kibi-cli 2.3.0 → 2.5.0

package/dist/operations/proof/code-scope.d.ts

@@ -1,4 +1,5 @@
 import type { PrologPort } from "../../public/operations/runtime-types.js";
+import type { ProofContract } from "../../public/proof-protocol.js";
 /**
  * Which symbols a proof receipt's per-contract binding covers. Receipt ingest
  * (which writes `binding_hash`) and coverage (which checks it) must derive
@@ -14,4 +15,31 @@ import type { PrologPort } from "../../public/operations/runtime-types.js";
 export declare function receiptCodeScopeSymbolIds(contract: unknown, bindings: unknown, coveredBySymbols: readonly string[]): string[];
 /** Map each test id to the symbols linked `covered_by` it, in one query. */
 export declare function loadCoveredBySymbolsByTest(prolog: Pick<PrologPort, "query">): Promise<ReadonlyMap<string, readonly string[]>>;
+/**
+ * The proof-contract projection a receipt binding hashes. Ingest validates a
+ * contract and then hashes exactly this projection; coverage must hash the
+ * same projection, never the raw stored value, or a cosmetic extra key would
+ * make every receipt of that test silently fall back to snapshot matching.
+ */
+export declare function receiptBindingContract(raw: unknown): ProofContract | null;
+export type ReceiptBindingInput = Readonly<{
+    workspaceRoot: string;
+    readFile: (absolutePath: string) => Promise<string>;
+    /** The test entity: source, proof_contract and proof_bindings are read. */
+    test: Readonly<Record<string, unknown>>;
+    coveredBySymbols: readonly string[];
+}>;
+/**
+ * The current per-contract binding hash of one proof-bearing test, or
+ * undefined when the test has no markdown source the binding can hash.
+ *
+ * Ingest writes this value into `binding_hash` and coverage compares against
+ * it, so both call this one function. Every input is repository-relative and
+ * content-addressed: the test document is located by its normalized
+ * repo-relative `source`, the code scope by normalized manifest paths, and
+ * only file contents (never absolute locations) enter the hash. Receipts
+ * written on a CI runner and on a developer checkout of the same commit
+ * therefore carry the same binding.
+ */
+export declare function currentReceiptBindingHash(input: ReceiptBindingInput): Promise<string | undefined>;
 //# sourceMappingURL=code-scope.d.ts.map

package/dist/operations/proof/code-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-scope.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/code-scope.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E;;;;;;;;;;;GAWG;AAEH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,MAAM,EAAE,CAoBV;AAED,4EAA4E;AAE5E,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAiBjD"}
+{"version":3,"file":"code-scope.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/code-scope.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAKpE;;;;;;;;;;;GAWG;AAEH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,MAAM,EAAE,CAoBV;AAED,4EAA4E;AAE5E,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAiBjD;AAQD;;;;;GAKG;AAEH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAkBzE;AAGD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,2EAA2E;IAC3E,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AAEH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuB7B"}

package/dist/operations/proof/code-scope.js

@@ -7,7 +7,13 @@
  the Free Software Foundation, either version 3 of the License, or
  (at your option) any later version.
  */
+import { join } from "node:path";
+import { resolveBoundSymbolScope } from "../../extractors/manifest.js";
 import { normalizeEntityId, parseTriples } from "../../prolog/codec.js";
+import { receiptBindingHash } from "../../public/proof-fingerprint.js";
+import { normalizeRepoRelativePath } from "../../utils/repo-relative-path.js";
+import { resolveContainedSourcePath } from "../mutation/source-authoring.js";
+import { removeFrontmatterBlock } from "./receipt-document.js";
 /**
  * Which symbols a proof receipt's per-contract binding covers. Receipt ingest
  * (which writes `binding_hash`) and coverage (which checks it) must derive
@@ -58,3 +64,69 @@ export async function loadCoveredBySymbolsByTest(prolog) {
     }
     return byTest;
 }
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+/**
+ * The proof-contract projection a receipt binding hashes. Ingest validates a
+ * contract and then hashes exactly this projection; coverage must hash the
+ * same projection, never the raw stored value, or a cosmetic extra key would
+ * make every receipt of that test silently fall back to snapshot matching.
+ */
+// implements REQ-kibi-fresh-verification-receipts-v2
+export function receiptBindingContract(raw) {
+    const contract = record(raw);
+    if (!contract)
+        return null;
+    const requiredProofs = Array.isArray(contract.required_proofs)
+        ? contract.required_proofs
+        : [];
+    return {
+        version: contract.version,
+        integration: String(contract.integration ?? ""),
+        required_proofs: requiredProofs.map((entry) => {
+            const row = record(entry);
+            return {
+                symbol_id: String(row?.symbol_id ?? ""),
+                target: String(row?.target ?? ""),
+            };
+        }),
+        success_policy: contract.success_policy,
+    };
+}
+/**
+ * The current per-contract binding hash of one proof-bearing test, or
+ * undefined when the test has no markdown source the binding can hash.
+ *
+ * Ingest writes this value into `binding_hash` and coverage compares against
+ * it, so both call this one function. Every input is repository-relative and
+ * content-addressed: the test document is located by its normalized
+ * repo-relative `source`, the code scope by normalized manifest paths, and
+ * only file contents (never absolute locations) enter the hash. Receipts
+ * written on a CI runner and on a developer checkout of the same commit
+ * therefore carry the same binding.
+ */
+// implements REQ-kibi-fresh-verification-receipts-v2
+export async function currentReceiptBindingHash(input) {
+    const contract = receiptBindingContract(input.test.proof_contract);
+    if (!contract)
+        return undefined;
+    const source = typeof input.test.source === "string" ? input.test.source : "";
+    if (!/\.(md|mdx)$/i.test(source.trim()))
+        return undefined;
+    const relative = normalizeRepoRelativePath(input.workspaceRoot, source);
+    if (relative === null)
+        return undefined;
+    try {
+        const absolute = resolveContainedSourcePath(input.workspaceRoot, relative);
+        const authored = await input.readFile(absolute);
+        const stripped = removeFrontmatterBlock(authored, "proof_receipts");
+        const codeScope = resolveBoundSymbolScope(join(input.workspaceRoot, ".kb", "symbols.yaml"), receiptCodeScopeSymbolIds(contract, input.test.proof_bindings, input.coveredBySymbols));
+        return receiptBindingHash(contract, stripped ?? authored, codeScope);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/operations/proof/compact-receipts.d.ts

@@ -0,0 +1,49 @@
+import type { OperationContext } from "../../public/operations/runtime-types.js";
+import { PROOF_RECEIPT_COMPACTION_POLICY } from "./receipt-compaction.js";
+export type CompactReceiptsArgs = Readonly<{
+    /** Compact a single test entity only. */
+    testId?: string;
+    /** Report what would be removed without writing anything. */
+    dryRun?: boolean;
+}>;
+export type CompactReceiptsTestResult = Readonly<{
+    testId: string;
+    before: number;
+    after: number;
+    removed: number;
+}>;
+export type CompactReceiptsResult = Readonly<{
+    policy: typeof PROOF_RECEIPT_COMPACTION_POLICY;
+    snapshot: string;
+    dryRun: boolean;
+    removed: number;
+    tests: readonly CompactReceiptsTestResult[];
+    skipped: readonly Readonly<{
+        testId: string;
+        reason: string;
+    }>[];
+}>;
+/**
+ * Replace one test's receipt history with a shorter, already-validated
+ * history. Only the `proof_receipts` frontmatter block of the authored
+ * document is rewritten: the rest of the document keeps its exact bytes, so
+ * the receipt-stripped document (an input of the per-contract binding) and
+ * therefore every receipt's freshness are unchanged by the rewrite.
+ */
+export declare function rewriteReceiptHistory(test: Readonly<Record<string, unknown>>, nextReceipts: readonly Readonly<Record<string, unknown>>[], context: OperationContext): Promise<void>;
+/**
+ * One-off migration for existing stores: apply the ingest-time compaction
+ * policy (kibi.proof-receipt-compaction.v1) to every test's receipt history
+ * against the live workspace snapshot and each test's current per-contract
+ * binding. Coverage decisions are unchanged by construction; histories that
+ * are not structurally valid are reported and left untouched, because an
+ * invalid history decides `invalid` and must stay visible.
+ */
+export declare function executeCompactReceipts(args: CompactReceiptsArgs, context: OperationContext): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    structuredContent: CompactReceiptsResult;
+}>;
+//# sourceMappingURL=compact-receipts.d.ts.map

package/dist/operations/proof/compact-receipts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/compact-receipts.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAUjF,OAAO,EACL,+BAA+B,EAGhC,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,OAAO,+BAA+B,CAAC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC5C,OAAO,EAAE,SAAS,QAAQ,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;CAClE,CAAC,CAAC;AAWH;;;;;;GAMG;AAEH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,YAAY,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,EAC1D,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;;;;GAOG;AAEH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,qBAAqB,CAAC;CAC1C,CAAC,CA+FD"}

package/dist/operations/proof/compact-receipts.js

@@ -0,0 +1,160 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+import { loadEntities, loadEntitiesPaged, } from "../../public/operations/discovery-entities.js";
+import { readWorkspaceSnapshot } from "../../public/operations/workspace-snapshot.js";
+import { proofReceiptHistoryErrors } from "../../public/proof-receipt.js";
+import { projectEntityProperties } from "../mutation/entity-projection.js";
+import { resolveContainedSourcePath } from "../mutation/source-authoring.js";
+import { executeUpsert } from "../mutation/upsert.js";
+import { currentReceiptBindingHash, loadCoveredBySymbolsByTest, } from "./code-scope.js";
+import { PROOF_RECEIPT_COMPACTION_POLICY, compactProofReceipts, isOrderedReceiptSubsequence, } from "./receipt-compaction.js";
+import { patchReceiptsIntoDocument } from "./receipt-document.js";
+function receiptRecords(value) {
+    return Array.isArray(value)
+        ? value.filter((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry))
+        : [];
+}
+/**
+ * Replace one test's receipt history with a shorter, already-validated
+ * history. Only the `proof_receipts` frontmatter block of the authored
+ * document is rewritten: the rest of the document keeps its exact bytes, so
+ * the receipt-stripped document (an input of the per-contract binding) and
+ * therefore every receipt's freshness are unchanged by the rewrite.
+ */
+// implements REQ-kibi-fresh-verification-receipts-v2
+export async function rewriteReceiptHistory(test, nextReceipts, context) {
+    const testId = String(test.id);
+    let sourceDocumentOverride;
+    const source = typeof test.source === "string" ? test.source : "";
+    if (context.fs && /\.(md|mdx)$/i.test(source)) {
+        try {
+            const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
+            const before = await context.fs.readFile(absolute);
+            sourceDocumentOverride =
+                patchReceiptsIntoDocument(before, nextReceipts) ?? undefined;
+        }
+        catch {
+            sourceDocumentOverride = undefined;
+        }
+    }
+    const properties = projectEntityProperties(test);
+    properties.proof_receipts = undefined;
+    await executeUpsert({
+        type: "test",
+        id: testId,
+        properties: { ...properties, proof_receipts: [...nextReceipts] },
+    }, context, {
+        allowReceiptsPrune: true,
+        ...(sourceDocumentOverride === undefined
+            ? {}
+            : { sourceDocumentOverride }),
+    });
+}
+/**
+ * One-off migration for existing stores: apply the ingest-time compaction
+ * policy (kibi.proof-receipt-compaction.v1) to every test's receipt history
+ * against the live workspace snapshot and each test's current per-contract
+ * binding. Coverage decisions are unchanged by construction; histories that
+ * are not structurally valid are reported and left untouched, because an
+ * invalid history decides `invalid` and must stay visible.
+ */
+// implements REQ-kibi-fresh-verification-receipts-v2
+export async function executeCompactReceipts(args, context) {
+    if (!context.prolog)
+        throw new Error("Proof compact requires a Prolog runtime");
+    const fs = context.fs;
+    if (fs === undefined)
+        throw new Error("Proof compact failed: this maintenance action rewrites authored test documents and requires a filesystem-capable runtime");
+    const workspace = await readWorkspaceSnapshot(context);
+    if (!workspace.available)
+        throw new Error(`Proof compact failed: ${workspace.error}`);
+    const snapshot = workspace.snapshot.hash;
+    const dryRun = args.dryRun === true;
+    // Receipt histories are exactly what this action reads; page them so a
+    // long-lived store never exceeds the bounded Prolog output capacity.
+    const tests = args.testId === undefined
+        ? await loadEntitiesPaged(context.prolog, "test")
+        : await loadEntities(context.prolog, { type: "test", id: args.testId });
+    if (args.testId !== undefined && tests.length === 0) {
+        throw new Error(`Proof compact failed: test ${args.testId} was not found`);
+    }
+    const coveredBy = await loadCoveredBySymbolsByTest(context.prolog);
+    const results = [];
+    const skipped = [];
+    for (const test of [...tests].sort((left, right) => String(left.id).localeCompare(String(right.id)))) {
+        const testId = String(test.id);
+        const receipts = receiptRecords(test.proof_receipts);
+        if (receipts.length <= 1)
+            continue;
+        const historyErrors = proofReceiptHistoryErrors(testId, test.verification_scope, receipts);
+        if (historyErrors.length > 0) {
+            skipped.push({
+                testId,
+                reason: `invalid receipt history left untouched: ${historyErrors[0]}`,
+            });
+            continue;
+        }
+        const bindingHash = await currentReceiptBindingHash({
+            workspaceRoot: context.workspaceRoot,
+            readFile: (absolute) => fs.readFile(absolute),
+            test,
+            coveredBySymbols: coveredBy.get(testId) ?? [],
+        });
+        const { kept, removed } = compactProofReceipts(receipts, {
+            codeSnapshot: snapshot,
+            ...(bindingHash === undefined ? {} : { bindingHash }),
+        });
+        if (removed === 0)
+            continue;
+        if (!isOrderedReceiptSubsequence(kept, receipts)) {
+            throw new Error(`Proof compact failed for ${testId}: compaction must only drop superseded receipts`);
+        }
+        if (!dryRun)
+            await rewriteReceiptHistory(test, kept, context);
+        results.push({
+            testId,
+            before: receipts.length,
+            after: kept.length,
+            removed,
+        });
+    }
+    const removed = results.reduce((sum, row) => sum + row.removed, 0);
+    const verb = dryRun ? "Would remove" : "Removed";
+    const summary = results.length === 0
+        ? "No test had superseded receipts."
+        : `${verb} ${removed} superseded receipt(s) across ${results.length} test(s).`;
+    const skippedText = skipped.length > 0
+        ? ` Skipped ${skipped.length} test(s) with invalid receipt history.`
+        : "";
+    return {
+        content: [
+            {
+                type: "text",
+                text: `Proof receipts compacted (${PROOF_RECEIPT_COMPACTION_POLICY}). ${summary}${skippedText}`,
+            },
+        ],
+        structuredContent: {
+            policy: PROOF_RECEIPT_COMPACTION_POLICY,
+            snapshot,
+            dryRun,
+            removed,
+            tests: results,
+            skipped,
+        },
+    };
+}

package/dist/operations/proof/ingest-proof.d.ts

@@ -13,6 +13,8 @@ export type IngestProofTestResult = Readonly<{
     applied: boolean;
     duplicate: boolean;
     receiptCount: number;
+    /** Superseded receipts the ingest compaction dropped from the history. */
+    compacted: number;
     gaps: readonly ProofGap[];
 }>;
 export type IngestProofResult = Readonly<{

package/dist/operations/proof/ingest-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAkBjF,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAqBvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC;AAqkBF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAuC5B"}
+{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAiBjF,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAkBvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC;AAolBF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAuC5B"}

package/dist/operations/proof/ingest-proof.js

@@ -1,11 +1,10 @@
-import { join } from "node:path";
-import { resolveBoundSymbolScope } from "../../extractors/manifest.js";
-import { loadCoveredBySymbolsByTest, receiptCodeScopeSymbolIds, } from "./code-scope.js";
+import { currentReceiptBindingHash, loadCoveredBySymbolsByTest, } from "./code-scope.js";
+import { compactProofReceipts, isOrderedReceiptSubsequence, } from "./receipt-compaction.js";
 import { evaluateContractAgainstRun, } from "../../proof/evaluate.js";
 import { loadProofIntegrations, resolveIntegration, toExecution, } from "../../proof/integrations.js";
 import { loadEntities } from "../../public/operations/discovery-entities.js";
 import { readWorkspaceSnapshot } from "../../public/operations/workspace-snapshot.js";
-import { environmentHash as canonicalEnvironmentHash, effectiveProofFingerprint, jsonDigest, proofContractHash, receiptBindingHash, } from "../../public/proof-fingerprint.js";
+import { environmentHash as canonicalEnvironmentHash, effectiveProofFingerprint, jsonDigest, proofContractHash, } from "../../public/proof-fingerprint.js";
 import { PROOF_CONTRACT_VERSION, PROOF_RECEIPT_VERSION, proofBindingsErrors, proofRunArtifactErrors, } from "../../public/proof-protocol.js";
 import { MAX_PROOF_RECEIPTS, proofReceiptCurrentBindingErrors, proofReceiptHistoryErrors, } from "../../public/proof-receipt.js";
 import { projectEntityProperties } from "../mutation/entity-projection.js";
@@ -14,7 +13,7 @@ import { buildUpsertBatchCommitGoal, parseUpsertChangeKinds, } from "../mutation
 import { executeUpsert } from "../mutation/upsert.js";
 import { acquireWorkspaceMutationLock, releaseWorkspaceMutationLock, } from "../mutation/workspace-mutation-lock.js";
 import { MutationRollbackFailureError } from "../mutation/saga.js";
-import { patchReceiptsIntoDocument, removeFrontmatterBlock, } from "./receipt-document.js";
+import { patchReceiptsIntoDocument } from "./receipt-document.js";
 async function rollbackUncommittedReceipts(pending, originalError, lifecycle) {
     const failures = [];
     for (const entry of pending) {
@@ -243,21 +242,17 @@ async function executeIngestProofUnlocked(args, context, lifecycle) {
         // Per-contract receipt binding (W2): hash the receipt-stripped authored
         // document, the contract, and the bound symbols' source hashes so the
         // receipt survives unrelated workspace changes and stales only when its
-        // own inputs (contract, document, production code scope) change.
-        let bindingHash;
-        const source = typeof test.source === "string" ? test.source : "";
-        if (context.fs && source !== "" && /\.(md|mdx)$/i.test(source)) {
-            try {
-                const absolute = resolveContainedSourcePath(context.workspaceRoot, source);
-                const authored = await context.fs.readFile(absolute);
-                const stripped = removeFrontmatterBlock(authored, "proof_receipts");
-                const codeScope = resolveBoundSymbolScope(join(context.workspaceRoot, ".kb", "symbols.yaml"), receiptCodeScopeSymbolIds(contract, bindings, coveredBy.get(testId) ?? []));
-                bindingHash = receiptBindingHash(contract, stripped ?? authored, codeScope);
-            }
-            catch {
-                bindingHash = undefined;
-            }
-        }
+        // own inputs (contract, document, production code scope) change. The
+        // same function computes the binding coverage compares against.
+        const fs = context.fs;
+        const bindingHash = fs === undefined
+            ? undefined
+            : await currentReceiptBindingHash({
+                workspaceRoot: context.workspaceRoot,
+                readFile: (absolute) => fs.readFile(absolute),
+                test,
+                coveredBySymbols: coveredBy.get(testId) ?? [],
+            });
         const receipt = {
             version: PROOF_RECEIPT_VERSION,
             receipt_id: `PR-${jsonDigest({
@@ -319,19 +314,38 @@ async function executeIngestProofUnlocked(args, context, lifecycle) {
                     applied: false,
                     duplicate: true,
                     receiptCount: existing.length,
+                    compacted: 0,
                     gaps: evaluation.gaps,
                 });
                 continue;
             }
-            const nextReceipts = [
+            const appended = [
                 ...existing,
                 receipt,
-            ].slice(-MAX_PROOF_RECEIPTS);
-            const historyErrors = proofReceiptHistoryErrors(testId, test.verification_scope, nextReceipts);
+            ];
+            const appendedWindow = appended.slice(-MAX_PROOF_RECEIPTS);
+            const historyErrors = proofReceiptHistoryErrors(testId, test.verification_scope, appendedWindow);
             const bindingErrors = proofReceiptCurrentBindingErrors(testId, test.verification_scope, receipt, contract, receipt.fingerprint);
             const receiptErrors = [...historyErrors, ...bindingErrors];
             if (receiptErrors.length > 0)
                 throw new Error(`Proof ingest failed for ${testId}: ${receiptErrors.join("; ")}`);
+            // Compact only the validated history: superseded receipts that can no
+            // longer decide this test's proof for the snapshot and binding the new
+            // receipt was produced on are dropped, so histories stay a handful of
+            // entries instead of growing to the rotation cap. The new receipt is
+            // always the newest entry and is always kept.
+            const nextReceipts = [
+                ...compactProofReceipts(appendedWindow, {
+                    codeSnapshot: snapshot,
+                    ...(receipt.binding_hash === undefined
+                        ? {}
+                        : { bindingHash: receipt.binding_hash }),
+                }).kept,
+            ];
+            if (nextReceipts.at(-1)?.receipt_id !== receipt.receipt_id ||
+                !isOrderedReceiptSubsequence(nextReceipts, appended)) {
+                throw new Error(`Proof ingest failed for ${testId}: receipt compaction must only drop superseded receipts`);
+            }
             const properties = projectEntityProperties(test);
             properties.proof_receipts = undefined;
             // Surgical receipt append: splice only the proof_receipts block into the
@@ -355,8 +369,13 @@ async function executeIngestProofUnlocked(args, context, lifecycle) {
                 }
             }
             // exactOptionalPropertyTypes: only pass the override when one exists.
+            // The compacted history was checked above to be the existing history plus
+            // the new receipt with superseded entries removed, so the generic
+            // append-only revalidation (which would reject any removal) is replaced
+            // by that stricter subsequence check.
             const upsertOptions = {
                 deferCompiledCommit: true,
+                allowReceiptsPrune: true,
                 ...(sourceDocumentOverride === undefined
                     ? {}
                     : { sourceDocumentOverride }),
@@ -375,6 +394,7 @@ async function executeIngestProofUnlocked(args, context, lifecycle) {
                 outcome: receipt.outcome,
                 receiptId: receipt.receipt_id,
                 receiptCount: nextReceipts.length,
+                compacted: appended.length - nextReceipts.length,
                 gaps: evaluation.gaps,
                 deferred,
             });
@@ -426,6 +446,7 @@ async function executeIngestProofUnlocked(args, context, lifecycle) {
                 applied: true,
                 duplicate: false,
                 receiptCount: entry.receiptCount,
+                compacted: entry.compacted,
                 gaps: entry.gaps,
             });
         }

package/dist/operations/proof/prune-receipts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prune-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/prune-receipts.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AASjF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,uDAAuD;IAEvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAE7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAEzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAYH;;;;;;;;;GASG;AAEH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,mBAAmB,CAAC;CACxC,CAAC,CAuED"}
+{"version":3,"file":"prune-receipts.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/prune-receipts.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAQjF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,uDAAuD;IAEvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAE7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAEzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAYH;;;;;;;;;GASG;AAEH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,mBAAmB,CAAC;CACxC,CAAC,CAgED"}

package/dist/operations/proof/prune-receipts.js

@@ -17,8 +17,7 @@
  */
 import { loadEntities, loadEntitiesPaged, } from "../../public/operations/discovery-entities.js";
 import { proofReceiptHistoryErrors, } from "../../public/proof-receipt.js";
-import { projectEntityProperties } from "../mutation/entity-projection.js";
-import { executeUpsert } from "../mutation/upsert.js";
+import { rewriteReceiptHistory } from "./compact-receipts.js";
 function parseKeep(value) {
     if (value === undefined)
         return 1;
@@ -68,13 +67,10 @@ export async function executePruneReceipts(args, context) {
         if (historyErrors.length > 0) {
             throw new Error(`Proof prune failed for ${testId}: pruned history is invalid: ${historyErrors.join("; ")}`);
         }
-        const properties = projectEntityProperties(test);
-        properties.proof_receipts = undefined;
-        await executeUpsert({
-            type: "test",
-            id: testId,
-            properties: { ...properties, proof_receipts: nextReceipts },
-        }, context, { allowReceiptsPrune: true });
+        // Patch only the receipts block: a canonical re-render of the authored
+        // document would change the receipt-stripped bytes the per-contract
+        // binding hashes and stale every receipt the prune keeps.
+        await rewriteReceiptHistory(test, nextReceipts, context);
         results.push({
             testId,
             before: receipts.length,

package/dist/operations/proof/receipt-compaction.d.ts

@@ -0,0 +1,48 @@
+export declare const PROOF_RECEIPT_COMPACTION_POLICY: "kibi.proof-receipt-compaction.v1";
+/**
+ * What "current" means when a history is compacted: the live workspace
+ * snapshot and the test's current per-contract binding hash. Coverage selects
+ * a test's deciding receipts with exactly these two keys.
+ */
+export type ReceiptCompactionAnchor = Readonly<{
+    codeSnapshot?: string;
+    bindingHash?: string;
+}>;
+export type ReceiptCompaction = Readonly<{
+    kept: readonly Readonly<Record<string, unknown>>[];
+    removed: number;
+}>;
+type Receipt = Readonly<Record<string, unknown>>;
+/**
+ * Deterministic, decision-preserving compaction of one test's proof-receipt
+ * history (policy kibi.proof-receipt-compaction.v1).
+ *
+ * Coverage decides a test from one selector group: receipts whose
+ * `binding_hash` equals the test's current binding, or, when there are none,
+ * receipts whose `code_snapshot` equals the live snapshot. Within that group
+ * it reads the newest receipt per (scope, contract_hash) and the set of
+ * contract hashes present. Compaction keeps exactly what those reads can
+ * observe, plus two history anchors:
+ *
+ * - per selector group, the newest receipt for each (scope, contract_hash);
+ * - the newest receipt overall (what the last run reported);
+ * - the newest passing receipt (last known good, so reverting a change
+ *   finds its proof again without a re-run).
+ *
+ * Everything else is superseded evidence: it can never be the deciding
+ * receipt again for the current snapshot or binding. The result is an
+ * ordered subsequence of the input, so it stays a valid history, and the
+ * function is idempotent for a fixed anchor. Inputs that are not structurally
+ * valid histories must not be compacted (callers validate first): an invalid
+ * history decides `invalid`, and dropping the offending entry would change
+ * that decision.
+ */
+export declare function compactProofReceipts(receipts: readonly Receipt[], anchor: ReceiptCompactionAnchor): ReceiptCompaction;
+/**
+ * True when `subset` is `superset` with entries removed and nothing changed or
+ * reordered. Compaction may only drop receipts; this guard keeps every other
+ * rewrite of a receipt history fail-closed.
+ */
+export declare function isOrderedReceiptSubsequence(subset: readonly Receipt[], superset: readonly Receipt[]): boolean;
+export {};
+//# sourceMappingURL=receipt-compaction.d.ts.map

package/dist/operations/proof/receipt-compaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-compaction.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/receipt-compaction.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,+BAA+B,EAC1C,kCAA2C,CAAC;AAE9C;;;;GAIG;AAEH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,KAAK,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAuBjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,MAAM,EAAE,uBAAuB,GAC9B,iBAAiB,CA0CnB;AAED;;;;GAIG;AAEH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,SAAS,OAAO,EAAE,EAC1B,QAAQ,EAAE,SAAS,OAAO,EAAE,GAC3B,OAAO,CAcT"}