kibi-cli 2.0.0 → 2.2.0

package/dist/cli-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAO7E,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AA+CF,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}
+{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAO7E,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAiDF,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAyD5B"}

package/dist/cli-protocol.js

@@ -5,13 +5,14 @@ import { isOperationName } from "./cli-operation-metadata.js";
 import { prepareOperationInput, } from "./cli-validate.js";
 import { operationData, toKibiResult, } from "./public/operations/result-envelope.js";
 const outputValidator = new Ajv2020({ strict: false, allErrors: true });
-function errorResult(operation, error, spec) {
+function errorResult(operation, error, spec, attempted = true) {
     const envelope = toKibiResult(spec ?? {
         name: operation,
         effects: [],
         resultVersion: `kibi.${operation}.v1`,
     }, null, {
         status: "error",
+        attempted,
         error: {
             code: error.code,
             message: error.detail,
@@ -42,7 +43,7 @@ export async function executeOperation(catalogName, input, context) {
     const spec = await loadOperationSpec(catalogName);
     const prepared = prepareOperationInput(input, spec.businessInputSchema);
     if (!prepared.valid) {
-        return errorResult(catalogName, new InputError("VALIDATION_FAILED", prepared.errors.join("; ")), spec);
+        return errorResult(catalogName, new InputError("VALIDATION_FAILED", prepared.errors.join("; ")), spec, false);
     }
     try {
         const executionContext = prepared.telemetry

package/dist/cli-register-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-proof.d.ts","sourceRoot":"","sources":["../src/cli-register-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsH3D"}
+{"version":3,"file":"cli-register-proof.d.ts","sourceRoot":"","sources":["../src/cli-register-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6J3D"}

package/dist/cli-register-proof.js

@@ -1,5 +1,5 @@
 import { withExitCode } from "./cli-command.js";
-// implements REQ-kibi-proof-evidence-protocol
+// implements REQ-kibi-verification-evidence-contract
 export function registerProofCommand(program) {
     program
         .command("prove")
@@ -50,6 +50,30 @@ export function registerProofCommand(program) {
         process.stdout.write(renderInspection(result));
         return undefined;
     }));
+    proof
+        .command("explain")
+        .description("Project one requirement or symbol proof, labeling required_proofs, executable_for, and covered_by separately")
+        .argument("[id]", "Requirement (REQ-*) or symbol (SYM-*) ID")
+        .option("--requirement <id>", "Explain a requirement ID")
+        .option("--symbol <id>", "Explain a symbol ID")
+        .option("--json", "Emit structured JSON", false)
+        .action(withExitCode(async (id, options) => {
+        return await (await import("./commands/proof-explain.js")).proofExplainCommand({
+            ...(id === undefined ? {} : { id }),
+            ...(options.requirement === undefined
+                ? {}
+                : { requirement: options.requirement }),
+            ...(options.symbol === undefined ? {} : { symbol: options.symbol }),
+            json: options.json === true,
+        });
+    }));
+    proof
+        .command("impact")
+        .description("Compare current proof state to HEAD:proof/baseline.json")
+        .option("--json", "Emit structured JSON", false)
+        .action(withExitCode(async (options) => {
+        return await (await import("./commands/proof-impact.js")).proofImpactCommand({ json: options.json === true });
+    }));
     proof
         .command("prune")
         .description("Shrink each test's proof_receipts history to its newest entries (re-proving the same snapshot appends duplicates; prune removes the superseded ones)")

package/dist/cli-register-reporting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyKhE"}
+{"version":3,"file":"cli-register-reporting.d.ts","sourceRoot":"","sources":["../src/cli-register-reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2LhE"}

package/dist/cli-register-reporting.js

@@ -6,6 +6,12 @@ async function runJsonInvocation(invocation) {
 }
 // implements REQ-kibi-operation-interface-parity
 export function registerReportingCommands(program) {
+    program
+        .command("check-generated")
+        .description("Compare generated symbol manifests with the staged Git snapshot")
+        .requiredOption("--staged", "Use the exact Git index bytes")
+        .option("--changed-only", "Skip regeneration when staged paths cannot affect symbols")
+        .action(withExitCode(async (options) => (await import("./commands/check-generated.js")).checkGeneratedManifests(options)));
     program
         .command("find-gaps [type]")
         .alias("gaps")

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUrD;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAIT;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAI7D;AAGD,wBAAgB,YAAY,IAAI,OAAO,CAiBtC;AAGD,wBAAsB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAc3C;AAED,wBAAsB,kBAAkB,CACtC,YAAY,UAAoD,EAChE,KAAK,cAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAGf"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUrD;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAIT;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAI7D;AAGD,wBAAgB,YAAY,IAAI,OAAO,CAiBtC;AAGD,wBAAsB,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAe3C;AAED,wBAAsB,kBAAkB,CACtC,YAAY,UAAoD,EAChE,KAAK,cAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/cli.js

@@ -26,6 +26,7 @@ import { registerMaintenanceCommands } from "./cli-register-maintenance.js";
 import { registerProofCommand } from "./cli-register-proof.js";
 import { registerReportingCommands } from "./cli-register-reporting.js";
 import { registerSkillsCommands } from "./cli-register-skills.js";
+import { bootstrapKibiEnvironment } from "./env/bootstrap.js";
 const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 export function packageVersion(value) {
     if (value !== null &&
@@ -61,6 +62,7 @@ export function buildProgram() {
 }
 // implements REQ-kibi-operation-interface-parity
 export async function main() {
+    bootstrapKibiEnvironment();
     let exitCode = process.exitCode ?? 0;
     try {
         await buildProgram().parseAsync(process.argv);

package/dist/commands/aggregated-checks.d.ts

@@ -1,5 +1,12 @@
 import { type PrologProcess } from "../prolog.js";
 import type { Violation } from "./check.js";
+/**
+ * Forward the invoking process's ontology-quality thresholds. The engine
+ * daemon outlives the CLI/MCP call that started it, so its own environment
+ * would otherwise decide. Prolog validates the values and falls back to its
+ * defaults for anything out of range.
+ */
+export declare function ontologyQualityOverridesGoal(env?: NodeJS.ProcessEnv): string;
 /**
  * Run all checks using the aggregated Prolog predicates.
  * This makes a single Prolog call and parses JSON output, significantly

package/dist/commands/aggregated-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregated-checks.d.ts","sourceRoot":"","sources":["../../src/commands/aggregated-checks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,cAAc,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAW5C;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EACpC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,GACjC,OAAO,CAAC,SAAS,EAAE,CAAC,CA8DtB"}
+{"version":3,"file":"aggregated-checks.d.ts","sourceRoot":"","sources":["../../src/commands/aggregated-checks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,cAAc,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAiB5C;;;;;GAKG;AAEH,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAYR;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EACpC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,GACjC,OAAO,CAAC,SAAS,EAAE,CAAC,CA8DtB"}

package/dist/commands/aggregated-checks.js

@@ -1,6 +1,30 @@
 import path from "node:path";
 import { resolveKbPlPath } from "../prolog.js";
 import { escapeAtom, toPrologAtom } from "../prolog/codec.js";
+function ontologyQualitySetting(raw) {
+    if (raw === undefined || raw.trim() === "")
+        return "default";
+    const value = Number(raw.trim());
+    return Number.isFinite(value) ? String(value) : "default";
+}
+/**
+ * Forward the invoking process's ontology-quality thresholds. The engine
+ * daemon outlives the CLI/MCP call that started it, so its own environment
+ * would otherwise decide. Prolog validates the values and falls back to its
+ * defaults for anything out of range.
+ */
+// implements REQ-kibi-ontology-quality
+export function ontologyQualityOverridesGoal(env = process.env) {
+    const ratio = ontologyQualitySetting(env.KIBI_ONTOLOGY_QUALITY_MAX_SINGLETON_RATIO);
+    const minFacts = ontologyQualitySetting(env.KIBI_ONTOLOGY_QUALITY_MIN_FACTS);
+    // call/1 defers resolution: a literal module-qualified goal is checked by
+    // the toplevel when the query is read, before use_module has loaded
+    // semantic_quality.pl (the same reason the check calls use call/1).
+    return `(   predicate_property(semantic_quality:set_ontology_quality_overrides(_, _), defined)
+    ->  call(semantic_quality:set_ontology_quality_overrides(${ratio}, ${minFacts}))
+    ;   true
+    )`;
+}
 /**
  * Run all checks using the aggregated Prolog predicates.
  * This makes a single Prolog call and parses JSON output, significantly
@@ -25,7 +49,7 @@ export async function runAggregatedChecks(prolog, rulesAllowlist) {
       ;   ${fallbackQuery}
       )`
         : fallbackQuery;
-    const query = `(use_module('${checksPlPathEscaped}'), ${checksQuery})`;
+    const query = `(use_module('${checksPlPathEscaped}'), ${ontologyQualityOverridesGoal()}, ${checksQuery})`;
     const result = await prolog.query(query);
     if (!result.success) {
         throw new Error(`Aggregated checks query failed: ${result.error || "Unknown error"}`);

package/dist/commands/check-generated.d.ts

@@ -0,0 +1,7 @@
+/** Compare generated artifacts for exactly one captured Git index tree. */
+export declare function checkGeneratedManifests(options?: {
+    changedOnly?: boolean;
+}): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=check-generated.d.ts.map

package/dist/commands/check-generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-generated.d.ts","sourceRoot":"","sources":["../../src/commands/check-generated.ts"],"names":[],"mappings":"AA2HA,2EAA2E;AAE3E,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GACL,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAwH/B"}

package/dist/commands/check-generated.js

@@ -0,0 +1,192 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+import { load as parseYAML } from "js-yaml";
+import { refreshManifestCoordinates } from "./sync/manifest.js";
+const MANIFESTS = [".kb/symbols.yaml", ".kb/symbol-coordinates.yaml"];
+const MAX_GIT_OUTPUT = 256 * 1024 * 1024;
+function git(args, input) {
+    const result = spawnSync("git", args, {
+        input,
+        maxBuffer: MAX_GIT_OUTPUT,
+        encoding: "buffer",
+    });
+    if (result.error || result.status !== 0) {
+        throw new Error(`git ${args.join(" ")} failed: ${result.error?.message ?? result.stderr.toString("utf8").trim()}`);
+    }
+    return result.stdout;
+}
+function indexTree() {
+    return git(["write-tree"]).toString("utf8").trim();
+}
+function treeBlobs(tree) {
+    const entries = git(["ls-tree", "-r", "-z", "--full-tree", tree]);
+    const blobs = new Map();
+    const nonRegularPaths = new Set();
+    for (const record of entries.toString("utf8").split("\0")) {
+        if (!record)
+            continue;
+        const match = /^(\d{6}) (\w+) ([a-f0-9]+)\t(.+)$/.exec(record);
+        if (!match)
+            throw new Error("Could not parse staged Git tree");
+        const [, mode, type, oid, file] = match;
+        if (file === undefined || oid === undefined)
+            throw new Error("Could not parse staged Git tree");
+        if (mode === "100644" || mode === "100755") {
+            if (type !== "blob")
+                throw new Error(`Unexpected Git object for ${file}`);
+            blobs.set(file, oid);
+        }
+        else {
+            nonRegularPaths.add(file);
+        }
+    }
+    return { blobs, nonRegularPaths };
+}
+function readBlobs(oids) {
+    if (oids.length === 0)
+        return new Map();
+    const response = git(["cat-file", "--batch"], Buffer.from(`${oids.join("\n")}\n`));
+    const contents = new Map();
+    let offset = 0;
+    for (const oid of oids) {
+        const end = response.indexOf(10, offset);
+        if (end < 0)
+            throw new Error("Incomplete Git blob response");
+        const header = response.subarray(offset, end).toString("utf8");
+        const match = /^([a-f0-9]+) blob (\d+)$/.exec(header);
+        if (!match || match[1] !== oid)
+            throw new Error(`Invalid Git blob response for ${oid}`);
+        const size = Number(match[2]);
+        const start = end + 1;
+        const finish = start + size;
+        if (!Number.isSafeInteger(size) ||
+            finish >= response.length ||
+            response[finish] !== 10) {
+            throw new Error(`Incomplete Git blob ${oid}`);
+        }
+        contents.set(oid, response.subarray(start, finish));
+        offset = finish + 1;
+    }
+    return contents;
+}
+function sourcePaths(symbols) {
+    const parsed = parseYAML(symbols.toString("utf8"));
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        !("symbols" in parsed) ||
+        !Array.isArray(parsed.symbols)) {
+        throw new Error("Staged .kb/symbols.yaml has no symbols array");
+    }
+    const sources = new Set();
+    for (const symbol of parsed.symbols) {
+        const source = symbol?.sourceFile;
+        if (typeof source !== "string")
+            continue;
+        const normalized = path.posix.normalize(source.replaceAll("\\", "/"));
+        if (normalized === "." ||
+            path.posix.isAbsolute(normalized) ||
+            /^[A-Za-z]:/.test(normalized) ||
+            normalized.split("/").includes("..")) {
+            throw new Error(`Symbol source must be a repository-relative path: ${source}`);
+        }
+        sources.add(normalized);
+    }
+    return { paths: [...sources], symbolCount: parsed.symbols.length };
+}
+/** Compare generated artifacts for exactly one captured Git index tree. */
+// implements REQ-cli-check
+export async function checkGeneratedManifests(options = {}) {
+    let snapshotDir;
+    try {
+        const tree = indexTree();
+        const { blobs, nonRegularPaths } = treeBlobs(tree);
+        const symbolsOid = blobs.get(MANIFESTS[0]);
+        if (!symbolsOid)
+            throw new Error("Staged .kb/symbols.yaml is missing or is not a regular file");
+        const initial = readBlobs([symbolsOid]);
+        const symbols = initial.get(symbolsOid);
+        if (!symbols)
+            throw new Error("Could not read staged .kb/symbols.yaml");
+        const { paths: sources, symbolCount } = sourcePaths(symbols);
+        // Plain sync does not publish coordinate artifacts for a freshly
+        // initialized, empty symbols manifest. The first commit must remain usable.
+        if (symbolCount === 0) {
+            if (indexTree() !== tree)
+                throw new Error("Git index changed during generated-manifest analysis; retry the commit");
+            console.log("kibi: staged symbols manifest is empty; no coordinates to refresh.");
+            return { exitCode: 0 };
+        }
+        const nonRegularEntries = [...nonRegularPaths];
+        const nonRegular = sources.find((source) => nonRegularEntries.some((entry) => source === entry || source.startsWith(`${entry}/`)));
+        if (nonRegular)
+            throw new Error(`Staged symbol source is not a regular file: ${nonRegular}`);
+        if (options.changedOnly) {
+            const changed = new Set(git(["diff", "--cached", "--name-only", "--no-renames", "-z"])
+                .toString("utf8")
+                .split("\0")
+                .filter(Boolean));
+            if (![...MANIFESTS, ...sources].some((file) => changed.has(file))) {
+                if (indexTree() !== tree)
+                    throw new Error("Git index changed during generated-manifest analysis; retry the commit");
+                console.log("kibi: no staged symbol sources or generated manifests changed.");
+                return { exitCode: 0 };
+            }
+        }
+        const files = [...MANIFESTS, ...sources];
+        const objectIds = [
+            ...new Set(files
+                .map((file) => blobs.get(file))
+                .filter((oid) => !!oid)),
+        ];
+        const content = readBlobs(objectIds);
+        snapshotDir = mkdtempSync(path.join(tmpdir(), "kibi-generated-check-"));
+        for (const file of files) {
+            const oid = blobs.get(file);
+            if (!oid)
+                continue;
+            const target = path.join(snapshotDir, file);
+            mkdirSync(path.dirname(target), { recursive: true });
+            const bytes = content.get(oid);
+            if (!bytes)
+                throw new Error(`Could not read staged blob for ${file}`);
+            writeFileSync(target, bytes);
+        }
+        await refreshManifestCoordinates(path.join(snapshotDir, MANIFESTS[0]), snapshotDir, {
+            refreshSymbolCoordinates: true,
+            quiet: true,
+        });
+        const snapshot = snapshotDir;
+        const drift = MANIFESTS.filter((file) => {
+            const generatedPath = path.join(snapshot, file);
+            const expected = existsSync(generatedPath)
+                ? readFileSync(generatedPath)
+                : undefined;
+            const oid = blobs.get(file);
+            const staged = oid ? content.get(oid) : undefined;
+            return expected === undefined
+                ? staged !== undefined
+                : staged === undefined || !expected.equals(staged);
+        });
+        // An index mutation invalidates every comparison, even if the manifests
+        // themselves were untouched. Git will commit the later index state.
+        if (indexTree() !== tree)
+            throw new Error("Git index changed during generated-manifest analysis; retry the commit");
+        if (drift.length > 0) {
+            console.error(`kibi: generated manifest drift in staged snapshot: ${drift.join(", ")}`);
+            console.error("Run kibi sync --refresh-symbol-coordinates, review the diff, then stage only the intended hunks with git add -p (or git add <path> when the whole file is intended).");
+            return { exitCode: 1 };
+        }
+        console.log("kibi: staged generated manifests are current.");
+        return { exitCode: 0 };
+    }
+    catch (error) {
+        console.error(`kibi: generated manifest check failed: ${error instanceof Error ? error.message : String(error)}`);
+        return { exitCode: 1 };
+    }
+    finally {
+        if (snapshotDir)
+            rmSync(snapshotDir, { recursive: true, force: true });
+    }
+}

package/dist/commands/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAgE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AA8eD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3B,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAMpB;AAGD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0a/B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAoDtB;AAID,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AACD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA+DtB;AAID,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAmGtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAyCtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgDtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA+BtB"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAiE7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AAifD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3B,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAMpB;AAGD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA4b/B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAoDtB;AAID,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AACD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgEtB;AAID,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAmGtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAyCtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgDtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA+BtB"}

package/dist/commands/check.js

@@ -29,10 +29,11 @@ import { KIBI_NO_IMPACT_DECLARATION, KIBI_SYMBOLS_MANIFEST_PATH, KIBI_SYMBOL_COO
 import { getStagedInventory, supportedStagedFiles, } from "../traceability/git-staged.js";
 import { validateStagedMarkdown } from "../traceability/markdown-validate.js";
 import { collectStagedKibiDiagnostics, } from "../traceability/staged-diagnostics.js";
+import { createStagedEntityIdStyleDiagnostics } from "../traceability/staged-entity-id-style.js";
 import { analyzeStagedFileCoverage, } from "../traceability/staged-file-coverage.js";
 import { classifyKibiImpactEvidence, isBehaviorSourceEdit, parseKibiImpactOverride, } from "../traceability/staged-impact-contract.js";
 import { assessStagedSymbolsManifest, collectStagedAuthoredSymbolsManifestEvidence, } from "../traceability/staged-symbols-manifest.js";
-import { createManifestLookupSentinelKey, extractSymbolsFromStagedFile, } from "../traceability/symbol-extract.js";
+import { createManifestLookupSentinelKey, extractSymbolsFromStagedFileAsync, } from "../traceability/symbol-extract.js";
 import { cleanupTempKb, consultOverlay, createOverlayFacts, createTempKb, projectStagedEntities, } from "../traceability/temp-kb.js";
 import { formatViolations as formatStagedViolations, validateStagedSymbols, } from "../traceability/validate.js";
 import { resolveBranchAttachment } from "../utils/branch-resolver.js";
@@ -486,7 +487,8 @@ export async function checkCommand(options) {
                         if (f.content !== undefined) {
                             sourceContentByFile.set(f.path, f.content);
                         }
-                        const symbols = extractSymbolsFromStagedFile(f, manifestLookup);
+                        // Maintenance path: builtin-only (no CapabilityRegistry / workspaceRoot).
+                        const symbols = await extractSymbolsFromStagedFileAsync(f, manifestLookup, {});
                         symbolsByFile.set(f.path, symbols);
                         if (symbols?.length) {
                             allSymbols.push(...symbols);
@@ -543,23 +545,26 @@ export async function checkCommand(options) {
                         ? { activeEntityIds: activeStagedSymbolEntityIds }
                         : {}),
                     symbolsByFile,
-                }), ...createSemanticReviewDiagnostics({ symbolsByFile }));
+                }), ...createSemanticReviewDiagnostics({ symbolsByFile }), ...createStagedEntityIdStyleDiagnostics(markdownFiles));
                 if (allSymbols.length === 0 && stagedEntityResults.length === 0) {
                     if (stagedKibiDiagnostics.length > 0) {
+                        const blocking = hasBlockingImpactDiagnostics(stagedKibiDiagnostics);
                         printStagedResult({
                             format: options.format,
                             coverage: stagedCoverage,
                             qualityDiagnostics: stagedKibiDiagnostics,
-                            messages: [formatStagedKibiDiagnostics(stagedKibiDiagnostics)],
+                            messages: [
+                                formatStagedKibiDiagnostics(stagedKibiDiagnostics),
+                                // Advisory-only findings still pass; say so explicitly.
+                                ...(!blocking
+                                    ? ["✓ No violations found in staged files."]
+                                    : []),
+                            ],
                         });
                         if (options.dryRun) {
                             return { exitCode: 0 };
                         }
-                        return {
-                            exitCode: hasBlockingImpactDiagnostics(stagedKibiDiagnostics)
-                                ? 1
-                                : 0,
-                        };
+                        return { exitCode: blocking ? 1 : 0 };
                     }
                     printStagedResult({
                         format: options.format,
@@ -572,20 +577,23 @@ export async function checkCommand(options) {
                 }
                 if (allSymbols.length === 0) {
                     if (stagedKibiDiagnostics.length > 0) {
+                        const blocking = hasBlockingImpactDiagnostics(stagedKibiDiagnostics);
                         printStagedResult({
                             format: options.format,
                             coverage: stagedCoverage,
                             qualityDiagnostics: stagedKibiDiagnostics,
-                            messages: [formatStagedKibiDiagnostics(stagedKibiDiagnostics)],
+                            messages: [
+                                formatStagedKibiDiagnostics(stagedKibiDiagnostics),
+                                // Advisory-only findings still pass; say so explicitly.
+                                ...(!blocking
+                                    ? ["✓ No violations found in staged files."]
+                                    : []),
+                            ],
                         });
                         if (options.dryRun) {
                             return { exitCode: 0 };
                         }
-                        return {
-                            exitCode: hasBlockingImpactDiagnostics(stagedKibiDiagnostics)
-                                ? 1
-                                : 0,
-                        };
+                        return { exitCode: blocking ? 1 : 0 };
                     }
                     printStagedResult({
                         format: options.format,
@@ -849,6 +857,7 @@ export async function checkNoDanglingRefs(prolog) {
         "constrains",
         "requires_property",
         "supersedes",
+        "restates",
         "relates_to",
     ];
     const allRels = [];

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B;AAGD,wBAAsB,aAAa,CACjC,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAiF/B;AAED,wBAAsB,4BAA4B,CAChD,IAAI,GAAE,MAAM,OAAO,CAAC;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,CACT,GACxC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;;;;;;;;;;;;;;;MAkE3C;AAkGD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAepB"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAkEA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B;AAGD,wBAAsB,aAAa,CACjC,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgG/B;AAED,wBAAsB,4BAA4B,CAChD,IAAI,GAAE,MAAM,OAAO,CAAC;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,CACT,GACxC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;;;;;;;;;;;;;;;MAkE3C;AAkGD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAepB"}