kibi-cli 1.0.1 → 2.1.0

package/dist/commands/proof-impact.js

@@ -0,0 +1,39 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ */
+import { executeProofImpact, proofImpactExitCode, } from "../operations/proof/impact.js";
+import { createCliRuntime } from "../runtime/cli-runtime.js";
+// implements REQ-kibi-verification-evidence-contract
+export async function proofImpactCommand(options) {
+    const runtime = createCliRuntime();
+    const context = await runtime.open({
+        name: "kibi_proof_impact",
+        effects: [],
+        requiresProlog: true,
+        execute: async () => undefined,
+    }, {});
+    let completed = false;
+    try {
+        const { result, text } = await executeProofImpact(context);
+        if (options.json) {
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            process.stdout.write(text);
+        }
+        completed = true;
+        await runtime.afterSuccess({ name: "kibi_proof_impact" }, context);
+        return { exitCode: proofImpactExitCode(result) };
+    }
+    finally {
+        await runtime.close(context, completed
+            ? { status: "success", result: 0 }
+            : { status: "error", error: 1 });
+    }
+}

package/dist/commands/proof-migrate-legacy.d.ts

@@ -0,0 +1,7 @@
+export type ProofMigrateLegacyOptions = Readonly<{
+    test?: string;
+}>;
+export declare function proofMigrateLegacyCommand(options: ProofMigrateLegacyOptions): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=proof-migrate-legacy.d.ts.map

package/dist/commands/proof-migrate-legacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-migrate-legacy.d.ts","sourceRoot":"","sources":["../../src/commands/proof-migrate-legacy.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAE/C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAGH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC/B"}

package/dist/commands/proof-migrate-legacy.js

@@ -0,0 +1,45 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+import { executeMigrateLegacyReceipts } from "../operations/proof/migrate-legacy-receipts.js";
+import { createCliRuntime } from "../runtime/cli-runtime.js";
+// implements REQ-kibi-verification-evidence-contract
+export async function proofMigrateLegacyCommand(options) {
+    const runtime = createCliRuntime();
+    const context = await runtime.open({
+        name: "kibi_proof_migrate_legacy",
+        effects: ["kb-mutate", "workspace-write"],
+        requiresProlog: true,
+        execute: async () => undefined,
+    }, {});
+    let completed = false;
+    try {
+        const result = await executeMigrateLegacyReceipts(options.test === undefined ? {} : { testId: options.test }, context);
+        process.stdout.write(`${result.content[0]?.text ?? ""}\n`);
+        for (const row of result.structuredContent.tests) {
+            process.stdout.write(`  ${row.testId}: legacy verification_receipts removed\n`);
+        }
+        completed = true;
+        await runtime.afterSuccess({ name: "kibi_proof_migrate_legacy" }, context);
+        return { exitCode: 0 };
+    }
+    finally {
+        await runtime.close(context, completed
+            ? { status: "success", result: 0 }
+            : { status: "error", error: 1 });
+    }
+}

package/dist/commands/proof-prune.d.ts

@@ -0,0 +1,8 @@
+export type ProofPruneOptions = Readonly<{
+    test?: string;
+    keep?: string;
+}>;
+export declare function proofPruneCommand(options: ProofPruneOptions): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=proof-prune.d.ts.map

package/dist/commands/proof-prune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-prune.d.ts","sourceRoot":"","sources":["../../src/commands/proof-prune.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IAEvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAGH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC;IAC3E,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CA0CD"}

package/dist/commands/proof-prune.js

@@ -0,0 +1,53 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+import { executePruneReceipts } from "../operations/proof/prune-receipts.js";
+import { createCliRuntime } from "../runtime/cli-runtime.js";
+// implements REQ-kibi-verification-evidence-contract
+export async function proofPruneCommand(options) {
+    const keepRaw = options.keep ?? "1";
+    const keep = Number.parseInt(keepRaw, 10);
+    if (!Number.isSafeInteger(keep) || keep < 1 || keep > 50) {
+        throw new Error("proof prune: --keep must be an integer between 1 and 50");
+    }
+    const runtime = createCliRuntime();
+    const context = await runtime.open({
+        name: "kibi_proof_prune",
+        effects: ["kb-mutate", "workspace-write"],
+        requiresProlog: true,
+        execute: async () => undefined,
+    }, {});
+    let completed = false;
+    try {
+        const result = await executePruneReceipts({
+            keep,
+            ...(options.test === undefined ? {} : { testId: options.test }),
+        }, context);
+        process.stdout.write(`${result.content[0]?.text ?? ""}\n`);
+        for (const row of result.structuredContent.tests) {
+            process.stdout.write(`  ${row.testId}: ${row.before} -> ${row.after} receipt(s)\n`);
+        }
+        completed = true;
+        await runtime.afterSuccess({ name: "kibi_proof_prune" }, context);
+        return { exitCode: 0 };
+    }
+    finally {
+        await runtime.close(context, completed
+            ? { status: "success", result: 0 }
+            : { status: "error", error: 1 });
+    }
+}

package/dist/commands/prove.d.ts

@@ -0,0 +1,37 @@
+import { executeIngestProof } from "../operations/proof/ingest-proof.js";
+import type { ProofIntegration } from "../proof/integrations.js";
+import type { OperationRuntime } from "../public/operations/runtime-types.js";
+import { readWorkspaceSnapshot } from "../public/operations/workspace-snapshot.js";
+export type ProveCommandOptions = Readonly<{
+    testId?: string;
+    requirement?: string;
+    integration?: string;
+    integrationExcept?: string;
+    all?: boolean;
+    workspaceRoot?: string;
+}>;
+export type ProveCommandDependencies = Readonly<{
+    runtime?: OperationRuntime;
+    ingestProof?: typeof executeIngestProof;
+}>;
+type SelectedTest = Record<string, unknown>;
+/**
+ * Describe which paths moved when a proof snapshot refusal fires, so
+ * consumers can see what kibi thinks changed instead of diffing by hand.
+ * Snapshot-relevant changes come first (receipt-only and ignored edits do
+ * not affect the hash), and the list is capped to keep the error readable.
+ */
+export declare function describeWorkspaceDrift(snapshot: Awaited<ReturnType<typeof readWorkspaceSnapshot>>): string;
+/**
+ * Parse a comma-separated integration selector ("a", "a,b,c") into a set of
+ * trimmed, non-empty ids. Empty selectors yield an empty set; blank items
+ * fail fast instead of silently narrowing the selection.
+ */
+export declare function parseIntegrationSelector(value: string | undefined, flagName: string): Set<string>;
+export declare function testId(test: SelectedTest): string;
+export declare function commandEnvironment(integration: ProofIntegration, commandArgv: readonly string[], snapshot: string, workspaceRoot: string, testIds: readonly string[], outputPath: string): NodeJS.ProcessEnv;
+export declare function proveCommand(options: ProveCommandOptions, deps?: ProveCommandDependencies): Promise<{
+    exitCode: number;
+}>;
+export {};
+//# sourceMappingURL=prove.d.ts.map

package/dist/commands/prove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../../src/commands/prove.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AASjE,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAYnF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,kBAAkB,CAAC;CACzC,CAAC,CAAC;AAEH,KAAK,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5C;;;;;GAKG;AAEH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,GAC1D,MAAM,CAiBR;AAED;;;;GAIG;AAEH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,GACf,GAAG,CAAC,MAAM,CAAC,CAUb;AAQD,wBAAgB,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAEjD;AAkCD,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,UAAU,EAAE,MAAM,GACjB,MAAM,CAAC,UAAU,CAWnB;AA4KD,wBAAsB,YAAY,CAChC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgL/B"}

package/dist/commands/prove.js

@@ -0,0 +1,470 @@
+import { spawn } from "node:child_process";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { executeIngestProof } from "../operations/proof/ingest-proof.js";
+import { PROOF_RUNS_DIR, loadProofIntegrations, resolveIntegration, } from "../proof/integrations.js";
+import { convertJUnitXml } from "../proof/producers/junit-adapter.js";
+import { convertTap } from "../proof/producers/tap-adapter.js";
+import { loadEntities } from "../public/operations/discovery-entities.js";
+import { ingestProofSpec } from "../public/operations/specs/proof.js";
+import { readWorkspaceSnapshot } from "../public/operations/workspace-snapshot.js";
+import { PROOF_RUN_VERSION, proofBindingsErrors, proofRunArtifactErrors, } from "../public/proof-protocol.js";
+import { createCliRuntime } from "../runtime/cli-runtime.js";
+/**
+ * Describe which paths moved when a proof snapshot refusal fires, so
+ * consumers can see what kibi thinks changed instead of diffing by hand.
+ * Snapshot-relevant changes come first (receipt-only and ignored edits do
+ * not affect the hash), and the list is capped to keep the error readable.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function describeWorkspaceDrift(snapshot) {
+    if (!snapshot.available)
+        return " (workspace snapshot unavailable)";
+    const changes = snapshot.snapshot.changes ?? [];
+    const relevant = changes.filter((change) => change.snapshotRelevant);
+    const pool = relevant.length > 0
+        ? relevant
+        : changes.filter((change) => !change.snapshotRelevant);
+    if (pool.length === 0) {
+        return " (git reported no workspace changes; the hash drift may come from file content that git treats as unchanged)";
+    }
+    const maxPaths = 10;
+    const listed = pool
+        .slice(0, maxPaths)
+        .map((change) => `${change.status.trim() || "M"} ${change.path}`);
+    const more = pool.length - listed.length;
+    return `; changed: ${listed.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
+}
+/**
+ * Parse a comma-separated integration selector ("a", "a,b,c") into a set of
+ * trimmed, non-empty ids. Empty selectors yield an empty set; blank items
+ * fail fast instead of silently narrowing the selection.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function parseIntegrationSelector(value, flagName) {
+    if (value === undefined || value.trim() === "")
+        return new Set();
+    const ids = new Set();
+    for (const raw of value.split(",")) {
+        const id = raw.trim();
+        if (id === "")
+            throw new Error(`prove: ${flagName} contains an empty integration id`);
+        ids.add(id);
+    }
+    return ids;
+}
+function withId(entity) {
+    if (typeof entity.id !== "string" || entity.id === "")
+        throw new Error("prove: loaded test entity is missing an id");
+    return entity;
+}
+export function testId(test) {
+    return String(test.id);
+}
+function parseContract(test) {
+    const contract = test.proof_contract;
+    if (contract === null ||
+        typeof contract !== "object" ||
+        Array.isArray(contract))
+        return null;
+    return contract;
+}
+async function runChild(commandArgv, cwd, env) {
+    const [command, ...args] = commandArgv;
+    if (!command)
+        throw new Error("prove: integration command argv must be non-empty");
+    return await new Promise((resolve, reject) => {
+        const child = spawn(command, args, {
+            cwd,
+            env,
+            shell: false,
+            stdio: "inherit",
+        });
+        child.once("error", reject);
+        child.once("close", (code) => resolve(code ?? 1));
+    });
+}
+// implements REQ-kibi-verification-evidence-contract
+export function commandEnvironment(integration, commandArgv, snapshot, workspaceRoot, testIds, outputPath) {
+    return {
+        ...process.env,
+        KIBI_PROOF_RUN: "1",
+        KIBI_PROOF_OUTPUT: outputPath,
+        KIBI_PROOF_SNAPSHOT: snapshot,
+        KIBI_PROOF_COMMAND_ARGV: JSON.stringify(commandArgv),
+        KIBI_PROOF_INTEGRATION: integration.id,
+        KIBI_PROOF_WORKSPACE: workspaceRoot,
+        KIBI_PROOF_TEST_IDS: JSON.stringify(testIds),
+    };
+}
+function collectBindings(tests) {
+    const bindings = [];
+    for (const test of tests) {
+        const raw = test.proof_bindings;
+        if (raw === undefined || raw === null)
+            continue;
+        if (!Array.isArray(raw))
+            continue;
+        const errors = proofBindingsErrors(raw);
+        if (errors.length > 0)
+            throw new Error(`prove: test ${test.id} has invalid proof_bindings: ${errors.join("; ")}`);
+        for (const entry of raw) {
+            const row = entry;
+            bindings.push({
+                symbol_id: String(row.symbol_id),
+                target: String(row.target),
+                ...(row.native_id !== undefined
+                    ? { native_id: String(row.native_id) }
+                    : {}),
+                ...(row.aliases !== undefined
+                    ? { aliases: row.aliases.map(String) }
+                    : {}),
+            });
+        }
+    }
+    return bindings;
+}
+function dedupeObligations(tests) {
+    const seen = new Set();
+    const results = [];
+    for (const test of tests) {
+        const contract = parseContract(test);
+        if (!contract)
+            continue;
+        for (const obligation of contract.required_proofs) {
+            const key = `${obligation.target}\0${obligation.symbol_id}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            results.push({
+                symbol_id: obligation.symbol_id,
+                target: obligation.target,
+                outcome: "passed",
+                binding: "aggregate_run",
+                attempts: { status: "unavailable" },
+            });
+        }
+    }
+    return results;
+}
+function markAggregateFailure(results) {
+    return results.map((result) => ({ ...result, outcome: "failed" }));
+}
+async function selectTests(context, options) {
+    // Paginated: loading every test entity with full props in one query can
+    // exceed the Prolog output buffer once receipt histories grow.
+    const loadAll = async () => {
+        const pageSize = 25;
+        const all = [];
+        for (let offset = 0;; offset += pageSize) {
+            const page = await loadEntities(context.prolog, {
+                type: "test",
+                limit: pageSize,
+                offset,
+            });
+            all.push(...page);
+            if (page.length < pageSize)
+                return all;
+        }
+    };
+    let candidates = [];
+    if (options.testId) {
+        const found = await loadEntities(context.prolog, {
+            id: options.testId,
+            type: "test",
+        });
+        candidates = found.map(withId);
+    }
+    else if (options.requirement) {
+        const requirementId = options.requirement;
+        const scenarioResult = await context.prolog?.query(`findall([S,T], (kb_relationship(specified_by, '${requirementId}', S), (kb_relationship(verified_by, S, T) ; kb_relationship(validates, T, S)), kb_entity(T, test, _)), Rows)`);
+        const rowsRaw = scenarioResult?.success
+            ? scenarioResult.bindings.Rows
+            : undefined;
+        const ids = new Set();
+        if (typeof rowsRaw === "string") {
+            for (const match of rowsRaw.matchAll(/\[['"]?([^,\]]+)['"]?,['"]?([^,\]]+)['"]?\]/g)) {
+                const test = match[2];
+                if (test)
+                    ids.add(test.trim());
+            }
+        }
+        const directResult = await context.prolog?.query(`findall(T, (kb_relationship(validates, T, '${requirementId}'), kb_entity(T, test, _)), Rows)`);
+        const directRaw = directResult?.success
+            ? directResult.bindings.Rows
+            : undefined;
+        if (typeof directRaw === "string") {
+            for (const match of directRaw.matchAll(/\[?['"]?([A-Za-z0-9_-]+)['"]?\]?/g)) {
+                const candidate = match[1];
+                if (candidate?.startsWith("TEST-"))
+                    ids.add(candidate);
+            }
+        }
+        const all = await loadAll();
+        candidates = all.filter((entity) => ids.has(String(entity.id))).map(withId);
+    }
+    else {
+        candidates = (await loadAll()).map(withId);
+    }
+    const selected = candidates.filter((entity) => parseContract(entity) !== null);
+    const includeIds = parseIntegrationSelector(options.integration, "--integration");
+    const excludeIds = parseIntegrationSelector(options.integrationExcept, "--integration-except");
+    if (includeIds.size === 0 && excludeIds.size === 0)
+        return selected;
+    const filtered = selected.filter((entity) => {
+        const contract = parseContract(entity);
+        if (!contract)
+            return false;
+        if (includeIds.size > 0 && !includeIds.has(contract.integration))
+            return false;
+        if (excludeIds.size > 0 && excludeIds.has(contract.integration))
+            return false;
+        return true;
+    });
+    if (filtered.length === 0 && includeIds.size + excludeIds.size > 0) {
+        const requested = [
+            ...(includeIds.size > 0
+                ? [`integrations: ${[...includeIds].sort().join(", ")}`]
+                : []),
+            ...(excludeIds.size > 0
+                ? [`excluding: ${[...excludeIds].sort().join(", ")}`]
+                : []),
+        ].join("; ");
+        throw new Error(`prove: no proof-bearing tests match the integration selector (${requested})`);
+    }
+    return filtered;
+}
+function summarize(result) {
+    const parts = [`passed ${result.passed}`, `failed ${result.failed}`];
+    if (result.unchanged > 0)
+        parts.push(`unchanged ${result.unchanged}`);
+    return parts.join(", ");
+}
+// implements REQ-kibi-verification-evidence-contract
+export async function proveCommand(options, deps = {}) {
+    const workspaceRoot = options.workspaceRoot ?? process.cwd();
+    const ingestProof = deps.ingestProof ?? executeIngestProof;
+    const runtime = deps.runtime ??
+        createCliRuntime(options.workspaceRoot === undefined ? {} : { workspaceRoot });
+    const context = await runtime.open(ingestProofSpec, {
+        ...(options.workspaceRoot === undefined ? {} : { workspaceRoot }),
+    });
+    let completed = false;
+    try {
+        const integrations = loadProofIntegrations(context.workspaceRoot);
+        if (!integrations.available)
+            throw new Error(`prove: ${integrations.error}`);
+        const selected = await selectTests(context, options);
+        if (selected.length === 0) {
+            process.stdout.write(`${JSON.stringify({ proved: 0, failed: 0, message: "no proof-bearing tests selected" })}\n`);
+            completed = true;
+            return { exitCode: 0 };
+        }
+        const before = await readWorkspaceSnapshot(context);
+        if (!before.available)
+            throw new Error(`prove: ${before.error}`);
+        const snapshot = before.snapshot.hash;
+        // Packed contracts run in separate processes; one shared packed-tarball
+        // cache area per campaign snapshot replaces dozens of repeated packs and
+        // installs with a single population. The snapshot hash is the provenance
+        // key: different workspace state never sees another campaign's artifacts.
+        process.env.KIBI_E2E_PACK_CACHE_KEY ??= snapshot;
+        const groups = new Map();
+        for (const test of selected) {
+            const contract = parseContract(test);
+            if (!contract)
+                continue;
+            const list = groups.get(contract.integration) ?? [];
+            list.push(test);
+            groups.set(contract.integration, list);
+        }
+        const runsDir = path.join(context.workspaceRoot, PROOF_RUNS_DIR);
+        await mkdir(runsDir, { recursive: true });
+        const ingestResults = [];
+        const failures = [];
+        for (const [integrationId, tests] of groups) {
+            const integration = resolveIntegration(integrations.integrations, integrationId);
+            if (!integration) {
+                failures.push(`integration '${integrationId}' (required by ${tests.map((t) => t.id).join(", ")}) is not configured in .kb/proof/integrations.json`);
+                continue;
+            }
+            const commandArgv = [...integration.command];
+            const artifactPath = path.resolve(context.workspaceRoot, integration.artifact ??
+                path.join(PROOF_RUNS_DIR, `${integrationId}.json`));
+            await mkdir(path.dirname(artifactPath), { recursive: true });
+            await rm(artifactPath, { force: true });
+            const env = commandEnvironment(integration, commandArgv, snapshot, context.workspaceRoot, tests.map((test) => String(test.id)), artifactPath);
+            const startedAt = new Date().toISOString();
+            let exitCode;
+            try {
+                exitCode = await runChild(commandArgv, context.workspaceRoot, env);
+            }
+            catch (error) {
+                failures.push(`integration '${integrationId}' failed to start: ${error instanceof Error ? error.message : String(error)}`);
+                continue;
+            }
+            const finishedAt = new Date().toISOString();
+            let artifact;
+            try {
+                artifact = await buildArtifact({
+                    integration,
+                    commandArgv,
+                    exitCode,
+                    startedAt,
+                    finishedAt,
+                    artifactPath,
+                    snapshot,
+                    tests,
+                });
+            }
+            catch (error) {
+                failures.push(`integration '${integrationId}': ${error instanceof Error ? error.message : String(error)}`);
+                continue;
+            }
+            const artifactErrors = proofRunArtifactErrors(artifact);
+            if (artifactErrors.length > 0) {
+                failures.push(`integration '${integrationId}' produced an invalid kibi.proof-run.v1 artifact: ${artifactErrors.join("; ")}`);
+                continue;
+            }
+            await mkdir(path.dirname(artifactPath), { recursive: true });
+            await writeFile(artifactPath, `${JSON.stringify(artifact, null, 2)}\n`, "utf8");
+            const afterRun = await readWorkspaceSnapshot(context);
+            if (!afterRun.available || afterRun.snapshot.hash !== snapshot) {
+                failures.push(`integration '${integrationId}' changed the tracked workspace during proof execution; proof is bound to snapshot ${snapshot}${describeWorkspaceDrift(afterRun)}`);
+                continue;
+            }
+            const ingested = await ingestProof({
+                snapshot,
+                artifact: artifact,
+                testIds: tests.map((test) => String(test.id)),
+            }, context);
+            ingestResults.push(ingested.structuredContent);
+            const afterIngest = await readWorkspaceSnapshot(context);
+            if (!afterIngest.available || afterIngest.snapshot.hash !== snapshot) {
+                failures.push(`the tracked workspace changed while receipts were applied; re-run kibi prove${describeWorkspaceDrift(afterIngest)}`);
+            }
+        }
+        const passed = ingestResults.reduce((sum, result) => sum + result.passed, 0);
+        const failed = ingestResults.reduce((sum, result) => sum + result.failed, 0);
+        const unchanged = ingestResults.reduce((sum, result) => sum + result.unchanged, 0);
+        const summary = {
+            proved: passed,
+            failed,
+            unchanged,
+            runs: ingestResults.map((result) => ({
+                integration: result.integration,
+                summary: summarize(result),
+                results: result.results,
+            })),
+            ...(failures.length > 0 ? { failures } : {}),
+        };
+        process.stdout.write(`${JSON.stringify(summary)}\n`);
+        completed = true;
+        await runtime.afterSuccess(ingestProofSpec, context);
+        return { exitCode: failures.length > 0 || failed > 0 ? 1 : 0 };
+    }
+    finally {
+        await runtime.close(context, completed
+            ? { status: "success", result: 0 }
+            : { status: "error", error: 1 });
+    }
+}
+async function buildArtifact(input) {
+    const { integration, commandArgv, exitCode, startedAt, finishedAt, artifactPath, snapshot, tests, } = input;
+    const run = (outcome) => ({
+        outcome,
+        exit_code: exitCode,
+        started_at: startedAt,
+        finished_at: finishedAt,
+    });
+    if (integration.producer === "command") {
+        const results = dedupeObligations(tests);
+        return {
+            version: PROOF_RUN_VERSION,
+            producer: {
+                name: "kibi-command-producer",
+                ...(integration.producer_version !== undefined
+                    ? { version: integration.producer_version }
+                    : {}),
+            },
+            integration: integration.id,
+            command_argv: [...commandArgv],
+            code_snapshot: snapshot,
+            environment: {
+                os: process.platform,
+                arch: process.arch,
+                runtime: { name: "node", version: process.version },
+            },
+            run: run(exitCode === 0 ? "passed" : "failed"),
+            proof_results: exitCode === 0 ? results : markAggregateFailure(results),
+        };
+    }
+    if (integration.producer === "junit" || integration.producer === "tap") {
+        const nativePath = integration.artifact;
+        if (!nativePath)
+            throw new Error(`producer '${integration.producer}' requires an artifact path in .kb/proof/integrations.json`);
+        let native;
+        try {
+            native = await readFile(path.resolve(context_path(nativePath)), "utf8");
+        }
+        catch {
+            throw new Error(`producer '${integration.producer}' did not produce its native report at ${nativePath}`);
+        }
+        const bindings = collectBindings(tests);
+        const conversion = integration.producer === "junit"
+            ? convertJUnitXml(native, bindings)
+            : convertTap(native, bindings);
+        if (conversion.fatal) {
+            throw new Error(`producer '${integration.producer}' rejected its native report${conversion.diagnostics.length > 0 ? `: ${conversion.diagnostics.join("; ")}` : ""}`);
+        }
+        if (conversion.results.length === 0)
+            throw new Error(`producer '${integration.producer}' produced no bound proof results${conversion.diagnostics.length > 0 ? `: ${conversion.diagnostics.join("; ")}` : ""}`);
+        return {
+            version: PROOF_RUN_VERSION,
+            producer: {
+                name: `kibi-${integration.producer}-adapter`,
+                ...(integration.producer_version !== undefined
+                    ? { version: integration.producer_version }
+                    : {}),
+            },
+            integration: integration.id,
+            command_argv: [...commandArgv],
+            code_snapshot: snapshot,
+            environment: {
+                os: process.platform,
+                arch: process.arch,
+                runtime: { name: "node", version: process.version },
+            },
+            run: run(conversion.results.every((result) => result.outcome === "passed")
+                ? "passed"
+                : "failed"),
+            proof_results: conversion.results,
+            ...(conversion.diagnostics.length > 0
+                ? { diagnostics: conversion.diagnostics }
+                : {}),
+        };
+    }
+    // Self-emitting producers (playwright and custom): read the emitted
+    // kibi.proof-run.v1 artifact and enforce the process outcome.
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(artifactPath, "utf8"));
+    }
+    catch {
+        throw new Error(`producer '${integration.producer}' did not emit a readable kibi.proof-run.v1 artifact at ${artifactPath}`);
+    }
+    const artifact = parsed;
+    const runRecord = parsed.run;
+    const reportedOutcome = runRecord?.outcome;
+    if (exitCode !== 0) {
+        if (reportedOutcome === "passed") {
+            throw new Error(`producer '${integration.producer}' reported run.outcome 'passed' but the process exited with code ${exitCode}`);
+        }
+    }
+    return artifact;
+}
+function context_path(nativePath) {
+    return path.isAbsolute(nativePath)
+        ? nativePath
+        : path.join(process.cwd(), nativePath);
+}