kibi-cli 2.2.0 → 2.3.0

package/dist/public/operations/impact-review-preparation.js

@@ -0,0 +1,379 @@
+import { execFileSync } from "node:child_process";
+import { createMaintenanceSourceAnalysisService, fingerprintMaintenanceSourceSet, readSnapshotSourceConfig, } from "../../plugins/maintenance-source-analysis.js";
+import { analyzeSourceChanges } from "../../plugins/source-change-analysis.js";
+import { analysisObligation } from "../../traceability/analysis-gate.js";
+import { captureDiffSnapshot, captureStagedSnapshot, } from "../../traceability/git-change-snapshot.js";
+import { fingerprintImpactEvaluator, prepareImpactReview, } from "../../traceability/impact-evaluator.js";
+import { IMPACT_EVALUATOR_VERSION, IMPACT_REVIEW_VERSION, canonicalJson, } from "../../traceability/impact-review.js";
+import impactReviewRecordSchema from "../../traceability/impact-review.schema.json" with {
+    type: "json"
+};
+import { readSnapshotKnowledge } from "../../traceability/snapshot-knowledge.js";
+const FULL_COMMIT_OID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SEMANTIC_RELATIONSHIPS = new Set([
+    "constrains",
+    "depends_on",
+    "requires_predicate",
+    "requires_property",
+    "requires_rule",
+    "specified_by",
+    "supersedes",
+    "validates",
+    "verified_by",
+]);
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function gitText(root, args) {
+    return execFileSync("git", [...args], {
+        cwd: root,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"],
+    }).trim();
+}
+function resolveCommit(root, oid) {
+    return gitText(root, [
+        "rev-parse",
+        "--verify",
+        "--end-of-options",
+        `${oid}^{commit}`,
+    ]);
+}
+function treeForCommit(root, oid) {
+    return gitText(root, [
+        "rev-parse",
+        "--verify",
+        "--end-of-options",
+        `${oid}^{tree}`,
+    ]);
+}
+function assertExplicitDiffUnchanged(root, input, snapshot) {
+    const baseCommit = resolveCommit(root, input.baseCommit);
+    const headCommit = resolveCommit(root, input.headCommit);
+    if (baseCommit !== input.baseCommit ||
+        headCommit !== input.headCommit ||
+        snapshot.headCommit !== baseCommit ||
+        treeForCommit(root, baseCommit) !== snapshot.baseTree ||
+        treeForCommit(root, headCommit) !== snapshot.headTree)
+        throw new Error("Selected diff commit or tree identity changed during impact review preparation");
+}
+function snapshotIdentity(scope, snapshot) {
+    return {
+        kind: scope.kind,
+        baseCommit: scope.kind === "diff" ? scope.baseCommit : snapshot.headCommit,
+        baseTree: snapshot.baseTree,
+        headCommit: scope.kind === "diff" ? scope.headCommit : null,
+        headTree: snapshot.headTree,
+        headTreeSource: scope.kind === "diff" ? "commit" : "index",
+    };
+}
+function plainEntity(entity) {
+    return Object.fromEntries(Object.entries(entity)
+        .filter(([key]) => !["created_at", "updated_at", "proof_receipts"].includes(key))
+        .sort(([left], [right]) => compareText(left, right)));
+}
+function entityMap(snapshot, tree) {
+    return new Map(readSnapshotKnowledge(snapshot.readGit, tree, snapshot.readBlobs).map((row) => [
+        row.entity.id,
+        {
+            entity: row.entity,
+            relationships: row.relationships.map(({ type, from, to }) => ({
+                type,
+                from,
+                to,
+            })),
+            ...(row.sourceFile ? { sourceFile: row.sourceFile } : {}),
+        },
+    ]));
+}
+function requirementContext(id, rows, entities, allRows) {
+    const row = rows.get(id);
+    const binding = entities.get(id);
+    if (!row || !binding) {
+        return {
+            id,
+            state: "absent",
+            entityFingerprint: null,
+            artifactPath: null,
+            sourcePath: null,
+            relationships: [],
+            relatedEntities: [],
+        };
+    }
+    const relationships = [...allRows.entries()]
+        .flatMap(([ownerId, candidate]) => candidate.relationships
+        .filter((relationship) => SEMANTIC_RELATIONSHIPS.has(relationship.type) &&
+        (relationship.from === id || relationship.to === id))
+        .map((relationship) => ({ ownerId, ...relationship })))
+        .sort((left, right) => compareText(canonicalJson(left), canonicalJson(right)));
+    const relatedIds = [
+        ...new Set(relationships
+            .flatMap(({ from, to }) => [from, to])
+            .filter((relatedId) => relatedId !== id)),
+    ].sort();
+    return {
+        id,
+        state: "present",
+        entityFingerprint: binding.fingerprint,
+        artifactPath: binding.artifactPath,
+        sourcePath: binding.sourcePath ?? row.sourceFile ?? null,
+        entity: plainEntity(row.entity),
+        relationships: relationships.map(({ ownerId: _ownerId, ...edge }) => edge),
+        relatedEntities: relatedIds.flatMap((relatedId) => {
+            const related = allRows.get(relatedId);
+            if (!related)
+                return [];
+            const relatedBinding = entities.get(relatedId);
+            return [
+                {
+                    id: relatedId,
+                    type: related.entity.type ?? null,
+                    entityFingerprint: relatedBinding?.fingerprint ?? null,
+                    artifactPath: relatedBinding?.artifactPath ?? null,
+                    sourcePath: relatedBinding?.sourcePath ?? related.sourceFile ?? null,
+                    entity: plainEntity(related.entity),
+                },
+            ];
+        }),
+    };
+}
+function requirementScopes(prepared, snapshot) {
+    const before = entityMap(snapshot, snapshot.baseTree);
+    const after = entityMap(snapshot, snapshot.headTree);
+    return [...prepared.scopedRequirementIdsByPath.entries()]
+        .sort(([left], [right]) => compareText(left, right))
+        .map(([path, requirementIds]) => ({
+        path,
+        requirementIds: [...requirementIds].sort(),
+        before: [...requirementIds]
+            .sort()
+            .map((id) => requirementContext(id, before, prepared.baseEntities, before)),
+        after: [...requirementIds]
+            .sort()
+            .map((id) => requirementContext(id, after, prepared.headEntities, after)),
+    }));
+}
+function residualReviewObligations(prepared) {
+    const obligations = [];
+    for (const file of prepared.files) {
+        for (const side of ["before", "after"]) {
+            const analysis = file[side]?.analysis;
+            if (!analysis)
+                continue;
+            const obligation = analysisObligation(side, analysis, file.newHunkRanges);
+            if (obligation.kind === "unsupported_review") {
+                obligations.push({
+                    path: file.path,
+                    side,
+                    status: analysis.status,
+                    diagnosticCodes: [...analysis.diagnosticCodes].sort(),
+                    kind: "unsupported_review",
+                    wholeFile: true,
+                    pending: true,
+                });
+                continue;
+            }
+            if (obligation.kind !== "partial_review")
+                continue;
+            const limitationClasses = new Set();
+            for (const code of analysis.diagnosticCodes) {
+                const allowed = prepared.policy.allowedPartial.find((entry) => entry.providerId === analysis.providerId &&
+                    entry.providerFingerprint === analysis.providerFingerprint &&
+                    entry.diagnosticCode === code);
+                if (allowed)
+                    limitationClasses.add(allowed.limitationClass);
+            }
+            const limitationClass = [...limitationClasses][0];
+            if (limitationClasses.size !== 1 || limitationClass === undefined)
+                throw new Error(`Partial review obligation is not covered by the trusted policy: ${file.path} (${side})`);
+            obligations.push({
+                path: file.path,
+                side,
+                status: analysis.status,
+                diagnosticCodes: [...analysis.diagnosticCodes].sort(),
+                kind: "partial_review",
+                limitationClass,
+                ranges: obligation.ranges.map((range) => ({ ...range })),
+                pending: true,
+            });
+        }
+    }
+    return obligations.sort((left, right) => compareText(`${left.path}\0${left.side}`, `${right.path}\0${right.side}`));
+}
+function cloneRecordSchema() {
+    return JSON.parse(JSON.stringify(impactReviewRecordSchema));
+}
+function cloneRecordTemplateSchema() {
+    const schema = cloneRecordSchema();
+    schema.$id = "urn:kibi:impact-review-authoring-record-template:v1";
+    const properties = schema.properties;
+    properties.reviewedAt = { type: "null" };
+    const definitions = schema.$defs;
+    const reviewer = definitions.reviewer;
+    reviewer.properties.id = { type: "null" };
+    const file = definitions.file;
+    file.properties.analysisReviews = {
+        anyOf: [file.properties.analysisReviews, { type: "null" }],
+    };
+    file.properties.decision = {
+        anyOf: [file.properties.decision, { type: "null" }],
+    };
+    return schema;
+}
+function authoringContract(prepared) {
+    const recordHeaders = {
+        contractVersion: IMPACT_REVIEW_VERSION,
+        policy: {
+            id: prepared.policy.id,
+            version: prepared.policy.version,
+            fingerprint: prepared.policyFingerprint,
+        },
+        evaluator: {
+            contractVersion: IMPACT_EVALUATOR_VERSION,
+            fingerprint: prepared.evaluatorFingerprint,
+        },
+        scope: {
+            fingerprint: prepared.scopeFingerprint,
+            knowledgeFingerprint: prepared.knowledgeFingerprint,
+            providerSetFingerprint: prepared.providerSetFingerprint,
+        },
+    };
+    return {
+        templateVersion: "kibi.impact-review-authoring-template.v1",
+        isValidImpactReviewRecord: false,
+        instructions: "This template is reviewer input only. Author every decision, required analysis review, rationale, reviewer id, and reviewedAt before strict record validation. It is not an approval, signature, or proof receipt.",
+        authoredFields: [
+            "files[].decision",
+            "files[].analysisReviews",
+            "reviewer.id",
+            "reviewedAt",
+        ],
+        recordSchema: cloneRecordSchema(),
+        decisionSchema: { $ref: "urn:kibi:impact-review:v1#/$defs/decision" },
+        analysisReviewSchema: {
+            oneOf: [
+                { $ref: "urn:kibi:impact-review:v1#/$defs/unsupportedReview" },
+                { $ref: "urn:kibi:impact-review:v1#/$defs/partialReview" },
+            ],
+        },
+        templateSchema: {
+            $schema: "https://json-schema.org/draft/2020-12/schema",
+            $id: "urn:kibi:impact-review-authoring-template:v1",
+            type: "object",
+            additionalProperties: false,
+            required: ["templateVersion", "isValidImpactReviewRecord", "record"],
+            properties: {
+                templateVersion: {
+                    const: "kibi.impact-review-authoring-template.v1",
+                },
+                isValidImpactReviewRecord: { const: false },
+                record: cloneRecordTemplateSchema(),
+            },
+        },
+        recordTemplate: {
+            templateVersion: "kibi.impact-review-authoring-template.v1",
+            isValidImpactReviewRecord: false,
+            record: {
+                ...recordHeaders,
+                reviewer: { id: null, source: "self-claimed-local" },
+                reviewedAt: null,
+                files: prepared.files
+                    .slice()
+                    .sort((left, right) => compareText(left.path, right.path))
+                    .map((file) => ({
+                    ...withoutAnalysisReviews(file),
+                    analysisReviews: null,
+                    decision: null,
+                })),
+            },
+        },
+    };
+}
+function withoutAnalysisReviews(file) {
+    const { analysisReviews: _analysisReviews, ...evidence } = file;
+    return evidence;
+}
+function completeFileEvidence(prepared) {
+    return prepared.files
+        .slice()
+        .sort((left, right) => compareText(left.path, right.path))
+        .map((file) => withoutAnalysisReviews(file));
+}
+function buildPreparation(scope, snapshot, prepared) {
+    return {
+        preparationVersion: "kibi.impact-review-preparation.v1",
+        status: "ready_for_authoring",
+        snapshot: snapshotIdentity(scope, snapshot),
+        recordHeaders: {
+            contractVersion: IMPACT_REVIEW_VERSION,
+            policy: {
+                id: prepared.policy.id,
+                version: prepared.policy.version,
+                fingerprint: prepared.policyFingerprint,
+            },
+            evaluator: {
+                contractVersion: IMPACT_EVALUATOR_VERSION,
+                fingerprint: prepared.evaluatorFingerprint,
+            },
+            scope: {
+                fingerprint: prepared.scopeFingerprint,
+                knowledgeFingerprint: prepared.knowledgeFingerprint,
+                providerSetFingerprint: prepared.providerSetFingerprint,
+            },
+        },
+        files: completeFileEvidence(prepared),
+        requirementScopes: requirementScopes(prepared, snapshot),
+        residualReviewObligations: residualReviewObligations(prepared),
+        authorship: authoringContract(prepared),
+    };
+}
+function validateDiffInput(scope) {
+    if (scope.kind === "diff" &&
+        (!FULL_COMMIT_OID.test(scope.baseCommit) ||
+            !FULL_COMMIT_OID.test(scope.headCommit)))
+        throw new Error("Diff scope requires full lowercase hexadecimal baseCommit and headCommit object IDs");
+}
+export async function executePrepareImpactReview(input, context) {
+    validateDiffInput(input.scope);
+    const workspaceRoot = context.workspaceRoot;
+    const snapshot = input.scope.kind === "staged"
+        ? captureStagedSnapshot(workspaceRoot)
+        : captureDiffSnapshot(workspaceRoot, input.scope.baseCommit, input.scope.headCommit);
+    if (input.scope.kind === "diff")
+        assertExplicitDiffUnchanged(workspaceRoot, input.scope, snapshot);
+    const trustedConfig = readSnapshotSourceConfig(snapshot, snapshot.baseTree);
+    const providerSetFingerprint = fingerprintMaintenanceSourceSet(workspaceRoot, trustedConfig);
+    const evaluatorFingerprint = fingerprintImpactEvaluator();
+    const service = createMaintenanceSourceAnalysisService(workspaceRoot, trustedConfig);
+    const analyses = await analyzeSourceChanges(snapshot.inventory, service);
+    const prepared = prepareImpactReview(snapshot, {
+        providerSetFingerprint,
+        evaluatorFingerprint,
+        analyses,
+    });
+    // Build all KB-derived context before the final snapshot/closure checks.
+    // Projection can be substantial, so checking only before it could return
+    // evidence for a workspace or evaluator closure that changed mid-projection.
+    const data = buildPreparation(input.scope, snapshot, prepared);
+    snapshot.assertUnchanged();
+    if (input.scope.kind === "diff")
+        assertExplicitDiffUnchanged(workspaceRoot, input.scope, snapshot);
+    const finalProviderFingerprint = fingerprintMaintenanceSourceSet(workspaceRoot, trustedConfig);
+    const finalEvaluatorFingerprint = fingerprintImpactEvaluator();
+    if (finalProviderFingerprint !== providerSetFingerprint ||
+        finalEvaluatorFingerprint !== evaluatorFingerprint)
+        throw new Error("Trusted source-provider or impact-evaluator closure changed during impact review preparation");
+    snapshot.assertUnchanged();
+    if (input.scope.kind === "diff")
+        assertExplicitDiffUnchanged(workspaceRoot, input.scope, snapshot);
+    return {
+        content: [
+            {
+                type: "text",
+                text: `Prepared complete ${input.scope.kind} impact-review authoring inputs; every review decision remains unauthored.`,
+            },
+        ],
+        structuredContent: data,
+    };
+}

package/dist/public/operations/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./catalog.js";
 export * from "./check-executor.js";
+export * from "./impact-review-preparation.js";
 export * from "./discovery-entities.js";
 export * from "./discovery-executors.js";
 export * from "./runtime-types.js";
@@ -10,6 +11,7 @@ export * from "./migration-plan.js";
 export * from "./symbol-repair-plan.js";
 export * from "./specs/bootstrap.js";
 export * from "./specs/check.js";
+export * from "./specs/impact-review-preparation.js";
 export * from "./specs/discovery.js";
 export * from "./specs/modeling.js";
 export * from "./specs/planning.js";

package/dist/public/operations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/public/operations/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,4CAA4C,CAAC;AAC3D,mBAAmB,qCAAqC,CAAC;AACzD,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/public/operations/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sCAAsC,CAAC;AACrD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,4CAA4C,CAAC;AAC3D,mBAAmB,qCAAqC,CAAC;AACzD,cAAc,mBAAmB,CAAC"}

package/dist/public/operations/index.js

@@ -1,5 +1,6 @@
 export * from "./catalog.js";
 export * from "./check-executor.js";
+export * from "./impact-review-preparation.js";
 export * from "./discovery-entities.js";
 export * from "./discovery-executors.js";
 export * from "./runtime-types.js";
@@ -10,6 +11,7 @@ export * from "./migration-plan.js";
 export * from "./symbol-repair-plan.js";
 export * from "./specs/bootstrap.js";
 export * from "./specs/check.js";
+export * from "./specs/impact-review-preparation.js";
 export * from "./specs/discovery.js";
 export * from "./specs/modeling.js";
 export * from "./specs/planning.js";

package/dist/public/operations/node-ports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-ports.d.ts","sourceRoot":"","sources":["../../../src/public/operations/node-ports.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE/E,KAAK,kBAAkB,GAAG,cAAc,GAAG;IACzC,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,KACjE,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AAEF,KAAK,WAAW,GAAG,OAAO,GAAG;IAC3B,QAAQ,CAAC,YAAY,EAAE,CACrB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,KACrB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AAkMF,eAAO,MAAM,cAAc,EAAE,kBAoB5B,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,WAiBrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,WAEzB,CAAC"}
+{"version":3,"file":"node-ports.d.ts","sourceRoot":"","sources":["../../../src/public/operations/node-ports.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE/E,KAAK,kBAAkB,GAAG,cAAc,GAAG;IACzC,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,KACjE,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AAEF,KAAK,WAAW,GAAG,OAAO,GAAG;IAC3B,QAAQ,CAAC,YAAY,EAAE,CACrB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,KACrB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AA2JF,eAAO,MAAM,cAAc,EAAE,kBAoB5B,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,WAiBrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,WAEzB,CAAC"}

package/dist/public/operations/node-ports.js

@@ -6,6 +6,7 @@ import path from "node:path";
 import { promisify } from "node:util";
 import fg from "fast-glob";
 import { createRepoIgnorePolicy } from "../ignore-policy.js";
+import { snapshotFileContent } from "./proof-receipt-projection.js";
 const execFileAsync = promisify(execFile);
 const SNAPSHOT_EXCLUDED_PREFIXES = [
     ".changeset/",
@@ -36,41 +37,6 @@ const ALWAYS_IGNORED_GLOBS = [
 function includedSnapshotPath(relativePath) {
     return !SNAPSHOT_EXCLUDED_PREFIXES.some((prefix) => relativePath === prefix.slice(0, -1) || relativePath.startsWith(prefix));
 }
-function withoutProofReceiptFrontmatter(content) {
-    const lines = content.match(/[^\n]*\n|[^\n]+$/g) ?? [];
-    if (lines[0]?.trim() !== "---")
-        return content;
-    let inFrontmatter = true;
-    let skippingReceipts = false;
-    const retained = [];
-    for (const [index, line] of lines.entries()) {
-        const trimmed = line.trim();
-        if (index > 0 && inFrontmatter && trimmed === "---") {
-            inFrontmatter = false;
-            skippingReceipts = false;
-            retained.push(line);
-            continue;
-        }
-        if (inFrontmatter && /^proof_receipts\s*:/.test(line)) {
-            skippingReceipts = true;
-            continue;
-        }
-        if (inFrontmatter &&
-            skippingReceipts &&
-            /^[A-Za-z_][A-Za-z0-9_-]*\s*:/.test(line)) {
-            skippingReceipts = false;
-        }
-        if (!skippingReceipts)
-            retained.push(line);
-    }
-    return retained.join("");
-}
-function snapshotFileContent(relativePath, content) {
-    if (relativePath.endsWith(".md")) {
-        return Buffer.from(withoutProofReceiptFrontmatter(content.toString("utf8")));
-    }
-    return content;
-}
 /**
  * A tracked markdown file whose only change is proof-receipt frontmatter
  * cannot alter the snapshot hash (receipts are stripped before hashing), so it

package/dist/public/operations/proof-receipt-projection.d.ts

@@ -0,0 +1,5 @@
+/** Remove only the top-level proof-receipt frontmatter block, byte-for-byte otherwise. */
+export declare function withoutProofReceiptFrontmatter(content: string): string;
+/** Match the workspace proof snapshot's markdown receipt projection exactly. */
+export declare function snapshotFileContent(relativePath: string, content: Buffer): Buffer;
+//# sourceMappingURL=proof-receipt-projection.d.ts.map

package/dist/public/operations/proof-receipt-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-receipt-projection.d.ts","sourceRoot":"","sources":["../../../src/public/operations/proof-receipt-projection.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA4BtE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,MAAM,CAGR"}

package/dist/public/operations/proof-receipt-projection.js

@@ -0,0 +1,36 @@
+/** Remove only the top-level proof-receipt frontmatter block, byte-for-byte otherwise. */
+export function withoutProofReceiptFrontmatter(content) {
+    const lines = content.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    if (lines[0]?.trim() !== "---")
+        return content;
+    let inFrontmatter = true;
+    let skippingReceipts = false;
+    const retained = [];
+    for (const [index, line] of lines.entries()) {
+        const trimmed = line.trim();
+        if (index > 0 && inFrontmatter && trimmed === "---") {
+            inFrontmatter = false;
+            skippingReceipts = false;
+            retained.push(line);
+            continue;
+        }
+        if (inFrontmatter && /^proof_receipts\s*:/.test(line)) {
+            skippingReceipts = true;
+            continue;
+        }
+        if (inFrontmatter &&
+            skippingReceipts &&
+            /^[A-Za-z_][A-Za-z0-9_-]*\s*:/.test(line)) {
+            skippingReceipts = false;
+        }
+        if (!skippingReceipts)
+            retained.push(line);
+    }
+    return retained.join("");
+}
+/** Match the workspace proof snapshot's markdown receipt projection exactly. */
+export function snapshotFileContent(relativePath, content) {
+    if (!relativePath.endsWith(".md"))
+        return content;
+    return Buffer.from(withoutProofReceiptFrontmatter(content.toString("utf8")));
+}

package/dist/public/operations/specs/impact-review-preparation.d.ts

@@ -0,0 +1,47 @@
+import { executePrepareImpactReview } from "../impact-review-preparation.js";
+export declare const prepareImpactReviewSpec: {
+    readonly name: "kb_prepare_impact_review";
+    readonly cliName: "prepare-impact-review";
+    readonly description: "Prepare complete content-bound impact-review authoring inputs from the current staged snapshot or explicitly selected immutable Git commits. Returns strict reviewer schemas and an unauthored template; it does not decide, approve, sign, stage, or prove the review.";
+    readonly businessInputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["scope"];
+        readonly properties: {
+            readonly scope: {
+                readonly oneOf: readonly [{
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "staged";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "baseCommit", "headCommit"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "diff";
+                        };
+                        readonly baseCommit: {
+                            readonly type: "string";
+                            readonly pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$";
+                        };
+                        readonly headCommit: {
+                            readonly type: "string";
+                            readonly pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$";
+                        };
+                    };
+                }];
+            };
+        };
+    };
+    readonly requiresProlog: false;
+    readonly effects: readonly ["workspace-read", "kb-read"];
+    readonly agentVisibleStructuredData: true;
+    readonly execute: typeof executePrepareImpactReview;
+};
+//# sourceMappingURL=impact-review-preparation.d.ts.map

package/dist/public/operations/specs/impact-review-preparation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"impact-review-preparation.d.ts","sourceRoot":"","sources":["../../../../src/public/operations/specs/impact-review-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAG7E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CF,CAAC"}

package/dist/public/operations/specs/impact-review-preparation.js

@@ -0,0 +1,43 @@
+import { executePrepareImpactReview } from "../impact-review-preparation.js";
+export const prepareImpactReviewSpec = {
+    name: "kb_prepare_impact_review",
+    cliName: "prepare-impact-review",
+    description: "Prepare complete content-bound impact-review authoring inputs from the current staged snapshot or explicitly selected immutable Git commits. Returns strict reviewer schemas and an unauthored template; it does not decide, approve, sign, stage, or prove the review.",
+    businessInputSchema: {
+        type: "object",
+        additionalProperties: false,
+        required: ["scope"],
+        properties: {
+            scope: {
+                oneOf: [
+                    {
+                        type: "object",
+                        additionalProperties: false,
+                        required: ["kind"],
+                        properties: { kind: { const: "staged" } },
+                    },
+                    {
+                        type: "object",
+                        additionalProperties: false,
+                        required: ["kind", "baseCommit", "headCommit"],
+                        properties: {
+                            kind: { const: "diff" },
+                            baseCommit: {
+                                type: "string",
+                                pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$",
+                            },
+                            headCommit: {
+                                type: "string",
+                                pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$",
+                            },
+                        },
+                    },
+                ],
+            },
+        },
+    },
+    requiresProlog: false,
+    effects: ["workspace-read", "kb-read"],
+    agentVisibleStructuredData: true,
+    execute: executePrepareImpactReview,
+};

package/dist/public/operations/types.d.ts

@@ -1,6 +1,6 @@
 import type { OperationContext } from "./runtime-types.js";
 export type { OperationContext };
-export type OperationName = "kb_query" | "kb_search" | "kb_status" | "kb_skills_list" | "kb_skills_load" | "kb_skills_read" | "kb_find_gaps" | "kb_coverage" | "kb_graph" | "kb_sparql_remote" | "kb_semantic_advisor" | "kb_upsert" | "kb_validate_upsert" | "kb_delete" | "kb_check" | "kb_model_requirement" | "kb_suggest_predicates" | "kb_plan_bootstrap" | "kb_compile_intent" | "kb_apply_plan" | "kb_ingest_proof";
+export type OperationName = "kb_query" | "kb_search" | "kb_status" | "kb_skills_list" | "kb_skills_load" | "kb_skills_read" | "kb_find_gaps" | "kb_coverage" | "kb_graph" | "kb_sparql_remote" | "kb_semantic_advisor" | "kb_upsert" | "kb_validate_upsert" | "kb_delete" | "kb_check" | "kb_prepare_impact_review" | "kb_model_requirement" | "kb_suggest_predicates" | "kb_plan_bootstrap" | "kb_compile_intent" | "kb_apply_plan" | "kb_ingest_proof";
 export type OperationEffect = "local-read" | "kb-read" | "workspace-read" | "network-read" | "kb-write" | "workspace-write";
 export type OperationEffectDeclaration = Readonly<{
     kind: OperationEffect;

package/dist/public/operations/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/public/operations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,CAAC;AACjC,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,WAAW,GACX,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,UAAU,GACV,kBAAkB,GAClB,qBAAqB,GACrB,WAAW,GACX,oBAAoB,GACpB,WAAW,GACX,UAAU,GACV,sBAAsB,GACtB,uBAAuB,GACvB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,iBAAiB,CAAC;AAEtB,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;CAChC;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,wBAAwB,GAAG,OAAO,CAAC;AAE9E,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,IAAI;IACpC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,SAAS;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAC;QAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;QACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;QAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,aAAa,CAC5B,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrC,CAAC,GAAG,OAAO;IAEX,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,uEAAuE;IACvE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACjE,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE;QAChB,cAAc,CACZ,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;KAChC,CAAC,gBAAgB,CAAC,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,CAC/B,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrC,CAAC,GAAG,OAAO,IACT,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IACxB,QAAQ,CAAC,eAAe,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/public/operations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,CAAC;AACjC,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,WAAW,GACX,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,UAAU,GACV,kBAAkB,GAClB,qBAAqB,GACrB,WAAW,GACX,oBAAoB,GACpB,WAAW,GACX,UAAU,GACV,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,GACvB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,iBAAiB,CAAC;AAEtB,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;CAChC;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,wBAAwB,GAAG,OAAO,CAAC;AAE9E,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,IAAI;IACpC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,SAAS;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAC;QAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;QACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;QAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,aAAa,CAC5B,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrC,CAAC,GAAG,OAAO;IAEX,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,uEAAuE;IACvE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACjE,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE;QAChB,cAAc,CACZ,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;KAChC,CAAC,gBAAgB,CAAC,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,CAC/B,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACrC,CAAC,GAAG,OAAO,IACT,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IACxB,QAAQ,CAAC,eAAe,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D,CAAC"}

package/dist/public/skills/kibi-usage/resources/operation-access.md

@@ -23,6 +23,7 @@ per operation. Effects are authoritative for mutability and adapter annotations.
 | `kb_upsert` | `upsert` | --input JSON | write | yes | kb-write, workspace-write | peer; capability-selected | kibi.kb_upsert.v1 | yes | unsafe | no | yes |
 | `kb_delete` | `delete` | --input JSON | write | yes | kb-write, workspace-write | peer; capability-selected | kibi.kb_delete.v1 | yes | unsafe | no | yes |
 | `kb_check` | `check` | --input JSON or flags | read | yes | kb-read, workspace-read | peer; capability-selected | kibi.kb_check.v1 | no | safe | no | yes |
+| `kb_prepare_impact_review` | `prepare-impact-review` | --input JSON | read | no | workspace-read, kb-read | peer; capability-selected | kibi.kb_prepare_impact_review.v1 | no | safe | no | yes |
 | `kb_sparql_remote` | `sparql-remote` | --input JSON | read | no | network-read | peer; capability-selected | kibi.kb_sparql_remote.v1 | no | safe | yes | yes |
 | `kb_compile_intent` | `compile-intent` | --input JSON | read | yes | kb-read, workspace-read | peer; capability-selected | kibi.kb_compile_intent.v1 | no | safe | no | yes |
 | `kb_apply_plan` | `apply-plan` | --input JSON | write | yes | kb-read, kb-write, workspace-read, workspace-write | peer; capability-selected | kibi.kb_apply_plan.v1 | yes | unsafe | no | yes |