kibi-cli 2.0.0 → 2.2.0

package/dist/operations/proof/impact.js

@@ -0,0 +1,118 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ */
+import { execFileSync } from "node:child_process";
+import { executeCoverage } from "../../public/operations/specs/reporting.js";
+import { diffFingerprints, fingerprintRequirements, renderRequirementDiffs, } from "./baseline-diff.js";
+// implements REQ-kibi-verification-evidence-contract
+export const COMMITTED_BASELINE_PATH = "proof/baseline.json";
+function asNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function gitErrorText(error) {
+    if (error && typeof error === "object" && "stderr" in error) {
+        const stderr = error.stderr;
+        if (typeof stderr === "string" && stderr.trim() !== "")
+            return stderr;
+        if (Buffer.isBuffer(stderr) && stderr.length > 0) {
+            return stderr.toString("utf8");
+        }
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+function committedBaselineReadError(relativePath, error) {
+    const text = gitErrorText(error);
+    if (/not a git repository/i.test(text) ||
+        /ambiguous argument 'HEAD'/i.test(text) ||
+        /unknown revision/i.test(text) ||
+        /needed a single revision/i.test(text) ||
+        /bad revision 'HEAD'/i.test(text)) {
+        return new Error(`proof impact: repository is not in a suitable Git state to read HEAD:${relativePath}`);
+    }
+    if (/does not exist in 'HEAD'/i.test(text) ||
+        /exists on disk, but not in 'HEAD'/i.test(text) ||
+        /path '.*' does not exist/i.test(text)) {
+        return new Error(`proof impact: HEAD:${relativePath} is missing or unreadable`);
+    }
+    return new Error(`proof impact: could not read HEAD:${relativePath}: ${text.trim()}`);
+}
+// implements REQ-kibi-verification-evidence-contract
+export function readCommittedHeadFile(workspaceRoot, relativePath) {
+    try {
+        return execFileSync("git", ["-C", workspaceRoot, "show", `HEAD:${relativePath}`], {
+            encoding: "utf8",
+            maxBuffer: 64 * 1024 * 1024,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch (error) {
+        throw committedBaselineReadError(relativePath, error);
+    }
+}
+// implements REQ-kibi-verification-evidence-contract
+export async function loadCommittedBaseline(workspaceRoot, readCommittedFile = readCommittedHeadFile) {
+    const raw = await readCommittedFile(workspaceRoot, COMMITTED_BASELINE_PATH);
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`proof impact: HEAD:${COMMITTED_BASELINE_PATH} is not valid JSON`);
+    }
+}
+/** Diagnostic only: successful evaluation always exits 0. Ratchet lives in check-proof-baseline.mjs. */
+export function proofImpactExitCode(_result) {
+    return 0;
+}
+// implements REQ-kibi-verification-evidence-contract
+export function buildProofImpact(baseline, coverage) {
+    const rows = Array.isArray(coverage.rows)
+        ? coverage.rows
+        : [];
+    const summary = coverage.summary ?? {};
+    const proofNotApplicable = asNumber(summary.proofNotApplicable);
+    const total = asNumber(summary.total);
+    const proofProven = asNumber(summary.proofProven);
+    const currentUnproven = asNumber(summary.proofMissing) + asNumber(summary.proofUnresolved);
+    const current = fingerprintRequirements(rows);
+    const changes = diffFingerprints(baseline.requirements, current);
+    return {
+        rows,
+        result: {
+            comparisonTarget: COMMITTED_BASELINE_PATH,
+            baselineVersion: baseline.version ?? "unknown",
+            currentRequirements: total - proofNotApplicable,
+            proofProven,
+            currentUnproven,
+            changes,
+        },
+    };
+}
+// implements REQ-kibi-verification-evidence-contract
+export function renderProofImpact(result, rows) {
+    const header = [
+        `Proof impact compared to committed ${result.comparisonTarget}`,
+        `baseline version: ${result.baselineVersion}`,
+        `current requirements: ${result.currentRequirements}`,
+        `proofProven: ${result.proofProven}`,
+        `currentUnproven: ${result.currentUnproven}`,
+        `changed requirements: ${result.changes.length}`,
+        "",
+    ];
+    const diff = renderRequirementDiffs(result.changes, rows);
+    return `${header.join("\n")}${diff || "No requirement fingerprint changes versus the committed baseline.\n"}`;
+}
+// implements REQ-kibi-verification-evidence-contract
+export async function executeProofImpact(context, options = {}) {
+    const baseline = await loadCommittedBaseline(context.workspaceRoot, options.readCommittedFile ?? readCommittedHeadFile);
+    const coverage = options.loadCoverage
+        ? await options.loadCoverage(context)
+        : await executeCoverage({ by: "req", includePassing: true, limit: 100_000, offset: 0 }, context);
+    const { result, rows } = buildProofImpact(baseline, coverage.structuredContent);
+    return { result, rows, text: renderProofImpact(result, rows) };
+}

package/dist/operations/proof/ingest-proof.d.ts

@@ -24,11 +24,13 @@ export type IngestProofResult = Readonly<{
     unchanged: number;
     results: readonly IngestProofTestResult[];
 }>;
-export declare function executeIngestProof(args: IngestProofArgs, context: OperationContext): Promise<{
+type IngestProofOutput = {
     content: Array<{
         type: "text";
         text: string;
     }>;
     structuredContent: IngestProofResult;
-}>;
+};
+export declare function executeIngestProof(args: IngestProofArgs, context: OperationContext): Promise<IngestProofOutput>;
+export {};
 //# sourceMappingURL=ingest-proof.d.ts.map

package/dist/operations/proof/ingest-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAkBjF,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAYvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAqFH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC,CA2RD"}
+{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAkBjF,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAqBvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC;AAokBF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAuC5B"}

package/dist/operations/proof/ingest-proof.js

@@ -1,3 +1,6 @@
+import { join } from "node:path";
+import { resolveBoundSymbolScope } from "../../extractors/manifest.js";
+import { loadCoveredBySymbolsByTest, receiptCodeScopeSymbolIds, } from "./code-scope.js";
 import { evaluateContractAgainstRun, } from "../../proof/evaluate.js";
 import { loadProofIntegrations, resolveIntegration, toExecution, } from "../../proof/integrations.js";
 import { loadEntities } from "../../public/operations/discovery-entities.js";
@@ -6,11 +9,33 @@ import { environmentHash as canonicalEnvironmentHash, effectiveProofFingerprint,
 import { PROOF_CONTRACT_VERSION, PROOF_RECEIPT_VERSION, proofBindingsErrors, proofRunArtifactErrors, } from "../../public/proof-protocol.js";
 import { MAX_PROOF_RECEIPTS, proofReceiptCurrentBindingErrors, proofReceiptHistoryErrors, } from "../../public/proof-receipt.js";
 import { projectEntityProperties } from "../mutation/entity-projection.js";
-import { join } from "node:path";
-import { resolveBoundSymbolScope } from "../../extractors/manifest.js";
 import { resolveContainedSourcePath } from "../mutation/source-authoring.js";
+import { buildUpsertBatchCommitGoal, parseUpsertChangeKinds, } from "../mutation/contradictions.js";
 import { executeUpsert } from "../mutation/upsert.js";
+import { acquireWorkspaceMutationLock, releaseWorkspaceMutationLock, } from "../mutation/workspace-mutation-lock.js";
+import { MutationRollbackFailureError } from "../mutation/saga.js";
 import { patchReceiptsIntoDocument, removeFrontmatterBlock, } from "./receipt-document.js";
+async function rollbackUncommittedReceipts(pending, originalError, lifecycle) {
+    const failures = [];
+    for (const entry of pending) {
+        if (entry.deferred.state === "committed")
+            continue;
+        try {
+            const rollbackFailures = await entry.deferred.rollback();
+            for (const failure of rollbackFailures) {
+                failures.push({ testId: entry.testId, ...failure });
+            }
+        }
+        catch (error) {
+            failures.push({ testId: entry.testId, step: "rollback", error });
+        }
+    }
+    if (failures.length > 0) {
+        lifecycle?.onRollbackFailure?.();
+        throw new AggregateError([originalError, ...failures.map((failure) => failure.error)], `Proof ingest failed and could not restore every uncommitted receipt source; the source mutation lock remains held for recovery (${failures.map(({ testId, step }) => `${testId}:${step}`).join(", ")})`);
+    }
+    throw originalError;
+}
 function text(value) {
     return typeof value === "string" ? value.trim() : "";
 }
@@ -74,13 +99,53 @@ function parseBindings(test) {
         };
     });
 }
+function enforceNativeCaseBindings(testId, contract, bindings, artifact) {
+    const requiredKeys = new Set(contract.required_proofs.map((obligation) => `${obligation.target}\0${obligation.symbol_id}`));
+    const nativeResults = artifact.proof_results.filter((result) => result.binding === "native_case" &&
+        requiredKeys.has(`${result.target}\0${result.symbol_id}`));
+    const seenNativeIds = new Set();
+    for (const result of nativeResults) {
+        const nativeId = typeof result.native_id === "string" ? result.native_id : "";
+        const resultLabel = `${result.symbol_id}/${result.target}`;
+        if (!nativeId) {
+            throw new Error(`Proof ingest failed: test ${testId} native_case result ${resultLabel} has no native_id`);
+        }
+        if (seenNativeIds.has(nativeId)) {
+            throw new Error(`Proof ingest failed: test ${testId} duplicate native result for native_id '${nativeId}'`);
+        }
+        seenNativeIds.add(nativeId);
+        const matchingBindings = bindings.filter((binding) => binding.symbol_id === result.symbol_id &&
+            binding.target === result.target);
+        if (matchingBindings.length === 0) {
+            throw new Error(`Proof ingest failed: test ${testId} native_case result ${resultLabel} has no matching proof_binding`);
+        }
+        if (matchingBindings.length !== 1) {
+            throw new Error(`Proof ingest failed: test ${testId} native_case result ${resultLabel} has an ambiguous proof_binding`);
+        }
+        const binding = matchingBindings[0];
+        if (binding === undefined) {
+            throw new Error(`Proof ingest failed: test ${testId} native_case result ${resultLabel} has an ambiguous proof_binding`);
+        }
+        const boundNativeIds = [
+            binding.native_id,
+            ...(binding.aliases ?? []),
+        ].filter((value) => typeof value === "string" && value !== "");
+        if (!boundNativeIds.includes(nativeId)) {
+            throw new Error(`Proof ingest failed: test ${testId} native_case result ${resultLabel} native_id '${nativeId}' does not match its proof_binding native_id or aliases`);
+        }
+        const ambiguousOwners = bindings.filter((candidate) => [candidate.native_id, ...(candidate.aliases ?? [])].includes(nativeId));
+        if (ambiguousOwners.length !== 1) {
+            throw new Error(`Proof ingest failed: test ${testId} native_id '${nativeId}' has an ambiguous proof_binding`);
+        }
+    }
+}
 function existingReceipts(test) {
     return Array.isArray(test.proof_receipts)
         ? test.proof_receipts.filter(record).map((value) => ({ ...value }))
         : [];
 }
-// implements REQ-kibi-proof-evidence-protocol
-export async function executeIngestProof(args, context) {
+// implements REQ-kibi-verification-evidence-contract
+async function executeIngestProofUnlocked(args, context, lifecycle) {
     if (!context.prolog)
         throw new Error("Proof ingest requires a Prolog runtime");
     const snapshot = requiredString(args.snapshot, "snapshot");
@@ -122,18 +187,37 @@ export async function executeIngestProof(args, context) {
         }
     }
     else {
-        const all = await loadEntities(context.prolog, { type: "test" });
-        for (const test of all) {
-            const contract = record(test.proof_contract);
-            if (contract &&
-                contract.version === PROOF_CONTRACT_VERSION &&
-                text(contract.integration) === integrationId) {
-                tests.push(test);
+        // Select candidates from the paged contract projection (no receipt
+        // histories), then load each matching test in full: the append-only
+        // receipt update needs that test's existing history, but never every
+        // test's history in a single Prolog answer.
+        const candidates = await loadEntities(context.prolog, {
+            type: "test",
+            projection: "proof_contract",
+        });
+        for (const candidate of candidates) {
+            const contract = record(candidate.proof_contract);
+            if (!contract ||
+                contract.version !== PROOF_CONTRACT_VERSION ||
+                text(contract.integration) !== integrationId) {
+                continue;
             }
+            const testId = String(candidate.id);
+            const found = await loadEntities(context.prolog, {
+                id: testId,
+                type: "test",
+            });
+            const test = found[0];
+            if (!test)
+                throw new Error(`Proof ingest failed: test ${testId} was not found`);
+            tests.push(test);
         }
         if (tests.length === 0)
             throw new Error(`Proof ingest failed: no tests declare proof_contract.integration '${integrationId}'`);
     }
+    // Loaded outside the per-test binding try/catch: an engine failure must fail
+    // the ingest, not silently write receipts without a binding hash.
+    const coveredBy = await loadCoveredBySymbolsByTest(context.prolog);
     const prepared = [];
     for (const test of tests) {
         const testId = String(test.id);
@@ -147,6 +231,7 @@ export async function executeIngestProof(args, context) {
         if (jsonDigest(artifact.command_argv) !== jsonDigest([...integration.command]))
             throw new Error(`Proof ingest failed: artifact command_argv does not match the configured command for integration '${effectiveIntegrationId}'`);
         const bindings = parseBindings(test);
+        enforceNativeCaseBindings(testId, contract, bindings, artifact);
         const { fingerprint, components } = effectiveProofFingerprint({
             contract,
             integration: toExecution(integration),
@@ -166,7 +251,7 @@ export async function executeIngestProof(args, context) {
                 const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
                 const authored = await context.fs.readFile(absolute);
                 const stripped = removeFrontmatterBlock(authored, "proof_receipts");
-                const codeScope = resolveBoundSymbolScope(join(context.workspaceRoot, ".kb", "symbols.yaml"), bindings.map((binding) => binding.symbol_id));
+                const codeScope = resolveBoundSymbolScope(join(context.workspaceRoot, ".kb", "symbols.yaml"), receiptCodeScopeSymbolIds(contract, bindings, coveredBy.get(testId) ?? []));
                 bindingHash = receiptBindingHash(contract, stripped ?? authored, codeScope);
             }
             catch {
@@ -212,82 +297,138 @@ export async function executeIngestProof(args, context) {
         });
     }
     const results = [];
+    const pendingCommits = [];
     let passed = 0;
     let failed = 0;
     let unchanged = 0;
-    for (const entry of prepared) {
-        const { testId, test, contract, evaluation, receipt, existing } = entry;
-        // Idempotent re-ingestion: the same artifact against the same effective
-        // contract+fingerprint derives the same receipt id and must not re-append.
-        if (existing.some((row) => row.receipt_id === receipt.receipt_id)) {
-            unchanged += 1;
-            if (receipt.outcome === "passed")
-                passed += 1;
-            else
-                failed += 1;
-            results.push({
+    try {
+        for (const entry of prepared) {
+            const { testId, test, contract, evaluation, receipt, existing } = entry;
+            // Idempotent re-ingestion: the same artifact against the same effective
+            // contract+fingerprint derives the same receipt id and must not re-append.
+            if (existing.some((row) => row.receipt_id === receipt.receipt_id)) {
+                unchanged += 1;
+                if (receipt.outcome === "passed")
+                    passed += 1;
+                else
+                    failed += 1;
+                results.push({
+                    testId,
+                    outcome: receipt.outcome,
+                    receiptId: receipt.receipt_id,
+                    applied: false,
+                    duplicate: true,
+                    receiptCount: existing.length,
+                    gaps: evaluation.gaps,
+                });
+                continue;
+            }
+            const nextReceipts = [
+                ...existing,
+                receipt,
+            ].slice(-MAX_PROOF_RECEIPTS);
+            const historyErrors = proofReceiptHistoryErrors(testId, test.verification_scope, nextReceipts);
+            const bindingErrors = proofReceiptCurrentBindingErrors(testId, test.verification_scope, receipt, contract, receipt.fingerprint);
+            const receiptErrors = [...historyErrors, ...bindingErrors];
+            if (receiptErrors.length > 0)
+                throw new Error(`Proof ingest failed for ${testId}: ${receiptErrors.join("; ")}`);
+            const properties = projectEntityProperties(test);
+            properties.proof_receipts = undefined;
+            // Surgical receipt append: splice only the proof_receipts block into the
+            // authored document so unrelated frontmatter keeps its authored form.
+            // Canonical re-rendering here would change non-receipt bytes, shift the
+            // workspace snapshot hash mid-campaign, and make later integrations in
+            // the same `kibi prove --all` refuse with "changed the tracked
+            // workspace". Falls back to the canonical render when the document is
+            // not a patchable markdown file.
+            let sourceDocumentOverride;
+            const source = typeof test.source === "string" ? test.source : "";
+            if (context.fs && source !== "" && /\.(md|mdx)$/i.test(source)) {
+                try {
+                    const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
+                    const before = await context.fs.readFile(absolute);
+                    sourceDocumentOverride =
+                        patchReceiptsIntoDocument(before, nextReceipts) ?? undefined;
+                }
+                catch {
+                    sourceDocumentOverride = undefined;
+                }
+            }
+            // exactOptionalPropertyTypes: only pass the override when one exists.
+            const upsertOptions = {
+                deferCompiledCommit: true,
+                ...(sourceDocumentOverride === undefined
+                    ? {}
+                    : { sourceDocumentOverride }),
+            };
+            const upsert = await executeUpsert({
+                type: "test",
+                id: testId,
+                properties: { ...properties, proof_receipts: nextReceipts },
+            }, context, upsertOptions);
+            const deferred = upsert.structuredContent?.deferredCommit;
+            if (!deferred) {
+                throw new Error(`Proof ingest failed for ${testId}: receipt commit was not prepared`);
+            }
+            pendingCommits.push({
                 testId,
                 outcome: receipt.outcome,
                 receiptId: receipt.receipt_id,
-                applied: false,
-                duplicate: true,
-                receiptCount: existing.length,
+                receiptCount: nextReceipts.length,
                 gaps: evaluation.gaps,
+                deferred,
             });
-            continue;
         }
-        const nextReceipts = [
-            ...existing,
-            receipt,
-        ].slice(-MAX_PROOF_RECEIPTS);
-        const historyErrors = proofReceiptHistoryErrors(testId, test.verification_scope, nextReceipts);
-        const bindingErrors = proofReceiptCurrentBindingErrors(testId, test.verification_scope, receipt, contract, receipt.fingerprint);
-        const receiptErrors = [...historyErrors, ...bindingErrors];
-        if (receiptErrors.length > 0)
-            throw new Error(`Proof ingest failed for ${testId}: ${receiptErrors.join("; ")}`);
-        const properties = projectEntityProperties(test);
-        properties.proof_receipts = undefined;
-        // Surgical receipt append: splice only the proof_receipts block into the
-        // authored document so unrelated frontmatter keeps its authored form.
-        // Canonical re-rendering here would change non-receipt bytes, shift the
-        // workspace snapshot hash mid-campaign, and make later integrations in
-        // the same `kibi prove --all` refuse with "changed the tracked
-        // workspace". Falls back to the canonical render when the document is
-        // not a patchable markdown file.
-        let sourceDocumentOverride;
-        const source = typeof test.source === "string" ? test.source : "";
-        if (context.fs && source !== "" && /\.(md|mdx)$/i.test(source)) {
-            try {
-                const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
-                const before = await context.fs.readFile(absolute);
-                sourceDocumentOverride =
-                    patchReceiptsIntoDocument(before, nextReceipts) ?? undefined;
-            }
-            catch {
-                sourceDocumentOverride = undefined;
+    }
+    catch (error) {
+        if (error instanceof MutationRollbackFailureError) {
+            lifecycle?.onRollbackFailure?.();
+        }
+        await rollbackUncommittedReceipts(pendingCommits, error, lifecycle);
+    }
+    const prolog = context.prolog;
+    if (!prolog)
+        throw new Error("Proof ingest failed: Prolog runtime is unavailable");
+    const batchSize = 25;
+    for (let offset = 0; offset < pendingCommits.length; offset += batchSize) {
+        const batch = pendingCommits.slice(offset, offset + batchSize);
+        let written;
+        try {
+            written = await prolog.query(buildUpsertBatchCommitGoal(batch.map((entry) => ({
+                entity: entry.deferred.entity,
+                relationships: entry.deferred.relationships,
+                skipContradictionCheck: entry.deferred.skipContradictionCheck,
+            }))));
+            if (!written.success) {
+                throw new Error(written.error || "batch commit failed");
             }
+            // Prolog success is the irreversible commit boundary. Finalize this
+            // batch before parsing auxiliary metadata or doing more work, so later
+            // failures can only roll back still-prepared source writes.
+            for (const entry of batch)
+                entry.deferred.finalize();
+            lifecycle?.onBatchCommitted?.();
+            prolog.invalidateCache?.();
+            parseUpsertChangeKinds(written.bindings, batch.length);
+        }
+        catch (error) {
+            await rollbackUncommittedReceipts(pendingCommits, error, lifecycle);
+        }
+        for (const entry of batch) {
+            if (entry.outcome === "passed")
+                passed += 1;
+            else
+                failed += 1;
+            results.push({
+                testId: entry.testId,
+                outcome: entry.outcome,
+                receiptId: entry.receiptId,
+                applied: true,
+                duplicate: false,
+                receiptCount: entry.receiptCount,
+                gaps: entry.gaps,
+            });
         }
-        // exactOptionalPropertyTypes: only pass the override when one exists.
-        const upsertOptions = sourceDocumentOverride === undefined ? {} : { sourceDocumentOverride };
-        const upsert = await executeUpsert({
-            type: "test",
-            id: testId,
-            properties: { ...properties, proof_receipts: nextReceipts },
-        }, context, upsertOptions);
-        void upsert;
-        if (receipt.outcome === "passed")
-            passed += 1;
-        else
-            failed += 1;
-        results.push({
-            testId,
-            outcome: receipt.outcome,
-            receiptId: receipt.receipt_id,
-            applied: true,
-            duplicate: false,
-            receiptCount: nextReceipts.length,
-            gaps: evaluation.gaps,
-        });
     }
     const summary = passed > 0
         ? `Proved ${passed} test(s)${failed > 0 ? `, ${failed} failed` : ""}${unchanged > 0 ? `, ${unchanged} unchanged` : ""}.`
@@ -305,3 +446,36 @@ export async function executeIngestProof(args, context) {
         },
     };
 }
+export async function executeIngestProof(args, context) {
+    if (!context.fs ||
+        context.sourceFirst === false ||
+        context.sourceMutationLockHeld === true) {
+        return executeIngestProofUnlocked(args, context);
+    }
+    const lock = await acquireWorkspaceMutationLock(context.workspaceRoot);
+    let operationFailure;
+    let committed = false;
+    let releaseSafe = true;
+    try {
+        return await executeIngestProofUnlocked(args, { ...context, sourceMutationLockHeld: true }, {
+            onBatchCommitted: () => {
+                committed = true;
+            },
+            onRollbackFailure: () => {
+                releaseSafe = false;
+            },
+        });
+    }
+    catch (error) {
+        operationFailure = { error };
+        throw error;
+    }
+    finally {
+        // A failed compensation must leave the cooperative lock fail-closed. The
+        // next writer will require verified recovery rather than observing a
+        // partially restored set of receipt documents.
+        if (releaseSafe) {
+            releaseWorkspaceMutationLock(lock, operationFailure, committed);
+        }
+    }
+}

package/dist/operations/proof/migrate-legacy-receipts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-legacy-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/migrate-legacy-receipts.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAOjF,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,yCAAyC;IAEzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAEjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AAEH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,2BAA2B,CAAC;CAChD,CAAC,CA6ED"}
+{"version":3,"file":"migrate-legacy-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/migrate-legacy-receipts.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAOjF,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,yCAAyC;IAEzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAEjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AAEH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,2BAA2B,CAAC;CAChD,CAAC,CAqFD"}

package/dist/operations/proof/migrate-legacy-receipts.js

@@ -15,7 +15,7 @@
  You should have received a copy of the GNU Affero General Public License
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-import { loadEntities } from "../../public/operations/discovery-entities.js";
+import { loadEntities, loadEntitiesPaged, } from "../../public/operations/discovery-entities.js";
 import { projectEntityProperties } from "../mutation/entity-projection.js";
 import { resolveContainedSourcePath } from "../mutation/source-authoring.js";
 import { executeUpsert } from "../mutation/upsert.js";
@@ -31,51 +31,57 @@ import { removeFrontmatterBlock } from "./receipt-document.js";
  * the authored document and the compiled entity — one block splice, no
  * canonical re-render.
  */
-// implements REQ-kibi-proof-evidence-protocol
+// implements REQ-kibi-verification-evidence-contract
 export async function executeMigrateLegacyReceipts(args, context) {
     if (!context.prolog)
         throw new Error("Legacy receipt migration requires a Prolog runtime");
     if (context.fs === undefined)
         throw new Error("Legacy receipt migration failed: this maintenance action rewrites authored test documents and requires a filesystem-capable runtime");
-    const tests = await loadEntities(context.prolog, {
-        type: "test",
-        ...(args.testId === undefined ? {} : { id: args.testId }),
-    });
+    // A bulk run pages full entities: receipt histories are exactly what this
+    // maintenance action reads, and loading all of them at once can exceed the
+    // bounded Prolog output capacity on long-lived stores.
+    const tests = args.testId === undefined
+        ? await loadEntitiesPaged(context.prolog, "test")
+        : await loadEntities(context.prolog, { type: "test", id: args.testId });
     if (args.testId !== undefined && tests.length === 0) {
         throw new Error(`Legacy receipt migration failed: test ${args.testId} was not found`);
     }
     const migratedTests = [];
     for (const test of tests) {
         const testId = String(test.id);
-        const hasLegacy = Array.isArray(test.verification_receipts);
+        // The compiled lane only survives in stores compiled by older versions:
+        // current sync does not extract verification_receipts, so the authored
+        // document is the durable carrier of the legacy block. Both signals must
+        // trigger the migration.
+        const hasCompiledLegacy = Array.isArray(test.verification_receipts);
         const hasProofContract = test.proof_contract !== null && typeof test.proof_contract === "object";
-        if (!hasLegacy || !hasProofContract)
+        if (!hasProofContract)
             continue;
         const source = typeof test.source === "string" ? test.source : "";
-        let patchedContent;
-        if (context.fs && source !== "" && /\.(md|mdx)$/i.test(source)) {
-            const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
-            const before = await context.fs.readFile(absolute);
-            patchedContent =
-                removeFrontmatterBlock(before, "verification_receipts") ?? undefined;
-            if (patchedContent === undefined) {
-                throw new Error(`Legacy receipt migration failed for ${testId}: ${source} is not a patchable frontmatter document`);
+        const patchableSource = source !== "" && /\.(md|mdx)$/i.test(source) && context.fs !== undefined;
+        if (!patchableSource) {
+            if (hasCompiledLegacy) {
+                throw new Error(`Legacy receipt migration failed for ${testId}: test source '${source || "unknown"}' is not an authored markdown document`);
             }
+            continue;
         }
-        else {
-            throw new Error(`Legacy receipt migration failed for ${testId}: test source '${source || "unknown"}' is not an authored markdown document`);
+        const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
+        const before = await context.fs.readFile(absolute);
+        const patchedContent = removeFrontmatterBlock(before, "verification_receipts");
+        if (patchedContent === null) {
+            if (hasCompiledLegacy) {
+                throw new Error(`Legacy receipt migration failed for ${testId}: ${source} is not a patchable frontmatter document`);
+            }
+            continue;
         }
         const properties = Object.fromEntries(Object.entries(projectEntityProperties(test)).filter(([key]) => key !== "verification_receipts"));
         // Drop the legacy lane from the compiled entity; proof_receipts stay
         // untouched so append-only validation keeps holding.
-        const upsertOptions = patchedContent === undefined
-            ? {}
-            : { sourceDocumentOverride: patchedContent };
         await executeUpsert({
             type: "test",
             id: testId,
             properties: { ...properties },
-        }, context, upsertOptions);
+        }, context, { sourceDocumentOverride: patchedContent });
         migratedTests.push({ testId });
     }
     const summary = migratedTests.length === 0

package/dist/operations/proof/prune-receipts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prune-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/prune-receipts.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AASjF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,uDAAuD;IAEvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAE7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAEzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAYH;;;;;;;;;GASG;AAEH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,mBAAmB,CAAC;CACxC,CAAC,CAoED"}
+{"version":3,"file":"prune-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/prune-receipts.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AASjF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,uDAAuD;IAEvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAE7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAEzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAYH;;;;;;;;;GASG;AAEH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,mBAAmB,CAAC;CACxC,CAAC,CAuED"}