kibi-cli 0.19.0 → 2.0.0

package/dist/utils/manifest-paths.js

@@ -1,64 +1,16 @@
-import { existsSync, readFileSync } from "node:fs";
 import * as path from "node:path";
-export const DEFAULT_SYMBOLS_PATH = "documentation/symbols.yaml";
-export const DEFAULT_COORDINATES_PATH = "documentation/symbol-coordinates.yaml";
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function resolveConfigPath(workspaceRoot, configPath) {
-    const configuredPath = configPath ?? path.join(workspaceRoot, ".kb", "config.json");
-    return path.isAbsolute(configuredPath)
-        ? configuredPath
-        : path.resolve(workspaceRoot, configuredPath);
-}
-function readManifestResolverConfig(workspaceRoot, configPath) {
-    const resolvedConfigPath = resolveConfigPath(workspaceRoot, configPath);
-    if (!existsSync(resolvedConfigPath)) {
-        return null;
-    }
-    try {
-        return JSON.parse(readFileSync(resolvedConfigPath, "utf8"));
-    }
-    catch {
-        return null;
-    }
-}
-function resolveConfiguredSymbolsPath(workspaceRoot, configPath) {
-    const config = readManifestResolverConfig(workspaceRoot, configPath);
-    if (!config) {
-        return null;
-    }
-    const configuredPathCandidate = config.paths?.symbols ?? config.symbolsManifest;
-    if (!isNonEmptyString(configuredPathCandidate)) {
-        return null;
-    }
-    return path.isAbsolute(configuredPathCandidate)
-        ? configuredPathCandidate
-        : path.resolve(workspaceRoot, configuredPathCandidate);
-}
-function resolveDefaultSymbolsPath(workspaceRoot) {
-    const candidates = [
-        path.join(workspaceRoot, DEFAULT_SYMBOLS_PATH),
-        path.join(workspaceRoot, "symbols.yaml"),
-        path.join(workspaceRoot, "symbols.yml"),
-    ];
-    return (candidates.find((candidate) => existsSync(candidate)) ??
-        candidates[0] ??
-        path.join(workspaceRoot, DEFAULT_SYMBOLS_PATH));
-}
-function deriveCoordinatesPath(symbolsPath) {
-    return path.join(path.dirname(symbolsPath), path.basename(DEFAULT_COORDINATES_PATH));
-}
+import { CANONICAL_ENTITY_PATHS, KB_PATHS } from "./kb-paths.js";
+export const DEFAULT_SYMBOLS_PATH = KB_PATHS.symbolsManifest;
+export const DEFAULT_COORDINATES_PATH = KB_PATHS.symbolCoordinates;
 // implements REQ-cli-sync
-export function resolveSymbolsManifestPaths(workspaceRoot, configPath) {
-    const symbolsPath = resolveConfiguredSymbolsPath(workspaceRoot, configPath) ??
-        resolveDefaultSymbolsPath(workspaceRoot);
+export function resolveSymbolsManifestPaths(workspaceRoot) {
+    const symbolsPath = path.join(workspaceRoot, CANONICAL_ENTITY_PATHS.symbols);
     return {
         symbolsPath,
-        coordinatesPath: deriveCoordinatesPath(symbolsPath),
+        coordinatesPath: path.join(workspaceRoot, DEFAULT_COORDINATES_PATH),
     };
 }
 // implements REQ-cli-sync
-export function resolveSymbolsManifestPath(workspaceRoot, configPath) {
-    return resolveSymbolsManifestPaths(workspaceRoot, configPath).symbolsPath;
+export function resolveSymbolsManifestPath(workspaceRoot) {
+    return resolveSymbolsManifestPaths(workspaceRoot).symbolsPath;
 }

package/dist/utils/rule-registry.d.ts

@@ -1,16 +1,27 @@
+export type RuleEnforcementClass = 
 /**
- * Central registry of all KB check rules.
- * This is the single source of truth for rule names, descriptions, and defaults.
+ * Canonical blocking correctness checks. Always evaluated by
+ * `kibi check`, hooks, CI, reports, and coverage summaries. Not
+ * configurable by any project surface.
  */
+"canonical"
+/**
+ * Advisory modeling-quality checks. Reported as quality diagnostics to
+ * guide agents, but never gate canonical health on their own.
+ */
+ | "advisory"
+/**
+ * Migration/experimental diagnostics. Default-off; surfaced only through
+ * explicit invocation-time `--rules` selection for focused diagnosis.
+ */
+ | "migration";
 export interface RuleDefinition {
     name: string;
     description: string;
-    defaultEnabled: boolean;
+    /** Kibi-owned role of this rule in the enforcement contract. */
+    enforcementClass: RuleEnforcementClass;
     category: "coverage" | "integrity" | "lifecycle" | "traceability";
 }
-export interface SymbolTraceabilityOptions {
-    requireAdr: boolean;
-}
 /** A single KB check violation. */
 export interface Violation {
     rule: string;
@@ -21,37 +32,44 @@ export interface Violation {
     /** Exact source-bound proof evidence, when the check can produce it. */
     evidence?: Readonly<Record<string, unknown>>;
 }
-export interface ChecksConfig {
-    rules: Record<string, boolean>;
-    symbolTraceability: SymbolTraceabilityOptions;
-}
-/**
- * All known check rules.
- * When adding a new rule, add it here.
- */
+/** All known check rules, generated from the shared registry JSON. */
 export declare const RULES: readonly RuleDefinition[];
 /**
  * Set of all rule names for quick lookups.
  */
 export declare const RULE_NAMES: Set<string>;
+export declare function getRuleDefinition(name: string): RuleDefinition | undefined;
+export declare function getRuleEnforcementClass(name: string): RuleEnforcementClass | undefined;
+/**
+ * Whether a plain `kibi check` evaluates this enforcement class.
+ * Canonical and advisory rules run; migration rules run only when
+ * explicitly selected with `--rules`.
+ */
+export declare function ruleRunsByDefault(enforcementClass: RuleEnforcementClass): boolean;
 /**
- * Default checks configuration with all rules enabled.
+ * Rules that a plain `kibi check` evaluates. Derived from enforcement
+ * class: canonical and advisory run, migration does not.
  */
-export declare const DEFAULT_CHECKS_CONFIG: ChecksConfig;
+export declare function getDefaultRules(): Set<string>;
 /**
- * Get effective rules based on config and CLI --rules filter.
- * @param configRules Rules from .kb/config.json (may be partial)
- * @param cliRules Optional comma-separated list from --rules CLI flag
+ * Canonical blocking rules only. Used by health badges, reports, and CI
+ * gates that must not fail on advisory or migration diagnostics.
+ */
+export declare function getCanonicalRules(): Set<string>;
+export declare function isCanonicalRule(name: string): boolean;
+/**
+ * Resolve the rule set for one check invocation.
+ *
+ * @param requestedRules Optional invocation-time diagnostic selector
+ *   (`--rules`). When absent, canonical and advisory rules run. When
+ *   present, only the selected rules run for that invocation and nothing is
+ *   persisted. Selection never changes enforcement class.
  * @returns Set of rule names that should run
  */
-export declare function getEffectiveRules(configRules?: Record<string, boolean>, cliRules?: string): Set<string>;
+export declare function getEffectiveRules(requestedRules?: readonly string[]): Set<string>;
 /**
  * Validate a rule name.
  * @returns Error message if invalid, null if valid
  */
 export declare function validateRuleName(name: string): string | null;
-/**
- * Merge partial checks config with defaults.
- */
-export declare function mergeChecksConfig(partial?: Partial<ChecksConfig>): ChecksConfig;
 //# sourceMappingURL=rule-registry.d.ts.map

package/dist/utils/rule-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule-registry.d.ts","sourceRoot":"","sources":["../../src/utils/rule-registry.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;CACnE;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,kBAAkB,EAAE,yBAAyB,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,SAAS,cAAc,EAsHjC,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,UAAU,aAAoC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAKnC,CAAC;AAEF;;;;;GAKG;AAEH,wBAAgB,iBAAiB,CAC/B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,QAAQ,CAAC,EAAE,MAAM,GAChB,GAAG,CAAC,MAAM,CAAC,CAsBb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC9B,YAAY,CAWd"}
+{"version":3,"file":"rule-registry.d.ts","sourceRoot":"","sources":["../../src/utils/rule-registry.ts"],"names":[],"mappings":"AAgCA,MAAM,MAAM,oBAAoB;AAC9B;;;;GAIG;AACD,WAAW;AACb;;;GAGG;GACD,UAAU;AACZ;;;GAGG;GACD,WAAW,CAAC;AAEhB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,QAAQ,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;CACnE;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,sEAAsE;AACtE,eAAO,MAAM,KAAK,EAAE,SAAS,cAAc,EAAoB,CAAC;AAIhE;;GAEG;AACH,eAAO,MAAM,UAAU,aAAoC,CAAC;AAE5D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1E;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX,oBAAoB,GAAG,SAAS,CAElC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,gBAAgB,EAAE,oBAAoB,GACrC,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,GAAG,CAAC,MAAM,CAAC,CAM7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,CAAC,CAM/C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AAEH,wBAAgB,iBAAiB,CAC/B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,GAAG,CAAC,MAAM,CAAC,CAOb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D"}

package/dist/utils/rule-registry.generated.d.ts

@@ -0,0 +1,97 @@
+export declare const GENERATED_RULES: readonly [{
+    readonly name: "must-priority-coverage";
+    readonly description: "Every must-priority requirement must have a scenario and a test";
+    readonly enforcementClass: "canonical";
+    readonly category: "coverage";
+}, {
+    readonly name: "symbol-coverage";
+    readonly description: "Production symbols need qualifying coverage via covered_by plus a canonical requirement/scenario test path";
+    readonly enforcementClass: "canonical";
+    readonly category: "coverage";
+}, {
+    readonly name: "symbol-traceability";
+    readonly description: "Production symbols must directly implement requirements for ownership; covered_by is coverage only and executable_for is test identity only";
+    readonly enforcementClass: "canonical";
+    readonly category: "traceability";
+}, {
+    readonly name: "no-dangling-refs";
+    readonly description: "All relationship targets must exist in the KB";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "source-relationship-parity";
+    readonly description: "Authored Markdown and relationship-shard edges must exactly match the compiled KB";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "no-cycles";
+    readonly description: "No circular dependency chains in requirements";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "required-fields";
+    readonly description: "All entities must have required fields";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "deprecated-adr-no-successor";
+    readonly description: "Deprecated ADRs must have a successor ADR that supersedes them";
+    readonly enforcementClass: "canonical";
+    readonly category: "lifecycle";
+}, {
+    readonly name: "domain-contradictions";
+    readonly description: "Detect contradictions between requirements constraining the same fact";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "logic-coverage";
+    readonly description: "Require every explicitly declared atomic requirement claim to be grounded by a linked strict-property or predicate fact";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "rule-safety";
+    readonly description: "Stored Logic IR rules use only the typed, bounded, stratified vocabulary";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "rule-verifiability";
+    readonly description: "Requirement rule links resolve to safe rules and registered rule schemas";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "query-plan-safety";
+    readonly description: "Detect Prolog validation clauses that place negation before generator calls";
+    readonly enforcementClass: "canonical";
+    readonly category: "integrity";
+}, {
+    readonly name: "req-status-vocabulary";
+    readonly description: "Requirement statuses must use the canonical vocabulary (open, in_progress, closed; legacy: active, approved); ADR statuses such as accepted silently fall out of the proof ladder";
+    readonly enforcementClass: "canonical";
+    readonly category: "lifecycle";
+}, {
+    readonly name: "strict-fact-shape";
+    readonly description: "Detect malformed strict facts (facts with fact_kind that are missing required fields)";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+}, {
+    readonly name: "strict-req-fact-pairing";
+    readonly description: "Detect requirements with incomplete strict subject/property fact pairing for contradiction-safe semantics";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+}, {
+    readonly name: "predicate-verifiability";
+    readonly description: "Detect requires_predicate links that do not target ground fact_kind: predicate facts";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+}, {
+    readonly name: "strict-readiness";
+    readonly description: "Report strict contradiction-readiness levels for requirements that are still prose-only or otherwise not contradiction-ready";
+    readonly enforcementClass: "migration";
+    readonly category: "integrity";
+}, {
+    readonly name: "semantic-completeness";
+    readonly description: "Every inventoried assertive proposition is modeled or explicitly classified";
+    readonly enforcementClass: "migration";
+    readonly category: "integrity";
+}];
+//# sourceMappingURL=rule-registry.generated.d.ts.map

package/dist/utils/rule-registry.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-registry.generated.d.ts","sourceRoot":"","sources":["../../src/utils/rule-registry.generated.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmIlB,CAAC"}

package/dist/utils/rule-registry.generated.js

@@ -0,0 +1,125 @@
+/*
+ * Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ * Copyright (C) 2026 Piotr Franczyk
+ *
+ * This file is generated by scripts/generate-rule-registry.mjs from
+ * packages/core/schema/rule-registry.json. Do not edit it directly; edit the
+ * JSON source and regenerate.
+ */
+// implements REQ-006
+export const GENERATED_RULES = [
+    {
+        name: "must-priority-coverage",
+        description: "Every must-priority requirement must have a scenario and a test",
+        enforcementClass: "canonical",
+        category: "coverage",
+    },
+    {
+        name: "symbol-coverage",
+        description: "Production symbols need qualifying coverage via covered_by plus a canonical requirement/scenario test path",
+        enforcementClass: "canonical",
+        category: "coverage",
+    },
+    {
+        name: "symbol-traceability",
+        description: "Production symbols must directly implement requirements for ownership; covered_by is coverage only and executable_for is test identity only",
+        enforcementClass: "canonical",
+        category: "traceability",
+    },
+    {
+        name: "no-dangling-refs",
+        description: "All relationship targets must exist in the KB",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "source-relationship-parity",
+        description: "Authored Markdown and relationship-shard edges must exactly match the compiled KB",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "no-cycles",
+        description: "No circular dependency chains in requirements",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "required-fields",
+        description: "All entities must have required fields",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "deprecated-adr-no-successor",
+        description: "Deprecated ADRs must have a successor ADR that supersedes them",
+        enforcementClass: "canonical",
+        category: "lifecycle",
+    },
+    {
+        name: "domain-contradictions",
+        description: "Detect contradictions between requirements constraining the same fact",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "logic-coverage",
+        description: "Require every explicitly declared atomic requirement claim to be grounded by a linked strict-property or predicate fact",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "rule-safety",
+        description: "Stored Logic IR rules use only the typed, bounded, stratified vocabulary",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "rule-verifiability",
+        description: "Requirement rule links resolve to safe rules and registered rule schemas",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "query-plan-safety",
+        description: "Detect Prolog validation clauses that place negation before generator calls",
+        enforcementClass: "canonical",
+        category: "integrity",
+    },
+    {
+        name: "req-status-vocabulary",
+        description: "Requirement statuses must use the canonical vocabulary (open, in_progress, closed; legacy: active, approved); ADR statuses such as accepted silently fall out of the proof ladder",
+        enforcementClass: "canonical",
+        category: "lifecycle",
+    },
+    {
+        name: "strict-fact-shape",
+        description: "Detect malformed strict facts (facts with fact_kind that are missing required fields)",
+        enforcementClass: "advisory",
+        category: "integrity",
+    },
+    {
+        name: "strict-req-fact-pairing",
+        description: "Detect requirements with incomplete strict subject/property fact pairing for contradiction-safe semantics",
+        enforcementClass: "advisory",
+        category: "integrity",
+    },
+    {
+        name: "predicate-verifiability",
+        description: "Detect requires_predicate links that do not target ground fact_kind: predicate facts",
+        enforcementClass: "advisory",
+        category: "integrity",
+    },
+    {
+        name: "strict-readiness",
+        description: "Report strict contradiction-readiness levels for requirements that are still prose-only or otherwise not contradiction-ready",
+        enforcementClass: "migration",
+        category: "integrity",
+    },
+    {
+        name: "semantic-completeness",
+        description: "Every inventoried assertive proposition is modeled or explicitly classified",
+        enforcementClass: "migration",
+        category: "integrity",
+    },
+];

package/dist/utils/rule-registry.js

@@ -16,151 +16,70 @@
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 /**
- * All known check rules.
- * When adding a new rule, add it here.
+ * Central registry of KB check rules.
+ *
+ * Kibi — not the repository — owns each rule's enforcement class. Projects
+ * can no longer disable canonical checks. `--rules` remains an
+ * invocation-time diagnostic selector only and never persists policy.
+ *
+ * RULES itself is generated from packages/core/schema/rule-registry.json by
+ * scripts/generate-rule-registry.mjs; that JSON is the single editing point
+ * shared with the kb_check input enum and the Prolog rule_registry facts.
  */
-export const RULES = [
-    // implements REQ-006
-    {
-        name: "must-priority-coverage",
-        description: "Every must-priority requirement must have a scenario and a test",
-        defaultEnabled: true,
-        category: "coverage",
-    },
-    {
-        name: "symbol-coverage",
-        description: "Production symbols need qualifying coverage via covered_by plus a canonical requirement/scenario test path",
-        defaultEnabled: true,
-        category: "coverage",
-    },
-    {
-        name: "symbol-traceability",
-        description: "Production symbols must directly implement requirements for ownership; covered_by is coverage only, executable_for is test identity only, and ADR constraints are optional unless configured",
-        defaultEnabled: true,
-        category: "traceability",
-    },
-    {
-        name: "no-dangling-refs",
-        description: "All relationship targets must exist in the KB",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-    {
-        name: "no-cycles",
-        description: "No circular dependency chains in requirements",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-    {
-        name: "required-fields",
-        description: "All entities must have required fields",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-    {
-        name: "deprecated-adr-no-successor",
-        description: "Deprecated ADRs must have a successor ADR that supersedes them",
-        defaultEnabled: true,
-        category: "lifecycle",
-    },
-    {
-        name: "domain-contradictions",
-        description: "Detect contradictions between requirements constraining the same fact",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-    {
-        name: "strict-fact-shape",
-        description: "Detect malformed strict facts (facts with fact_kind that are missing required fields)",
-        defaultEnabled: false,
-        category: "integrity",
-    },
-    {
-        name: "strict-req-fact-pairing",
-        description: "Detect requirements with incomplete strict subject/property fact pairing for contradiction-safe semantics",
-        defaultEnabled: false,
-        category: "integrity",
-    },
-    {
-        name: "strict-readiness",
-        description: "Report strict contradiction-readiness levels for requirements that are still prose-only or otherwise not contradiction-ready",
-        defaultEnabled: false,
-        category: "integrity",
-    },
-    {
-        name: "predicate-verifiability",
-        description: "Detect requires_predicate links that do not target ground fact_kind: predicate facts",
-        defaultEnabled: false,
-        category: "integrity",
-    },
-    {
-        name: "logic-coverage",
-        description: "Require every explicitly declared atomic requirement claim to be grounded by a linked strict-property or predicate fact",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-    {
-        name: "rule-safety",
-        description: "Stored Logic IR rules use only the typed, bounded, stratified vocabulary",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-    {
-        name: "rule-verifiability",
-        description: "Requirement rule links resolve to safe rules and registered rule schemas",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-    {
-        name: "semantic-completeness",
-        description: "Every inventoried assertive proposition is modeled or explicitly classified",
-        defaultEnabled: false,
-        category: "integrity",
-    },
-    {
-        name: "query-plan-safety",
-        description: "Detect Prolog validation clauses that place negation before generator calls",
-        defaultEnabled: true,
-        category: "integrity",
-    },
-];
+import { GENERATED_RULES } from "./rule-registry.generated.js";
+/** All known check rules, generated from the shared registry JSON. */
+export const RULES = GENERATED_RULES;
+const RULES_BY_NAME = new Map(RULES.map((rule) => [rule.name, rule]));
 /**
  * Set of all rule names for quick lookups.
  */
 export const RULE_NAMES = new Set(RULES.map((r) => r.name));
+export function getRuleDefinition(name) {
+    return RULES_BY_NAME.get(name);
+}
+export function getRuleEnforcementClass(name) {
+    return RULES_BY_NAME.get(name)?.enforcementClass;
+}
+/**
+ * Whether a plain `kibi check` evaluates this enforcement class.
+ * Canonical and advisory rules run; migration rules run only when
+ * explicitly selected with `--rules`.
+ */
+export function ruleRunsByDefault(enforcementClass) {
+    return enforcementClass !== "migration";
+}
+/**
+ * Rules that a plain `kibi check` evaluates. Derived from enforcement
+ * class: canonical and advisory run, migration does not.
+ */
+export function getDefaultRules() {
+    return new Set(RULES.filter((rule) => ruleRunsByDefault(rule.enforcementClass)).map((rule) => rule.name));
+}
 /**
- * Default checks configuration with all rules enabled.
+ * Canonical blocking rules only. Used by health badges, reports, and CI
+ * gates that must not fail on advisory or migration diagnostics.
  */
-export const DEFAULT_CHECKS_CONFIG = {
-    rules: Object.fromEntries(RULES.map((r) => [r.name, r.defaultEnabled])),
-    symbolTraceability: {
-        requireAdr: false,
-    },
-};
+export function getCanonicalRules() {
+    return new Set(RULES.filter((rule) => rule.enforcementClass === "canonical").map((r) => r.name));
+}
+export function isCanonicalRule(name) {
+    return RULES_BY_NAME.get(name)?.enforcementClass === "canonical";
+}
 /**
- * Get effective rules based on config and CLI --rules filter.
- * @param configRules Rules from .kb/config.json (may be partial)
- * @param cliRules Optional comma-separated list from --rules CLI flag
+ * Resolve the rule set for one check invocation.
+ *
+ * @param requestedRules Optional invocation-time diagnostic selector
+ *   (`--rules`). When absent, canonical and advisory rules run. When
+ *   present, only the selected rules run for that invocation and nothing is
+ *   persisted. Selection never changes enforcement class.
  * @returns Set of rule names that should run
  */
 // implements REQ-006
-export function getEffectiveRules(configRules, cliRules) {
-    if (cliRules) {
-        return new Set(cliRules
-            .split(",")
-            .map((s) => s.trim())
-            .filter((s) => RULE_NAMES.has(s)));
-    }
-    // Start with all known rules
-    const effective = new Set();
-    for (const rule of RULES) {
-        // Config value takes precedence over default, missing means use default
-        const enabled = configRules?.[rule.name] ?? rule.defaultEnabled;
-        if (enabled) {
-            effective.add(rule.name);
-        }
+export function getEffectiveRules(requestedRules) {
+    if (requestedRules !== undefined) {
+        return new Set(requestedRules.filter((name) => RULE_NAMES.has(name)));
     }
-    return effective;
+    return getDefaultRules();
 }
 /**
  * Validate a rule name.
@@ -172,18 +91,3 @@ export function validateRuleName(name) {
     }
     return null;
 }
-/**
- * Merge partial checks config with defaults.
- */
-export function mergeChecksConfig(partial) {
-    return {
-        rules: {
-            ...DEFAULT_CHECKS_CONFIG.rules,
-            ...partial?.rules,
-        },
-        symbolTraceability: {
-            ...DEFAULT_CHECKS_CONFIG.symbolTraceability,
-            ...partial?.symbolTraceability,
-        },
-    };
-}

package/dist/utils/schema-version.d.ts

@@ -1,5 +1,4 @@
-import type { KbConfig } from "./config.js";
-export declare const LATEST_KB_SCHEMA_VERSION = 4;
+export declare const LATEST_KB_SCHEMA_VERSION = 5;
 export interface SchemaVersionStatus {
     status: "missing" | "invalid" | "older" | "current" | "newer";
     currentVersion: number | null;
@@ -7,8 +6,9 @@ export interface SchemaVersionStatus {
     needsMigration: boolean;
     warning: string | null;
 }
-type SchemaVersionConfig = Pick<KbConfig, "schemaVersion"> | null | undefined;
+export type SchemaVersionSource = {
+    schemaVersion: number | string | null | undefined;
+} | null | undefined;
 export declare function normalizeSchemaVersion(schemaVersion: number | string | null | undefined): number | null;
-export declare function getSchemaVersionStatus(config?: SchemaVersionConfig): SchemaVersionStatus;
-export {};
+export declare function getSchemaVersionStatus(config?: SchemaVersionSource): SchemaVersionStatus;
 //# sourceMappingURL=schema-version.d.ts.map

package/dist/utils/schema-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-version.d.ts","sourceRoot":"","sources":["../../src/utils/schema-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAC9D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,KAAK,mBAAmB,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAG9E,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAChD,MAAM,GAAG,IAAI,CAgBf;AAGD,wBAAgB,sBAAsB,CACpC,MAAM,CAAC,EAAE,mBAAmB,GAC3B,mBAAmB,CA6CrB"}
+{"version":3,"file":"schema-version.d.ts","sourceRoot":"","sources":["../../src/utils/schema-version.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAC9D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,GACrD,IAAI,GACJ,SAAS,CAAC;AAGd,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAChD,MAAM,GAAG,IAAI,CAgBf;AAGD,wBAAgB,sBAAsB,CACpC,MAAM,CAAC,EAAE,mBAAmB,GAC3B,mBAAmB,CAgDrB"}