kibi-cli 0.19.0 → 2.0.0

package/src/public/proof-receipt.ts

@@ -0,0 +1,499 @@
+import {
+  type ProofFingerprintComponents,
+  canonicalJson,
+  proofContractHash,
+} from "./proof-fingerprint.js";
+import {
+  PROOF_RECEIPT_VERSION,
+  PROOF_RESULT_OUTCOMES,
+  PROOF_RUN_OUTCOMES,
+  type ProofContract,
+} from "./proof-protocol.js";
+
+export const PROOF_RECEIPT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
+
+export const PROOF_RECEIPT_OUTCOMES = [
+  "passed",
+  "failed",
+  "errored",
+  "cancelled",
+  "skipped",
+  "timed_out",
+  "interrupted",
+] as const;
+
+export const PROOF_RECEIPT_SCHEMA = {
+  type: "object",
+  description:
+    "Kibi-derived kibi.proof-receipt.v1. Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.",
+  required: [
+    "version",
+    "receipt_id",
+    "test_id",
+    "scope",
+    "outcome",
+    "code_snapshot",
+    "environment_hash",
+    "started_at",
+    "finished_at",
+    "artifact_digest",
+    "contract_hash",
+    "fingerprint",
+    "fingerprint_components",
+    "integration_id",
+    "producer",
+    "command_argv",
+    "run_outcome",
+    "proof_results",
+  ],
+  properties: {
+    version: { type: "string", const: PROOF_RECEIPT_VERSION },
+    receipt_id: {
+      type: "string",
+      pattern: "^PR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$",
+    },
+    test_id: { type: "string", minLength: 1 },
+    scope: { type: "string", enum: ["unit", "integration", "end_to_end"] },
+    outcome: { type: "string", enum: [...PROOF_RECEIPT_OUTCOMES] },
+    code_snapshot: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    environment_hash: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    started_at: { type: "string", minLength: 1 },
+    finished_at: { type: "string", minLength: 1 },
+    artifact_digest: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    contract_hash: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    binding_hash: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    fingerprint: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    fingerprint_components: {
+      type: "object",
+      required: ["contract", "integration", "command", "bindings", "producer"],
+      additionalProperties: false,
+      properties: {
+        contract: { type: "string", pattern: "^[a-f0-9]{64}$" },
+        integration: { type: "string", pattern: "^[a-f0-9]{64}$" },
+        command: { type: "string", pattern: "^[a-f0-9]{64}$" },
+        bindings: { type: "string", pattern: "^[a-f0-9]{64}$" },
+        producer: { type: "string", pattern: "^[a-f0-9]{64}$" },
+      },
+    },
+    integration_id: { type: "string", minLength: 1 },
+    producer: {
+      type: "object",
+      required: ["name"],
+      properties: {
+        name: { type: "string", minLength: 1 },
+        version: { type: "string", minLength: 1 },
+      },
+      additionalProperties: false,
+    },
+    command_argv: {
+      type: "array",
+      minItems: 1,
+      items: { type: "string", minLength: 1 },
+    },
+    run_outcome: { type: "string", enum: [...PROOF_RUN_OUTCOMES] },
+    proof_results: {
+      type: "array",
+      minItems: 0,
+      maxItems: 1000,
+      items: {
+        type: "object",
+        required: ["symbol_id", "target", "outcome", "binding", "attempts"],
+        properties: {
+          symbol_id: { type: "string", minLength: 1 },
+          target: { type: "string", minLength: 1 },
+          outcome: { type: "string", enum: [...PROOF_RESULT_OUTCOMES] },
+          binding: { type: "string", enum: ["native_case", "aggregate_run"] },
+          native_id: { type: "string", minLength: 1 },
+          attempts: {
+            oneOf: [
+              {
+                type: "object",
+                required: ["status", "entries"],
+                properties: {
+                  status: { type: "string", const: "complete" },
+                  entries: {
+                    type: "array",
+                    minItems: 1,
+                    items: {
+                      type: "object",
+                      required: ["outcome"],
+                      properties: {
+                        outcome: {
+                          type: "string",
+                          enum: [...PROOF_RESULT_OUTCOMES],
+                        },
+                        duration_ms: { type: "number", minimum: 0 },
+                      },
+                      additionalProperties: false,
+                    },
+                  },
+                },
+                additionalProperties: false,
+              },
+              {
+                type: "object",
+                required: ["status"],
+                properties: {
+                  status: { type: "string", const: "unavailable" },
+                },
+                additionalProperties: false,
+              },
+            ],
+          },
+        },
+        additionalProperties: false,
+      },
+    },
+    gaps: {
+      type: "array",
+      items: {
+        type: "object",
+        required: ["symbol_id", "target", "reason"],
+        properties: {
+          symbol_id: { type: "string", minLength: 1 },
+          target: { type: "string", minLength: 1 },
+          reason: { type: "string", minLength: 1 },
+        },
+        additionalProperties: false,
+      },
+    },
+  },
+  additionalProperties: false,
+} as const;
+
+export type ProofReceipt = Readonly<{
+  version: typeof PROOF_RECEIPT_VERSION;
+  receipt_id: string;
+  test_id: string;
+  scope: "unit" | "integration" | "end_to_end";
+  outcome: (typeof PROOF_RECEIPT_OUTCOMES)[number];
+  code_snapshot: string;
+  environment_hash: string;
+  started_at: string;
+  finished_at: string;
+  artifact_digest: string;
+  contract_hash: string;
+  fingerprint: string;
+  fingerprint_components: ProofFingerprintComponents;
+  integration_id: string;
+  producer: { readonly name: string; readonly version?: string };
+  command_argv: readonly string[];
+  run_outcome: (typeof PROOF_RUN_OUTCOMES)[number];
+  proof_results: readonly {
+    readonly symbol_id: string;
+    readonly target: string;
+    readonly outcome: (typeof PROOF_RESULT_OUTCOMES)[number];
+    readonly binding: "native_case" | "aggregate_run";
+    readonly native_id?: string;
+    readonly attempts:
+      | {
+          readonly status: "complete";
+          readonly entries: readonly {
+            readonly outcome: string;
+            readonly duration_ms?: number;
+          }[];
+        }
+      | { readonly status: "unavailable" };
+  }[];
+  gaps?: readonly {
+    readonly symbol_id: string;
+    readonly target: string;
+    readonly reason: string;
+  }[];
+}>;
+
+export function finishedAtPrecedesStartedAt(
+  startedAt: number | null,
+  finishedAt: number | null,
+): boolean {
+  return startedAt !== null && finishedAt !== null && finishedAt < startedAt;
+}
+
+function timestamp(value: unknown): number | null {
+  if (typeof value !== "string") return null;
+  if (
+    !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(
+      value,
+    )
+  ) {
+    return null;
+  }
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function nonEmptyString(value: unknown): boolean {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function hex64(value: unknown): boolean {
+  return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function validAttempts(value: unknown): boolean {
+  const row = isRecord(value) ? value : null;
+  if (!row) return false;
+  if (row.status === "unavailable") return row.entries === undefined;
+  if (row.status !== "complete") return false;
+  if (!Array.isArray(row.entries) || row.entries.length === 0) return false;
+  return row.entries.every((entry) => {
+    const attempt = isRecord(entry) ? entry : null;
+    return (
+      attempt !== null &&
+      nonEmptyString(attempt.outcome) &&
+      (PROOF_RESULT_OUTCOMES as readonly string[]).includes(
+        String(attempt.outcome),
+      ) &&
+      (attempt.duration_ms === undefined ||
+        (Number.isInteger(attempt.duration_ms) &&
+          Number(attempt.duration_ms) >= 0))
+    );
+  });
+}
+
+function validReceiptProofResult(value: unknown): boolean {
+  const row = isRecord(value) ? value : null;
+  if (!row) return false;
+  return (
+    nonEmptyString(row.symbol_id) &&
+    nonEmptyString(row.target) &&
+    (PROOF_RESULT_OUTCOMES as readonly string[]).includes(
+      String(row.outcome),
+    ) &&
+    (["native_case", "aggregate_run"] as readonly string[]).includes(
+      String(row.binding),
+    ) &&
+    (row.native_id === undefined || nonEmptyString(row.native_id)) &&
+    validAttempts(row.attempts)
+  );
+}
+
+function validFingerprintComponents(value: unknown): boolean {
+  const row = isRecord(value) ? value : null;
+  if (!row) return false;
+  return (
+    hex64(row.contract) &&
+    hex64(row.integration) &&
+    hex64(row.command) &&
+    hex64(row.bindings) &&
+    hex64(row.producer)
+  );
+}
+
+/** Structural validation of one kibi.proof-receipt.v1 entry. */
+export function validProofReceiptShape(
+  testId: string,
+  receipt: unknown,
+): boolean {
+  const row = isRecord(receipt) ? receipt : null;
+  if (!row) return false;
+  if (row.version !== PROOF_RECEIPT_VERSION) return false;
+  if (
+    typeof row.receipt_id !== "string" ||
+    !/^PR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(row.receipt_id)
+  )
+    return false;
+  if (row.test_id !== testId) return false;
+  if (
+    !(["unit", "integration", "end_to_end"] as readonly string[]).includes(
+      String(row.scope),
+    )
+  )
+    return false;
+  if (
+    !(PROOF_RECEIPT_OUTCOMES as readonly string[]).includes(String(row.outcome))
+  )
+    return false;
+  if (!hex64(row.code_snapshot) || !hex64(row.environment_hash)) return false;
+  if (!hex64(row.artifact_digest)) return false;
+  if (!hex64(row.contract_hash) || !hex64(row.fingerprint)) return false;
+  if (
+    row.binding_hash !== undefined &&
+    (typeof row.binding_hash !== "string" || !hex64(row.binding_hash))
+  ) {
+    return false;
+  }
+  if (!validFingerprintComponents(row.fingerprint_components)) return false;
+  if (!nonEmptyString(row.integration_id)) return false;
+  const producer = isRecord(row.producer) ? row.producer : null;
+  if (!producer || !nonEmptyString(producer.name)) return false;
+  if (producer.version !== undefined && !nonEmptyString(producer.version))
+    return false;
+  if (
+    !Array.isArray(row.command_argv) ||
+    row.command_argv.length === 0 ||
+    !row.command_argv.every((argument) => nonEmptyString(argument))
+  )
+    return false;
+  if (
+    !(PROOF_RUN_OUTCOMES as readonly string[]).includes(String(row.run_outcome))
+  )
+    return false;
+  if (
+    !Array.isArray(row.proof_results) ||
+    !row.proof_results.every(validReceiptProofResult)
+  )
+    return false;
+  if (row.gaps !== undefined) {
+    if (!Array.isArray(row.gaps)) return false;
+    if (
+      !row.gaps.every(
+        (gap) =>
+          isRecord(gap) &&
+          nonEmptyString(gap.symbol_id) &&
+          nonEmptyString(gap.target) &&
+          nonEmptyString(gap.reason),
+      )
+    )
+      return false;
+  }
+  const startedAt = timestamp(row.started_at);
+  const finishedAt = timestamp(row.finished_at);
+  if (startedAt === null || finishedAt === null) return false;
+  return !finishedAtPrecedesStartedAt(startedAt, finishedAt);
+}
+
+/**
+ * Full-history validation for proof_receipts: unique ids, per-test binding,
+ * supported scope, ordered timestamps, and structurally valid v1 entries.
+ */
+export function proofReceiptHistoryErrors(
+  testId: string,
+  verificationScope: unknown,
+  receipts: readonly Readonly<Record<string, unknown>>[],
+): readonly string[] {
+  const errors: string[] = [];
+  if (receipts.length > 0 && typeof verificationScope !== "string") {
+    errors.push(
+      "verification_scope is required when proof_receipts are present",
+    );
+  }
+  const receiptIds = new Set<string>();
+  for (const [index, receipt] of receipts.entries()) {
+    const prefix = `proof_receipts[${index}]`;
+    const receiptId = receipt.receipt_id;
+    if (typeof receiptId === "string") {
+      if (receiptIds.has(receiptId)) {
+        errors.push(`${prefix}.receipt_id duplicates '${receiptId}'`);
+      }
+      receiptIds.add(receiptId);
+    }
+    if (receipt.test_id !== testId) {
+      errors.push(`${prefix}.test_id must equal '${testId}'`);
+    }
+    if (!validProofReceiptShape(testId, receipt)) {
+      errors.push(
+        `${prefix} must be a structurally valid kibi.proof-receipt.v1 bound to '${testId}'`,
+      );
+      continue;
+    }
+    const finishedAt = timestamp(receipt.finished_at);
+    if (
+      finishedAt !== null &&
+      index > 0 &&
+      timestamp(receipts[index - 1]?.finished_at) !== null &&
+      finishedAt <= (timestamp(receipts[index - 1]?.finished_at) as number)
+    ) {
+      errors.push(
+        `${prefix}.finished_at must be strictly later than the previous receipt`,
+      );
+    }
+  }
+  return errors;
+}
+
+/** The current receipt must match the live scope, contract hash, and fingerprint. */
+export function proofReceiptCurrentBindingErrors(
+  testId: string,
+  verificationScope: unknown,
+  receipt: Readonly<Record<string, unknown>>,
+  contract?: ProofContract,
+  fingerprint?: string,
+): readonly string[] {
+  const errors: string[] = [];
+  if (receipt.test_id !== testId) {
+    errors.push(`proof receipt test_id must equal '${testId}'`);
+  }
+  if (typeof verificationScope !== "string") {
+    errors.push("verification_scope is required for current receipt evidence");
+  } else if (receipt.scope !== verificationScope) {
+    errors.push(
+      `proof receipt scope must equal the current verification_scope '${verificationScope}'`,
+    );
+  }
+  if (contract !== undefined) {
+    if (typeof receipt.contract_hash === "string") {
+      const expectedHash = proofContractHash(contract);
+      if (receipt.contract_hash !== expectedHash) {
+        errors.push(
+          "proof receipt contract_hash does not match the current proof_contract",
+        );
+      }
+    }
+    if (
+      fingerprint !== undefined &&
+      typeof receipt.fingerprint === "string" &&
+      receipt.fingerprint !== fingerprint
+    ) {
+      errors.push(
+        "proof receipt fingerprint does not match the current effective execution fingerprint",
+      );
+    }
+  }
+  return errors;
+}
+
+/**
+ * Hard schema cap on stored receipts per test. Ingest appends past this cap by
+ * rotating: drop exactly the oldest receipts so the newest evidence stays
+ * bound to the test without ever exceeding the cap.
+ */
+export const MAX_PROOF_RECEIPTS = 50;
+
+function isCapRotation(
+  previous: readonly Readonly<Record<string, unknown>>[],
+  next: readonly Readonly<Record<string, unknown>>[],
+): boolean {
+  if (next.length !== MAX_PROOF_RECEIPTS) return false;
+  if (previous.length < MAX_PROOF_RECEIPTS) return false;
+  const preserved = MAX_PROOF_RECEIPTS - 1;
+  for (let index = 0; index < preserved; index++) {
+    if (
+      canonicalJson(previous[previous.length - preserved + index]) !==
+      canonicalJson(next[index])
+    ) {
+      return false;
+    }
+  }
+  return true;
+}
+
+export function appendOnlyProofReceiptHistoryErrors(
+  previous: readonly Readonly<Record<string, unknown>>[],
+  next: readonly Readonly<Record<string, unknown>>[] | undefined,
+): readonly string[] {
+  if (previous.length === 0) return [];
+  if (next === undefined) {
+    return [
+      "proof_receipts is append-only and cannot be removed from an existing test",
+    ];
+  }
+  if (isCapRotation(previous, next)) return [];
+  if (next.length < previous.length) {
+    return [
+      `proof_receipts is append-only: expected at least ${previous.length} historical receipt(s), received ${next.length}`,
+    ];
+  }
+  for (const [index, receipt] of previous.entries()) {
+    if (canonicalJson(next[index]) !== canonicalJson(receipt)) {
+      return [
+        `proof_receipts is append-only: historical receipt at index ${index} was changed, removed, or reordered`,
+      ];
+    }
+  }
+  return [];
+}

package/src/public/schemas/entity.ts

@@ -16,9 +16,13 @@
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
+import {
+  PROOF_BINDINGS_SCHEMA,
+  PROOF_CONTRACT_SCHEMA,
+} from "../proof-protocol.js";
+import { PROOF_RECEIPT_SCHEMA } from "../proof-receipt.js";
 // Typed fact field enums per proposal
 import { SYMBOL_ROLES, type SymbolRole } from "../symbol-granularity.js";
-import { VERIFICATION_RECEIPT_SCHEMA } from "../verification-receipt.js";
 
 type FactKind =
   | "subject"
@@ -356,6 +360,17 @@ const entitySchema: Record<string, unknown> = {
     severity: { type: "string" },
     links: { type: "array", items: { type: "string" } },
     text_ref: { type: "string" },
+    proof_exempt: {
+      type: "boolean",
+      description:
+        "Requirement-only. Marks a current requirement as intentionally outside E2E-proof scope; requires proof_exempt_reason.",
+    },
+    proof_exempt_reason: {
+      type: "string",
+      minLength: 1,
+      description:
+        "Requirement-only. Required when proof_exempt is true; surfaces as the applicability reason in coverage rows.",
+    },
     semantic_text: {
       type: "string",
       description:
@@ -439,6 +454,7 @@ const entitySchema: Record<string, unknown> = {
         "module-level-behavior",
         "extractor-miss",
         "legacy-link",
+        "test-suite",
       ],
     },
     symbol_role: {
@@ -453,10 +469,11 @@ const entitySchema: Record<string, unknown> = {
       type: "string",
       enum: ["internal", "consumer"] satisfies VerificationPerspective[],
     },
-    verification_receipts: {
+    proof_contract: PROOF_CONTRACT_SCHEMA,
+    proof_bindings: PROOF_BINDINGS_SCHEMA,
+    proof_receipts: {
       type: "array",
-      maxItems: 50,
-      items: VERIFICATION_RECEIPT_SCHEMA,
+      items: PROOF_RECEIPT_SCHEMA,
     },
     type: {
       type: "string",
@@ -597,13 +614,15 @@ const entitySchema: Record<string, unknown> = {
           anyOf: [
             { required: ["verification_scope"] },
             { required: ["verification_perspective"] },
-            { required: ["verification_receipts"] },
+            { required: ["proof_contract"] },
+            { required: ["proof_bindings"] },
+            { required: ["proof_receipts"] },
           ],
         },
       },
     },
     {
-      if: { required: ["verification_receipts"] },
+      if: { required: ["proof_receipts"] },
       // biome-ignore lint/suspicious/noThenProperty: JSON Schema conditional keyword.
       then: { required: ["verification_scope"] },
     },
@@ -620,6 +639,8 @@ const entitySchema: Record<string, unknown> = {
             { required: ["semantic_inventory_version"] },
             { required: ["semantic_source_field"] },
             { required: ["semantic_source_hash"] },
+            { required: ["proof_exempt"] },
+            { required: ["proof_exempt_reason"] },
           ],
         },
       },

package/src/public/skills/kibi-bootstrap/SKILL.md

@@ -0,0 +1,58 @@
+---
+id: kibi-bootstrap
+name: kibi-bootstrap
+description: Bootstrap Kibi from the current Git checkout with exact Git attachment, preview approval, source-first writes, and repair-safe completion.
+version: 3.0.0
+kibiCompatibility: ">=1.0.0"
+tags:
+  - kibi
+  - bootstrap
+  - source-first
+  - agent-guidance
+resources:
+  - resources/bootstrap.md
+  - resources/branch-lifecycle.md
+  - resources/source-authoring.md
+  - resources/operation-access.md
+---
+## Goal
+
+Seed branch-local Kibi knowledge for an attached but thin repository without
+creating a parallel human-maintained ticket system. Ask at most four bounded
+context questions only when the planner says repository evidence is
+insufficient; agents own deterministic translation and humans resolve genuine
+ambiguity. A seeded repository hands off to the normal Kibi workflow.
+
+## Interface and preview
+
+Use the visible approved MCP surface or the trusted project-local CLI as equal
+peer interfaces. If neither is available, stop. Run `kb_plan_bootstrap` (or
+`plan-bootstrap --input`) read-only. If it returns `needs_context`, ask only its
+bounded questions (never more than four), then rerun the planner. Show the
+complete returned `structuredContent.plan`, including its canonical hash, and
+get explicit approval before any write. Pass that plan object unchanged to
+`kb_apply_plan`; do not reconstruct it from preview fields.
+
+For CLI JSON, use the trusted route with `--input` (for example
+`printf '%s\n' '{}' | kibi status --input -`); MCP and CLI are semantic peers.
+Read the branch-lifecycle and source-authoring resources before migration,
+source writes, or repair actions.
+
+## Apply and verify
+
+Apply the approved `kibi.bootstrap-plan.v1` by calling `kb_apply_plan` with the
+exact plan and approved hash. The operation owns dependency ordering,
+source-first writes, sequential mutation, and recovery journaling. Direct
+`kb_upsert` is forbidden for every kibi-bootstrap task, including after
+approval; never replay plan actions manually. Use `kb_delete` only for an
+approved hash-bound deletion plan; evolve requirements with `supersedes`.
+Finish with `kb_check` and `kb_status`.
+
+Consume the versioned `kibiProtocol: 1` result envelope: inspect `status`, `effects`,
+`diagnostics`, and `nextActions`. On `committed_with_repairs`, execute required
+repair actions and never retry the original mutation.
+
+Kibi may author tracked Markdown/YAML/manifests and relationship shards
+transactionally, but never Git-stages or commits them. Never read or edit
+`.kb` directly. Missing exact branch stores are compiled from this checkout's
+tracked sources by `kibi sync`; Kibi does not copy another branch's store.

package/src/public/skills/kibi-bootstrap/resources/bootstrap.md

@@ -0,0 +1,11 @@
+# Bootstrap resource
+
+`kb_plan_bootstrap` is read-only and returns `kibi.bootstrap-plan.v1`. Review
+candidate evidence, exact actions, dependencies, expected snapshots, source
+hashes, bounded questions, diagnostics, and the canonical `planHash` before
+approving. A preview does not authorize source edits. After approval, pass the
+unchanged returned `structuredContent.plan` to `kb_apply_plan` once with its
+approved hash; inspect its typed result
+and follow `nextActions` if it returns `committed_with_repairs`. Direct
+`kb_upsert` is forbidden for every bootstrap task; never manually replay the
+plan through it.

package/src/public/skills/kibi-bootstrap/resources/branch-lifecycle.md

@@ -0,0 +1,7 @@
+# Branch lifecycle
+
+Use the exact `KIBI_BRANCH` value or Git symbolic HEAD. Hashed stores carry a
+matching `branch.json`; missing stores are compiled from tracked sources by
+`kibi sync`. Legacy literal stores require explicit migration. Kibi never
+copies stores between branches or resolves Git conflicts. Read the preview,
+approval hash, quarantine, restore, and purge details before lifecycle work.

package/src/public/skills/kibi-bootstrap/resources/operation-access.md

@@ -0,0 +1,5 @@
+# Operation access
+
+MCP tools and the trusted project-local CLI are peer surfaces for the same
+operation contracts. Use the dedicated JSON route; parse the shared
+`KibiResult` envelope and follow required `nextActions` after partial commits.

package/src/public/skills/kibi-bootstrap/resources/source-authoring.md

@@ -0,0 +1,8 @@
+# Source authoring
+
+Tracked documents, manifests, and relationship shards are authoritative.
+Kibi may write them transactionally but does not stage or commit them. Use
+`document.path` for ambiguous new targets, preserve existing bodies when the
+body is omitted, and use hash-bound deletion plans. On
+`committed_with_repairs`, follow typed `nextActions` and never retry the
+original mutation.