kibi-cli 0.19.0 → 1.0.1

package/dist/cli-operation-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-operation-loader.d.ts","sourceRoot":"","sources":["../src/cli-operation-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,8BAA8B,CAAC;AAOtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,aAAa,CAAC,CAoDxB"}
+{"version":3,"file":"cli-operation-loader.d.ts","sourceRoot":"","sources":["../src/cli-operation-loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,8BAA8B,CAAC;AAOtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,aAAa,CAAC,CAoFxB"}

package/dist/cli-operation-loader.js

@@ -1,58 +1,91 @@
+import { withContractDefaults } from "./public/operations/catalog.js";
 // Load only the implementation selected by the client. Importing the public
 // catalog remains useful for introspection and parity tests, but pulling every
 // operation into each short-lived CLI process makes test and shell startup pay
 // for unrelated commands.
 // implements REQ-test-journaled-engine-harness
 export async function loadOperationSpec(name) {
+    let spec;
     switch (name) {
         case "kb_skills_list":
-            return (await import("./public/operations/specs/skills.js"))
+            spec = (await import("./public/operations/specs/skills.js"))
                 .skillsListSpec;
+            break;
         case "kb_skills_load":
-            return (await import("./public/operations/specs/skills.js"))
+            spec = (await import("./public/operations/specs/skills.js"))
                 .skillsLoadSpec;
+            break;
         case "kb_skills_read":
-            return (await import("./public/operations/specs/skills.js"))
+            spec = (await import("./public/operations/specs/skills.js"))
                 .skillsReadSpec;
+            break;
         case "kb_query":
-            return (await import("./public/operations/specs/discovery.js")).querySpec;
+            spec = (await import("./public/operations/specs/discovery.js")).querySpec;
+            break;
         case "kb_search":
-            return (await import("./public/operations/specs/discovery.js"))
+            spec = (await import("./public/operations/specs/discovery.js"))
                 .searchSpec;
+            break;
         case "kb_status":
-            return (await import("./public/operations/specs/discovery.js"))
+            spec = (await import("./public/operations/specs/discovery.js"))
                 .statusSpec;
+            break;
         case "kb_find_gaps":
-            return (await import("./public/operations/specs/reporting.js"))
+            spec = (await import("./public/operations/specs/reporting.js"))
                 .findGapsSpec;
+            break;
         case "kb_coverage":
-            return (await import("./public/operations/specs/reporting.js"))
+            spec = (await import("./public/operations/specs/reporting.js"))
                 .coverageSpec;
+            break;
         case "kb_graph":
-            return (await import("./public/operations/specs/reporting.js")).graphSpec;
+            spec = (await import("./public/operations/specs/reporting.js")).graphSpec;
+            break;
         case "kb_sparql_remote":
-            return (await import("./public/operations/specs/sparql.js"))
+            spec = (await import("./public/operations/specs/sparql.js"))
                 .sparqlRemoteSpec;
+            break;
         case "kb_semantic_advisor":
-            return (await import("./public/operations/specs/semantic.js"))
+            spec = (await import("./public/operations/specs/semantic.js"))
                 .semanticAdvisorSpec;
+            break;
         case "kb_model_requirement":
-            return (await import("./public/operations/specs/modeling.js"))
+            spec = (await import("./public/operations/specs/modeling.js"))
                 .modelRequirementSpec;
+            break;
         case "kb_suggest_predicates":
-            return (await import("./public/operations/specs/modeling.js"))
+            spec = (await import("./public/operations/specs/modeling.js"))
                 .suggestPredicatesSpec;
-        case "kb_autopilot_generate":
-            return (await import("./public/operations/specs/autopilot.js"))
-                .autopilotGenerateSpec;
+            break;
+        case "kb_plan_bootstrap":
+            spec = (await import("./public/operations/specs/bootstrap.js"))
+                .planBootstrapSpec;
+            break;
         case "kb_validate_upsert":
-            return (await import("./public/operations/specs/mutation.js"))
+            spec = (await import("./public/operations/specs/mutation.js"))
                 .validateUpsertSpec;
+            break;
         case "kb_upsert":
-            return (await import("./public/operations/specs/upsert.js")).upsertSpec;
+            spec = (await import("./public/operations/specs/upsert.js")).upsertSpec;
+            break;
         case "kb_delete":
-            return (await import("./public/operations/specs/mutation.js")).deleteSpec;
+            spec = (await import("./public/operations/specs/mutation.js")).deleteSpec;
+            break;
         case "kb_check":
-            return (await import("./public/operations/specs/check.js")).checkSpec;
+            spec = (await import("./public/operations/specs/check.js")).checkSpec;
+            break;
+        case "kb_compile_intent":
+            spec = (await import("./public/operations/specs/planning.js"))
+                .compileIntentSpec;
+            break;
+        case "kb_apply_plan":
+            spec = (await import("./public/operations/specs/planning.js"))
+                .applyPlanSpec;
+            break;
+        case "kb_ingest_verification":
+            spec = (await import("./public/operations/specs/verification.js"))
+                .ingestVerificationSpec;
+            break;
     }
+    return withContractDefaults(spec);
 }

package/dist/cli-operation-metadata.d.ts

@@ -23,11 +23,11 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_search";
     readonly cliName: "search";
-    readonly description: "Search KB entities for discovery using metadata and markdown body text. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.";
+    readonly description: "Search KB entities for discovery using legacy lexical ranking or deterministic intent-v1 ranking. Intent mode accepts host-agent semantic facets and source locations, returns evidence and abstains below its confidence threshold. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.";
 }, {
     readonly name: "kb_status";
     readonly cliName: "status";
-    readonly description: "Report current branch, KB snapshot and freshness metadata, plus the deterministic workspace snapshot used to validate execution receipts. Read-only status inspection with no mutation side effects.";
+    readonly description: "Report current branch, KB snapshot, freshness metadata, schema status, and a typed kibi.migration-plan.v2 action graph. Read-only status inspection with no mutation side effects; damaged stores are diagnosed without starting the engine.";
 }, {
     readonly name: "kb_find_gaps";
     readonly cliName: "find-gaps";
@@ -35,7 +35,7 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_coverage";
     readonly cliName: "coverage";
-    readonly description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Requirement reports include a deterministic, dependency-ordered, read-only repair plan; optional legacy migration previews reconstruct authored proposition inventories and rank exact schema candidates without producing executable writes. Paginated plans identify incomplete scope. Requirement rows keep coverageStatus separate from proofStatus and require fresh snapshot-bound E2E receipts before proof. No mutation side effects.";
+    readonly description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Reports include the compatible repair plan plus typed kibi.migration-plan.v2 actions; semantic and E2E actions remain review/execution work. Paginated plans identify incomplete scope and no mutation occurs.";
 }, {
     readonly name: "kb_graph";
     readonly cliName: "graph";
@@ -51,11 +51,11 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_suggest_predicates";
     readonly cliName: "suggest-predicates";
-    readonly description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Read-only guidance returns ranked candidates, an applicable predicate-fact plan only when every ordered argument is bound, a separate requires_predicate relationship plan when a requirement ID is supplied, or an explicit ontology-gap observation when no predicate fits.";
+    readonly description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Retrieval/ranking is followed by a semantic applicability gate and conservative binding review; complete-looking generic placeholders never trigger application. Read-only guidance returns additive candidate diagnostics, an applicable predicate-fact plan only for a semantically eligible candidate with reviewed bindings, or an explicit ontology-gap observation plus a deterministic review-only predicate schema draft when no schema fits.";
 }, {
-    readonly name: "kb_autopilot_generate";
-    readonly cliName: "autopilot-generate";
-    readonly description: "Generate agent-centric bootstrap output for KB population. Read-only analysis that returns activation state, bootstrap guidance, candidate entities with evidence, payoff summary, and exact applyPlan payloads for later kb_upsert calls. No mutation side effects.";
+    readonly name: "kb_plan_bootstrap";
+    readonly cliName: "plan-bootstrap";
+    readonly description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.";
 }, {
     readonly name: "kb_validate_upsert";
     readonly cliName: "validate-upsert";
@@ -71,11 +71,23 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_check";
     readonly cliName: "check";
-    readonly description: "Run KB validation rules and return violations. Use before or after mutations, and after meaningful source edits with impact options to surface symbol granularity and semantic-review diagnostics. Do not use for point lookups. No write side effects. Prefer explicit rules for faster iteration; omit rules for final full validation plus full-KB qualityDiagnostics review, including telemetry acceptance when .kb/usage.log exists.";
+    readonly description: "Run KB validation rules and return violations, quality diagnostics, and typed kibi.migration-plan.v2 actions. Use before or after mutations and after source edits; checks remain read-only and never infer or apply actions from prose suggestions.";
 }, {
     readonly name: "kb_sparql_remote";
     readonly cliName: "sparql-remote";
     readonly description: "Opt-in remote SPARQL query tool for external HTTP(S) RDF endpoints. This does not query Kibi's local RDF store directly, stores no credentials, and depends on network availability.";
+}, {
+    readonly name: "kb_compile_intent";
+    readonly cliName: "compile-intent";
+    readonly description: "Compile complete change intent into a deterministic, snapshot-bound read-only plan. Reuses intent-aware discovery and semantic modeling, accounts for every proposition, reports contradiction witnesses, proposes traceability links, and emits dependency-ordered kb_upsert-style steps only for resolved typed claims. No mutation side effects.";
+}, {
+    readonly name: "kb_apply_plan";
+    readonly cliName: "apply-plan";
+    readonly description: "Apply an explicitly approved kibi.bootstrap-plan.v1, kibi.compile-plan.v1, kibi.migration-plan.v2, or entity-deletion plan after revalidating its canonical hash and live snapshots. Bootstrap actions are dependency-ordered, sequential, source-first, and recoverable from a typed journal.";
+}, {
+    readonly name: "kb_ingest_verification";
+    readonly cliName: "ingest-verification";
+    readonly description: "Ingest a reporter-produced kibi.playwright-run.v1 artifact for a contracted test. Revalidates the live workspace snapshot, runner/command contract, required case/project coverage, and append-only receipt history before deriving and appending a kibi.verification-receipt.v2. It never accepts a caller-authored receipt or trusted outcome.";
 }];
 export declare function getCliOperationMetadata(name: OperationName): CliOperationMetadata;
 export declare function isOperationName(name: string): name is OperationName;

package/dist/cli-operation-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6GiB,CAAC;AAMrD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAMtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}
+{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+HiB,CAAC;AAMrD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAMtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}

package/dist/cli-operation-metadata.js

@@ -25,12 +25,12 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_search",
         cliName: "search",
-        description: "Search KB entities for discovery using metadata and markdown body text. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.",
+        description: "Search KB entities for discovery using legacy lexical ranking or deterministic intent-v1 ranking. Intent mode accepts host-agent semantic facets and source locations, returns evidence and abstains below its confidence threshold. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.",
     },
     {
         name: "kb_status",
         cliName: "status",
-        description: "Report current branch, KB snapshot and freshness metadata, plus the deterministic workspace snapshot used to validate execution receipts. Read-only status inspection with no mutation side effects.",
+        description: "Report current branch, KB snapshot, freshness metadata, schema status, and a typed kibi.migration-plan.v2 action graph. Read-only status inspection with no mutation side effects; damaged stores are diagnosed without starting the engine.",
     },
     {
         name: "kb_find_gaps",
@@ -40,7 +40,7 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_coverage",
         cliName: "coverage",
-        description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Requirement reports include a deterministic, dependency-ordered, read-only repair plan; optional legacy migration previews reconstruct authored proposition inventories and rank exact schema candidates without producing executable writes. Paginated plans identify incomplete scope. Requirement rows keep coverageStatus separate from proofStatus and require fresh snapshot-bound E2E receipts before proof. No mutation side effects.",
+        description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Reports include the compatible repair plan plus typed kibi.migration-plan.v2 actions; semantic and E2E actions remain review/execution work. Paginated plans identify incomplete scope and no mutation occurs.",
     },
     {
         name: "kb_graph",
@@ -60,12 +60,12 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_suggest_predicates",
         cliName: "suggest-predicates",
-        description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Read-only guidance returns ranked candidates, an applicable predicate-fact plan only when every ordered argument is bound, a separate requires_predicate relationship plan when a requirement ID is supplied, or an explicit ontology-gap observation when no predicate fits.",
+        description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Retrieval/ranking is followed by a semantic applicability gate and conservative binding review; complete-looking generic placeholders never trigger application. Read-only guidance returns additive candidate diagnostics, an applicable predicate-fact plan only for a semantically eligible candidate with reviewed bindings, or an explicit ontology-gap observation plus a deterministic review-only predicate schema draft when no schema fits.",
     },
     {
-        name: "kb_autopilot_generate",
-        cliName: "autopilot-generate",
-        description: "Generate agent-centric bootstrap output for KB population. Read-only analysis that returns activation state, bootstrap guidance, candidate entities with evidence, payoff summary, and exact applyPlan payloads for later kb_upsert calls. No mutation side effects.",
+        name: "kb_plan_bootstrap",
+        cliName: "plan-bootstrap",
+        description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.",
     },
     {
         name: "kb_validate_upsert",
@@ -85,13 +85,28 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_check",
         cliName: "check",
-        description: "Run KB validation rules and return violations. Use before or after mutations, and after meaningful source edits with impact options to surface symbol granularity and semantic-review diagnostics. Do not use for point lookups. No write side effects. Prefer explicit rules for faster iteration; omit rules for final full validation plus full-KB qualityDiagnostics review, including telemetry acceptance when .kb/usage.log exists.",
+        description: "Run KB validation rules and return violations, quality diagnostics, and typed kibi.migration-plan.v2 actions. Use before or after mutations and after source edits; checks remain read-only and never infer or apply actions from prose suggestions.",
     },
     {
         name: "kb_sparql_remote",
         cliName: "sparql-remote",
         description: "Opt-in remote SPARQL query tool for external HTTP(S) RDF endpoints. This does not query Kibi's local RDF store directly, stores no credentials, and depends on network availability.",
     },
+    {
+        name: "kb_compile_intent",
+        cliName: "compile-intent",
+        description: "Compile complete change intent into a deterministic, snapshot-bound read-only plan. Reuses intent-aware discovery and semantic modeling, accounts for every proposition, reports contradiction witnesses, proposes traceability links, and emits dependency-ordered kb_upsert-style steps only for resolved typed claims. No mutation side effects.",
+    },
+    {
+        name: "kb_apply_plan",
+        cliName: "apply-plan",
+        description: "Apply an explicitly approved kibi.bootstrap-plan.v1, kibi.compile-plan.v1, kibi.migration-plan.v2, or entity-deletion plan after revalidating its canonical hash and live snapshots. Bootstrap actions are dependency-ordered, sequential, source-first, and recoverable from a typed journal.",
+    },
+    {
+        name: "kb_ingest_verification",
+        cliName: "ingest-verification",
+        description: "Ingest a reporter-produced kibi.playwright-run.v1 artifact for a contracted test. Revalidates the live workspace snapshot, runner/command contract, required case/project coverage, and append-only receipt history before deriving and appending a kibi.verification-receipt.v2. It never accepts a caller-authored receipt or trusted outcome.",
+    },
 ];
 const METADATA_BY_NAME = new Map(CLI_OPERATION_METADATA.map((metadata) => [metadata.name, metadata]));
 export function getCliOperationMetadata(name) {

package/dist/cli-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAG7E,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAUF,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAoC5B"}
+{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAO7E,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AA+CF,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}

package/dist/cli-protocol.js

@@ -1,38 +1,68 @@
+import Ajv2020 from "ajv/dist/2020.js";
 import { InputError, OperationError } from "./cli-errors.js";
 import { loadOperationSpec } from "./cli-operation-loader.js";
 import { isOperationName } from "./cli-operation-metadata.js";
 import { prepareOperationInput, } from "./cli-validate.js";
-function errorResult(error) {
+import { operationData, toKibiResult, } from "./public/operations/result-envelope.js";
+const outputValidator = new Ajv2020({ strict: false, allErrors: true });
+function errorResult(operation, error, spec) {
+    const envelope = toKibiResult(spec ?? {
+        name: operation,
+        effects: [],
+        resultVersion: `kibi.${operation}.v1`,
+    }, null, {
+        status: "error",
+        error: {
+            code: error.code,
+            message: error.detail,
+            retryable: error.exitCode === 1,
+        },
+    });
     return {
         exitCode: error.exitCode,
+        stdout: `${JSON.stringify(envelope)}\n`,
         stderr: `Error [${error.code}]: ${error.detail}\n`,
     };
 }
+function protocolValid(spec, envelope) {
+    if (!spec.outputSchema)
+        return true;
+    try {
+        return outputValidator.compile(spec.outputSchema)(envelope) === true;
+    }
+    catch {
+        return false;
+    }
+}
 // implements REQ-kibi-operation-interface-parity
 export async function executeOperation(catalogName, input, context) {
     if (!isOperationName(catalogName)) {
-        return errorResult(new InputError("UNKNOWN_OPERATION", `Unknown operation '${catalogName}'.`));
+        return errorResult(catalogName, new InputError("UNKNOWN_OPERATION", `Unknown operation '${catalogName}'.`));
     }
     const spec = await loadOperationSpec(catalogName);
     const prepared = prepareOperationInput(input, spec.businessInputSchema);
     if (!prepared.valid) {
-        return errorResult(new InputError("VALIDATION_FAILED", prepared.errors.join("; ")));
+        return errorResult(catalogName, new InputError("VALIDATION_FAILED", prepared.errors.join("; ")), spec);
     }
     try {
         const executionContext = prepared.telemetry
             ? { ...context, diagnosticTelemetry: prepared.telemetry }
             : context;
         const result = await spec.execute(prepared.businessInput, executionContext);
-        const output = result.structuredContent ?? result;
-        return { exitCode: 0, stdout: `${JSON.stringify(output)}\n` };
+        const output = operationData(result);
+        const envelope = toKibiResult(spec, output);
+        if (!protocolValid(spec, envelope)) {
+            return errorResult(catalogName, new OperationError("PROTOCOL_VALIDATION_FAILED", "Operation produced a result that does not satisfy its generated output contract."), spec);
+        }
+        return { exitCode: 0, stdout: `${JSON.stringify(envelope)}\n` };
     }
     catch (error) {
         if (error instanceof InputError || error instanceof OperationError) {
-            return errorResult(error);
+            return errorResult(catalogName, error, spec);
         }
         if (error instanceof Error) {
-            return errorResult(new OperationError("OPERATION_FAILED", error.message));
+            return errorResult(catalogName, new OperationError("OPERATION_FAILED", error.message), spec);
         }
-        return errorResult(new OperationError("OPERATION_FAILED", "Operation failed unexpectedly."));
+        return errorResult(catalogName, new OperationError("OPERATION_FAILED", "Operation failed unexpectedly."), spec);
     }
 }

package/dist/cli-register-foundation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-foundation.d.ts","sourceRoot":"","sources":["../src/cli-register-foundation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuHjE"}
+{"version":3,"file":"cli-register-foundation.d.ts","sourceRoot":"","sources":["../src/cli-register-foundation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqJjE"}

package/dist/cli-register-foundation.js

@@ -8,14 +8,26 @@ async function runJsonInvocation(invocation) {
 export function registerFoundationCommands(program) {
     program
         .command("init")
-        .description("Initialize .kb/ directory")
+        .description("Initialize Kibi repository infrastructure, hooks, and branch-local storage")
         .option("--no-hooks", "Do not install git hooks (hooks installed by default)")
+        .option("--github", "Scaffold the GitHub Pages badge + requirement-health report workflow")
+        .option("--badge-only", "With --github, publish only the badge (opt out of the full report)")
         .action(withExitCode(async (options) => (await import("./commands/init.js")).initCommand(options)));
     program
         .command("migrate")
-        .description("Migrate .kb/config.json to the latest schema version")
+        .description("Preview or apply the structured migration plan")
         .option("--dry-run", "Preview migration changes without writing files")
         .option("--yes", "Apply migration changes without prompting")
+        .option("--format <format>", "Output format: json|table", "table")
+        .option("--apply-safe", "Apply only explicitly approved deterministic migration actions")
+        .option("--approved-plan-hash <sha256>", "Exact migration plan hash approved for --apply-safe")
+        .option("--approved-action <id>", "Approve one migration action (repeatable through comma-separated IDs)", (value, previous = []) => [
+        ...previous,
+        ...value
+            .split(",")
+            .map((item) => item.trim())
+            .filter(Boolean),
+    ])
         .action(withExitCode(async (options) => (await import("./commands/migrate.js")).migrateCommand(options)));
     program
         .command("sync")

package/dist/cli-register-maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0GlE"}
+{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2IlE"}

package/dist/cli-register-maintenance.js

@@ -32,17 +32,22 @@ export function registerMaintenanceCommands(program) {
         .command("gc")
         .description("Garbage collect stale branch KBs")
         .option("--dry-run", "Preview without deleting (default)", true)
-        .option("--force", "Actually delete stale branches")
+        .option("--force", "Quarantine stale branches (reversible)")
+        .option("--purge", "Permanently purge quarantined stores past retention")
+        .option("--retention-days <n>", "Quarantine retention period", "30")
         .action(async (options) => {
         await (await import("./commands/gc.js")).gcCommand({
             dryRun: !options.force,
             force: options.force,
+            purge: options.purge,
+            retentionDays: Number(options.retentionDays),
         });
     });
     program
         .command("doctor")
         .description("Diagnose KB setup and configuration")
-        .action(withExitCode(async () => (await import("./commands/doctor.js")).doctorCommand()));
+        .option("--format <format>", "Output format: json|table", "table")
+        .action(withExitCode(async (options) => (await import("./commands/doctor.js")).doctorCommand(options)));
     program
         .command("usage-metrics")
         .description("Report usage and quality metrics from .kb/usage.log")
@@ -59,11 +64,28 @@ export function registerMaintenanceCommands(program) {
     program
         .command("branch")
         .description("Manage branch KBs")
-        .argument("<action>", "Action: ensure")
-        .option("--from <branch>", "Source branch to copy KB from")
+        .argument("<action>", "Action: ensure|migrate|recover|restore")
+        .option("--branch <branch>", "Exact branch identity to restore")
+        .option("--from <branch>", "Legacy source branch for explicit migration")
+        .option("--to <branch>", "Exact target Git branch identity (required for migration)")
+        .option("--approval-hash <sha256>", "Hash printed by the migration preview")
+        .option("--recover-journal <id>", "Recover an interrupted branch migration journal")
+        .option("--apply", "Apply an explicit branch migration (preview is default)")
         .action(async (action, options) => {
         if (action === "ensure") {
             await (await import("./commands/branch.js")).branchEnsureCommand(options);
         }
+        else if (action === "migrate") {
+            await (await import("./commands/branch.js")).branchMigrateCommand(options);
+        }
+        else if (action === "recover") {
+            await (await import("./commands/branch.js")).branchRecoverCommand(options);
+        }
+        else if (action === "restore") {
+            await (await import("./commands/branch.js")).branchRestoreCommand(options);
+        }
+        else {
+            throw new Error(`Unknown branch action '${action}'`);
+        }
     });
 }

package/dist/cli-register-reporting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgJhE"}
+{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqKhE"}

package/dist/cli-register-reporting.js

@@ -30,6 +30,16 @@ export function registerReportingCommands(program) {
         }
         await (await import("./commands/gaps.js")).gapsCommand(type, options);
     });
+    program
+        .command("report")
+        .description("Generate a self-contained HTML requirement-health report for local viewing or CI publishing")
+        .option("--output <path>", "HTML file or directory (directories receive index.html)", "kibi-report")
+        .option("--open", "Open the generated report in the default browser", false)
+        .option("--tag <tags>", "Comma-separated tag filter")
+        .option("--limit <n>", "Maximum complete requirement rows (1-100000)", "10000")
+        .action(async (options) => {
+        await (await import("./commands/report.js")).reportCommand(options);
+    });
     program
         .command("coverage")
         .description(getCliOperationMetadata("kb_coverage").description)

package/dist/cli-register-verification.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerVerificationCommand(program: Command): void;
+//# sourceMappingURL=cli-register-verification.d.ts.map

package/dist/cli-register-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-register-verification.d.ts","sourceRoot":"","sources":["../src/cli-register-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6BlE"}

package/dist/cli-register-verification.js

@@ -0,0 +1,16 @@
+import { withExitCode } from "./cli-command.js";
+// implements REQ-kibi-verification-evidence-contract
+export function registerVerificationCommand(program) {
+    program
+        .command("verify [command...]")
+        .description("Run an explicit contracted verification command and ingest its Playwright reporter artifact")
+        .requiredOption("--test-id <id>", "Existing test entity with a verification contract")
+        .option("--output <path>", "Reporter artifact path")
+        .allowUnknownOption(true)
+        .action(withExitCode(async (commandArgv, options) => (await import("./commands/verify.js")).verifyCommand({
+        testId: options.testId,
+        ...(options.output === undefined
+            ? {}
+            : { outputPath: options.output }),
+    }, commandArgv)));
+}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAmBtD,wBAAgB,YAAY,IAAI,OAAO,CAgBtC;AAGD,wBAAsB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAgB3C"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAmBtD,wBAAgB,YAAY,IAAI,OAAO,CAiBtC;AAGD,wBAAsB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAgB3C"}

package/dist/cli.js

@@ -25,6 +25,7 @@ import { registerJsonOnlyCommands } from "./cli-register-json.js";
 import { registerMaintenanceCommands } from "./cli-register-maintenance.js";
 import { registerReportingCommands } from "./cli-register-reporting.js";
 import { registerSkillsCommands } from "./cli-register-skills.js";
+import { registerVerificationCommand } from "./cli-register-verification.js";
 const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 function packageVersion(value) {
     if (value !== null &&
@@ -46,6 +47,7 @@ export function buildProgram() {
     registerReportingCommands(program);
     registerMaintenanceCommands(program);
     registerSkillsCommands(program);
+    registerVerificationCommand(program);
     registerJsonOnlyCommands(program);
     return program;
 }

package/dist/commands/aggregated-checks.d.ts

@@ -6,7 +6,6 @@ import type { Violation } from "./check.js";
  * faster than running individual checks with multiple round-trips.
  * @param prolog - The Prolog process
  * @param rulesAllowlist - Set of rule names to run (null = all)
- * @param requireAdr - Whether to require ADR constraints for symbol-traceability
  */
-export declare function runAggregatedChecks(prolog: Pick<PrologProcess, "query">, rulesAllowlist: Set<string> | null, requireAdr?: boolean): Promise<Violation[]>;
+export declare function runAggregatedChecks(prolog: Pick<PrologProcess, "query">, rulesAllowlist: Set<string> | null): Promise<Violation[]>;
 //# sourceMappingURL=aggregated-checks.d.ts.map

package/dist/commands/aggregated-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregated-checks.d.ts","sourceRoot":"","sources":["../../src/commands/aggregated-checks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,cAAc,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAW5C;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EACpC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAClC,UAAU,UAAQ,GACjB,OAAO,CAAC,SAAS,EAAE,CAAC,CAwDtB"}
+{"version":3,"file":"aggregated-checks.d.ts","sourceRoot":"","sources":["../../src/commands/aggregated-checks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,cAAc,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAW5C;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EACpC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,GACjC,OAAO,CAAC,SAAS,EAAE,CAAC,CA8DtB"}

package/dist/commands/aggregated-checks.js

@@ -1,26 +1,31 @@
 import path from "node:path";
 import { resolveKbPlPath } from "../prolog.js";
-import { escapeAtom } from "../prolog/codec.js";
+import { escapeAtom, toPrologAtom } from "../prolog/codec.js";
 /**
  * Run all checks using the aggregated Prolog predicates.
  * This makes a single Prolog call and parses JSON output, significantly
  * faster than running individual checks with multiple round-trips.
  * @param prolog - The Prolog process
  * @param rulesAllowlist - Set of rule names to run (null = all)
- * @param requireAdr - Whether to require ADR constraints for symbol-traceability
  */
-export async function runAggregatedChecks(prolog, rulesAllowlist, requireAdr = false) {
+export async function runAggregatedChecks(prolog, rulesAllowlist) {
     // implements REQ-003
     const violations = [];
     const checksPlPath = path.join(path.dirname(resolveKbPlPath()), "checks.pl");
     const checksPlPathEscaped = escapeAtom(checksPlPath);
-    // Use check_all_json_with_options if available, otherwise fall back to check_all_json
-    const requireAdrStr = requireAdr ? "true" : "false";
-    const query = `(use_module('${checksPlPathEscaped}'), 
-    (   predicate_property(checks:check_all_json_with_options(_, _), _)
-    ->  call(checks:check_all_json_with_options(JsonString, ${requireAdrStr}))
+    const fallbackQuery = `(   predicate_property(checks:check_all_json_with_options(_, _), _)
+    ->  call(checks:check_all_json_with_options(JsonString, false))
     ;   call(checks:check_all_json(JsonString))
-    ))`;
+    )`;
+    const checksQuery = rulesAllowlist
+        ? `(   predicate_property(checks:check_selected_json(_, _), _)
+      ->  call(checks:check_selected_json([${[...rulesAllowlist]
+            .map(toPrologAtom)
+            .join(",")}], JsonString))
+      ;   ${fallbackQuery}
+      )`
+        : fallbackQuery;
+    const query = `(use_module('${checksPlPathEscaped}'), ${checksQuery})`;
     const result = await prolog.query(query);
     if (!result.success) {
         throw new Error(`Aggregated checks query failed: ${result.error || "Unknown error"}`);