    out.push(`\nFacts (deterministic)`);
+    out.push(fmtFacts(packet.facts));
+    out.push(`\nObserved Bash events`);
+    out.push(fmtBashEvents(packet.bashEvents));
+    out.push(`\nMissing evidence flags`);
+    out.push(fmtList(packet.missingEvidence));
+    if (packet.agentClaimsRaw) {
+        out.push(`\nAgent self-report (verbatim final message; NOT verified)`);
+        out.push(`  ${packet.agentClaimsRaw.slice(0, 1200).replace(/\n/g, "\n  ")}`);
+    }
+    // No "Recommended next prompt" block (Mission deletion, PR1 Correction 5): the
+    // steering prompt was the lone surviving review-steering output and it embedded
+    // "Continue mission <X>". The producer side stopped emitting it; the renderer
+    // deliberately never surfaces `recommendedNextPrompt` even if a legacy/unmigrated
+    // packet still carries one on the wire. The surviving failure signal lives in the
+    // Missing-evidence flags above (e.g. `test_command_failed`).
+    // E2 run-end review directive (interim form). Per-session pending counts need
+    // the session->candidate linkage that lands with extraction (RCA Phase 3); until
+    // then this points at the session-scoped `mla review` and the Console queues the
+    // command already leads with. No verdict, no count fabrication.
+    out.push(`\nReview pending items`);
+    out.push(`  This ledger carries no verdict. Captured candidates and claims are reviewed`);
+    out.push(`  in the Console queues above. Re-run for this session: mla review`);
+    out.push(`\n╰──────────────────────────────────────────────────────────────────────╯`);
+    return out.join("\n");
+}
+function renderCaseRow(c) {
+    return `  ${c.id}  [${c.status}]  ${c.severity.toUpperCase()}  ${c.riskCategory}  ${c.title}`;
+}
+// Matches the risk on a ReviewPacket back to the case row. Cases were created
+// via createFromAgentReview using risk.title + risk.category, so a (title,
+// category) tuple is the load-bearing key the bridge already commits to. The
+// fingerprint sha1 is not exposed on the packet's risks payload, so we cannot
+// match by fingerprint client-side.
+function pickRiskForCase(packet, rowMeta) {
+    if (!packet || !packet.risks || packet.risks.length === 0)
+        return null;
+    const t = (rowMeta.title || "").trim();
+    const cat = (rowMeta.riskCategory || "").trim();
+    if (!t && !cat)
+        return null;
+    const exact = packet.risks.find((r) => (r.title || "").trim() === t && (r.category || "").trim() === cat);
+    if (exact)
+        return exact;
+    const byCat = packet.risks.find((r) => (r.category || "").trim() === cat);
+    return byCat ?? null;
+}
+function fmtCaseShow(row, packet) {
+    const meta = (row?.metadata ?? {});
+    const out = [];
+    out.push(`╭─ Meetless CoordinationCase ───────────────────────────────────────────╮`);
+    out.push(`  id:           ${row?.id ?? "?"}`);
+    out.push(`  kind:         ${row?.kindId ?? "?"}`);
+    out.push(`  status:       ${row?.statusId ?? row?.status ?? "?"}`);
+    if (row?.canonicalFingerprint) {
+        out.push(`  fingerprint:  ${row.canonicalFingerprint}`);
+    }
+    if (row?.createdAt)
+        out.push(`  created:      ${row.createdAt}`);
+    if (row?.closedAt) {
+        out.push(`  closed:       ${row.closedAt}  (${row.closedReason ?? "no reason"})`);
+    }
+    out.push(`────────────────────────────────────────────────────────────────────────`);
+    const sev = (meta.severity || "?").toString().toUpperCase();
+    const cat = meta.riskCategory || row?.kindId || "?";
+    const title = meta.title || "(no title)";
+    out.push(`\n  ${sev}  ${cat}  ${title}`);
+    if (meta.description) {
+        out.push(`\n${("  " + String(meta.description)).replace(/\n/g, "\n  ")}`);
+    }
+    // Evidence: prefer the packet's risk row (carries the wire refs). Fall back
+    // to evidenceCount on the case row so we at least surface that signal.
+    const matched = pickRiskForCase(packet, {
+        title: meta.title,
+        riskCategory: meta.riskCategory,
+    });
+    if (matched && matched.evidence && matched.evidence.length > 0) {
+        const rendered = matched.evidence.map(fmtEvidenceRef).filter((s) => !!s);
+        if (rendered.length > 0) {
+            out.push(`\n  evidence:`);
+            for (const r of rendered)
+                out.push(`    - ${r}`);
+        }
+    }
+    else if (typeof meta.evidenceCount === "number" && meta.evidenceCount > 0) {
+        out.push(`\n  evidence: (${meta.evidenceCount} refs on packet; run \`mla review by-run <runId>\` to inspect)`);
+    }
+    if (meta.runId) {
+        out.push(`\n  run id:       ${meta.runId}`);
+        if (meta.packetId)
+            out.push(`  packet id:    ${meta.packetId}`);
+        out.push(`\n  next: mla review   (run inside the Claude Code session that produced this packet)`);
+    }
+    out.push(`\n╰──────────────────────────────────────────────────────────────────────╯`);
+    return out.join("\n");
+}
+// =============================================================================
+// KB curation receipts (notes/20260530-mla-kb-curation-cli-proposal-v2 §4)
+// =============================================================================
+//
+// The renderers below feed `mla kb add | show | forget | reingest | purge |
+// move`. Each command's HTTP layer returns a typed JSON
+// envelope; the commands hand the parsed envelope to a renderer here and a
+// final console.log of the returned string is the only stdout the operator
+// sees. Receipts always close with a one-line `next:` hint so the operator
+// knows what verifies the action.
+//
+// Display formatting choices:
+//   - Box-drawing characters match the existing review/case renderers so
+//     `mla` output looks consistent across surfaces.
+//   - Hashes render as 12-char prefixes (`a3f9e2c10b48...`). The full value
+//     lives in the audit log; the prefix is enough to spot a divergence.
+//   - Counterpart tags ("[tombstoned: 2026-05-30T...]") inline next to the
+//     edge counterpart per §4.2 correction #8.
+//   - Timestamps render as the raw ISO string from intel. No timezone
+//     conversion in the CLI; the operator's terminal already knows.
+function fmtKv(key, value) {
+    const v = value === undefined || value === null ? "(unset)" : String(value);
+    return `  ${key.padEnd(18, " ")} ${v}`;
+}
+function fmtHashPrefix(hash) {
+    if (!hash)
+        return "(none)";
+    return hash.length <= 12 ? hash : `${hash.slice(0, 12)}...`;
+}
+function fmtCounterpartTag(state, ts) {
+    if (!state || state === "ACTIVE")
+        return "";
+    const tsPart = ts ? `: ${ts}` : "";
+    return ` [${state.toLowerCase()}${tsPart}]`;
+}
+// B1: turn a GRAPH_EXTRACT extraction state into a human + agent signal. The
+// async-queued case is the current default (the worker owns the LLM detector);
+// the concrete states arrive once B3 polls the job to completion.
+function fmtExtractionValue(ex) {
+    switch (ex.state) {
+        case "queued":
+            return "extraction queued (async; check `mla kb show` once it completes)";
+        case "running":
+            return "extracting now (async; check `mla kb show` once it completes)";
+        case "completed": {
+            const n = ex.candidateCount ?? 0;
+            const c = ex.conflictCount ?? 0;
+            const noun = `${n} candidate${n === 1 ? "" : "s"}`;
+            const conflictPart = c > 0 ? ` (${c} conflict${c === 1 ? "" : "s"}: CONTRADICTS/SUPERSEDES)` : "";
+            const review = n > 0 ? "; review with `mla kb pending`" : "; none to review";
+            return `${noun}${conflictPart}${review}`;
+        }
+        case "failed":
+            return "extraction FAILED; retry with `mla kb reingest`";
+        case "skipped":
+            return "not re-extracted (no body change)";
+    }
+}
+function renderKbAddReceipt(r) {
+    const out = [];
+    const verb = r.mode === "corpus" ? "corpus" : "file";
+    out.push(`╭─ mla kb add (${verb}) ${"─".repeat(Math.max(0, 49 - verb.length))}╮`);
+    out.push(fmtKv("workspace:", r.workspaceId));
+    out.push(fmtKv("outcome:", r.outcome));
+    out.push(fmtKv("documentId:", r.documentId));
+    out.push(fmtKv("canonicalPath:", r.canonicalPath));
+    out.push(fmtKv("parentUuid:", r.parentUuid));
+    out.push(fmtKv("provenance:", r.provenance));
+    if (r.outcome === "failed" && r.failure) {
+        out.push("");
+        out.push(fmtKv("FAILED code:", r.failure.code));
+        out.push(fmtKv("FAILED reason:", r.failure.reason));
+        out.push(fmtKv("FAILED at:", r.failure.failedAt));
+    }
+    else {
+        out.push("");
+        out.push(fmtKv("revisionId:", r.revisionId || "(unset)"));
+        out.push(fmtKv("revision status:", r.revisionStatus || "(unset)"));
+        out.push(fmtKv("chunk count:", r.chunkCount ?? 0));
+        out.push(fmtKv("normalizedBody:", fmtHashPrefix(r.normalizedBodyHash)));
+        out.push(fmtKv("fullDocument:", fmtHashPrefix(r.fullDocumentHash)));
+        out.push(fmtKv("outbox event:", r.outboxEventType || "(none)"));
+        // B1: never let `outbox event` be the only post-ingest signal. A minted
+        // revision enqueues GRAPH_EXTRACT; say so honestly. A noop_unchanged delivery
+        // mints nothing, so it enqueues no extraction.
+        const enqueuesExtraction = r.outcome === "ingested";
+        if (r.extraction) {
+            out.push(fmtKv("relationships:", fmtExtractionValue(r.extraction)));
+        }
+        else if (enqueuesExtraction) {
+            out.push(fmtKv("relationships:", fmtExtractionValue({ state: "queued" })));
+        }
+    }
+    if (r.corpus) {
+        out.push("");
+        out.push(`  corpus: ${r.corpus.corpusName}`);
+        out.push(`  root:   ${r.corpus.rootPath}`);
+        out.push(`  totals: ingested=${r.corpus.ingested} restored=${r.corpus.restored} ` +
+            `no_change=${r.corpus.noChange} failed=${r.corpus.failed}`);
+        if (r.corpus.perDoc.length > 0) {
+            out.push("");
+            out.push("  per doc:");
+            for (const d of r.corpus.perDoc) {
+                const chunkPart = typeof d.chunkCount === "number" ? ` chunks=${d.chunkCount}` : "";
+                const failPart = d.failureCode ? ` failure=${d.failureCode}` : "";
+                out.push(`    - ${d.canonicalPath}  [${d.outcome}]${chunkPart}${failPart}`);
+            }
+        }
+    }
+    // B4a: always surface the Console review URL when the command layer supplies
+    // it. The human reviews candidate edges in the Console; the CLI prints the
+    // clickable link rather than auto-opening a browser.
+    if (r.consoleUrl) {
+        out.push("");
+        out.push(fmtKv("review (console):", r.consoleUrl));
+    }
+    out.push("");
+    out.push(`  next: mla kb show ${r.canonicalPath}`);
+    out.push(`╰──────────────────────────────────────────────────────────────────────╯`);
+    return out.join("\n");
+}
+// B2: render the candidate-section line when there are zero candidate edges.
+// Each branch is an honest, distinct signal; never the bare `(none)` that
+// conflated "still running", "found nothing", and "crashed".
+function fmtKbExtractionStatusLine(ext) {
+    if (!ext) {
+        // No GRAPH_EXTRACT run on record for this doc (e.g. ingested before the
+        // async detection lane, or a frontmatter-only reingest that never
+        // re-extracted). Honest, and distinct from a completed-with-nothing run.
+        return [`    (no extraction on record for this revision)`];
+    }
+    switch (ext.state) {
+        case "queued":
+        case "running": {
+            const when = ext.state === "queued"
+                ? ext.enqueuedAt
+                    ? `queued ${ext.enqueuedAt}`
+                    : "queued"
+                : "running";
+            return [`    extracting (${when}; job ${ext.jobId})`];
+        }
+        case "completed":
+            return [`    none found (extraction completed; job ${ext.jobId})`];
+        case "failed":
+            return [
+                `    extraction failed (job ${ext.jobId})${ext.error ? `: ${ext.error}` : ""}`,
+                `    retry: mla kb add <path> --reingest`,
+            ];
+        default:
+            return [`    (no extraction on record for this revision)`];
+    }
+}
+function fmtRevisionLine(r) {
+    const parts = [`${r.id}  [${r.status}]`];
+    if (r.status === "FAILED" && r.failureCode) {
+        parts.push(`failure=${r.failureCode}`);
+    }
+    if (r.provenanceOverride && r.status !== "FAILED") {
+        parts.push(`override=${r.provenanceOverride}`);
+    }
+    if (typeof r.chunkCount === "number")
+        parts.push(`chunks=${r.chunkCount}`);
+    if (r.createdAt)
+        parts.push(r.createdAt);
+    return parts.join("  ");
+}
+function fmtEdgeLine(e) {
+    const arrow = e.direction === "outgoing" ? "->" : "<-";
+    const tag = fmtCounterpartTag(e.counterpart.tombstoneState, e.counterpart.tombstonedAt);
+    const cp = e.counterpart.canonicalPath || `kbdoc:${e.counterpart.documentId}`;
+    const head = `    ${arrow} ${e.predicate}  ${cp}${tag}  (${e.status}/${e.posture})  ${e.id}`;
+    // Task 5.2: promoted edges carry a VALID-time window + clock trust. Print it
+    // on its own indented line so the operator sees WHEN the relation was true and
+    // HOW trustworthy that clock is. Candidates have no window (validity absent),
+    // so they keep the single-line form.
+    if (!e.validity)
+        return head;
+    const window = (0, temporal_1.renderValidWindow)(e.validity);
+    const trust = (0, temporal_1.renderTrustLabel)(e.validity.validTimeSource);
+    return `${head}\n        ${window}, ${trust}`;
+}
+function renderKbShow(view) {
+    const out = [];
+    const d = view.document;
+    out.push(`╭─ mla kb show ────────────────────────────────────────────────────────╮`);
+    out.push(`  workspace: ${view.workspaceId}`);
+    out.push("");
+    out.push(`  IDENTITY + LIFECYCLE`);
+    out.push(fmtKv("id:", d.id));
+    out.push(fmtKv("canonicalPath:", d.canonicalPath || "(redacted; hard deleted)"));
+    if (d.pathAliases.length > 0) {
+        out.push(fmtKv("pathAliases:", d.pathAliases.join(", ")));
+    }
+    out.push(fmtKv("parentUuid:", d.parentUuid || "(cleared)"));
+    out.push(fmtKv("provenance:", d.provenance));
+    out.push(fmtKv("currentPosture:", d.currentPosture || "(null)"));
+    out.push(fmtKv("effectivePosture:", d.effectivePosture || "(null)"));
+    out.push(fmtKv("tombstoneState:", d.tombstoneState));
+    if (d.tombstonedAt)
+        out.push(fmtKv("tombstonedAt:", d.tombstonedAt));
+    if (d.tombstoneActorId)
+        out.push(fmtKv("tombstoneActor:", d.tombstoneActorId));
+    if (d.tombstoneReason)
+        out.push(fmtKv("tombstoneReason:", d.tombstoneReason));
+    if (d.deletedAt)
+        out.push(fmtKv("deletedAt:", d.deletedAt));
+    if (d.deletedBy)
+        out.push(fmtKv("deletedBy:", d.deletedBy));
+    if (d.redactedPathHash)
+        out.push(fmtKv("redactedPathHash:", fmtHashPrefix(d.redactedPathHash)));
+    out.push(fmtKv("createdAt:", d.createdAt));
+    out.push(fmtKv("updatedAt:", d.updatedAt));
+    out.push("");
+    out.push(`  CURRENT REVISION`);
+    if (!view.currentRevision) {
+        out.push(`    (no current revision; doc state = ${d.tombstoneState})`);
+    }
+    else {
+        const cr = view.currentRevision;
+        out.push(fmtKv("revisionId:", cr.id));
+        out.push(fmtKv("status:", cr.status));
+        out.push(fmtKv("ingestRunId:", cr.ingestRunId || "(unset)"));
+        out.push(fmtKv("postureAtIngest:", cr.postureAtIngest || "(unset)"));
+        if (cr.provenanceOverride) {
+            out.push(fmtKv("provenanceOverride:", cr.provenanceOverride));
+            if (cr.overrideReason)
+                out.push(fmtKv("overrideReason:", cr.overrideReason));
+        }
+        out.push(fmtKv("normalizedBody:", fmtHashPrefix(cr.normalizedBodyHash)));
+        out.push(fmtKv("frontmatter:", fmtHashPrefix(cr.frontmatterHash)));
+        out.push(fmtKv("fullDocument:", fmtHashPrefix(cr.fullDocumentHash)));
+        out.push(fmtKv("chunkCount:", cr.chunkCount ?? 0));
+        out.push(fmtKv("createdAt:", cr.createdAt || "(unset)"));
+    }
+    out.push("");
+    out.push(`  REVISION HISTORY${view.revisionHistoryTruncated ? "  (truncated; pass --all)" : ""}`);
+    if (view.revisionHistory.length === 0) {
+        out.push(`    (no revisions on file)`);
+    }
+    else {
+        for (const r of view.revisionHistory) {
+            out.push(`    ${fmtRevisionLine(r)}`);
+            if (r.status === "FAILED" && r.failureReason) {
+                out.push(`        failure: ${r.failureReason}`);
+            }
+        }
+    }
+    out.push("");
+    out.push(`  CHUNKS`);
+    out.push(fmtKv("total count:", view.chunks.totalCount));
+    out.push(fmtKv("total bytes:", view.chunks.totalBytes));
+    if (view.chunks.preview.length > 0) {
+        out.push("    active preview:");
+        for (const c of view.chunks.preview) {
+            out.push(`      [${c.ordinal}] ${c.preview.slice(0, 80)}`);
+        }
+    }
+    if (view.chunks.pendingReviewPreview.length > 0) {
+        out.push("    pending review preview:");
+        for (const c of view.chunks.pendingReviewPreview) {
+            out.push(`      [${c.ordinal}] ${c.preview.slice(0, 80)}`);
+        }
+    }
+    out.push("");
+    out.push(`  CANDIDATES TOUCHING THIS DOC  (${view.candidates.length})`);
+    if (view.candidates.length === 0) {
+        for (const line of fmtKbExtractionStatusLine(view.extraction))
+            out.push(line);
+    }
+    else {
+        for (const e of view.candidates)
+            out.push(fmtEdgeLine(e));
+    }
+    out.push("");
+    out.push(`  PROMOTED EDGES  (${view.promoted.length})`);
+    if (view.promoted.length === 0) {
+        out.push(`    (none)`);
+    }
+    else {
+        for (const e of view.promoted)
+            out.push(fmtEdgeLine(e));
+    }
+    out.push("");
+    out.push(`  AUDIT TRAIL${view.auditTruncated ? "  (truncated; pass --audit-all)" : ""}`);
+    if (view.audit.length === 0) {
+        out.push(`    (no audit rows)`);
+    }
+    else {
+        for (const a of view.audit) {
+            const actor = a.actorId ? ` by ${a.actorId}` : "";
+            out.push(`    ${a.occurredAt}  ${a.eventType}${actor}  ${a.id}`);
+        }
+    }
+    // B4a: surface the Console review URL (the human surface for candidate
+    // review). Printed always when present; the CLI never auto-opens a browser
+    // from an inspection command run repeatedly / over SSH / in CI.
+    if (view.consoleUrl) {
+        out.push("");
+        out.push(`  CONSOLE`);
+        out.push(`    review queue: ${view.consoleUrl}`);
+    }
+    out.push("");
+    out.push(`╰──────────────────────────────────────────────────────────────────────╯`);
+    return out.join("\n");
+}
+// The governed tombstone flips one column (tombstoneState ACTIVE -> TOMBSTONED);
+// the serve gate drops the doc at read time via the liveness predicate, so there
+// is no chunk sweep, no outbox event, and no tombstone-timestamp column to echo.
+function renderKbForgetReceipt(r) {
+    const out = [];
+    out.push(`╭─ mla kb forget ──────────────────────────────────────────────────────╮`);
+    out.push(fmtKv("workspace:", r.workspaceId));
+    out.push(fmtKv("outcome:", r.outcome));
+    out.push(fmtKv("documentId:", r.documentId));
+    out.push(fmtKv("canonicalPath:", r.canonicalPath));
+    out.push(fmtKv("priorRevisionId:", r.priorRevisionId || "(none)"));
+    if (r.reason)
+        out.push(fmtKv("reason:", r.reason));
+    out.push("");
+    out.push(`  next: mla kb show kbdoc:${r.documentId}   (verify tombstoneState)`);
+    out.push(`╰──────────────────────────────────────────────────────────────────────╯`);
+    return out.join("\n");
+}
+function renderKbReingestReceipt(r) {
+    const out = [];
+    out.push(`╭─ mla kb reingest ────────────────────────────────────────────────────╮`);
+    out.push(fmtKv("workspace:", r.workspaceId));
+    out.push(fmtKv("outcome:", r.outcome));
+    out.push(fmtKv("documentId:", r.documentId));
+    out.push(fmtKv("canonicalPath:", r.canonicalPath));
+    out.push(fmtKv("parentUuid:", r.parentUuid));
+    out.push(fmtKv("priorRevisionId:", r.priorRevisionId || "(none)"));
+    if (r.outcome === "failed" && r.failure) {
+        out.push(fmtKv("newRevisionId:", r.newRevisionId || "(none)"));
+        out.push(fmtKv("FAILED code:", r.failure.code));
+        out.push(fmtKv("FAILED reason:", r.failure.reason));
+        out.push(fmtKv("FAILED at:", r.failure.failedAt));
+    }
+    else if (r.outcome === "noop_unchanged") {
+        // Content-identical re-delivery: nothing minted, prior head unchanged.
+        out.push(fmtKv("note:", "content unchanged; no new revision minted"));
+    }
+    else {
+        out.push(fmtKv("newRevisionId:", r.newRevisionId || "(unset)"));
+        out.push(fmtKv("revision status:", r.newRevisionStatus || "(unset)"));
+        out.push(fmtKv("provenance:", r.provenance || "(unset)"));
+        out.push(fmtKv("chunk count:", r.chunkCount ?? 0));
+        out.push(fmtKv("normalizedBody:", fmtHashPrefix(r.normalizedBodyHash)));
+        out.push(fmtKv("fullDocument:", fmtHashPrefix(r.fullDocumentHash)));
+    }
+    if (r.reason)
+        out.push(fmtKv("reason:", r.reason));
+    out.push("");
+    out.push(`  next: mla kb show kbdoc:${r.documentId}`);
+    out.push(`╰──────────────────────────────────────────────────────────────────────╯`);
+    return out.join("\n");
+}
+function renderKbPurgeReceipt(r) {
+    const out = [];
+    out.push(`╭─ mla kb purge ───────────────────────────────────────────────────────╮`);
+    out.push(fmtKv("workspace:", r.workspaceId));
+    out.push(fmtKv("outcome:", r.outcome));
+    out.push(fmtKv("documentId:", r.documentId));
+    out.push(fmtKv("canonicalPath:", r.canonicalPath));
+    out.push(fmtKv("priorRevisionId:", r.priorRevisionId || "(none)"));
+    out.push(fmtKv("revisions total:", r.revisionsTotal));
+    out.push(fmtKv("revisions redacted:", r.revisionsRedacted));
+    out.push(fmtKv("already redacted:", r.revisionsAlreadyRedacted));
+    out.push(fmtKv("tombstoneState:", r.tombstoneState));
+    out.push(fmtKv("reason:", r.reason));
+    out.push("");
+    if (r.outcome === "already_purged") {
+        out.push(`  note: every revision was already redacted and the document was`);
+        out.push(`        already tombstoned; nothing to do.`);
+    }
+    else {
+        out.push(`  note: all revisions redacted (content gone, audit metadata kept).`);
+        out.push(`        slice A has no physical-purge primitive, so the document is`);
+        out.push(`        TOMBSTONED rather than PURGED.`);
+    }
+    out.push(`  next: mla kb show kbdoc:${r.documentId}   (verify tombstoneState)`);
+    out.push(`╰──────────────────────────────────────────────────────────────────────╯`);
+    return out.join("\n");
+}
+// `mla kb move` is a BLOCKED capability in slice A (governed identity is the
+// source tuple; re-pathing yields a different document and there is no redirect
+// primitive yet), so it emits no receipt. The legacy KbMoveReceipt /
+// renderKbMoveReceipt were removed: they modeled now-dead concepts (parentUuid,
+// path_aliases, the KB_MOVED outbox event). When move is unblocked under a real
+// redirect primitive, a fresh receipt should be defined against that model.

package/dist/lib/rules/applicability.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseApplicability = parseApplicability;
+// R0 applicability parser. Turns a raw, untrusted descriptor into an explicit
+// OK / DISABLED / INVALID result. The cardinal rule: NEVER infer a mode from
+// absence. A missing, malformed, or unknown mode is a diagnostic, not a silent
+// fall-through to "ambient".
+function invalid(diagnostic) {
+    return { status: "INVALID", diagnostic };
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseMatcher(raw) {
+    if (!isPlainObject(raw)) {
+        return { error: "action applicability requires a matcher object" };
+    }
+    if (typeof raw.field !== "string" || raw.field.length === 0) {
+        return { error: "action matcher requires a non-empty string field" };
+    }
+    const matcher = { field: raw.field };
+    if (raw.glob !== undefined) {
+        if (typeof raw.glob !== "string" || raw.glob.length === 0) {
+            return { error: "action matcher glob must be a non-empty string when present" };
+        }
+        matcher.glob = raw.glob;
+    }
+    return matcher;
+}
+function parseApplicability(raw) {
+    if (!isPlainObject(raw)) {
+        return invalid("applicability must be an object with an explicit mode");
+    }
+    if (typeof raw.mode !== "string") {
+        return invalid("applicability.mode is missing; ambient is never inferred from absence");
+    }
+    switch (raw.mode) {
+        case "ambient":
+            return { status: "OK", applicability: { mode: "ambient" } };
+        case "action": {
+            if (!Array.isArray(raw.tools) || raw.tools.length === 0) {
+                return invalid("action applicability requires a non-empty tools array");
+            }
+            if (!raw.tools.every((t) => typeof t === "string" && t.length > 0)) {
+                return invalid("action applicability tools must all be non-empty strings");
+            }
+            const matcher = parseMatcher(raw.matcher);
+            if ("error" in matcher) {
+                return invalid(matcher.error);
+            }
+            return {
+                status: "OK",
+                applicability: { mode: "action", tools: raw.tools, matcher },
+            };
+        }
+        case "turn":
+            return {
+                status: "DISABLED",
+                diagnostic: "turn applicability is reserved and inert in R0/R1; rule not evaluated",
+            };
+        default:
+            return invalid(`unknown applicability mode: ${raw.mode}`);
+    }
+}