kibi-cli 2.2.0 → 2.4.0

package/dist/public/operations/impact-review-preparation.js

@@ -0,0 +1,379 @@
+import { execFileSync } from "node:child_process";
+import { createMaintenanceSourceAnalysisService, fingerprintMaintenanceSourceSet, readSnapshotSourceConfig, } from "../../plugins/maintenance-source-analysis.js";
+import { analyzeSourceChanges } from "../../plugins/source-change-analysis.js";
+import { analysisObligation } from "../../traceability/analysis-gate.js";
+import { captureDiffSnapshot, captureStagedSnapshot, } from "../../traceability/git-change-snapshot.js";
+import { fingerprintImpactEvaluator, prepareImpactReview, } from "../../traceability/impact-evaluator.js";
+import { IMPACT_EVALUATOR_VERSION, IMPACT_REVIEW_VERSION, canonicalJson, } from "../../traceability/impact-review.js";
+import impactReviewRecordSchema from "../../traceability/impact-review.schema.json" with {
+    type: "json"
+};
+import { readSnapshotKnowledge } from "../../traceability/snapshot-knowledge.js";
+const FULL_COMMIT_OID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SEMANTIC_RELATIONSHIPS = new Set([
+    "constrains",
+    "depends_on",
+    "requires_predicate",
+    "requires_property",
+    "requires_rule",
+    "specified_by",
+    "supersedes",
+    "validates",
+    "verified_by",
+]);
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function gitText(root, args) {
+    return execFileSync("git", [...args], {
+        cwd: root,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"],
+    }).trim();
+}
+function resolveCommit(root, oid) {
+    return gitText(root, [
+        "rev-parse",
+        "--verify",
+        "--end-of-options",
+        `${oid}^{commit}`,
+    ]);
+}
+function treeForCommit(root, oid) {
+    return gitText(root, [
+        "rev-parse",
+        "--verify",
+        "--end-of-options",
+        `${oid}^{tree}`,
+    ]);
+}
+function assertExplicitDiffUnchanged(root, input, snapshot) {
+    const baseCommit = resolveCommit(root, input.baseCommit);
+    const headCommit = resolveCommit(root, input.headCommit);
+    if (baseCommit !== input.baseCommit ||
+        headCommit !== input.headCommit ||
+        snapshot.headCommit !== baseCommit ||
+        treeForCommit(root, baseCommit) !== snapshot.baseTree ||
+        treeForCommit(root, headCommit) !== snapshot.headTree)
+        throw new Error("Selected diff commit or tree identity changed during impact review preparation");
+}
+function snapshotIdentity(scope, snapshot) {
+    return {
+        kind: scope.kind,
+        baseCommit: scope.kind === "diff" ? scope.baseCommit : snapshot.headCommit,
+        baseTree: snapshot.baseTree,
+        headCommit: scope.kind === "diff" ? scope.headCommit : null,
+        headTree: snapshot.headTree,
+        headTreeSource: scope.kind === "diff" ? "commit" : "index",
+    };
+}
+function plainEntity(entity) {
+    return Object.fromEntries(Object.entries(entity)
+        .filter(([key]) => !["created_at", "updated_at", "proof_receipts"].includes(key))
+        .sort(([left], [right]) => compareText(left, right)));
+}
+function entityMap(snapshot, tree) {
+    return new Map(readSnapshotKnowledge(snapshot.readGit, tree, snapshot.readBlobs).map((row) => [
+        row.entity.id,
+        {
+            entity: row.entity,
+            relationships: row.relationships.map(({ type, from, to }) => ({
+                type,
+                from,
+                to,
+            })),
+            ...(row.sourceFile ? { sourceFile: row.sourceFile } : {}),
+        },
+    ]));
+}
+function requirementContext(id, rows, entities, allRows) {
+    const row = rows.get(id);
+    const binding = entities.get(id);
+    if (!row || !binding) {
+        return {
+            id,
+            state: "absent",
+            entityFingerprint: null,
+            artifactPath: null,
+            sourcePath: null,
+            relationships: [],
+            relatedEntities: [],
+        };
+    }
+    const relationships = [...allRows.entries()]
+        .flatMap(([ownerId, candidate]) => candidate.relationships
+        .filter((relationship) => SEMANTIC_RELATIONSHIPS.has(relationship.type) &&
+        (relationship.from === id || relationship.to === id))
+        .map((relationship) => ({ ownerId, ...relationship })))
+        .sort((left, right) => compareText(canonicalJson(left), canonicalJson(right)));
+    const relatedIds = [
+        ...new Set(relationships
+            .flatMap(({ from, to }) => [from, to])
+            .filter((relatedId) => relatedId !== id)),
+    ].sort();
+    return {
+        id,
+        state: "present",
+        entityFingerprint: binding.fingerprint,
+        artifactPath: binding.artifactPath,
+        sourcePath: binding.sourcePath ?? row.sourceFile ?? null,
+        entity: plainEntity(row.entity),
+        relationships: relationships.map(({ ownerId: _ownerId, ...edge }) => edge),
+        relatedEntities: relatedIds.flatMap((relatedId) => {
+            const related = allRows.get(relatedId);
+            if (!related)
+                return [];
+            const relatedBinding = entities.get(relatedId);
+            return [
+                {
+                    id: relatedId,
+                    type: related.entity.type ?? null,
+                    entityFingerprint: relatedBinding?.fingerprint ?? null,
+                    artifactPath: relatedBinding?.artifactPath ?? null,
+                    sourcePath: relatedBinding?.sourcePath ?? related.sourceFile ?? null,
+                    entity: plainEntity(related.entity),
+                },
+            ];
+        }),
+    };
+}
+function requirementScopes(prepared, snapshot) {
+    const before = entityMap(snapshot, snapshot.baseTree);
+    const after = entityMap(snapshot, snapshot.headTree);
+    return [...prepared.scopedRequirementIdsByPath.entries()]
+        .sort(([left], [right]) => compareText(left, right))
+        .map(([path, requirementIds]) => ({
+        path,
+        requirementIds: [...requirementIds].sort(),
+        before: [...requirementIds]
+            .sort()
+            .map((id) => requirementContext(id, before, prepared.baseEntities, before)),
+        after: [...requirementIds]
+            .sort()
+            .map((id) => requirementContext(id, after, prepared.headEntities, after)),
+    }));
+}
+function residualReviewObligations(prepared) {
+    const obligations = [];
+    for (const file of prepared.files) {
+        for (const side of ["before", "after"]) {
+            const analysis = file[side]?.analysis;
+            if (!analysis)
+                continue;
+            const obligation = analysisObligation(side, analysis, file.newHunkRanges);
+            if (obligation.kind === "unsupported_review") {
+                obligations.push({
+                    path: file.path,
+                    side,
+                    status: analysis.status,
+                    diagnosticCodes: [...analysis.diagnosticCodes].sort(),
+                    kind: "unsupported_review",
+                    wholeFile: true,
+                    pending: true,
+                });
+                continue;
+            }
+            if (obligation.kind !== "partial_review")
+                continue;
+            const limitationClasses = new Set();
+            for (const code of analysis.diagnosticCodes) {
+                const allowed = prepared.policy.allowedPartial.find((entry) => entry.providerId === analysis.providerId &&
+                    entry.providerFingerprint === analysis.providerFingerprint &&
+                    entry.diagnosticCode === code);
+                if (allowed)
+                    limitationClasses.add(allowed.limitationClass);
+            }
+            const limitationClass = [...limitationClasses][0];
+            if (limitationClasses.size !== 1 || limitationClass === undefined)
+                throw new Error(`Partial review obligation is not covered by the trusted policy: ${file.path} (${side})`);
+            obligations.push({
+                path: file.path,
+                side,
+                status: analysis.status,
+                diagnosticCodes: [...analysis.diagnosticCodes].sort(),
+                kind: "partial_review",
+                limitationClass,
+                ranges: obligation.ranges.map((range) => ({ ...range })),
+                pending: true,
+            });
+        }
+    }
+    return obligations.sort((left, right) => compareText(`${left.path}\0${left.side}`, `${right.path}\0${right.side}`));
+}
+function cloneRecordSchema() {
+    return JSON.parse(JSON.stringify(impactReviewRecordSchema));
+}
+function cloneRecordTemplateSchema() {
+    const schema = cloneRecordSchema();
+    schema.$id = "urn:kibi:impact-review-authoring-record-template:v1";
+    const properties = schema.properties;
+    properties.reviewedAt = { type: "null" };
+    const definitions = schema.$defs;
+    const reviewer = definitions.reviewer;
+    reviewer.properties.id = { type: "null" };
+    const file = definitions.file;
+    file.properties.analysisReviews = {
+        anyOf: [file.properties.analysisReviews, { type: "null" }],
+    };
+    file.properties.decision = {
+        anyOf: [file.properties.decision, { type: "null" }],
+    };
+    return schema;
+}
+function authoringContract(prepared) {
+    const recordHeaders = {
+        contractVersion: IMPACT_REVIEW_VERSION,
+        policy: {
+            id: prepared.policy.id,
+            version: prepared.policy.version,
+            fingerprint: prepared.policyFingerprint,
+        },
+        evaluator: {
+            contractVersion: IMPACT_EVALUATOR_VERSION,
+            fingerprint: prepared.evaluatorFingerprint,
+        },
+        scope: {
+            fingerprint: prepared.scopeFingerprint,
+            knowledgeFingerprint: prepared.knowledgeFingerprint,
+            providerSetFingerprint: prepared.providerSetFingerprint,
+        },
+    };
+    return {
+        templateVersion: "kibi.impact-review-authoring-template.v1",
+        isValidImpactReviewRecord: false,
+        instructions: "This template is reviewer input only. Author every decision, required analysis review, rationale, reviewer id, and reviewedAt before strict record validation. It is not an approval, signature, or proof receipt.",
+        authoredFields: [
+            "files[].decision",
+            "files[].analysisReviews",
+            "reviewer.id",
+            "reviewedAt",
+        ],
+        recordSchema: cloneRecordSchema(),
+        decisionSchema: { $ref: "urn:kibi:impact-review:v1#/$defs/decision" },
+        analysisReviewSchema: {
+            oneOf: [
+                { $ref: "urn:kibi:impact-review:v1#/$defs/unsupportedReview" },
+                { $ref: "urn:kibi:impact-review:v1#/$defs/partialReview" },
+            ],
+        },
+        templateSchema: {
+            $schema: "https://json-schema.org/draft/2020-12/schema",
+            $id: "urn:kibi:impact-review-authoring-template:v1",
+            type: "object",
+            additionalProperties: false,
+            required: ["templateVersion", "isValidImpactReviewRecord", "record"],
+            properties: {
+                templateVersion: {
+                    const: "kibi.impact-review-authoring-template.v1",
+                },
+                isValidImpactReviewRecord: { const: false },
+                record: cloneRecordTemplateSchema(),
+            },
+        },
+        recordTemplate: {
+            templateVersion: "kibi.impact-review-authoring-template.v1",
+            isValidImpactReviewRecord: false,
+            record: {
+                ...recordHeaders,
+                reviewer: { id: null, source: "self-claimed-local" },
+                reviewedAt: null,
+                files: prepared.files
+                    .slice()
+                    .sort((left, right) => compareText(left.path, right.path))
+                    .map((file) => ({
+                    ...withoutAnalysisReviews(file),
+                    analysisReviews: null,
+                    decision: null,
+                })),
+            },
+        },
+    };
+}
+function withoutAnalysisReviews(file) {
+    const { analysisReviews: _analysisReviews, ...evidence } = file;
+    return evidence;
+}
+function completeFileEvidence(prepared) {
+    return prepared.files
+        .slice()
+        .sort((left, right) => compareText(left.path, right.path))
+        .map((file) => withoutAnalysisReviews(file));
+}
+function buildPreparation(scope, snapshot, prepared) {
+    return {
+        preparationVersion: "kibi.impact-review-preparation.v1",
+        status: "ready_for_authoring",
+        snapshot: snapshotIdentity(scope, snapshot),
+        recordHeaders: {
+            contractVersion: IMPACT_REVIEW_VERSION,
+            policy: {
+                id: prepared.policy.id,
+                version: prepared.policy.version,
+                fingerprint: prepared.policyFingerprint,
+            },
+            evaluator: {
+                contractVersion: IMPACT_EVALUATOR_VERSION,
+                fingerprint: prepared.evaluatorFingerprint,
+            },
+            scope: {
+                fingerprint: prepared.scopeFingerprint,
+                knowledgeFingerprint: prepared.knowledgeFingerprint,
+                providerSetFingerprint: prepared.providerSetFingerprint,
+            },
+        },
+        files: completeFileEvidence(prepared),
+        requirementScopes: requirementScopes(prepared, snapshot),
+        residualReviewObligations: residualReviewObligations(prepared),
+        authorship: authoringContract(prepared),
+    };
+}
+function validateDiffInput(scope) {
+    if (scope.kind === "diff" &&
+        (!FULL_COMMIT_OID.test(scope.baseCommit) ||
+            !FULL_COMMIT_OID.test(scope.headCommit)))
+        throw new Error("Diff scope requires full lowercase hexadecimal baseCommit and headCommit object IDs");
+}
+export async function executePrepareImpactReview(input, context) {
+    validateDiffInput(input.scope);
+    const workspaceRoot = context.workspaceRoot;
+    const snapshot = input.scope.kind === "staged"
+        ? captureStagedSnapshot(workspaceRoot)
+        : captureDiffSnapshot(workspaceRoot, input.scope.baseCommit, input.scope.headCommit);
+    if (input.scope.kind === "diff")
+        assertExplicitDiffUnchanged(workspaceRoot, input.scope, snapshot);
+    const trustedConfig = readSnapshotSourceConfig(snapshot, snapshot.baseTree);
+    const providerSetFingerprint = fingerprintMaintenanceSourceSet(workspaceRoot, trustedConfig);
+    const evaluatorFingerprint = fingerprintImpactEvaluator();
+    const service = createMaintenanceSourceAnalysisService(workspaceRoot, trustedConfig);
+    const analyses = await analyzeSourceChanges(snapshot.inventory, service);
+    const prepared = prepareImpactReview(snapshot, {
+        providerSetFingerprint,
+        evaluatorFingerprint,
+        analyses,
+    });
+    // Build all KB-derived context before the final snapshot/closure checks.
+    // Projection can be substantial, so checking only before it could return
+    // evidence for a workspace or evaluator closure that changed mid-projection.
+    const data = buildPreparation(input.scope, snapshot, prepared);
+    snapshot.assertUnchanged();
+    if (input.scope.kind === "diff")
+        assertExplicitDiffUnchanged(workspaceRoot, input.scope, snapshot);
+    const finalProviderFingerprint = fingerprintMaintenanceSourceSet(workspaceRoot, trustedConfig);
+    const finalEvaluatorFingerprint = fingerprintImpactEvaluator();
+    if (finalProviderFingerprint !== providerSetFingerprint ||
+        finalEvaluatorFingerprint !== evaluatorFingerprint)
+        throw new Error("Trusted source-provider or impact-evaluator closure changed during impact review preparation");
+    snapshot.assertUnchanged();
+    if (input.scope.kind === "diff")
+        assertExplicitDiffUnchanged(workspaceRoot, input.scope, snapshot);
+    return {
+        content: [
+            {
+                type: "text",
+                text: `Prepared complete ${input.scope.kind} impact-review authoring inputs; every review decision remains unauthored.`,
+            },
+        ],
+        structuredContent: data,
+    };
+}

package/dist/public/operations/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./catalog.js";
 export * from "./check-executor.js";
+export * from "./impact-review-preparation.js";
 export * from "./discovery-entities.js";
 export * from "./discovery-executors.js";
 export * from "./runtime-types.js";
@@ -10,6 +11,7 @@ export * from "./migration-plan.js";
 export * from "./symbol-repair-plan.js";
 export * from "./specs/bootstrap.js";
 export * from "./specs/check.js";
+export * from "./specs/impact-review-preparation.js";
 export * from "./specs/discovery.js";
 export * from "./specs/modeling.js";
 export * from "./specs/planning.js";

package/dist/public/operations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/public/operations/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,4CAA4C,CAAC;AAC3D,mBAAmB,qCAAqC,CAAC;AACzD,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/public/operations/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sCAAsC,CAAC;AACrD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,4CAA4C,CAAC;AAC3D,mBAAmB,qCAAqC,CAAC;AACzD,cAAc,mBAAmB,CAAC"}

package/dist/public/operations/index.js

@@ -1,5 +1,6 @@
 export * from "./catalog.js";
 export * from "./check-executor.js";
+export * from "./impact-review-preparation.js";
 export * from "./discovery-entities.js";
 export * from "./discovery-executors.js";
 export * from "./runtime-types.js";
@@ -10,6 +11,7 @@ export * from "./migration-plan.js";
 export * from "./symbol-repair-plan.js";
 export * from "./specs/bootstrap.js";
 export * from "./specs/check.js";
+export * from "./specs/impact-review-preparation.js";
 export * from "./specs/discovery.js";
 export * from "./specs/modeling.js";
 export * from "./specs/planning.js";

package/dist/public/operations/node-ports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-ports.d.ts","sourceRoot":"","sources":["../../../src/public/operations/node-ports.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE/E,KAAK,kBAAkB,GAAG,cAAc,GAAG;IACzC,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,KACjE,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AAEF,KAAK,WAAW,GAAG,OAAO,GAAG;IAC3B,QAAQ,CAAC,YAAY,EAAE,CACrB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,KACrB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AAkMF,eAAO,MAAM,cAAc,EAAE,kBAoB5B,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,WAiBrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,WAEzB,CAAC"}
+{"version":3,"file":"node-ports.d.ts","sourceRoot":"","sources":["../../../src/public/operations/node-ports.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE/E,KAAK,kBAAkB,GAAG,cAAc,GAAG;IACzC,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,KACjE,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AAEF,KAAK,WAAW,GAAG,OAAO,GAAG;IAC3B,QAAQ,CAAC,YAAY,EAAE,CACrB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,SAAS,MAAM,EAAE,KACrB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACjC,CAAC;AA2JF,eAAO,MAAM,cAAc,EAAE,kBAoB5B,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,WAiBrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,WAEzB,CAAC"}

package/dist/public/operations/node-ports.js

@@ -6,6 +6,7 @@ import path from "node:path";
 import { promisify } from "node:util";
 import fg from "fast-glob";
 import { createRepoIgnorePolicy } from "../ignore-policy.js";
+import { snapshotFileContent } from "./proof-receipt-projection.js";
 const execFileAsync = promisify(execFile);
 const SNAPSHOT_EXCLUDED_PREFIXES = [
     ".changeset/",
@@ -36,41 +37,6 @@ const ALWAYS_IGNORED_GLOBS = [
 function includedSnapshotPath(relativePath) {
     return !SNAPSHOT_EXCLUDED_PREFIXES.some((prefix) => relativePath === prefix.slice(0, -1) || relativePath.startsWith(prefix));
 }
-function withoutProofReceiptFrontmatter(content) {
-    const lines = content.match(/[^\n]*\n|[^\n]+$/g) ?? [];
-    if (lines[0]?.trim() !== "---")
-        return content;
-    let inFrontmatter = true;
-    let skippingReceipts = false;
-    const retained = [];
-    for (const [index, line] of lines.entries()) {
-        const trimmed = line.trim();
-        if (index > 0 && inFrontmatter && trimmed === "---") {
-            inFrontmatter = false;
-            skippingReceipts = false;
-            retained.push(line);
-            continue;
-        }
-        if (inFrontmatter && /^proof_receipts\s*:/.test(line)) {
-            skippingReceipts = true;
-            continue;
-        }
-        if (inFrontmatter &&
-            skippingReceipts &&
-            /^[A-Za-z_][A-Za-z0-9_-]*\s*:/.test(line)) {
-            skippingReceipts = false;
-        }
-        if (!skippingReceipts)
-            retained.push(line);
-    }
-    return retained.join("");
-}
-function snapshotFileContent(relativePath, content) {
-    if (relativePath.endsWith(".md")) {
-        return Buffer.from(withoutProofReceiptFrontmatter(content.toString("utf8")));
-    }
-    return content;
-}
 /**
  * A tracked markdown file whose only change is proof-receipt frontmatter
  * cannot alter the snapshot hash (receipts are stripped before hashing), so it

package/dist/public/operations/proof-receipt-projection.d.ts

@@ -0,0 +1,5 @@
+/** Remove only the top-level proof-receipt frontmatter block, byte-for-byte otherwise. */
+export declare function withoutProofReceiptFrontmatter(content: string): string;
+/** Match the workspace proof snapshot's markdown receipt projection exactly. */
+export declare function snapshotFileContent(relativePath: string, content: Buffer): Buffer;
+//# sourceMappingURL=proof-receipt-projection.d.ts.map

package/dist/public/operations/proof-receipt-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-receipt-projection.d.ts","sourceRoot":"","sources":["../../../src/public/operations/proof-receipt-projection.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA4BtE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,MAAM,CAGR"}

package/dist/public/operations/proof-receipt-projection.js

@@ -0,0 +1,36 @@
+/** Remove only the top-level proof-receipt frontmatter block, byte-for-byte otherwise. */
+export function withoutProofReceiptFrontmatter(content) {
+    const lines = content.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    if (lines[0]?.trim() !== "---")
+        return content;
+    let inFrontmatter = true;
+    let skippingReceipts = false;
+    const retained = [];
+    for (const [index, line] of lines.entries()) {
+        const trimmed = line.trim();
+        if (index > 0 && inFrontmatter && trimmed === "---") {
+            inFrontmatter = false;
+            skippingReceipts = false;
+            retained.push(line);
+            continue;
+        }
+        if (inFrontmatter && /^proof_receipts\s*:/.test(line)) {
+            skippingReceipts = true;
+            continue;
+        }
+        if (inFrontmatter &&
+            skippingReceipts &&
+            /^[A-Za-z_][A-Za-z0-9_-]*\s*:/.test(line)) {
+            skippingReceipts = false;
+        }
+        if (!skippingReceipts)
+            retained.push(line);
+    }
+    return retained.join("");
+}
+/** Match the workspace proof snapshot's markdown receipt projection exactly. */
+export function snapshotFileContent(relativePath, content) {
+    if (!relativePath.endsWith(".md"))
+        return content;
+    return Buffer.from(withoutProofReceiptFrontmatter(content.toString("utf8")));
+}

package/dist/public/operations/specs/bootstrap.d.ts

@@ -4,7 +4,7 @@ export { executePlanBootstrap } from "../../../operations/bootstrap/generate.js"
 export declare const planBootstrapSpec: {
     readonly name: "kb_plan_bootstrap";
     readonly cliName: "plan-bootstrap";
-    readonly description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.";
+    readonly description: "Generate a deterministic, snapshot-bound kibi.bootstrap-plan.v1 for repository onboarding. Read-only analysis of the repository plus any declared knowledge sources and cited intent claims returns evidence, bounded context questions, exact dependency-ordered actions, a canonical plan hash, and no mutation side effects.";
     readonly businessInputSchema: {
         readonly type: "object";
         readonly properties: {
@@ -71,6 +71,78 @@ export declare const planBootstrapSpec: {
                         };
                         readonly description: "Optional verification commands, documents, or checkpoints to reference in the output.";
                     };
+                    readonly knowledgeSources: {
+                        readonly type: "array";
+                        readonly maxItems: 50;
+                        readonly description: "Knowledge sources outside the code that the human confirmed during the bootstrap interview (issue trackers, wikis, specs, decision logs). Kibi never contacts them; the agent reads them through its own connectors and cites them from intentClaims. Bound into the plan hash.";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly required: readonly ["id", "kind", "title", "locator", "authority"];
+                            readonly additionalProperties: false;
+                            readonly properties: {
+                                readonly id: {
+                                    readonly type: "string";
+                                    readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                                    readonly description: "Stable kebab-case handle that intentClaims cite, for example jira-payments.";
+                                };
+                                readonly kind: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["issue_tracker", "wiki", "specification", "design", "decision_log", "support", "chat", "repository_docs", "other"];
+                                };
+                                readonly title: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                                readonly locator: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                    readonly description: "Where the source lives: a URL, project key, space name, or repo-relative path.";
+                                };
+                                readonly authority: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["authoritative", "supporting", "stale"];
+                                    readonly description: "The human's call: authoritative claims become higher-confidence candidates, supporting claims lower ones, and stale sources are cited but never produce candidates.";
+                                };
+                                readonly connector: {
+                                    readonly type: "string";
+                                    readonly description: "Optional name of the MCP server or tool the agent used to read the source.";
+                                };
+                                readonly notes: {
+                                    readonly type: "string";
+                                };
+                            };
+                        };
+                    };
+                    readonly intentClaims: {
+                        readonly type: "array";
+                        readonly maxItems: 200;
+                        readonly description: "Statements of product intent the agent harvested from knowledgeSources, each citing its source. Normative claims the strict modeler can ground become cited req candidates; the rest become explicit authoring follow-ups. Bound into the plan hash.";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly required: readonly ["statement", "sourceId", "reference"];
+                            readonly additionalProperties: false;
+                            readonly properties: {
+                                readonly statement: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                    readonly description: "One normative statement in the source's meaning, for example 'Refunds must not exceed the original charge.'";
+                                };
+                                readonly sourceId: {
+                                    readonly type: "string";
+                                    readonly description: "The id of a declared knowledge source.";
+                                };
+                                readonly reference: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                    readonly description: "Exact citation inside the source: a ticket key, page URL, or section anchor.";
+                                };
+                                readonly excerpt: {
+                                    readonly type: "string";
+                                    readonly description: "Optional short quote supporting the claim.";
+                                };
+                            };
+                        };
+                    };
                 };
             };
         };

package/dist/public/operations/specs/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/public/operations/specs/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAOjF,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF7B,CAAC"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/public/operations/specs/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AASjF,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2J7B,CAAC"}