kibi-cli 2.31.0 → 2.32.0

package/src/public/proof-protocol.ts

@@ -2,8 +2,23 @@
 export const PROOF_RUN_VERSION = "kibi.proof-run.v1" as const;
 // implements REQ-kibi-verification-evidence-contract
 export const PROOF_CONTRACT_VERSION = "kibi.proof-contract.v1" as const;
-// implements REQ-kibi-verification-evidence-contract
-export const PROOF_RECEIPT_VERSION = "kibi.proof-receipt.v1" as const;
+/**
+ * Receipts Kibi writes. v2 adds the contract's kind, the evidence level the
+ * receipt supports, and for certificate kinds the re-checked certificate.
+ */
+// implements REQ-kibi-verification-evidence-contract, REQ-kibi-code-proof-kinds
+export const PROOF_RECEIPT_VERSION = "kibi.proof-receipt.v2" as const;
+/** Receipts written before v2; still read, as e2e evidence at tested. */
+// implements REQ-kibi-code-proof-kinds
+export const PROOF_RECEIPT_V1_VERSION = "kibi.proof-receipt.v1" as const;
+// implements REQ-kibi-code-proof-kinds
+export const PROOF_RECEIPT_VERSIONS = [
+  PROOF_RECEIPT_V1_VERSION,
+  PROOF_RECEIPT_VERSION,
+] as const;
+/** The certificate a certificate-kind proof leaves for Kibi to re-check. */
+// implements REQ-kibi-code-proof-kinds
+export const CODE_CERTIFICATE_VERSION = "kibi.code-certificate.v1" as const;
 // implements REQ-kibi-verification-evidence-contract
 export const PROOF_INTEGRATION_VERSION = "kibi.proof-integration.v1" as const;
 
@@ -38,7 +53,52 @@ export const RUN_FAILURE_PHASES = [
   "infrastructure",
 ] as const;
 
-export const SUCCESS_POLICIES = ["all_required_first_attempt"] as const;
+/**
+ * `all_required_first_attempt`: the whole run must pass and every obligation's
+ * own result must pass on its first attempt.
+ * `own_results_first_attempt`: a run whose only failures are other test cases
+ * (outcome `failed` in the execution phase) still proves an obligation whose
+ * own native-case result passed on its first attempt, so one unrelated
+ * failing case does not erase a suite's evidence. Aggregate-run obligations
+ * still need the whole run to pass.
+ */
+export const SUCCESS_POLICIES = [
+  "all_required_first_attempt",
+  "own_results_first_attempt",
+] as const;
+
+/**
+ * What a proof contract's checker establishes. Runner kinds (e2e, example,
+ * property) sample cases and support tested evidence; certificate kinds
+ * (exhaustive, typecheck, arithmetic, smt) cover every case and support
+ * proved evidence once Kibi re-checks the certificate the run left.
+ */
+// implements REQ-kibi-code-proof-kinds
+export const PROOF_KINDS = [
+  "e2e",
+  "example",
+  "property",
+  "exhaustive",
+  "typecheck",
+  "arithmetic",
+  "smt",
+] as const;
+
+// implements REQ-kibi-code-proof-kinds
+export const CERTIFICATE_PROOF_KINDS = [
+  "exhaustive",
+  "typecheck",
+  "arithmetic",
+  "smt",
+] as const;
+
+// implements REQ-kibi-code-proof-kinds
+export type ProofKind = (typeof PROOF_KINDS)[number];
+
+// implements REQ-kibi-code-proof-kinds
+export function isCertificateProofKind(kind: unknown): boolean {
+  return (CERTIFICATE_PROOF_KINDS as readonly unknown[]).includes(kind);
+}
 
 export type {
   AttemptsStatus,
@@ -191,6 +251,13 @@ export const PROOF_RUN_ARTIFACT_SCHEMA = {
       type: "array",
       items: { type: "string", minLength: 1 },
     },
+    certificates: {
+      type: "array",
+      description:
+        "kibi.code-certificate.v1 objects the run left for certificate-kind contracts, one per test. Kibi re-checks each before a receipt counts as proved.",
+      maxItems: 1000,
+      items: { type: "object", required: ["version", "kind", "test_id"] },
+    },
   },
   additionalProperties: false,
 } as const;
@@ -218,6 +285,73 @@ export const PROOF_CONTRACT_SCHEMA = {
       },
     },
     success_policy: { type: "string", enum: [...SUCCESS_POLICIES] },
+    kind: {
+      type: "string",
+      enum: [...PROOF_KINDS],
+      description:
+        "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic and smt must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved.",
+    },
+    domain_source: {
+      type: "object",
+      description:
+        "exhaustive and typecheck: the symbol that defines the finite domain. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.",
+      required: ["symbol_id"],
+      properties: {
+        symbol_id: { type: "string", minLength: 1 },
+        export: {
+          type: "string",
+          minLength: 1,
+          description:
+            "The name the domain is exported under in the symbol's source file, when the symbol's title is not that name.",
+        },
+      },
+      additionalProperties: false,
+    },
+    witness: {
+      type: "object",
+      description:
+        "typecheck: the repository-relative witness file Kibi compiles (an exhaustive switch ending in never, or a mapped type over the domain).",
+      required: ["path"],
+      properties: { path: { type: "string", minLength: 1 } },
+      additionalProperties: false,
+    },
+    proves: {
+      type: "array",
+      description:
+        "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt); a claim with no such derivation is only attested and never counts as proved.",
+      minItems: 1,
+      items: { type: "string", pattern: "^CLAIM-" },
+      uniqueItems: true,
+    },
+    value_source: {
+      type: "array",
+      description:
+        "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base.",
+      minItems: 1,
+      items: {
+        type: "object",
+        required: ["symbol_id"],
+        properties: {
+          symbol_id: { type: "string", minLength: 1 },
+          export: { type: "string", minLength: 1 },
+        },
+        additionalProperties: false,
+      },
+    },
+    constraint_source: {
+      type: "object",
+      description:
+        "arithmetic and smt: the typed numeric property_value facts the certificate's assumptions come from. Kibi checks the assumptions (or the query's assertions) are exactly these facts' constraints, so the proof is about the knowledge base, not numbers the test chose.",
+      required: ["fact_ids"],
+      properties: {
+        fact_ids: {
+          type: "array",
+          minItems: 1,
+          items: { type: "string", minLength: 1 },
+        },
+      },
+      additionalProperties: false,
+    },
   },
   additionalProperties: false,
 } as const;
@@ -479,6 +613,24 @@ export function proofRunArtifactErrors(value: unknown): string[] {
     )
       errors.push("artifact.diagnostics must be an array of non-empty strings");
   }
+  if (artifact.certificates !== undefined) {
+    if (!Array.isArray(artifact.certificates))
+      errors.push("artifact.certificates must be an array when present");
+    else
+      artifact.certificates.forEach((entry, index) => {
+        const row = record(entry);
+        if (
+          !row ||
+          !nonEmptyString(row.version) ||
+          !includes(CERTIFICATE_PROOF_KINDS, row.kind) ||
+          !nonEmptyString(row.test_id) ||
+          !isPlainJson(row)
+        )
+          errors.push(
+            `artifact.certificates[${index}] must be a JSON object with version, a certificate kind (${CERTIFICATE_PROOF_KINDS.join(", ")}) and test_id`,
+          );
+      });
+  }
   return errors;
 }
 
@@ -537,9 +689,172 @@ export function proofContractErrors(value: unknown): string[] {
     errors.push(
       `proof_contract.success_policy must be one of: ${SUCCESS_POLICIES.join(", ")}; received ${JSON.stringify(contract.success_policy ?? null)}`,
     );
+  errors.push(...proofContractKindErrors(contract));
+  return errors;
+}
+
+// implements REQ-kibi-code-proof-kinds
+function proofContractKindErrors(contract: Record<string, unknown>): string[] {
+  const errors: string[] = [];
+  const kind = contract.kind;
+  if (kind !== undefined && !includes(PROOF_KINDS, kind))
+    errors.push(
+      `proof_contract.kind must be one of: ${PROOF_KINDS.join(", ")}; received ${JSON.stringify(kind)}`,
+    );
+  const domain = contract.domain_source;
+  if (domain !== undefined) {
+    const row = record(domain);
+    if (
+      !row ||
+      !nonEmptyString(row.symbol_id) ||
+      (row.export !== undefined && !nonEmptyString(row.export)) ||
+      Object.keys(row).some((key) => key !== "symbol_id" && key !== "export")
+    )
+      errors.push(
+        "proof_contract.domain_source must be {symbol_id, export?} naming the symbol that defines the domain and, when its title is not the export name, the export to read",
+      );
+  } else if (kind === "exhaustive" || kind === "typecheck")
+    errors.push(
+      `proof_contract.domain_source is required for kind ${String(kind)}: name the symbol the proof reads its domain from`,
+    );
+  const witness = contract.witness;
+  if (witness !== undefined) {
+    const row = record(witness);
+    if (!row || !nonEmptyString(row.path) || Object.keys(row).length !== 1)
+      errors.push(
+        "proof_contract.witness must be {path} naming the repository-relative witness file",
+      );
+  } else if (kind === "typecheck")
+    errors.push(
+      "proof_contract.witness is required for kind typecheck: name the file the type checker compiles",
+    );
+  const source = contract.constraint_source;
+  if (source !== undefined) {
+    const row = record(source);
+    const ids = row?.fact_ids;
+    if (
+      !row ||
+      Object.keys(row).length !== 1 ||
+      !Array.isArray(ids) ||
+      ids.length === 0 ||
+      !ids.every(nonEmptyString)
+    )
+      errors.push(
+        "proof_contract.constraint_source must be {fact_ids: [FACT-...]} naming the facts the assumptions come from",
+      );
+  } else if (
+    (kind === "arithmetic" || kind === "smt") &&
+    contract.value_source === undefined
+  )
+    errors.push(
+      `proof_contract.constraint_source or value_source is required for kind ${String(kind)}: name the typed facts or code constants its assumptions come from`,
+    );
+  const valueSource = contract.value_source;
+  if (valueSource !== undefined) {
+    if (
+      !Array.isArray(valueSource) ||
+      valueSource.length === 0 ||
+      !valueSource.every((entry) => {
+        const row = record(entry);
+        return (
+          row !== null &&
+          nonEmptyString(row.symbol_id) &&
+          (row.export === undefined || nonEmptyString(row.export)) &&
+          Object.keys(row).every(
+            (key) => key === "symbol_id" || key === "export",
+          )
+        );
+      })
+    )
+      errors.push(
+        "proof_contract.value_source must be [{symbol_id, export?}] naming the code constants the assumptions read",
+      );
+    else if (kind !== "arithmetic" && kind !== "smt")
+      errors.push(
+        `proof_contract.value_source applies only to kind arithmetic or smt, not ${String(kind ?? "e2e")}`,
+      );
+  }
+  const proves = contract.proves;
+  if (proves !== undefined) {
+    if (
+      !Array.isArray(proves) ||
+      proves.length === 0 ||
+      !proves.every(
+        (key) => typeof key === "string" && /^CLAIM-[A-Za-z0-9]+$/.test(key),
+      ) ||
+      new Set(proves).size !== proves.length
+    )
+      errors.push(
+        "proof_contract.proves must be a non-empty list of distinct claim keys (CLAIM-...) the certificate proves",
+      );
+    else if (!isCertificateProofKind(kind))
+      errors.push(
+        `proof_contract.proves applies only to certificate kinds (exhaustive, typecheck, arithmetic, smt), not ${String(kind ?? "e2e")}`,
+      );
+  }
   return errors;
 }
 
+/**
+ * The optional contract fields beyond the v1 core, copied only when present
+ * so existing contracts keep their hash.
+ */
+// implements REQ-kibi-code-proof-kinds
+export function optionalProofContractFields(
+  contract: Record<string, unknown>,
+): Pick<
+  ProofContract,
+  | "kind"
+  | "domain_source"
+  | "witness"
+  | "constraint_source"
+  | "value_source"
+  | "proves"
+> {
+  const fields: {
+    kind?: ProofKind;
+    domain_source?: { symbol_id: string; export?: string };
+    witness?: { path: string };
+    constraint_source?: { fact_ids: string[] };
+    value_source?: { symbol_id: string; export?: string }[];
+    proves?: string[];
+  } = {};
+  if (typeof contract.kind === "string")
+    fields.kind = contract.kind as ProofKind;
+  const domain = record(contract.domain_source);
+  if (domain && typeof domain.symbol_id === "string")
+    fields.domain_source = {
+      symbol_id: domain.symbol_id,
+      ...(typeof domain.export === "string" ? { export: domain.export } : {}),
+    };
+  const witness = record(contract.witness);
+  if (witness && typeof witness.path === "string")
+    fields.witness = { path: witness.path };
+  const source = record(contract.constraint_source);
+  if (source && Array.isArray(source.fact_ids))
+    fields.constraint_source = {
+      fact_ids: source.fact_ids.filter(
+        (id): id is string => typeof id === "string",
+      ),
+    };
+  if (Array.isArray(contract.value_source))
+    fields.value_source = contract.value_source
+      .map((entry) => record(entry))
+      .filter(
+        (row): row is Record<string, unknown> =>
+          row !== null && typeof row.symbol_id === "string",
+      )
+      .map((row) => ({
+        symbol_id: String(row.symbol_id),
+        ...(typeof row.export === "string" ? { export: row.export } : {}),
+      }));
+  if (Array.isArray(contract.proves))
+    fields.proves = contract.proves.filter(
+      (key): key is string => typeof key === "string",
+    );
+  return fields;
+}
+
 export function proofBindingsErrors(value: unknown): string[] {
   if (!Array.isArray(value))
     return ["proof_bindings must be an array of binding objects"];

package/src/public/proof-receipt.ts

@@ -4,14 +4,33 @@ import {
   proofContractHash,
 } from "./proof-fingerprint.js";
 import {
+  PROOF_KINDS,
   PROOF_RECEIPT_VERSION,
+  PROOF_RECEIPT_VERSIONS,
   PROOF_RESULT_OUTCOMES,
   PROOF_RUN_OUTCOMES,
   type ProofContract,
+  type ProofKind,
+  isCertificateProofKind,
 } from "./proof-protocol.js";
 
 export const PROOF_RECEIPT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
 
+/**
+ * How a certificate binds to a claim its contract names in proves: derived
+ * (Kibi checked it against the claim's fact; the only verdict that proves),
+ * attested (the fact has no derivation; the author vouches) or rejected.
+ */
+// implements REQ-kibi-claim-bound-proofs
+export const CLAIM_BINDING_VERDICTS = [
+  "derived",
+  "attested",
+  "rejected",
+] as const;
+
+// implements REQ-kibi-claim-bound-proofs
+export type ClaimBindingVerdict = (typeof CLAIM_BINDING_VERDICTS)[number];
+
 export const PROOF_RECEIPT_OUTCOMES = [
   "passed",
   "failed",
@@ -25,7 +44,7 @@ export const PROOF_RECEIPT_OUTCOMES = [
 export const PROOF_RECEIPT_SCHEMA = {
   type: "object",
   description:
-    "Kibi-derived kibi.proof-receipt.v1. Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.",
+    "Kibi-derived kibi.proof-receipt.v2 (kibi.proof-receipt.v1 entries are still read). Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.",
   required: [
     "version",
     "receipt_id",
@@ -47,7 +66,7 @@ export const PROOF_RECEIPT_SCHEMA = {
     "proof_results",
   ],
   properties: {
-    version: { type: "string", const: PROOF_RECEIPT_VERSION },
+    version: { type: "string", enum: [...PROOF_RECEIPT_VERSIONS] },
     receipt_id: {
       type: "string",
       pattern: "^PR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$",
@@ -144,6 +163,33 @@ export const PROOF_RECEIPT_SCHEMA = {
         additionalProperties: false,
       },
     },
+    kind: { type: "string", enum: [...PROOF_KINDS] },
+    evidence_level: { type: "string", enum: ["proved", "tested"] },
+    certificate: { type: "object" },
+    certificate_digest: { type: "string", pattern: "^[a-f0-9]{64}$" },
+    certificate_rejection: { type: "string", minLength: 1 },
+    claim_bindings: {
+      type: "array",
+      description:
+        "Certificate kinds: how the certificate binds to each claim its contract names in proves, judged at ingest. derived means Kibi derived the certificate's obligation from the claim's grounding fact and the certificate satisfies it; attested means no derivation exists and the author vouches for it (never proved); rejected names why.",
+      items: {
+        type: "object",
+        required: ["claim_key", "binding"],
+        properties: {
+          claim_key: { type: "string", minLength: 1 },
+          requirement_id: { type: "string", minLength: 1 },
+          fact_id: { type: "string", minLength: 1 },
+          binding: {
+            type: "string",
+            enum: [...CLAIM_BINDING_VERDICTS],
+          },
+          scope: { type: "string", enum: ["code", "intent"] },
+          obligation: { type: "object" },
+          reason: { type: "string", minLength: 1 },
+        },
+        additionalProperties: false,
+      },
+    },
     gaps: {
       type: "array",
       items: {
@@ -162,7 +208,7 @@ export const PROOF_RECEIPT_SCHEMA = {
 } as const;
 
 export type ProofReceipt = Readonly<{
-  version: typeof PROOF_RECEIPT_VERSION;
+  version: (typeof PROOF_RECEIPT_VERSIONS)[number];
   receipt_id: string;
   test_id: string;
   scope: "unit" | "integration" | "end_to_end";
@@ -201,6 +247,27 @@ export type ProofReceipt = Readonly<{
     readonly target: string;
     readonly reason: string;
   }[];
+  /** v2: what the contract's checker establishes. */
+  kind?: ProofKind;
+  /** v2: proved only for a passed certificate kind whose certificate re-checked. */
+  evidence_level?: "proved" | "tested";
+  certificate?: Readonly<Record<string, unknown>>;
+  certificate_digest?: string;
+  certificate_rejection?: string;
+  /** Certificate kinds: the binding to each claim the contract names in proves. */
+  claim_bindings?: readonly ClaimBinding[];
+}>;
+
+/** How one certificate binds to one requirement claim, judged at ingest. */
+// implements REQ-kibi-claim-bound-proofs
+export type ClaimBinding = Readonly<{
+  claim_key: string;
+  requirement_id?: string;
+  fact_id?: string;
+  binding: ClaimBindingVerdict;
+  scope?: "code" | "intent";
+  obligation?: Readonly<Record<string, unknown>>;
+  reason?: string;
 }>;
 
 export function finishedAtPrecedesStartedAt(
@@ -285,14 +352,17 @@ function validFingerprintComponents(value: unknown): boolean {
   );
 }
 
-/** Structural validation of one kibi.proof-receipt.v1 entry. */
+/** Structural validation of one kibi.proof-receipt.v1 or v2 entry. */
 export function validProofReceiptShape(
   testId: string,
   receipt: unknown,
 ): boolean {
   const row = isRecord(receipt) ? receipt : null;
   if (!row) return false;
-  if (row.version !== PROOF_RECEIPT_VERSION) return false;
+  if (!(PROOF_RECEIPT_VERSIONS as readonly unknown[]).includes(row.version))
+    return false;
+  if (row.version === PROOF_RECEIPT_VERSION && !validV2Fields(row))
+    return false;
   if (
     typeof row.receipt_id !== "string" ||
     !/^PR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(row.receipt_id)
@@ -358,9 +428,59 @@ export function validProofReceiptShape(
   return !finishedAtPrecedesStartedAt(startedAt, finishedAt);
 }
 
+// implements REQ-kibi-code-proof-kinds
+function validV2Fields(row: Record<string, unknown>): boolean {
+  if (!(PROOF_KINDS as readonly unknown[]).includes(row.kind)) return false;
+  if (row.evidence_level !== "proved" && row.evidence_level !== "tested")
+    return false;
+  if (
+    row.evidence_level === "proved" &&
+    (row.outcome !== "passed" ||
+      !isCertificateProofKind(row.kind) ||
+      !isRecord(row.certificate) ||
+      !hex64(row.certificate_digest) ||
+      row.certificate_rejection !== undefined)
+  )
+    return false;
+  if (row.certificate !== undefined && !isRecord(row.certificate)) return false;
+  if (row.certificate_digest !== undefined && !hex64(row.certificate_digest))
+    return false;
+  if (
+    row.certificate_rejection !== undefined &&
+    !nonEmptyString(row.certificate_rejection)
+  )
+    return false;
+  if (
+    row.claim_bindings !== undefined &&
+    !validClaimBindings(row.claim_bindings)
+  )
+    return false;
+  return true;
+}
+
+// implements REQ-kibi-claim-bound-proofs
+function validClaimBindings(value: unknown): boolean {
+  return (
+    Array.isArray(value) &&
+    value.every(
+      (entry) =>
+        isRecord(entry) &&
+        nonEmptyString(entry.claim_key) &&
+        (CLAIM_BINDING_VERDICTS as readonly unknown[]).includes(
+          entry.binding,
+        ) &&
+        (entry.scope === undefined ||
+          entry.scope === "code" ||
+          entry.scope === "intent") &&
+        (entry.obligation === undefined || isRecord(entry.obligation)) &&
+        (entry.reason === undefined || nonEmptyString(entry.reason)),
+    )
+  );
+}
+
 /**
  * Full-history validation for proof_receipts: unique ids, per-test binding,
- * supported scope, ordered timestamps, and structurally valid v1 entries.
+ * supported scope, ordered timestamps, and structurally valid v1 or v2 entries.
  */
 export function proofReceiptHistoryErrors(
   testId: string,
@@ -388,7 +508,7 @@ export function proofReceiptHistoryErrors(
     }
     if (!validProofReceiptShape(testId, receipt)) {
       errors.push(
-        `${prefix} must be a structurally valid kibi.proof-receipt.v1 bound to '${testId}'`,
+        `${prefix} must be a structurally valid kibi.proof-receipt.v2 (or v1) bound to '${testId}'`,
       );
       continue;
     }

package/src/public/schemas/entity.ts

@@ -17,6 +17,7 @@
  */
 
 import { ENTITY_ORIGIN_SCHEMA } from "../entity-origin.js";
+import { EVIDENCE_LEVELS } from "../evidence-levels.js";
 import {
   PROOF_BINDINGS_SCHEMA,
   PROOF_CONTRACT_SCHEMA,
@@ -364,6 +365,12 @@ const entitySchema: Record<string, unknown> = {
       description:
         "Requirement and ADR only. How firmly the decision was made. firm: a human stated it as a rule; it needs a ref (origin.ref, or approval_ref on a requirement) to their words, and only a human may change it. default: a delegated or agent choice; a later agent may supersede it with evidence. exploratory: a flagged guess, expected to be revisited. When absent, it reads as default if an agent wrote the entity (origin.kind agent) and as firm otherwise (a person's, imported or migrated decision); set it explicitly when recording a decision.",
     },
+    required_evidence: {
+      type: "string",
+      enum: [...EVIDENCE_LEVELS],
+      description:
+        "Requirement-only. The weakest evidence level this current requirement accepts; the evidence-floor check rule fails while its computed evidence level is lower. proved: a re-checkable certificate covers every case. tested: fresh passing E2E receipts cover every linked scenario. asserted: a person stands behind it. unverified: no floor. When absent, it is tested for a firm requirement and unverified otherwise.",
+    },
     expects: {
       type: "string",
       enum: ["success", "rejection", "error"],
@@ -543,8 +550,17 @@ const entitySchema: Record<string, unknown> = {
     subject_key: { type: "string" },
     property_key: { type: "string" },
     operator: { type: "string", enum: ["eq", "neq", "lt", "lte", "gt", "gte"] },
-    value_type: { type: "string", enum: ["string", "int", "number", "bool"] },
+    value_type: {
+      type: "string",
+      enum: ["string", "int", "number", "bool", "set"],
+    },
     value_string: { type: "string" },
+    value_set: {
+      type: "array",
+      items: { type: "string", minLength: 1 },
+      minItems: 1,
+      uniqueItems: true,
+    },
     value_int: { type: "integer" },
     value_number: { type: "number" },
     value_bool: { type: "boolean" },
@@ -643,6 +659,7 @@ const entitySchema: Record<string, unknown> = {
             { required: ["value_int"] },
             { required: ["value_number"] },
             { required: ["value_bool"] },
+            { required: ["value_set"] },
             { required: ["unit"] },
             { required: ["scope"] },
             { required: ["polarity"] },
@@ -715,6 +732,7 @@ const entitySchema: Record<string, unknown> = {
             { required: ["approval_ref"] },
             { required: ["rationale"] },
             { required: ["exempts_claims"] },
+            { required: ["required_evidence"] },
           ],
         },
       },

package/src/public/skills/kibi-bootstrap/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-bootstrap
 name: kibi-bootstrap
 description: "Use for any Kibi bootstrap or onboarding task: seeding a new or thin knowledge base; reviewing a bootstrap or onboarding plan, preview, or evidence; judging approval readiness or coverage; diagnosing a blocked, partial, or failed bootstrap or its repair; applying an approved bootstrap plan; or asking the human which knowledge sources hold intent. Covers kb_status first, source interview, cited intent claims, read-only kb_plan_bootstrap preview, explicit approval, exact-plan kb_apply_plan, and repair-safe close-out."
-version: 3.16.0
+version: 3.17.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -43,7 +43,7 @@ Seed branch-local Kibi knowledge from cited product intent, without creating a p
 9. **Read back** with `kb_query` and `kb_search` to confirm writes and citations.
 10. **Close out** with `kb_check`, then `kb_status`.
 11. **Deepen.** Bootstrap is complete; the KB is now half-way, holding cited `req` entries and review facts but no scenarios, tests or predicates. Load `kibi-usage` and continue in the normal Kibi workflow, one area at a time, telling the human what you author:
-    - **Unplanned claims.** For every claim suppressed as `invalid_write` and every `sourceOnlySignals` entry ("Author requirement …"), restate the claim's statement and citation (`sourceId:reference`), model it with `kb_model` (`mode: "requirement"`, or `mode: "predicates"` for domain claims), and write the result with `kb_upsert` (`dryRun: true` first) with `origin: {kind: "import", ref: "<sourceId:reference>"}` and `firmness: "firm"`, as the plan does for the claims it writes. Without an explicit origin `kb_upsert` records the requirement as the agent's own `default` choice, which a later agent may supersede without asking.
+    - **Unplanned claims.** For every claim suppressed as `invalid_write` and every `sourceOnlySignals` entry ("Author requirement …"), restate the claim's statement and citation (`sourceId:reference`), model it with `kb_model` (`mode: "requirement"`, or `mode: "predicates"` for domain claims), and write the result with `kb_upsert` (`dryRun: true` first) with `origin: {kind: "import", ref: "<sourceId:reference>"}` and `firmness: "firm"` and `required_evidence: "asserted"`, as the plan does for the claims it writes; raise the floor (drop `required_evidence`) only once an end-to-end proof covers the requirement. Without an explicit origin `kb_upsert` records the requirement as the agent's own `default` choice, which a later agent may supersede without asking.
     - **Scenarios.** Write scenarios from the cited ticket's acceptance criteria, one scenario per criterion, not bulk drafts from the requirement title; ask the human when the source states none. Give each a plain title, the scenario prose in `document.body` (never in `properties`), and `assumes` links to the `property_value` facts whose values the scenario relies on. Set `expects` only when the scenario links `assumes` facts (or its criterion names concrete values that become them); `expects` without `assumes` only yields a feasibility-unknown warning, so a draft tagged `needs-human-review` omits `expects`. Then link the requirement with `specified_by` (upsert the `req` with its stored `title`, a `status` and that relationship only). Example: criterion "Given an annotation in draft state, when the user deletes it, the draft is cleared" becomes `{"type":"scenario","id":"SCEN-annotation-delete-clears-draft","properties":{"title":"Deleting a draft annotation clears the draft","status":"active","expects":"success"},"document":{"body":"Given an annotation in draft state, when the user deletes it, then the draft is cleared and nothing is published.\n\nThe acceptance criterion comes from the cited ticket; reviewers asked for it so a deleted draft never reappears after reload.\n"},"relationships":[{"type":"assumes","from":"SCEN-annotation-delete-clears-draft","to":"FACT-annotation-state-draft"}]}`, where the assumed fact is a `property_value` (`annotation.state` `eq` `draft`). Link existing tests that exercise it; never invent test evidence.
     - **Predicates.** Run `kb_model` with `mode: "predicates"` and `requirementId` on each persisted requirement and apply a returned plan with `requires_predicate` to its `relationshipTarget` (the planned `FACT-PRED-…` id, never a `SUGGEST-…` candidate id), or record the `review:ontology-gap` observation it returns, with its prose in `document.body`. A non-empty `existingGrounding` means the bootstrap already grounded that claim: on `replace_grounding` leave it unless the human wants the `replacementPlan` swap; on `provide_argument_bindings` retry with the listed arguments bound; on `record_ontology_gap` still write the returned gap observation, which is not a grounding link. Count what `kb_query` shows afterwards, not the calls you made.
     - **Unrecorded ambiguity.** Record any conflict or open question you found but did not declare in step 3 as a cited `fact_kind: observation` tagged `review:conflict` or `review:open-question`.

package/src/public/skills/kibi-commit-review/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-commit-review
 name: kibi-commit-review
 description: "Use when kibi check --staged or the Kibi pre-commit hook blocks a commit (kibi_impact_evidence_missing, symbols_manifest_stale, symbol_granularity_violation, symbol-coverage, kibi check-generated drift, Staged impact review failed), or when preparing a commit or pull-request impact review. Covers reading the per-file Detail lines, authoring .kb/symbols.yaml symbol entries through kb_upsert, kibi sync --refresh-symbol-coordinates, staging the tracked Kibi evidence with git add, kb_prepare_impact_review for a staged or diff scope, the kibi signoff requirements summary to show before a commit, and how merge commits and migration renames are judged."
-version: 1.2.0
+version: 1.2.2
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -85,8 +85,9 @@ requirement with its statement (before and after for a rewrite), firmness,
 origin, scenarios and proof state. Put it in your reply unchanged (in the
 messaging tool's message when replies go through one), then add one or two
 sentences on why the requirements changed. Offer the full page with
-`kibi signoff --format html --open`, or attach or publish
-`.kb/briefs/signoff/latest.html` when your host can carry a file or a page;
+`kibi signoff --format html --open`, or publish `.kb/briefs/signoff/latest.html`
+as a rendered page when your host has a page tool (the Artifact tool in Claude
+apps); never attach the `.html` as a file, which chat apps show as raw source;
 past 15 requirements the Markdown stops and only the page lists them all.
 Host details: `kibi-decisions`, `resources/signoff-views.md`. `--no-proof` skips the proof lookup, which reads coverage and is slow
 on a large knowledge base. The summary is not an approval: never set