kibi-cli 2.31.1 → 2.32.0

package/dist/public/operations/specs/reporting.js

@@ -133,7 +133,7 @@ export async function perContractTestBindings(context) {
     if (currentProofBindingMode() !== "per_contract")
         return null;
     const { loadEntities } = await import("../discovery-entities.js");
-    const { currentReceiptBindingHash, loadCoveredBySymbolsByTest } = await import("../../../operations/proof/code-scope.js");
+    const { currentReceiptBindingHashes, loadCoveredBySymbolsByTest } = await import("../../../operations/proof/code-scope.js");
     // Only the contract, scoped code, and authored source feed the binding
     // hash. The paged projection never materializes receipt histories, which
     // grow without bound and previously overflowed the bounded Prolog output
@@ -161,14 +161,18 @@ export async function perContractTestBindings(context) {
             continue;
         // The same computation ingest uses to write binding_hash. Unreadable or
         // non-markdown documents keep strict snapshot semantics for that test.
-        const binding = await currentReceiptBindingHash({
+        const bindings = await currentReceiptBindingHashes({
             workspaceRoot: context.workspaceRoot,
             readFile: (absolute) => fs.readFile(absolute),
             test,
             coveredBySymbols: coveredBy.get(testId) ?? [],
         });
-        if (binding !== undefined) {
-            entries.push(`${toPrologAtom(testId)}: ${toPrologAtom(binding)}`);
+        if (bindings !== undefined) {
+            // One hash, or the current and the earlier binding a receipt may carry.
+            const value = bindings.length === 1
+                ? toPrologAtom(bindings[0])
+                : `[${bindings.map(toPrologAtom).join(", ")}]`;
+            entries.push(`${toPrologAtom(testId)}: ${value}`);
         }
     }
     if (entries.length === 0)
@@ -207,14 +211,19 @@ export async function executeCoverage(input, context) {
             : "unknown";
         const checkedAt = context.clock().toISOString();
         const statuses = (input.statuses ?? []).map((status) => validateCoverageStatus(status));
-        const bindingsDict = statuses.length === 0 && (input.by ?? "req") === "req"
+        // A status filter judges receipts with the same per-contract binding as
+        // the unfiltered report; otherwise its rows and summary disagree with
+        // every other proof view.
+        const bindingsDict = (input.by ?? "req") === "req"
             ? await perContractTestBindings(context)
             : null;
-        const goalFor = (limit, offset) => bindingsDict !== null
-            ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, per_contract, ${bindingsDict}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
-            : statuses.length > 0
-                ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${toPrologList(statuses)}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
-                : `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`;
+        const goalFor = (limit, offset) => bindingsDict !== null && statuses.length > 0
+            ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${toPrologList(statuses)}, per_contract, ${bindingsDict}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
+            : bindingsDict !== null
+                ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, per_contract, ${bindingsDict}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
+                : statuses.length > 0
+                    ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${toPrologList(statuses)}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
+                    : `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`;
         const payload = await readCoveragePages(requireProlog(context), goalFor, input.limit ?? 100, input.offset ?? 0);
         const rows = (input.by ?? "req") === "req"
             ? await addCoordinateRepairEvidence(payload.rows, context)

package/dist/public/operations/specs/upsert.d.ts

@@ -140,6 +140,11 @@ export declare const upsertSpec: {
                         readonly enum: readonly ["firm", "default", "exploratory"];
                         readonly description: "req/adr only. firm = a human stated it as a rule (needs origin.ref to their words); its title, meaning or firmness changes only with new human words (a new origin.ref) or by supersede. default = delegated or agent choice; exploratory = flagged guess. Absent = default if an agent wrote it, else firm.";
                     };
+                    readonly required_evidence: {
+                        readonly type: "string";
+                        readonly enum: readonly ["proved", "tested", "asserted", "unverified"];
+                        readonly description: "Requirement-only. Weakest evidence level it accepts; the evidence-floor rule fails below it. Absent = tested if firm, else unverified.";
+                    };
                     readonly rationale: {
                         readonly type: "string";
                         readonly minLength: 1;
@@ -219,7 +224,87 @@ export declare const upsertSpec: {
                             };
                             readonly success_policy: {
                                 readonly type: "string";
-                                readonly enum: readonly ["all_required_first_attempt"];
+                                readonly enum: readonly ["all_required_first_attempt", "own_results_first_attempt"];
+                            };
+                            readonly kind: {
+                                readonly type: "string";
+                                readonly enum: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt"];
+                                readonly description: "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic and smt must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved.";
+                            };
+                            readonly domain_source: {
+                                readonly type: "object";
+                                readonly description: "exhaustive and typecheck: the symbol that defines the finite domain. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.";
+                                readonly required: readonly ["symbol_id"];
+                                readonly properties: {
+                                    readonly symbol_id: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                    };
+                                    readonly export: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                        readonly description: "The name the domain is exported under in the symbol's source file, when the symbol's title is not that name.";
+                                    };
+                                };
+                                readonly additionalProperties: false;
+                            };
+                            readonly witness: {
+                                readonly type: "object";
+                                readonly description: "typecheck: the repository-relative witness file Kibi compiles (an exhaustive switch ending in never, or a mapped type over the domain).";
+                                readonly required: readonly ["path"];
+                                readonly properties: {
+                                    readonly path: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                    };
+                                };
+                                readonly additionalProperties: false;
+                            };
+                            readonly proves: {
+                                readonly type: "array";
+                                readonly description: "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt); a claim with no such derivation is only attested and never counts as proved.";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "string";
+                                    readonly pattern: "^CLAIM-";
+                                };
+                                readonly uniqueItems: true;
+                            };
+                            readonly value_source: {
+                                readonly type: "array";
+                                readonly description: "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base.";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "object";
+                                    readonly required: readonly ["symbol_id"];
+                                    readonly properties: {
+                                        readonly symbol_id: {
+                                            readonly type: "string";
+                                            readonly minLength: 1;
+                                        };
+                                        readonly export: {
+                                            readonly type: "string";
+                                            readonly minLength: 1;
+                                        };
+                                    };
+                                    readonly additionalProperties: false;
+                                };
+                            };
+                            readonly constraint_source: {
+                                readonly type: "object";
+                                readonly description: "arithmetic and smt: the typed numeric property_value facts the certificate's assumptions come from. Kibi checks the assumptions (or the query's assertions) are exactly these facts' constraints, so the proof is about the knowledge base, not numbers the test chose.";
+                                readonly required: readonly ["fact_ids"];
+                                readonly properties: {
+                                    readonly fact_ids: {
+                                        readonly type: "array";
+                                        readonly minItems: 1;
+                                        readonly items: {
+                                            readonly type: "string";
+                                            readonly minLength: 1;
+                                        };
+                                    };
+                                };
+                                readonly additionalProperties: false;
                             };
                         };
                         readonly additionalProperties: false;
@@ -267,12 +352,12 @@ export declare const upsertSpec: {
                         readonly maxItems: 50;
                         readonly items: {
                             readonly type: "object";
-                            readonly description: "Kibi-derived kibi.proof-receipt.v1. Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.";
+                            readonly description: "Kibi-derived kibi.proof-receipt.v2 (kibi.proof-receipt.v1 entries are still read). Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.";
                             readonly required: readonly ["version", "receipt_id", "test_id", "scope", "outcome", "code_snapshot", "environment_hash", "started_at", "finished_at", "artifact_digest", "contract_hash", "fingerprint", "fingerprint_components", "integration_id", "producer", "command_argv", "run_outcome", "proof_results"];
                             readonly properties: {
                                 readonly version: {
                                     readonly type: "string";
-                                    readonly const: "kibi.proof-receipt.v1";
+                                    readonly enum: readonly ["kibi.proof-receipt.v1", "kibi.proof-receipt.v2"];
                                 };
                                 readonly receipt_id: {
                                     readonly type: "string";
@@ -454,6 +539,63 @@ export declare const upsertSpec: {
                                         readonly additionalProperties: false;
                                     };
                                 };
+                                readonly kind: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt"];
+                                };
+                                readonly evidence_level: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["proved", "tested"];
+                                };
+                                readonly certificate: {
+                                    readonly type: "object";
+                                };
+                                readonly certificate_digest: {
+                                    readonly type: "string";
+                                    readonly pattern: "^[a-f0-9]{64}$";
+                                };
+                                readonly certificate_rejection: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                                readonly claim_bindings: {
+                                    readonly type: "array";
+                                    readonly description: "Certificate kinds: how the certificate binds to each claim its contract names in proves, judged at ingest. derived means Kibi derived the certificate's obligation from the claim's grounding fact and the certificate satisfies it; attested means no derivation exists and the author vouches for it (never proved); rejected names why.";
+                                    readonly items: {
+                                        readonly type: "object";
+                                        readonly required: readonly ["claim_key", "binding"];
+                                        readonly properties: {
+                                            readonly claim_key: {
+                                                readonly type: "string";
+                                                readonly minLength: 1;
+                                            };
+                                            readonly requirement_id: {
+                                                readonly type: "string";
+                                                readonly minLength: 1;
+                                            };
+                                            readonly fact_id: {
+                                                readonly type: "string";
+                                                readonly minLength: 1;
+                                            };
+                                            readonly binding: {
+                                                readonly type: "string";
+                                                readonly enum: readonly ["derived", "attested", "rejected"];
+                                            };
+                                            readonly scope: {
+                                                readonly type: "string";
+                                                readonly enum: readonly ["code", "intent"];
+                                            };
+                                            readonly obligation: {
+                                                readonly type: "object";
+                                            };
+                                            readonly reason: {
+                                                readonly type: "string";
+                                                readonly minLength: 1;
+                                            };
+                                        };
+                                        readonly additionalProperties: false;
+                                    };
+                                };
                                 readonly gaps: {
                                     readonly type: "array";
                                     readonly items: {
@@ -501,8 +643,8 @@ export declare const upsertSpec: {
                     };
                     readonly value_type: {
                         readonly type: "string";
-                        readonly enum: readonly ["string", "int", "number", "bool"];
-                        readonly description: "Optional typed value discriminator for property_value facts. Pair with exactly one value_string, value_int, value_number, or value_bool; do not use generic value.";
+                        readonly enum: readonly ["string", "int", "number", "bool", "set"];
+                        readonly description: "Optional typed value discriminator for property_value facts. Pair with exactly one value_string, value_int, value_number, value_bool, or value_set (set: an exact list of allowed values, operator eq or neq); do not use generic value.";
                     };
                     readonly value_string: {
                         readonly type: "string";
@@ -520,6 +662,16 @@ export declare const upsertSpec: {
                         readonly type: "boolean";
                         readonly description: "Optional boolean value for property_value facts.";
                     };
+                    readonly value_set: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly description: "Optional exact set of values for property_value facts with value_type set, such as the members a domain must have.";
+                    };
                     readonly unit: {
                         readonly type: "string";
                         readonly description: "Optional unit for numeric property_value facts.";

package/dist/public/operations/specs/upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upsert.d.ts","sourceRoot":"","sources":["../../../../src/public/operations/specs/upsert.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAQvE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0DuC,CAAC"}
+{"version":3,"file":"upsert.d.ts","sourceRoot":"","sources":["../../../../src/public/operations/specs/upsert.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAQvE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0DuC,CAAC"}

package/dist/public/proof-certificates.d.ts

@@ -0,0 +1,89 @@
+import { CODE_CERTIFICATE_VERSION } from "./proof-protocol.js";
+/** Where `kibi prove` asks a run to leave its certificates. */
+export declare const PROOF_CERTIFICATES_ENV = "KIBI_PROOF_CERTIFICATES";
+export type CodeCertificate = Readonly<Record<string, unknown>> & Readonly<{
+    version: typeof CODE_CERTIFICATE_VERSION;
+    kind: "exhaustive" | "typecheck" | "arithmetic" | "smt";
+    test_id: string;
+}>;
+/**
+ * The canonical JSON of a certificate, byte for byte what
+ * code_certificates.pl hashes: keys sorted by code point, no whitespace,
+ * non-ASCII and control characters as \u escapes of UTF-16 code units.
+ */
+export declare function canonicalCertificateJson(value: unknown): string;
+/** The sha256 a receipt records for its certificate. */
+export declare function certificateDigest(certificate: unknown): string;
+export type ExhaustiveResult = Readonly<{
+    member: string;
+    outcome: "passed" | "failed";
+    message?: string;
+}>;
+/**
+ * Run `check` on every member of a finite domain and record each outcome.
+ * `members` must be the domain as the code defines it (import it from its
+ * source, never restate it): Kibi rejects the certificate unless the proof
+ * file imports the contract's domain_source symbol.
+ */
+export declare function exhaustiveCertificate<T>(input: {
+    testId: string;
+    domain: Readonly<{
+        symbolId: string;
+        members: Iterable<T>;
+    }>;
+    key?: (member: T) => string;
+    check: (member: T) => void | Promise<void>;
+}): Promise<CodeCertificate>;
+/** The members an exhaustive certificate records as failed. */
+export declare function failedMembers(certificate: CodeCertificate): string[];
+/**
+ * A type checker accepted `witnessPath`, a file that fails to compile when a
+ * member of the domain goes unhandled (an exhaustive switch ending in a
+ * `never` assignment, or a mapped type over the domain).
+ */
+export declare function typecheckCertificate(input: {
+    testId: string;
+    domainSymbolId: string;
+    witnessPath: string;
+    workspaceRoot?: string;
+    compiler: Readonly<{
+        name: string;
+        version: string;
+    }>;
+    accepted: boolean;
+}): CodeCertificate;
+export type ArithmeticConstraint = Readonly<{
+    operator: "eq" | "neq" | "lt" | "lte" | "gt" | "gte";
+    value: number;
+}>;
+/**
+ * A claim about one numeric variable that Kibi decides exactly: the
+ * assumptions must be satisfiable and must entail the claim for every value
+ * of the variable, not only the values a test happened to try.
+ */
+export declare function arithmeticCertificate(input: {
+    testId: string;
+    variable: string;
+    valueType: "int" | "real";
+    assumptions: readonly ArithmeticConstraint[];
+    claim: ArithmeticConstraint;
+}): CodeCertificate;
+/**
+ * An SMT-LIB query whose unsat answer proves the claim (the query asserts
+ * the claim's negation). Kibi re-runs the named solver on the query.
+ */
+export declare function smtCertificate(input: {
+    testId: string;
+    solver: Readonly<{
+        name: "z3" | "cvc5";
+        version: string;
+    }>;
+    query: string;
+    result: string;
+}): CodeCertificate;
+/**
+ * Leave the certificate where `kibi prove` reads it. Returns the file written,
+ * or null outside a `kibi prove` run.
+ */
+export declare function writeCodeCertificate(certificate: CodeCertificate, env?: NodeJS.ProcessEnv): string | null;
+//# sourceMappingURL=proof-certificates.d.ts.map

package/dist/public/proof-certificates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-certificates.d.ts","sourceRoot":"","sources":["../../src/public/proof-certificates.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,+DAA+D;AAE/D,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAGhE,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC7D,QAAQ,CAAC;IACP,OAAO,EAAE,OAAO,wBAAwB,CAAC;IACzC,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,YAAY,GAAG,KAAK,CAAC;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAmCL;;;;GAIG;AAEH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAc/D;AAED,wDAAwD;AAExD,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,CAI9D;AAGD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH;;;;;GAKG;AAEH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C,GAAG,OAAO,CAAC,eAAe,CAAC,CA0B3B;AAED,+DAA+D;AAE/D,wBAAgB,aAAa,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,EAAE,CASpE;AAED;;;;GAIG;AAEH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,eAAe,CAmBlB;AAGD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IACrD,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH;;;;GAIG;AAEH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;IAC1B,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7C,KAAK,EAAE,oBAAoB,CAAC;CAC7B,GAAG,eAAe,CAUlB;AAED;;;GAGG;AAEH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,eAAe,CASlB;AAED;;;GAGG;AAEH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,eAAe,EAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAUf"}

package/dist/public/proof-certificates.js

@@ -0,0 +1,207 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+/**
+ * Builders for the kibi.code-certificate.v1 a certificate-kind proof contract
+ * leaves for `kibi prove`. A test builds its certificate and writes it with
+ * writeCodeCertificate; outside `kibi prove` the write is a no-op, so the same
+ * test runs unchanged in an ordinary test run. Kibi re-checks every
+ * certificate at ingest and again whenever it reports evidence, so a
+ * certificate only records what the test did; it never vouches for itself.
+ */
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { CODE_CERTIFICATE_VERSION } from "./proof-protocol.js";
+/** Where `kibi prove` asks a run to leave its certificates. */
+// implements REQ-kibi-code-proof-kinds
+export const PROOF_CERTIFICATES_ENV = "KIBI_PROOF_CERTIFICATES";
+function compareCodePoints(left, right) {
+    const a = Array.from(left, (char) => char.codePointAt(0) ?? 0);
+    const b = Array.from(right, (char) => char.codePointAt(0) ?? 0);
+    for (let index = 0; index < Math.min(a.length, b.length); index++) {
+        const difference = (a[index] ?? 0) - (b[index] ?? 0);
+        if (difference !== 0)
+            return difference;
+    }
+    return a.length - b.length;
+}
+const JSON_ESCAPES = {
+    '"': '\\"',
+    "\\": "\\\\",
+    "\b": "\\b",
+    "\f": "\\f",
+    "\n": "\\n",
+    "\r": "\\r",
+    "\t": "\\t",
+};
+function canonicalString(value) {
+    let out = '"';
+    for (let index = 0; index < value.length; index++) {
+        const char = value[index];
+        const unit = value.charCodeAt(index);
+        const escaped = JSON_ESCAPES[char];
+        if (escaped !== undefined)
+            out += escaped;
+        else if (unit >= 0x20 && unit <= 0x7e)
+            out += char;
+        else
+            out += `\\u${unit.toString(16).padStart(4, "0")}`;
+    }
+    return `${out}"`;
+}
+/**
+ * The canonical JSON of a certificate, byte for byte what
+ * code_certificates.pl hashes: keys sorted by code point, no whitespace,
+ * non-ASCII and control characters as \u escapes of UTF-16 code units.
+ */
+// implements REQ-kibi-code-proof-kinds
+export function canonicalCertificateJson(value) {
+    if (value === null || value === undefined)
+        return "null";
+    if (Array.isArray(value))
+        return `[${value.map(canonicalCertificateJson).join(",")}]`;
+    if (typeof value === "object")
+        return `{${Object.keys(value)
+            .sort(compareCodePoints)
+            .map((key) => `${canonicalString(key)}:${canonicalCertificateJson(value[key])}`)
+            .join(",")}}`;
+    if (typeof value === "string")
+        return canonicalString(value);
+    return JSON.stringify(value);
+}
+/** The sha256 a receipt records for its certificate. */
+// implements REQ-kibi-code-proof-kinds
+export function certificateDigest(certificate) {
+    return createHash("sha256")
+        .update(canonicalCertificateJson(certificate), "utf8")
+        .digest("hex");
+}
+/**
+ * Run `check` on every member of a finite domain and record each outcome.
+ * `members` must be the domain as the code defines it (import it from its
+ * source, never restate it): Kibi rejects the certificate unless the proof
+ * file imports the contract's domain_source symbol.
+ */
+// implements REQ-kibi-code-proof-kinds
+export async function exhaustiveCertificate(input) {
+    const key = input.key ?? ((member) => String(member));
+    const members = [...input.domain.members];
+    const results = [];
+    for (const member of members) {
+        try {
+            await input.check(member);
+            results.push({ member: key(member), outcome: "passed" });
+        }
+        catch (error) {
+            results.push({
+                member: key(member),
+                outcome: "failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return {
+        version: CODE_CERTIFICATE_VERSION,
+        kind: "exhaustive",
+        test_id: input.testId,
+        domain: {
+            symbol_id: input.domain.symbolId,
+            members: members.map(key),
+        },
+        results,
+    };
+}
+/** The members an exhaustive certificate records as failed. */
+// implements REQ-kibi-code-proof-kinds
+export function failedMembers(certificate) {
+    const results = Array.isArray(certificate.results)
+        ? certificate.results
+        : [];
+    return results
+        .filter((result) => result.outcome !== "passed")
+        .map((result) => result.message ? `${result.member}: ${result.message}` : result.member);
+}
+/**
+ * A type checker accepted `witnessPath`, a file that fails to compile when a
+ * member of the domain goes unhandled (an exhaustive switch ending in a
+ * `never` assignment, or a mapped type over the domain).
+ */
+// implements REQ-kibi-code-proof-kinds
+export function typecheckCertificate(input) {
+    const absolute = path.resolve(input.workspaceRoot ?? process.cwd(), input.witnessPath);
+    return {
+        version: CODE_CERTIFICATE_VERSION,
+        kind: "typecheck",
+        test_id: input.testId,
+        domain: { symbol_id: input.domainSymbolId },
+        witness: {
+            path: input.witnessPath,
+            sha256: createHash("sha256")
+                .update(readFileSync(absolute, "utf8"))
+                .digest("hex"),
+        },
+        compiler: { ...input.compiler },
+        outcome: input.accepted ? "passed" : "failed",
+    };
+}
+/**
+ * A claim about one numeric variable that Kibi decides exactly: the
+ * assumptions must be satisfiable and must entail the claim for every value
+ * of the variable, not only the values a test happened to try.
+ */
+// implements REQ-kibi-code-proof-kinds
+export function arithmeticCertificate(input) {
+    return {
+        version: CODE_CERTIFICATE_VERSION,
+        kind: "arithmetic",
+        test_id: input.testId,
+        variable: input.variable,
+        value_type: input.valueType,
+        assumptions: input.assumptions.map((row) => ({ ...row })),
+        claim: { ...input.claim },
+    };
+}
+/**
+ * An SMT-LIB query whose unsat answer proves the claim (the query asserts
+ * the claim's negation). Kibi re-runs the named solver on the query.
+ */
+// implements REQ-kibi-code-proof-kinds
+export function smtCertificate(input) {
+    return {
+        version: CODE_CERTIFICATE_VERSION,
+        kind: "smt",
+        test_id: input.testId,
+        solver: { ...input.solver },
+        query: input.query,
+        result: input.result,
+    };
+}
+/**
+ * Leave the certificate where `kibi prove` reads it. Returns the file written,
+ * or null outside a `kibi prove` run.
+ */
+// implements REQ-kibi-code-proof-kinds
+export function writeCodeCertificate(certificate, env = process.env) {
+    const directory = env[PROOF_CERTIFICATES_ENV];
+    if (directory === undefined || directory.trim() === "")
+        return null;
+    mkdirSync(directory, { recursive: true });
+    const file = path.join(directory, `${certificate.test_id.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
+    writeFileSync(file, `${JSON.stringify(certificate, null, 2)}\n`, "utf8");
+    return file;
+}