kibi-cli 0.19.0 → 2.0.0

package/dist/cli-errors.d.ts

@@ -2,12 +2,14 @@ export declare class InputError extends Error {
     readonly code: string;
     readonly detail: string;
     readonly exitCode = 2;
+    readonly retryable = false;
     constructor(code: string, detail: string);
 }
 export declare class OperationError extends Error {
     readonly code: string;
     readonly detail: string;
+    readonly retryable: boolean;
     readonly exitCode = 1;
-    constructor(code: string, detail: string);
+    constructor(code: string, detail: string, retryable?: boolean);
 }
 //# sourceMappingURL=cli-errors.d.ts.map

package/dist/cli-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-errors.d.ts","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AACA,qBAAa,UAAW,SAAQ,KAAK;IAKjC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,QAAQ,KAAK;gBAGX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B;AAGD,qBAAa,cAAe,SAAQ,KAAK;IAKrC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,QAAQ,KAAK;gBAGX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B"}
+{"version":3,"file":"cli-errors.d.ts","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AACA,qBAAa,UAAW,SAAQ,KAAK;IAMjC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALzB,QAAQ,CAAC,QAAQ,KAAK;IACtB,QAAQ,CAAC,SAAS,SAAS;gBAGhB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B;AAGD,qBAAa,cAAe,SAAQ,KAAK;IAKrC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS;IALpB,QAAQ,CAAC,QAAQ,KAAK;gBAGX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,UAAO;CAK5B"}

package/dist/cli-errors.js

@@ -4,6 +4,7 @@ export class InputError extends Error {
     detail;
     // implements REQ-kibi-operation-interface-parity
     exitCode = 2;
+    retryable = false;
     constructor(code, detail) {
         super(detail);
         this.code = code;
@@ -15,12 +16,14 @@ export class InputError extends Error {
 export class OperationError extends Error {
     code;
     detail;
+    retryable;
     // implements REQ-kibi-operation-interface-parity
     exitCode = 1;
-    constructor(code, detail) {
+    constructor(code, detail, retryable = true) {
         super(detail);
         this.code = code;
         this.detail = detail;
+        this.retryable = retryable;
         this.name = "OperationError";
     }
 }

package/dist/cli-json-command.d.ts

@@ -1,5 +1,6 @@
 import type { Command } from "commander";
 import type { OperationName } from "./public/operations/types.js";
+export declare function writeOptionalStderr(stderr: string | undefined): void;
 export type JsonInvocation = {
     readonly operationName: OperationName;
     readonly inputPath: string;

package/dist/cli-json-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-json-command.d.ts","sourceRoot":"","sources":["../src/cli-json-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAIlE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KACpC,EAAE,CAAC;CACL,CAAC;AA0CF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC,CAyGf"}
+{"version":3,"file":"cli-json-command.d.ts","sourceRoot":"","sources":["../src/cli-json-command.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIpE;AAGD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KACpC,EAAE,CAAC;CACL,CAAC;AAkDF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC,CAuGf"}

package/dist/cli-json-command.js

@@ -1,3 +1,4 @@
+import { once } from "node:events";
 import { InputError } from "./cli-errors.js";
 import { loadInput } from "./cli-input.js";
 import { loadOperationSpec } from "./cli-operation-loader.js";
@@ -5,6 +6,11 @@ import { executeOperation as executeProtocolOperation } from "./cli-protocol.js"
 import { prepareOperationInput } from "./cli-validate.js";
 import { appendCliDiagnosticUsage } from "./public/diagnostic-usage.js";
 import { createCliRuntime } from "./runtime/cli-runtime.js";
+export function writeOptionalStderr(stderr) {
+    if (stderr !== undefined) {
+        process.stderr.write(stderr);
+    }
+}
 function writeInputError(error) {
     process.stderr.write(`Error [${error.code}]: ${error.detail}\n`);
     process.exitCode = error.exitCode;
@@ -38,6 +44,11 @@ function structuredResult(stdout) {
         return undefined;
     }
 }
+async function writeAndWaitForDrain(stream, value) {
+    if (stream.write(value))
+        return;
+    await once(stream, "drain");
+}
 // implements REQ-kibi-operation-interface-parity
 export async function runJsonInvocation(invocation) {
     const startedAt = new Date();
@@ -131,10 +142,8 @@ export async function runJsonInvocation(invocation) {
         });
     }
     if (result.stdout !== undefined) {
-        process.stdout.write(result.stdout);
-    }
-    if (result.stderr !== undefined) {
-        process.stderr.write(result.stderr);
+        await writeAndWaitForDrain(process.stdout, result.stdout);
     }
+    writeOptionalStderr(result.stderr);
     process.exitCode = result.exitCode;
 }

package/dist/cli-operation-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-operation-loader.d.ts","sourceRoot":"","sources":["../src/cli-operation-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,8BAA8B,CAAC;AAOtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,aAAa,CAAC,CAoDxB"}
+{"version":3,"file":"cli-operation-loader.d.ts","sourceRoot":"","sources":["../src/cli-operation-loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,8BAA8B,CAAC;AAOtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,aAAa,CAAC,CAoFxB"}

package/dist/cli-operation-loader.js

@@ -1,58 +1,91 @@
+import { withContractDefaults } from "./public/operations/catalog.js";
 // Load only the implementation selected by the client. Importing the public
 // catalog remains useful for introspection and parity tests, but pulling every
 // operation into each short-lived CLI process makes test and shell startup pay
 // for unrelated commands.
 // implements REQ-test-journaled-engine-harness
 export async function loadOperationSpec(name) {
+    let spec;
     switch (name) {
         case "kb_skills_list":
-            return (await import("./public/operations/specs/skills.js"))
+            spec = (await import("./public/operations/specs/skills.js"))
                 .skillsListSpec;
+            break;
         case "kb_skills_load":
-            return (await import("./public/operations/specs/skills.js"))
+            spec = (await import("./public/operations/specs/skills.js"))
                 .skillsLoadSpec;
+            break;
         case "kb_skills_read":
-            return (await import("./public/operations/specs/skills.js"))
+            spec = (await import("./public/operations/specs/skills.js"))
                 .skillsReadSpec;
+            break;
         case "kb_query":
-            return (await import("./public/operations/specs/discovery.js")).querySpec;
+            spec = (await import("./public/operations/specs/discovery.js")).querySpec;
+            break;
         case "kb_search":
-            return (await import("./public/operations/specs/discovery.js"))
+            spec = (await import("./public/operations/specs/discovery.js"))
                 .searchSpec;
+            break;
         case "kb_status":
-            return (await import("./public/operations/specs/discovery.js"))
+            spec = (await import("./public/operations/specs/discovery.js"))
                 .statusSpec;
+            break;
         case "kb_find_gaps":
-            return (await import("./public/operations/specs/reporting.js"))
+            spec = (await import("./public/operations/specs/reporting.js"))
                 .findGapsSpec;
+            break;
         case "kb_coverage":
-            return (await import("./public/operations/specs/reporting.js"))
+            spec = (await import("./public/operations/specs/reporting.js"))
                 .coverageSpec;
+            break;
         case "kb_graph":
-            return (await import("./public/operations/specs/reporting.js")).graphSpec;
+            spec = (await import("./public/operations/specs/reporting.js")).graphSpec;
+            break;
         case "kb_sparql_remote":
-            return (await import("./public/operations/specs/sparql.js"))
+            spec = (await import("./public/operations/specs/sparql.js"))
                 .sparqlRemoteSpec;
+            break;
         case "kb_semantic_advisor":
-            return (await import("./public/operations/specs/semantic.js"))
+            spec = (await import("./public/operations/specs/semantic.js"))
                 .semanticAdvisorSpec;
+            break;
         case "kb_model_requirement":
-            return (await import("./public/operations/specs/modeling.js"))
+            spec = (await import("./public/operations/specs/modeling.js"))
                 .modelRequirementSpec;
+            break;
         case "kb_suggest_predicates":
-            return (await import("./public/operations/specs/modeling.js"))
+            spec = (await import("./public/operations/specs/modeling.js"))
                 .suggestPredicatesSpec;
-        case "kb_autopilot_generate":
-            return (await import("./public/operations/specs/autopilot.js"))
-                .autopilotGenerateSpec;
+            break;
+        case "kb_plan_bootstrap":
+            spec = (await import("./public/operations/specs/bootstrap.js"))
+                .planBootstrapSpec;
+            break;
         case "kb_validate_upsert":
-            return (await import("./public/operations/specs/mutation.js"))
+            spec = (await import("./public/operations/specs/mutation.js"))
                 .validateUpsertSpec;
+            break;
         case "kb_upsert":
-            return (await import("./public/operations/specs/upsert.js")).upsertSpec;
+            spec = (await import("./public/operations/specs/upsert.js")).upsertSpec;
+            break;
         case "kb_delete":
-            return (await import("./public/operations/specs/mutation.js")).deleteSpec;
+            spec = (await import("./public/operations/specs/mutation.js")).deleteSpec;
+            break;
         case "kb_check":
-            return (await import("./public/operations/specs/check.js")).checkSpec;
+            spec = (await import("./public/operations/specs/check.js")).checkSpec;
+            break;
+        case "kb_compile_intent":
+            spec = (await import("./public/operations/specs/planning.js"))
+                .compileIntentSpec;
+            break;
+        case "kb_apply_plan":
+            spec = (await import("./public/operations/specs/planning.js"))
+                .applyPlanSpec;
+            break;
+        case "kb_ingest_proof":
+            spec = (await import("./public/operations/specs/proof.js"))
+                .ingestProofSpec;
+            break;
     }
+    return withContractDefaults(spec);
 }

package/dist/cli-operation-metadata.d.ts

@@ -23,11 +23,11 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_search";
     readonly cliName: "search";
-    readonly description: "Search KB entities for discovery using metadata and markdown body text. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.";
+    readonly description: "Search KB entities for discovery using legacy lexical ranking or deterministic intent-v1 ranking. Intent mode accepts host-agent semantic facets and source locations, returns evidence and abstains below its confidence threshold. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.";
 }, {
     readonly name: "kb_status";
     readonly cliName: "status";
-    readonly description: "Report current branch, KB snapshot and freshness metadata, plus the deterministic workspace snapshot used to validate execution receipts. Read-only status inspection with no mutation side effects.";
+    readonly description: "Report current branch, KB snapshot, freshness metadata, schema status, and a typed kibi.migration-plan.v2 action graph. Read-only status inspection with no mutation side effects; damaged stores are diagnosed without starting the engine.";
 }, {
     readonly name: "kb_find_gaps";
     readonly cliName: "find-gaps";
@@ -35,7 +35,7 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_coverage";
     readonly cliName: "coverage";
-    readonly description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Requirement reports include a deterministic, dependency-ordered, read-only repair plan; optional legacy migration previews reconstruct authored proposition inventories and rank exact schema candidates without producing executable writes. Paginated plans identify incomplete scope. Requirement rows keep coverageStatus separate from proofStatus and require fresh snapshot-bound E2E receipts before proof. No mutation side effects.";
+    readonly description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Reports include the compatible repair plan plus typed kibi.migration-plan.v2 actions; semantic and E2E actions remain review/execution work. Paginated plans identify incomplete scope and no mutation occurs.";
 }, {
     readonly name: "kb_graph";
     readonly cliName: "graph";
@@ -51,11 +51,11 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_suggest_predicates";
     readonly cliName: "suggest-predicates";
-    readonly description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Read-only guidance returns ranked candidates, an applicable predicate-fact plan only when every ordered argument is bound, a separate requires_predicate relationship plan when a requirement ID is supplied, or an explicit ontology-gap observation when no predicate fits.";
+    readonly description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Retrieval/ranking is followed by a semantic applicability gate and conservative binding review; complete-looking generic placeholders never trigger application. Read-only guidance returns additive candidate diagnostics, an applicable predicate-fact plan only for a semantically eligible candidate with reviewed bindings, or an explicit ontology-gap observation plus a deterministic review-only predicate schema draft when no schema fits.";
 }, {
-    readonly name: "kb_autopilot_generate";
-    readonly cliName: "autopilot-generate";
-    readonly description: "Generate agent-centric bootstrap output for KB population. Read-only analysis that returns activation state, bootstrap guidance, candidate entities with evidence, payoff summary, and exact applyPlan payloads for later kb_upsert calls. No mutation side effects.";
+    readonly name: "kb_plan_bootstrap";
+    readonly cliName: "plan-bootstrap";
+    readonly description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.";
 }, {
     readonly name: "kb_validate_upsert";
     readonly cliName: "validate-upsert";
@@ -71,12 +71,25 @@ export declare const CLI_OPERATION_METADATA: readonly [{
 }, {
     readonly name: "kb_check";
     readonly cliName: "check";
-    readonly description: "Run KB validation rules and return violations. Use before or after mutations, and after meaningful source edits with impact options to surface symbol granularity and semantic-review diagnostics. Do not use for point lookups. No write side effects. Prefer explicit rules for faster iteration; omit rules for final full validation plus full-KB qualityDiagnostics review, including telemetry acceptance when .kb/usage.log exists.";
+    readonly description: "Run KB validation rules and return violations, quality diagnostics, and typed kibi.migration-plan.v2 actions. Use before or after mutations and after source edits; checks remain read-only and never infer or apply actions from prose suggestions.";
 }, {
     readonly name: "kb_sparql_remote";
     readonly cliName: "sparql-remote";
     readonly description: "Opt-in remote SPARQL query tool for external HTTP(S) RDF endpoints. This does not query Kibi's local RDF store directly, stores no credentials, and depends on network availability.";
+}, {
+    readonly name: "kb_compile_intent";
+    readonly cliName: "compile-intent";
+    readonly description: "Compile complete change intent into a deterministic, snapshot-bound read-only plan. Reuses intent-aware discovery and semantic modeling, accounts for every proposition, reports contradiction witnesses, proposes traceability links, and emits dependency-ordered kb_upsert-style steps only for resolved typed claims. No mutation side effects.";
+}, {
+    readonly name: "kb_apply_plan";
+    readonly cliName: "apply-plan";
+    readonly description: "Apply an explicitly approved kibi.bootstrap-plan.v1, kibi.compile-plan.v1, kibi.migration-plan.v2, or entity-deletion plan after revalidating its canonical hash and live snapshots. Bootstrap actions are dependency-ordered, sequential, source-first, and recoverable from a typed journal.";
+}, {
+    readonly name: "kb_ingest_proof";
+    readonly cliName: "ingest-proof";
+    readonly description: "Ingest a producer-emitted kibi.proof-run.v1 artifact and evaluate it against each selected test's kibi.proof-contract.v1 proof obligations. Revalidates the live workspace snapshot, integration command binding, run-level outcome, attempt history, success policy, and append-only proof-receipt history before deriving and appending idempotent kibi.proof-receipt.v1 receipts. Producers report what happened; Kibi evaluates proof. Prefer `kibi prove` so the configured producer runs automatically; direct ingestion is an integration path for custom producers and agents.";
 }];
+export declare function requireCliOperationMetadata(metadata: CliOperationMetadata | undefined, name: OperationName): CliOperationMetadata;
 export declare function getCliOperationMetadata(name: OperationName): CliOperationMetadata;
 export declare function isOperationName(name: string): name is OperationName;
 //# sourceMappingURL=cli-operation-metadata.d.ts.map

package/dist/cli-operation-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6GiB,CAAC;AAMrD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAMtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}
+{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+HiB,CAAC;AAMrD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAKtB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAEtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}

package/dist/cli-operation-metadata.js

@@ -25,12 +25,12 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_search",
         cliName: "search",
-        description: "Search KB entities for discovery using metadata and markdown body text. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.",
+        description: "Search KB entities for discovery using legacy lexical ranking or deterministic intent-v1 ranking. Intent mode accepts host-agent semantic facets and source locations, returns evidence and abstains below its confidence threshold. Use for exploratory lookup before exact follow-up with kb_query. No mutation side effects.",
     },
     {
         name: "kb_status",
         cliName: "status",
-        description: "Report current branch, KB snapshot and freshness metadata, plus the deterministic workspace snapshot used to validate execution receipts. Read-only status inspection with no mutation side effects.",
+        description: "Report current branch, KB snapshot, freshness metadata, schema status, and a typed kibi.migration-plan.v2 action graph. Read-only status inspection with no mutation side effects; damaged stores are diagnosed without starting the engine.",
     },
     {
         name: "kb_find_gaps",
@@ -40,7 +40,7 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_coverage",
         cliName: "coverage",
-        description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Requirement reports include a deterministic, dependency-ordered, read-only repair plan; optional legacy migration previews reconstruct authored proposition inventories and rank exact schema candidates without producing executable writes. Paginated plans identify incomplete scope. Requirement rows keep coverageStatus separate from proofStatus and require fresh snapshot-bound E2E receipts before proof. No mutation side effects.",
+        description: "Generate curated structural coverage and conservative end-to-end requirement proof reports for requirements, symbols, or grouped types. Reports include the compatible repair plan plus typed kibi.migration-plan.v2 actions; semantic and E2E actions remain review/execution work. Paginated plans identify incomplete scope and no mutation occurs.",
     },
     {
         name: "kb_graph",
@@ -60,12 +60,12 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_suggest_predicates",
         cliName: "suggest-predicates",
-        description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Read-only guidance returns ranked candidates, an applicable predicate-fact plan only when every ordered argument is bound, a separate requires_predicate relationship plan when a requirement ID is supplied, or an explicit ontology-gap observation when no predicate fits.",
+        description: "Suggest ontology predicate schemas for prose requirements before agents write facts. Retrieval/ranking is followed by a semantic applicability gate and conservative binding review; complete-looking generic placeholders never trigger application. Read-only guidance returns additive candidate diagnostics, an applicable predicate-fact plan only for a semantically eligible candidate with reviewed bindings, or an explicit ontology-gap observation plus a deterministic review-only predicate schema draft when no schema fits.",
     },
     {
-        name: "kb_autopilot_generate",
-        cliName: "autopilot-generate",
-        description: "Generate agent-centric bootstrap output for KB population. Read-only analysis that returns activation state, bootstrap guidance, candidate entities with evidence, payoff summary, and exact applyPlan payloads for later kb_upsert calls. No mutation side effects.",
+        name: "kb_plan_bootstrap",
+        cliName: "plan-bootstrap",
+        description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.",
     },
     {
         name: "kb_validate_upsert",
@@ -85,22 +85,39 @@ export const CLI_OPERATION_METADATA = [
     {
         name: "kb_check",
         cliName: "check",
-        description: "Run KB validation rules and return violations. Use before or after mutations, and after meaningful source edits with impact options to surface symbol granularity and semantic-review diagnostics. Do not use for point lookups. No write side effects. Prefer explicit rules for faster iteration; omit rules for final full validation plus full-KB qualityDiagnostics review, including telemetry acceptance when .kb/usage.log exists.",
+        description: "Run KB validation rules and return violations, quality diagnostics, and typed kibi.migration-plan.v2 actions. Use before or after mutations and after source edits; checks remain read-only and never infer or apply actions from prose suggestions.",
     },
     {
         name: "kb_sparql_remote",
         cliName: "sparql-remote",
         description: "Opt-in remote SPARQL query tool for external HTTP(S) RDF endpoints. This does not query Kibi's local RDF store directly, stores no credentials, and depends on network availability.",
     },
+    {
+        name: "kb_compile_intent",
+        cliName: "compile-intent",
+        description: "Compile complete change intent into a deterministic, snapshot-bound read-only plan. Reuses intent-aware discovery and semantic modeling, accounts for every proposition, reports contradiction witnesses, proposes traceability links, and emits dependency-ordered kb_upsert-style steps only for resolved typed claims. No mutation side effects.",
+    },
+    {
+        name: "kb_apply_plan",
+        cliName: "apply-plan",
+        description: "Apply an explicitly approved kibi.bootstrap-plan.v1, kibi.compile-plan.v1, kibi.migration-plan.v2, or entity-deletion plan after revalidating its canonical hash and live snapshots. Bootstrap actions are dependency-ordered, sequential, source-first, and recoverable from a typed journal.",
+    },
+    {
+        name: "kb_ingest_proof",
+        cliName: "ingest-proof",
+        description: "Ingest a producer-emitted kibi.proof-run.v1 artifact and evaluate it against each selected test's kibi.proof-contract.v1 proof obligations. Revalidates the live workspace snapshot, integration command binding, run-level outcome, attempt history, success policy, and append-only proof-receipt history before deriving and appending idempotent kibi.proof-receipt.v1 receipts. Producers report what happened; Kibi evaluates proof. Prefer `kibi prove` so the configured producer runs automatically; direct ingestion is an integration path for custom producers and agents.",
+    },
 ];
 const METADATA_BY_NAME = new Map(CLI_OPERATION_METADATA.map((metadata) => [metadata.name, metadata]));
-export function getCliOperationMetadata(name) {
-    const metadata = METADATA_BY_NAME.get(name);
+export function requireCliOperationMetadata(metadata, name) {
     if (metadata === undefined) {
         throw new RangeError(`Unknown Kibi CLI operation: ${name}`);
     }
     return metadata;
 }
+export function getCliOperationMetadata(name) {
+    return requireCliOperationMetadata(METADATA_BY_NAME.get(name), name);
+}
 export function isOperationName(name) {
     return METADATA_BY_NAME.has(name);
 }

package/dist/cli-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAG7E,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAUF,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAoC5B"}
+{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAO7E,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AA+CF,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}

package/dist/cli-protocol.js

@@ -1,38 +1,68 @@
+import Ajv2020 from "ajv/dist/2020.js";
 import { InputError, OperationError } from "./cli-errors.js";
 import { loadOperationSpec } from "./cli-operation-loader.js";
 import { isOperationName } from "./cli-operation-metadata.js";
 import { prepareOperationInput, } from "./cli-validate.js";
-function errorResult(error) {
+import { operationData, toKibiResult, } from "./public/operations/result-envelope.js";
+const outputValidator = new Ajv2020({ strict: false, allErrors: true });
+function errorResult(operation, error, spec) {
+    const envelope = toKibiResult(spec ?? {
+        name: operation,
+        effects: [],
+        resultVersion: `kibi.${operation}.v1`,
+    }, null, {
+        status: "error",
+        error: {
+            code: error.code,
+            message: error.detail,
+            retryable: error.retryable,
+        },
+    });
     return {
         exitCode: error.exitCode,
+        stdout: `${JSON.stringify(envelope)}\n`,
         stderr: `Error [${error.code}]: ${error.detail}\n`,
     };
 }
+function protocolValid(spec, envelope) {
+    if (!spec.outputSchema)
+        return true;
+    try {
+        return outputValidator.compile(spec.outputSchema)(envelope) === true;
+    }
+    catch {
+        return false;
+    }
+}
 // implements REQ-kibi-operation-interface-parity
 export async function executeOperation(catalogName, input, context) {
     if (!isOperationName(catalogName)) {
-        return errorResult(new InputError("UNKNOWN_OPERATION", `Unknown operation '${catalogName}'.`));
+        return errorResult(catalogName, new InputError("UNKNOWN_OPERATION", `Unknown operation '${catalogName}'.`));
     }
     const spec = await loadOperationSpec(catalogName);
     const prepared = prepareOperationInput(input, spec.businessInputSchema);
     if (!prepared.valid) {
-        return errorResult(new InputError("VALIDATION_FAILED", prepared.errors.join("; ")));
+        return errorResult(catalogName, new InputError("VALIDATION_FAILED", prepared.errors.join("; ")), spec);
     }
     try {
         const executionContext = prepared.telemetry
             ? { ...context, diagnosticTelemetry: prepared.telemetry }
             : context;
         const result = await spec.execute(prepared.businessInput, executionContext);
-        const output = result.structuredContent ?? result;
-        return { exitCode: 0, stdout: `${JSON.stringify(output)}\n` };
+        const output = operationData(result);
+        const envelope = toKibiResult(spec, output);
+        if (!protocolValid(spec, envelope)) {
+            return errorResult(catalogName, new OperationError("PROTOCOL_VALIDATION_FAILED", "Operation produced a result that does not satisfy its generated output contract."), spec);
+        }
+        return { exitCode: 0, stdout: `${JSON.stringify(envelope)}\n` };
     }
     catch (error) {
         if (error instanceof InputError || error instanceof OperationError) {
-            return errorResult(error);
+            return errorResult(catalogName, error, spec);
         }
         if (error instanceof Error) {
-            return errorResult(new OperationError("OPERATION_FAILED", error.message));
+            return errorResult(catalogName, new OperationError("OPERATION_FAILED", error.message), spec);
         }
-        return errorResult(new OperationError("OPERATION_FAILED", "Operation failed unexpectedly."));
+        return errorResult(catalogName, new OperationError("OPERATION_FAILED", "Operation failed unexpectedly."), spec);
     }
 }

package/dist/cli-register-foundation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-foundation.d.ts","sourceRoot":"","sources":["../src/cli-register-foundation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuHjE"}
+{"version":3,"file":"cli-register-foundation.d.ts","sourceRoot":"","sources":["../src/cli-register-foundation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqJjE"}

package/dist/cli-register-foundation.js

@@ -8,14 +8,26 @@ async function runJsonInvocation(invocation) {
 export function registerFoundationCommands(program) {
     program
         .command("init")
-        .description("Initialize .kb/ directory")
+        .description("Initialize Kibi repository infrastructure, hooks, and branch-local storage")
         .option("--no-hooks", "Do not install git hooks (hooks installed by default)")
+        .option("--github", "Scaffold the GitHub Pages badge + requirement-health report workflow")
+        .option("--badge-only", "With --github, publish only the badge (opt out of the full report)")
         .action(withExitCode(async (options) => (await import("./commands/init.js")).initCommand(options)));
     program
         .command("migrate")
-        .description("Migrate .kb/config.json to the latest schema version")
+        .description("Preview or apply the structured migration plan")
         .option("--dry-run", "Preview migration changes without writing files")
         .option("--yes", "Apply migration changes without prompting")
+        .option("--format <format>", "Output format: json|table", "table")
+        .option("--apply-safe", "Apply only explicitly approved deterministic migration actions")
+        .option("--approved-plan-hash <sha256>", "Exact migration plan hash approved for --apply-safe")
+        .option("--approved-action <id>", "Approve one migration action (repeatable through comma-separated IDs)", (value, previous = []) => [
+        ...previous,
+        ...value
+            .split(",")
+            .map((item) => item.trim())
+            .filter(Boolean),
+    ])
         .action(withExitCode(async (options) => (await import("./commands/migrate.js")).migrateCommand(options)));
     program
         .command("sync")

package/dist/cli-register-maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0GlE"}
+{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2JlE"}

package/dist/cli-register-maintenance.js

@@ -12,6 +12,13 @@ export function registerMaintenanceCommands(program) {
         .command("stop")
         .description("Stop the current workspace engine")
         .action(async () => (await import("./commands/engine.js")).engineStopCommand());
+    engine
+        .command("janitor")
+        .description("Classify and clean stale engine daemons and branch-store locks (crashed engines, removed worktrees)")
+        .option("--all", "Also sweep runtime-directory daemon sockets from other workspaces", false)
+        .option("--apply", "Execute cleanups (default: report only)", false)
+        .option("--format <format>", "Output format: json|table", "table")
+        .action(async (options) => (await import("./commands/engine.js")).engineJanitorCommand(options));
     const storage = program
         .command("storage")
         .description("Inspect and maintain journaled Kibi storage");
@@ -32,17 +39,22 @@ export function registerMaintenanceCommands(program) {
         .command("gc")
         .description("Garbage collect stale branch KBs")
         .option("--dry-run", "Preview without deleting (default)", true)
-        .option("--force", "Actually delete stale branches")
+        .option("--force", "Quarantine stale branches (reversible)")
+        .option("--purge", "Permanently purge quarantined stores past retention")
+        .option("--retention-days <n>", "Quarantine retention period", "30")
         .action(async (options) => {
         await (await import("./commands/gc.js")).gcCommand({
             dryRun: !options.force,
             force: options.force,
+            purge: options.purge,
+            retentionDays: Number(options.retentionDays),
         });
     });
     program
         .command("doctor")
         .description("Diagnose KB setup and configuration")
-        .action(withExitCode(async () => (await import("./commands/doctor.js")).doctorCommand()));
+        .option("--format <format>", "Output format: json|table", "table")
+        .action(withExitCode(async (options) => (await import("./commands/doctor.js")).doctorCommand(options)));
     program
         .command("usage-metrics")
         .description("Report usage and quality metrics from .kb/usage.log")
@@ -59,11 +71,28 @@ export function registerMaintenanceCommands(program) {
     program
         .command("branch")
         .description("Manage branch KBs")
-        .argument("<action>", "Action: ensure")
-        .option("--from <branch>", "Source branch to copy KB from")
+        .argument("<action>", "Action: ensure|migrate|recover|restore")
+        .option("--branch <branch>", "Exact branch identity to restore")
+        .option("--from <branch>", "Legacy source branch for explicit migration")
+        .option("--to <branch>", "Exact target Git branch identity (required for migration)")
+        .option("--approval-hash <sha256>", "Hash printed by the migration preview")
+        .option("--recover-journal <id>", "Recover an interrupted branch migration journal")
+        .option("--apply", "Apply an explicit branch migration (preview is default)")
         .action(async (action, options) => {
         if (action === "ensure") {
             await (await import("./commands/branch.js")).branchEnsureCommand(options);
         }
+        else if (action === "migrate") {
+            await (await import("./commands/branch.js")).branchMigrateCommand(options);
+        }
+        else if (action === "recover") {
+            await (await import("./commands/branch.js")).branchRecoverCommand(options);
+        }
+        else if (action === "restore") {
+            await (await import("./commands/branch.js")).branchRestoreCommand(options);
+        }
+        else {
+            throw new Error(`Unknown branch action '${action}'`);
+        }
     });
 }

package/dist/cli-register-proof.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerProofCommand(program: Command): void;
+//# sourceMappingURL=cli-register-proof.d.ts.map

package/dist/cli-register-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-register-proof.d.ts","sourceRoot":"","sources":["../src/cli-register-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsH3D"}