kibi-cli 2.15.0 → 2.17.0

package/dist/cli-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAG7D,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAMpE,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,iBAAS,WAAW,CAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,UAAU,GAAG,cAAc,EAClC,IAAI,CAAC,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,EACD,SAAS,UAAO,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,iBAAiB,CAwBnB;AA4BD;;;;GAIG;AAEH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,EACvC,KAAK,EAAE,OAAO,GACb,iBAAiB,CAWnB;AAGD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAwE5B"}
+{"version":3,"file":"cli-protocol.d.ts","sourceRoot":"","sources":["../src/cli-protocol.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAG7D,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAMpE,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD,CAAC;AAGF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,iBAAS,WAAW,CAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,UAAU,GAAG,cAAc,EAClC,IAAI,CAAC,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,EACD,SAAS,UAAO,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,iBAAiB,CAwBnB;AA4BD;;;;GAIG;AAEH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,EACvC,KAAK,EAAE,OAAO,GACb,iBAAiB,CAWnB;AAGD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAqF5B"}

package/dist/cli-protocol.js

@@ -78,6 +78,19 @@ export async function executeOperation(catalogName, input, context) {
         if (!protocolValid(spec, envelope)) {
             return errorResult(catalogName, new OperationError("PROTOCOL_VALIDATION_FAILED", "Operation produced a result that does not satisfy its generated output contract."), spec);
         }
+        // A result the operation itself reports as an error (a rejected
+        // bootstrap, a refused migration plan) exits non-zero like any other.
+        if (envelope.status === "error") {
+            return {
+                exitCode: 1,
+                stdout: `${JSON.stringify(envelope)}\n`,
+                ...(envelope.error
+                    ? {
+                        stderr: `Error [${envelope.error.code}]: ${envelope.error.message}\n`,
+                    }
+                    : {}),
+            };
+        }
         return { exitCode: 0, stdout: `${JSON.stringify(envelope)}\n` };
     }
     catch (error) {

package/dist/cli-register-proof.d.ts

@@ -1,3 +1,9 @@
 import type { Command } from "commander";
 export declare function registerProofCommand(program: Command): void;
+/**
+ * `--command` for `kibi proof inspect`: a JSON array of argv strings, or
+ * space-separated words (no shell quoting; Kibi runs integrations with
+ * `shell: false`).
+ */
+export declare function parseCommandOption(value: string): readonly string[];
 //# sourceMappingURL=cli-register-proof.d.ts.map

package/dist/cli-register-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-register-proof.d.ts","sourceRoot":"","sources":["../src/cli-register-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsL3D"}
+{"version":3,"file":"cli-register-proof.d.ts","sourceRoot":"","sources":["../src/cli-register-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2M3D;AAED;;;;GAIG;AAEH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAwBnE"}

package/dist/cli-register-proof.js

@@ -39,10 +39,18 @@ export function registerProofCommand(program) {
         .description("Inspect proof integration and maintain proof evidence");
     proof
         .command("inspect")
-        .description("Detect test infrastructure and recommend the strongest available proof integration")
+        .description("Detect test infrastructure, propose a proof integration and return the reviewed plan that writes .kb/proof/integrations.json")
+        .option("--update <id>", "Plan adding or replacing this integration in an existing .kb/proof/integrations.json")
+        .option("--command <command>", 'Command the proposed integration runs instead of the detected one: space-separated words, or a JSON array of argv strings (e.g. \'["npx","vitest","run","tests/e2e"]\')')
         .option("--json", "Emit structured JSON", false)
         .action(withExitCode(async (options) => {
-        const result = await (await import("./proof/inspect.js")).inspectProofEnvironment(process.cwd());
+        const command = options.command === undefined
+            ? undefined
+            : parseCommandOption(options.command);
+        const result = await (await import("./proof/inspect.js")).inspectProofEnvironment(process.cwd(), {
+            ...(options.update === undefined ? {} : { update: options.update }),
+            ...(command === undefined ? {} : { command }),
+        });
         if (options.json) {
             process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
             return undefined;
@@ -108,6 +116,33 @@ export function registerProofCommand(program) {
         });
     }));
 }
+/**
+ * `--command` for `kibi proof inspect`: a JSON array of argv strings, or
+ * space-separated words (no shell quoting; Kibi runs integrations with
+ * `shell: false`).
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function parseCommandOption(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("[")) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            throw new Error("--command must be a JSON array of argv strings or space-separated words.");
+        }
+        if (!Array.isArray(parsed) ||
+            parsed.length === 0 ||
+            !parsed.every((entry) => typeof entry === "string" && entry !== ""))
+            throw new Error("--command must be a JSON array of non-empty argv strings.");
+        return parsed;
+    }
+    const words = trimmed.split(/\s+/).filter((word) => word !== "");
+    if (words.length === 0)
+        throw new Error("--command must not be empty.");
+    return words;
+}
 function renderInspection(result) {
     const inspection = result;
     const lines = ["Proof environment", ""];
@@ -136,5 +171,20 @@ function renderInspection(result) {
         for (const entry of inspection.missing)
             lines.push(`  - ${entry}`);
     }
+    if (inspection.proposedIntegration) {
+        const proposed = inspection.proposedIntegration;
+        lines.push("");
+        lines.push(`Proposed integration: ${proposed.id} (${proposed.producer}: ${proposed.command.join(" ")})`);
+    }
+    if (inspection.integrationPlan) {
+        const plan = inspection.integrationPlan;
+        lines.push(`Integration plan: ${plan.planHash.slice(0, 12)} (actions: ${plan.actions.map((action) => action.id).join(", ")}); rerun with --json for the plan to pass to kb_apply_plan.`);
+        if (inspection.integrationPlanReason)
+            lines.push(inspection.integrationPlanReason);
+    }
+    else if (inspection.integrationPlanReason) {
+        lines.push("");
+        lines.push(`Integration plan: none. ${inspection.integrationPlanReason}`);
+    }
     return `${lines.join("\n")}\n`;
 }

package/dist/commands/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA8E7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AA8gBD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3B,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAMpB;AAGD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0nB/B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAoDtB;AAID,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAkEtB;AAID,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAmGtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAyCtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgDtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA+BtB"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA8E7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B;AA8gBD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3B,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAMpB;AAGD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA8nB/B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAoDtB;AAID,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAkEtB;AAID,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAmGtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,SAAS,EAAE,CAAC,CAyCtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAgDtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA0BtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,SAAS,EAAE,CAAC,CA+BtB"}

package/dist/commands/check.js

@@ -885,7 +885,11 @@ export async function checkCommand(options) {
                 invalidateCache: () => activeProlog.invalidateCache(),
                 save: () => activeProlog.query("kb_save"),
             },
-        }, { collectFullQualityDiagnosticsForExplicitRules: true });
+        }, {
+            collectFullQualityDiagnosticsForExplicitRules: true,
+            // The engine reads the branch store; an explicit --kb-path does not.
+            branchStoreAttached: options.kbPath === undefined,
+        });
         const violations = result.structuredContent?.violations ?? [];
         const qualityDiagnostics = result.structuredContent?.qualityDiagnostics ?? [];
         if (options.format === "json") {

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAiFA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B;AAGD,wBAAsB,aAAa,CACjC,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoG/B;AAED,wBAAsB,4BAA4B,CAChD,IAAI,GAAE,MAAM,OAAO,CAAC;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,CACT,GACxC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;;;;;;;;;;;;;;;MAkE3C;AAkGD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAepB"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AA2FA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B;AAGD,wBAAsB,aAAa,CACjC,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmH/B;AAED,wBAAsB,4BAA4B,CAChD,IAAI,GAAE,MAAM,OAAO,CAAC;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,CACT,GACxC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;;;;;;;;;;;;;;;MAkE3C;AAkGD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAepB"}

package/dist/commands/doctor.js

@@ -25,7 +25,8 @@ import { kibiPackageVersions } from "../package-versions.js";
 import { describeConfiguredCapabilityPlugins, readProjectKibiConfig, } from "../plugins/project-config.js";
 import { SwiplResolutionError, inspectSwiplBundle, probeRequiredLibraries, resolveSwipl, } from "../prolog/swipl-resolver.js";
 import { buildMigrationPlan, migrationAction, } from "../public/operations/migration-plan.js";
-import { resolveReadBranchAttachment } from "../utils/branch-resolver.js";
+import { resolveBranchAttachment, resolveReadBranchAttachment, } from "../utils/branch-resolver.js";
+import { branchStoreCompilation, inspectBranchStore, uncompiledBranchStoreReason, } from "../utils/branch-store.js";
 import { resolveGitRepository, } from "../utils/git-repository-context.js";
 import { readKbManifestStatus } from "../utils/kb-manifest.js";
 import { hasManagedHooks, outdatedManagedHooks } from "./init-helpers.js";
@@ -68,6 +69,10 @@ export async function doctorCommand(options = {}) {
             name: "Git repository",
             check: checkGitRepository,
         },
+        {
+            name: "Branch store",
+            check: checkBranchStore,
+        },
         {
             name: "Git hooks",
             check: checkGitHooks,
@@ -98,6 +103,7 @@ export async function doctorCommand(options = {}) {
         results.push({ name, ...(await check()) });
     }
     const allPassed = results.every((result) => result.passed);
+    const warnings = results.filter((result) => result.passed && result.warning === true).length;
     const runtime = await runtimeProvenance();
     const packageActions = await packageMigrationActions(runtime);
     const migrationPlan = buildMigrationPlan({
@@ -113,6 +119,7 @@ export async function doctorCommand(options = {}) {
         console.log(JSON.stringify({
             version: "kibi.doctor.v1",
             passed: allPassed,
+            warnings,
             runtime,
             checks: results,
             migrationPlan,
@@ -121,12 +128,17 @@ export async function doctorCommand(options = {}) {
     }
     console.log("Kibi Environment Diagnostics\n");
     for (const result of results) {
-        const status = result.passed ? "✓" : "✗";
+        const warned = result.passed && result.warning === true;
+        const status = !result.passed ? "✗" : warned ? "!" : "✓";
         console.log(`${status} ${result.name}: ${result.message}`);
-        if (!result.passed && result.remediation)
+        if ((!result.passed || warned) && result.remediation)
             console.log(`  → ${result.remediation}`);
     }
     console.log();
+    if (allPassed && warnings > 0) {
+        console.log(`All required checks passed, with ${warnings} warning(s) above (marked !).`);
+        return { exitCode: 0 };
+    }
     if (allPassed) {
         console.log("All checks passed! Your environment is ready.");
         return { exitCode: 0 };
@@ -644,6 +656,68 @@ function checkGitRepository() {
         };
     }
 }
+/**
+ * The current branch's KB store: it must exist and hold a compilation
+ * (journal sequence above 0) when .kb/ has authored sources. Kibi stores are
+ * per branch and never copied, so a branch created without the post-checkout
+ * hook starts empty until `kibi sync`.
+ */
+// implements REQ-cli-doctor
+function checkBranchStore() {
+    const workspaceRoot = process.cwd();
+    let attachment;
+    try {
+        attachment = resolveBranchAttachment(workspaceRoot);
+    }
+    catch (error) {
+        attachment = {
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if ("error" in attachment) {
+        return {
+            passed: true,
+            message: `Not checked: no current Git branch (${attachment.error})`,
+        };
+    }
+    const branch = attachment.kbBranch;
+    const store = inspectBranchStore(workspaceRoot, branch);
+    const details = { branch, path: store.path, state: store.state };
+    if (store.state === "incomplete" || store.state === "unreadable") {
+        return {
+            passed: false,
+            message: `Store for ${branch} is ${store.state}: ${store.detail ?? store.errorCode ?? "requires recovery"}`,
+            remediation: "Run: kibi branch recover, then kibi branch recover --apply",
+            details,
+        };
+    }
+    const compilation = branchStoreCompilation(store);
+    if (compilation.compiled) {
+        return {
+            passed: true,
+            message: `Compiled for ${branch}${compilation.generation ? ` (${compilation.generation})` : ""}`,
+            details: { ...details, generation: compilation.generation },
+        };
+    }
+    const reason = uncompiledBranchStoreReason(workspaceRoot, store, branch);
+    if (reason === null) {
+        return {
+            passed: true,
+            message: `Not compiled yet for ${branch}; .kb/ holds no authored sources`,
+            details,
+        };
+    }
+    return {
+        passed: false,
+        message: String(reason.detail),
+        remediation: "Run: kibi sync",
+        details: {
+            ...details,
+            generation: compilation.generation,
+            authoredSources: reason.authoredSources,
+        },
+    };
+}
 // Hook health must be diagnosed against the hooks directory Git actually
 // executes (resolved via git rev-parse --git-path hooks, honoring
 // core.hooksPath and linked worktrees), not against <cwd>/.git/hooks.
@@ -720,10 +794,15 @@ function checkGitHooks() {
     const postMergeExists = existsSync(postMergePath);
     // An existing pre-commit is hard enforcement; the companions being absent
     // must not downgrade the summary to "optional".
+    // implements REQ-cli-doctor
+    // Without the hooks kibi init installs, a new branch starts with an empty
+    // store (post-checkout compiles it) and commits skip kibi check --staged.
     if (!postCheckoutExists && !postMergeExists && !existsSync(preCommitPath)) {
         return {
             passed: true,
-            message: `Not installed (optional)${hooksPathSuffix()}`,
+            warning: true,
+            message: `Not installed: a new branch is not compiled on checkout and commits skip 'kibi check --staged'${hooksPathSuffix()}`,
+            remediation: "Run: kibi init (installs the git hooks)",
         };
     }
     if (postCheckoutExists && postMergeExists) {

package/dist/commands/prove.js

@@ -279,7 +279,7 @@ export async function proveCommand(options, deps = {}) {
         for (const [integrationId, tests] of groups) {
             const integration = resolveIntegration(integrations.integrations, integrationId);
             if (!integration) {
-                failures.push(`integration '${integrationId}' (required by ${tests.map((t) => t.id).join(", ")}) is not configured in .kb/proof/integrations.json`);
+                failures.push(`integration '${integrationId}' (required by ${tests.map((t) => t.id).join(", ")}) is not configured in .kb/proof/integrations.json; plan it with kibi proof inspect --update ${integrationId} --json and apply the plan with kb_apply_plan`);
                 continue;
             }
             const commandArgv = [...integration.command];

package/dist/operations/modeling/model-requirement.d.ts

@@ -1,8 +1,13 @@
+import { type StrictWriteSet } from "../../public/check-types.js";
 import type { OperationContext } from "../../public/operations/runtime-types.js";
 import { strictWriteSetToApplyPlan, writeSetPrimaryEntityId } from "./requirement-applyplan.js";
 import { estimateNormativeSignalConfidence, extractRequirementClaim } from "./requirement-modeler.js";
 import type { ModelRequirementArgs, ModelRequirementResult } from "./requirement-types.js";
 export type { ModelRequirementArgs, ModelRequirementResult, } from "./requirement-types.js";
+export declare function reuseExistingSubject(writeSet: StrictWriteSet, existingFactId: string): {
+    writeSet: StrictWriteSet;
+    replacedSubjectId: string | null;
+};
 export { estimateNormativeSignalConfidence, extractRequirementClaim, strictWriteSetToApplyPlan, writeSetPrimaryEntityId, };
 export declare function annotateModelRequirementStep(step: Record<string, unknown>, context: {
     claimKey: string;

package/dist/operations/modeling/model-requirement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-requirement.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/model-requirement.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAgBjF,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAUhC,YAAY,EACV,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAkNhC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,CAAC;AAIF,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACA,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+CzB;AAwOD,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,oBAAoB,EAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,sBAAsB,CAAC,CAgHjC;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAajC"}
+{"version":3,"file":"model-requirement.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/model-requirement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAiBjF,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAUhC,YAAY,EACV,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAuBhC,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,GACrB;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAuBhE;AA2KD,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,CAAC;AAIF,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACA,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+CzB;AAwOD,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,oBAAoB,EAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,sBAAsB,CAAC,CAwHjC;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAajC"}

package/dist/operations/modeling/model-requirement.js

@@ -1,6 +1,6 @@
 import { buildStrictWriteSet, } from "../../public/check-types.js";
 import { readKbManifestStatus } from "../../utils/kb-manifest.js";
-import { isConventionalSubjectKey, normalizeSubjectKey, } from "../../utils/strict-modeling.js";
+import { factSourcePath, isConventionalSubjectKey, normalizeSubjectKey, } from "../../utils/strict-modeling.js";
 import { modeledClaimRole, normalizeSemanticClause, semanticClaimKey, } from "../semantic-advisor/clauses.js";
 import { detectConditionalRule } from "../semantic-advisor/conditional-rules.js";
 import { advisorPropositionRole } from "../semantic-advisor/proposition-role.js";
@@ -11,7 +11,10 @@ import { estimateNormativeSignalConfidence, extractRequirementClaim, } from "./r
 import { normalizeOptionalString, normalizeSourceFiles, } from "./requirement-utils.js";
 import { alignRequirementVocabulary, } from "./vocabulary-alignment.js";
 const NEW_SUBJECT_REVIEW_SCORE = 0.3;
-function reuseExistingSubject(writeSet, existingFactId) {
+// implements REQ-kibi-subject-vocabulary
+// The write set describes the existing subject fact, so its id and its source
+// both name that fact; the minted fact (and its file) is never created.
+export function reuseExistingSubject(writeSet, existingFactId) {
     if (!writeSet.isStrict)
         return { writeSet, replacedSubjectId: null };
     const replacedSubjectId = writeSet.subjectFact.id;
@@ -22,7 +25,11 @@ function reuseExistingSubject(writeSet, existingFactId) {
             subjectFact: {
                 ...writeSet.subjectFact,
                 id: existingFactId,
-                properties: { ...writeSet.subjectFact.properties, id: existingFactId },
+                properties: {
+                    ...writeSet.subjectFact.properties,
+                    id: existingFactId,
+                    source: factSourcePath(existingFactId),
+                },
             },
             relationships: writeSet.relationships.map((relationship) => relationship.type === "constrains"
                 ? { ...relationship, to: existingFactId }
@@ -57,10 +64,11 @@ function possibleDuplicateObservation(claimKey, statement, source, candidates) {
  * when the keys match. Otherwise the plan explicitly declares a new subject.
  */
 // implements REQ-kibi-subject-vocabulary
-async function applyVocabularyAlignment(context, extracted, claimKey) {
+async function applyVocabularyAlignment(context, extracted, claimKey, requirementId) {
     const initial = buildStrictWriteSet({
         claim: extracted.claim,
         statement: extracted.statement,
+        ...(requirementId !== undefined ? { requirementId } : {}),
     });
     const unchanged = {
         writeSet: initial,
@@ -90,6 +98,7 @@ async function applyVocabularyAlignment(context, extracted, claimKey) {
             const rebuilt = buildStrictWriteSet({
                 claim: { ...extracted.claim, subjectKey: subject.subjectKey },
                 statement: extracted.statement,
+                ...(requirementId !== undefined ? { requirementId } : {}),
             });
             ({ writeSet, replacedSubjectId } = reuseExistingSubject(rebuilt, subject.existingFactId));
         }
@@ -431,7 +440,10 @@ export async function handleKbModelRequirement(_prolog, args, workspaceRoot, con
     if (conditional?.kind === "unparsed")
         return unresolvedConditionalResult(args, extracted, conditional.reason, workspaceRoot);
     const claimKey = semanticClaimKey(extracted.statement);
-    const aligned = await applyVocabularyAlignment(context, extracted, claimKey);
+    // implements REQ-kibi-subject-vocabulary
+    // A caller-named requirement keeps its id: the strict write set updates it
+    // instead of minting REQ-AUTO-<hash>.
+    const aligned = await applyVocabularyAlignment(context, extracted, claimKey, normalizeOptionalString(args.requirementId));
     const writeSet = aligned.writeSet;
     const logicClaims = Array.from(new Set([...(args.existingLogicClaims ?? []), claimKey]));
     const plan = aligned.adjustPlan(strictWriteSetToApplyPlan(writeSet));

package/dist/operations/modeling/predicate-applicability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"predicate-applicability.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/predicate-applicability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,uBAAuB,CAAC;AAG/B,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAqW1C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,GACX,qBAAqB,CA2EvB"}
+{"version":3,"file":"predicate-applicability.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/predicate-applicability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,uBAAuB,CAAC;AAG/B,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,qBAAqB,OAAO,CAAC;AA2W1C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,GACX,qBAAqB,CA2EvB"}

package/dist/operations/modeling/predicate-applicability.js

@@ -96,7 +96,13 @@ const INTENT_RULES = {
     permission_rule: {
         allOf: [
             [/only|may|can|allowed|denied|forbidden|must\s+not|cannot/i],
-            [/delete|export|access|read|write|update|remove|manage|permission/i],
+            [
+                /delete|export|access|read|write|update|remove|manage|permission/i,
+                // A common action verb counts only right after the permission modal
+                // ("must not publish", "may approve"), so a quota such as "uploads
+                // must not exceed 10 MB" does not read as a permission.
+                /\b(?:may|can|cannot|can't|must\s+(?:not|never)|never|(?:is|are)\s+(?:not\s+)?(?:allowed|permitted|forbidden)\s+to)\s+(?:only\s+)?(?:publish|unpublish|approve|assign|view|see|edit|modify|create|submit|share|invite|upload|download|comment|post|complete|archive|restore|grant|revoke|purchase|cancel|execute|invoke|configure|moderate|ban|join|book|reserve|transfer|close|reopen|merge)\b/i,
+            ],
         ],
     },
     resource_constraint: {

package/dist/operations/modeling/predicate-applyplan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"predicate-applyplan.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/predicate-applyplan.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAEV,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAQ9B,wBAAgB,eAAe,CAC7B,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,gBAAgB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,EACvD,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,EAChC,WAAW,CAAC,EAAE;IACZ,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,GACA,mBAAmB,CAgKrB;AAGD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,mBAAmB,EAC/B,IAAI,EAAE,qBAAqB,GAC1B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0ChC;AAGD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,CAAC,EAAE,MAAM,EAClB,mBAAmB,GAAE,SAAS,MAAM,EAAO,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAuBhC;AAoBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,qBAAqB,GAC1B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwBhC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,0BAA0B,CAoE5B"}
+{"version":3,"file":"predicate-applyplan.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/predicate-applyplan.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAEV,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAQ9B,wBAAgB,eAAe,CAC7B,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,gBAAgB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,EACvD,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,EAChC,WAAW,CAAC,EAAE;IACZ,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,GACA,mBAAmB,CA2KrB;AAGD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,mBAAmB,EAC/B,IAAI,EAAE,qBAAqB,GAC1B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0ChC;AAGD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,SAAS,CAAC,EAAE,MAAM,EAClB,mBAAmB,GAAE,SAAS,MAAM,EAAO,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAuBhC;AAoBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,qBAAqB,GAC1B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwBhC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,0BAA0B,CAoE5B"}

package/dist/operations/modeling/predicate-applyplan.js

@@ -74,17 +74,27 @@ export function buildSuggestion(schema, text, subject, score, argumentBindings =
                     constrainedSubjects,
                 }),
     ]));
-    // The subject the planned predicate fact is about, when the requirement
-    // constrains subjects: the `subject` argument's value, or for a schema
-    // without one the reviewed subject, recorded as the fact's subject_key.
-    const subjectKey = constrainedSubjects.length === 0
+    // The subjects the planned predicate must be about: those the requirement
+    // constrains, or, for a requirement that is not written yet or constrains
+    // nothing, the explicit subjectHint. The hint is then the subject fact the
+    // agent is about to link, so the planned fact carries its subject_key and
+    // kb_check pairs the two once the requirement is written.
+    const plannedSubjects = constrainedSubjects.length > 0
+        ? constrainedSubjects
+        : explicitSubject
+            ? [subject]
+            : [];
+    // The subject the planned predicate fact is about: the `subject`
+    // argument's value, or for a schema without one the reviewed subject,
+    // recorded as the fact's subject_key.
+    const subjectKey = plannedSubjects.length === 0
         ? null
         : subjectArgument >= 0
             ? (predicateArgs[subjectArgument] ?? null)
             : (reviewedSubject ?? null);
-    const subjectPairing = constrainedSubjects.length === 0
+    const subjectPairing = plannedSubjects.length === 0
         ? "not_required"
-        : subjectKey !== null && constrainedSubjects.includes(subjectKey)
+        : subjectKey !== null && plannedSubjects.includes(subjectKey)
             ? "paired"
             : "unpaired";
     const bindingProvenance = aggregateBindingProvenance(Object.values(bindingProvenanceByArgument));

package/dist/operations/modeling/predicate-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"predicate-utils.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/predicate-utils.ts"],"names":[],"mappings":"AAKA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQlD;AAGD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAGpB;AAGD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,MAAM,CAIR;AAGD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM5D;AAGD,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM1C;AAGD,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAO9D;AAED;;;;;;GAMG;AAEH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,CAAC,EAAE,QAAQ,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC,GACD,MAAM,CAeR;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C;AAGD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAGD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAGD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAGD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAOT;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAGD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAclD;AAGD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM9C;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI9C;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C"}
+{"version":3,"file":"predicate-utils.d.ts","sourceRoot":"","sources":["../../../src/operations/modeling/predicate-utils.ts"],"names":[],"mappings":"AAMA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQlD;AAGD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAGpB;AAGD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,MAAM,CAIR;AAGD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM5D;AAGD,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM1C;AAGD,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAO9D;AAED;;;;;;GAMG;AAEH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,WAAW,CAAC,EAAE,QAAQ,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC,GACD,MAAM,CAeR;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C;AAGD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAGD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAGD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAGD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAOT;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAGD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtD;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAclD;AAGD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM9C;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI9C;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C"}

package/dist/operations/modeling/predicate-utils.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { singularizeToken } from "../semantic-advisor/shared.js";
 const DEFAULT_MIN_SCORE = 0.35;
 // implements REQ-mcp-suggest-predicates
 export function normalizeText(text) {
@@ -114,9 +115,7 @@ export function normalizePredicateToken(value) {
 }
 // implements REQ-mcp-suggest-predicates
 export function singularize(value) {
-    if (["changes", "status", "results"].includes(value))
-        return value;
-    return value.endsWith("s") && value.length > 3 ? value.slice(0, -1) : value;
+    return singularizeToken(value, ["changes", "status", "results"]);
 }
 // implements REQ-mcp-suggest-predicates
 export function normalizeSubjectKey(value) {

package/dist/operations/planning/apply-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-plan.d.ts","sourceRoot":"","sources":["../../../src/operations/planning/apply-plan.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAEV,gBAAgB,EAGjB,MAAM,0CAA0C,CAAC;AAQlD,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,uBAAuB,CAAC;AA+D/B,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EAGhB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,eAAO,MAAM,yBAAyB,EAAG,2BAAoC,CAAC;AA6G9E,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACnE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,IAAI,CAaN;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,SAAS,cAAoB,GAC5B,eAAe,EAAE,CA2CnB;AA8zBD;;;;;;GAMG;AAEH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAyqDD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,eAAe,CAAC;CACpC,CAAC,CAkDD"}
+{"version":3,"file":"apply-plan.d.ts","sourceRoot":"","sources":["../../../src/operations/planning/apply-plan.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAEV,gBAAgB,EAGjB,MAAM,0CAA0C,CAAC;AASlD,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,uBAAuB,CAAC;AAgE/B,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EAGhB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,eAAO,MAAM,yBAAyB,EAAG,2BAAoC,CAAC;AA6G9E,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACnE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,IAAI,CAaN;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,SAAS,cAAoB,GAC5B,eAAe,EAAE,CA2CnB;AA8zBD;;;;;;GAMG;AAEH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAyqDD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,eAAe,CAAC;CACpC,CAAC,CAkDD"}

package/dist/operations/planning/apply-plan.js

@@ -4,12 +4,14 @@ import { OperationError } from "../../cli-errors.js";
 import { branchEnsureCommand, branchMigrateCommand, branchRecoverCommand, } from "../../commands/branch.js";
 import { migrateCommand } from "../../commands/migrate.js";
 import { syncCommand } from "../../commands/sync.js";
+import { PROOF_INTEGRATION_CONFIGURE, applyProofIntegrationAction, } from "../../proof/integration-plan.js";
 import { loadEntities } from "../../public/operations/discovery-entities.js";
 import { executeStatus } from "../../public/operations/discovery-executors.js";
 import { PREDICATE_SCHEMA_ALIGNMENT_CODE, migrationPlanHash, } from "../../public/operations/migration-plan.js";
 import { readMigrationConfigStatus } from "../../public/operations/migration-plan.js";
 import { readWorkspaceSnapshot } from "../../public/operations/workspace-snapshot.js";
 import { computeShardPath, renderShardWithRelationship, } from "../../relationships/shards.js";
+import { BRANCH_STORE_NOT_COMPILED } from "../../utils/branch-store.js";
 import { canonicalFilesystemPath } from "../../utils/canonical-path.js";
 import { isDerivedKbPath } from "../../utils/kb-paths.js";
 import { bootstrapEmptyKbSnapshotId, bootstrapPlanHash, } from "../bootstrap/types.js";
@@ -22,6 +24,7 @@ import { canonicalSourcePath, renderSourceDocument, } from "../mutation/source-a
 import { assertRelationshipShardContained, executeUpsert, validateUpsertForCommit, } from "../mutation/upsert.js";
 import { acquireWorkspaceMutationLock, releaseWorkspaceMutationLock, } from "../mutation/workspace-mutation-lock.js";
 import { compilePlanHash, isBlockingWitness, parseWhatIfAnalysis, planWhatIfGoal, } from "./compile-intent.js";
+import { MigrationActionRefusedError } from "./migration-refusal.js";
 // implements REQ-kibi-change-to-proof-plan-compiler-v2
 export const PLAN_APPLY_RESULT_VERSION = "kibi.plan-apply-result.v1";
 const ENTITY_TYPES = new Set([
@@ -2119,6 +2122,9 @@ async function applyMigrationPlan(args, context, onCommitted = () => undefined)
     }
     const results = [];
     let failed = false;
+    // Failures that changed nothing (a precondition refused the action).
+    let refusals = 0;
+    let failures = 0;
     for (const action of actions) {
         if (failed) {
             results.push({
@@ -2139,6 +2145,9 @@ async function applyMigrationPlan(args, context, onCommitted = () => undefined)
         }
         catch (error) {
             failed = true;
+            failures += 1;
+            if (error instanceof MigrationActionRefusedError)
+                refusals += 1;
             results.push({
                 actionId: action.id,
                 outcome: "failed",
@@ -2188,10 +2197,15 @@ async function applyMigrationPlan(args, context, onCommitted = () => undefined)
             });
         }
     }
+    // refused: nothing was applied and every failure was a refusal, so the
+    // workspace is as it was; reconciliation_required: an action failed
+    // without being refused, so its effect must be inspected.
     const outcome = failed
         ? results.some((result) => result.outcome === "applied")
             ? "partially_applied"
-            : "reconciliation_required"
+            : failures > 0 && refusals === failures
+                ? "refused"
+                : "reconciliation_required"
         : "applied";
     const kbState = finalStatus.branchAttachment?.migrationRequired
         ? "legacy_compat"
@@ -2235,7 +2249,7 @@ async function applyMigrationPlan(args, context, onCommitted = () => undefined)
         closeout: {
             taskOutcome: outcome === "applied"
                 ? "complete"
-                : outcome === "reconciliation_required"
+                : outcome === "reconciliation_required" || outcome === "refused"
                     ? "blocked"
                     : "interim",
             kbState,
@@ -2248,7 +2262,11 @@ async function applyMigrationPlan(args, context, onCommitted = () => undefined)
         content: [
             {
                 type: "text",
-                text: `${outcome === "applied" ? "Applied" : "Stopped after"} migration plan ${args.plan.planHash.slice(0, 12)}.`,
+                text: outcome === "applied"
+                    ? `Applied migration plan ${args.plan.planHash.slice(0, 12)}.`
+                    : outcome === "refused"
+                        ? `Refused migration plan ${args.plan.planHash.slice(0, 12)}; nothing was changed.`
+                        : `Stopped after migration plan ${args.plan.planHash.slice(0, 12)}.`,
             },
         ],
         structuredContent: payload,
@@ -2278,6 +2296,15 @@ async function applyMigrationAction(action, context) {
         case "missing_exact_branch_store":
             await branchEnsureCommand({ workspaceRoot: context.workspaceRoot });
             return;
+        // implements REQ-cli-status-pre-first-sync
+        case BRANCH_STORE_NOT_COMPILED: {
+            const result = await syncCommand({
+                workspaceRoot: context.workspaceRoot,
+            });
+            if (!result.success)
+                throw new Error("Compiling the branch store (kibi sync) did not complete successfully.");
+            return;
+        }
         case "damaged_exact_branch_store":
             await branchRecoverCommand({
                 apply: true,
@@ -2307,12 +2334,16 @@ async function applyMigrationAction(action, context) {
         case PREDICATE_SCHEMA_ALIGNMENT_CODE:
             await applyPredicateSchemaAlignment(action, context);
             return;
+        // implements REQ-kibi-verification-evidence-contract
+        case PROOF_INTEGRATION_CONFIGURE:
+            applyProofIntegrationAction(action, context.workspaceRoot);
+            return;
         default:
             if (SCHEMA6_AUTOMATIC_CODES.has(action.code)) {
                 await applySchema6MigrationAction(action, context);
                 return;
             }
-            throw new Error(`Migration action '${action.code}' has no automatic executor.`);
+            throw new MigrationActionRefusedError(`Migration action '${action.code}' has no automatic executor.`);
     }
 }
 /**
@@ -2323,10 +2354,10 @@ async function applyMigrationAction(action, context) {
 async function applyPredicateSchemaAlignment(action, context) {
     const invocation = action.invocation;
     if (invocation.kind !== "operation" || invocation.name !== "kb_upsert")
-        throw new Error("Predicate schema alignment requires its planned kb_upsert invocation.");
+        throw new MigrationActionRefusedError("Predicate schema alignment requires its planned kb_upsert invocation.");
     const input = asUpsert(invocation.input);
     if (input.type !== "fact")
-        throw new Error("Predicate schema alignment only rewrites fact entities.");
+        throw new MigrationActionRefusedError("Predicate schema alignment only rewrites fact entities.");
     const prolog = context.prolog ?? (await context.ensureProlog?.());
     if (!prolog)
         throw new Error("Predicate schema alignment requires a Prolog runtime.");
@@ -2348,6 +2379,6 @@ async function applyPredicateSchemaAlignment(action, context) {
             typeof rewrite.index === "number" &&
             currentArgs[rewrite.index] === rewrite.from);
     if (!unchanged)
-        throw new Error(`Predicate fact ${input.id} changed since planning; rerun kibi check and approve the new plan.`);
+        throw new MigrationActionRefusedError(`Predicate fact ${input.id} changed since planning; rerun kibi check and approve the new plan.`);
     await executeUpsert(input, operationContext);
 }