@skillstech/thunderlang 0.1.7 → 0.2.0

package/src/cli.mjs

@@ -7,7 +7,7 @@
 //
 //   thunder check   <file>                      parse + semantic diagnostics (exit 1 on error)
 //   thunder graph   <file> [--out .intent]      contract-graph.json + architecture-graph.json
-//   intent proof   <file> [--out .intent]      .intent-proof.json
+//   intent proof   <file> [--out .intent]      .thunder-proof.json
 //   intent build   <file> [--out .intent] [--no-ai]   all artifacts + docs + mermaid + testplan
 //
 // --no-ai is the default and only mode today; the flag is accepted for forward-compatibility.
@@ -39,18 +39,49 @@ import { liftSource, liftAll, liftRepo, languageForFile } from './lift.mjs';
 import { approveIntent, checkDrift, buildDriftHandoff } from './drift.mjs';
 import { buildMissionIndex } from './atlas.mjs';
 import { parseSelection, regionMetrics, selectCandidate } from './select.mjs';
-import { buildIntentGraph } from './intent-graph.mjs';
+import { buildIntentGraph, safeGraph } from './intent-graph.mjs';
 import { buildAtlas, searchAtlas, expandNode } from './intent-atlas.mjs';
 import { buildFocusGraph, intentBrief, makeScope } from './focus.mjs';
 import { comprehensionLevel, comprehensionReport, LEVELS as COMPREHENSION_LEVELS } from './comprehension.mjs';
 import { twelveFactorReport } from './twelve-factor.mjs';
 import { GENERATORS } from './codegen.mjs';
 import { changeReport } from './changes.mjs';
-import { execSync } from 'node:child_process';
+import { execSync, spawnSync } from 'node:child_process';
 import { diffGraphs, mergeGraphs } from './semantic-diff.mjs';
 import { applyWaivers, governanceDiagnostics } from './governance.mjs';
 import { exportIntent, EXPORT_FORMATS } from './exporters.mjs';
 import { evaluateDecision, simulateLifecycle } from './runtime.mjs';
+import { runProperties } from './property.mjs';
+import { runMutations } from './mutate.mjs';
+import { buildConformance } from './conformance.mjs';
+import { semanticCoverage } from './coverage.mjs';
+import { runTypescriptTarget } from './target-ts.mjs';
+import { runPythonTarget, pythonAvailable } from './target-py.mjs';
+import { runCSharpTarget, csharpAvailable } from './target-cs.mjs';
+import { runJavaTarget, javaAvailable } from './target-java.mjs';
+
+// The live-target registry: one entry per canonical target that can be compiled + executed.
+// `available()` is a (cached) toolchain probe; TypeScript/JS runs in-process so it is always live.
+const LIVE_TARGETS = [
+  { key: 'typescript', run: runTypescriptTarget, available: () => true },
+  { key: 'python', run: runPythonTarget, available: pythonAvailable },
+  { key: 'csharp', run: runCSharpTarget, available: csharpAvailable },
+  { key: 'java', run: runJavaTarget, available: javaAvailable },
+];
+const LIVE_BY_KEY = new Map(LIVE_TARGETS.map((t) => [t.key, t]));
+LIVE_BY_KEY.set('javascript', LIVE_BY_KEY.get('typescript')); // js is the same in-process runner
+// All canonical targets available to run right now (used by --all-targets).
+const availableLiveTargets = () => LIVE_TARGETS.filter((t) => t.available());
+const RUNNABLE_TARGETS = new Set(['typescript', 'ts', 'javascript', 'js', 'python', 'py', 'csharp', 'cs', 'c#', 'java']);
+// Map an alias to its canonical target key + the adapter that executes it.
+const TARGET_ALIASES = { ts: 'typescript', js: 'javascript', py: 'python', cs: 'csharp', 'c#': 'csharp' };
+const canonicalTarget = (t) => TARGET_ALIASES[String(t).toLowerCase()] || String(t).toLowerCase();
+// Execute a live target. Returns { "Test / case": actual } or null if the target can't run
+// (e.g. the runtime/SDK is not installed). Unknown targets return null.
+function runLiveTarget(ast, target) {
+  const entry = LIVE_BY_KEY.get(canonicalTarget(target));
+  return entry ? entry.run(ast) : null;
+}
 import { importIntent, importReport, detectFormat, IMPORT_FORMATS } from './importers.mjs';
 import { runTests } from './testing.mjs';
 import { evaluateOutcomes } from './outcome.mjs';
@@ -98,6 +129,77 @@ function collectIntents(root, acc = []) {
   return acc;
 }
 
+// Resolve every guarantee/never obligation against the SPECIFIC test that verifies it.
+// Shared by `thunder test --contracts` and `thunder prove` so both agree per-claim.
+// States: verified (proven by a passing named test), failed (its test fails), declared
+// (a verification is named/classified but not runnable in-file), unverified (nothing).
+function resolveObligations(ast) {
+  const t = runTests(ast);
+  const testPass = new Map();
+  for (const res of (t.results || [])) {
+    const cur = testPass.get(res.target);
+    testPass.set(res.target, cur === undefined ? !!res.pass : cur && !!res.pass);
+  }
+  const norm = (s) => String(s).toLowerCase().replace(/[^a-z0-9]/g, '');
+  const matchTest = (verifyText) => {
+    const v = norm(verifyText); if (!v) return null;
+    for (const [name, pass] of testPass) { const n = norm(name); if (n && (n === v || n.includes(v) || v.includes(n))) return { name, pass }; }
+    return null;
+  };
+  const build = (kind, o) => {
+    const verify = o.verify || [];
+    const kinds = [...new Set((o.verifications || []).map((v) => v.kind).filter((k) => k && k !== 'unclassified'))];
+    let status, provenBy = null;
+    if (!verify.length) status = 'unverified';
+    else {
+      let m = null;
+      for (const vt of verify) { const x = matchTest(vt); if (x) { m = x; if (!x.pass) break; } }
+      if (m) { status = m.pass ? 'verified' : 'failed'; provenBy = m.name; } else status = 'declared';
+    }
+    return { kind, id: o.id, text: o.statement, status, verify, kinds, provenBy };
+  };
+  const obligations = [
+    ...ast.guarantees.map((g) => build('guarantee', g)),
+    ...ast.neverRules.map((n) => build('prohibition', n)),
+  ];
+  const count = (s) => obligations.filter((o) => o.status === s).length;
+  return { obligations, tests: t, verified: count('verified'), declared: count('declared'), unverified: count('unverified'), failed: count('failed') };
+}
+
+// Proof freshness: a proof is valid only for a specific (intent, implementation, dependencies,
+// compiler, environment) tuple. These helpers capture that tuple so `verify` can mark a proof STALE.
+const gitCmd = (c) => { try { return execSync(`git ${c}`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] }).trim() || null; } catch { return null; } };
+const LOCKFILES = ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock', 'poetry.lock', 'Pipfile.lock', 'Cargo.lock', 'go.sum', 'Gemfile.lock', 'composer.lock'];
+function findLockfile(startDir) {
+  let dir = startDir || '.';
+  for (let i = 0; i < 6; i++) {
+    for (const lf of LOCKFILES) { const p = join(dir, lf); if (existsSync(p)) return p; }
+    const parent = dirname(dir); if (parent === dir) break; dir = parent;
+  }
+  return null;
+}
+function freshnessFor(file, proof, envName) {
+  const dir = dirname(file) || '.';
+  const lock = findLockfile(dir);
+  return {
+    intentHash: proof.sourceHash,
+    compilerVersion: proof.compilerVersion,
+    implementation: gitCmd('rev-parse HEAD'),
+    dependencies: lock ? { file: basename(lock), hash: sha256(readFileSync(lock, 'utf8')) } : null,
+    environment: envName || null,
+    generatedAt: proof.generatedAt,
+  };
+}
+// Given a proof's recorded freshness, recompute the current tuple and list what has drifted.
+function stalenessReasons(freshness, srcDir) {
+  const reasons = [];
+  if (!freshness) return reasons;
+  if (freshness.implementation) { const now = gitCmd('rev-parse HEAD'); if (now && now !== freshness.implementation) reasons.push(`implementation moved: proof at ${freshness.implementation.slice(0, 7)}, now ${now.slice(0, 7)}`); }
+  if (freshness.dependencies) { const lock = findLockfile(srcDir); const now = lock ? sha256(readFileSync(lock, 'utf8')) : null; if (now && now !== freshness.dependencies.hash) reasons.push(`dependency lockfile changed (${freshness.dependencies.file})`); }
+  if (freshness.compilerVersion && freshness.compilerVersion !== COMPILER_VERSION) reasons.push(`compiler upgraded: proof ${freshness.compilerVersion}, now ${COMPILER_VERSION}`);
+  return reasons;
+}
+
 function parseArgs(argv) {
   const args = { _: [], out: '.intent', noAi: false };
   for (let i = 0; i < argv.length; i++) {
@@ -129,6 +231,19 @@ function parseArgs(argv) {
     else if (a === '--check') args.check = true;
     else if (a === '--schema') args.schema = true;
     else if (a === '--all') args.all = true;
+    else if (a === '--contracts') args.contracts = true;
+    else if (a === '--strict') args.strict = true;
+    else if (a === '--changed') args.changed = true;
+    else if (a === '--properties') args.properties = true;
+    else if (a === '--scenarios') args.scenarios = true;
+    else if (a === '--mutate') args.mutate = true;
+    else if (a === '--safe') args.safe = true;
+    else if (a === '--evals') args.evals = true;
+    else if (a === '--coverage') args.coverage = true;
+    else if (a === '--run') args.run = (argv[++i] || '').split(',').map((s) => s.trim()).filter(Boolean);
+    else if (a === '--results') args.results = argv[++i];
+    else if (a === '--cases') args.cases = argv[++i];
+    else if (a === '--seed') args.seed = argv[++i];
     else if (a === '--ir') args.ir = argv[++i];
     else if (a === '--subject') args.subject = argv[++i];
     else if (a === '--lens') args.lens = argv[++i];
@@ -139,6 +254,8 @@ function parseArgs(argv) {
     else if (a === '--learning') args.learning = true;
     else if (a === '--governed') args.governed = true;
     else if (a === '--target') args.target = argv[++i];
+    else if (a === '--all-targets') args.allTargets = true;
+    else if (a === '--env') args.env = argv[++i];
     else if (a === '--brief') args.brief = argv[++i];
     else if (a === '--after') args.after = argv[++i];
     else if (a === '--before') args.before = argv[++i];
@@ -202,12 +319,25 @@ function printDiagnostics(diags) {
   return errors;
 }
 
-const HELP = `thunder , the deterministic ThunderLang compiler (no AI required)
+const HELP = `thunder , the ThunderLang compiler + engine (deterministic, no AI required)
+
+usage: thunder <command> <file> [options]
+       thunder mission <Name> <command>     run any command on a mission by name
 
-usage: intent <command> <file> [options]
+Everyday
+  new [Name]               scaffold a runnable starter mission (Name.thunder)   [alias: init]
+  mission <Name> [cmd]     resolve a mission by name and run a command on it (list | <Name> | <Name> <cmd>)
+  check <file|dir>         parse + lint + explainable diagnostics
+  run <file> --inputs '<json>'         execute the decision(s) deterministically
+  test <file> [--contracts | --properties | --scenarios | --mutate | --evals | --changed | --coverage] [--strict]
+  test <file> --target typescript|python|csharp|java   run the tests against the EXECUTED generated code
+  test <file> --all-targets            run the tests against every AVAILABLE target in one pass
+  prove <file>             emit an intent-proof-v1 artifact (honest verdicts + freshness)
+  verify <proof.json> [src]  re-check a proof; reports STALE when impl/deps/compiler moved
+  build <file>             generate docs, contract graph, test plan, targets
 
 Author & check
-  init [Name]              scaffold a runnable starter mission (Name.intent)
+  init [Name]              scaffold a runnable starter mission (Name.thunder)
   draft --brief <json|->   scaffold a rigorous intent draft + gap checklist from a brief
   check <file|dir> [--json|--format sarif]  diagnostics for one file, or gate a whole dir
   report [dir] [--json]     repo-wide intent health: severity + area counts, coverage
@@ -226,11 +356,12 @@ Author & check
   edit <file> [--edits <json|->] [--set-goal ..] [--add-guarantee ..] [--write]  structural edits, comments kept
   lsp                      start the Language Server (LSP over stdio, for editors)
   mcp                      start the MCP server (for AI coding agents; stdio)
-  build <file>              docs, contract graph, test plan, and .intent-proof.json
-  graph <file>              the canonical Intent Graph (intent-graph-v1)
-  proof <file>              the .intent-proof.json artifact
+  build <file>              docs, contract graph, test plan, and .thunder-proof.json
+  graph <file> [--safe]     the canonical Intent Graph (intent-graph-v1); --safe = display-safe on stdout
+  proof <file>              the .thunder-proof.json artifact
   proof --schema            emit the canonical proof envelope JSON Schema (intent-proof-v1)
   verify <proof.json> [src]  confirm a proof is well-formed and still matches its source
+  conform <file> [--targets a,b] [--run typescript,python,csharp,java | --all-targets] [--results <json>]  run the same cases against every target (conformance matrix)
   schema                    emit the canonical graph schema + diagnostic catalog
   explain <IL-CODE>         explain a diagnostic code (area, severity, what it blocks)
   rules [--json]            list the whole canonical diagnostic catalog
@@ -249,7 +380,7 @@ Execute (no AI, no generated code)
 Interop
   export <file> --format <dmn|bpmn|smv|jsonschema|openapi|tokens|mermaid|css|playwright>   render to a standard format
   import <file> [--format dmn|bpmn] [--json]                 lift DMN/BPMN into intent
-  source <file|graph.json>                                   regenerate .intent from a graph
+  source <file|graph.json>                                   regenerate .thunder from a graph
   migrate <graph.json> [--to <version>]                      upgrade a persisted graph
   validate <graph.json> [--json]                             check a graph is canonical (anti-fork)
 
@@ -292,7 +423,7 @@ function main() {
     console.log(JSON.stringify(intentProofJsonSchema(), null, 2));
     return;
   }
-  // Verify a .intent-proof.json against its source: the source hash still matches (no
+  // Verify a .thunder-proof.json against its source: the source hash still matches (no
   // drift / tampering) and the proof's claims re-derive from the source.
   if (cmd === 'verify') {
     const proofPath = args._[0];
@@ -312,16 +443,22 @@ function main() {
     // Structural gate: the envelope must be a well-formed intent-proof-v1 document first.
     const structure = validateProof(proof);
     const valid = structure.valid && hashMatch && semanticMatch && guaranteesMatch && neverMatch;
-    const result = { schema: 'intent-verify-v1', proof: proofPath, source: srcPath, valid, checks: { wellFormed: structure.valid, hashMatch, semanticMatch, guaranteesMatch, neverMatch }, structureErrors: structure.errors };
-    if (args.json) { console.log(JSON.stringify(result, null, 2)); process.exit(valid ? 0 : 1); return; }
-    console.log(`thunder verify ${basename(proofPath)}: ${valid ? 'VALID' : 'FAILED'} (source ${basename(srcPath)})`);
+    // Freshness: even if the intent still matches, the proof is STALE if the implementation,
+    // dependencies, or compiler moved since it was generated. A stale proof must not read green.
+    const staleReasons = valid ? stalenessReasons(proof.freshness, dirname(srcPath) || '.') : [];
+    const stale = staleReasons.length > 0;
+    const status = !valid ? 'FAILED' : stale ? 'STALE' : 'VALID';
+    const result = { schema: 'intent-verify-v1', proof: proofPath, source: srcPath, valid, stale, status, staleReasons, checks: { wellFormed: structure.valid, hashMatch, semanticMatch, guaranteesMatch, neverMatch }, structureErrors: structure.errors };
+    if (args.json) { console.log(JSON.stringify(result, null, 2)); process.exit(valid && !stale ? 0 : 1); return; }
+    console.log(`thunder verify ${basename(proofPath)}: ${status} (source ${basename(srcPath)})`);
     if (!structure.valid) { console.log(`  X proof is not a well-formed intent-proof-v1 document:`); for (const e of structure.errors) console.log(`      ${e.path || '(root)'}: ${e.message}`); }
     if (!hashMatch) console.log('  X source hash does not match , the source has changed since the proof was generated (drift or tampering).');
     if (!semanticMatch) console.log('  X the proof claims a different semantic result than the source produces now.');
     if (!guaranteesMatch) console.log('  X guarantee count differs from the proof.');
     if (!neverMatch) console.log('  X never-rule count differs from the proof.');
-    if (valid) console.log(`  ok proof matches source (hash + ${(proof.guarantees || []).length} guarantee(s), ${(proof.neverRules || []).length} never-rule(s)).`);
-    process.exit(valid ? 0 : 1);
+    if (stale) { console.log('  ! proof is STALE , the intent still matches, but the world moved since it was generated:'); for (const r of staleReasons) console.log(`      ${r}`); console.log('    regenerate: thunder prove ' + basename(srcPath)); }
+    if (valid && !stale) console.log(`  ok proof matches source and is fresh (hash + ${(proof.guarantees || []).length} guarantee(s), ${(proof.neverRules || []).length} never-rule(s)).`);
+    process.exit(valid && !stale ? 0 : 1);
     return;
   }
 
@@ -571,7 +708,7 @@ function main() {
   }
 
   // Scaffold a runnable starter mission (deterministic, no AI). `thunder init [Name]`.
-  if (cmd === 'init') {
+  if (cmd === 'init' || cmd === 'new') {
     const name = stripSourceExt(file || 'Mission');
     const target = join(args.out && args.out !== '.intent' ? args.out : '.', `${name}.thunder`);
     if (existsSync(target) && !args.force) {
@@ -612,15 +749,61 @@ test Example
 `;
     if (target.includes('/')) mkdirSync(dirname(target), { recursive: true });
     writeFileSync(target, starter);
-    console.log(`thunder init: wrote ${target}`);
+    console.log(`thunder ${cmd}: wrote ${target}`);
     console.log(`  next: thunder check ${target}  |  thunder run ${target} --inputs '{"age":20}'  |  thunder test ${target}`);
     return;
   }
 
-  if (!file && cmd !== 'draft') {
+  if (!file && cmd !== 'draft' && cmd !== 'mission' && !(cmd === 'test' && args.changed)) {
     console.error(`thunder ${cmd}: missing a file argument. Run "intent help" for usage.`);
     process.exit(2);
   }
+
+  // `thunder mission <Name> [<verb> ...]` , noun-first ergonomics: resolve a mission by name
+  // anywhere in the project, then run any verb on it without typing a path.
+  // `thunder mission list` lists every mission. `thunder mission <Name>` prints a summary.
+  if (cmd === 'mission') {
+    const scanRoot = process.cwd();
+    const parsed = collectIntents(scanRoot)
+      .map((f) => { try { return { file: f, ast: parseIntent(readFileSync(f, 'utf8')) }; } catch { return null; } })
+      .filter((x) => x && x.ast && x.ast.mission);
+    const raw = process.argv.slice(3); // [Name|list, verb?, ...passthrough]
+    const nameArg = raw[0];
+
+    if (!nameArg || nameArg === 'list') {
+      if (!parsed.length) { console.log('thunder mission list: no missions found under the current directory.'); return; }
+      console.log(`thunder mission list: ${parsed.length} mission(s)`);
+      for (const { file: f, ast } of parsed.sort((a, b) => (a.ast.mission || '').localeCompare(b.ast.mission || ''))) {
+        const g = (ast.guarantees || []).length, n = (ast.neverRules || []).length, t = (ast.tests || []).length;
+        console.log(`  ${(ast.mission || '(unnamed)').padEnd(26)} ${relative(scanRoot, f)}  (${g} guarantee(s), ${n} never, ${t} test(s))`);
+      }
+      return;
+    }
+
+    const norm = (s) => String(s).toLowerCase().replace(/[^a-z0-9]/g, '');
+    const matches = parsed.filter((x) => x.ast.mission === nameArg);
+    const hit = matches[0] || parsed.find((x) => norm(x.ast.mission) === norm(nameArg));
+    if (!hit) { console.error(`thunder mission: no mission named "${nameArg}". Try: thunder mission list`); process.exit(2); return; }
+    if (matches.length > 1) console.error(`thunder mission: ${matches.length} missions named "${nameArg}"; using ${relative(scanRoot, hit.file)}`);
+
+    const verb = raw[1];
+    if (!verb) {
+      const a = hit.ast;
+      console.log(`mission ${a.mission}   (${relative(scanRoot, hit.file)})`);
+      if (a.goal) console.log(`  goal: ${a.goal}`);
+      if ((a.guarantees || []).length) { console.log('  guarantees:'); for (const g of a.guarantees) console.log(`    - ${g.statement}`); }
+      if ((a.neverRules || []).length) { console.log('  never:'); for (const nr of a.neverRules) console.log(`    - ${nr.statement}`); }
+      if ((a.targets || []).length) console.log(`  targets: ${a.targets.join(', ')}`);
+      if ((a.tests || []).length) console.log(`  tests: ${a.tests.length}`);
+      console.log(`  try: thunder mission ${a.mission} check | run | test | prove | build`);
+      return;
+    }
+
+    // Delegate to `thunder <verb> <file> <passthrough>` in a child so every flag is honored exactly.
+    const res = spawnSync(process.execPath, [process.argv[1], verb, hit.file, ...raw.slice(2)], { stdio: 'inherit' });
+    process.exit(res.status == null ? 0 : res.status);
+    return;
+  }
   // IntentLift: lift source CODE into inferred .intent drafts (not intent parsing).
   if (cmd === 'lift') {
     // Repo mode: walk a directory, lift each file, emit drafts + a repo summary.
@@ -957,7 +1140,285 @@ test Example
 
   // Self-verifying intent: run the `test` blocks in a .intent file (decisions + lifecycles).
   if (cmd === 'test') {
+    // Change-impact selection: run the tests for what a diff actually affects, using the Intent
+    // Graph (not just the modified files). Selects changed intents plus any intent that shares an
+    // event / service / api symbol with a changed one. `thunder test --changed [<range>]`.
+    if (args.changed) {
+      const gitc = (c) => { try { return execSync(`git ${c}`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] }); } catch { return null; } };
+      const top = gitc('rev-parse --show-toplevel');
+      if (top === null) { console.error('thunder test --changed: not a git repository'); process.exit(2); return; }
+      const root = top.trim();
+      const range = file || '';
+      let base, head;
+      if (range.includes('..')) { [base, head] = range.split('..'); head = head || 'HEAD'; }
+      else if (range) { base = range; head = null; }
+      else { base = 'HEAD'; head = null; }
+      const diffSpec = head ? `${base} ${head}` : base;
+      const changed = (gitc(`diff --name-only ${diffSpec} -- "*.thunder" "*.tl" "*.intent"`) || '').split('\n').map((s) => s.trim()).filter(Boolean);
+      const label = range || `${base}..working-tree`;
+      if (!changed.length) { console.log(`thunder test --changed ${label}: no source files changed`); return; }
+
+      const symbolsOf = (ast) => {
+        const s = new Set();
+        if (!ast) return s;
+        if (ast.mission) s.add(`system:${ast.mission}`);
+        for (const e of ast.events || []) s.add(`event:${e.name}`);
+        for (const sv of ast.services || []) { s.add(`service:${sv.name}`); (sv.publishes || []).forEach((p) => s.add(`event:${p}`)); (sv.consumes || []).forEach((p) => s.add(`event:${p}`)); }
+        for (const ap of ast.apis || []) s.add(`api:${ap.name}`);
+        return s;
+      };
+      const rel = (p) => relative(root, p);
+      const astAt = (relpath) => { const abs = join(root, relpath); if (!existsSync(abs)) return null; try { return parseIntent(readFileSync(abs, 'utf8')); } catch { return null; } };
+
+      // Seed symbols from the changed intents, then find every repo intent that shares one.
+      const changedAsts = new Map(changed.map((p) => [p, astAt(p)]));
+      const seed = new Set();
+      for (const ast of changedAsts.values()) for (const sym of symbolsOf(ast)) seed.add(sym);
+      const selected = new Map();
+      for (const p of changed) selected.set(p, 'changed');
+      for (const abs of collectIntents(root)) {
+        const p = rel(abs);
+        if (selected.has(p)) continue;
+        const shared = [...symbolsOf(parseIntent(readFileSync(abs, 'utf8')))].filter((x) => seed.has(x));
+        if (shared.length) selected.set(p, `impacted via ${shared[0].replace(':', ' ')}`);
+      }
+
+      let anyFail = false;
+      const results = [];
+      for (const [p, reason] of selected) {
+        const ast = changedAsts.get(p) || astAt(p);
+        if (!ast) { results.push({ file: p, reason, deleted: true }); continue; }
+        const r = runTests(ast);
+        const res = resolveObligations(ast);
+        const testsOk = r.total === 0 || r.ok;
+        if (!testsOk || res.failed > 0) anyFail = true;
+        results.push({ file: p, reason, tests: { passed: r.passed, total: r.total, ok: testsOk }, unverified: res.unverified, failedClaims: res.failed });
+      }
+      if (args.json) { console.log(JSON.stringify({ schema: 'thunder-changed-v1', range: label, changed, selected: results }, null, 2)); process.exit(anyFail ? 1 : 0); return; }
+      console.log(`thunder test --changed ${label}: ${changed.length} changed, ${selected.size} intent(s) selected`);
+      for (const r of results) {
+        if (r.deleted) { console.log(`  , ${r.file}  [${r.reason}, deleted]`); continue; }
+        const mark = r.tests.ok && !r.failedClaims ? 'PASS' : 'FAIL';
+        console.log(`  ${mark.padEnd(6)} ${r.file}  [${r.reason}]  tests ${r.tests.passed}/${r.tests.total}${r.unverified ? `, ${r.unverified} unverified` : ''}`);
+      }
+      process.exit(anyFail ? 1 : 0);
+      return;
+    }
+
     const ast = parseIntent(readFileSync(file, 'utf8'));
+
+    // Property-based testing: generate many cases for each `property`, evaluate the decision,
+    // assert the `expect` clauses, and shrink failures. `thunder test <file> --properties`.
+    if (args.properties) {
+      const cases = Number.isFinite(Number(args.cases)) && Number(args.cases) > 0 ? Math.min(Math.floor(Number(args.cases)), 100000) : 100;
+      const seed = Number.isFinite(Number(args.seed)) ? Math.floor(Number(args.seed)) : 424242;
+      const rep = runProperties(ast, { cases, seed });
+      const bad = rep.passed !== rep.total;
+      if (args.json) { console.log(JSON.stringify(rep, null, 2)); process.exit(bad ? 1 : 0); return; }
+      if (!rep.total) { console.log(`thunder test ${basename(file)} --properties: no property blocks found.`); return; }
+      console.log(`thunder test ${basename(file)} --properties: ${rep.total} propert${rep.total === 1 ? 'y' : 'ies'}, ${rep.passed} passed`);
+      for (const r of rep.results) {
+        if (r.error) { console.log(`  FAIL  ${r.property} , ${r.error}`); continue; }
+        if (r.ok) { console.log(`  PASS  ${r.property}  (${r.cases} cases, seed ${r.seed})`); continue; }
+        const f = r.failure;
+        const inputs = Object.entries(f.inputs).map(([k, v]) => `${k}=${v}`).join(', ');
+        console.log(`  FAIL  ${r.property}  (seed ${r.seed})`);
+        console.log(`        smallest failure: ${inputs}  ->  ${f.expect} (got ${f.actual})`);
+      }
+      process.exit(bad ? 1 : 0);
+      return;
+    }
+
+    // Scenario tests: workflow-level given/when/then/never. Deterministically flags a scenario
+    // that both expects and prohibits the same outcome; otherwise DECLARED (needs runtime evidence).
+    if (args.scenarios) {
+      const scenarios = ast.scenarios || [];
+      const norm = (s) => String(s).toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+      const results = scenarios.map((sc) => {
+        const neverSet = new Set(sc.never.map(norm));
+        const positives = [...sc.then, ...sc.eventually.flatMap((e) => e.clauses)];
+        const contradictions = positives.filter((p) => neverSet.has(norm(p)));
+        return { scenario: sc.name, status: contradictions.length ? 'failed' : 'declared', given: sc.given.length, then: positives.length, never: sc.never.length, contradictions };
+      });
+      const failed = results.filter((r) => r.status === 'failed').length;
+      const rep = { schema: 'thunder-scenarios-v1', mission: ast.mission, file: basename(file), total: results.length, failed, results };
+      if (args.json) { console.log(JSON.stringify(rep, null, 2)); process.exit(failed ? 1 : 0); return; }
+      if (!rep.total) { console.log(`thunder test ${basename(file)} --scenarios: no scenario blocks found.`); return; }
+      console.log(`thunder test ${basename(file)} --scenarios: ${rep.total} scenario(s), ${rep.total - failed} consistent${failed ? `, ${failed} contradictory` : ''}`);
+      for (const r of results) {
+        if (r.status === 'failed') console.log(`  FAIL      ${r.scenario} , contradiction: ${r.contradictions.map((c) => `"${c}"`).join(', ')} both expected and prohibited`);
+        else console.log(`  DECLARED  ${r.scenario}  (${r.given} given, ${r.then} then, ${r.never} never) , needs runtime evidence`);
+      }
+      process.exit(failed ? 1 : 0);
+      return;
+    }
+
+    // All-targets mode: run the tests against EVERY target whose toolchain is available, in one
+    // pass, and report each target's pass count side by side. `thunder test <file> --all-targets`.
+    if (args.allTargets) {
+      const gradeCases = (actual) => {
+        const cs = [];
+        for (const t of ast.tests || []) {
+          if (!(ast.decisions || []).some((d) => d.name === t.name)) continue;
+          for (const c of t.cases || []) {
+            const key = `${t.name} / ${c.name || 'case'}`;
+            const act = actual[key];
+            cs.push({ key, expected: c.expect, actual: act, pass: c.expect == null || String(act) === String(c.expect) });
+          }
+        }
+        return cs;
+      };
+      const report = LIVE_TARGETS.map((t) => {
+        const actual = t.available() ? t.run(ast) : null;
+        if (actual === null) return { target: t.key, status: 'skipped', reason: `${t.key} toolchain not available` };
+        const cases = gradeCases(actual);
+        const passed = cases.filter((c) => c.pass).length;
+        return { target: t.key, status: passed === cases.length ? 'pass' : 'fail', total: cases.length, passed, cases };
+      });
+      const bad = report.some((r) => r.status === 'fail');
+      if (args.json) { console.log(JSON.stringify({ schema: 'thunder-all-targets-v1', mission: ast.mission, file: basename(file), targets: report }, null, 2)); process.exit(bad ? 1 : 0); return; }
+      const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+      const ran = report.filter((r) => r.status !== 'skipped');
+      console.log(`thunder test ${basename(file)} --all-targets: ${ran.length}/${report.length} target(s) executed`);
+      for (const r of report) {
+        if (r.status === 'skipped') { console.log(`  SKIP  ${cap(r.target).padEnd(12)} (toolchain not available)`); continue; }
+        console.log(`  ${r.status === 'pass' ? 'PASS' : 'FAIL'}  ${cap(r.target).padEnd(12)} ${r.passed}/${r.total} passed (executed generated code)`);
+        for (const c of r.cases) if (!c.pass) console.log(`          FAIL ${c.key} , expected ${c.expected}, got ${c.actual}`);
+      }
+      process.exit(bad ? 1 : 0);
+      return;
+    }
+
+    // Target mode: run the tests against the GENERATED TypeScript (executed for real), not the
+    // semantic engine. Proves the generated implementation is faithful to the intent.
+    // `thunder test <file> --target typescript`.
+    if (args.target && RUNNABLE_TARGETS.has(String(args.target).toLowerCase())) {
+      const targetKey = canonicalTarget(args.target);
+      const actual = runLiveTarget(ast, targetKey);
+      // Live target could not run (e.g. python3 not installed) , skip cleanly, don't fail.
+      if (actual === null) {
+        if (args.json) { console.log(JSON.stringify({ schema: 'thunder-target-v1', target: targetKey, skipped: true, reason: `${targetKey} runtime unavailable` }, null, 2)); return; }
+        console.log(`thunder test ${basename(file)} --target ${targetKey}: skipped (the ${targetKey} runtime is not available on this machine).`);
+        return;
+      }
+      const cases = [];
+      for (const t of ast.tests || []) {
+        const dec = (ast.decisions || []).find((d) => d.name === t.name);
+        if (!dec) continue;
+        for (const c of t.cases || []) {
+          const key = `${t.name} / ${c.name || 'case'}`;
+          const act = actual[key];
+          cases.push({ key, expected: c.expect, actual: act, pass: c.expect == null || String(act) === String(c.expect) });
+        }
+      }
+      const passed = cases.filter((c) => c.pass).length;
+      const bad = passed !== cases.length;
+      if (args.json) { console.log(JSON.stringify({ schema: 'thunder-target-v1', target: targetKey, total: cases.length, passed, cases }, null, 2)); process.exit(bad ? 1 : 0); return; }
+      if (!cases.length) { console.log(`thunder test ${basename(file)} --target ${targetKey}: no decision test cases to run.`); return; }
+      console.log(`thunder test ${basename(file)} --target ${targetKey}: ${passed}/${cases.length} passed (executed generated code)`);
+      for (const c of cases) console.log(`  ${c.pass ? 'PASS' : 'FAIL'}  ${c.key}${c.pass ? '' : `  , expected ${c.expected}, got ${c.actual}`}`);
+      process.exit(bad ? 1 : 0);
+      return;
+    }
+
+    // Semantic coverage: which goals, decision rules, guarantees, prohibitions, scenarios, and
+    // targets are actually exercised , meaning-level, not lines. `thunder test <file> --coverage`.
+    if (args.coverage) {
+      const rep = semanticCoverage(ast);
+      const bad = args.strict && rep.unverified.length > 0;
+      if (args.json) { console.log(JSON.stringify(rep, null, 2)); process.exit(bad ? 1 : 0); return; }
+      console.log(`thunder test ${basename(file)} --coverage: ${rep.overall}% overall`);
+      console.log('');
+      for (const m of rep.metrics) console.log(`  ${m.name.padEnd(16)} ${`${m.covered}/${m.total}`.padStart(7)}   ${String(m.pct).padStart(3)}%`);
+      if (rep.unverified.length) {
+        console.log('');
+        console.log('  Unverified:');
+        for (const u of rep.unverified) console.log(`    - ${u}`);
+      }
+      process.exit(bad ? 1 : 0);
+      return;
+    }
+
+    // AI evaluations: probabilistic behavior graded against a dataset by metric thresholds.
+    // Declare the bar in ThunderLang; feed measured metrics via --results to gate on them.
+    // `thunder test <file> --evals [--results <json|path>] [--strict]`.
+    if (args.evals) {
+      let results = null;
+      if (args.results) {
+        try { results = existsSync(args.results) ? JSON.parse(readFileSync(args.results, 'utf8')) : JSON.parse(args.results); }
+        catch { console.error('thunder test --evals: --results must be a JSON file path or inline JSON of {metric: value}'); process.exit(2); return; }
+      }
+      const cmp = { '>=': (a, b) => a >= b, '<=': (a, b) => a <= b, '>': (a, b) => a > b, '<': (a, b) => a < b, '==': (a, b) => a === b, '!=': (a, b) => a !== b };
+      const evals = (ast.evaluations || []).map((ev) => {
+        if (!results) return { name: ev.name, dataset: ev.dataset, status: 'declared', requires: ev.requires };
+        const checks = ev.requires.map((r) => {
+          const have = results[r.metric];
+          if (have === undefined) return { ...r, actual: null, pass: false, missing: true };
+          return { ...r, actual: Number(have), pass: cmp[r.op](Number(have), r.threshold) };
+        });
+        return { name: ev.name, dataset: ev.dataset, status: checks.every((c) => c.pass) ? 'passed' : 'failed', checks };
+      });
+      const failed = evals.filter((e) => e.status === 'failed').length;
+      const declared = evals.filter((e) => e.status === 'declared').length;
+      const bad = failed > 0 || (args.strict && declared > 0);
+      const rep = { schema: 'thunder-evals-v1', mission: ast.mission, file: basename(file), total: evals.length, passed: evals.filter((e) => e.status === 'passed').length, declared, failed, results: evals };
+      if (args.json) { console.log(JSON.stringify(rep, null, 2)); process.exit(bad ? 1 : 0); return; }
+      if (!rep.total) { console.log(`thunder test ${basename(file)} --evals: no evaluation blocks found.`); return; }
+      console.log(`thunder test ${basename(file)} --evals: ${rep.total} evaluation(s)${results ? `, ${rep.passed} passed${failed ? `, ${failed} failed` : ''}` : ' (declared , provide --results to grade)'}`);
+      for (const e of evals) {
+        const label = e.status === 'passed' ? 'PASS' : e.status === 'failed' ? 'FAIL' : 'DECLARED';
+        console.log(`  ${label.padEnd(9)} ${e.name}${e.dataset ? `  (dataset ${e.dataset})` : ''}`);
+        for (const r of (e.checks || e.requires)) {
+          const mark = e.checks ? (r.pass ? '✓' : '✗') : '·';
+          const actual = e.checks ? (r.missing ? '  (metric not in results)' : `  (${r.actual})`) : '';
+          console.log(`    ${mark} ${r.metric} ${r.op} ${r.threshold}${actual}`);
+        }
+      }
+      process.exit(bad ? 1 : 0);
+      return;
+    }
+
+    // Mutation testing: inject faults into decisions and check the tests catch them.
+    // A survived mutant is a weak spot. `thunder test <file> --mutate [--strict]`.
+    if (args.mutate) {
+      const rep = runMutations(ast);
+      const bad = args.strict && rep.survived > 0;
+      if (args.json) { console.log(JSON.stringify(rep, null, 2)); process.exit(bad ? 1 : 0); return; }
+      if (rep.total === 0) { console.log(`thunder test ${basename(file)} --mutate: ${rep.note}`); return; }
+      console.log(`thunder test ${basename(file)} --mutate: mutation score ${rep.score}%  (${rep.killed} killed, ${rep.survived} survived of ${rep.total})`);
+      const survivors = rep.results.filter((r) => !r.killed);
+      if (survivors.length) { console.log('  survived , the tests did not catch these (weak spots):'); for (const s of survivors) console.log(`    - ${s.describe}`); }
+      process.exit(bad ? 1 : 0);
+      return;
+    }
+
+    // Contract-test derivation: every `guarantee` and `never` is a test obligation.
+    // Honest resolution: no verification -> UNVERIFIED (never silently PASS); a declared
+    // verification with the file's checks green -> PASS; a failing in-file check -> FAIL.
+    // `--strict` also fails the run on any UNVERIFIED obligation (CI: nothing left unproven).
+    if (args.contracts) {
+      const res = resolveObligations(ast);
+      const obligations = res.obligations;
+      const rep = { schema: 'thunder-contracts-v1', mission: ast.mission, file: basename(file),
+        total: obligations.length, verified: res.verified, declared: res.declared,
+        unverified: res.unverified, failed: res.failed, obligations };
+      const bad = rep.failed > 0 || (args.strict && rep.unverified > 0);
+      if (args.json) { console.log(JSON.stringify(rep, null, 2)); process.exit(bad ? 1 : 0); return; }
+      if (!rep.total) { console.log(`thunder test ${basename(file)} --contracts: no guarantees or prohibitions declared.`); return; }
+      console.log(`thunder test ${basename(file)} --contracts: ${rep.total} obligation(s), ${rep.verified} verified, ${rep.declared} declared, ${rep.unverified} unverified${rep.failed ? `, ${rep.failed} failed` : ''}`);
+      const LABEL = { verified: 'PASS', failed: 'FAIL', declared: 'DECLARED', unverified: 'UNVERIFIED' };
+      for (const o of obligations) {
+        const by = o.kinds.length ? `  by ${o.kinds.join('+')}` : '';
+        const detail = o.provenBy ? `  proven by test ${o.provenBy}`
+          : o.status === 'declared' ? '  (declared, runs in target mode)'
+          : o.status === 'unverified' ? '  (nothing verifies this)' : '';
+        console.log(`  ${LABEL[o.status].padEnd(10)} ${o.kind} ${o.id}: ${o.text}${by}${detail}`);
+      }
+      if (args.strict && rep.unverified) console.log(`\n  strict: ${rep.unverified} unverified obligation(s) , run fails until every claim carries a verification.`);
+      process.exit(bad ? 1 : 0);
+      return;
+    }
+
     const r = runTests(ast);
     if (args.json) { console.log(JSON.stringify(r, null, 2)); process.exit(r.ok ? 0 : 1); return; }
     if (r.total === 0) { console.log(`thunder test ${basename(file)}: no test blocks found.`); return; }
@@ -972,6 +1433,141 @@ test Example
     return;
   }
 
+  // PROVE: run the tests, evaluate guarantee / prohibition obligations, and emit a durable
+  // intent-proof-v1 artifact with honest statuses. Unverified claims never read as passed.
+  // `thunder prove <file> [--out <dir>] [--json]`.
+  if (cmd === 'prove') {
+    if (!file || !existsSync(file)) { console.error('usage: thunder prove <file> [--out <dir>] [--json]'); process.exit(2); return; }
+    const source = readFileSync(file, 'utf8');
+    const ast = parseIntent(source);
+    const diagnostics = semanticDiagnostics(ast);
+    const resolved = resolveObligations(ast);
+    const tests = resolved.tests;
+    const proof = buildProof(ast, {
+      sourceFile: basename(file),
+      sourceHash: sha256(source),
+      targetsRequested: ast.targets || [],
+      targetsGenerated: [],
+      diagnostics,
+      generatedAt: new Date().toISOString(),
+    });
+    // Fold per-claim verdicts into the proof so it records real status, not just planned/needs_verification.
+    const CLAIM_MAP = { verified: 'verified', failed: 'failed', declared: 'planned', unverified: 'needs_verification' };
+    const byId = new Map(resolved.obligations.map((o) => [o.id, o]));
+    const applyStatus = (claim) => { const o = byId.get(claim.id); return o ? { ...claim, status: CLAIM_MAP[o.status], provenBy: o.provenBy || null } : claim; };
+    proof.guarantees = proof.guarantees.map(applyStatus);
+    proof.neverRules = proof.neverRules.map(applyStatus);
+    // Freshness tuple: what `thunder verify` recomputes to mark this proof STALE later.
+    proof.freshness = freshnessFor(file, proof, args.env);
+    const proofId = `proof-${proof.sourceHash.replace('sha256:', '').slice(0, 6)}`;
+    const fail = !proof.verification.semanticPassed || !tests.ok || resolved.failed > 0;
+
+    if (args.json) {
+      console.log(JSON.stringify({ proofId, ...proof, tests }, null, 2));
+      process.exit(fail ? 1 : 0);
+      return;
+    }
+
+    console.log(`Proof created: ${proofId}`);
+    console.log('');
+    console.log(`  Intent:        ${proof.missionName || stripSourceExt(basename(file))}`);
+    console.log(`  Intent hash:   ${proof.sourceHash}`);
+    console.log(`  Compiler:      ThunderLang ${proof.compilerVersion}`);
+    console.log(`  Generated:     ${proof.generatedAt}`);
+    console.log(`  Syntax:        ${proof.verification.syntaxPassed ? 'PASS' : 'FAIL'}`);
+    console.log(`  Semantics:     ${proof.verification.semanticPassed ? 'PASS' : 'FAIL'}`);
+    console.log(`  Tests:         ${tests.total ? `${tests.passed}/${tests.total} passed` : 'none'}`);
+    console.log(`  Claims:        ${resolved.verified} verified, ${resolved.declared} declared, ${resolved.unverified} UNVERIFIED${resolved.failed ? `, ${resolved.failed} FAILED` : ''}  (of ${resolved.obligations.length})`);
+    console.log(`  Proof status:  ${String(proof.proofStatus).toUpperCase()}${(resolved.unverified || resolved.failed) ? '  (not fully proven)' : ''}`);
+    const fr = proof.freshness;
+    console.log(`  Bound to:      commit ${fr.implementation ? fr.implementation.slice(0, 7) : 'n/a'}${fr.dependencies ? ` · deps ${fr.dependencies.hash.replace('sha256:', '').slice(0, 7)} (${fr.dependencies.file})` : ''}${fr.environment ? ` · env ${fr.environment}` : ''}`);
+    const problems = resolved.obligations.filter((o) => o.status === 'unverified' || o.status === 'failed');
+    if (problems.length) {
+      console.log('');
+      console.log('  Not proven (this is where drift hides , a claim like this never counts as proven):');
+      for (const o of problems) console.log(`    - ${o.status === 'failed' ? 'FAILED    ' : 'UNVERIFIED'} ${o.kind} ${o.id}: ${o.text}`);
+    }
+    const outName = `${slug(ast.mission || stripSourceExt(basename(file)))}.thunder-proof.json`;
+    const outDir = args.out && args.out !== '.intent' ? args.out : dirname(file);
+    const outPath = join(outDir, outName);
+    writeFileSync(outPath, JSON.stringify(proof, null, 2));
+    console.log('');
+    console.log(`  wrote ${relative(process.cwd(), outPath)}`);
+    process.exit(fail ? 1 : 0);
+    return;
+  }
+
+  // CONFORMANCE: the same test cases run against every target. The engine defines the canonical
+  // result each case must produce; target outputs fed via --results are graded against it.
+  // `thunder conform <file> [--targets ts,py] [--results <json|path>] [--json]`.
+  if (cmd === 'conform') {
+    const ast = parseIntent(readFileSync(file, 'utf8'));
+    let results = null;
+    if (args.results) {
+      try { results = existsSync(args.results) ? JSON.parse(readFileSync(args.results, 'utf8')) : JSON.parse(args.results); }
+      catch { console.error('thunder conform: --results must be JSON of {target: {"Test / case": result}} (file path or inline)'); process.exit(2); return; }
+    }
+    let targets = (args.targets && args.targets.length ? args.targets : (ast.targets || [])).map((t) => canonicalTarget(t));
+    const skippedTargets = [];
+    // --all-targets: execute EVERY target whose toolchain is available in one pass, and show all
+    // live targets as columns (unavailable ones stay "declared" with a skipped note).
+    if (args.allTargets) {
+      results = results || {};
+      targets = Array.from(new Set([...targets, ...LIVE_TARGETS.map((t) => t.key)]));
+      for (const t of LIVE_TARGETS) {
+        if (!t.available()) { skippedTargets.push(t.key); continue; }
+        const actual = t.run(ast);
+        if (actual !== null) results[t.key] = actual; else skippedTargets.push(t.key);
+      }
+    }
+    // --run <targets>: execute specific live targets (TypeScript/JS/Python/C#/Java) and grade real
+    // outputs. A null result (e.g. the SDK is not installed) is skipped, leaving it "declared".
+    if (args.run && args.run.length) {
+      results = results || {};
+      for (const rt of args.run) {
+        if (!RUNNABLE_TARGETS.has(rt.toLowerCase())) continue;
+        const key = canonicalTarget(rt);
+        const actual = runLiveTarget(ast, key);
+        if (actual !== null) results[key] = actual;
+      }
+    }
+    const rep = buildConformance(ast, { targets, results });
+    if (skippedTargets.length) rep.skipped = Array.from(new Set(skippedTargets));
+    const bad = rep.semanticFailures > 0 || rep.failures.length > 0;
+    if (args.json) { console.log(JSON.stringify(rep, null, 2)); process.exit(bad ? 1 : 0); return; }
+    if (!rep.total) { console.log(`thunder conform ${basename(file)}: no test cases to conform.`); return; }
+
+    const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+    const cols = ['Semantic', ...rep.columns.map(cap)];
+    const labelW = Math.max(12, ...rep.cases.map((c) => c.key.length));
+    const cw = (h) => Math.max(h.length, 8);
+    const cell = (v, w) => String(v).padEnd(w);
+    console.log(`thunder conform ${basename(file)}: ${rep.total} case(s) · semantic + ${rep.columns.length} target(s)${rep.graded ? '' : ' (declared , provide --results to grade targets)'}`);
+    console.log(`  ${cell('', labelW)}  ${cols.map((h) => cell(h, cw(h))).join('  ')}`);
+    for (const c of rep.cases) {
+      const sem = c.semanticPass ? 'PASS' : 'FAIL';
+      const tcells = rep.columns.map((col) => {
+        const s = c.targets[col].status;
+        return cell(s === 'pass' ? 'PASS' : s === 'fail' ? 'FAIL' : '—', cw(cap(col)));
+      });
+      console.log(`  ${cell(c.key, labelW)}  ${cell(sem, cw('Semantic'))}  ${tcells.join('  ')}`);
+    }
+    for (const f of rep.failures) {
+      console.log('');
+      console.log('  CONFORMANCE FAILURE');
+      console.log(`    Target:   ${cap(f.target)}`);
+      console.log(`    Case:     ${f.case}`);
+      console.log(`    Expected: ${f.expected}`);
+      console.log(`    Actual:   ${f.actual}`);
+    }
+    if (rep.skipped && rep.skipped.length) {
+      console.log('');
+      console.log(`  Skipped (toolchain not available, left declared): ${rep.skipped.map(cap).join(', ')}`);
+    }
+    process.exit(bad ? 1 : 0);
+    return;
+  }
+
   // Intent Runtime: SIMULATE a lifecycle against a sequence of events.
   if (cmd === 'simulate') {
     const ast = parseIntent(readFileSync(file, 'utf8'));
@@ -1507,6 +2103,13 @@ test Example
   }
 
   const generated = [];
+  // `thunder graph <file> --safe` , a display-safe intent-graph on stdout, for external viewers
+  // (e.g. STT rendering the Intent Atlas). Strips owner/source provenance and redacts sensitive
+  // classifications; carries no source code.
+  if (cmd === 'graph' && args.safe) {
+    console.log(JSON.stringify(safeGraph(buildIntentGraph(ast)), null, 2));
+    return;
+  }
   if (cmd === 'graph' || cmd === 'build') {
     generated.push(writeJson(outDir, 'contract-graph.json', buildContractGraph(ast, generatedAt)));
     generated.push(writeJson(outDir, 'architecture-graph.json', buildArchitectureGraph(ast, generatedAt)));
@@ -1525,7 +2128,7 @@ test Example
       targetsGenerated: generated.map((p) => p.replace(process.cwd() + '/', '')),
       diagnostics,
     });
-    generated.push(writeJson(outDir, '.intent-proof.json', proof));
+    generated.push(writeJson(outDir, '.thunder-proof.json', proof));
   }
   if (!['graph', 'proof', 'build'].includes(cmd)) {
     console.error(`unknown command: ${cmd}`);