@rowan-hiro/inkan 0.1.0 → 0.2.1

package/README.md

@@ -4,18 +4,14 @@
 
 **Agents make promises. Inkan keeps the receipts.**
 
-*Seal what the work is meant to deliver. Then check that what landed is what was sealed.*
+*Seal what the work is meant to deliver. Record what was declared when it closed.*
 
 Inkan is a small, zero-dependency CLI for repositories where coding agents
 do real work. It keeps a trustworthy record of what each piece of work was
 meant to deliver, how that intent changed along the way, and what was
-declared when it closed. It then binds each landing commit to that record,
-so anyone, human or agent, can ask later whether the commit is faithful to
-the promise.
-
-It is also a working prototype of a larger idea: one record that follows an
-agent's work through its whole lifecycle, from fixed intent to audited
-commit, and is never rewritten along the way.
+declared when it closed. The record lives in the repository and travels
+with the code, so a fresh session or a different agent can pick up the work
+without relying on another assistant's memory.
 
 ## The problem
 
@@ -31,20 +27,22 @@ every time it re-reads history, and the loop never ends. Inkan takes the
 other route. It records what was declared and when, treats the record as
 fact, and leaves judging the result to the repository's own tests.
 
-## Three questions
-
-Inkan answers exactly three questions about a piece of work, and it refuses
-to grow beyond them.
+## What the record holds
 
 | Question | How Inkan answers it |
 |---|---|
-| Is the stored outcome still what was sealed? | One append-only file per outcome. A contract hash over the sealed text, its criteria, and every amendment. `inkan status` prints the seal verbatim with its hash. |
-| Is what got committed the sealed outcome? | Closing records the hash of the working tree. The landing commit carries an `Inkan-Outcome: <id>` trailer. `inkan check <commit>` compares trailer, recorded hash, and recorded tree against the commit itself. |
-| Was the outcome swapped mid-way without authorization? | The headline never changes. Criteria change only through `inkan amend --reason`. Closing requires a disposition for every live criterion. An outcome that was never closed stays visibly open; nothing closes it on anyone's behalf. |
+| What was the work meant to deliver? | `begin` seals the outcome text and its acceptance criteria in an append-only file. `status` prints open outcomes verbatim. |
+| How did the intent change? | The headline stays. `amend --reason` appends the reason, additions, and any added or withdrawn criteria. |
+| What was declared at close? | `end` records a disposition for every live criterion and a note. An outcome without an end event stays open. |
+
+These are declarations. Inkan does not compare them with commits or decide
+whether the work fulfilled the criteria. Closing creates no later audit
+step and no obligation to prove the same work again.
 
 ## Quick start
 
-Requires Node.js 22 or newer and git.
+Requires Node.js 22 or newer. Commit the records with your usual Git workflow;
+Inkan itself does not invoke Git.
 
 ```sh
 npm install --global @rowan-hiro/inkan
@@ -97,53 +95,44 @@ inkan end --met 1 --met 2 --unmet 3 --note "Rate limiting deferred to the next s
 Inkan-Outcome: 2026-09-03-0621-82qz
 ```
 
-Status is derived, not chosen: every criterion met is `completed`, any
-unmet is `partial`. A truthful `partial` is a first-class result, and it is
-what an agent reports instead of stretching the definition of done.
-
-**5. Land it with the trailer.**
-
-```sh
-git commit -m "$(printf 'feat: account recovery\n\nInkan-Outcome: 2026-09-03-0621-82qz\n')"
-```
+Status is derived from the dispositions: every criterion declared met is
+`completed`, any declared unmet is `partial`. A truthful `partial` is a
+first-class result, and it is what an agent reports instead of stretching
+the definition of done.
 
-The trailer goes in the last paragraph of the message, next to any other
-trailers such as `Co-Authored-By`, with no blank line between them. Git
-reads trailers only from that final paragraph; a trailer set apart by a
-blank line is silently not a trailer.
+**5. Commit the work and its record together.**
 
-**6. Ask, any time later, whether the commit kept its promise.**
+Stage the files for this outcome, including its `.inkan/` records. Include
+the trailer printed by `end` in the landing commit:
 
 ```sh
-inkan check HEAD
+git commit -m "feat: account recovery" \
+  -m "Inkan-Outcome: 2026-09-03-0621-82qz"
 ```
 
-```
-b751a39  Inkan-Outcome: 2026-09-03-0621-82qz
-  outcome: present, closed (partial)
-  hash: matches refold
-  tree: matches commit tree
-consistent
-```
+The trailer goes in the final paragraph of the commit message, beside any
+other trailers without a blank line between them. The agent protocol
+requires it when submitting the work; Inkan installs no hook or executable
+gate to enforce that writing rule.
 
-## What a swap looks like
+The outcome is closed. There is no delivery audit to run afterwards.
 
-Suppose the code is changed after the outcome closed and committed under
-the same trailer. The recorded tree no longer matches the commit:
+## Commit references when reading history
 
-```
-c7f3a54  Inkan-Outcome: 2026-09-03-0621-82qz
-  outcome: present, closed (partial)
-  hash: matches refold
-  tree: differs from commit tree
-mismatch
-a mismatch is a fact about this commit; it is recorded, not repaired
-```
+`Inkan-Outcome: <id>` associates a commit with an outcome. It supplies
+context: what the work was meant to deliver, how it changed, and what was
+declared at close. It certifies neither completion nor acceptance criteria
+nor the contents of the commit.
 
-Exit codes are 0 for consistent, 1 for mismatch, and 2 when the commit
-carries no `Inkan-Outcome` trailer at all. Nothing is repaired and nothing
-is blocked. `check` is a report about the past, which is exactly why it can
-run in a review or a CI job without turning into a gate.
+Follow the reference when useful. For historical context, prefer the file
+`.inkan/outcomes/<id>.jsonl` stored in that commit, readable with ordinary
+Git. `inkan log <id>` reads the record in the current checkout. These reads
+supply context without comparing the record with the commit.
+
+Missing trailers or unavailable referenced records are missing information.
+Reading history does not require validating delivery, backfilling trailers,
+repairing old commits, or reopening closed outcomes. The writing requirement
+applies when making new commits; it creates no retroactive duty for readers.
 
 ## After context loss
 
@@ -184,11 +173,11 @@ a re-read of the history:
 These are the product, not its limitations.
 
 - **It never runs anything.** No tests, no builds, no shell commands. The
-  only child process Inkan ever spawns is git, with a fixed argument list.
-  Whether the work is correct is the repository's job.
+  tool spawns no child processes, including Git. Whether the work is
+  correct is the repository's job.
 - **It never gates.** Nothing in Inkan runs before or during `git commit`,
-  and `init` installs no hooks. `check` and `doctor` report on commits and
-  files that already exist.
+  and `init` installs no hooks. There is no commit comparison or delivery
+  audit. `doctor` is an optional file diagnostic, never a workflow step.
 - **Closed is final.** There is no stale state, no invalidation, and no
   notion that a closed outcome needs to be redone. Reviewing the log is
   reading, not re-checking. If a past declaration now looks wrong, that is a
@@ -210,10 +199,13 @@ These are the product, not its limitations.
 
 `inkan init` writes a generated protocol block into `AGENTS.md`, the file
 coding agents already read. Five rules: seal before durable changes; the
-seal is a fact; close with dispositions, then commit with the trailer in the
-last paragraph of the message; re-anchor with `inkan status` after context
-loss and leave other sessions' outcomes alone; closed outcomes are final.
-The block carries a protocol number. `init`
+seal is a fact; close with dispositions, then commit the record with the
+work and include the outcome trailer; re-anchor with `inkan status` after
+context loss and leave other sessions' outcomes alone; closed outcomes are
+final and commit references are informational when reading history.
+The block states policy only. It names the commands and what each call
+must carry, and leaves flag-level syntax to `inkan help`, so a CLI change
+does not bump the protocol. The block carries a protocol number. `init`
 upgrades a block it generated under an earlier protocol in place and refuses
 to overwrite a block that was edited by hand, so the policy lives in exactly
 one place. `--lang <tag>` sets the language agents should write outcome
@@ -249,29 +241,30 @@ Inkan's own design is recorded this way, from the boundary in `0001`
 onward. There is no separate design document; `inkan decision list` prints
 the index.
 
-## A prototype for the whole lifecycle
+## One record through the work
 
-Inkan is also a working prototype of something larger: managing an agent's
-work across its whole lifecycle, from the moment intent is fixed to the
-moment a commit is audited, with one record that every stage writes to and
-no stage rewrites.
+Each stage adds to the record without rewriting an earlier declaration.
 
 | Stage | What is recorded | Command |
 |---|---|---|
 | Intent | What will be delivered and how it will be judged | `begin` |
 | Change | How the intent moved, and why | `amend --reason` |
 | Constraint | The decisions the work is bound by | `decision add`, `--decision` |
-| Close | A disposition per criterion and a derived, truthful status | `end` |
-| Delivery | The commit that landed the work, bound to the seal | `Inkan-Outcome` trailer |
-| Audit | Whether the commit and the record still agree | `check`, `doctor` |
+| Close | A disposition per criterion and the status derived from those declarations | `end` |
+| Commit reference | The outcome associated with a landing commit, for context | `Inkan-Outcome` trailer |
 | Resume | Where a fresh session picks up | `status`, `log` |
 
-Inkan is built this way itself. Every commit in its repository after the
-first carries an `Inkan-Outcome` trailer, each milestone was sealed and
-closed as an outcome, and its design decisions live in `.inkan/decisions/`.
-The record is deliberately small. What the prototype tests is whether a
-lifecycle can be managed by a log of facts alone, with no runner and no
-gate in the loop.
+Inkan is built this way itself. Its work is sealed and closed as outcomes,
+and its design decisions live in `.inkan/decisions/`. The repository holds
+the durable context for every agent that works on it.
+
+## Optional file diagnostics
+
+`inkan doctor` reports corrupt record files, mismatched or duplicate ids,
+and missing decision references. Run it when you want to diagnose those
+files. It does not judge the work, inspect commits, or repair anything.
+It is not required to close an outcome, commit, or resume a session, and it
+is not part of the generated agent protocol.
 
 ## Command reference
 
@@ -280,11 +273,10 @@ gate in the loop.
 | `inkan init [--lang <tag>] [--claude]` | Writes or upgrades the managed block in `AGENTS.md`; creates `.inkan/`. `--claude` also links `CLAUDE.md` to `AGENTS.md`. | The block was hand-edited. A `CLAUDE.md` exists that is not that symlink. |
 | `inkan begin "<outcome>" [--accept <text>]... [--decision <id>]... [--lane <tag>]` | Seals a new outcome; prints its id. Any other open outcome is named in a notice on stderr and left untouched. | Never. |
 | `inkan amend --reason <text> [<addition>] [--accept <text>]... [--withdraw <n>]... [--decision <id>]... [<id>]` | Appends an amendment; prints the new contract hash. | No reason. No open outcome. Ambiguous open outcome without `<id>`. |
-| `inkan end [<id>] [--met <n>]... [--unmet <n>]... [-s abandoned] --note <text>` | Records dispositions and closes. Status is derived: all met is `completed`, any unmet is `partial`. Prints the commit trailer line. | A live criterion has no disposition, unless closing with `-s abandoned`. No note. |
+| `inkan end [<id>] [--met <n>]... [--unmet <n>]... [-s abandoned] --note <text>` | Records dispositions and closes. Status is derived: all met is `completed`, any unmet is `partial`. Prints the outcome id, status, and commit reference trailer. | A live criterion has no disposition, unless closing with `-s abandoned`. No note. |
 | `inkan status` | Prints every open outcome verbatim: sealed time, hash, lane, criteria with indexes, amendments with reasons, linked decisions. | Never. |
-| `inkan log [-n N] [--since <date>] [--grep <regex>] [--status <s>] [--decision <id>] [--lane <tag>] [<id>]` | One line per outcome, newest first, default 20. `<id>` prints one outcome in full, including dispositions, note, and recorded tree. Filters combine. | Never. |
-| `inkan check [<commit>]` | Read-only. Reads `Inkan-Outcome` trailers, loads each named outcome from the commit's own tree, refolds it, and reports trailer, closure, hash, and tree. Exit 0 consistent, 1 mismatch, 2 no trailer. | Never blocks anything. |
-| `inkan doctor` | Read-only. Folds every outcome and parses every decision; reports corrupt files, id mismatches, duplicate decision ids, and dangling decision links. Exit 0 clean, 1 problems. | Never. |
+| `inkan log [-n N] [--since <date>] [--grep <regex>] [--status <s>] [--decision <id>] [--lane <tag>] [<id>]` | One line per outcome, newest first, default 20. `<id>` prints one outcome in full, including dispositions and note. Filters combine. | Never. |
+| `inkan doctor` | Optional, read-only diagnostic. Folds every outcome and parses every decision; reports corrupt files, id mismatches, duplicate decision ids, and dangling decision links. Exit 0 clean, 1 problems. | Never. |
 | `inkan decision add "<title>" --context <text> --decision <text> [--driver <text>]... [--option <text>]... [--consequence <text>]... [-s <status>]` | Writes a numbered MADR file; prints its path. | Missing required sections. |
 | `inkan decision update <id> --status <status> --reason <text>` | Appends a dated history entry and sets the new status. Names the open outcome when there is one. Never edits Context or Decision Outcome. | Unknown id or status. |
 | `inkan decision list [-s <status>]` / `inkan decision show <id>` | Read-only. `show` accepts `2`, `02`, or `0002`. | Never. |
@@ -309,10 +301,10 @@ outcome is simply a file with no `end` yet.
 
 The contract hash is a SHA-256 over the outcome text, its criteria with
 their withdrawn flags, the linked decisions, and every amendment's reason
-and addition. `end` records it, together with the git tree hash of the
-working tree with `.inkan/outcomes` excluded, so the log never perturbs the
-hash of the work it describes. `check` refolds the outcome as stored in the
-commit and compares both.
+and addition. `end` stores that contract hash with the dispositions and
+note. Readers enforce the event format and reject corrupt records; they
+do not inspect project files or compare the record with a commit. Existing
+v1 records that contain Git metadata remain readable without being rewritten.
 
 Because each outcome is its own file, two branches never touch the same
 file and an ordinary merge brings them together. It also keeps review cheap
@@ -322,8 +314,10 @@ benchmark (`npm run bench`) seeds ten thousand closed outcomes and holds
 
 ## Status
 
-Inkan 0.1.0 is the first release, rebuilt from scratch as the successor to
-DriftSeal. Deliberately not in this release: an importer for DriftSeal
+Inkan began with 0.1.0, rebuilt from scratch as the successor to DriftSeal.
+Current development removes delivery auditing from that first release
+(decision 0015) while retaining outcome trailers as commit references
+(decision 0016). Still deferred: an importer for DriftSeal
 history and an MCP server. Those are adapters and can follow without
 changing the record format. The only host-specific convenience is
 `--claude` on `init` and `skill install`; every other host reads

package/README.zh.md

@@ -4,11 +4,9 @@
 
 **Agent 许下承诺，Inkan 留下凭据。**
 
-*先把工作真正要交付的结果 seal 下来，再核对最终落地的内容有没有兑现承诺。*
+*先把工作要交付的结果 seal 下来，在结束时如实记录完成情况。*
 
-Inkan 是一款小巧、零依赖的 CLI，专为让 coding agent 真正参与开发的代码仓库而生。它会可靠地记录每项工作原本要交付什么、意图在过程中如何变化，以及工作结束时作出了怎样的声明；再把最终落地的每个 commit 与这份记录绑定。于是，无论人还是 agent，日后都能清楚回答：这个 commit，真的兑现了当初的承诺吗？
-
-它同时也是一个更宏大构想的可运行原型：用一份贯穿 agent 工作全生命周期的记录，从意图确定一路走到 commit 审计，并且全程只追加、不改写。
+Inkan 是一款小巧、零依赖的 CLI，面向使用 coding agent 开发的代码仓库。它记录每项工作原本要交付什么、意图在过程中如何变化，以及结束时作出了怎样的声明。记录保存在仓库里，随代码一起提交；换一个 session 或 agent，也能从这里接手工作。
 
 ## 问题所在
 
@@ -16,19 +14,19 @@ Inkan 是一款小巧、零依赖的 CLI，专为让 coding agent 真正参与
 
 常见的解决办法是不断增加检查：更多测试、更多 gate，每次查看日志都重新验证一遍。这会让 agent 每次重读历史时，都再次检查自己过去的工作，最终陷入没有尽头的循环。Inkan 选择了另一条路：如实记录当时声明了什么、声明发生在何时，把记录本身视为事实，并把结果是否正确的判断交还给仓库自己的测试体系。
 
-## 三个问题
-
-对于一项工作，Inkan 只回答三个问题，并且刻意不越界。
+## 记录里有什么
 
 | 问题 | Inkan 如何回答 |
 |---|---|
-| 保存下来的 outcome 还是当初 seal 的那一个吗？ | 每个 outcome 都有自己的 append-only 文件。系统会根据 seal 的文本、验收标准和历次 amendment 计算 contract hash。`inkan status` 会逐字打印 seal 及其 hash。 |
-| commit 中落地的内容就是 seal 的 outcome 吗？ | 关闭 outcome 时会记录 working tree 的 hash。落地 commit 带有 `Inkan-Outcome: <id>` trailer。`inkan check <commit>` 会把 trailer、记录的 hash 和记录的 tree 与 commit 本身逐一比对。 |
-| outcome 是否在中途被擅自调换？ | 标题永远不变。验收标准只能通过 `inkan amend --reason` 修改。关闭时，每一条仍生效的标准都必须给出 disposition。从未关闭的 outcome 会一直明确显示为 open；Inkan 不会替任何人关闭它。 |
+| 工作原本要交付什么？ | `begin` 把 outcome 文本和验收标准 seal 到一个 append-only 文件中。`status` 逐字打印 open outcome。 |
+| 意图发生过什么变化？ | 标题保留。`amend --reason` 追加原因、补充说明，以及新增或撤回的标准。 |
+| 结束时声明了什么？ | `end` 记录每条仍生效标准的 disposition 和结束说明。没有 end event 的 outcome 保持 open。 |
+
+这些都是工作声明。Inkan 不把它们与 commit 比较，也不判断工作是否满足了标准。关闭之后，没有额外的交付审计步骤，也没有再次证明同一项工作的义务。
 
 ## 快速开始
 
-需要 Node.js 22 或更高版本，以及 git。
+需要 Node.js 22 或更高版本。按仓库平时的 Git 流程提交记录即可；Inkan 本身不调用 Git。
 
 ```sh
 npm install --global @rowan-hiro/inkan
@@ -77,44 +75,28 @@ inkan end --met 1 --met 2 --unmet 3 --note "Rate limiting deferred to the next s
 Inkan-Outcome: 2026-09-03-0621-82qz
 ```
 
-状态由事实推导，而不是人为选择：所有标准均达成时为 `completed`，只要有一项未达成就是 `partial`。如实记录的 `partial` 是一种完整、正式的结果；agent 应当报告它，而不是为了声称“完成”而拉伸 done 的定义。
-
-**5. 带上 trailer，让工作落地。**
-
-```sh
-git commit -m "$(printf 'feat: account recovery\n\nInkan-Outcome: 2026-09-03-0621-82qz\n')"
-```
+状态根据 disposition 推导：所有标准都声明为 met 时是 `completed`，只要有一项声明为 unmet 就是 `partial`。如实记录的 `partial` 是一种完整、正式的结果；agent 应当报告它，而不是为了声称“完成”而拉伸 done 的定义。
 
-trailer 必须放在 commit message 的最后一个段落，并与 `Co-Authored-By` 等其他 trailer 相邻，中间不能有空行。Git 只会把最后一个段落中的内容识别为 trailer；用空行单独隔开的 trailer，不会报错，却也不会被识别。
+**5. 把工作和记录一起提交。**
 
-**6. 日后随时检查：这个 commit 是否兑现了承诺？**
+把本项工作涉及的文件加入暂存区，包括 `.inkan/` 中的记录。落地 commit 要带上 `end` 打印的 trailer：
 
 ```sh
-inkan check HEAD
+git commit -m "feat: account recovery" \
+  -m "Inkan-Outcome: 2026-09-03-0621-82qz"
 ```
 
-```
-b751a39  Inkan-Outcome: 2026-09-03-0621-82qz
-  outcome: present, closed (partial)
-  hash: matches refold
-  tree: matches commit tree
-consistent
-```
+trailer 放在 commit message 的最后一段，与其他 trailer 相邻，中间不留空行。agent protocol 要求提交时写上这条关联信息；Inkan 不安装 hook，也不通过程序阻塞提交来执行这项规则。
 
-## 偷换 outcome 会是什么样
+outcome 已经关闭，后面没有需要执行的交付审计。
 
-假设 outcome 关闭后，代码又被修改，却仍使用同一个 trailer 提交。此时，记录中的 tree 将不再匹配这个 commit：
+## 阅读历史时使用关联信息
 
-```
-c7f3a54  Inkan-Outcome: 2026-09-03-0621-82qz
-  outcome: present, closed (partial)
-  hash: matches refold
-  tree: differs from commit tree
-mismatch
-a mismatch is a fact about this commit; it is recorded, not repaired
-```
+`Inkan-Outcome: <id>` 把 commit 与 outcome 联系起来，方便了解工作原本要交付什么、过程中如何调整，以及结束时声明了什么。它不证明工作已完成、验收条件已满足，也不证明 commit 的内容。
 
-一致时退出码为 0，不匹配时为 1；如果 commit 完全没有 `Inkan-Outcome` trailer，则为 2。Inkan 不会修复任何内容，也不会阻塞任何操作。`check` 只是对过去作出报告——也正因为如此，它可以安心地运行在 code review 或 CI job 中，而不会摇身变成一道 gate。
+需要这些上下文时再沿着引用读取。了解历史时，优先通过普通 Git 命令读取该 commit 中的 `.inkan/outcomes/<id>.jsonl`；`inkan log <id>` 读取的是当前 checkout 中的记录。这种读取只提供上下文，不作一致性判断。
+
+缺少 trailer 或找不到关联记录，只表示信息缺失。阅读历史不要求验证交付、补填 trailer、修复旧 commit 或重新打开已关闭的 outcome。提交规则用于写入新的 commit，不给阅读者增加追溯修补的义务。
 
 ## Context 丢失之后
 
@@ -148,8 +130,8 @@ inkan log -n 3
 
 这些不是功能缺失，而是产品本身的边界。
 
-- **它绝不运行任何任务。** 不运行测试、build 或 shell command。Inkan 唯一会启动的 child process 是 git，而且参数列表固定。工作是否正确，应由仓库自己判断。
-- **它绝不充当 gate。** `git commit` 之前或期间不会运行任何 Inkan 操作，`init` 也不会安装 hook。`check` 和 `doctor` 只报告已经存在的 commit 和文件。
+- **它绝不运行任何任务。** 不运行测试、build 或 shell command。Inkan 不启动任何 child process，包括 Git。工作是否正确，应由仓库自己判断。
+- **它绝不充当 gate。** `git commit` 之前或期间不会运行任何 Inkan 操作，`init` 也不会安装 hook。没有 commit 比较或交付审计。`doctor` 是可选的文件诊断工具，不是工作流程中的必经步骤。
 - **关闭即最终状态。** 没有 stale state，没有 invalidation，也不存在已经关闭的 outcome 还需要重做的概念。查看日志就是阅读，而不是重新检查。如果过去的声明如今看来有误，那应当成为一项拥有独立 seal 的新 outcome。
 - **它绝不代替别人关闭 outcome。** 多个 outcome 可以同时 open，每个 session 或 branch 各自拥有一个。`begin` 会指出其他 outcome 的存在，但不会碰它们。从未关闭的 outcome，就是“它确实没有关闭”的诚实记录；为何一直 open，应由人来调查，而不是由 agent 擅自判断。仅仅为了关闭而关闭，只会让日志充斥无意义的记录。
 - **它绝不改写当时的场景。** 情况变化时，agent 可以通过 amendment 或新的 decision record 对既有决定提出挑战，但绝不会修改那段记录了当时所知信息与所作决定的文本。
@@ -157,7 +139,7 @@ inkan log -n 3
 
 ## 为 agent 而生
 
-`inkan init` 会把生成好的 protocol block 写进 coding agent 本来就会读取的 `AGENTS.md`。其中只有五条规则：在 durable change 之前 seal；seal 是事实；先逐项 disposition 并关闭，再把 trailer 放在 commit message 的最后一段完成提交；context 丢失后用 `inkan status` 重新锚定，同时不碰其他 session 的 outcome；关闭即最终状态。
+`inkan init` 会把生成好的 protocol block 写进 coding agent 本来就会读取的 `AGENTS.md`。其中只有五条规则：在 durable change 之前 seal；seal 是事实；先逐项 disposition 并关闭，再把记录与工作一起提交，并写入 outcome trailer；context 丢失后用 `inkan status` 重新锚定，同时不碰其他 session 的 outcome；关闭即最终状态，阅读历史时仅把 commit 引用作为辅助信息。
 
 protocol block 带有版本号。`init` 会原地升级由旧版 protocol 生成的 block，但拒绝覆盖经过手工编辑的 block，确保 policy 始终只有一个权威来源。`--lang <tag>` 用来设置 agent 撰写 outcome 文本时应使用的语言。`inkan init --claude` 还会把 `CLAUDE.md` 创建为指向 `AGENTS.md` 的 symlink：Claude Code 读的是自己认识的文件名，而 policy 依然只有一份，不是副本。
 
@@ -179,23 +161,26 @@ outcome 可以在 `begin` 或 `amend` 时通过 `--decision <id>` 指明自己
 
 Inkan 自己的设计也用同样的方式记录，从 `0001` 中划定的边界一路延续至今。仓库没有单独的设计文档；`inkan decision list` 就是它的索引。
 
-## 面向完整生命周期的原型
+## 工作共用一份记录
 
-Inkan 还是一个更大构想的可运行原型：管理 agent 工作的完整生命周期，从意图确定的那一刻，到 commit 接受审计的那一刻。整个过程中，每个阶段都向同一份记录写入事实，没有任何阶段会改写过去。
+每个阶段都向记录追加内容，不改写此前的声明。
 
 | 阶段 | 记录什么 | 命令 |
 |---|---|---|
 | 意图 | 要交付什么，以及如何判断是否达成 | `begin` |
 | 变更 | 意图如何变化，以及为什么变化 | `amend --reason` |
 | 约束 | 当前工作受哪些 decision 约束 | `decision add`、`--decision` |
-| 关闭 | 每条标准的 disposition，以及由此推导出的诚实状态 | `end` |
-| 交付 | 真正落地的 commit，并与 seal 绑定 | `Inkan-Outcome` trailer |
-| 审计 | commit 与记录是否仍然一致 | `check`、`doctor` |
+| 关闭 | 每条标准的 disposition，以及由这些声明推导出的状态 | `end` |
+| 提交关联 | commit 关联的 outcome，供阅读时了解上下文 | `Inkan-Outcome` trailer |
 | 恢复 | 新 session 从哪里接手 | `status`、`log` |
 
-Inkan 本身就是这样构建的。仓库从第二个 commit 开始，每个 commit 都带有 `Inkan-Outcome` trailer；每个 milestone 都先作为 outcome 被 seal，随后关闭；所有设计决定都保存在 `.inkan/decisions/` 中。
+Inkan 本身也这样开发：工作先作为 outcome 被 seal，结束时记录声明；设计决定保存在 `.inkan/decisions/` 中。仓库保存长期上下文，供参与工作的每个 agent 使用。
+
+## 可选的文件诊断
+
+`inkan doctor` 报告记录文件损坏、id 不匹配或重复，以及缺失的 decision 引用。需要排查这些文件时可以主动运行；它不判断工作结果、不读取 commit，也不修复内容。
 
-这份记录被刻意设计得很小。这个原型真正要验证的是：不在流程里加入 runner，也不设置 gate，仅凭一份只记录事实的日志，能否管理完整的生命周期。
+关闭 outcome、提交代码和恢复 session 都不要求运行 `doctor`，生成的 agent protocol 也不包含这一步。
 
 ## 命令参考
 
@@ -204,11 +189,10 @@ Inkan 本身就是这样构建的。仓库从第二个 commit 开始，每个 co
 | `inkan init [--lang <tag>] [--claude]` | 写入或升级 `AGENTS.md` 中由 Inkan 管理的 block；创建 `.inkan/`。`--claude` 还会把 `CLAUDE.md` 软链到 `AGENTS.md`。 | block 曾被手工编辑；已存在一个不是该 symlink 的 `CLAUDE.md`。 |
 | `inkan begin "<outcome>" [--accept <text>]... [--decision <id>]... [--lane <tag>]` | Seal 一个新 outcome，并打印其 id。其他 open outcome 会在 stderr 的 notice 中被点名，但不会受到任何改动。 | 永不拒绝。 |
 | `inkan amend --reason <text> [<addition>] [--accept <text>]... [--withdraw <n>]... [--decision <id>]... [<id>]` | 追加 amendment，并打印新的 contract hash。 | 没有 reason；没有 open outcome；存在多个 open outcome，却没有用 `<id>` 明确指定目标。 |
-| `inkan end [<id>] [--met <n>]... [--unmet <n>]... [-s abandoned] --note <text>` | 记录 disposition 并关闭 outcome。状态由结果推导：全部 met 为 `completed`，任一 unmet 为 `partial`。打印 commit trailer 行。 | 仍生效的标准缺少 disposition（以 `-s abandoned` 关闭时除外）；没有 note。 |
+| `inkan end [<id>] [--met <n>]... [--unmet <n>]... [-s abandoned] --note <text>` | 记录 disposition 并关闭 outcome。状态由结果推导：全部 met 为 `completed`，任一 unmet 为 `partial`。打印 outcome id、状态和供 commit 使用的关联 trailer。 | 仍生效的标准缺少 disposition（以 `-s abandoned` 关闭时除外）；没有 note。 |
 | `inkan status` | 逐字打印所有 open outcome：seal 时间、hash、lane、带编号的标准、附 reason 的 amendment，以及关联的 decision。 | 永不拒绝。 |
-| `inkan log [-n N] [--since <date>] [--grep <regex>] [--status <s>] [--decision <id>] [--lane <tag>] [<id>]` | 每个 outcome 打印一行，最新的在前，默认 20 条。`<id>` 会完整打印一项 outcome，包括 disposition、note 和记录的 tree。filter 可以组合。 | 永不拒绝。 |
-| `inkan check [<commit>]` | 只读。从 commit 自身的 tree 中读取 `Inkan-Outcome` trailer 和对应 outcome，重新 fold 后报告 trailer、关闭状态、hash 与 tree。退出码：一致为 0，不匹配为 1，没有 trailer 为 2。 | 不会阻塞任何操作。 |
-| `inkan doctor` | 只读。Fold 所有 outcome 并解析所有 decision；报告损坏文件、id 不匹配、重复的 decision id，以及失效的 decision link。退出码：正常为 0，发现问题为 1。 | 永不拒绝。 |
+| `inkan log [-n N] [--since <date>] [--grep <regex>] [--status <s>] [--decision <id>] [--lane <tag>] [<id>]` | 每个 outcome 打印一行，最新的在前，默认 20 条。`<id>` 会完整打印一项 outcome，包括 disposition 和 note。filter 可以组合。 | 永不拒绝。 |
+| `inkan doctor` | 可选的只读文件诊断。Fold 所有 outcome 并解析所有 decision；报告损坏文件、id 不匹配、重复的 decision id，以及失效的 decision link。退出码：正常为 0，发现问题为 1。 | 永不拒绝。 |
 | `inkan decision add "<title>" --context <text> --decision <text> [--driver <text>]... [--option <text>]... [--consequence <text>]... [-s <status>]` | 写入一个带编号的 MADR 文件，并打印其路径。 | 缺少必要 section。 |
 | `inkan decision update <id> --status <status> --reason <text>` | 追加一条带日期的历史记录，并设置新状态。有 open outcome 时会指出它的名称。永不编辑 Context 或 Decision Outcome。 | id 或 status 未知。 |
 | `inkan decision list [-s <status>]` / `inkan decision show <id>` | 只读。`show` 接受 `2`、`02` 或 `0002`。 | 永不拒绝。 |
@@ -226,13 +210,13 @@ Decision status 包括 `proposed`、`accepted`、`rejected`、`deferred`、`depr
 
 `2026-09-03-1432-k7m2` 这样的 outcome id，由 outcome 开始时的 UTC 日期与分钟，加上四个随机字符组成。因此 id 可以按时间排序，两个 branch 也几乎不可能发生冲突。每个 outcome 文件包含一个 `begin` event、任意数量的 `amend` event，以及最多一个 `end` event。所谓 open outcome，就是一个尚无 `end` 的文件。
 
-contract hash 是一个 SHA-256，计算范围包括 outcome 文本、带 withdrawn 标记的验收标准、关联的 decision，以及每次 amendment 的 reason 和 addition。`end` 会记录这个 hash，同时记录 working tree 的 git tree hash；计算时会排除 `.inkan/outcomes`，因此日志本身不会扰动它所描述的工作 hash。`check` 会重新 fold commit 中保存的 outcome，并同时比较两者。
+contract hash 是一个 SHA-256，计算范围包括 outcome 文本、带 withdrawn 标记的验收标准、关联的 decision，以及每次 amendment 的 reason 和 addition。`end` 把这个 hash 与 disposition 和 note 一起保存。读取时仍会检查 event 格式并拒绝损坏的记录，但不会读取项目文件或与 commit 比较。旧 v1 记录中的 Git 信息可以继续读取，不会被改写。
 
 由于每个 outcome 都有独立文件，两个 branch 永远不会改动同一个 outcome 文件，普通 merge 就能把记录自然汇合。这种设计不需要 cache，也能让 review 保持轻快：不带 filter 的 `log` 只读取实际要打印的文件数；内置 benchmark（`npm run bench`）会生成一万个已关闭的 outcome，并将 `log -n 3` 控制在 50 ms 以内、`log --grep` 控制在 1 秒以内、`doctor` 控制在 2 秒以内。
 
 ## 当前状态
 
-Inkan 0.1.0 是首个正式版本，也是 DriftSeal 继任者的一次从零重构。本版本有意没有加入 DriftSeal 历史记录 importer 和 MCP server。这些都属于 adapter，可以后续补上，而无需改变记录格式。唯一针对特定 host 的便利是 `init` 和 `skill install` 的 `--claude`；其他 host 直接读取 `AGENTS.md` 和 `.agents/skills`，无需任何适配。Lane 目前只作为 `begin` 时可选的归档 tag，以及 `log` 的 filter。
+Inkan 从 0.1.0 起作为 DriftSeal 的继任者，从零重新构建。当前开发版本移除了首发版本中的交付审计（decision 0015），同时保留 outcome trailer 作为 commit 的关联信息（decision 0016）。目前仍未加入 DriftSeal 历史记录 importer 和 MCP server。这些都属于 adapter，可以后续补上，而无需改变记录格式。唯一针对特定 host 的便利是 `init` 和 `skill install` 的 `--claude`；其他 host 直接读取 `AGENTS.md` 和 `.agents/skills`，无需任何适配。Lane 目前只作为 `begin` 时可选的归档 tag，以及 `log` 的 filter。
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rowan-hiro/inkan",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Seal the authoritative outcome; keep a trustworthy record of the process.",
   "type": "module",
   "bin": {

package/src/api.js

@@ -8,7 +8,6 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as store from './store.js';
 import { fold, computeContractHash } from './fold.js';
-import * as git from './git.js';
 import * as decisions from './decisions.js';
 
 export class InkanError extends Error {
@@ -116,7 +115,6 @@ export function begin({ root, outcome, accept = [], decision = [], lane }) {
   // Other open outcomes belong to whoever began them. They are reported,
   // never closed or otherwise touched here (decision 0013).
   const openAlongside = openRecords(resolvedRoot).map((r) => ({ id: r.id, outcome: r.outcome }));
-  const head = git.head(resolvedRoot);
   const existingIds = store.listOutcomeIds(resolvedRoot);
   const resolvedLane = lane ?? null;
 
@@ -131,11 +129,10 @@ export function begin({ root, outcome, accept = [], decision = [], lane }) {
       criteria: accept,
       decisions: decision,
       lane: resolvedLane,
-      head,
     };
     try {
       store.createOutcomeFile(resolvedRoot, id, event);
-      return { id, outcome, criteria: accept, decisions: decision, lane: resolvedLane, head, openAlongside };
+      return { id, outcome, criteria: accept, decisions: decision, lane: resolvedLane, openAlongside };
     } catch (err) {
       existingIds.push(id);
       if (attempt === 4) throw err;
@@ -159,7 +156,6 @@ export function amend({ root, id, reason, addition, accept = [], withdraw = [],
     const criterion = record.criteria[n - 1];
     if (!criterion || criterion.withdrawn) throw new InkanError(`cannot withdraw unknown or already-withdrawn criterion ${n}`);
   }
-  const head = git.head(resolvedRoot);
   store.appendEvent(resolvedRoot, record.id, {
     v: 1,
     type: 'amend',
@@ -170,7 +166,6 @@ export function amend({ root, id, reason, addition, accept = [], withdraw = [],
     criteria: accept,
     withdraw: withdrawIndexes,
     decisions: decision,
-    head,
   });
   const updated = loadRecord(resolvedRoot, record.id);
   return { id: record.id, contractHash: computeContractHash(updated) };
@@ -213,8 +208,6 @@ export function end({ root, id, met = [], unmet = [], status, note }) {
     finalStatus = dispositions.some((d) => !d.met) ? 'partial' : 'completed';
   }
   const contractHash = computeContractHash(record);
-  const tree = git.treeHash(resolvedRoot);
-  const head = git.head(resolvedRoot);
   store.appendEvent(resolvedRoot, record.id, {
     v: 1,
     type: 'end',
@@ -224,8 +217,6 @@ export function end({ root, id, met = [], unmet = [], status, note }) {
     dispositions,
     note,
     contractHash,
-    tree,
-    head,
   });
 
   return { id: record.id, status: finalStatus };
@@ -296,61 +287,9 @@ export function log({ root, n, lane, since, grep, status, decision, id }) {
   return { records: records.slice(0, limit) };
 }
 
-// --- check / doctor ---------------------------------------------------------
+// --- doctor ----------------------------------------------------------------
 
-const OUTCOME_FILE_PREFIX = '.inkan/outcomes/';
-
-/** The four facts for one `Inkan-Outcome` trailer value, per decision 0006. */
-function checkTrailer(root, sha, id) {
-  const filePath = `${OUTCOME_FILE_PREFIX}${id}.jsonl`;
-  const raw = git.showFile(root, sha, filePath);
-  if (raw === null) return { id, lines: ['outcome: missing from commit'], ok: false };
-
-  let events;
-  try {
-    events = store.parseOutcomeEvents(raw, `${sha}:${filePath}`);
-  } catch (err) {
-    const firstLine = String(err.message).split('\n')[0];
-    return { id, lines: [`outcome: present, unreadable (${firstLine})`], ok: false };
-  }
-  const endEvent = events.find((e) => e && e.type === 'end');
-  if (!endEvent) return { id, lines: ['outcome: present, open'], ok: false };
-
-  let hashOk = true;
-  try {
-    fold(events, `${sha}:${filePath}`);
-  } catch {
-    hashOk = false;
-  }
-  const lines = [`outcome: present, closed (${endEvent.status})`, hashOk ? 'hash: matches refold' : 'hash: does not match refold'];
-
-  let treeOk = true;
-  if (endEvent.tree == null) {
-    lines.push('tree: not recorded');
-  } else if (git.treeMatchesCommit(root, endEvent.tree, sha)) {
-    lines.push('tree: matches commit tree');
-  } else {
-    lines.push('tree: differs from commit tree');
-    treeOk = false;
-  }
-
-  return { id, lines, ok: hashOk && treeOk };
-}
-
-/** Read-only report on whether a commit's `Inkan-Outcome` trailers stay faithful to what it recorded. */
-export function check({ root, commit }) {
-  const resolvedRoot = resolveRoot(root);
-  const ref = commit ?? 'HEAD';
-  const sha = git.revParse(resolvedRoot, ref);
-  if (!sha) throw new InkanError(`unknown commit "${ref}"`);
-  const shortSha = git.shortSha(resolvedRoot, sha);
-  const trailerIds = git.trailerValues(resolvedRoot, sha);
-  if (trailerIds.length === 0) return { shortSha, noTrailer: true };
-  const reports = trailerIds.map((id) => checkTrailer(resolvedRoot, sha, id));
-  return { shortSha, reports, consistent: reports.every((r) => r.ok) };
-}
-
-/** Read-only report: folds every outcome, parses every decision, and cross-checks ids and links. */
+/** Optional file diagnostic: folds outcomes, parses decisions, and reports id/link problems. */
 export function doctor({ root }) {
   const resolvedRoot = resolveRoot(root);
   const problems = [];
@@ -519,6 +458,7 @@ Outcome log: \`.inkan/outcomes/<id>.jsonl\`, one append-only file per outcome. C
 ${END_MARKER}`;
 }
 
+// Protocol 4, frozen verbatim for upgrades. Never edit.
 function protocolBlockV4(lang) {
   return `${START_MARKER}
 <!-- inkan-protocol: 4 -->
@@ -540,7 +480,71 @@ Outcome log: \`.inkan/outcomes/<id>.jsonl\`, one append-only file per outcome. C
 ${END_MARKER}`;
 }
 
-const PROTOCOL_VERSION = 4;
+// Protocol 5, frozen verbatim for upgrades. Never edit.
+function protocolBlockV5(lang) {
+  return `${START_MARKER}
+<!-- inkan-protocol: 5 -->
+<!-- inkan-lang: ${lang} -->
+
+## Agent protocol: sealed outcomes
+
+This repository uses Inkan (\`inkan\`, alias \`ink\`). Inkan keeps a trustworthy record of what the work was meant to deliver and what was declared at close. It does not inspect commits, run tests, or judge the result; the repository's own checks do that. Write outcome prose in ${lang}.
+
+1. **Seal before durable changes.** Before changing code, configuration, documentation, or dependencies, run \`inkan status\`; if it shows an open outcome that is not your work, follow rule 4 first. Then run \`inkan begin "<outcome>" --accept "<observable criterion>"\`. Repeat \`--accept\` per criterion. Add \`--decision <id>\` for each decision record this work is bound by. Add \`--lane <tag>\` only when the repository already files outcomes by lane.
+2. **The seal is a fact.** Deliver what it says. If circumstances change, do not reinterpret it: run \`inkan amend --reason "<what changed>"\` with the added or withdrawn criteria. The original text stays. Never question why the outcome was sealed the way it was at the time.
+3. **Close with dispositions, then commit.** Run \`inkan end --met <n>... [--unmet <n>...] --note "<what happened>"\`. Every live criterion gets a disposition. Commit the outcome record with the work. Never report success without closing the outcome.
+4. **Re-anchor after context loss.** Run \`inkan status\` and \`inkan log -n 3\`. An open outcome that is the work you were asked to do is your task: continue it, or close it with a note. An open outcome that is not your work belongs to another session: leave it alone. Never close, amend, or abandon an outcome you did not work on, and do not judge why it is still open. Before beginning your own outcome beside it, stop and tell the person it is there, and ask whether your work should run in its own git worktree, because separate worktrees keep each session's edits apart.
+5. **Closed outcomes are final.** Reviewing the log is reading, not re-checking. Never re-verify, re-attest, or re-close a closed outcome. If a past declaration now looks wrong, that is a new outcome with its own seal.
+
+Decision records live in \`.inkan/decisions/\`. Their Context and Decision sections record the scenario at the time and are never edited. To challenge one, run \`inkan decision update <id> --status <status> --reason "<what changed>"\` or add a new record that supersedes it.
+
+Outcome log: \`.inkan/outcomes/<id>.jsonl\`, one append-only file per outcome. Commit \`.inkan/\` with the code. Do not edit these files by hand.
+${END_MARKER}`;
+}
+
+function protocolBlockV6(lang) {
+  return `${START_MARKER}
+<!-- inkan-protocol: 6 -->
+<!-- inkan-lang: ${lang} -->
+
+## Agent protocol: sealed outcomes
+
+This repository uses Inkan (\`inkan\`, alias \`ink\`). Inkan keeps a trustworthy record of what the work was meant to deliver and what was declared at close. It does not inspect commits, run tests, or judge the result; the repository's own checks do that. Write outcome prose in ${lang}.
+
+1. **Seal before durable changes.** Before changing code, configuration, documentation, or dependencies, run \`inkan status\`; if it shows an open outcome that is not your work, follow rule 4 first. Then run \`inkan begin "<outcome>" --accept "<observable criterion>"\`. Repeat \`--accept\` per criterion. Add \`--decision <id>\` for each decision record this work is bound by. Add \`--lane <tag>\` only when the repository already files outcomes by lane.
+2. **The seal is a fact.** Deliver what it says. If circumstances change, do not reinterpret it: run \`inkan amend --reason "<what changed>"\` with the added or withdrawn criteria. The original text stays. Never question why the outcome was sealed the way it was at the time.
+3. **Close with dispositions, then commit.** Run \`inkan end --met <n>... [--unmet <n>...] --note "<what happened>"\`. Every live criterion gets a disposition. Commit the outcome record with the work. Include the printed \`Inkan-Outcome: <id>\` trailer in the final paragraph of the landing commit message, beside any other trailers with no blank line between them. Never report success without closing the outcome.
+4. **Re-anchor after context loss.** Run \`inkan status\` and \`inkan log -n 3\`. An open outcome that is the work you were asked to do is your task: continue it, or close it with a note. An open outcome that is not your work belongs to another session: leave it alone. Never close, amend, or abandon an outcome you did not work on, and do not judge why it is still open. Before beginning your own outcome beside it, stop and tell the person it is there, and ask whether your work should run in its own git worktree, because separate worktrees keep each session's edits apart.
+5. **Closed outcomes are final.** Reviewing the log is reading, not re-checking. Never re-verify, re-attest, or re-close a closed outcome. If a past declaration now looks wrong, that is a new outcome with its own seal. When reading history, use commit trailers only as references. Missing trailers or unavailable referenced records are missing information, not failed outcomes or a reason to verify delivery or repair history.
+
+Decision records live in \`.inkan/decisions/\`. Their Context and Decision sections record the scenario at the time and are never edited. To challenge one, run \`inkan decision update <id> --status <status> --reason "<what changed>"\` or add a new record that supersedes it.
+
+Outcome log: \`.inkan/outcomes/<id>.jsonl\`, one append-only file per outcome. Commit \`.inkan/\` with the code. Do not edit these files by hand.
+${END_MARKER}`;
+}
+
+function protocolBlockV7(lang) {
+  return `${START_MARKER}
+<!-- inkan-protocol: 7 -->
+<!-- inkan-lang: ${lang} -->
+
+## Agent protocol: sealed outcomes
+
+This repository uses Inkan (\`inkan\`, alias \`ink\`). Inkan keeps a trustworthy record of what the work was meant to deliver and what was declared at close. It does not inspect commits, run tests, or judge the result; the repository's own checks do that. Write outcome prose in ${lang}. This block states the policy; \`inkan help\` gives the command syntax.
+
+1. **Seal before durable changes.** Before changing code, configuration, documentation, or dependencies, run \`inkan status\`; if it shows an open outcome that is not your work, follow rule 4 first. Then run \`inkan begin\` with the outcome, one observable acceptance criterion at a time, and every decision record the work is bound by. File the outcome by lane only when the repository already files outcomes by lane.
+2. **The seal is a fact.** Deliver what it says. If circumstances change, do not reinterpret it: run \`inkan amend\` with the reason and the added or withdrawn criteria. The original text stays. Never question why the outcome was sealed the way it was at the time.
+3. **Close with dispositions, then commit.** Run \`inkan end\` with a disposition, met or unmet, for every live criterion and a note on what happened. Commit the outcome record with the work. Include the printed \`Inkan-Outcome: <id>\` trailer in the final paragraph of the landing commit message, beside any other trailers with no blank line between them. Never report success without closing the outcome.
+4. **Re-anchor after context loss.** Run \`inkan status\` and \`inkan log -n 3\`. An open outcome that is the work you were asked to do is your task: continue it, or close it with a note. An open outcome that is not your work belongs to another session: leave it alone. Never close, amend, or abandon an outcome you did not work on, and do not judge why it is still open. Before beginning your own outcome beside it, stop and tell the person it is there, and ask whether your work should run in its own git worktree, because separate worktrees keep each session's edits apart.
+5. **Closed outcomes are final.** Reviewing the log is reading, not re-checking. Never re-verify, re-attest, or re-close a closed outcome. If a past declaration now looks wrong, that is a new outcome with its own seal. When reading history, use commit trailers only as references. Missing trailers or unavailable referenced records are missing information, not failed outcomes or a reason to verify delivery or repair history.
+
+Decision records live in \`.inkan/decisions/\`. Their Context and Decision sections record the scenario at the time and are never edited. To challenge one, run \`inkan decision update\` with the new status and the reason, or add a new record that supersedes it.
+
+Outcome log: \`.inkan/outcomes/<id>.jsonl\`, one append-only file per outcome. Commit \`.inkan/\` with the code. Do not edit these files by hand.
+${END_MARKER}`;
+}
+
+const PROTOCOL_VERSION = 7;
 
 /**
  * The managed block for `lang` at protocol `version`, current by default.
@@ -552,6 +556,9 @@ export function protocolBlock(lang, version = PROTOCOL_VERSION) {
   if (version === 2) return protocolBlockV2(lang);
   if (version === 3) return protocolBlockV3(lang);
   if (version === 4) return protocolBlockV4(lang);
+  if (version === 5) return protocolBlockV5(lang);
+  if (version === 6) return protocolBlockV6(lang);
+  if (version === 7) return protocolBlockV7(lang);
   throw new InkanError(`unknown protocol version ${version}`);
 }
 

package/src/cli.js

@@ -22,24 +22,30 @@ Commands:
       Create .inkan/ and write the agent protocol block into AGENTS.md.
       --claude also links CLAUDE.md to AGENTS.md.
   begin "<outcome>" [--accept <text>]... [--decision <id>]... [--lane <tag>]
-      Seal a new outcome; prints its id.
+      Seal a new outcome; prints its id. Repeat --accept once per
+      observable criterion; they are numbered from 1 in that order.
+      Repeat --decision once per decision record the work is bound by.
+      Use --lane only where the repository already files outcomes by lane.
   amend --reason <text> [<addition>] [--accept <text>]... [--withdraw <n>]...
         [--decision <id>]... [<id>]
       Append an amendment to the open outcome; prints the new contract hash.
+      --reason is required. Added criteria continue the numbering;
+      --withdraw takes a criterion number. The original text is kept.
   end [<id>] [--met <n>]... [--unmet <n>]... [-s abandoned] --note <text>
-      Record dispositions and close an outcome.
+      Record dispositions and close an outcome; prints the Inkan-Outcome
+      trailer to put in the landing commit. Repeat --met or --unmet once
+      per live criterion number; every live criterion needs one. A value
+      may carry a note as "<n>: <text>". --note is required.
   status
       Print every open outcome.
   log [-n <count>] [--since <date>] [--grep <regex>] [--status <s>]
       [--decision <id>] [--lane <tag>] [<id>]
       Print the outcome log, newest first; <id> prints one outcome in full.
       Filters combine.
-  check [<commit>]
-      Read-only. Reports whether a commit's Inkan-Outcome trailers still
-      match what was recorded. Exit 0 consistent, 1 mismatch, 2 no trailer.
   doctor
-      Read-only. Reports corrupt outcomes, id mismatches, duplicate
-      decision ids, and dangling decision links. Exit 0 clean, 1 problems.
+      Optional, read-only file diagnostic. Reports corrupt outcomes, id
+      mismatches, duplicate decision ids, and dangling decision links.
+      Exit 0 clean, 1 problems. Never required to close an outcome.
   decision add "<title>" --context <text> --decision <text> [--driver <text>]...
                [--option <text>]... [--consequence <text>]... [-s <status>]
       Write a numbered MADR record; prints its file path.
@@ -114,8 +120,6 @@ function printRecord(record) {
     console.log(`  closed: ${record.closedAt}`);
     console.log(`  status: ${record.status}`);
     console.log(`  note: ${record.note}`);
-    console.log(`  tree: ${record.tree ?? 'none'}`);
-    console.log(`  head: ${record.head ?? 'none'}`);
   }
 }
 
@@ -127,25 +131,6 @@ function printStatus(open) {
   for (const record of open) printRecord(record);
 }
 
-function printCheck(result) {
-  if (result.noTrailer) {
-    console.log(`${result.shortSha}  no Inkan-Outcome trailer`);
-    process.exitCode = 2;
-    return;
-  }
-  for (const r of result.reports) {
-    console.log(`${result.shortSha}  Inkan-Outcome: ${r.id}`);
-    for (const line of r.lines) console.log(`  ${line}`);
-  }
-  if (result.consistent) {
-    console.log('consistent');
-  } else {
-    console.log('mismatch');
-    console.log('a mismatch is a fact about this commit; it is recorded, not repaired');
-    process.exitCode = 1;
-  }
-}
-
 function printDoctor(result) {
   if (result.problems.length === 0) {
     console.log(`ok: ${result.outcomeCount} outcomes, ${result.decisionCount} decisions`);
@@ -315,12 +300,6 @@ function run(argv) {
         else for (const record of result.records) printLogLine(record);
         break;
       }
-      case 'check': {
-        const { positionals } = parseArgs({ args: rest, allowPositionals: true });
-        if (positionals.length > 1) throw new InkanError('usage: inkan check [<commit>]');
-        printCheck(api.check({ root, commit: positionals[0] }));
-        break;
-      }
       case 'doctor': {
         parseArgs({ args: rest });
         printDoctor(api.doctor({ root }));

package/src/git.js

@@ -1,83 +0,0 @@
-// The only child process Inkan ever spawns: git, with a fixed argument
-// array. Never `shell: true`, never a user-supplied command string.
-
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import crypto from 'node:crypto';
-
-function run(args, { cwd, env }) {
-  return spawnSync('git', args, { cwd, env, encoding: 'utf8' });
-}
-
-/** The full sha `ref` resolves to, or null if it does not resolve here. */
-export function revParse(cwd, ref) {
-  const result = run(['rev-parse', ref], { cwd, env: process.env });
-  if (result.status !== 0) return null;
-  return result.stdout.trim();
-}
-
-/** The HEAD sha, or null outside a worktree or before the first commit. */
-export function head(cwd) {
-  return revParse(cwd, 'HEAD');
-}
-
-export function isWorktree(cwd) {
-  const result = run(['rev-parse', '--is-inside-work-tree'], { cwd, env: process.env });
-  return result.status === 0 && result.stdout.trim() === 'true';
-}
-
-/** The abbreviated form of `sha`, or `sha` itself if git cannot shorten it. */
-export function shortSha(cwd, sha) {
-  const result = run(['rev-parse', '--short', sha], { cwd, env: process.env });
-  return result.status === 0 ? result.stdout.trim() : sha;
-}
-
-/** Values of `commit`'s `Inkan-Outcome` trailers, in order; empty if none or if `commit` does not resolve. */
-export function trailerValues(cwd, commit) {
-  const result = run(['log', '-1', '--format=%(trailers:key=Inkan-Outcome,valueonly)', commit], { cwd, env: process.env });
-  if (result.status !== 0) return [];
-  return result.stdout.split('\n').filter((line) => line.length > 0);
-}
-
-/** The content of `filePath` as it exists in `commit`'s tree, or null if it is not there. */
-export function showFile(cwd, commit, filePath) {
-  const result = run(['show', `${commit}:${filePath}`], { cwd, env: process.env });
-  return result.status === 0 ? result.stdout : null;
-}
-
-/** Whether `recordedTree` matches `commit`'s tree, `.inkan/outcomes` excluded. */
-export function treeMatchesCommit(cwd, recordedTree, commit) {
-  const result = run(
-    ['diff-tree', '-r', '--quiet', recordedTree, `${commit}^{tree}`, '--', '.', ':(exclude).inkan/outcomes'],
-    { cwd, env: process.env }
-  );
-  return result.status === 0;
-}
-
-/**
- * The tree hash of the working tree, `.inkan/outcomes` excluded, via the
- * temporary-index recipe from decision 0006. Returns null outside a worktree.
- * The temporary index file is always cleaned up.
- */
-export function treeHash(cwd) {
-  if (!isWorktree(cwd)) return null;
-  const tmp = path.join(os.tmpdir(), `inkan-index-${process.pid}-${crypto.randomUUID()}`);
-  const env = { ...process.env, GIT_INDEX_FILE: tmp };
-  try {
-    let result = run(['read-tree', '--empty'], { cwd, env });
-    if (result.status !== 0) throw new Error(`git read-tree failed: ${result.stderr}`);
-    result = run(['add', '-A', '--', '.', ':(exclude).inkan/outcomes'], { cwd, env });
-    if (result.status !== 0) throw new Error(`git add failed: ${result.stderr}`);
-    result = run(['write-tree'], { cwd, env });
-    if (result.status !== 0) throw new Error(`git write-tree failed: ${result.stderr}`);
-    return result.stdout.trim();
-  } finally {
-    try {
-      fs.unlinkSync(tmp);
-    } catch {
-      // already gone
-    }
-  }
-}