kibi-cli 0.19.0 → 2.0.0

package/src/public/operations/node-ports.ts

@@ -1,5 +1,6 @@
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
+import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
@@ -23,10 +24,22 @@ type NodeGitPort = GitPort & {
 };
 
 const execFileAsync = promisify(execFile);
-const SNAPSHOT_EXCLUDED_PREFIXES = [".changeset/", ".kb/", "docs/"] as const;
+const SNAPSHOT_EXCLUDED_PREFIXES = [
+  ".changeset/",
+  ".kb/branches/",
+  ".kb/recovery/",
+  ".kb/proof/runs/",
+  ".kb/briefs/",
+  ".kb/migrations/",
+  "docs/",
+] as const;
 const ALWAYS_IGNORED_GLOBS = [
   "**/.git/**",
-  "**/.kb/**",
+  "**/.kb/branches/**",
+  "**/.kb/recovery/**",
+  "**/.kb/proof/runs/**",
+  "**/.kb/briefs/**",
+  "**/.kb/migrations/**",
   "**/node_modules/**",
   "**/vendor/**",
   "**/vendors/**",
@@ -45,7 +58,7 @@ function includedSnapshotPath(relativePath: string): boolean {
   );
 }
 
-function withoutVerificationReceiptFrontmatter(content: string): string {
+function withoutProofReceiptFrontmatter(content: string): string {
   const lines = content.match(/[^\n]*\n|[^\n]+$/g) ?? [];
   if (lines[0]?.trim() !== "---") return content;
   let inFrontmatter = true;
@@ -59,7 +72,7 @@ function withoutVerificationReceiptFrontmatter(content: string): string {
       retained.push(line);
       continue;
     }
-    if (inFrontmatter && /^verification_receipts\s*:/.test(line)) {
+    if (inFrontmatter && /^proof_receipts\s*:/.test(line)) {
       skippingReceipts = true;
       continue;
     }
@@ -76,17 +89,42 @@ function withoutVerificationReceiptFrontmatter(content: string): string {
 }
 
 function snapshotFileContent(relativePath: string, content: Buffer): Buffer {
-  if (
-    relativePath.startsWith("documentation/") &&
-    relativePath.endsWith(".md")
-  ) {
+  if (relativePath.endsWith(".md")) {
     return Buffer.from(
-      withoutVerificationReceiptFrontmatter(content.toString("utf8")),
+      withoutProofReceiptFrontmatter(content.toString("utf8")),
     );
   }
   return content;
 }
 
+/**
+ * A tracked markdown file whose only change is proof-receipt frontmatter
+ * cannot alter the snapshot hash (receipts are stripped before hashing), so it
+ * must not mark the workspace dirty either. CI proof runs append receipts to
+ * tracked proof documents before reporting, and would otherwise always surface
+ * a dirty-workspace warning.
+ */
+function isReceiptOnlyMarkdownChange(
+  workspaceRoot: string,
+  relativePath: string,
+): boolean {
+  if (!relativePath.endsWith(".md")) return false;
+  try {
+    const working = snapshotFileContent(
+      relativePath,
+      fsSync.readFileSync(path.join(workspaceRoot, relativePath)),
+    );
+    const committed = execFileSync(
+      "git",
+      ["-C", workspaceRoot, "show", `HEAD:${relativePath}`],
+      { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 },
+    ) as Buffer;
+    return working.equals(snapshotFileContent(relativePath, committed));
+  } catch {
+    return false;
+  }
+}
+
 async function workspaceSnapshot(workspaceRoot: string) {
   const { stdout: listed } = await execFileAsync(
     "git",
@@ -108,7 +146,7 @@ async function workspaceSnapshot(workspaceRoot: string) {
     .filter(includedSnapshotPath)
     .sort();
   const digest = createHash("sha256");
-  digest.update("kibi.workspace-snapshot.v1\0");
+  digest.update("kibi.workspace-snapshot.v2\0");
   for (const relativePath of paths) {
     digest.update(relativePath);
     digest.update("\0");
@@ -132,14 +170,48 @@ async function workspaceSnapshot(workspaceRoot: string) {
       "status",
       "--porcelain=v1",
       "--untracked-files=normal",
+      "-z",
     ],
     { maxBuffer: 16 * 1024 * 1024 },
   );
+  const rawChanges = status.split("\0").filter(Boolean);
+  const changes: {
+    path: string;
+    status: string;
+    snapshotRelevant: boolean;
+    previousPath?: string;
+  }[] = [];
+  for (let index = 0; index < rawChanges.length; index++) {
+    const entry = rawChanges[index] ?? "";
+    const statusCode = entry.slice(0, 2);
+    const relativePath = entry.slice(3).replaceAll("\\", "/");
+    const previous = rawChanges[index + 1];
+    const isRenameOrCopy = statusCode[0] === "R" || statusCode[0] === "C";
+    const previousPath =
+      isRenameOrCopy && previous ? previous.replaceAll("\\", "/") : undefined;
+    const receiptOnly =
+      statusCode.includes("M") &&
+      includedSnapshotPath(relativePath) &&
+      isReceiptOnlyMarkdownChange(workspaceRoot, relativePath);
+    changes.push({
+      path: relativePath,
+      status: statusCode,
+      snapshotRelevant:
+        (includedSnapshotPath(relativePath) && !receiptOnly) ||
+        (previousPath !== undefined && includedSnapshotPath(previousPath)),
+      ...(previousPath !== undefined ? { previousPath } : {}),
+    });
+    if (previousPath !== undefined) index++;
+  }
+  const maxChanges = 200;
   return {
-    version: "kibi.workspace-snapshot.v1" as const,
+    version: "kibi.workspace-snapshot.v2" as const,
     hash: digest.digest("hex"),
-    dirty: status.trim().length > 0,
+    dirty: changes.some((change) => change.snapshotRelevant),
     fileCount: paths.length,
+    changes: changes.slice(0, maxChanges),
+    changeCount: changes.length,
+    changesTruncated: changes.length > maxChanges,
   };
 }
 
@@ -148,10 +220,12 @@ export const nodeFilesystem: NodeFilesystemPort = {
   writeFile: async (filePath, data) => {
     await fs.writeFile(filePath, data, "utf8");
   },
+  rename: (from, to) => fs.rename(from, to),
   mkdir: async (directoryPath) => {
     await fs.mkdir(directoryPath, { recursive: true });
   },
   stat: (filePath) => fs.stat(filePath),
+  unlink: (filePath) => fs.unlink(filePath),
   glob: (patterns, options) =>
     fg([...patterns], {
       cwd: options.cwd,

package/src/public/operations/prolog-json.ts

@@ -5,6 +5,43 @@ import { resolveKbPlPath } from "../../prolog.js";
 import { escapeAtom } from "../../prolog/codec.js";
 import type { PrologPort } from "./runtime-types.js";
 
+export type JsonBindingDecodeStage = "outer" | "inner";
+
+/**
+ * A JSON operation result is transported through Prolog's answer printer and
+ * then through the engine frame. Keep decode failures typed and bounded: the
+ * raw binding may contain project-authored data and must never be copied into
+ * diagnostics wholesale.
+ */
+export class OperationJsonDecodeError extends Error {
+  readonly code = "engine_result_invalid_json";
+  readonly stage: JsonBindingDecodeStage;
+  readonly rawLength: number;
+  readonly prefixCodePoints: readonly number[];
+
+  constructor(
+    errorLabel: string,
+    stage: JsonBindingDecodeStage,
+    rawJson: unknown,
+    cause: unknown,
+  ) {
+    const rawText = typeof rawJson === "string" ? rawJson : "";
+    const bindingType = typeof rawJson;
+    const message = cause instanceof Error ? cause.message : String(cause);
+    super(
+      `${errorLabel} returned invalid JSON binding (stage=${stage}, bindingType=${bindingType}, length=${rawText.length}, prefixCodePoints=${JSON.stringify([...rawText].slice(0, 8).map((character) => character.codePointAt(0) ?? 0))}): ${message}`,
+    );
+    this.name = "OperationJsonDecodeError";
+    this.stage = stage;
+    this.rawLength = rawText.length;
+    this.prefixCodePoints = Object.freeze(
+      [...rawText]
+        .slice(0, 8)
+        .map((character) => character.codePointAt(0) ?? 0),
+    );
+  }
+}
+
 function resolveCoreModulePath(fileName: string): string {
   const genericOverride = getKbPlPathOverride();
   return path.join(
@@ -29,9 +66,10 @@ export async function runOperationJsonQuery<T>(
   const longLivedEngine =
     typeof (prolog as { storageStatus?: unknown }).storageStatus === "function";
   const oneShotMode =
-    !longLivedEngine &&
-    process.env.NODE_ENV === "test" &&
-    typeof (globalThis as { Bun?: unknown }).Bun !== "undefined";
+    prolog.oneShotMode === true ||
+    (!longLivedEngine &&
+      process.env.NODE_ENV === "test" &&
+      typeof (globalThis as { Bun?: unknown }).Bun !== "undefined");
   const typedStatusQuery = prolog.queryStatusJson;
   const result =
     fileName === "status.pl" && typeof typedStatusQuery === "function"
@@ -48,9 +86,26 @@ export async function runOperationJsonQuery<T>(
   if (rawJson === undefined) {
     throw new Error(`${errorLabel} query returned no JsonString binding`);
   }
-  let parsed: unknown = JSON.parse(rawJson);
+  if (typeof rawJson !== "string") {
+    throw new OperationJsonDecodeError(
+      errorLabel,
+      "outer",
+      rawJson,
+      new TypeError("JsonString binding is not a string"),
+    );
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawJson);
+  } catch (error) {
+    throw new OperationJsonDecodeError(errorLabel, "outer", rawJson, error);
+  }
   if (typeof parsed === "string") {
-    parsed = JSON.parse(parsed);
+    try {
+      parsed = JSON.parse(parsed);
+    } catch (error) {
+      throw new OperationJsonDecodeError(errorLabel, "inner", parsed, error);
+    }
   }
   return parsed as T;
 }

package/src/public/operations/repair-plan.ts

@@ -126,15 +126,14 @@ const REPAIR_PHASES = {
     validationRules: [],
     writePolicy: "runtime_recovery",
   },
-  verification_evidence: {
+  proof_evidence: {
     order: 80,
     objective:
-      "Run the scenario-backed E2E test and append a fresh snapshot-bound passing receipt.",
+      "Run the configured proof integration with kibi prove and append fresh snapshot-bound passing receipts.",
     workflowSteps: [
       "kb_status",
-      "execute_e2e",
-      "kb_validate_upsert",
-      "kb_upsert",
+      "execute_proof_run",
+      "kb_ingest_proof",
       "kb_coverage",
     ],
     validationRules: ["required-fields", "no-dangling-refs"],
@@ -206,12 +205,13 @@ const GAP_PHASE: Readonly<Record<string, RepairPhase>> = {
   blocking_contradiction: "contradiction_resolution",
   missing_scenario: "scenario_endpoints",
   missing_scenario_test: "scenario_tests",
-  verification_snapshot_unavailable: "snapshot_runtime",
-  missing_passing_e2e: "verification_evidence",
-  missing_verification_receipt: "verification_evidence",
-  stale_verification_receipt: "verification_evidence",
-  failed_verification_receipt: "verification_evidence",
-  invalid_verification_receipt: "verification_evidence",
+  proof_snapshot_unavailable: "snapshot_runtime",
+  missing_passing_e2e: "proof_evidence",
+  proof_contract_mismatch: "proof_evidence",
+  missing_proof_receipt: "proof_evidence",
+  stale_proof_receipt: "proof_evidence",
+  failed_proof_receipt: "proof_evidence",
+  invalid_proof_receipt: "proof_evidence",
   missing_executable_test_symbol: "executable_symbols",
   missing_production_symbol: "production_ownership",
   missing_production_symbol_coverage: "production_coverage",
@@ -233,11 +233,12 @@ const GAP_STAGE: Readonly<Record<string, string>> = {
   missing_scenario: "scenarios",
   missing_scenario_test: "scenario_tests",
   missing_passing_e2e: "passing_e2e",
-  missing_verification_receipt: "passing_e2e",
-  stale_verification_receipt: "passing_e2e",
-  failed_verification_receipt: "passing_e2e",
-  invalid_verification_receipt: "passing_e2e",
-  verification_snapshot_unavailable: "passing_e2e",
+  missing_proof_receipt: "passing_e2e",
+  stale_proof_receipt: "passing_e2e",
+  failed_proof_receipt: "passing_e2e",
+  invalid_proof_receipt: "passing_e2e",
+  proof_contract_mismatch: "passing_e2e",
+  proof_snapshot_unavailable: "passing_e2e",
   missing_executable_test_symbol: "executable_symbols",
   missing_production_symbol: "production_symbols",
   missing_production_symbol_coverage: "production_symbols",
@@ -426,7 +427,38 @@ function buildRequirementBatches(
   );
   const priorBatchIds: string[] = [];
   return phases.map((phase) => {
-    const definition = REPAIR_PHASES[phase];
+    const phaseRepairs = byPhase.get(phase) ?? [];
+    const coordinatesNeedReview =
+      phase === "source_coordinates" &&
+      phaseRepairs.some((repair) => {
+        const evidence = repair.evidence.coordinateRepairs;
+        return (
+          repair.gap !== "missing_symbol_coordinates" ||
+          !Array.isArray(evidence) ||
+          evidence.length === 0 ||
+          evidence.some((item) => !isRecord(item) || item.refreshable !== true)
+        );
+      });
+    const definition: RepairPhaseDefinition = coordinatesNeedReview
+      ? {
+          ...REPAIR_PHASES[phase],
+          objective: phaseRepairs.some(
+            (repair) => repair.gap === "missing_requirement_source",
+          )
+            ? "Bind the requirement to its current source document through validated upsert and inspect any missing symbol anchors before refreshing."
+            : "Query the affected symbols and repair their sourceFile/title or explicitly author granularity_reason: extractor-miss (or another intentional coarse anchor) through validated upsert before refreshing.",
+          workflowSteps: [
+            "kb_query",
+            "kb_validate_upsert",
+            "kb_upsert",
+            "kibi sync --refresh-symbol-coordinates",
+            "kibi sync",
+            "kb_check",
+            "kb_coverage",
+          ],
+          writePolicy: "review_then_sequential_upsert",
+        }
+      : REPAIR_PHASES[phase];
     const id = batchId(requirementId, phase);
     const batch: RepairPlanBatch = {
       id,
@@ -440,11 +472,17 @@ function buildRequirementBatches(
       validationRules: definition.validationRules,
       writePolicy: definition.writePolicy,
       autoApplicable: false,
-      repairs: (byPhase.get(phase) ?? []).sort(
-        (left, right) =>
-          left.proofPriority - right.proofPriority ||
-          left.gap.localeCompare(right.gap),
-      ),
+      repairs: phaseRepairs
+        .map((repair) =>
+          coordinatesNeedReview
+            ? { ...repair, action: definition.objective }
+            : repair,
+        )
+        .sort(
+          (left, right) =>
+            left.proofPriority - right.proofPriority ||
+            left.gap.localeCompare(right.gap),
+        ),
     };
     priorBatchIds.push(id);
     return batch;

package/src/public/operations/result-envelope.ts

@@ -0,0 +1,141 @@
+import type { KibiResult, OperationEffect, OperationName } from "./types.js";
+
+export const KIBI_PROTOCOL_VERSION = 1 as const;
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function diagnostics(value: unknown): KibiResult["diagnostics"] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    if (typeof entry === "string")
+      return [{ message: entry, severity: "warning" as const }];
+    if (!record(entry) || typeof entry.message !== "string") return [];
+    return [entry as KibiResult["diagnostics"][number]];
+  });
+}
+
+function nextActions(value: unknown): KibiResult["nextActions"] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    if (
+      !record(entry) ||
+      typeof entry.operation !== "string" ||
+      typeof entry.reason !== "string"
+    )
+      return [];
+    return [
+      {
+        operation: entry.operation,
+        input: entry.input,
+        reason: entry.reason,
+        required: entry.required === true,
+      },
+    ];
+  });
+}
+
+export function failedEffectStatus(
+  effect: OperationEffect,
+  failure: Record<string, unknown>,
+): KibiResult["effects"][number] {
+  return {
+    kind: effect,
+    status: "failed",
+    detail: failure.detail,
+    ...(typeof failure.errorCode === "string"
+      ? { errorCode: failure.errorCode }
+      : {}),
+  };
+}
+
+function effectStatus(
+  effect: OperationEffect,
+  data: Record<string, unknown> | undefined,
+): KibiResult["effects"][number] {
+  const failures = data?.effectFailures;
+  if (Array.isArray(failures)) {
+    const failure = failures.find(
+      (entry) => record(entry) && entry.kind === effect,
+    );
+    if (record(failure)) return failedEffectStatus(effect, failure);
+  }
+  return { kind: effect, status: "completed" };
+}
+
+function extraFailedEffects(
+  declared: readonly OperationEffect[],
+  data: Record<string, unknown> | undefined,
+): KibiResult["effects"] {
+  const failures = data?.effectFailures;
+  if (!Array.isArray(failures)) return [];
+  const seen = new Set(declared);
+  return failures.flatMap((entry) => {
+    if (
+      !record(entry) ||
+      typeof entry.kind !== "string" ||
+      seen.has(entry.kind as OperationEffect)
+    ) {
+      return [];
+    }
+    seen.add(entry.kind as OperationEffect);
+    return [
+      {
+        kind: entry.kind,
+        status: "failed" as const,
+        detail: entry.detail,
+        ...(typeof entry.errorCode === "string"
+          ? { errorCode: entry.errorCode }
+          : {}),
+      },
+    ];
+  });
+}
+
+export function resultVersion(spec: {
+  readonly name: OperationName | string;
+  readonly resultVersion?: string;
+}): string {
+  return spec.resultVersion ?? `kibi.${spec.name}.v1`;
+}
+
+export function toKibiResult<T>(
+  spec: {
+    readonly name: OperationName | string;
+    readonly effects: readonly OperationEffect[];
+    readonly resultVersion?: string;
+  },
+  data: T,
+  options: Partial<
+    Pick<KibiResult<T>, "status" | "diagnostics" | "nextActions" | "error">
+  > = {},
+): KibiResult<T> {
+  const row = record(data) ? data : undefined;
+  const status =
+    options.status ??
+    (row?.status === "committed_with_repairs"
+      ? "committed_with_repairs"
+      : "success");
+  return {
+    kibiProtocol: KIBI_PROTOCOL_VERSION,
+    operation: spec.name as OperationName,
+    resultVersion: resultVersion(spec),
+    status,
+    data,
+    effects: [
+      ...spec.effects.map((effect) => effectStatus(effect, row)),
+      ...extraFailedEffects(spec.effects, row),
+    ],
+    diagnostics: options.diagnostics ?? diagnostics(row?.diagnostics),
+    nextActions: options.nextActions ?? nextActions(row?.nextActions),
+    ...(options.error ? { error: options.error } : {}),
+  };
+}
+
+export function operationData(value: unknown): unknown {
+  if (record(value) && "structuredContent" in value) {
+    return value.structuredContent;
+  }
+  return value;
+}

package/src/public/operations/runtime-types.ts

@@ -1,3 +1,5 @@
+import type { PrologErrorRecord } from "../../prolog/error-terms.js";
+import type { BranchAttachment } from "../../utils/branch-resolver.js";
 import type { OperationEffect } from "./types.js";
 
 export type { OperationEffect } from "./types.js";
@@ -6,6 +8,8 @@ export type PrologQueryResult = {
   readonly success: boolean;
   readonly bindings: Readonly<Record<string, string>>;
   readonly error?: string;
+  /** Structured error term when the failure crossed a kb.pl throw site. */
+  readonly errorRecord?: PrologErrorRecord;
 };
 
 export type PrologEntityQueryInput = Readonly<{
@@ -35,20 +39,79 @@ export type PrologSearchQueryResult = Readonly<{
   count: number;
 }>;
 
+/** Goal-free, versioned commands accepted by the journaled engine. */
+export type EngineCommandV1 =
+  | Readonly<{ version: 1; kind: "status" }>
+  | Readonly<{
+      version: 1;
+      kind: "entities";
+      type?: string;
+      id?: string;
+      tags?: readonly string[];
+      sourceFile?: string;
+      limit: number;
+      offset: number;
+    }>
+  | Readonly<{
+      version: 1;
+      kind: "search";
+      query: string;
+      type?: string;
+      limit: number;
+      offset: number;
+    }>
+  | Readonly<{ version: 1; kind: "checkpoint" }>
+  | Readonly<{ version: 1; kind: "compact" }>
+  | Readonly<{ version: 1; kind: "save" }>
+  | Readonly<{ version: 1; kind: "check"; rule?: string }>
+  | Readonly<{
+      version: 1;
+      kind: "relationship";
+      action: "assert" | "retract";
+      type: string;
+      from: string;
+      to: string;
+    }>
+  | Readonly<{
+      version: 1;
+      kind: "persistence";
+      action: "checkpoint" | "compact" | "save" | "export";
+      targetDirectory?: string;
+    }>
+  | Readonly<{
+      version: 1;
+      kind: "lifecycle";
+      action: "stop" | "cancel";
+      requestId?: number;
+    }>
+  | Readonly<{ version: 1; kind: "stop" }>
+  | Readonly<{ version: 1; kind: "cancel"; requestId: number }>;
+
+export interface EnginePort {
+  execute<T = PrologQueryResult>(
+    command: EngineCommandV1,
+    signal?: AbortSignal,
+  ): Promise<T>;
+}
+
 // implements REQ-kibi-operation-interface-parity
 export interface PrologPort {
-  query(goal: string): Promise<PrologQueryResult>;
+  query(goal: string, signal?: AbortSignal): Promise<PrologQueryResult>;
+  /** True when each query is isolated and must include its module load. */
+  oneShotMode?: boolean;
   /** Optional index-backed page query supplied by the journaled engine. */
   queryEntities?(
     input: PrologEntityQueryInput,
+    signal?: AbortSignal,
   ): Promise<PrologEntityQueryResult>;
   /** Optional normalized-token candidate lookup supplied by the engine. */
   searchEntities?(
     input: PrologSearchQueryInput,
+    signal?: AbortSignal,
   ): Promise<PrologSearchQueryResult>;
   nextSolution(): Promise<PrologQueryResult | null>;
   invalidateCache?(): void;
-  save(): Promise<PrologQueryResult>;
+  save(signal?: AbortSignal): Promise<PrologQueryResult>;
   /** Present on the journaled engine; used to distinguish a persistent port from one-shot SWI. */
   storageStatus?(): Promise<PrologQueryResult>;
   /** Typed public freshness query; avoids exposing module loading over RPC. */
@@ -63,21 +126,39 @@ export type FilesystemStat = {
 export interface FilesystemPort {
   readFile(path: string): Promise<string>;
   writeFile(path: string, data: string): Promise<void>;
+  /** Optional workspace globbing used by source-posture classifiers. */
+  glob?(
+    patterns: readonly string[],
+    options: { readonly cwd: string; readonly includeIgnored?: boolean },
+  ): Promise<readonly string[]>;
+  /** Replace a file atomically when the host filesystem supports it. */
+  rename?(from: string, to: string): Promise<void>;
   mkdir(path: string): Promise<void>;
   stat(path: string): Promise<FilesystemStat>;
+  /** Optional destructive primitive used only to roll back newly-created files. */
+  unlink?(path: string): Promise<void>;
 }
 
 export interface GitPort {
-  revParse(...args: readonly string[]): Promise<string>;
-  showToplevel(): Promise<string>;
+  /** Optional low-level Git probes; the journaled runtime may provide them. */
+  revParse?(...args: readonly string[]): Promise<string>;
+  showToplevel?(): Promise<string>;
   workspaceSnapshot?(workspaceRoot: string): Promise<WorkspaceSnapshot>;
 }
 
 export type WorkspaceSnapshot = Readonly<{
-  version: "kibi.workspace-snapshot.v1";
+  version: "kibi.workspace-snapshot.v2";
   hash: string;
+  /** True only when at least one change can alter the verification snapshot. */
   dirty: boolean;
   fileCount: number;
+  readonly changes?: readonly {
+    readonly path: string;
+    readonly status: string;
+    readonly snapshotRelevant: boolean;
+  }[];
+  readonly changeCount?: number;
+  readonly changesTruncated?: boolean;
 }>;
 
 export interface NetworkPort {
@@ -101,9 +182,19 @@ export type OperationContext = {
   readonly signal: AbortSignal;
   readonly clock: Clock;
   readonly prolog?: PrologPort;
+  readonly engine?: EnginePort;
+  /** Lazily acquire the branch engine for operations that may start without Prolog. */
+  readonly ensureProlog?: () => Promise<PrologPort>;
   readonly fs?: FilesystemPort;
+  /** Whether filesystem-capable mutations must author tracked source files. */
+  readonly sourceFirst?: boolean;
+  /** Internal apply-plan capability: source bytes were already approved/published. */
+  readonly sourcePlanApplication?: boolean;
+  /** Internal apply-plan capability: caller holds the cooperative source lock. */
+  readonly sourceMutationLockHeld?: boolean;
   readonly git?: GitPort;
   readonly net?: NetworkPort;
+  readonly branchAttachment?: BranchAttachment;
 };
 
 export interface RuntimeOperationSpec<TInput = unknown, TResult = unknown> {