kibi-cli 2.14.0 → 2.16.0

package/dist/prolog.js

@@ -505,6 +505,9 @@ export class PrologProcess {
             trimmed.startsWith("kb_storage_export") ||
             trimmed.startsWith("status:") ||
             trimmed.startsWith("kb_commit_upsert(") ||
+            // The preview stages a write in a rolled-back transaction: never
+            // answer it from the cache of an earlier payload.
+            trimmed.startsWith("kb_preview_upsert_contradiction(") ||
             trimmed.startsWith("kb_assert_") ||
             trimmed.startsWith("kb_delete_") ||
             trimmed.startsWith("kb_retract_"));
@@ -790,7 +793,11 @@ export class PrologProcess {
         return match?.[1] ?? "anonymous";
     }
     addDiagnosticStage(message, goal, diagnostics) {
-        if (this.goalLabel(goal) !== "kb_commit_upsert")
+        // The dry-run contradiction preview reports the same stages as the
+        // commit it previews, so its refusal reads exactly like the commit's.
+        const label = this.goalLabel(goal);
+        if (label !== "kb_commit_upsert" &&
+            label !== "kb_preview_upsert_contradiction")
             return message;
         const stage = this.lastDiagnosticStage(diagnostics);
         return stage === null ? message : `${message} (stage=${stage})`;

package/dist/proof/inspect.d.ts

@@ -1,3 +1,5 @@
+import type { MigrationPlan } from "../public/operations/migration-plan.js";
+import { type ProposedIntegration } from "./integration-plan.js";
 export type ProofInspection = Readonly<{
     languages: readonly string[];
     buildSystems: readonly string[];
@@ -6,7 +8,22 @@ export type ProofInspection = Readonly<{
     currentIntegration: string | null;
     recommendation: string;
     missing: readonly string[];
+    /** The integration Kibi proposes for the detected runner, if any. */
+    proposedIntegration: ProposedIntegration["integration"] | null;
+    /** What a proof-bearing test's proof_contract names for that integration. */
+    contractDefaults: ProposedIntegration["contractDefaults"] | null;
+    /**
+     * Hash-bound kibi.migration-plan.v2 that writes the integrations file;
+     * review it, then apply it with kb_apply_plan / `kibi apply-plan`.
+     */
+    integrationPlan: MigrationPlan | null;
+    /** Why there is no plan, or what applying it does. */
+    integrationPlanReason: string;
+}>;
+export type ProofInspectionOptions = Readonly<{
+    /** Plan a replacement of this existing integration id. */
+    update?: string;
 }>;
 export declare function directoryEntriesMatch(directory: string, regex: RegExp): boolean;
-export declare function inspectProofEnvironment(root: string): ProofInspection;
+export declare function inspectProofEnvironment(root: string, options?: ProofInspectionOptions): ProofInspection;
 //# sourceMappingURL=inspect.d.ts.map

package/dist/proof/inspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../src/proof/inspect.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAwIH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AA2BD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAoFrE"}
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../src/proof/inspect.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,uBAAuB,CAAC;AAM/B,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,qEAAqE;IACrE,mBAAmB,EAAE,mBAAmB,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IAC/D,6EAA6E;IAC7E,gBAAgB,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;IACjE;;;OAGG;IACH,eAAe,EAAE,aAAa,GAAG,IAAI,CAAC;IACtC,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAwIH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AA2BD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAgGjB"}

package/dist/proof/inspect.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
-import { loadProofIntegrations } from "./integrations.js";
+import { buildProofIntegrationPlan, } from "./integration-plan.js";
+import { PROOF_INTEGRATIONS_PATH, loadProofIntegrations, } from "./integrations.js";
 /**
  * Declarative detection manifests. Deterministic CLI logic consumes these;
  * agents consume the inspection output and never reinvent runner discovery.
@@ -149,7 +150,7 @@ function directoryExists(root, relative) {
     }
 }
 // implements REQ-kibi-verification-evidence-contract
-export function inspectProofEnvironment(root) {
+export function inspectProofEnvironment(root, options = {}) {
     const languages = new Set();
     const buildSystems = new Set();
     const runners = [];
@@ -207,17 +208,21 @@ export function inspectProofEnvironment(root) {
     const currentIntegration = integrations.available
         ? integrations.integrations.integrations.map((entry) => entry.id).join(", ")
         : null;
+    const planned = buildProofIntegrationPlan(root, options);
+    const applyHint = "review integrationPlan, then apply it with kb_apply_plan (or `kibi apply-plan --input -`) passing plan, approvedPlanHash = plan.planHash and approvedActionIds";
     let recommendation;
-    if (!integrations.available) {
-        if (runners.length === 0) {
+    if (planned.plan !== null && options.update !== undefined) {
+        recommendation = `To replace integration '${options.update}', ${applyHint}.`;
+    }
+    else if (!integrations.available) {
+        if (planned.plan === null) {
             recommendation =
                 "No test harness detected. Proof integration is deferred until the first proof-bearing test introduces one; command proof can prove any command.";
-            missing.push(".kb/proof/integrations.json (created by bootstrap)");
+            missing.push(`${PROOF_INTEGRATIONS_PATH} (written by applying the plan from kibi proof inspect --json)`);
         }
         else {
-            recommendation =
-                "Run bootstrap to configure proof integrations: native producers or standard-format adapters for detected runners, or command proof as the universal fallback.";
-            missing.push(".kb/proof/integrations.json (created by bootstrap)");
+            recommendation = `Kibi proposes a command integration for the detected runner. To configure it, ${applyHint}. Proof-bearing tests then name it in proof_contract.integration and kibi prove runs it.`;
+            missing.push(`${PROOF_INTEGRATIONS_PATH} (written by applying integrationPlan)`);
         }
     }
     else {
@@ -232,5 +237,9 @@ export function inspectProofEnvironment(root) {
         currentIntegration,
         recommendation,
         missing,
+        proposedIntegration: planned.proposal?.integration ?? null,
+        contractDefaults: planned.proposal?.contractDefaults ?? null,
+        integrationPlan: planned.plan,
+        integrationPlanReason: planned.reason,
     };
 }

package/dist/proof/integration-plan.d.ts

@@ -0,0 +1,57 @@
+import { type MigrationAction, type MigrationPlan } from "../public/operations/migration-plan.js";
+import { PROOF_CONTRACT_VERSION } from "../public/proof-protocol.js";
+import { type ProofIntegration } from "./integrations.js";
+/** Migration action code of a reviewed proof integration write. */
+export declare const PROOF_INTEGRATION_CONFIGURE = "proof_integration_configure";
+export type ProposedIntegration = Readonly<{
+    integration: ProofIntegration;
+    /** The runner the proposal was derived from (for the review summary). */
+    runner: string;
+    /** What a proof-bearing test's proof_contract names for this integration. */
+    contractDefaults: Readonly<{
+        version: typeof PROOF_CONTRACT_VERSION;
+        integration: string;
+        required_proofs: ReadonlyArray<{
+            symbol_id: string;
+            target: string;
+        }>;
+        success_policy: "all_required_first_attempt";
+    }>;
+}>;
+export type ProofIntegrationPlanResult = Readonly<{
+    /** The hash-bound plan to review and apply with kb_apply_plan, if any. */
+    plan: MigrationPlan | null;
+    proposal: ProposedIntegration | null;
+    /** Why no plan was produced, or what applying it does. */
+    reason: string;
+}>;
+/**
+ * The command-producer integration Kibi proposes for the repository's test
+ * runner: the package.json `test` script when there is one (it is what the
+ * project already runs), otherwise the first detected runner. A command
+ * integration is the universal floor: Kibi judges the run by its exit code
+ * (aggregate-run provenance), so it works for every runner without a
+ * reporter; a native producer can replace it later through an update plan.
+ */
+export declare function proposeProofIntegration(root: string, overrideId?: string): ProposedIntegration | null;
+/**
+ * Build the hash-bound `kibi.migration-plan.v2` that writes
+ * `.kb/proof/integrations.json` through Kibi. Without `update`, a plan is
+ * produced only while the file does not exist; with `update` it adds or
+ * replaces the named integration of an existing, valid file. The plan carries the file's
+ * current hash and the hashes of the files the proposal was derived from;
+ * `kb_apply_plan` refuses it once either changed.
+ */
+export declare function buildProofIntegrationPlan(root: string, options?: Readonly<{
+    update?: string;
+}>): ProofIntegrationPlanResult;
+/**
+ * Apply one reviewed `proof_integration_configure` action: write
+ * `.kb/proof/integrations.json` (`kibi.proof-integration.v1`). A create is
+ * refused when the file exists; an update is refused unless the file still
+ * has the hash the plan was built against, and it adds or replaces only the
+ * named integration. Either is refused when
+ * a file the proposal was derived from changed since planning.
+ */
+export declare function applyProofIntegrationAction(action: MigrationAction, root: string): void;
+//# sourceMappingURL=integration-plan.d.ts.map

package/dist/proof/integration-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-plan.d.ts","sourceRoot":"","sources":["../../src/proof/integration-plan.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAGnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sBAAsB,EAEvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,gBAAgB,EAGtB,MAAM,mBAAmB,CAAC;AAE3B,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAqCzE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,gBAAgB,EAAE,QAAQ,CAAC;QACzB,OAAO,EAAE,OAAO,sBAAsB,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,aAAa,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtE,cAAc,EAAE,4BAA4B,CAAC;KAC9C,CAAC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,0EAA0E;IAC1E,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAyGH;;;;;;;GAOG;AAEH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,mBAAmB,GAAG,IAAI,CA8B5B;AAsCD;;;;;;;GAOG;AAEH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,QAAQ,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAM,GAC1C,0BAA0B,CAiE5B;AAMD;;;;;;;GAOG;AAEH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,GACX,IAAI,CAyDN"}

package/dist/proof/integration-plan.js

@@ -0,0 +1,331 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { buildMigrationPlan, migrationAction, } from "../public/operations/migration-plan.js";
+import { PROOF_CONTRACT_VERSION, PROOF_INTEGRATION_VERSION, } from "../public/proof-protocol.js";
+import { PROOF_INTEGRATIONS_PATH, integrationsPath, proofIntegrationErrors, } from "./integrations.js";
+/** Migration action code of a reviewed proof integration write. */
+export const PROOF_INTEGRATION_CONFIGURE = "proof_integration_configure";
+/**
+ * Files the proposal is derived from. Their hashes are bound into the plan,
+ * so a plan reviewed against one package.json is refused after it changed.
+ */
+const PROPOSAL_SOURCES = [
+    "package.json",
+    "bun.lock",
+    "bun.lockb",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "playwright.config.ts",
+    "playwright.config.mjs",
+    "playwright.config.js",
+    "vitest.config.ts",
+    "vitest.config.mjs",
+    "vitest.config.js",
+    "jest.config.ts",
+    "jest.config.mjs",
+    "jest.config.js",
+    "pytest.ini",
+    "pyproject.toml",
+    "setup.cfg",
+    "tox.ini",
+    "go.mod",
+    "Cargo.toml",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "Gemfile",
+    "Rakefile",
+];
+/** npm writes this placeholder into a fresh package.json; it runs no tests. */
+const NPM_PLACEHOLDER_TEST = /no test specified/i;
+function readPackageJson(root) {
+    try {
+        const parsed = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+        return parsed !== null &&
+            typeof parsed === "object" &&
+            !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function packageTestCommand(root) {
+    const pkg = readPackageJson(root);
+    const scripts = pkg !== null &&
+        pkg.scripts !== null &&
+        typeof pkg.scripts === "object" &&
+        !Array.isArray(pkg.scripts)
+        ? pkg.scripts
+        : {};
+    const test = scripts.test;
+    if (typeof test !== "string" || test.trim() === "")
+        return null;
+    if (NPM_PLACEHOLDER_TEST.test(test))
+        return null;
+    const has = (file) => existsSync(path.join(root, file));
+    if (has("bun.lock") || has("bun.lockb"))
+        return ["bun", "run", "test"];
+    if (has("pnpm-lock.yaml"))
+        return ["pnpm", "test"];
+    if (has("yarn.lock"))
+        return ["yarn", "test"];
+    return ["npm", "test"];
+}
+/** Ordered: the first runner whose marker file exists wins. */
+const RUNNER_COMMANDS = [
+    {
+        runner: "playwright",
+        id: "e2e",
+        files: [
+            "playwright.config.ts",
+            "playwright.config.mjs",
+            "playwright.config.js",
+        ],
+        command: ["npx", "playwright", "test"],
+    },
+    {
+        runner: "vitest",
+        id: "unit",
+        files: ["vitest.config.ts", "vitest.config.mjs", "vitest.config.js"],
+        command: ["npx", "vitest", "run"],
+    },
+    {
+        runner: "jest",
+        id: "unit",
+        files: ["jest.config.ts", "jest.config.mjs", "jest.config.js"],
+        command: ["npx", "jest", "--ci"],
+    },
+    {
+        runner: "pytest",
+        id: "unit",
+        files: ["pytest.ini", "pyproject.toml", "setup.cfg", "tox.ini"],
+        command: ["pytest"],
+    },
+    {
+        runner: "go test",
+        id: "unit",
+        files: ["go.mod"],
+        command: ["go", "test", "./..."],
+    },
+    {
+        runner: "cargo test",
+        id: "unit",
+        files: ["Cargo.toml"],
+        command: ["cargo", "test"],
+    },
+    {
+        runner: "maven",
+        id: "unit",
+        files: ["pom.xml"],
+        command: ["mvn", "test"],
+    },
+    {
+        runner: "gradle",
+        id: "unit",
+        files: ["build.gradle", "build.gradle.kts"],
+        command: ["gradle", "test"],
+    },
+    {
+        runner: "rake test",
+        id: "unit",
+        files: ["Rakefile"],
+        command: ["bundle", "exec", "rake", "test"],
+    },
+];
+/**
+ * The command-producer integration Kibi proposes for the repository's test
+ * runner: the package.json `test` script when there is one (it is what the
+ * project already runs), otherwise the first detected runner. A command
+ * integration is the universal floor: Kibi judges the run by its exit code
+ * (aggregate-run provenance), so it works for every runner without a
+ * reporter; a native producer can replace it later through an update plan.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function proposeProofIntegration(root, overrideId) {
+    const npmCommand = packageTestCommand(root);
+    const detected = npmCommand !== null
+        ? {
+            runner: `package.json test script (${npmCommand.join(" ")})`,
+            id: "unit",
+            command: npmCommand,
+        }
+        : RUNNER_COMMANDS.find((entry) => entry.files.some((file) => existsSync(path.join(root, file))));
+    if (detected === undefined)
+        return null;
+    const id = overrideId ?? detected.id;
+    return {
+        runner: detected.runner,
+        integration: {
+            id,
+            producer: "command",
+            command: [...detected.command],
+            targets: ["default"],
+            description: `Command proof: runs ${detected.command.join(" ")} once per kibi prove and judges every selected test by its exit code.`,
+        },
+        contractDefaults: {
+            version: PROOF_CONTRACT_VERSION,
+            integration: id,
+            required_proofs: [{ symbol_id: "SYM-<symbol the test proves>", target: "default" }],
+            success_policy: "all_required_first_attempt",
+        },
+    };
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function fileHash(filePath) {
+    try {
+        return sha256(readFileSync(filePath));
+    }
+    catch {
+        return null;
+    }
+}
+function sourceHashes(root) {
+    const hashes = {};
+    for (const file of PROPOSAL_SOURCES) {
+        const hash = fileHash(path.join(root, file));
+        if (hash !== null)
+            hashes[file] = hash;
+    }
+    return hashes;
+}
+function readIntegrationsFile(root) {
+    try {
+        const parsed = JSON.parse(readFileSync(integrationsPath(root), "utf8"));
+        return proofIntegrationErrors(parsed).length === 0 ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the hash-bound `kibi.migration-plan.v2` that writes
+ * `.kb/proof/integrations.json` through Kibi. Without `update`, a plan is
+ * produced only while the file does not exist; with `update` it adds or
+ * replaces the named integration of an existing, valid file. The plan carries the file's
+ * current hash and the hashes of the files the proposal was derived from;
+ * `kb_apply_plan` refuses it once either changed.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function buildProofIntegrationPlan(root, options = {}) {
+    const filePath = integrationsPath(root);
+    const exists = existsSync(filePath);
+    const update = options.update?.trim() || undefined;
+    if (exists && update === undefined) {
+        return {
+            plan: null,
+            proposal: null,
+            reason: `${PROOF_INTEGRATIONS_PATH} already exists; Kibi will not overwrite it. Run kibi proof inspect --update <integration id> for a plan that adds or replaces one named integration.`,
+        };
+    }
+    if (!exists && update !== undefined) {
+        return {
+            plan: null,
+            proposal: null,
+            reason: `${PROOF_INTEGRATIONS_PATH} does not exist yet. Run kibi proof inspect without --update for a plan that creates it.`,
+        };
+    }
+    if (update !== undefined && readIntegrationsFile(root) === null)
+        return {
+            plan: null,
+            proposal: null,
+            reason: `${PROOF_INTEGRATIONS_PATH} is not a valid ${PROOF_INTEGRATION_VERSION} file, so Kibi cannot update one integration in it. Run kibi prove for the validation error.`,
+        };
+    const proposal = proposeProofIntegration(root, update);
+    if (proposal === null) {
+        return {
+            plan: null,
+            proposal: null,
+            reason: "No test runner detected (no package.json test script and no known runner configuration), so Kibi has no command to propose. Proof integration stays deferred until the first proof-bearing test introduces a harness.",
+        };
+    }
+    const action = migrationAction({
+        id: `proof-integration-${proposal.integration.id}`,
+        code: PROOF_INTEGRATION_CONFIGURE,
+        category: "proof",
+        safety: "automatic",
+        autoApplicable: true,
+        invocation: {
+            kind: "review",
+            instruction: `Review the proposed ${proposal.integration.producer} integration '${proposal.integration.id}' (command: ${proposal.integration.command.join(" ")}), then apply this plan with kb_apply_plan (plan, approvedPlanHash, approvedActionIds) to ${update === undefined ? "create" : "update"} ${PROOF_INTEGRATIONS_PATH}.`,
+        },
+        affectedFiles: [PROOF_INTEGRATIONS_PATH],
+        evidence: {
+            path: PROOF_INTEGRATIONS_PATH,
+            mode: update === undefined ? "create" : "update",
+            integration: proposal.integration,
+            runner: proposal.runner,
+            contractDefaults: proposal.contractDefaults,
+            previousFileHash: update === undefined ? null : fileHash(filePath),
+            sourceHashes: sourceHashes(root),
+        },
+        postconditions: [
+            { file: PROOF_INTEGRATIONS_PATH, version: PROOF_INTEGRATION_VERSION },
+        ],
+    });
+    return {
+        plan: buildMigrationPlan({
+            evaluatedDomains: ["proof"],
+            actions: [action],
+        }),
+        proposal,
+        reason: `Applying the plan ${update === undefined ? "creates" : "updates"} ${PROOF_INTEGRATIONS_PATH} with the ${proposal.integration.producer} integration '${proposal.integration.id}' (${proposal.integration.command.join(" ")}). Proof-bearing tests then name it in proof_contract.integration and kibi prove runs it.`,
+    };
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+ * Apply one reviewed `proof_integration_configure` action: write
+ * `.kb/proof/integrations.json` (`kibi.proof-integration.v1`). A create is
+ * refused when the file exists; an update is refused unless the file still
+ * has the hash the plan was built against, and it adds or replaces only the
+ * named integration. Either is refused when
+ * a file the proposal was derived from changed since planning.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function applyProofIntegrationAction(action, root) {
+    const evidence = action.evidence;
+    const integration = evidence.integration;
+    if (evidence.path !== PROOF_INTEGRATIONS_PATH ||
+        (evidence.mode !== "create" && evidence.mode !== "update") ||
+        !isRecord(integration) ||
+        typeof integration.id !== "string")
+        throw new Error(`Proof integration action '${action.id}' is malformed; rerun kibi proof inspect for a new plan.`);
+    const planned = isRecord(evidence.sourceHashes) ? evidence.sourceHashes : {};
+    const live = sourceHashes(root);
+    const changed = [
+        ...new Set([...Object.keys(planned), ...Object.keys(live)]),
+    ].filter((file) => planned[file] !== live[file]);
+    if (changed.length > 0)
+        throw new Error(`Proof integration plan refused: ${changed.join(", ")} changed since planning; rerun kibi proof inspect and review the new plan.`);
+    const filePath = integrationsPath(root);
+    let integrations;
+    if (evidence.mode === "create") {
+        if (existsSync(filePath))
+            throw new Error(`Proof integration plan refused: ${PROOF_INTEGRATIONS_PATH} already exists and this plan only creates it. Run kibi proof inspect --update <integration id> for a plan that adds or replaces one named integration.`);
+        integrations = [integration];
+    }
+    else {
+        if (fileHash(filePath) !== evidence.previousFileHash)
+            throw new Error(`Proof integration plan refused: ${PROOF_INTEGRATIONS_PATH} changed since planning; rerun kibi proof inspect --update ${integration.id}.`);
+        const current = readIntegrationsFile(root);
+        if (current === null)
+            throw new Error(`Proof integration plan refused: ${PROOF_INTEGRATIONS_PATH} is not a valid ${PROOF_INTEGRATION_VERSION} file.`);
+        integrations = current.integrations.some((entry) => entry.id === integration.id)
+            ? current.integrations.map((entry) => entry.id === integration.id ? integration : entry)
+            : [...current.integrations, integration];
+    }
+    const file = { version: PROOF_INTEGRATION_VERSION, integrations };
+    const errors = proofIntegrationErrors(file);
+    if (errors.length > 0)
+        throw new Error(`Proof integration plan refused: the result would be invalid (${errors.join("; ")}).`);
+    mkdirSync(path.dirname(filePath), { recursive: true });
+    const temporary = `${filePath}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(file, null, 2)}\n`, "utf8");
+    renameSync(temporary, filePath);
+}

package/dist/proof/integrations.js

@@ -70,7 +70,7 @@ export function loadProofIntegrations(workspaceRoot) {
     if (!existsSync(filePath)) {
         return {
             available: false,
-            error: `No proof integration configuration at ${PROOF_INTEGRATIONS_PATH}. Run bootstrap for this repository to configure proof producers.`,
+            error: `No proof integration configuration at ${PROOF_INTEGRATIONS_PATH}. Run kibi proof inspect --json and apply its integrationPlan with kb_apply_plan to configure one.`,
         };
     }
     let parsed;

package/dist/public/operations/catalog.d.ts

@@ -572,7 +572,7 @@ export declare const OPERATION_CATALOG: readonly [{
             };
             readonly requirementId: {
                 readonly type: "string";
-                readonly description: "Optional existing requirement ID to receive the requires_rule relationship.";
+                readonly description: "Optional requirement ID. The strict write set updates this requirement instead of minting a REQ-AUTO id, and a typed logic rule attaches its requires_rule relationship to it.";
             };
             readonly claimKey: {
                 readonly type: "string";
@@ -1732,7 +1732,7 @@ export declare const OPERATION_CATALOG: readonly [{
                     readonly type: "string";
                     readonly enum: readonly string[];
                 };
-                readonly description: "Optional rule subset. Allowed: must-priority-coverage, symbol-coverage, symbol-traceability, no-dangling-refs, source-relationship-parity, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged. If omitted, server runs canonical and advisory rules plus the full-KB qualityDiagnostics audit scan, including usage telemetry acceptance when evidence exists; migration rules run only when explicitly selected. Advisory and migration findings are non-blocking qualityDiagnostics. If supplied, server preserves scoped validation and skips the full-KB advisory scan.";
+                readonly description: "Optional rule subset. Allowed: must-priority-coverage, symbol-coverage, symbol-traceability, no-dangling-refs, source-relationship-parity, branch-store-not-compiled, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged, policy-ownership, policy-markers. If omitted, server runs canonical and advisory rules plus the full-KB qualityDiagnostics audit scan, including usage telemetry acceptance when evidence exists; migration rules run only when explicitly selected. Advisory and migration findings are non-blocking qualityDiagnostics. If supplied, server preserves scoped validation and skips the full-KB advisory scan.";
             };
             readonly sourceFiles: {
                 readonly type: "array";

package/dist/public/operations/check-executor.d.ts

@@ -1,3 +1,4 @@
+import type { Violation } from "../check-types.js";
 import { type CheckDiagnostic, type CheckStructuredContent, buildStructuredContent, buildSummary } from "./check-format-shared.js";
 import { getEffectiveRules, resolveCheckRules } from "./check-helpers.js";
 import type { OperationContext } from "./runtime-types.js";
@@ -16,6 +17,21 @@ export type { CheckDiagnostic, CheckStructuredContent };
 export { buildStructuredContent, buildSummary, getEffectiveRules, resolveCheckRules, };
 export type CheckExecutionOptions = {
     readonly collectFullQualityDiagnosticsForExplicitRules?: boolean;
+    /**
+     * The engine reads the current branch's store although the context carries
+     * no branch attachment (the `kibi check` engine path). A context with a
+     * branch attachment (the CLI and MCP runtimes) implies it; without either,
+     * the attached store is unknown (an explicit --kb-path store or an injected
+     * test store) and the branch-store compilation check is skipped.
+     */
+    readonly branchStoreAttached?: boolean;
 };
+/**
+ * The one finding for a branch whose store was never compiled while .kb/
+ * holds authored sources. Every store-backed rule would read an empty KB
+ * (source-relationship-parity alone reports each authored relationship as
+ * missing), so kb_check reports this instead of any of them.
+ */
+export declare function uncompiledBranchStoreViolation(context: OperationContext, workspaceRoot: string): Violation | null;
 export declare function executeCheck(args: CheckInput, context: OperationContext, options?: CheckExecutionOptions): Promise<OperationResult<CheckPayload>>;
 //# sourceMappingURL=check-executor.d.ts.map

package/dist/public/operations/check-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-executor.d.ts","sourceRoot":"","sources":["../../../src/public/operations/check-executor.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,sBAAsB,EACtB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,iBAAiB,EAGjB,iBAAiB,EAElB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,gBAAgB,EAAc,MAAM,oBAAoB,CAAC;AAMvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC;AACxD,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,6CAA6C,CAAC,EAAE,OAAO,CAAC;CAClE,CAAC;AAqDF,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CA2KxC"}
+{"version":3,"file":"check-executor.d.ts","sourceRoot":"","sources":["../../../src/public/operations/check-executor.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,sBAAsB,EACtB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,iBAAiB,EAGjB,iBAAiB,EAElB,MAAM,oBAAoB,CAAC;AAW5B,OAAO,KAAK,EAAE,gBAAgB,EAAc,MAAM,oBAAoB,CAAC;AAMvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC;AACxD,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,6CAA6C,CAAC,EAAE,OAAO,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC;AAoDF;;;;;GAKG;AAEH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,MAAM,GACpB,SAAS,GAAG,IAAI,CAgClB;AAGD,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAgOxC"}