kibi-cli 2.1.0 → 2.2.0

package/dist/operations/planning/apply-plan.js

@@ -5,14 +5,15 @@ import { OperationError } from "../../cli-errors.js";
 import { branchEnsureCommand, branchMigrateCommand, branchRecoverCommand, } from "../../commands/branch.js";
 import { migrateCommand } from "../../commands/migrate.js";
 import { syncCommand } from "../../commands/sync.js";
+import { loadEntities } from "../../public/operations/discovery-entities.js";
 import { executeStatus } from "../../public/operations/discovery-executors.js";
-import { migrationPlanHash, } from "../../public/operations/migration-plan.js";
+import { PREDICATE_SCHEMA_ALIGNMENT_CODE, migrationPlanHash, } from "../../public/operations/migration-plan.js";
 import { readMigrationConfigStatus } from "../../public/operations/migration-plan.js";
 import { readWorkspaceSnapshot } from "../../public/operations/workspace-snapshot.js";
 import { isDerivedKbPath } from "../../utils/kb-paths.js";
 import { bootstrapEmptyKbSnapshotId, bootstrapPlanHash, } from "../bootstrap/types.js";
 import { executeDelete } from "../mutation/delete.js";
-import { writePendingSourceReceipt } from "../mutation/source-authoring.js";
+import { retirePendingSourceReceipt, writePendingSourceReceipt, } from "../mutation/source-authoring.js";
 import { executeUpsert } from "../mutation/upsert.js";
 import { acquireWorkspaceMutationLock, releaseWorkspaceMutationLock, } from "../mutation/workspace-mutation-lock.js";
 import { compilePlanHash, } from "./compile-intent.js";
@@ -37,6 +38,21 @@ function isRecord(value) {
 function digest(value) {
     return createHash("sha256").update(value).digest("hex");
 }
+/**
+ * Reconcile pending-source receipts with committed source writes: a written
+ * file is bound to its exact bytes until Git tracks it, and a deleted file
+ * must not leave a receipt that later syncs would report as missing.
+ */
+function reconcilePendingSourceReceipts(workspaceRoot, writes) {
+    for (const write of writes) {
+        if ((write.mode ?? "write") === "delete") {
+            retirePendingSourceReceipt(workspaceRoot, write.path);
+        }
+        else if (write.afterHash !== null) {
+            writePendingSourceReceipt(workspaceRoot, write.path, write.afterHash);
+        }
+    }
+}
 function relationships(step) {
     if (!Array.isArray(step.relationships))
         return [];
@@ -356,11 +372,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
                 throw new Error(`MUTATION_ALREADY_COMMITTED: source plan ${planHash} already crossed the authoritative commit boundary; use kb_apply_plan recoveryJournalId=${journalId} instead of retrying the original mutation`);
             }
             onCommitted();
-            for (const entry of prior.entries) {
-                if (entry.mode === "write" && entry.afterHash !== null) {
-                    writePendingSourceReceipt(context.workspaceRoot, entry.path, entry.afterHash);
-                }
-            }
+            reconcilePendingSourceReceipts(context.workspaceRoot, prior.entries);
             return { paths: priorPaths, rollback: async () => undefined, journalId };
         }
     }
@@ -518,11 +530,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
         // A newly authored file is intentionally excluded from ordinary Git
         // discovery until the operator stages it. The receipt binds that pending
         // input to the exact bytes committed by this plan.
-        for (const write of writes) {
-            if ((write.mode ?? "write") === "write" && write.afterHash !== null) {
-                writePendingSourceReceipt(context.workspaceRoot, write.path, write.afterHash);
-            }
-        }
+        reconcilePendingSourceReceipts(context.workspaceRoot, writes);
     }
     catch (error) {
         if (sourceCommitted) {
@@ -609,11 +617,7 @@ async function executeSourceRecovery(args, context, onCommitted = () => undefine
         });
     }
     const sourceWrites = await applySourceWrites(context, writes, journal.planHash, true, onCommitted);
-    for (const write of writes) {
-        if (write.mode === "write" && write.afterHash !== null) {
-            writePendingSourceReceipt(context.workspaceRoot, write.path, write.afterHash);
-        }
-    }
+    reconcilePendingSourceReceipts(context.workspaceRoot, writes);
     const sync = await syncCommand({
         workspaceRoot: context.workspaceRoot,
         rebuild: true,
@@ -1272,6 +1276,7 @@ async function executeApplyPlanUnlocked(args, context, onCommitted = () => undef
         structuredContent: payload,
     };
 }
+// implements REQ-agent-guided-migration-orchestration, REQ-cli-canonical-runtime, REQ-KIBI-BOOTSTRAP-PLAN, REQ-kibi-change-to-proof-plan-compiler, REQ-kibi-predicate-vocabulary-migration
 export async function executeApplyPlan(args, context) {
     if (!context.fs || context.sourceMutationLockHeld === true)
         return executeApplyPlanUnlocked(args, context);
@@ -1508,7 +1513,46 @@ async function applyMigrationAction(action, context) {
                 throw new Error("Coordinate refresh did not complete successfully.");
             return;
         }
+        case PREDICATE_SCHEMA_ALIGNMENT_CODE:
+            await applyPredicateSchemaAlignment(action, context);
+            return;
         default:
             throw new Error(`Migration action '${action.code}' has no automatic executor.`);
     }
 }
+/**
+ * Replay the planned kb_upsert for one predicate fact after confirming the
+ * fact still has the namespace and alias spellings the plan was built from.
+ */
+// implements REQ-kibi-predicate-vocabulary-migration
+async function applyPredicateSchemaAlignment(action, context) {
+    const invocation = action.invocation;
+    if (invocation.kind !== "operation" || invocation.name !== "kb_upsert")
+        throw new Error("Predicate schema alignment requires its planned kb_upsert invocation.");
+    const input = asUpsert(invocation.input);
+    if (input.type !== "fact")
+        throw new Error("Predicate schema alignment only rewrites fact entities.");
+    const prolog = context.prolog ?? (await context.ensureProlog?.());
+    if (!prolog)
+        throw new Error("Predicate schema alignment requires a Prolog runtime.");
+    const operationContext = { ...context, prolog, sourceFirst: true };
+    const [current] = await loadEntities(prolog, { type: "fact", id: input.id });
+    const evidence = action.evidence;
+    const currentNamespace = typeof current?.predicate_namespace === "string" &&
+        current.predicate_namespace !== ""
+        ? current.predicate_namespace
+        : "default";
+    const currentArgs = Array.isArray(current?.predicate_args)
+        ? current.predicate_args
+        : [];
+    const rewrites = Array.isArray(evidence.rewrites) ? evidence.rewrites : [];
+    const unchanged = current !== undefined &&
+        current.fact_kind === "predicate" &&
+        currentNamespace === evidence.namespace &&
+        rewrites.every((rewrite) => isRecord(rewrite) &&
+            typeof rewrite.index === "number" &&
+            currentArgs[rewrite.index] === rewrite.from);
+    if (!unchanged)
+        throw new Error(`Predicate fact ${input.id} changed since planning; rerun kibi check and approve the new plan.`);
+    await executeUpsert(input, operationContext);
+}

package/dist/operations/planning/compile-intent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compile-intent.d.ts","sourceRoot":"","sources":["../../../src/operations/planning/compile-intent.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEpB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,KAAK,EAEV,2BAA2B,EAE5B,MAAM,8BAA8B,CAAC;AAGtC,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AAGpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACzD,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACjD,CAAC,CAAC;AAGH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAGH,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC1D,uBAAuB,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAC3C,CAAC,CAAC;AAGH,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAGzD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACtC,MAAM,CAGR;AAGD,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;KACvD,CAAC;IACF,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAC1B,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,SAAS,EAAE;QACT,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;QACzC,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,YAAY,EAAE,SAAS;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACrC,WAAW,EACP,iBAAiB,GACjB,WAAW,GACX,MAAM,GACN,aAAa,GACb,YAAY,CAAC;QACjB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,CAAC;QAChE,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;KAClC,EAAE,CAAC;IACJ,qBAAqB,EAAE;QACrB,OAAO,EAAE,aAAa,GAAG,UAAU,GAAG,YAAY,CAAC;QACnD,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;KAC5C,CAAC;IACF,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC3B,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IACzC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,QAAQ,CAAC;QAC3B,MAAM,EAAE,SAAS;YACf,QAAQ,EAAE,MAAM,CAAC;YACjB,aAAa,EAAE,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC;YACnB,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,OAAO,CAAC;YAClB,OAAO,EAAE,OAAO,CAAC;YACjB,OAAO,EAAE,OAAO,CAAC;YACjB,YAAY,CAAC,EAAE,OAAO,CAAC;YACvB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,EAAE,CAAC;QACJ,cAAc,EAAE,QAAQ,CAAC;YACvB,YAAY,EAAE,OAAO,CAAC;YACtB,SAAS,EAAE,SAAS;gBAClB,QAAQ,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,CAAC;gBACb,UAAU,EAAE,MAAM,CAAC;aACpB,EAAE,CAAC;YACJ,iBAAiB,EAAE,SAAS;gBAC1B,QAAQ,EAAE,MAAM,CAAC;gBACjB,aAAa,EAAE,MAAM,CAAC;gBACtB,UAAU,EAAE,MAAM,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC;gBACb,QAAQ,EAAE,OAAO,CAAC;gBAClB,OAAO,EAAE,OAAO,CAAC;gBACjB,OAAO,EAAE,OAAO,CAAC;gBACjB,YAAY,CAAC,EAAE,OAAO,CAAC;gBACvB,KAAK,CAAC,EAAE,MAAM,CAAC;gBACf,SAAS,EAAE,SAAS;oBAClB,QAAQ,EAAE,MAAM,CAAC;oBACjB,IAAI,EAAE,MAAM,CAAC;oBACb,UAAU,EAAE,MAAM,CAAC;iBACpB,EAAE,CAAC;aACL,EAAE,CAAC;SACL,CAAC,GAAG,IAAI,CAAC;QACV,QAAQ,EAAE,QAAQ,CAAC;YACjB,QAAQ,EAAE,OAAO,CAAC;YAClB,UAAU,EAAE,MAAM,CAAC;YACnB,gBAAgB,EAAE,MAAM,CAAC;YACzB,aAAa,EAAE,SAAS;gBACtB,MAAM,EAAE,MAAM,CAAC;gBACf,QAAQ,EAAE,MAAM,CAAC;gBACjB,aAAa,EAAE,MAAM,CAAC;gBACtB,UAAU,EAAE,MAAM,CAAC;aACpB,EAAE,CAAC;SACL,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AA0eH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,aAAa,CAAC;CAClC,CAAC,CAyWD"}
+{"version":3,"file":"compile-intent.d.ts","sourceRoot":"","sources":["../../../src/operations/planning/compile-intent.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEpB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,KAAK,EAEV,2BAA2B,EAE5B,MAAM,8BAA8B,CAAC;AAGtC,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AAGpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACzD,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACjD,CAAC,CAAC;AAGH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAGH,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC1D,uBAAuB,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;CACnD,CAAC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAC3C,CAAC,CAAC;AAGH,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAGzD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACtC,MAAM,CAGR;AAGD,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;KACvD,CAAC;IACF,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAC1B,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,SAAS,EAAE;QACT,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;QACzC,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,YAAY,EAAE,SAAS;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACrC,WAAW,EACP,iBAAiB,GACjB,WAAW,GACX,MAAM,GACN,aAAa,GACb,YAAY,CAAC;QACjB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,CAAC;QAChE,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;KAClC,EAAE,CAAC;IACJ,qBAAqB,EAAE;QACrB,OAAO,EAAE,aAAa,GAAG,UAAU,GAAG,YAAY,CAAC;QACnD,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;KAC5C,CAAC;IACF,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC3B,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IACzC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,QAAQ,CAAC;QAC3B,MAAM,EAAE,SAAS;YACf,QAAQ,EAAE,MAAM,CAAC;YACjB,aAAa,EAAE,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC;YACnB,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,OAAO,CAAC;YAClB,OAAO,EAAE,OAAO,CAAC;YACjB,OAAO,EAAE,OAAO,CAAC;YACjB,YAAY,CAAC,EAAE,OAAO,CAAC;YACvB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,EAAE,CAAC;QACJ,cAAc,EAAE,QAAQ,CAAC;YACvB,YAAY,EAAE,OAAO,CAAC;YACtB,SAAS,EAAE,SAAS;gBAClB,QAAQ,EAAE,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAM,CAAC;gBACb,UAAU,EAAE,MAAM,CAAC;aACpB,EAAE,CAAC;YACJ,iBAAiB,EAAE,SAAS;gBAC1B,QAAQ,EAAE,MAAM,CAAC;gBACjB,aAAa,EAAE,MAAM,CAAC;gBACtB,UAAU,EAAE,MAAM,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC;gBACb,QAAQ,EAAE,OAAO,CAAC;gBAClB,OAAO,EAAE,OAAO,CAAC;gBACjB,OAAO,EAAE,OAAO,CAAC;gBACjB,YAAY,CAAC,EAAE,OAAO,CAAC;gBACvB,KAAK,CAAC,EAAE,MAAM,CAAC;gBACf,SAAS,EAAE,SAAS;oBAClB,QAAQ,EAAE,MAAM,CAAC;oBACjB,IAAI,EAAE,MAAM,CAAC;oBACb,UAAU,EAAE,MAAM,CAAC;iBACpB,EAAE,CAAC;aACL,EAAE,CAAC;SACL,CAAC,GAAG,IAAI,CAAC;QACV,QAAQ,EAAE,QAAQ,CAAC;YACjB,QAAQ,EAAE,OAAO,CAAC;YAClB,UAAU,EAAE,MAAM,CAAC;YACnB,gBAAgB,EAAE,MAAM,CAAC;YACzB,aAAa,EAAE,SAAS;gBACtB,MAAM,EAAE,MAAM,CAAC;gBACf,QAAQ,EAAE,MAAM,CAAC;gBACjB,aAAa,EAAE,MAAM,CAAC;gBACtB,UAAU,EAAE,MAAM,CAAC;aACpB,EAAE,CAAC;SACL,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AA0eH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,aAAa,CAAC;CAClC,CAAC,CA4WD"}

package/dist/operations/planning/compile-intent.js

@@ -446,7 +446,9 @@ export async function executeCompileIntent(args, context) {
             diagnostics.push("Update target is unresolved: supply requirementId or improve the top candidate score and margin.");
         }
     }
-    if (args.mode === "create")
+    // A caller-chosen ID names the requirement by what it governs and wins;
+    // the content-hash ID is only a fallback when none is supplied.
+    if (args.mode === "create" && !explicitId)
         requirementId = generatedRequirementId(intent);
     if (!requirementId)
         throw new Error("Compile intent failed: could not determine requirementId");

package/dist/operations/proof/code-scope.d.ts

@@ -0,0 +1,17 @@
+import type { PrologPort } from "../../public/operations/runtime-types.js";
+/**
+ * Which symbols a proof receipt's per-contract binding covers. Receipt ingest
+ * (which writes `binding_hash`) and coverage (which checks it) must derive
+ * the same set, so both go through this module:
+ *
+ * - the contract's required proof symbols (the test's own executable code),
+ * - any symbols the test declares in `proof_bindings`,
+ * - every production symbol linked `covered_by` this test.
+ *
+ * Editing any of those symbols' source files changes the binding hash, so the
+ * receipt goes stale until the test is proven again on the new code.
+ */
+export declare function receiptCodeScopeSymbolIds(contract: unknown, bindings: unknown, coveredBySymbols: readonly string[]): string[];
+/** Map each test id to the symbols linked `covered_by` it, in one query. */
+export declare function loadCoveredBySymbolsByTest(prolog: Pick<PrologPort, "query">): Promise<ReadonlyMap<string, readonly string[]>>;
+//# sourceMappingURL=code-scope.d.ts.map

package/dist/operations/proof/code-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-scope.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/code-scope.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E;;;;;;;;;;;GAWG;AAEH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,MAAM,EAAE,CAoBV;AAED,4EAA4E;AAE5E,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAiBjD"}

package/dist/operations/proof/code-scope.js

@@ -0,0 +1,60 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ */
+import { normalizeEntityId, parseTriples } from "../../prolog/codec.js";
+/**
+ * Which symbols a proof receipt's per-contract binding covers. Receipt ingest
+ * (which writes `binding_hash`) and coverage (which checks it) must derive
+ * the same set, so both go through this module:
+ *
+ * - the contract's required proof symbols (the test's own executable code),
+ * - any symbols the test declares in `proof_bindings`,
+ * - every production symbol linked `covered_by` this test.
+ *
+ * Editing any of those symbols' source files changes the binding hash, so the
+ * receipt goes stale until the test is proven again on the new code.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function receiptCodeScopeSymbolIds(contract, bindings, coveredBySymbols) {
+    const ids = new Set();
+    const requiredProofs = contract !== null &&
+        typeof contract === "object" &&
+        Array.isArray(contract.required_proofs)
+        ? contract.required_proofs
+        : [];
+    for (const entry of [
+        ...requiredProofs,
+        ...(Array.isArray(bindings) ? bindings : []),
+    ]) {
+        const symbolId = entry !== null && typeof entry === "object"
+            ? entry.symbol_id
+            : undefined;
+        if (typeof symbolId === "string" && symbolId !== "")
+            ids.add(symbolId);
+    }
+    for (const symbolId of coveredBySymbols)
+        ids.add(symbolId);
+    return [...ids].sort();
+}
+/** Map each test id to the symbols linked `covered_by` it, in one query. */
+// implements REQ-kibi-verification-evidence-contract
+export async function loadCoveredBySymbolsByTest(prolog) {
+    const result = await prolog.query("findall([From,To,'covered_by'], kb_relationship(covered_by, From, To), Rels)");
+    if (!result.success) {
+        throw new Error(`covered_by relationship query failed: ${result.error ?? "Unknown error"}`);
+    }
+    const byTest = new Map();
+    for (const [rawFrom, rawTo] of parseTriples(result.bindings.Rels ?? "[]")) {
+        const testId = normalizeEntityId(rawTo);
+        const symbols = byTest.get(testId) ?? [];
+        symbols.push(normalizeEntityId(rawFrom));
+        byTest.set(testId, symbols);
+    }
+    return byTest;
+}

package/dist/operations/proof/ingest-proof.d.ts

@@ -24,11 +24,13 @@ export type IngestProofResult = Readonly<{
     unchanged: number;
     results: readonly IngestProofTestResult[];
 }>;
-export declare function executeIngestProof(args: IngestProofArgs, context: OperationContext): Promise<{
+type IngestProofOutput = {
     content: Array<{
         type: "text";
         text: string;
     }>;
     structuredContent: IngestProofResult;
-}>;
+};
+export declare function executeIngestProof(args: IngestProofArgs, context: OperationContext): Promise<IngestProofOutput>;
+export {};
 //# sourceMappingURL=ingest-proof.d.ts.map

package/dist/operations/proof/ingest-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAkBjF,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAUvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAoKH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC,CAgSD"}
+{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAkBjF,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAqBvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC;AAokBF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAuC5B"}

package/dist/operations/proof/ingest-proof.js

@@ -1,5 +1,6 @@
 import { join } from "node:path";
 import { resolveBoundSymbolScope } from "../../extractors/manifest.js";
+import { loadCoveredBySymbolsByTest, receiptCodeScopeSymbolIds, } from "./code-scope.js";
 import { evaluateContractAgainstRun, } from "../../proof/evaluate.js";
 import { loadProofIntegrations, resolveIntegration, toExecution, } from "../../proof/integrations.js";
 import { loadEntities } from "../../public/operations/discovery-entities.js";
@@ -9,8 +10,32 @@ import { PROOF_CONTRACT_VERSION, PROOF_RECEIPT_VERSION, proofBindingsErrors, pro
 import { MAX_PROOF_RECEIPTS, proofReceiptCurrentBindingErrors, proofReceiptHistoryErrors, } from "../../public/proof-receipt.js";
 import { projectEntityProperties } from "../mutation/entity-projection.js";
 import { resolveContainedSourcePath } from "../mutation/source-authoring.js";
+import { buildUpsertBatchCommitGoal, parseUpsertChangeKinds, } from "../mutation/contradictions.js";
 import { executeUpsert } from "../mutation/upsert.js";
+import { acquireWorkspaceMutationLock, releaseWorkspaceMutationLock, } from "../mutation/workspace-mutation-lock.js";
+import { MutationRollbackFailureError } from "../mutation/saga.js";
 import { patchReceiptsIntoDocument, removeFrontmatterBlock, } from "./receipt-document.js";
+async function rollbackUncommittedReceipts(pending, originalError, lifecycle) {
+    const failures = [];
+    for (const entry of pending) {
+        if (entry.deferred.state === "committed")
+            continue;
+        try {
+            const rollbackFailures = await entry.deferred.rollback();
+            for (const failure of rollbackFailures) {
+                failures.push({ testId: entry.testId, ...failure });
+            }
+        }
+        catch (error) {
+            failures.push({ testId: entry.testId, step: "rollback", error });
+        }
+    }
+    if (failures.length > 0) {
+        lifecycle?.onRollbackFailure?.();
+        throw new AggregateError([originalError, ...failures.map((failure) => failure.error)], `Proof ingest failed and could not restore every uncommitted receipt source; the source mutation lock remains held for recovery (${failures.map(({ testId, step }) => `${testId}:${step}`).join(", ")})`);
+    }
+    throw originalError;
+}
 function text(value) {
     return typeof value === "string" ? value.trim() : "";
 }
@@ -120,7 +145,7 @@ function existingReceipts(test) {
         : [];
 }
 // implements REQ-kibi-verification-evidence-contract
-export async function executeIngestProof(args, context) {
+async function executeIngestProofUnlocked(args, context, lifecycle) {
     if (!context.prolog)
         throw new Error("Proof ingest requires a Prolog runtime");
     const snapshot = requiredString(args.snapshot, "snapshot");
@@ -162,18 +187,37 @@ export async function executeIngestProof(args, context) {
         }
     }
     else {
-        const all = await loadEntities(context.prolog, { type: "test" });
-        for (const test of all) {
-            const contract = record(test.proof_contract);
-            if (contract &&
-                contract.version === PROOF_CONTRACT_VERSION &&
-                text(contract.integration) === integrationId) {
-                tests.push(test);
+        // Select candidates from the paged contract projection (no receipt
+        // histories), then load each matching test in full: the append-only
+        // receipt update needs that test's existing history, but never every
+        // test's history in a single Prolog answer.
+        const candidates = await loadEntities(context.prolog, {
+            type: "test",
+            projection: "proof_contract",
+        });
+        for (const candidate of candidates) {
+            const contract = record(candidate.proof_contract);
+            if (!contract ||
+                contract.version !== PROOF_CONTRACT_VERSION ||
+                text(contract.integration) !== integrationId) {
+                continue;
             }
+            const testId = String(candidate.id);
+            const found = await loadEntities(context.prolog, {
+                id: testId,
+                type: "test",
+            });
+            const test = found[0];
+            if (!test)
+                throw new Error(`Proof ingest failed: test ${testId} was not found`);
+            tests.push(test);
         }
         if (tests.length === 0)
             throw new Error(`Proof ingest failed: no tests declare proof_contract.integration '${integrationId}'`);
     }
+    // Loaded outside the per-test binding try/catch: an engine failure must fail
+    // the ingest, not silently write receipts without a binding hash.
+    const coveredBy = await loadCoveredBySymbolsByTest(context.prolog);
     const prepared = [];
     for (const test of tests) {
         const testId = String(test.id);
@@ -207,7 +251,7 @@ export async function executeIngestProof(args, context) {
                 const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
                 const authored = await context.fs.readFile(absolute);
                 const stripped = removeFrontmatterBlock(authored, "proof_receipts");
-                const codeScope = resolveBoundSymbolScope(join(context.workspaceRoot, ".kb", "symbols.yaml"), bindings.map((binding) => binding.symbol_id));
+                const codeScope = resolveBoundSymbolScope(join(context.workspaceRoot, ".kb", "symbols.yaml"), receiptCodeScopeSymbolIds(contract, bindings, coveredBy.get(testId) ?? []));
                 bindingHash = receiptBindingHash(contract, stripped ?? authored, codeScope);
             }
             catch {
@@ -253,82 +297,138 @@ export async function executeIngestProof(args, context) {
         });
     }
     const results = [];
+    const pendingCommits = [];
     let passed = 0;
     let failed = 0;
     let unchanged = 0;
-    for (const entry of prepared) {
-        const { testId, test, contract, evaluation, receipt, existing } = entry;
-        // Idempotent re-ingestion: the same artifact against the same effective
-        // contract+fingerprint derives the same receipt id and must not re-append.
-        if (existing.some((row) => row.receipt_id === receipt.receipt_id)) {
-            unchanged += 1;
-            if (receipt.outcome === "passed")
-                passed += 1;
-            else
-                failed += 1;
-            results.push({
+    try {
+        for (const entry of prepared) {
+            const { testId, test, contract, evaluation, receipt, existing } = entry;
+            // Idempotent re-ingestion: the same artifact against the same effective
+            // contract+fingerprint derives the same receipt id and must not re-append.
+            if (existing.some((row) => row.receipt_id === receipt.receipt_id)) {
+                unchanged += 1;
+                if (receipt.outcome === "passed")
+                    passed += 1;
+                else
+                    failed += 1;
+                results.push({
+                    testId,
+                    outcome: receipt.outcome,
+                    receiptId: receipt.receipt_id,
+                    applied: false,
+                    duplicate: true,
+                    receiptCount: existing.length,
+                    gaps: evaluation.gaps,
+                });
+                continue;
+            }
+            const nextReceipts = [
+                ...existing,
+                receipt,
+            ].slice(-MAX_PROOF_RECEIPTS);
+            const historyErrors = proofReceiptHistoryErrors(testId, test.verification_scope, nextReceipts);
+            const bindingErrors = proofReceiptCurrentBindingErrors(testId, test.verification_scope, receipt, contract, receipt.fingerprint);
+            const receiptErrors = [...historyErrors, ...bindingErrors];
+            if (receiptErrors.length > 0)
+                throw new Error(`Proof ingest failed for ${testId}: ${receiptErrors.join("; ")}`);
+            const properties = projectEntityProperties(test);
+            properties.proof_receipts = undefined;
+            // Surgical receipt append: splice only the proof_receipts block into the
+            // authored document so unrelated frontmatter keeps its authored form.
+            // Canonical re-rendering here would change non-receipt bytes, shift the
+            // workspace snapshot hash mid-campaign, and make later integrations in
+            // the same `kibi prove --all` refuse with "changed the tracked
+            // workspace". Falls back to the canonical render when the document is
+            // not a patchable markdown file.
+            let sourceDocumentOverride;
+            const source = typeof test.source === "string" ? test.source : "";
+            if (context.fs && source !== "" && /\.(md|mdx)$/i.test(source)) {
+                try {
+                    const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
+                    const before = await context.fs.readFile(absolute);
+                    sourceDocumentOverride =
+                        patchReceiptsIntoDocument(before, nextReceipts) ?? undefined;
+                }
+                catch {
+                    sourceDocumentOverride = undefined;
+                }
+            }
+            // exactOptionalPropertyTypes: only pass the override when one exists.
+            const upsertOptions = {
+                deferCompiledCommit: true,
+                ...(sourceDocumentOverride === undefined
+                    ? {}
+                    : { sourceDocumentOverride }),
+            };
+            const upsert = await executeUpsert({
+                type: "test",
+                id: testId,
+                properties: { ...properties, proof_receipts: nextReceipts },
+            }, context, upsertOptions);
+            const deferred = upsert.structuredContent?.deferredCommit;
+            if (!deferred) {
+                throw new Error(`Proof ingest failed for ${testId}: receipt commit was not prepared`);
+            }
+            pendingCommits.push({
                 testId,
                 outcome: receipt.outcome,
                 receiptId: receipt.receipt_id,
-                applied: false,
-                duplicate: true,
-                receiptCount: existing.length,
+                receiptCount: nextReceipts.length,
                 gaps: evaluation.gaps,
+                deferred,
             });
-            continue;
         }
-        const nextReceipts = [
-            ...existing,
-            receipt,
-        ].slice(-MAX_PROOF_RECEIPTS);
-        const historyErrors = proofReceiptHistoryErrors(testId, test.verification_scope, nextReceipts);
-        const bindingErrors = proofReceiptCurrentBindingErrors(testId, test.verification_scope, receipt, contract, receipt.fingerprint);
-        const receiptErrors = [...historyErrors, ...bindingErrors];
-        if (receiptErrors.length > 0)
-            throw new Error(`Proof ingest failed for ${testId}: ${receiptErrors.join("; ")}`);
-        const properties = projectEntityProperties(test);
-        properties.proof_receipts = undefined;
-        // Surgical receipt append: splice only the proof_receipts block into the
-        // authored document so unrelated frontmatter keeps its authored form.
-        // Canonical re-rendering here would change non-receipt bytes, shift the
-        // workspace snapshot hash mid-campaign, and make later integrations in
-        // the same `kibi prove --all` refuse with "changed the tracked
-        // workspace". Falls back to the canonical render when the document is
-        // not a patchable markdown file.
-        let sourceDocumentOverride;
-        const source = typeof test.source === "string" ? test.source : "";
-        if (context.fs && source !== "" && /\.(md|mdx)$/i.test(source)) {
-            try {
-                const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
-                const before = await context.fs.readFile(absolute);
-                sourceDocumentOverride =
-                    patchReceiptsIntoDocument(before, nextReceipts) ?? undefined;
-            }
-            catch {
-                sourceDocumentOverride = undefined;
+    }
+    catch (error) {
+        if (error instanceof MutationRollbackFailureError) {
+            lifecycle?.onRollbackFailure?.();
+        }
+        await rollbackUncommittedReceipts(pendingCommits, error, lifecycle);
+    }
+    const prolog = context.prolog;
+    if (!prolog)
+        throw new Error("Proof ingest failed: Prolog runtime is unavailable");
+    const batchSize = 25;
+    for (let offset = 0; offset < pendingCommits.length; offset += batchSize) {
+        const batch = pendingCommits.slice(offset, offset + batchSize);
+        let written;
+        try {
+            written = await prolog.query(buildUpsertBatchCommitGoal(batch.map((entry) => ({
+                entity: entry.deferred.entity,
+                relationships: entry.deferred.relationships,
+                skipContradictionCheck: entry.deferred.skipContradictionCheck,
+            }))));
+            if (!written.success) {
+                throw new Error(written.error || "batch commit failed");
             }
+            // Prolog success is the irreversible commit boundary. Finalize this
+            // batch before parsing auxiliary metadata or doing more work, so later
+            // failures can only roll back still-prepared source writes.
+            for (const entry of batch)
+                entry.deferred.finalize();
+            lifecycle?.onBatchCommitted?.();
+            prolog.invalidateCache?.();
+            parseUpsertChangeKinds(written.bindings, batch.length);
+        }
+        catch (error) {
+            await rollbackUncommittedReceipts(pendingCommits, error, lifecycle);
+        }
+        for (const entry of batch) {
+            if (entry.outcome === "passed")
+                passed += 1;
+            else
+                failed += 1;
+            results.push({
+                testId: entry.testId,
+                outcome: entry.outcome,
+                receiptId: entry.receiptId,
+                applied: true,
+                duplicate: false,
+                receiptCount: entry.receiptCount,
+                gaps: entry.gaps,
+            });
         }
-        // exactOptionalPropertyTypes: only pass the override when one exists.
-        const upsertOptions = sourceDocumentOverride === undefined ? {} : { sourceDocumentOverride };
-        const upsert = await executeUpsert({
-            type: "test",
-            id: testId,
-            properties: { ...properties, proof_receipts: nextReceipts },
-        }, context, upsertOptions);
-        void upsert;
-        if (receipt.outcome === "passed")
-            passed += 1;
-        else
-            failed += 1;
-        results.push({
-            testId,
-            outcome: receipt.outcome,
-            receiptId: receipt.receipt_id,
-            applied: true,
-            duplicate: false,
-            receiptCount: nextReceipts.length,
-            gaps: evaluation.gaps,
-        });
     }
     const summary = passed > 0
         ? `Proved ${passed} test(s)${failed > 0 ? `, ${failed} failed` : ""}${unchanged > 0 ? `, ${unchanged} unchanged` : ""}.`
@@ -346,3 +446,36 @@ export async function executeIngestProof(args, context) {
         },
     };
 }
+export async function executeIngestProof(args, context) {
+    if (!context.fs ||
+        context.sourceFirst === false ||
+        context.sourceMutationLockHeld === true) {
+        return executeIngestProofUnlocked(args, context);
+    }
+    const lock = await acquireWorkspaceMutationLock(context.workspaceRoot);
+    let operationFailure;
+    let committed = false;
+    let releaseSafe = true;
+    try {
+        return await executeIngestProofUnlocked(args, { ...context, sourceMutationLockHeld: true }, {
+            onBatchCommitted: () => {
+                committed = true;
+            },
+            onRollbackFailure: () => {
+                releaseSafe = false;
+            },
+        });
+    }
+    catch (error) {
+        operationFailure = { error };
+        throw error;
+    }
+    finally {
+        // A failed compensation must leave the cooperative lock fail-closed. The
+        // next writer will require verified recovery rather than observing a
+        // partially restored set of receipt documents.
+        if (releaseSafe) {
+            releaseWorkspaceMutationLock(lock, operationFailure, committed);
+        }
+    }
+}

package/dist/operations/proof/migrate-legacy-receipts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-legacy-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/migrate-legacy-receipts.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAOjF,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,yCAAyC;IAEzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAEjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AAEH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,2BAA2B,CAAC;CAChD,CAAC,CAkFD"}
+{"version":3,"file":"migrate-legacy-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/migrate-legacy-receipts.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAOjF,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,yCAAyC;IAEzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAEjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AAEH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,2BAA2B,CAAC;CAChD,CAAC,CAqFD"}