@rulvar/cli 1.2.0 → 1.3.1

package/dist/{dist-Cdj5YBRG.js → dist-hv4J07hq.js}

@@ -86992,7 +86992,7 @@ var require_eslint_helpers = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	*/
 	async function globMatch({ basePath, pattern }) {
 		let found = false;
-		const { hfs } = await import("./src-BA7JP7vn.js");
+		const { hfs } = await import("./src-pbHnkjmy.js");
 		const patternToUse = normalizeToPosix(path$9.relative(basePath, pattern));
 		const matcher = new Minimatch(patternToUse, MINIMATCH_OPTIONS);
 		const walkSettings = {
@@ -87040,7 +87040,7 @@ var require_eslint_helpers = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 			return new Minimatch(patternToUse, MINIMATCH_OPTIONS);
 		});
 		const unmatchedPatterns = /* @__PURE__ */ new Set([...relativeToPatterns.keys()]);
-		const { hfs } = await import("./src-BA7JP7vn.js");
+		const { hfs } = await import("./src-pbHnkjmy.js");
 		const walk = hfs.walk(basePath, {
 			async directoryFilter(entry) {
 				if (!matchers.some((matcher) => matcher.match(entry.path, true))) return false;
@@ -94921,7 +94921,7 @@ const duplicateIdenticalCall = {
 	meta: {
 		type: "suggestion",
 		docs: { description: "advisory: byte-identical ctx.agent/ctx.workflow calls in one function forward-match to ONE journal entry; pass opts.key to distinguish deliberate repeats" },
-		messages: { duplicateCall: "this call is byte-identical to an earlier one in the same function; identical calls share one journal entry via forward-matching, so a deliberate repeat needs a distinguishing opts.key (docs/03, section 7.3)" },
+		messages: { duplicateCall: "this call is byte-identical to an earlier one in the same function; identical calls share one journal entry via forward-matching, so a deliberate repeat needs a distinguishing opts.key" },
 		schema: []
 	},
 	create(context) {
@@ -95229,7 +95229,7 @@ var WorkerSandboxRunner = class {
 		this.workerUrl = options?.workerUrl ?? new URL("./sandbox-worker.js", import.meta.url);
 	}
 	async execute(wf, ctx, args) {
-		if (wf.kind !== "compiled-workflow") throw new ConfigError("WorkerSandboxRunner executes CompiledWorkflow values only; closures run in process (docs/06, section \"Script runners\")");
+		if (wf.kind !== "compiled-workflow") throw new ConfigError("WorkerSandboxRunner executes CompiledWorkflow values only; closures run in process ");
 		const argsJson = toJournalValue(args ?? null, "sandbox workflow args");
 		const channel = new MessageChannel();
 		const worker = new Worker(this.workerUrl, { resourceLimits: { maxOldGenerationSizeMb: this.memoryMb } });

package/dist/index.d.ts

@@ -16,7 +16,7 @@ interface CliIo {
 declare function processIo(): CliIo;
 //#endregion
 //#region src/cli-main.d.ts
-declare const HELP = "rulvar: durable multi-agent workflows (docs/06, section 10.5)\n\n  rulvar run <file|name> [--args JSON] [--store PATH] [--budget-usd N]\n  rulvar resume <runId>  [--store PATH]\n  rulvar runs ls         [--store PATH]\n  rulvar inspect <runId> [--store PATH]\n  rulvar plan \"<goal>\"   [--dry-run]\n  rulvar kb <list | inbox | sweep>\n\nEngine assembly: adapters, defaults, and the workflow registry come from\nrulvar.config.mjs in the working directory (default export\n{ engineOptions?, workflows? }) or from the workflow module's named\nexports. --store selects the JsonlFileStore directory (default .rulvar).\nplan asks the planner model (role plan) to write a workflow script,\nlints and self-repairs it, then runs it in the worker sandbox; --dry-run\nprints the accepted script without running. Requires @rulvar/planner\ninstalled. kb list shows the per-project claim store\n(./rulvar.models.json) with full provenance. kb sweep runs the\nfalsification matrix from the kbSweep section of rulvar.config.mjs\n(fixed pool UNIONED with every model carrying an active negative claim\nplus the re-measure queue; optional canary probes flip drifted claims\nstale first; requires @rulvar/evals installed). kb inbox arrives with\nModelKnowledge phase 3.";
+declare const HELP = "rulvar: durable multi-agent workflows (https://docs.rulvar.com)\n\n  rulvar run <file|name> [--args JSON] [--store PATH] [--budget-usd N]\n  rulvar resume <runId>  [--store PATH]\n  rulvar runs ls         [--store PATH]\n  rulvar inspect <runId> [--store PATH]\n  rulvar plan \"<goal>\"   [--dry-run]\n  rulvar kb <list | inbox | sweep>\n\nEngine assembly: adapters, defaults, and the workflow registry come from\nrulvar.config.mjs in the working directory (default export\n{ engineOptions?, workflows? }) or from the workflow module's named\nexports. --store selects the JsonlFileStore directory (default .rulvar).\nplan asks the planner model (role plan) to write a workflow script,\nlints and self-repairs it, then runs it in the worker sandbox; --dry-run\nprints the accepted script without running. Requires @rulvar/planner\ninstalled. kb list shows the per-project claim store\n(./rulvar.models.json) with full provenance. kb sweep runs the\nfalsification matrix from the kbSweep section of rulvar.config.mjs\n(fixed pool UNIONED with every model carrying an active negative claim\nplus the re-measure queue; optional canary probes flip drifted claims\nstale first; requires @rulvar/evals installed). kb inbox arrives with\nModelKnowledge phase 3.";
 declare function runCli(argv: string[], options: {
   cwd: string;
   io: CliIo;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-poGpn70r.js";
+import { a as resumeCommand, c as driveRun, d as renderEventLine, f as DEFAULT_STORE_DIR, g as looksLikeFile, h as loadWorkflowModule, i as inspectCommand, l as reportOutcome, m as loadCliConfig, n as HELP, o as runCommand, p as assembleEngine, r as runCli, s as runsLsCommand, t as processIo, u as attachProgress } from "./io-nATg3Bhx.js";
 import { ConfigError, InvalidResolutionError, JournalCompatibilityError, LeaseHeldError, Replayer, RulvarError, buildDeriverRegistry, costReportFromJournal, maskSecrets, normalizeEntry, scanJournalCompatibility, validateSchemaSpec } from "@rulvar/core";
 //#region src/server.ts
 /**
@@ -139,7 +139,7 @@ function createServer(options) {
 		const workflow = workflows[name];
 		if (workflow === void 0) return json(400, { error: {
 			code: "config",
-			message: `no workflow named '${name}' in the registry (docs/06, section 10.4)`
+			message: `no workflow named '${name}' in the registry`
 		} });
 		const runOptions = {
 			...body.options?.runId === void 0 ? {} : { runId: body.options.runId },
@@ -477,8 +477,8 @@ function workerIdentity() {
 }
 function createWorker(engine, options) {
 	const store = options.store;
-	if (!(typeof store.acquire === "function" && typeof store.renew === "function" && typeof store.release === "function")) throw new ConfigError("createWorker requires a LeasableStore (acquire/renew/release with fencing epochs); the supplied store has no lease capability (docs/03, section 12.3). Use @rulvar/store-sqlite or another conformant LeasableStore.");
-	if (engine.stores.journal !== store) throw new ConfigError("createWorker must lease the SAME journal store the engine writes (engine.stores.journal); leasing a different store would fence nothing (docs/02, section 8.3; docs/06, 10.2)");
+	if (!(typeof store.acquire === "function" && typeof store.renew === "function" && typeof store.release === "function")) throw new ConfigError("createWorker requires a LeasableStore (acquire/renew/release with fencing epochs); the supplied store has no lease capability. Use @rulvar/store-sqlite or another conformant LeasableStore.");
+	if (engine.stores.journal !== store) throw new ConfigError("createWorker must lease the SAME journal store the engine writes (engine.stores.journal); leasing a different store would fence nothing");
 	const concurrency = options.concurrency ?? 1;
 	if (!Number.isInteger(concurrency) || concurrency < 1) throw new ConfigError(`createWorker concurrency must be a positive integer, got ${concurrency}`);
 	const owner = options.owner ?? workerIdentity();

package/dist/{io-poGpn70r.js → io-nATg3Bhx.js}

@@ -1,4 +1,4 @@
-import { ConfigError, FileModelKnowledgeStore, JsonlFileStore, claimExpired, compilePermissionPreset, costReportFromJournal, createEngine, parseModelRef, priceUsdOf, remeasureQueue, resolvePricing, runProfile } from "@rulvar/core";
+import { ConfigError, FileModelKnowledgeStore, INBOX_PROPOSAL_TTL_DAYS, JsonlFileStore, claimExpired, claimExpiry, compilePermissionPreset, costReportFromJournal, createEngine, parseModelRef, priceUsdOf, proposalStatement, remeasureQueue, resolvePricing, runProfile } from "@rulvar/core";
 import { parseArgs } from "node:util";
 import { join, resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
@@ -373,7 +373,7 @@ async function resumeCommand(argv, context) {
 	if (meta === void 0) throw new ConfigError(`run '${runId}' not found in the store`);
 	const name = meta.workflowName;
 	const workflow = name === void 0 ? void 0 : assembled.workflows[name];
-	if (workflow === void 0) throw new ConfigError(`run '${runId}' was started from workflow '${name ?? "(unknown)"}'; register it under that name in rulvar.config.mjs workflows to resume (docs/06, section 10.2: resume requires the in-process workflow value)`);
+	if (workflow === void 0) throw new ConfigError(`run '${runId}' was started from workflow '${name ?? "(unknown)"}'; register it under that name in rulvar.config.mjs workflows to resume (resume requires the in-process workflow value)`);
 	const first = assembled.engine.resume(runId, workflow, { args });
 	return reportOutcome(await driveRun({
 		engine: assembled.engine,
@@ -456,7 +456,7 @@ async function planCommand(argv, context) {
 	if (goal === void 0 || parsed.positionals.length > 1) throw new ConfigError("usage: rulvar plan \"<goal>\" [--dry-run]");
 	let plannerModule;
 	try {
-		plannerModule = await import("./dist-Cdj5YBRG.js");
+		plannerModule = await import("./dist-hv4J07hq.js");
 	} catch {
 		throw new ConfigError("rulvar plan requires @rulvar/planner (the plan agent, compileScript, and the worker sandbox live there); install it next to the CLI");
 	}
@@ -487,15 +487,14 @@ async function planCommand(argv, context) {
 * consumption path. Claims with full provenance for the humans who
 * author ladders, floors, and profiles; no run and no pin, so model
 * names render VERBATIM here (only in-run cards are nameless). Reads
-* the per-project file store (./rulvar.models.json). The grammar
-* members inbox (phase 3) and sweep (phase 2) fail loudly until their
-* phases ship.
+* the per-project file store (./rulvar.models.json).
 */
 async function kbCommand(argv, context) {
 	const [sub, ...rest] = argv;
-	if (sub === "inbox") throw new ConfigError("rulvar kb inbox arrives with ModelKnowledge phase 3 (M12, gated by the measured-value checkpoint; docs/05, section \"Phases and placement\")");
+	if (sub === "inbox") return await kbInboxCommand(rest, context);
+	if (sub === "gate") return await kbGateCommand(rest, context);
 	if (sub === "sweep") return await kbSweepCommand(rest, context);
-	if (sub !== "list" || rest.length > 0) throw new ConfigError("usage: rulvar kb <list | inbox | sweep> (no aliases in v1)");
+	if (sub !== "list" || rest.length > 0) throw new ConfigError("usage: rulvar kb <list | inbox | gate | sweep> (no aliases in v1)");
 	const snapshot = await new FileModelKnowledgeStore({ path: join(context.cwd, "rulvar.models.json") }).current();
 	context.io.out(`knowledge store: rulvar.models.json (version ${String(snapshot.version)}, ${String(snapshot.claims.length)} claim${snapshot.claims.length === 1 ? "" : "s"})`);
 	renderKbList(snapshot, context);
@@ -517,6 +516,248 @@ function renderKbList(snapshot, context) {
 	}
 }
 /**
+* rulvar kb inbox (M12-T03): aggregates kb_propose-born proposals from
+* FINISHED runs through the RunLedger fold behind the LedgerExport
+* seam. Grouping of matching (subject, taskClass, polarity) triples is
+* STRICTLY display: the command writes nothing, authorizes no spend,
+* and schedules no sweeps; gating a proposal into a claim is the
+* separate human gate flow. The age anchor is the run's terminal
+* updatedAt (journal entries carry no wall clock by design): proposals
+* of runs finished more than fourteen days ago expire out of the view.
+* This is the human review surface, so the quarantined note text and
+* concrete model names render here VERBATIM, exactly like kb list.
+*/
+async function kbInboxCommand(argv, context) {
+	const flags = parseCommonFlags(argv);
+	if (flags.positionals.length > 0) throw new ConfigError("usage: rulvar kb inbox [--store PATH]");
+	let plan;
+	try {
+		plan = await import("./dist-DIqBj4U-.js");
+	} catch {
+		throw new ConfigError("rulvar kb inbox requires @rulvar/plan (the RunLedger fold behind the LedgerExport seam)");
+	}
+	const assembled = assembleEngine({
+		config: await loadCliConfig(context.cwd),
+		...flags.store === void 0 ? {} : { storePath: flags.store },
+		cwd: context.cwd
+	});
+	const finished = (await assembled.store.listRuns()).filter((meta) => meta.status !== "running");
+	const cutoffMs = Date.now() - INBOX_PROPOSAL_TTL_DAYS * 24 * 60 * 60 * 1e3;
+	const groups = /* @__PURE__ */ new Map();
+	let expired = 0;
+	for (const meta of finished) {
+		const entries = await assembled.store.load(meta.runId);
+		const view = plan.foldLedger(entries, {
+			ledgerScope: "",
+			planScope: "plan"
+		});
+		for (const row of view.observations) {
+			if (row.subject === void 0 || row.polarity === void 0 || row.trigger === void 0) continue;
+			if (Date.parse(meta.updatedAt) < cutoffMs) {
+				expired += 1;
+				continue;
+			}
+			const key = [
+				row.subject.model,
+				row.subject.effort ?? "",
+				row.taskClass,
+				row.polarity
+			].join("|");
+			const group = groups.get(key) ?? {
+				subject: row.subject,
+				taskClass: row.taskClass,
+				polarity: row.polarity,
+				members: []
+			};
+			group.members.push({
+				runId: meta.runId,
+				runLabel: meta.name ?? meta.workflowName ?? "",
+				entryRef: row.entryRef,
+				logicalTaskId: row.logicalTaskId,
+				...row.tierObserved === void 0 ? {} : { tierObserved: row.tierObserved },
+				trigger: row.trigger,
+				note: row.note,
+				evidenceRefs: row.evidenceRefs,
+				finishedAt: meta.updatedAt
+			});
+			groups.set(key, group);
+		}
+	}
+	const total = [...groups.values()].reduce((sum, group) => sum + group.members.length, 0);
+	context.io.out(`kb inbox: ${String(total)} live proposal${total === 1 ? "" : "s"} in ${String(groups.size)} group${groups.size === 1 ? "" : "s"} across ${String(finished.length)} finished run${finished.length === 1 ? "" : "s"}` + (expired > 0 ? `; ${String(expired)} expired (older than 14 days)` : ""));
+	for (const key of [...groups.keys()].sort()) {
+		const group = groups.get(key);
+		const effort = group.subject.effort === void 0 ? "" : ` effort=${group.subject.effort}`;
+		context.io.out(`${group.subject.model}${effort} :: ${group.taskClass} ${group.polarity} (${String(group.members.length)} proposal${group.members.length === 1 ? "" : "s"})`);
+		context.io.out(`  statement: ${proposalStatement({
+			taskClass: group.taskClass,
+			polarity: group.polarity,
+			trigger: group.members[0].trigger
+		})}`);
+		for (const member of group.members) {
+			const tier = member.tierObserved === void 0 ? "" : ` tier=${String(member.tierObserved)}`;
+			const label = member.runLabel === "" ? "" : ` (${member.runLabel})`;
+			context.io.out(`  - run=${member.runId}${label}#${String(member.entryRef)}${tier} trigger=${member.trigger} lineage=${member.logicalTaskId} finished=${member.finishedAt}`);
+			if (member.note !== "") context.io.out(`    note: ${member.note}`);
+			if (member.evidenceRefs.length > 0) context.io.out(`    evidence: ${member.evidenceRefs.map((ref) => `#${String(ref)}`).join(", ")}`);
+		}
+	}
+	return 0;
+}
+const RULED_OUT_VOCABULARY = [
+	"prompt",
+	"tools",
+	"difficulty",
+	"transient-provider"
+];
+/**
+* rulvar kb gate (M12-T04): the human gate turning ONE inbox proposal
+* into a human-editorial claim. The attribution attestation is
+* mandatory by construction: without --ruled-out the GateRecord does
+* not assemble and nothing is written. The born claim carries the
+* typed template statement (never the quarantined note), the origin
+* provenance back to the proposing run, evidence resolving into that
+* run's journal, and the editorial TTL; the commit is CAS against the
+* per-project file store, whose git review is the authenticating gate.
+*/
+async function kbGateCommand(argv, context) {
+	const { values, positionals } = parseArgs({
+		args: argv,
+		allowPositionals: true,
+		options: {
+			store: { type: "string" },
+			approver: { type: "string" },
+			"ruled-out": { type: "string" },
+			"contrast-run": { type: "string" },
+			"contrast-eval": { type: "string" },
+			confidence: { type: "string" }
+		}
+	});
+	const usage = "usage: rulvar kb gate <runId> <entryRef> --approver NAME --ruled-out a,b,c [--contrast-run runId#seq | --contrast-eval reportId:caseId[,caseId...]] [--confidence high|medium|low] [--store PATH]";
+	const runId = positionals[0];
+	const entryRefRaw = positionals[1];
+	if (runId === void 0 || entryRefRaw === void 0 || positionals.length > 2) throw new ConfigError(usage);
+	const entryRef = Number(entryRefRaw);
+	if (!Number.isInteger(entryRef) || entryRef < 1) throw new ConfigError(`entryRef must be a positive integer entry seq, got '${entryRefRaw}'`);
+	const approver = values.approver;
+	if (approver === void 0 || approver === "") throw new ConfigError(`--approver is required: the attestation names its human. ${usage}`);
+	const ruledOutRaw = values["ruled-out"];
+	if (ruledOutRaw === void 0 || ruledOutRaw === "") throw new ConfigError(`--ruled-out is required: the attribution attestation lists the alternative causes you ruled out (${RULED_OUT_VOCABULARY.join(", ")}). ${usage}`);
+	const ruledOut = ruledOutRaw.split(",").map((entry) => entry.trim());
+	for (const entry of ruledOut) if (!RULED_OUT_VOCABULARY.includes(entry)) throw new ConfigError(`--ruled-out '${entry}' is not in the attestation vocabulary (${RULED_OUT_VOCABULARY.join(", ")})`);
+	if (values["contrast-run"] !== void 0 && values["contrast-eval"] !== void 0) throw new ConfigError("--contrast-run and --contrast-eval are mutually exclusive");
+	let contrastEvidence;
+	if (values["contrast-run"] !== void 0) {
+		const [contrastRun, seqRaw, ...tail] = values["contrast-run"].split("#");
+		const seq = Number(seqRaw);
+		if (contrastRun === void 0 || contrastRun === "" || tail.length > 0 || !Number.isInteger(seq) || seq < 1) throw new ConfigError("--contrast-run must look like 'runId#seq'");
+		contrastEvidence = {
+			kind: "journal",
+			runId: contrastRun,
+			entryRef: seq
+		};
+	}
+	if (values["contrast-eval"] !== void 0) {
+		const [reportId, caseList, ...tail] = values["contrast-eval"].split(":");
+		const caseIds = (caseList ?? "").split(",").filter((entry) => entry !== "");
+		if (reportId === void 0 || reportId === "" || tail.length > 0 || caseIds.length === 0) throw new ConfigError("--contrast-eval must look like 'reportId:caseId[,caseId...]'");
+		contrastEvidence = {
+			kind: "eval",
+			reportId,
+			caseIds
+		};
+	}
+	const confidence = values.confidence ?? "medium";
+	if (![
+		"high",
+		"medium",
+		"low"
+	].includes(confidence)) throw new ConfigError(`--confidence must be high, medium or low, got '${String(values.confidence)}'`);
+	let plan;
+	try {
+		plan = await import("./dist-DIqBj4U-.js");
+	} catch {
+		throw new ConfigError("rulvar kb gate requires @rulvar/plan (the RunLedger fold behind the LedgerExport seam)");
+	}
+	const assembled = assembleEngine({
+		config: await loadCliConfig(context.cwd),
+		...values.store === void 0 ? {} : { storePath: values.store },
+		cwd: context.cwd
+	});
+	const meta = (await assembled.store.listRuns()).find((candidate) => candidate.runId === runId);
+	if (meta === void 0) throw new ConfigError(`run '${runId}' not found in the store`);
+	if (meta.status === "running") throw new ConfigError(`run '${runId}' is still running; proposals gate from finished runs`);
+	if (Date.parse(meta.updatedAt) < Date.now() - INBOX_PROPOSAL_TTL_DAYS * 24 * 60 * 60 * 1e3) throw new ConfigError(`the proposal expired: run '${runId}' finished ${meta.updatedAt}, and inbox entries expire after ${String(INBOX_PROPOSAL_TTL_DAYS)} days`);
+	const entries = await assembled.store.load(runId);
+	const proposal = plan.foldLedger(entries, {
+		ledgerScope: "",
+		planScope: "plan"
+	}).observations.find((row) => row.entryRef === entryRef);
+	if (proposal === void 0 || proposal.subject === void 0 || proposal.polarity === void 0 || proposal.trigger === void 0) throw new ConfigError(`run '${runId}' entry ${String(entryRef)} is not a kb_propose proposal (see rulvar kb inbox for the gateable entries)`);
+	const store = new FileModelKnowledgeStore({ path: join(context.cwd, "rulvar.models.json") });
+	const snapshot = await store.current();
+	const already = snapshot.claims.find((claim) => claim.origin?.kind === "kb-proposal" && claim.origin.runId === runId && claim.origin.entryRef === entryRef && claim.status === "active");
+	if (already !== void 0) throw new ConfigError(`this proposal is already gated as claim '${already.id}' (supersede is the edit path)`);
+	const observedAt = meta.updatedAt;
+	const evidence = proposal.evidenceRefs.length > 0 ? proposal.evidenceRefs.map((ref) => ({
+		kind: "journal",
+		runId,
+		entryRef: ref
+	})) : [{
+		kind: "journal",
+		runId,
+		entryRef
+	}];
+	const claim = {
+		id: `kb-proposal-${runId}-${String(entryRef)}`,
+		subject: {
+			model: proposal.subject.model,
+			...proposal.subject.effort === void 0 ? {} : { effort: proposal.subject.effort }
+		},
+		taskClass: proposal.taskClass,
+		polarity: proposal.polarity,
+		statement: proposalStatement({
+			taskClass: proposal.taskClass,
+			polarity: proposal.polarity,
+			trigger: proposal.trigger
+		}),
+		class: "human-editorial",
+		status: "active",
+		evidence,
+		confidence,
+		observedAt,
+		expiresAt: claimExpiry("human-editorial", proposal.polarity, observedAt),
+		author: {
+			kind: "human",
+			id: approver
+		},
+		origin: {
+			kind: "kb-proposal",
+			runId,
+			entryRef
+		}
+	};
+	const gate = {
+		kind: "human",
+		approver,
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		attribution: {
+			ruledOut,
+			...contrastEvidence === void 0 ? {} : { contrastEvidence }
+		}
+	};
+	const version = await store.commit([{
+		op: "add",
+		claim,
+		gate
+	}], snapshot.version);
+	context.io.out(`gated: ${claim.id} (store version ${String(version)}); the git review of rulvar.models.json is the authenticating gate`);
+	context.io.out(`  ${claim.subject.model}${claim.subject.effort === void 0 ? "" : ` effort=${claim.subject.effort}`} :: ${claim.taskClass} ${claim.polarity}`);
+	context.io.out(`  ${claim.statement}`);
+	context.io.out(`  origin: kb-proposal run=${runId}#${String(entryRef)} expires=${claim.expiresAt}`);
+	return 0;
+}
+/**
 * rulvar kb sweep (M11-T05):
 * falsification sweeps, run manually, from CI, or from a user cron,
 * NEVER engine-scheduled. The matrix is the config's FIXED pool
@@ -530,7 +771,7 @@ async function kbSweepCommand(argv, context) {
 	if (argv.length > 0) throw new ConfigError("usage: rulvar kb sweep (configuration lives in rulvar.config.mjs)");
 	const config = await loadCliConfig(context.cwd);
 	const sweep = config.kbSweep;
-	if (sweep === void 0) throw new ConfigError("rulvar kb sweep requires a kbSweep section in rulvar.config.mjs ({ committerId, models, cases }; docs/05, section 'Grounding and decay')");
+	if (sweep === void 0) throw new ConfigError("rulvar kb sweep requires a kbSweep section in rulvar.config.mjs ({ committerId, models, cases })");
 	let evals;
 	try {
 		evals = await import("./dist-M-vPRtBM.js");
@@ -609,7 +850,7 @@ async function kbSweepCommand(argv, context) {
 * Command dispatch for the canonical grammar (https://docs.rulvar.com/guide/cli):
 * no aliases in v1; unknown commands and flags fail loudly with usage.
 */
-const HELP = `rulvar: durable multi-agent workflows (docs/06, section 10.5)
+const HELP = `rulvar: durable multi-agent workflows (https://docs.rulvar.com)
 
   rulvar run <file|name> [--args JSON] [--store PATH] [--budget-usd N]
   rulvar resume <runId>  [--store PATH]

package/dist/{src-BA7JP7vn.js → src-pbHnkjmy.js}

@@ -1,4 +1,4 @@
-import { t as __esmMin } from "./dist-Cdj5YBRG.js";
+import { t as __esmMin } from "./dist-hv4J07hq.js";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import nativeFsp from "node:fs/promises";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/cli",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "rulvar shell: run/resume/runs/inspect/plan/kb commands, TUI progress, createServer, createWorker, OTel exporter.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,17 +22,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.2.0"
+    "@rulvar/core": "1.3.1"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "tsdown": "^0.22.3",
     "typescript": "~6.0.3",
-    "@rulvar/testing": "1.2.0",
-    "@rulvar/store-sqlite": "1.2.0",
-    "@rulvar/planner": "1.2.0",
-    "@rulvar/evals": "1.2.0",
-    "@rulvar/plan": "1.2.0"
+    "@rulvar/testing": "1.3.1",
+    "@rulvar/plan": "1.3.1",
+    "@rulvar/store-sqlite": "1.3.1",
+    "@rulvar/planner": "1.3.1",
+    "@rulvar/evals": "1.3.1"
   },
   "bin": {
     "rulvar": "./dist/cli.js"