@rulvar/cli 1.16.2 → 1.18.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as runCli, t as processIo } from "./io-lNmGU5Lv.js";
+import { r as runCli, t as processIo } from "./io-74cSn0r8.js";
 import { inspect } from "node:util";
 //#region src/cli.ts
 /**

package/dist/index.d.ts

@@ -16,7 +16,7 @@ interface CliIo {
 declare function processIo(): CliIo;
 //#endregion
 //#region src/cli-main.d.ts
-declare const HELP = "rulvar: durable multi-agent workflows (https://docs.rulvar.com)\n\n  rulvar run <file|name> [--args JSON] [--store PATH] [--budget-usd N]\n  rulvar resume <runId>  [--store PATH]\n  rulvar runs ls         [--store PATH]\n  rulvar inspect <runId> [--store PATH]\n  rulvar plan \"<goal>\"   [--dry-run]\n  rulvar kb <list | inbox | gate | sweep>\n\nEngine assembly: adapters, defaults, and the workflow registry come from\nrulvar.config.mjs in the working directory (default export\n{ engineOptions?, workflows? }) or from the workflow module's named\nexports. --store selects the JsonlFileStore directory (default .rulvar).\nplan asks the planner model (role plan) to write a workflow script,\nlints and self-repairs it, then runs it in the worker sandbox; --dry-run\nprints the accepted script without running. Requires @rulvar/planner\ninstalled. kb list shows the per-project claim store\n(./rulvar.models.json) with full provenance. kb sweep runs the\nfalsification matrix from the kbSweep section of rulvar.config.mjs\n(fixed pool UNIONED with every model carrying an active negative claim\nplus the re-measure queue; optional canary probes flip drifted claims\nstale first; requires @rulvar/evals installed). kb inbox aggregates\nkb_propose proposals from finished runs (14 day TTL); kb gate turns one\ninbox proposal into a committed claim behind a human attestation\n(--approver and --ruled-out are mandatory). inbox and gate require\n@rulvar/plan installed.";
+declare const HELP: string;
 declare function runCli(argv: string[], options: {
   cwd: string;
   io: CliIo;
@@ -76,6 +76,30 @@ interface KbSweepCliConfig {
     model: `${string}:${string}`;
     effort?: string;
   }) => unknown;
+  /**
+  * Immutable per-run ceilings and the aggregate debit-only envelope
+  * (v1.16.2 review P1-2). A sweep multiplies paid runs: pool members
+  * times cases for targets, one judge run per judge-grader call, one
+  * canary run per probe per member, and the falsification union can
+  * grow the pool past the configured models. Per-run ceilings alone do
+  * not bound that product, so maxTotalUsd is the hard aggregate ceiling
+  * every target, judge, and canary run authorizes against BEFORE it
+  * starts. Required unless allowUnbounded is set: a sweep is never
+  * silently unbounded.
+  */
+  budgets?: {
+    /** Immutable ceiling B0 of every eval target run. */targetUsd: number; /** Immutable ceiling of every judge run. */
+    judgeUsd: number; /** Immutable ceiling of every canary probe run. */
+    canaryUsd: number; /** The debit-only envelope over the WHOLE sweep (targets, judges, canary). */
+    maxTotalUsd: number;
+  };
+  /**
+  * Explicitly waive the ceilings and run every target, judge, and
+  * canary run unbounded (the pre-v1.16.2 behavior). A sweep with
+  * neither budgets nor this flag set fails loudly: an unbounded paid
+  * matrix is never the silent default.
+  */
+  allowUnbounded?: boolean;
 }
 /** Loads `rulvar.config.mjs`/`.js` from cwd; absent config is fine. */
 declare function loadCliConfig(cwd: string): Promise<CliConfig>;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-lNmGU5Lv.js";
+import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-74cSn0r8.js";
 import { ConfigError, InvalidResolutionError, JournalCompatibilityError, LeaseHeldError, Replayer, RulvarError, buildDeriverRegistry, costReportFromJournal, maskSecrets, normalizeEntry, scanJournalCompatibility, validateSchemaSpec } from "@rulvar/core";
 //#region src/server.ts
 /**

package/dist/{io-lNmGU5Lv.js → io-74cSn0r8.js}

@@ -1,8 +1,8 @@
 import { ConfigError, FileModelKnowledgeStore, INBOX_PROPOSAL_TTL_DAYS, JsonlFileStore, claimExpired, claimExpiry, compilePermissionPreset, costReportFromJournal, createEngine, parseModelRef, priceUsdOf, proposalStatement, remeasureQueue, resolvePricing, runProfile } from "@rulvar/core";
-import { parseArgs } from "node:util";
 import { join, resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
 import { createInterface } from "node:readline";
 //#region src/config.ts
 /**
@@ -302,6 +302,254 @@ function reportOutcome(outcome, io) {
 	}
 }
 //#endregion
+//#region src/grammar.ts
+/**
+* The canonical CLI grammar as data (v1.16.2 review P3-1): one
+* structure generates the help block, every per-command usage line,
+* and the docs contract test, so the three surfaces can never drift
+* apart again. Parsing goes through parseCommand, which converts
+* node:util parseArgs failures into the fail-loud ConfigError grammar
+* the CLI documents (v1.16.2 review P2-1): nothing is ignored; unknown
+* flags, duplicate value flags, mutually exclusive pairs, and wrong
+* positional arity all fail naming the canonical usage.
+*/
+const ARGS = {
+	name: "args",
+	placeholder: "JSON"
+};
+const STORE = {
+	name: "store",
+	placeholder: "PATH"
+};
+/**
+* Every command of the canonical grammar (no aliases in v1). The help
+* block, the per-command usage errors, and the docs grammar block in
+* docs/guide/cli.md all derive from this table; the docs contract test
+* compares them literally.
+*/
+const GRAMMAR = {
+	run: {
+		command: "run",
+		positionals: ["<file|name>"],
+		flags: [
+			ARGS,
+			STORE,
+			{
+				name: "budget-usd",
+				placeholder: "N"
+			},
+			{
+				name: "profile",
+				placeholder: "NAME"
+			}
+		]
+	},
+	resume: {
+		command: "resume",
+		positionals: ["<runId>"],
+		flags: [ARGS, STORE]
+	},
+	"runs ls": {
+		command: "runs ls",
+		positionals: [],
+		flags: [STORE],
+		note: "(no aliases in v1)"
+	},
+	inspect: {
+		command: "inspect",
+		positionals: ["<runId>"],
+		flags: [STORE]
+	},
+	plan: {
+		command: "plan",
+		positionals: ["\"<goal>\""],
+		flags: [
+			{
+				name: "planning-budget-usd",
+				placeholder: "N"
+			},
+			{
+				name: "budget-usd",
+				placeholder: "N"
+			},
+			{ name: "allow-unbounded" },
+			{ name: "dry-run" }
+		]
+	},
+	"kb list": {
+		command: "kb list",
+		positionals: [],
+		flags: []
+	},
+	"kb inbox": {
+		command: "kb inbox",
+		positionals: [],
+		flags: [STORE]
+	},
+	"kb gate": {
+		command: "kb gate",
+		positionals: ["<runId>", "<entryRef>"],
+		flags: [
+			{
+				name: "approver",
+				placeholder: "NAME",
+				required: true
+			},
+			{
+				name: "ruled-out",
+				placeholder: "a,b,c",
+				required: true
+			},
+			{
+				name: "contrast-run",
+				placeholder: "runId#seq",
+				exclusiveGroup: "contrast"
+			},
+			{
+				name: "contrast-eval",
+				placeholder: "reportId:caseId[,caseId...]",
+				exclusiveGroup: "contrast"
+			},
+			{
+				name: "confidence",
+				placeholder: "high|medium|low"
+			},
+			STORE
+		]
+	},
+	"kb sweep": {
+		command: "kb sweep",
+		positionals: [],
+		flags: [],
+		note: "(configuration lives in rulvar.config.mjs)"
+	}
+};
+/** The kb dispatch line: subcommands carry their own grammar entries. */
+const KB_FAMILY_USAGE = "usage: rulvar kb <list | inbox | gate | sweep> (no aliases in v1)";
+function renderFlags(flags) {
+	const tokens = [];
+	const renderedGroups = /* @__PURE__ */ new Set();
+	for (const flag of flags) {
+		if (flag.exclusiveGroup !== void 0) {
+			if (renderedGroups.has(flag.exclusiveGroup)) continue;
+			renderedGroups.add(flag.exclusiveGroup);
+			const members = flags.filter((candidate) => candidate.exclusiveGroup === flag.exclusiveGroup).map((member) => `--${member.name} ${member.placeholder ?? ""}`.trim());
+			tokens.push(`[${members.join(" | ")}]`);
+			continue;
+		}
+		const body = flag.placeholder === void 0 ? `--${flag.name}` : `--${flag.name} ${flag.placeholder}`;
+		tokens.push(flag.required === true ? body : `[${body}]`);
+	}
+	return tokens;
+}
+/** The full invocation shape, e.g. `rulvar run <file|name> [--args JSON] ...`. */
+function invocationOf(grammar) {
+	const parts = [
+		`rulvar ${grammar.command}`,
+		...grammar.positionals,
+		...renderFlags(grammar.flags)
+	];
+	if (grammar.note !== void 0) parts.push(grammar.note);
+	return parts.join(" ");
+}
+/** The canonical usage error line for a command. */
+function usageOf(grammar) {
+	return `usage: ${invocationOf(grammar)}`;
+}
+/**
+* The command lines of the help block: every top-level command plus the
+* kb family line, aligned on the flag column. The docs grammar block is
+* the same list verbatim (docs contract test).
+*/
+function helpCommandLines() {
+	const top = [
+		GRAMMAR.run,
+		GRAMMAR.resume,
+		GRAMMAR["runs ls"],
+		GRAMMAR.inspect,
+		GRAMMAR.plan
+	];
+	const heads = top.map((grammar) => [
+		"rulvar",
+		grammar.command,
+		...grammar.positionals
+	].join(" "));
+	const kbHead = "rulvar kb <list | inbox | gate | sweep>";
+	const width = Math.max(...heads.map((head) => head.length), 39);
+	const lines = top.map((grammar, index) => {
+		const tail = renderFlags(grammar.flags).join(" ");
+		return tail === "" ? heads[index] : `${heads[index].padEnd(width)} ${tail}`;
+	});
+	lines.push(kbHead);
+	return lines;
+}
+function isParseArgsError(error) {
+	if (!(error instanceof Error)) return false;
+	const code = error.code;
+	return typeof code === "string" && code.startsWith("ERR_PARSE_ARGS");
+}
+/**
+* Parses argv against one grammar entry. Everything the grammar does
+* not name is an error: unknown options (raised by parseArgs), value
+* flags given twice, both members of an exclusive group, and any
+* positional beyond the exact arity. Every rejection names the
+* canonical usage and happens before configs, stores, or adapters load.
+*/
+function parseCommand(grammar, argv) {
+	const options = {};
+	for (const flag of grammar.flags) options[flag.name] = {
+		type: flag.placeholder === void 0 ? "boolean" : "string",
+		multiple: true
+	};
+	let raw;
+	try {
+		raw = parseArgs({
+			args: argv,
+			allowPositionals: true,
+			options
+		});
+	} catch (error) {
+		if (isParseArgsError(error)) {
+			const summary = error.message.split(".")[0];
+			throw new ConfigError(`${summary}; ${usageOf(grammar)}`);
+		}
+		throw error;
+	}
+	if (raw.positionals.length < grammar.positionals.length) throw new ConfigError(usageOf(grammar));
+	if (raw.positionals.length > grammar.positionals.length) {
+		const extra = raw.positionals[grammar.positionals.length];
+		throw new ConfigError(`unexpected extra argument '${extra}'; ${usageOf(grammar)}`);
+	}
+	const values = {};
+	const groupMembers = /* @__PURE__ */ new Map();
+	for (const flag of grammar.flags) {
+		const entry = raw.values[flag.name];
+		if (entry === void 0) continue;
+		if (flag.placeholder !== void 0 && entry.length > 1) throw new ConfigError(`--${flag.name} may appear at most once; ${usageOf(grammar)}`);
+		values[flag.name] = flag.placeholder === void 0 ? true : entry[entry.length - 1];
+		if (flag.exclusiveGroup !== void 0) {
+			const members = groupMembers.get(flag.exclusiveGroup) ?? [];
+			members.push(`--${flag.name}`);
+			groupMembers.set(flag.exclusiveGroup, members);
+		}
+	}
+	for (const members of groupMembers.values()) if (members.length > 1) throw new ConfigError(`${members.join(" and ")} are mutually exclusive; ${usageOf(grammar)}`);
+	return {
+		positionals: raw.positionals,
+		values
+	};
+}
+/**
+* Validates a `--...-usd` flag value: a finite dollar amount strictly
+* above zero (0, NaN, Infinity, negatives, and non-numbers all fail),
+* checked at parse time, before any provider work.
+*/
+function parseBudgetValue(flagName, value) {
+	const budget = Number(value);
+	if (!Number.isFinite(budget) || budget <= 0) throw new ConfigError(`--${flagName} must be a positive number, got '${value}'`);
+	return budget;
+}
+//#endregion
 //#region src/commands.ts
 /**
 * The four M5 commands of the canonical CLI grammar (no aliases in v1):
@@ -340,61 +588,34 @@ async function loadCompanion(loading, specifier, command, missingMessage) {
 		throw new Error(`${command}: ${specifier} is installed but failed to load; the cause below is a defect in the installed package or its dependencies, not a missing install`, { cause: error });
 	}
 }
-function parseRunFlags(argv) {
-	const { values, positionals } = parseArgs({
-		args: argv,
-		allowPositionals: true,
-		options: {
-			args: { type: "string" },
-			store: { type: "string" },
-			"budget-usd": { type: "string" },
-			profile: { type: "string" }
-		}
-	});
-	const parsed = { positionals };
-	if (values.store !== void 0) parsed.store = values.store;
-	if (values.profile !== void 0) parsed.profile = values.profile;
-	if (values.args !== void 0) parsed.args = values.args;
-	if (values["budget-usd"] !== void 0) {
-		const budget = Number(values["budget-usd"]);
-		if (!Number.isFinite(budget) || budget <= 0) throw new ConfigError(`--budget-usd must be a positive number, got '${values["budget-usd"]}'`);
-		parsed.budgetUsd = budget;
-	}
-	return parsed;
-}
-function parseCommonFlags(argv) {
-	const { values, positionals } = parseArgs({
-		args: argv,
-		allowPositionals: true,
-		options: { store: { type: "string" } }
-	});
-	return {
-		positionals,
-		...values.store === void 0 ? {} : { store: values.store }
-	};
+/** Parses --args JSON into workflow arguments; undefined when absent. */
+function parseArgsJson(raw) {
+	if (raw === void 0) return;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		throw new ConfigError(`--args is not valid JSON: ${raw}`);
+	}
 }
 async function runCommand(argv, context) {
-	const flags = parseRunFlags(argv);
-	const target = flags.positionals[0];
-	if (target === void 0) throw new ConfigError("usage: rulvar run <file|name> [--args JSON] [--store PATH] [--budget-usd N]");
+	const parsed = parseCommand(GRAMMAR.run, argv);
+	const target = parsed.positionals[0];
+	const store = parsed.values.store;
+	const profile = parsed.values.profile;
+	const budgetUsd = parsed.values["budget-usd"] === void 0 ? void 0 : parseBudgetValue("budget-usd", parsed.values["budget-usd"]);
+	const args = parseArgsJson(parsed.values.args);
 	const config = await loadCliConfig(context.cwd);
 	const module = looksLikeFile(target) ? await loadWorkflowModule(target, context.cwd) : void 0;
 	const assembled = assembleEngine({
 		config,
 		...module === void 0 ? {} : { module },
-		...flags.store === void 0 ? {} : { storePath: flags.store },
-		...flags.profile === void 0 ? {} : { profile: flags.profile },
+		...store === void 0 ? {} : { storePath: store },
+		...profile === void 0 ? {} : { profile },
 		cwd: context.cwd
 	});
 	const workflow = module?.workflow ?? assembled.workflows[target];
 	if (workflow === void 0) throw new ConfigError(looksLikeFile(target) ? `${target} exports no workflow (default export or named 'workflow')` : `no workflow named '${target}' in the registry; register it in rulvar.config.mjs`);
-	let args;
-	if (flags.args !== void 0) try {
-		args = JSON.parse(flags.args);
-	} catch {
-		throw new ConfigError(`--args is not valid JSON: ${flags.args}`);
-	}
-	const runOptions = { ...flags.budgetUsd === void 0 ? {} : { budgetUsd: flags.budgetUsd } };
+	const runOptions = { ...budgetUsd === void 0 ? {} : { budgetUsd } };
 	const first = assembled.engine.run(workflow, args, runOptions);
 	context.io.err(`runId: ${first.runId}`);
 	return reportOutcome(await driveRun({
@@ -406,18 +627,13 @@ async function runCommand(argv, context) {
 	}), context.io);
 }
 async function resumeCommand(argv, context) {
-	const flags = parseRunFlags(argv);
-	const runId = flags.positionals[0];
-	if (runId === void 0) throw new ConfigError("usage: rulvar resume <runId> [--args JSON] [--store PATH]");
-	let args;
-	if (flags.args !== void 0) try {
-		args = JSON.parse(flags.args);
-	} catch {
-		throw new ConfigError(`--args is not valid JSON: ${flags.args}`);
-	}
+	const parsed = parseCommand(GRAMMAR.resume, argv);
+	const runId = parsed.positionals[0];
+	const args = parseArgsJson(parsed.values.args);
+	const store = parsed.values.store;
 	const assembled = assembleEngine({
 		config: await loadCliConfig(context.cwd),
-		...flags.store === void 0 ? {} : { storePath: flags.store },
+		...store === void 0 ? {} : { storePath: store },
 		cwd: context.cwd
 	});
 	const meta = (await assembled.store.listRuns()).find((m) => m.runId === runId);
@@ -435,10 +651,10 @@ async function resumeCommand(argv, context) {
 	}), context.io);
 }
 async function runsLsCommand(argv, context) {
-	const flags = parseCommonFlags(argv);
+	const store = parseCommand(GRAMMAR["runs ls"], argv).values.store;
 	const metas = await assembleEngine({
 		config: await loadCliConfig(context.cwd),
-		...flags.store === void 0 ? {} : { storePath: flags.store },
+		...store === void 0 ? {} : { storePath: store },
 		cwd: context.cwd
 	}).store.listRuns();
 	if (metas.length === 0) {
@@ -453,12 +669,12 @@ async function runsLsCommand(argv, context) {
 	return 0;
 }
 async function inspectCommand(argv, context) {
-	const flags = parseCommonFlags(argv);
-	const runId = flags.positionals[0];
-	if (runId === void 0) throw new ConfigError("usage: rulvar inspect <runId> [--store PATH]");
+	const parsed = parseCommand(GRAMMAR.inspect, argv);
+	const runId = parsed.positionals[0];
+	const store = parsed.values.store;
 	const assembled = assembleEngine({
 		config: await loadCliConfig(context.cwd),
-		...flags.store === void 0 ? {} : { storePath: flags.store },
+		...store === void 0 ? {} : { storePath: store },
 		cwd: context.cwd
 	});
 	const meta = (await assembled.store.listRuns()).find((m) => m.runId === runId);
@@ -491,34 +707,44 @@ async function inspectCommand(argv, context) {
 	return 0;
 }
 /**
-* rulvar plan "<goal>" [--dry-run] (M6-T11): plans a
-* workflow script through @rulvar/planner (loaded dynamically: the CLI's
-* static dependency stays @rulvar/core only),
-* prints the accepted script and its advisories, and runs it in the
-* worker sandbox unless --dry-run.
+* rulvar plan (M6-T11; grammar in grammar.ts): plans a workflow script
+* through @rulvar/planner (loaded dynamically: the CLI's static
+* dependency stays @rulvar/core only), prints the accepted script and
+* its advisories, and runs it in the worker sandbox unless --dry-run.
+*
+* Both stages are paid runs with their OWN immutable ceilings (the
+* v1.16.2 review P1-1): --planning-budget-usd caps the planning run
+* (PlanOptions.run.budgetUsd, frozen at the planning journal's
+* genesis), --budget-usd caps the execution run (RunOptions.budgetUsd,
+* consistent with rulvar run). A machine-written workflow never runs
+* unbounded silently: missing ceilings fail loudly unless
+* --allow-unbounded waives them explicitly, and an execution ceiling
+* beside --dry-run is a contradiction, not an ignorable leftover.
 */
 async function planCommand(argv, context) {
-	const parsed = parseArgs({
-		args: argv,
-		allowPositionals: true,
-		options: { "dry-run": { type: "boolean" } }
-	});
+	const parsed = parseCommand(GRAMMAR.plan, argv);
 	const goal = parsed.positionals[0];
-	if (goal === void 0 || parsed.positionals.length > 1) throw new ConfigError("usage: rulvar plan \"<goal>\" [--dry-run]");
+	const dryRun = parsed.values["dry-run"] === true;
+	const allowUnbounded = parsed.values["allow-unbounded"] === true;
+	const planningBudgetUsd = parsed.values["planning-budget-usd"] === void 0 ? void 0 : parseBudgetValue("planning-budget-usd", parsed.values["planning-budget-usd"]);
+	const executionBudgetUsd = parsed.values["budget-usd"] === void 0 ? void 0 : parseBudgetValue("budget-usd", parsed.values["budget-usd"]);
+	if (dryRun && executionBudgetUsd !== void 0) throw new ConfigError("--dry-run never executes the planned workflow, so --budget-usd (the execution ceiling) has nothing to bound; drop one of the two");
+	if (!allowUnbounded && planningBudgetUsd === void 0) throw new ConfigError("rulvar plan runs the planner model as a paid run; set --planning-budget-usd N (its immutable ceiling) or waive it explicitly with --allow-unbounded");
+	if (!allowUnbounded && !dryRun && executionBudgetUsd === void 0) throw new ConfigError("executing the planned workflow is a second paid run; set --budget-usd N (its immutable ceiling) or waive it explicitly with --allow-unbounded");
 	const plannerModule = await loadCompanion(import("@rulvar/planner"), "@rulvar/planner", "rulvar plan", "rulvar plan requires @rulvar/planner (the plan agent, compileScript, and the worker sandbox live there); install it next to the CLI");
 	const assembled = assembleEngine({
 		config: await loadCliConfig(context.cwd),
 		cwd: context.cwd
 	});
-	const planned = await plannerModule.plan(assembled.engine, goal);
+	const planned = await plannerModule.plan(assembled.engine, goal, planningBudgetUsd === void 0 ? void 0 : { run: { budgetUsd: planningBudgetUsd } });
 	context.io.err(`plan: accepted with ${String(planned.lint.length)} advisory diagnostic(s)`);
 	for (const diagnostic of planned.lint) context.io.err(`  ${diagnostic.ruleId}: ${diagnostic.message}`);
-	if (parsed.values["dry-run"] === true) {
+	if (dryRun) {
 		context.io.out(planned.source);
 		return 0;
 	}
 	const workflow = planned.workflow;
-	const first = assembled.engine.run(workflow, null);
+	const first = assembled.engine.run(workflow, null, executionBudgetUsd === void 0 ? {} : { budgetUsd: executionBudgetUsd });
 	context.io.err(`runId: ${first.runId}`);
 	return reportOutcome(await driveRun({
 		engine: assembled.engine,
@@ -540,7 +766,8 @@ async function kbCommand(argv, context) {
 	if (sub === "inbox") return await kbInboxCommand(rest, context);
 	if (sub === "gate") return await kbGateCommand(rest, context);
 	if (sub === "sweep") return await kbSweepCommand(rest, context);
-	if (sub !== "list" || rest.length > 0) throw new ConfigError("usage: rulvar kb <list | inbox | gate | sweep> (no aliases in v1)");
+	if (sub !== "list") throw new ConfigError(KB_FAMILY_USAGE);
+	parseCommand(GRAMMAR["kb list"], rest);
 	const snapshot = await new FileModelKnowledgeStore({ path: join(context.cwd, "rulvar.models.json") }).current();
 	context.io.out(`knowledge store: rulvar.models.json (version ${String(snapshot.version)}, ${String(snapshot.claims.length)} claim${snapshot.claims.length === 1 ? "" : "s"})`);
 	renderKbList(snapshot, context);
@@ -574,8 +801,7 @@ function renderKbList(snapshot, context) {
 * concrete model names render here VERBATIM, exactly like kb list.
 */
 async function kbInboxCommand(argv, context) {
-	const flags = parseCommonFlags(argv);
-	if (flags.positionals.length > 0) throw new ConfigError("usage: rulvar kb inbox [--store PATH]");
+	const flags = { store: parseCommand(GRAMMAR["kb inbox"], argv).values.store };
 	const plan = await loadCompanion(import("@rulvar/plan"), "@rulvar/plan", "rulvar kb inbox", "rulvar kb inbox requires @rulvar/plan (the RunLedger fold behind the LedgerExport seam)");
 	const assembled = assembleEngine({
 		config: await loadCliConfig(context.cwd),
@@ -662,22 +888,11 @@ const RULED_OUT_VOCABULARY = [
 * per-project file store, whose git review is the authenticating gate.
 */
 async function kbGateCommand(argv, context) {
-	const { values, positionals } = parseArgs({
-		args: argv,
-		allowPositionals: true,
-		options: {
-			store: { type: "string" },
-			approver: { type: "string" },
-			"ruled-out": { type: "string" },
-			"contrast-run": { type: "string" },
-			"contrast-eval": { type: "string" },
-			confidence: { type: "string" }
-		}
-	});
-	const usage = "usage: rulvar kb gate <runId> <entryRef> --approver NAME --ruled-out a,b,c [--contrast-run runId#seq | --contrast-eval reportId:caseId[,caseId...]] [--confidence high|medium|low] [--store PATH]";
-	const runId = positionals[0];
-	const entryRefRaw = positionals[1];
-	if (runId === void 0 || entryRefRaw === void 0 || positionals.length > 2) throw new ConfigError(usage);
+	const parsed = parseCommand(GRAMMAR["kb gate"], argv);
+	const values = parsed.values;
+	const usage = usageOf(GRAMMAR["kb gate"]);
+	const runId = parsed.positionals[0];
+	const entryRefRaw = parsed.positionals[1];
 	const entryRef = Number(entryRefRaw);
 	if (!Number.isInteger(entryRef) || entryRef < 1) throw new ConfigError(`entryRef must be a positive integer entry seq, got '${entryRefRaw}'`);
 	const approver = values.approver;
@@ -686,7 +901,6 @@ async function kbGateCommand(argv, context) {
 	if (ruledOutRaw === void 0 || ruledOutRaw === "") throw new ConfigError(`--ruled-out is required: the attribution attestation lists the alternative causes you ruled out (${RULED_OUT_VOCABULARY.join(", ")}). ${usage}`);
 	const ruledOut = ruledOutRaw.split(",").map((entry) => entry.trim());
 	for (const entry of ruledOut) if (!RULED_OUT_VOCABULARY.includes(entry)) throw new ConfigError(`--ruled-out '${entry}' is not in the attestation vocabulary (${RULED_OUT_VOCABULARY.join(", ")})`);
-	if (values["contrast-run"] !== void 0 && values["contrast-eval"] !== void 0) throw new ConfigError("--contrast-run and --contrast-eval are mutually exclusive");
 	let contrastEvidence;
 	if (values["contrast-run"] !== void 0) {
 		const [contrastRun, seqRaw, ...tail] = values["contrast-run"].split("#");
@@ -804,10 +1018,21 @@ async function kbGateCommand(argv, context) {
 * sweep re-measures.
 */
 async function kbSweepCommand(argv, context) {
-	if (argv.length > 0) throw new ConfigError("usage: rulvar kb sweep (configuration lives in rulvar.config.mjs)");
+	parseCommand(GRAMMAR["kb sweep"], argv);
 	const config = await loadCliConfig(context.cwd);
 	const sweep = config.kbSweep;
 	if (sweep === void 0) throw new ConfigError("rulvar kb sweep requires a kbSweep section in rulvar.config.mjs ({ committerId, models, cases })");
+	const budgets = sweep.budgets;
+	if (budgets === void 0 && sweep.allowUnbounded !== true) throw new ConfigError("rulvar kb sweep runs paid target, judge, and canary runs; set kbSweep.budgets ({ targetUsd, judgeUsd, canaryUsd, maxTotalUsd }) so every run carries an immutable ceiling and the whole sweep stays under maxTotalUsd, or waive the ceilings explicitly with kbSweep.allowUnbounded: true");
+	if (budgets !== void 0) for (const field of [
+		"targetUsd",
+		"judgeUsd",
+		"canaryUsd",
+		"maxTotalUsd"
+	]) {
+		const value = budgets[field];
+		if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) throw new ConfigError(`kbSweep.budgets.${field} must be a positive finite number, got ${String(value)}`);
+	}
 	const evals = await loadCompanion(import("@rulvar/evals"), "@rulvar/evals", "rulvar kb sweep", "rulvar kb sweep requires @rulvar/evals (matrix sweeps, the eval-committer identity, and the canary live there); install it next to the CLI");
 	const store = new FileModelKnowledgeStore({ path: join(context.cwd, "rulvar.models.json") });
 	const snapshot = await store.current();
@@ -849,15 +1074,40 @@ async function kbSweepCommand(argv, context) {
 			}
 		}
 	}));
+	const usd = (amount) => `$${String(Math.round(amount * 1e6) / 1e6)}`;
+	let envelope;
+	if (budgets !== void 0) {
+		envelope = new evals.SpendEnvelope(budgets.maxTotalUsd);
+		const canaryRuns = (sweep.canary?.prompts.length ?? 0) * pool.size;
+		const targetRuns = sweep.cases.length * pool.size;
+		context.io.out(`sweep budget: ${usd(budgets.maxTotalUsd)} maxTotalUsd hard ceiling; authorizes up to ${usd(canaryRuns * budgets.canaryUsd + targetRuns * budgets.targetUsd)} for ${String(canaryRuns)} canary + ${String(targetRuns)} target run(s) before judges (each judge run up to ${usd(budgets.judgeUsd)} draws from the same envelope at grade time)`);
+	} else context.io.err("kb sweep: running UNBOUNDED (kbSweep.allowUnbounded); no target, judge, or canary run carries a ceiling");
 	for (const { member, origin } of pool.values()) {
 		const effort = member.effort === void 0 ? "" : ` effort=${member.effort}`;
 		context.io.out(`pool: ${member.model}${effort} [${origin}]`);
 	}
 	if (sweep.canary !== void 0) for (const { member } of pool.values()) {
 		const engine = await engineFor(member);
-		const fingerprint = await evals.canaryFingerprint(engine, sweep.canary);
-		const drift = await evals.flipStaleOnCanaryDrift(store, member.model, fingerprint);
-		context.io.out(`canary ${member.model}: ${fingerprint.slice(0, 12)}...` + (drift.flipped.length === 0 ? " no drift" : ` DRIFT, ${String(drift.flipped.length)} claim(s) flipped stale`));
+		let canary;
+		try {
+			canary = await evals.runCanary(engine, sweep.canary, { ...budgets === void 0 ? {} : {
+				budgetUsd: budgets.canaryUsd,
+				envelope
+			} });
+		} catch (error) {
+			if (error instanceof Error && error.name === "SweepBudgetError") {
+				context.io.out(`canary ${member.model}: envelope exhausted, skipped`);
+				continue;
+			}
+			throw error;
+		}
+		if (!canary.allOk) {
+			const refused = canary.probes.filter((probe) => probe.status === "refused").length;
+			context.io.out(`canary ${member.model}: ${canary.fingerprint.slice(0, 12)}... incomplete ` + (refused > 0 ? `(${String(refused)} probe(s) refused by the envelope); NOT flipping claims` : "(a probe did not settle ok); NOT flipping claims"));
+			continue;
+		}
+		const drift = await evals.flipStaleOnCanaryDrift(store, member.model, canary.fingerprint);
+		context.io.out(`canary ${member.model}: ${canary.fingerprint.slice(0, 12)}...` + (drift.flipped.length === 0 ? " no drift" : ` DRIFT, ${String(drift.flipped.length)} claim(s) flipped stale`));
 	}
 	const report = await evals.runSweepMatrix({
 		models: [...pool.values()].map((entry) => entry.member),
@@ -868,11 +1118,31 @@ async function kbSweepCommand(argv, context) {
 		observedAt,
 		engineFor,
 		store,
-		...sweep.thresholds === void 0 ? {} : { thresholds: sweep.thresholds }
+		...sweep.thresholds === void 0 ? {} : { thresholds: sweep.thresholds },
+		...budgets === void 0 ? {} : {
+			suite: {
+				budgetUsd: budgets.targetUsd,
+				judgeBudgetUsd: budgets.judgeUsd
+			},
+			envelope
+		}
 	});
-	for (const cell of report.cells) context.io.out(`cell ${cell.model} :: ${cell.taskClass}: passRate ${cell.passRate.toFixed(2)} over ${String(cell.n)} case${cell.n === 1 ? "" : "s"}`);
+	for (const cell of report.cells) {
+		if (cell.envelopeExhausted === true && cell.n === 0) {
+			context.io.out(`cell ${cell.model} :: ${cell.taskClass}: envelope exhausted, not measured (no claim)`);
+			continue;
+		}
+		const notes = [];
+		if (cell.envelopeExhausted === true) notes.push(`INCOMPLETE: envelope refused ${cell.refusedRunLabel ?? "a run"} after ${String(cell.n)} of ${String(cell.plannedN)} case(s)`);
+		else if (cell.n < cell.plannedN) notes.push(`INCOMPLETE: ${String(cell.n)} of ${String(cell.plannedN)} case(s) measured`);
+		if (cell.exhaustedRuns !== void 0) notes.push(`${String(cell.exhaustedRuns)} run(s) hit their own ceiling`);
+		if (cell.judgeIncompleteRuns !== void 0) notes.push(`${String(cell.judgeIncompleteRuns)} case(s) kept as evidence with an unfinished judge (${cell.incompleteReason ?? "judge budget"})`);
+		const suffix = notes.length === 0 ? "" : ` (${notes.join("; ")}; no claim)`;
+		context.io.out(`cell ${cell.model} :: ${cell.taskClass}: passRate ${cell.passRate.toFixed(2)} over ${String(cell.n)} case${cell.n === 1 ? "" : "s"}${suffix}`);
+	}
 	for (const claim of report.claims) context.io.out(`claim ${claim.id}: ${claim.taskClass} ${claim.polarity}`);
 	context.io.out(report.committedVersion === void 0 ? "no claims crossed a threshold; nothing committed" : `committed ${String(report.claims.length)} claim(s) as store version ${String(report.committedVersion)} (report ${report.reportId})`);
+	if (envelope !== void 0) context.io.out(`sweep budget: authorized ${usd(envelope.authorizedUsd)} of ${usd(envelope.maxTotalUsd)}`);
 	return 0;
 }
 //#endregion
@@ -883,12 +1153,7 @@ async function kbSweepCommand(argv, context) {
 */
 const HELP = `rulvar: durable multi-agent workflows (https://docs.rulvar.com)
 
-  rulvar run <file|name> [--args JSON] [--store PATH] [--budget-usd N]
-  rulvar resume <runId>  [--store PATH]
-  rulvar runs ls         [--store PATH]
-  rulvar inspect <runId> [--store PATH]
-  rulvar plan "<goal>"   [--dry-run]
-  rulvar kb <list | inbox | gate | sweep>
+${helpCommandLines().map((line) => `  ${line}`).join("\n")}
 
 Engine assembly: adapters, defaults, and the workflow registry come from
 rulvar.config.mjs in the working directory (default export
@@ -896,13 +1161,18 @@ rulvar.config.mjs in the working directory (default export
 exports. --store selects the JsonlFileStore directory (default .rulvar).
 plan asks the planner model (role plan) to write a workflow script,
 lints and self-repairs it, then runs it in the worker sandbox; --dry-run
-prints the accepted script without running. Requires @rulvar/planner
-installed. kb list shows the per-project claim store
+prints the accepted script without running. Both stages are paid runs
+with their own immutable ceilings: --planning-budget-usd caps the
+planning run, --budget-usd caps the execution run, and a missing
+ceiling fails loudly unless --allow-unbounded waives it explicitly.
+Requires @rulvar/planner installed. kb list shows the per-project claim store
 (./rulvar.models.json) with full provenance. kb sweep runs the
 falsification matrix from the kbSweep section of rulvar.config.mjs
 (fixed pool UNIONED with every model carrying an active negative claim
 plus the re-measure queue; optional canary probes flip drifted claims
-stale first; requires @rulvar/evals installed). kb inbox aggregates
+stale first; kbSweep.budgets sets per-run ceilings plus the maxTotalUsd
+envelope, required unless allowUnbounded waives it; requires
+@rulvar/evals installed). kb inbox aggregates
 kb_propose proposals from finished runs (14 day TTL); kb gate turns one
 inbox proposal into a committed claim behind a human attestation
 (--approver and --ruled-out are mandatory). inbox and gate require
@@ -919,7 +1189,7 @@ async function runCli(argv, options) {
 			case "resume": return await resumeCommand(rest, context);
 			case "runs": {
 				const [sub, ...subRest] = rest;
-				if (sub !== "ls") throw new ConfigError("usage: rulvar runs ls [--store PATH] (no aliases in v1)");
+				if (sub !== "ls") throw new ConfigError(usageOf(GRAMMAR["runs ls"]));
 				return await runsLsCommand(subRest, context);
 			}
 			case "inspect": return await inspectCommand(rest, context);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/cli",
-  "version": "1.16.2",
+  "version": "1.18.0",
   "description": "Rulvar shell: run/resume/runs/inspect/plan/kb commands, TUI progress, createServer, createWorker, OTel exporter.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,17 +22,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.16.2"
+    "@rulvar/core": "1.18.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "tsdown": "^0.22.3",
     "typescript": "~6.0.3",
-    "@rulvar/testing": "1.16.2",
-    "@rulvar/planner": "1.16.2",
-    "@rulvar/store-sqlite": "1.16.2",
-    "@rulvar/plan": "1.16.2",
-    "@rulvar/evals": "1.16.2"
+    "@rulvar/planner": "1.18.0",
+    "@rulvar/plan": "1.18.0",
+    "@rulvar/store-sqlite": "1.18.0",
+    "@rulvar/evals": "1.18.0",
+    "@rulvar/testing": "1.18.0"
   },
   "bin": {
     "rulvar": "./dist/cli.js"