kibi-cli 1.0.1 → 2.1.0

package/dist/cli-errors.d.ts

@@ -2,12 +2,14 @@ export declare class InputError extends Error {
     readonly code: string;
     readonly detail: string;
     readonly exitCode = 2;
+    readonly retryable = false;
     constructor(code: string, detail: string);
 }
 export declare class OperationError extends Error {
     readonly code: string;
     readonly detail: string;
+    readonly retryable: boolean;
     readonly exitCode = 1;
-    constructor(code: string, detail: string);
+    constructor(code: string, detail: string, retryable?: boolean);
 }
 //# sourceMappingURL=cli-errors.d.ts.map

package/dist/cli-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-errors.d.ts","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AACA,qBAAa,UAAW,SAAQ,KAAK;IAKjC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,QAAQ,KAAK;gBAGX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B;AAGD,qBAAa,cAAe,SAAQ,KAAK;IAKrC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,QAAQ,KAAK;gBAGX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B"}
+{"version":3,"file":"cli-errors.d.ts","sourceRoot":"","sources":["../src/cli-errors.ts"],"names":[],"mappings":"AACA,qBAAa,UAAW,SAAQ,KAAK;IAMjC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALzB,QAAQ,CAAC,QAAQ,KAAK;IACtB,QAAQ,CAAC,SAAS,SAAS;gBAGhB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B;AAGD,qBAAa,cAAe,SAAQ,KAAK;IAKrC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS;IALpB,QAAQ,CAAC,QAAQ,KAAK;gBAGX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,UAAO;CAK5B"}

package/dist/cli-errors.js

@@ -4,6 +4,7 @@ export class InputError extends Error {
     detail;
     // implements REQ-kibi-operation-interface-parity
     exitCode = 2;
+    retryable = false;
     constructor(code, detail) {
         super(detail);
         this.code = code;
@@ -15,12 +16,14 @@ export class InputError extends Error {
 export class OperationError extends Error {
     code;
     detail;
+    retryable;
     // implements REQ-kibi-operation-interface-parity
     exitCode = 1;
-    constructor(code, detail) {
+    constructor(code, detail, retryable = true) {
         super(detail);
         this.code = code;
         this.detail = detail;
+        this.retryable = retryable;
         this.name = "OperationError";
     }
 }

package/dist/cli-json-command.d.ts

@@ -1,5 +1,6 @@
 import type { Command } from "commander";
 import type { OperationName } from "./public/operations/types.js";
+export declare function writeOptionalStderr(stderr: string | undefined): void;
 export type JsonInvocation = {
     readonly operationName: OperationName;
     readonly inputPath: string;

package/dist/cli-json-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-json-command.d.ts","sourceRoot":"","sources":["../src/cli-json-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAIlE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KACpC,EAAE,CAAC;CACL,CAAC;AA0CF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC,CAyGf"}
+{"version":3,"file":"cli-json-command.d.ts","sourceRoot":"","sources":["../src/cli-json-command.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIpE;AAGD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KACpC,EAAE,CAAC;CACL,CAAC;AAkDF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC,CAuGf"}

package/dist/cli-json-command.js

@@ -1,3 +1,4 @@
+import { once } from "node:events";
 import { InputError } from "./cli-errors.js";
 import { loadInput } from "./cli-input.js";
 import { loadOperationSpec } from "./cli-operation-loader.js";
@@ -5,6 +6,11 @@ import { executeOperation as executeProtocolOperation } from "./cli-protocol.js"
 import { prepareOperationInput } from "./cli-validate.js";
 import { appendCliDiagnosticUsage } from "./public/diagnostic-usage.js";
 import { createCliRuntime } from "./runtime/cli-runtime.js";
+export function writeOptionalStderr(stderr) {
+    if (stderr !== undefined) {
+        process.stderr.write(stderr);
+    }
+}
 function writeInputError(error) {
     process.stderr.write(`Error [${error.code}]: ${error.detail}\n`);
     process.exitCode = error.exitCode;
@@ -38,6 +44,11 @@ function structuredResult(stdout) {
         return undefined;
     }
 }
+async function writeAndWaitForDrain(stream, value) {
+    if (stream.write(value))
+        return;
+    await once(stream, "drain");
+}
 // implements REQ-kibi-operation-interface-parity
 export async function runJsonInvocation(invocation) {
     const startedAt = new Date();
@@ -131,10 +142,8 @@ export async function runJsonInvocation(invocation) {
         });
     }
     if (result.stdout !== undefined) {
-        process.stdout.write(result.stdout);
-    }
-    if (result.stderr !== undefined) {
-        process.stderr.write(result.stderr);
+        await writeAndWaitForDrain(process.stdout, result.stdout);
     }
+    writeOptionalStderr(result.stderr);
     process.exitCode = result.exitCode;
 }

package/dist/cli-operation-loader.js

@@ -82,9 +82,9 @@ export async function loadOperationSpec(name) {
             spec = (await import("./public/operations/specs/planning.js"))
                 .applyPlanSpec;
             break;
-        case "kb_ingest_verification":
-            spec = (await import("./public/operations/specs/verification.js"))
-                .ingestVerificationSpec;
+        case "kb_ingest_proof":
+            spec = (await import("./public/operations/specs/proof.js"))
+                .ingestProofSpec;
             break;
     }
     return withContractDefaults(spec);

package/dist/cli-operation-metadata.d.ts

@@ -85,10 +85,11 @@ export declare const CLI_OPERATION_METADATA: readonly [{
     readonly cliName: "apply-plan";
     readonly description: "Apply an explicitly approved kibi.bootstrap-plan.v1, kibi.compile-plan.v1, kibi.migration-plan.v2, or entity-deletion plan after revalidating its canonical hash and live snapshots. Bootstrap actions are dependency-ordered, sequential, source-first, and recoverable from a typed journal.";
 }, {
-    readonly name: "kb_ingest_verification";
-    readonly cliName: "ingest-verification";
-    readonly description: "Ingest a reporter-produced kibi.playwright-run.v1 artifact for a contracted test. Revalidates the live workspace snapshot, runner/command contract, required case/project coverage, and append-only receipt history before deriving and appending a kibi.verification-receipt.v2. It never accepts a caller-authored receipt or trusted outcome.";
+    readonly name: "kb_ingest_proof";
+    readonly cliName: "ingest-proof";
+    readonly description: "Ingest a producer-emitted kibi.proof-run.v1 artifact and evaluate it against each selected test's kibi.proof-contract.v1 proof obligations. Revalidates the live workspace snapshot, integration command binding, run-level outcome, attempt history, success policy, and append-only proof-receipt history before deriving and appending idempotent kibi.proof-receipt.v1 receipts. Producers report what happened; Kibi evaluates proof. Prefer `kibi prove` so the configured producer runs automatically; direct ingestion is an integration path for custom producers and agents.";
 }];
+export declare function requireCliOperationMetadata(metadata: CliOperationMetadata | undefined, name: OperationName): CliOperationMetadata;
 export declare function getCliOperationMetadata(name: OperationName): CliOperationMetadata;
 export declare function isOperationName(name: string): name is OperationName;
 //# sourceMappingURL=cli-operation-metadata.d.ts.map

package/dist/cli-operation-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+HiB,CAAC;AAMrD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAMtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}
+{"version":3,"file":"cli-operation-metadata.d.ts","sourceRoot":"","sources":["../src/cli-operation-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+HiB,CAAC;AAMrD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAKtB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,GAClB,oBAAoB,CAEtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE"}

package/dist/cli-operation-metadata.js

@@ -103,19 +103,21 @@ export const CLI_OPERATION_METADATA = [
         description: "Apply an explicitly approved kibi.bootstrap-plan.v1, kibi.compile-plan.v1, kibi.migration-plan.v2, or entity-deletion plan after revalidating its canonical hash and live snapshots. Bootstrap actions are dependency-ordered, sequential, source-first, and recoverable from a typed journal.",
     },
     {
-        name: "kb_ingest_verification",
-        cliName: "ingest-verification",
-        description: "Ingest a reporter-produced kibi.playwright-run.v1 artifact for a contracted test. Revalidates the live workspace snapshot, runner/command contract, required case/project coverage, and append-only receipt history before deriving and appending a kibi.verification-receipt.v2. It never accepts a caller-authored receipt or trusted outcome.",
+        name: "kb_ingest_proof",
+        cliName: "ingest-proof",
+        description: "Ingest a producer-emitted kibi.proof-run.v1 artifact and evaluate it against each selected test's kibi.proof-contract.v1 proof obligations. Revalidates the live workspace snapshot, integration command binding, run-level outcome, attempt history, success policy, and append-only proof-receipt history before deriving and appending idempotent kibi.proof-receipt.v1 receipts. Producers report what happened; Kibi evaluates proof. Prefer `kibi prove` so the configured producer runs automatically; direct ingestion is an integration path for custom producers and agents.",
     },
 ];
 const METADATA_BY_NAME = new Map(CLI_OPERATION_METADATA.map((metadata) => [metadata.name, metadata]));
-export function getCliOperationMetadata(name) {
-    const metadata = METADATA_BY_NAME.get(name);
+export function requireCliOperationMetadata(metadata, name) {
     if (metadata === undefined) {
         throw new RangeError(`Unknown Kibi CLI operation: ${name}`);
     }
     return metadata;
 }
+export function getCliOperationMetadata(name) {
+    return requireCliOperationMetadata(METADATA_BY_NAME.get(name), name);
+}
 export function isOperationName(name) {
     return METADATA_BY_NAME.has(name);
 }

package/dist/cli-protocol.js

@@ -15,7 +15,7 @@ function errorResult(operation, error, spec) {
         error: {
             code: error.code,
             message: error.detail,
-            retryable: error.exitCode === 1,
+            retryable: error.retryable,
         },
     });
     return {

package/dist/cli-register-maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2IlE"}
+{"version":3,"file":"cli-register-maintenance.d.ts","sourceRoot":"","sources":["../src/cli-register-maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2JlE"}

package/dist/cli-register-maintenance.js

@@ -12,6 +12,13 @@ export function registerMaintenanceCommands(program) {
         .command("stop")
         .description("Stop the current workspace engine")
         .action(async () => (await import("./commands/engine.js")).engineStopCommand());
+    engine
+        .command("janitor")
+        .description("Classify and clean stale engine daemons and branch-store locks (crashed engines, removed worktrees)")
+        .option("--all", "Also sweep runtime-directory daemon sockets from other workspaces", false)
+        .option("--apply", "Execute cleanups (default: report only)", false)
+        .option("--format <format>", "Output format: json|table", "table")
+        .action(async (options) => (await import("./commands/engine.js")).engineJanitorCommand(options));
     const storage = program
         .command("storage")
         .description("Inspect and maintain journaled Kibi storage");

package/dist/cli-register-proof.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerProofCommand(program: Command): void;
+//# sourceMappingURL=cli-register-proof.d.ts.map

package/dist/cli-register-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-register-proof.d.ts","sourceRoot":"","sources":["../src/cli-register-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6J3D"}

package/dist/cli-register-proof.js

@@ -0,0 +1,127 @@
+import { withExitCode } from "./cli-command.js";
+// implements REQ-kibi-verification-evidence-contract
+export function registerProofCommand(program) {
+    program
+        .command("prove")
+        .description("Run the configured proof producers and ingest valid kibi.proof-run.v1 evidence")
+        .option("--test <id>", "Prove a single test entity")
+        .option("--requirement <id>", "Prove every proof-bearing test behind a requirement")
+        .option("--integration <ids>", "Prove only tests bound to these integrations (comma-separated)")
+        .option("--integration-except <ids>", "With --all (or another selector), skip tests bound to these integrations (comma-separated)")
+        .option("--all", "Prove every proof-bearing test in the knowledge base")
+        .action(withExitCode(async (options) => {
+        const mode = [
+            options.test ? "test" : undefined,
+            options.requirement ? "requirement" : undefined,
+            options.integration ? "integration" : undefined,
+            options.all ? "all" : undefined,
+        ].filter(Boolean).length;
+        if (mode > 1)
+            throw new Error("prove: choose exactly one selector: --test, --requirement, --integration, or --all");
+        if (options.integrationExcept && mode === 0)
+            throw new Error("prove: --integration-except requires a selector such as --all");
+        return await (await import("./commands/prove.js")).proveCommand({
+            ...(options.test === undefined ? {} : { testId: options.test }),
+            ...(options.requirement === undefined
+                ? {}
+                : { requirement: options.requirement }),
+            ...(options.integration === undefined
+                ? {}
+                : { integration: options.integration }),
+            ...(options.integrationExcept === undefined
+                ? {}
+                : { integrationExcept: options.integrationExcept }),
+            all: mode === 0,
+        });
+    }));
+    const proof = program
+        .command("proof")
+        .description("Inspect proof integration and maintain proof evidence");
+    proof
+        .command("inspect")
+        .description("Detect test infrastructure and recommend the strongest available proof integration")
+        .option("--json", "Emit structured JSON", false)
+        .action(withExitCode(async (options) => {
+        const result = await (await import("./proof/inspect.js")).inspectProofEnvironment(process.cwd());
+        if (options.json) {
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            return undefined;
+        }
+        process.stdout.write(renderInspection(result));
+        return undefined;
+    }));
+    proof
+        .command("explain")
+        .description("Project one requirement or symbol proof, labeling required_proofs, executable_for, and covered_by separately")
+        .argument("[id]", "Requirement (REQ-*) or symbol (SYM-*) ID")
+        .option("--requirement <id>", "Explain a requirement ID")
+        .option("--symbol <id>", "Explain a symbol ID")
+        .option("--json", "Emit structured JSON", false)
+        .action(withExitCode(async (id, options) => {
+        return await (await import("./commands/proof-explain.js")).proofExplainCommand({
+            ...(id === undefined ? {} : { id }),
+            ...(options.requirement === undefined
+                ? {}
+                : { requirement: options.requirement }),
+            ...(options.symbol === undefined ? {} : { symbol: options.symbol }),
+            json: options.json === true,
+        });
+    }));
+    proof
+        .command("impact")
+        .description("Compare current proof state to HEAD:proof/baseline.json")
+        .option("--json", "Emit structured JSON", false)
+        .action(withExitCode(async (options) => {
+        return await (await import("./commands/proof-impact.js")).proofImpactCommand({ json: options.json === true });
+    }));
+    proof
+        .command("prune")
+        .description("Shrink each test's proof_receipts history to its newest entries (re-proving the same snapshot appends duplicates; prune removes the superseded ones)")
+        .option("--test <id>", "Prune a single test entity")
+        .option("--keep <n>", "Number of newest receipts to keep per test (default 1)", "1")
+        .action(withExitCode(async (options) => {
+        return await (await import("./commands/proof-prune.js")).proofPruneCommand({
+            ...(options.test === undefined ? {} : { test: options.test }),
+            ...(options.keep === undefined ? {} : { keep: options.keep }),
+        });
+    }));
+    proof
+        .command("migrate-legacy")
+        .description("Remove legacy verification_receipts blocks from test documents that already carry a proof_contract")
+        .option("--test <id>", "Migrate a single test entity")
+        .action(withExitCode(async (options) => {
+        return await (await import("./commands/proof-migrate-legacy.js")).proofMigrateLegacyCommand({
+            ...(options.test === undefined ? {} : { test: options.test }),
+        });
+    }));
+}
+function renderInspection(result) {
+    const inspection = result;
+    const lines = ["Proof environment", ""];
+    if (inspection.languages.length > 0)
+        lines.push(`Languages: ${inspection.languages.join(", ")}`);
+    if (inspection.buildSystems.length > 0)
+        lines.push(`Build systems: ${inspection.buildSystems.join(", ")}`);
+    lines.push("");
+    lines.push("Detected runners:");
+    if (inspection.detectedRunners.length === 0) {
+        lines.push("  (none detected)");
+    }
+    else {
+        for (const runner of inspection.detectedRunners)
+            lines.push(`  ✓ ${runner}`);
+    }
+    if (inspection.ciWorkflows.length > 0)
+        lines.push(`CI workflows: ${inspection.ciWorkflows.join(", ")}`);
+    lines.push("");
+    lines.push(`Current integration: ${inspection.currentIntegration ?? "none"}`);
+    lines.push("");
+    lines.push(`Recommendation: ${inspection.recommendation}`);
+    if (inspection.missing.length > 0) {
+        lines.push("");
+        lines.push("Missing:");
+        for (const entry of inspection.missing)
+            lines.push(`  - ${entry}`);
+    }
+    return `${lines.join("\n")}\n`;
+}

package/dist/cli-register-reporting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqKhE"}
+{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2LhE"}

package/dist/cli-register-reporting.js

@@ -6,6 +6,12 @@ async function runJsonInvocation(invocation) {
 }
 // implements REQ-kibi-operation-interface-parity
 export function registerReportingCommands(program) {
+    program
+        .command("check-generated")
+        .description("Compare generated symbol manifests with the staged Git snapshot")
+        .requiredOption("--staged", "Use the exact Git index bytes")
+        .option("--changed-only", "Skip regeneration when staged paths cannot affect symbols")
+        .action(withExitCode(async (options) => (await import("./commands/check-generated.js")).checkGeneratedManifests(options)));
     program
         .command("find-gaps [type]")
         .alias("gaps")
@@ -47,6 +53,7 @@ export function registerReportingCommands(program) {
         .option("--by <group>", "Coverage mode: req|symbol|type", "req")
         .option("--tag <tags>", "Comma-separated tag filter")
         .option("--include-passing", "Include passing rows", false)
+        .option("--status <statuses>", "Comma-separated requirement proof-status filter (proven, missing, unresolved, not_applicable); implies include-passing")
         .option("--no-include-transitive", "Disable transitive symbol coverage")
         .option("--limit <n>", "Limit results", "100")
         .option("--offset <n>", "Skip results", "0")

package/dist/cli.d.ts

@@ -1,5 +1,9 @@
 import { Command } from "commander";
 export type { CommandResult } from "./cli-command.js";
+export declare function packageVersion(value: unknown): string;
+export declare function isCliEntrypoint(argv1: string | undefined, moduleUrl: string): boolean;
+export declare function exitCodeFromCliFailure(error: unknown): number;
 export declare function buildProgram(): Command;
 export declare function main(): Promise<never>;
+export declare function runCliIfEntrypoint(isEntrypoint?: boolean, start?: typeof main): Promise<void>;
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAmBtD,wBAAgB,YAAY,IAAI,OAAO,CAiBtC;AAGD,wBAAsB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAgB3C"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUrD;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAIT;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAI7D;AAGD,wBAAgB,YAAY,IAAI,OAAO,CAiBtC;AAGD,wBAAsB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAe3C;AAED,wBAAsB,kBAAkB,CACtC,YAAY,UAAoD,EAChE,KAAK,cAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/cli.js

@@ -23,11 +23,12 @@ import { Command } from "commander";
 import { registerFoundationCommands } from "./cli-register-foundation.js";
 import { registerJsonOnlyCommands } from "./cli-register-json.js";
 import { registerMaintenanceCommands } from "./cli-register-maintenance.js";
+import { registerProofCommand } from "./cli-register-proof.js";
 import { registerReportingCommands } from "./cli-register-reporting.js";
 import { registerSkillsCommands } from "./cli-register-skills.js";
-import { registerVerificationCommand } from "./cli-register-verification.js";
+import { bootstrapKibiEnvironment } from "./env/bootstrap.js";
 const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
-function packageVersion(value) {
+export function packageVersion(value) {
     if (value !== null &&
         typeof value === "object" &&
         "version" in value &&
@@ -36,6 +37,14 @@ function packageVersion(value) {
     }
     return "0.1.0";
 }
+export function isCliEntrypoint(argv1, moduleUrl) {
+    return (argv1 !== undefined && moduleUrl === pathToFileURL(resolve(argv1)).href);
+}
+export function exitCodeFromCliFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(message);
+    return 1;
+}
 // implements REQ-kibi-operation-interface-parity
 export function buildProgram() {
     const program = new Command()
@@ -47,27 +56,27 @@ export function buildProgram() {
     registerReportingCommands(program);
     registerMaintenanceCommands(program);
     registerSkillsCommands(program);
-    registerVerificationCommand(program);
+    registerProofCommand(program);
     registerJsonOnlyCommands(program);
     return program;
 }
 // implements REQ-kibi-operation-interface-parity
 export async function main() {
+    bootstrapKibiEnvironment();
     let exitCode = process.exitCode ?? 0;
     try {
         await buildProgram().parseAsync(process.argv);
         exitCode = process.exitCode ?? 0;
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(message);
-        exitCode = 1;
+        exitCode = exitCodeFromCliFailure(error);
     }
     await Promise.all([process.stdout, process.stderr].map((stream) => stream.writableNeedDrain ? once(stream, "drain") : Promise.resolve()));
     process.exit(exitCode);
 }
-const entryPath = process.argv[1];
-if (entryPath !== undefined &&
-    import.meta.url === pathToFileURL(resolve(entryPath)).href) {
-    void main();
+export async function runCliIfEntrypoint(isEntrypoint = isCliEntrypoint(process.argv[1], import.meta.url), start = main) {
+    if (!isEntrypoint)
+        return;
+    await start();
 }
+void runCliIfEntrypoint();

package/dist/commands/branch.d.ts

@@ -23,6 +23,7 @@ export interface BranchRestoreOptions {
 /** Legacy migration changes storage format for one exact branch identity. */
 export declare function isSupportedLegacyBranchMigration(from: string, to: string): boolean;
 export declare function branchMigrationApprovalHash(from: string, to: string, sourcePath: string, targetPath: string): string;
+export declare function completeBranchJournalPaths(paths: readonly string[]): [string, string, string, string];
 export declare function branchEnsureCommand(options?: BranchEnsureOptions): Promise<void>;
 /**
  * Move a legacy branch-named KB into the exact active Git branch namespace.

package/dist/commands/branch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch.d.ts","sourceRoot":"","sources":["../../src/commands/branch.ts"],"names":[],"mappings":"AA4CA,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,OAAO,CAET;AAuBD,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CAeR;AAgHD,wBAAsB,mBAAmB,CACvC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CA2Kf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAyFf;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"branch.d.ts","sourceRoot":"","sources":["../../src/commands/branch.ts"],"names":[],"mappings":"AA4CA,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,OAAO,CAET;AAuBD,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CAeR;AAwBD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAMlC;AAwFD,wBAAsB,mBAAmB,CACvC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CA2Kf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAyFf;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED,eAAe,mBAAmB,CAAC"}

package/dist/commands/branch.js

@@ -72,6 +72,13 @@ function writeMigrationJournal(journalPath, journal) {
         mode: 0o600,
     });
 }
+export function completeBranchJournalPaths(paths) {
+    const [sourcePath, targetPath, stagingPath, backupPath] = paths;
+    if (!sourcePath || !targetPath || !stagingPath || !backupPath) {
+        throw new Error("Branch migration journal is incomplete");
+    }
+    return [sourcePath, targetPath, stagingPath, backupPath];
+}
 function recoverBranchMigration(workspaceRoot, id, apply) {
     const journalPath = migrationJournalPath(workspaceRoot, id);
     const journal = JSON.parse(fs.readFileSync(journalPath, "utf8"));
@@ -82,10 +89,7 @@ function recoverBranchMigration(workspaceRoot, id, apply) {
     if (paths.some((candidate) => !candidate.startsWith(`${root}${path.sep}`))) {
         throw new Error("Branch migration journal path escapes workspace");
     }
-    const [sourcePath, targetPath, stagingPath, backupPath] = paths;
-    if (!sourcePath || !targetPath || !stagingPath || !backupPath) {
-        throw new Error("Branch migration journal is incomplete");
-    }
+    const [sourcePath, targetPath, stagingPath, backupPath] = completeBranchJournalPaths(paths);
     console.log(`Branch migration recovery preview: ${id}`);
     console.log(`State: ${String(journal.state)}`);
     console.log(`Source: ${sourcePath}`);

package/dist/commands/check-generated.d.ts

@@ -0,0 +1,7 @@
+/** Compare generated artifacts for exactly one captured Git index tree. */
+export declare function checkGeneratedManifests(options?: {
+    changedOnly?: boolean;
+}): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=check-generated.d.ts.map

package/dist/commands/check-generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-generated.d.ts","sourceRoot":"","sources":["../../src/commands/check-generated.ts"],"names":[],"mappings":"AA2HA,2EAA2E;AAE3E,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GACL,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAwH/B"}