kibi-cli 2.1.0 → 2.3.0

package/dist/utils/git-repository-context.js

@@ -0,0 +1,259 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+import { execFileSync } from "node:child_process";
+import { lstatSync } from "node:fs";
+import * as path from "node:path";
+// `git rev-parse --path-format=absolute` requires git 2.31 (2021-03). Older
+// git returns cwd-relative paths for --git-dir/--git-common-dir/--git-path,
+// which are resolved against the caller's cwd below.
+const PATH_FORMAT_MINIMUM = { major: 2, minor: 31 };
+// Git's generic absence answer also covers directories it cannot read (an
+// unreadable `.git` yields the same "not a git repository" fatal). Only an
+// explicit absence diagnostic may classify a directory as standalone.
+const NOT_A_REPOSITORY_RE = /not a (git )?repository/i;
+/**
+ * Environment for diagnostic-parsing Git subprocesses: failure classification
+ * matches English diagnostics, so the child locale is pinned to C while every
+ * other environment value (and Git configuration) is preserved. The parent
+ * process's locale is never mutated.
+ */
+function gitEnv() {
+    return { ...process.env, LC_ALL: "C", LANG: "C" };
+}
+function runGitChecked(cwd, args) {
+    try {
+        return {
+            output: execFileSync("git", args, {
+                cwd,
+                encoding: "utf8",
+                env: gitEnv(),
+                stdio: ["ignore", "pipe", "pipe"],
+                timeout: 10_000,
+                maxBuffer: 1024 * 1024,
+            }).trim(),
+            failure: null,
+        };
+    }
+    catch (error) {
+        const stderr = error.stderr;
+        const text = typeof stderr === "string" ? stderr : stderr?.toString("utf8");
+        const firstLine = text
+            ?.split("\n")
+            .map((line) => line.trim())
+            .find(Boolean) ?? null;
+        return { output: null, failure: firstLine };
+    }
+}
+function runGit(cwd, args) {
+    return runGitChecked(cwd, args).output;
+}
+/**
+ * Decide whether a failed repository probe means the directory genuinely has
+ * no repository (standalone fallback is allowed) or Git refused for an
+ * operational reason (dubious ownership, access, timeouts, anything
+ * unrecognized) where callers must refuse before writing.
+ */
+function classifyGitFailure(failure) {
+    if (failure !== null && NOT_A_REPOSITORY_RE.test(failure)) {
+        return "not-a-repository";
+    }
+    return "refused";
+}
+/**
+ * On Git's absence answer, find the nearest `.git` entry (file, directory, or
+ * symlink) at or above `start`. Git reports the same generic "not a git
+ * repository" fatal for entries it cannot fully read (restricted permissions
+ * on objects/refs/HEAD, ownership checks) as for true absence, so a present
+ * marker means the context is unresolved: callers must conservatively refuse
+ * with the marker instead of treating the directory as standalone. Null means
+ * no marker exists up to the filesystem root: the directory genuinely has no
+ * repository and standalone handling is legitimate.
+ */
+function findRepositoryMarker(start) {
+    let current = path.resolve(start);
+    for (;;) {
+        const entry = path.join(current, ".git");
+        try {
+            lstatSync(entry);
+            return entry;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "EACCES" || code === "EPERM") {
+                // The entry cannot even be inspected: treat it as present.
+                return entry;
+            }
+            // ENOENT and friends: no entry at this level; keep walking.
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+function parseGitVersion(versionOutput) {
+    const match = /^git version (\d+)\.(\d+)(\.\d+)?/.exec(versionOutput);
+    if (!match)
+        return null;
+    return { major: Number(match[1]), minor: Number(match[2]) };
+}
+function resolveAgainstCwd(candidate, cwd) {
+    return path.isAbsolute(candidate) ? candidate : path.resolve(cwd, candidate);
+}
+/**
+ * Resolve the effective Git repository context for `cwd` by asking Git
+ * instead of assuming `<cwd>/.git`. The result distinguishes "no repository"
+ * (callers may fall back to standalone-workspace behavior) from repositories
+ * Kibi must not touch (bare repositories) and directories where Git refused
+ * operationally (dubious ownership, unreadable `.git`, access failures) — the
+ * last must never be mistaken for "no repository", because that would send
+ * callers into standalone workspace writes.
+ *
+ * implements REQ-git-hook-effective-install
+ */
+export function resolveGitRepository(cwd = process.cwd()) {
+    const versionProbe = runGitChecked(cwd, ["--version"]);
+    if (versionProbe.output === null) {
+        const marker = findRepositoryMarker(cwd);
+        if (marker !== null) {
+            return {
+                status: "git-refused",
+                reason: `Git is unavailable, but a .git entry exists at ${marker}; refusing to guess.`,
+            };
+        }
+        return { status: "git-unavailable" };
+    }
+    const toplevel = runGitChecked(cwd, ["rev-parse", "--show-toplevel"]);
+    if (toplevel.output === null) {
+        // A bare repository has no working tree (--show-toplevel fails) but is
+        // still a repository; treat it as unsupported instead of "no repository"
+        // so callers refuse to write workspace state into it.
+        const gitDirProbe = runGitChecked(cwd, ["rev-parse", "--git-dir"]);
+        if (gitDirProbe.output !== null) {
+            return {
+                status: "unsupported",
+                reason: "Bare repository: no working tree to attach Kibi to.",
+            };
+        }
+        if (classifyGitFailure(toplevel.failure) === "not-a-repository") {
+            // Git's absence answer also fires when a `.git` entry exists but some
+            // of its internals (objects, refs, HEAD) are unreadable; conservatively
+            // refuse with the marker instead of a standalone-directory verdict.
+            const marker = findRepositoryMarker(cwd);
+            if (marker !== null) {
+                return {
+                    status: "git-refused",
+                    reason: `Git reported no repository, but a .git entry exists at ${marker} (${toplevel.failure ?? "git produced no diagnostic output"}); refusing to guess.`,
+                };
+            }
+            return { status: "not-a-repository" };
+        }
+        return {
+            status: "git-refused",
+            reason: `Git refused to inspect this directory: ${toplevel.failure ??
+                gitDirProbe.failure ??
+                "git produced no diagnostic output"}`,
+        };
+    }
+    const version = parseGitVersion(versionProbe.output);
+    const absolute = version !== null &&
+        (version.major > PATH_FORMAT_MINIMUM.major ||
+            (version.major === PATH_FORMAT_MINIMUM.major &&
+                version.minor >= PATH_FORMAT_MINIMUM.minor));
+    const formatArgs = absolute ? ["--path-format=absolute"] : [];
+    const gitDirRaw = runGitChecked(cwd, [
+        "rev-parse",
+        ...formatArgs,
+        "--git-dir",
+    ]);
+    const commonGitDirRaw = runGitChecked(cwd, [
+        "rev-parse",
+        ...formatArgs,
+        "--git-common-dir",
+    ]);
+    const hooksDirRaw = runGitChecked(cwd, [
+        "rev-parse",
+        ...formatArgs,
+        "--git-path",
+        "hooks",
+    ]);
+    if (gitDirRaw.output === null ||
+        commonGitDirRaw.output === null ||
+        hooksDirRaw.output === null) {
+        const detail = gitDirRaw.failure ??
+            commonGitDirRaw.failure ??
+            hooksDirRaw.failure ??
+            "git produced no diagnostic output";
+        return {
+            status: "git-refused",
+            reason: `Git refused to report its directory layout for this repository: ${detail}`,
+        };
+    }
+    // Without --path-format the outputs above are relative to cwd (or absolute
+    // for linked-worktree git dirs); normalize everything against cwd.
+    const worktreeRoot = toplevel.output;
+    const gitDir = resolveAgainstCwd(gitDirRaw.output, cwd);
+    const commonGitDir = resolveAgainstCwd(commonGitDirRaw.output, cwd);
+    const effectiveHooksDir = resolveAgainstCwd(hooksDirRaw.output, cwd);
+    const originLine = runGit(cwd, [
+        "config",
+        "--show-origin",
+        "--get",
+        "core.hooksPath",
+    ]);
+    let hooksPathConfig = null;
+    let hooksPathOrigin = null;
+    if (originLine) {
+        const separator = originLine.lastIndexOf("\t");
+        if (separator >= 0) {
+            hooksPathOrigin = originLine.slice(0, separator).trim();
+            hooksPathConfig = originLine.slice(separator + 1).trim();
+        }
+        else {
+            hooksPathConfig = originLine.trim();
+        }
+    }
+    const isLinkedWorktree = gitDir !== commonGitDir;
+    let primaryWorktreeRoot = null;
+    if (path.basename(commonGitDir) === ".git") {
+        const candidate = path.dirname(commonGitDir);
+        // Validate the candidate as a real checkout: a linked worktree of a bare
+        // repository also has commonDir `<bare>/.git`, and dirname of that is the
+        // bare holder directory, not a checkout.
+        const candidateToplevel = runGit(candidate, [
+            "rev-parse",
+            "--show-toplevel",
+        ]);
+        if (candidateToplevel === candidate) {
+            primaryWorktreeRoot = candidate;
+        }
+    }
+    return {
+        status: "ok",
+        context: {
+            worktreeRoot,
+            gitDir,
+            commonGitDir,
+            effectiveHooksDir,
+            isLinkedWorktree,
+            primaryWorktreeRoot,
+            hooksPathConfig,
+            hooksPathOrigin,
+        },
+    };
+}

package/dist/utils/rule-registry.d.ts

@@ -21,6 +21,11 @@ export interface RuleDefinition {
     /** Kibi-owned role of this rule in the enforcement contract. */
     enforcementClass: RuleEnforcementClass;
     category: "coverage" | "integrity" | "lifecycle" | "traceability";
+    /**
+     * Severity for non-canonical findings rendered as quality diagnostics.
+     * Omitted means "warning"; "info" marks purely informational signals.
+     */
+    diagnosticSeverity?: "warning" | "info";
 }
 /** A single KB check violation. */
 export interface Violation {

package/dist/utils/rule-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule-registry.d.ts","sourceRoot":"","sources":["../../src/utils/rule-registry.ts"],"names":[],"mappings":"AAgCA,MAAM,MAAM,oBAAoB;AAC9B;;;;GAIG;AACD,WAAW;AACb;;;GAGG;GACD,UAAU;AACZ;;;GAGG;GACD,WAAW,CAAC;AAEhB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,QAAQ,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;CACnE;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,sEAAsE;AACtE,eAAO,MAAM,KAAK,EAAE,SAAS,cAAc,EAAoB,CAAC;AAIhE;;GAEG;AACH,eAAO,MAAM,UAAU,aAAoC,CAAC;AAE5D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1E;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX,oBAAoB,GAAG,SAAS,CAElC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,gBAAgB,EAAE,oBAAoB,GACrC,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,GAAG,CAAC,MAAM,CAAC,CAM7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,CAAC,CAM/C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AAEH,wBAAgB,iBAAiB,CAC/B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,GAAG,CAAC,MAAM,CAAC,CAOb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D"}
+{"version":3,"file":"rule-registry.d.ts","sourceRoot":"","sources":["../../src/utils/rule-registry.ts"],"names":[],"mappings":"AAgCA,MAAM,MAAM,oBAAoB;AAC9B;;;;GAIG;AACD,WAAW;AACb;;;GAGG;GACD,UAAU;AACZ;;;GAGG;GACD,WAAW,CAAC;AAEhB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,QAAQ,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;IAClE;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CACzC;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,sEAAsE;AACtE,eAAO,MAAM,KAAK,EAAE,SAAS,cAAc,EAAoB,CAAC;AAIhE;;GAEG;AACH,eAAO,MAAM,UAAU,aAAoC,CAAC;AAE5D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1E;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX,oBAAoB,GAAG,SAAS,CAElC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,gBAAgB,EAAE,oBAAoB,GACrC,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,GAAG,CAAC,MAAM,CAAC,CAM7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,CAAC,CAM/C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;GAQG;AAEH,wBAAgB,iBAAiB,CAC/B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,GAAG,CAAC,MAAM,CAAC,CAOb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D"}

package/dist/utils/rule-registry.generated.d.ts

@@ -98,5 +98,42 @@ export declare const GENERATED_RULES: readonly [{
     readonly description: "Detect unresolved required_proofs.symbol_id values, type-shape required proofs, and proof_bindings.source_file disagreement with the named symbol sourceFile";
     readonly enforcementClass: "advisory";
     readonly category: "integrity";
+}, {
+    readonly name: "entity-id-style";
+    readonly description: "Entity IDs name the governed behavior and match their filename stem; new purely numeric IDs are reported at creation boundaries";
+    readonly enforcementClass: "advisory";
+    readonly category: "lifecycle";
+}, {
+    readonly name: "domain-redundancy";
+    readonly description: "Two current requirements must not ground the identical logical term or share a ground fact unless linked by supersedes or restates";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+}, {
+    readonly name: "domain-implication";
+    readonly description: "Informational: one requirement's numeric bound strictly implies another requirement's bound on the same subject and property";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+    readonly diagnosticSeverity: "info";
+}, {
+    readonly name: "subject-key-identity";
+    readonly description: "Subject keys must name a shared component, not be derived from a requirement ID";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+}, {
+    readonly name: "subject-key-shape";
+    readonly description: "Subject keys follow dotted component.aspect[.sub] with lowercase snake segments";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+}, {
+    readonly name: "ontology-quality";
+    readonly description: "Informational: predicate schemas whose argument values mostly occur in only one fact are carrying prose instead of a shared vocabulary";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
+    readonly diagnosticSeverity: "info";
+}, {
+    readonly name: "predicate-schema-conformance";
+    readonly description: "Predicate facts match a predicate_schema (project-local, or the built-in catalog in the default namespace) and use its declared argument constants";
+    readonly enforcementClass: "advisory";
+    readonly category: "integrity";
 }];
 //# sourceMappingURL=rule-registry.generated.d.ts.map

package/dist/utils/rule-registry.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule-registry.generated.d.ts","sourceRoot":"","sources":["../../src/utils/rule-registry.generated.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0IlB,CAAC"}
+{"version":3,"file":"rule-registry.generated.d.ts","sourceRoot":"","sources":["../../src/utils/rule-registry.generated.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6LlB,CAAC"}

package/dist/utils/rule-registry.generated.js

@@ -128,4 +128,48 @@ export const GENERATED_RULES = [
         enforcementClass: "advisory",
         category: "integrity",
     },
+    {
+        name: "entity-id-style",
+        description: "Entity IDs name the governed behavior and match their filename stem; new purely numeric IDs are reported at creation boundaries",
+        enforcementClass: "advisory",
+        category: "lifecycle",
+    },
+    {
+        name: "domain-redundancy",
+        description: "Two current requirements must not ground the identical logical term or share a ground fact unless linked by supersedes or restates",
+        enforcementClass: "advisory",
+        category: "integrity",
+    },
+    {
+        name: "domain-implication",
+        description: "Informational: one requirement's numeric bound strictly implies another requirement's bound on the same subject and property",
+        enforcementClass: "advisory",
+        category: "integrity",
+        diagnosticSeverity: "info",
+    },
+    {
+        name: "subject-key-identity",
+        description: "Subject keys must name a shared component, not be derived from a requirement ID",
+        enforcementClass: "advisory",
+        category: "integrity",
+    },
+    {
+        name: "subject-key-shape",
+        description: "Subject keys follow dotted component.aspect[.sub] with lowercase snake segments",
+        enforcementClass: "advisory",
+        category: "integrity",
+    },
+    {
+        name: "ontology-quality",
+        description: "Informational: predicate schemas whose argument values mostly occur in only one fact are carrying prose instead of a shared vocabulary",
+        enforcementClass: "advisory",
+        category: "integrity",
+        diagnosticSeverity: "info",
+    },
+    {
+        name: "predicate-schema-conformance",
+        description: "Predicate facts match a predicate_schema (project-local, or the built-in catalog in the default namespace) and use its declared argument constants",
+        enforcementClass: "advisory",
+        category: "integrity",
+    },
 ];

package/dist/utils/strict-modeling.d.ts

@@ -52,6 +52,13 @@ interface ObservationWriteSet {
 }
 export type StrictWriteSet = StrictRequirementWriteSet | ObservationWriteSet;
 export declare function normalizeSubjectKey(value: string): string;
+/**
+ * Subject-key convention checked by `subject-key-shape`: dotted
+ * component.aspect[.sub] with lowercase snake segments. Mirrors
+ * valid_subject_key/1 in packages/core/src/semantic_quality.pl.
+ */
+export declare const SUBJECT_KEY_CONVENTION: RegExp;
+export declare function isConventionalSubjectKey(value: string): boolean;
 export declare function normalizePropertyKey(value: string): string;
 export declare function buildStableRequirementIds(claim: SemanticClaim): StableRequirementIds;
 export declare function buildStrictWriteSet(input: StrictModelInput): StrictWriteSet;

package/dist/utils/strict-modeling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strict-modeling.d.ts","sourceRoot":"","sources":["../../src/utils/strict-modeling.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAKlE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IAC7D,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,KAAK,gBAAgB,GAAG,OAAO,CAC7B,IAAI,CAAC,UAAU,EAAE,YAAY,GAAG,YAAY,CAAC,GAAG,UAAU,CAC3D,GAAG;IACF,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,WAAW,UAAU,CACzB,KAAK,SAAS,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,EAC7C,WAAW,SAAS,gBAAgB,GAAG,gBAAgB;IAEvD,IAAI,EAAE,KAAK,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,WAAW,CAAC;CACzB;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,gBAAgB,EAChB,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,YAAY,CACjD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACvB,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,mBAAmB;IAC3B,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,QAAQ,EAAE,KAAK,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,cAAc,GAAG,yBAAyB,GAAG,mBAAmB,CAAC;AAE7E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBzD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,aAAa,GACnB,oBAAoB,CAwBtB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc,CAsH3E;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACtC,cAAc,EAAE,CAkBlB;AAiDD,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GACb,MAAM,CAMR"}
+{"version":3,"file":"strict-modeling.d.ts","sourceRoot":"","sources":["../../src/utils/strict-modeling.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAKlE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IAC7D,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,KAAK,gBAAgB,GAAG,OAAO,CAC7B,IAAI,CAAC,UAAU,EAAE,YAAY,GAAG,YAAY,CAAC,GAAG,UAAU,CAC3D,GAAG;IACF,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,WAAW,UAAU,CACzB,KAAK,SAAS,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,EAC7C,WAAW,SAAS,gBAAgB,GAAG,gBAAgB;IAEvD,IAAI,EAAE,KAAK,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,WAAW,CAAC;CACzB;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,gBAAgB,EAChB,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,YAAY,CACjD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACvB,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,mBAAmB;IAC3B,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,QAAQ,EAAE,KAAK,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,cAAc,GAAG,yBAAyB,GAAG,mBAAmB,CAAC;AAE7E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBzD;AAED;;;;GAIG;AAEH,eAAO,MAAM,sBAAsB,QACoC,CAAC;AAGxE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,aAAa,GACnB,oBAAoB,CAwBtB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc,CAsH3E;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACtC,cAAc,EAAE,CAkBlB;AAiDD,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GACb,MAAM,CAMR"}

package/dist/utils/strict-modeling.js

@@ -33,6 +33,17 @@ export function normalizeSubjectKey(value) {
     }
     return normalized;
 }
+/**
+ * Subject-key convention checked by `subject-key-shape`: dotted
+ * component.aspect[.sub] with lowercase snake segments. Mirrors
+ * valid_subject_key/1 in packages/core/src/semantic_quality.pl.
+ */
+// implements REQ-kibi-subject-vocabulary
+export const SUBJECT_KEY_CONVENTION = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)*(?:\.[a-z][a-z0-9]*(?:_[a-z0-9]+)*)+$/;
+// implements REQ-kibi-subject-vocabulary
+export function isConventionalSubjectKey(value) {
+    return SUBJECT_KEY_CONVENTION.test(value);
+}
 export function normalizePropertyKey(value) {
     const normalized = value
         .trim()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kibi-cli",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "type": "module",
   "description": "Kibi CLI for knowledge base management",
   "engines": {
@@ -10,7 +10,15 @@
   "bin": {
     "kibi": "bin/kibi"
   },
-  "files": ["dist", "bin", "schema", "src/schemas", "src/public", "templates"],
+  "files": [
+    "dist",
+    "bin",
+    "schema",
+    "src/schemas",
+    "src/public",
+    "src/traceability/*.schema.json",
+    "templates"
+  ],
   "scripts": {
     "build": "tsc -p tsconfig.json && rm -rf dist/public/skills && mkdir -p dist/public/skills dist/report && cp -r src/public/skills/. dist/public/skills/ && cp src/report/html-report.css dist/report/html-report.css && node ../../scripts/generate-entity-schema.mjs --check",
     "test": "node ../../scripts/run-owned-engine-tests.mjs -- bun test --timeout 15000 .",
@@ -227,9 +235,10 @@
     "fast-glob": "^3.2.12",
     "gray-matter": "^4.0.3",
     "js-yaml": "^4.1.0",
-    "kibi-core": "^0.13.0",
-    "kibi-plugin-builtin": "^0.2.0",
-    "kibi-plugin-sdk": "^0.2.0",
+    "kibi-core": "^0.14.1",
+    "kibi-plugin-builtin": "^0.4.0",
+    "kibi-plugin-sdk": "^0.4.0",
+    "kibi-swipl": "^1.0.0",
     "saxes": "^6.0.0",
     "ignore": "^5.3.0",
     "yaml": "^2.9.0"

package/schema/entities.pl

@@ -3,6 +3,7 @@
 :- module(kibi_entities, [entity_type/1, entity_property/3, required_property/2, optional_property/2]).
 
 % Entity types
+% implements REQ-004
 entity_type(req).
 entity_type(scenario).
 entity_type(test).
@@ -20,7 +21,6 @@ entity_property(_, status, atom).
 entity_property(_, created_at, datetime).
 entity_property(_, updated_at, datetime).
 entity_property(_, source, uri).
-entity_property(_, sourceFile, uri).
 
 % Optional properties
 entity_property(_, tags, list).
@@ -29,6 +29,16 @@ entity_property(_, priority, atom).
 entity_property(_, severity, atom).
 entity_property(_, links, list).
 entity_property(_, text_ref, uri).
+entity_property(_, sourceFile, uri).
+entity_property(req, semantic_text, string).
+entity_property(req, logic_claims, list).
+entity_property(req, semantic_clauses, list).
+entity_property(req, semantic_inventory_version, string).
+entity_property(req, semantic_source_field, string).
+entity_property(req, semantic_source_hash, string).
+entity_property(req, semantic_inventory, list_or_json).
+entity_property(req, proof_exempt, boolean).
+entity_property(req, proof_exempt_reason, string).
 
 % Typed fact fields - only valid for fact entities
 entity_property(fact, fact_kind, atom).
@@ -47,10 +57,45 @@ entity_property(fact, closed_world, boolean).
 entity_property(fact, valid_from, datetime).
 entity_property(fact, valid_to, datetime).
 entity_property(fact, canonical_key, string).
+entity_property(fact, claim_key, string).
+entity_property(fact, claim_text, string).
+entity_property(fact, predicate_name, string).
+entity_property(fact, predicate_namespace, string).
+entity_property(fact, predicate_arity, integer).
+entity_property(fact, argument_names, list).
+entity_property(fact, argument_types, list).
+entity_property(fact, argument_descriptions, list).
+% Predicate-schema vocabularies are JSON objects serialized as strings.
+entity_property(fact, argument_constants, string).
+entity_property(fact, argument_aliases, string).
+entity_property(fact, aliases, list).
+entity_property(fact, examples, list).
+entity_property(fact, predicate_args, list).
+entity_property(fact, rule_ir, string).
+entity_property(fact, rule_hash, string).
+% Rule schema references are JSON strings at the public boundary, but the
+% Prolog peer represents entity identifiers as atoms.  Accept both forms so
+% decoded rule facts validate without losing the typed reference.
+entity_property(fact, rule_schema_id, atom_or_string).
+entity_property(fact, rule_name, string).
+entity_property(fact, semantic_key, string).
+entity_property(fact, claim_span_start, integer).
+entity_property(fact, claim_span_end, integer).
 
 % Typed symbol metadata fields - only valid for symbol entities
 entity_property(symbol, symbol_role, atom).
 entity_property(symbol, granularity_reason, atom).
+entity_property(symbol, sourceLine, integer).
+entity_property(symbol, sourceColumn, integer).
+entity_property(symbol, sourceEndLine, integer).
+entity_property(symbol, sourceEndColumn, integer).
+
+% Typed test verification fields - only valid for test entities
+entity_property(test, verification_scope, atom).
+entity_property(test, verification_perspective, atom).
+entity_property(test, proof_contract, list_or_json).
+entity_property(test, proof_bindings, string).
+entity_property(test, proof_receipts, string).
 
 % Required properties for all entity types
 required_property(Type, id) :- entity_type(Type).
@@ -67,6 +112,20 @@ optional_property(Type, priority) :- entity_type(Type).
 optional_property(Type, severity) :- entity_type(Type).
 optional_property(Type, links) :- entity_type(Type).
 optional_property(Type, text_ref) :- entity_type(Type).
+optional_property(req, semantic_text).
+optional_property(req, logic_claims).
+optional_property(req, semantic_clauses).
+optional_property(req, semantic_inventory_version).
+optional_property(req, semantic_source_field).
+optional_property(req, semantic_source_hash).
+optional_property(req, semantic_inventory).
+optional_property(req, proof_exempt).
+optional_property(req, proof_exempt_reason).
+optional_property(test, verification_scope).
+optional_property(test, verification_perspective).
+optional_property(test, proof_contract).
+optional_property(test, proof_bindings).
+optional_property(test, proof_receipts).
 
 % Documentation helpers
 % list all entity types

package/schema/relationships.pl

@@ -3,32 +3,36 @@
 :- module(kibi_relationships, [relationship_type/1, valid_relationship/3, relationship_metadata/1]).
 
 % Relationship types
+% implements REQ-005
 relationship_type(depends_on).
+relationship_type(executable_for).
 relationship_type(specified_by).
 relationship_type(verified_by).
 relationship_type(validates).
 relationship_type(implements).
 relationship_type(covered_by).
-relationship_type(executable_for).
 relationship_type(constrained_by).
 relationship_type(guards).
 relationship_type(publishes).
 relationship_type(consumes).
 relationship_type(relates_to).
 relationship_type(supersedes).
+relationship_type(restates).
 relationship_type(constrains).
 relationship_type(requires_property).
+relationship_type(requires_predicate).
+relationship_type(requires_rule).
 
 % valid_relationship(RelType, FromType, ToType).
 valid_relationship(depends_on, req, req).
+valid_relationship(executable_for, symbol, test).
 valid_relationship(specified_by, req, scenario).
 valid_relationship(verified_by, req, test).
+valid_relationship(verified_by, scenario, test).
 valid_relationship(validates, test, req).
+valid_relationship(validates, test, scenario).
 valid_relationship(implements, symbol, req).
 valid_relationship(covered_by, symbol, test).
-valid_relationship(executable_for, symbol, test).
-valid_relationship(verified_by, scenario, test).
-valid_relationship(validates, test, scenario).
 valid_relationship(constrained_by, symbol, adr).
 % guards can target symbol, event, or req
 valid_relationship(guards, flag, symbol).
@@ -38,12 +42,21 @@ valid_relationship(publishes, symbol, event).
 valid_relationship(consumes, symbol, event).
 valid_relationship(constrains, req, fact).
 valid_relationship(requires_property, req, fact).
+valid_relationship(requires_predicate, req, fact).
+valid_relationship(requires_rule, req, fact).
 
 %% supersedes(+NewAdrId, +OldAdrId)
 %% NewAdrId is the decision that replaces OldAdrId.
 %% OldAdrId's status should be archived or deprecated as a consequence.
 valid_relationship(supersedes, adr, adr).
 valid_relationship(supersedes, req, req).
+
+%% restates(+ReqId, +OtherReqId)
+%% ReqId intentionally restates OtherReqId (for example a product requirement
+%% echoed in a platform requirement). Both stay current; the pair is exempt
+%% from domain-redundancy. Use supersedes when one replaces the other.
+% implements REQ-kibi-restates-relationship
+valid_relationship(restates, req, req).
 % escape hatch - allow any to any
 valid_relationship(relates_to, _, _).