kibi-cli 2.31.1 → 2.32.0

package/dist/commands/prove.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { executeIngestProof } from "../operations/proof/ingest-proof.js";
 import { PROOF_TEST_REPORT_ENV, PROOF_TEST_REPORT_VERSION, attributeCommandRun, proofTestReportPath, } from "../proof/command-test-report.js";
@@ -7,9 +7,13 @@ import { PROOF_RUNS_DIR, loadProofIntegrations, resolveIntegration, } from "../p
 import { convertJUnitXml } from "../proof/producers/junit-adapter.js";
 import { convertTap } from "../proof/producers/tap-adapter.js";
 import { loadEntities } from "../public/operations/discovery-entities.js";
+import { runOperationJsonQuery, toPrologAtom, } from "../public/operations/prolog-json.js";
 import { ingestProofSpec } from "../public/operations/specs/proof.js";
+import { currentProofBindingMode, perContractTestBindings, } from "../public/operations/specs/reporting.js";
 import { readWorkspaceSnapshot } from "../public/operations/workspace-snapshot.js";
+import { PROOF_CERTIFICATES_ENV } from "../public/proof-certificates.js";
 import { PROOF_RUN_VERSION, proofBindingsErrors, proofRunArtifactErrors, } from "../public/proof-protocol.js";
+import { PROOF_RECEIPT_MAX_AGE_SECONDS } from "../public/proof-receipt.js";
 import { createCliRuntime } from "../runtime/cli-runtime.js";
 /**
  * Describe which paths moved when a proof snapshot refusal fires, so
@@ -70,19 +74,56 @@ function parseContract(test) {
         return null;
     return contract;
 }
-async function runChild(commandArgv, cwd, env) {
+/** Run a proof integration's command and resolve with its exit code. */
+// implements REQ-kibi-verification-evidence-contract
+export async function runChild(commandArgv, cwd, env) {
     const [command, ...args] = commandArgv;
     if (!command)
         throw new Error("prove: integration command argv must be non-empty");
     return await new Promise((resolve, reject) => {
+        // The producer runs in its own process group, so stopping kibi prove
+        // stops the whole suite it started (a test runner and its workers), not
+        // only kibi prove itself.
+        const ownGroup = process.platform !== "win32";
         const child = spawn(command, args, {
             cwd,
             env,
             shell: false,
             stdio: "inherit",
+            detached: ownGroup,
+        });
+        const forward = (signal) => {
+            const pid = child.pid;
+            try {
+                if (ownGroup && pid !== undefined)
+                    process.kill(-pid, signal);
+                else
+                    child.kill(signal);
+            }
+            catch {
+                // The producer already exited.
+            }
+            process.exit(signal === "SIGINT" ? 130 : 143);
+        };
+        const onInt = () => forward("SIGINT");
+        const onTerm = () => forward("SIGTERM");
+        const onHup = () => forward("SIGHUP");
+        process.once("SIGINT", onInt);
+        process.once("SIGTERM", onTerm);
+        process.once("SIGHUP", onHup);
+        const settle = () => {
+            process.removeListener("SIGINT", onInt);
+            process.removeListener("SIGTERM", onTerm);
+            process.removeListener("SIGHUP", onHup);
+        };
+        child.once("error", (error) => {
+            settle();
+            reject(error);
+        });
+        child.once("close", (code) => {
+            settle();
+            resolve(code ?? 1);
         });
-        child.once("error", reject);
-        child.once("close", (code) => resolve(code ?? 1));
     });
 }
 // implements REQ-kibi-verification-evidence-contract
@@ -98,6 +139,84 @@ export function commandEnvironment(integration, commandArgv, snapshot, workspace
         KIBI_PROOF_TEST_IDS: JSON.stringify(testIds),
     };
 }
+/** Where `kibi prove` records which integrations it has ingested. */
+export const PROVE_PROGRESS_FILE = "prove-progress.json";
+/** Read the progress file; anything unreadable counts as no progress. */
+export async function readProveProgress(runsDir) {
+    try {
+        const parsed = JSON.parse(await readFile(path.join(runsDir, PROVE_PROGRESS_FILE), "utf8"));
+        if (parsed.version !== "kibi.prove-progress.v1" ||
+            typeof parsed.snapshot !== "string" ||
+            parsed.ingested === null ||
+            typeof parsed.ingested !== "object")
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Start a fresh progress record for a run that is not resuming. */
+async function recordProgressReset(runsDir, progress) {
+    await writeFile(path.join(runsDir, PROVE_PROGRESS_FILE), `${JSON.stringify(progress, null, 2)}\n`, "utf8");
+}
+/**
+ * Integrations a resumed run can skip: ingested at the same snapshot, for
+ * every test this run selects for them.
+ */
+export function resumableIntegrations(progress, snapshot, groups) {
+    const skip = new Set();
+    if (progress === null || progress.snapshot !== snapshot)
+        return skip;
+    for (const [integrationId, tests] of groups) {
+        const done = new Set(progress.ingested[integrationId] ?? []);
+        if (done.size > 0 && tests.every((test) => done.has(String(test.id))))
+            skip.add(integrationId);
+    }
+    return skip;
+}
+/**
+ * Narrow a Playwright integration's command to the spec files the selected
+ * tests are bound to, so `kibi prove --test X` runs X's specs instead of the
+ * whole suite. Only a direct `playwright test` invocation is narrowed, and
+ * only when every selected test names its `proof_bindings[].source_file`;
+ * otherwise the command runs unchanged and the reason says why.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export function narrowedPlaywrightCommand(command, tests) {
+    const argv = [...command];
+    const runner = argv.findIndex((arg, index) => /(^|[\\/])playwright(\.c?js)?$/.test(arg) && argv[index + 1] === "test");
+    if (runner < 0)
+        return {
+            argv,
+            narrowed: false,
+            reason: "the command is not a direct `playwright test` invocation; narrow it from KIBI_PROOF_SOURCE_FILES",
+        };
+    const files = new Set();
+    for (const test of tests) {
+        const own = proofSourceFiles(test);
+        if (own.length === 0)
+            return {
+                argv,
+                narrowed: false,
+                reason: `test ${String(test.id)} has no proof_bindings[].source_file`,
+            };
+        for (const file of own)
+            files.add(file);
+    }
+    return { argv: [...argv, ...[...files].sort()], narrowed: true };
+}
+function proofSourceFiles(test) {
+    const raw = test.proof_bindings;
+    if (!Array.isArray(raw))
+        return [];
+    return raw.flatMap((entry) => {
+        const file = entry !== null && typeof entry === "object"
+            ? entry.source_file
+            : undefined;
+        return typeof file === "string" && file !== "" ? [file] : [];
+    });
+}
 function collectBindings(tests) {
     const bindings = [];
     for (const test of tests) {
@@ -151,7 +270,30 @@ function dedupeObligations(tests) {
 function markAggregateFailure(results) {
     return results.map((result) => ({ ...result, outcome: "failed" }));
 }
+/**
+ * Receipt state per proof-bearing test under the binding mode reports use.
+ * `passed` means the test already has a current passing receipt; anything
+ * else (missing, stale, contract_mismatch, invalid, failed) needs a run.
+ */
+// implements REQ-kibi-verification-evidence-contract
+export async function readTestReceiptStates(context) {
+    const snapshotEvidence = await readWorkspaceSnapshot(context);
+    const snapshot = snapshotEvidence.available
+        ? snapshotEvidence.snapshot.hash
+        : "unknown";
+    const bindingsDict = await perContractTestBindings(context);
+    const bindingMode = bindingsDict !== null ? "per_contract" : currentProofBindingMode();
+    const payload = await runOperationJsonQuery(context.prolog, "discovery.pl", `discovery:test_receipt_states_json(${bindingMode}, ${bindingsDict ?? "_{}"}, ${toPrologAtom(snapshot)}, ${toPrologAtom(context.clock().toISOString())}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`, "prove --stale");
+    return new Map(Object.entries(payload.states ?? {}));
+}
 async function selectTests(context, options) {
+    const selected = await selectTestsBySelector(context, options);
+    if (!options.stale || selected.length === 0)
+        return selected;
+    const states = await readTestReceiptStates(context);
+    return selected.filter((entity) => states.get(String(entity.id)) !== "passed");
+}
+async function selectTestsBySelector(context, options) {
     // Contract plus bindings only. Receipt histories are loaded again at ingest
     // and blow the Prolog output buffer when selected up front. JUnit and TAP
     // conversion needs the bindings before that reload.
@@ -227,6 +369,22 @@ async function selectTests(context, options) {
     }
     return filtered;
 }
+// implements REQ-kibi-claim-bound-proofs
+// One line per claim a certificate test names in proves: derived (with its
+// scope), attested, or rejected with the reason.
+function claimBindingLines(result) {
+    return result.results.flatMap((row) => (row.claimBindings ?? []).map((binding) => `${row.testId} ${binding.claim_key}${binding.requirement_id ? ` (${binding.requirement_id})` : ""}: ${binding.binding}${binding.binding === "derived" && binding.scope ? `, ${binding.scope} scope` : ""}${binding.reason ? `: ${binding.reason}` : ""}`));
+}
+// implements REQ-kibi-code-proof-kinds
+// One line per certificate test whose certificate did not re-check: the test
+// passed, but its receipt supports tested, not proved.
+function certificateRejectionLines(result) {
+    return result.results.flatMap((row) => row.certificateRejection === undefined
+        ? []
+        : [
+            `${row.testId} ${row.kind ?? "certificate"}: certificate rejected, ${row.certificateRejection}`,
+        ]);
+}
 function summarize(result) {
     const parts = [`passed ${result.passed}`, `failed ${result.failed}`];
     if (result.unchanged > 0)
@@ -249,7 +407,7 @@ export async function proveCommand(options, deps = {}) {
             throw new Error(`prove: ${integrations.error}`);
         const selected = await selectTests(context, options);
         if (selected.length === 0) {
-            process.stdout.write(`${JSON.stringify({ proved: 0, failed: 0, message: "no proof-bearing tests selected" })}\n`);
+            process.stdout.write(`${JSON.stringify({ passed: 0, certified: 0, failed: 0, message: options.stale ? "every selected test already has a current passing receipt" : "no proof-bearing tests selected" })}\n`);
             completed = true;
             return { exitCode: 0 };
         }
@@ -273,16 +431,51 @@ export async function proveCommand(options, deps = {}) {
         }
         const runsDir = path.join(context.workspaceRoot, PROOF_RUNS_DIR);
         await mkdir(runsDir, { recursive: true });
+        // Each integration's receipts are written as soon as it finishes; the
+        // progress file lets an interrupted run continue with --resume.
+        const previous = options.resume ? await readProveProgress(runsDir) : null;
+        const skipped = options.resume
+            ? resumableIntegrations(previous, snapshot, groups)
+            : new Set();
+        if (options.resume && previous !== null && previous.snapshot !== snapshot)
+            process.stderr.write("prove: the workspace changed since the interrupted run; running every selected integration\n");
+        const progress = {
+            version: "kibi.prove-progress.v1",
+            snapshot,
+            ingested: previous !== null && previous.snapshot === snapshot
+                ? { ...previous.ingested }
+                : {},
+        };
+        const recordProgress = async (integrationId, testIds) => {
+            const done = new Set(progress.ingested[integrationId] ?? []);
+            for (const id of testIds)
+                done.add(id);
+            progress.ingested[integrationId] = [...done].sort();
+            await writeFile(path.join(runsDir, PROVE_PROGRESS_FILE), `${JSON.stringify(progress, null, 2)}\n`, "utf8");
+        };
+        if (!options.resume)
+            await recordProgressReset(runsDir, progress);
+        if (skipped.size > 0)
+            process.stderr.write(`prove: resuming; skipping integrations already ingested at this snapshot: ${[...skipped].join(", ")}\n`);
+        const narrowSelection = Boolean(options.testId || options.requirement || options.stale);
+        const pending = [...groups].filter(([id]) => !skipped.has(id));
         const ingestResults = [];
         const runAttribution = new Map();
         const failures = [];
-        for (const [integrationId, tests] of groups) {
+        for (const [index, [integrationId, tests]] of pending.entries()) {
+            process.stderr.write(`prove: running integration '${integrationId}' (${index + 1}/${pending.length}, ${tests.length} test${tests.length === 1 ? "" : "s"})\n`);
             const integration = resolveIntegration(integrations.integrations, integrationId);
             if (!integration) {
                 failures.push(`integration '${integrationId}' (required by ${tests.map((t) => t.id).join(", ")}) is not configured in .kb/proof/integrations.json; plan it with kibi proof inspect --update ${integrationId} --json and apply the plan with kb_apply_plan`);
                 continue;
             }
-            const commandArgv = [...integration.command];
+            let commandArgv = [...integration.command];
+            if (narrowSelection && integration.producer === "playwright") {
+                const narrowed = narrowedPlaywrightCommand(commandArgv, tests);
+                commandArgv = narrowed.argv;
+                if (!narrowed.narrowed)
+                    process.stderr.write(`prove: running the whole '${integrationId}' integration: ${narrowed.reason}\n`);
+            }
             const artifactPath = path.resolve(context.workspaceRoot, integration.artifact ??
                 path.join(PROOF_RUNS_DIR, `${integrationId}.json`));
             await mkdir(path.dirname(artifactPath), { recursive: true });
@@ -298,6 +491,13 @@ export async function proveCommand(options, deps = {}) {
             const env = commandEnvironment(integration, commandArgv, snapshot, context.workspaceRoot, selectedTestIds, artifactPath);
             if (testReportPath !== undefined)
                 env[PROOF_TEST_REPORT_ENV] = testReportPath;
+            env.KIBI_PROOF_SOURCE_FILES = JSON.stringify([...new Set(tests.flatMap(proofSourceFiles))].sort());
+            // Certificate-kind tests leave one certificate per test here; any left
+            // by an earlier run must never be read as this run's proof.
+            const certificateDir = path.join(runsDir, "certificates", integrationId);
+            await rm(certificateDir, { recursive: true, force: true });
+            await mkdir(certificateDir, { recursive: true });
+            env[PROOF_CERTIFICATES_ENV] = certificateDir;
             const startedAt = new Date().toISOString();
             let exitCode;
             try {
@@ -344,6 +544,13 @@ export async function proveCommand(options, deps = {}) {
                 failures.push(`integration '${integrationId}': ${error instanceof Error ? error.message : String(error)}`);
                 continue;
             }
+            try {
+                evaluated = attachCertificates(evaluated, await readCertificateDir(certificateDir));
+            }
+            catch (error) {
+                failures.push(`integration '${integrationId}': ${error instanceof Error ? error.message : String(error)}`);
+                continue;
+            }
             const artifactErrors = [
                 ...(evaluated.wholeRun === undefined ? [] : [evaluated.wholeRun]),
                 ...evaluated.artifacts.map((entry) => entry.artifact),
@@ -379,6 +586,13 @@ export async function proveCommand(options, deps = {}) {
             if (merged !== undefined) {
                 ingestResults.push(merged);
                 runAttribution.set(merged, evaluated);
+                await recordProgress(integrationId, selectedTestIds);
+                process.stderr.write(`prove: ingested integration '${integrationId}' (${summarize(merged)})\n`);
+                for (const line of [
+                    ...certificateRejectionLines(merged),
+                    ...claimBindingLines(merged),
+                ])
+                    process.stderr.write(`prove: ${line}\n`);
             }
             const afterIngest = await readWorkspaceSnapshot(context);
             if (!afterIngest.available || afterIngest.snapshot.hash !== snapshot) {
@@ -388,8 +602,14 @@ export async function proveCommand(options, deps = {}) {
         const passed = ingestResults.reduce((sum, result) => sum + result.passed, 0);
         const failed = ingestResults.reduce((sum, result) => sum + result.failed, 0);
         const unchanged = ingestResults.reduce((sum, result) => sum + result.unchanged, 0);
+        // implements REQ-kibi-code-proof-kinds
+        // passed counts passing receipts; certified counts those whose certificate
+        // re-checked, the only receipts that can support proved.
+        const certified = ingestResults.reduce((sum, result) => sum +
+            result.results.filter((row) => row.outcome === "passed" && row.evidenceLevel === "proved").length, 0);
         const summary = {
-            proved: passed,
+            passed,
+            certified,
             failed,
             unchanged,
             runs: ingestResults.map((result) => {
@@ -413,6 +633,8 @@ export async function proveCommand(options, deps = {}) {
             }),
             ...(failures.length > 0 ? { failures } : {}),
         };
+        if (failures.length > 0 && Object.keys(progress.ingested).length > 0)
+            process.stderr.write("prove: integrations that failed to produce receipts run again with the same selector plus --resume\n");
         process.stdout.write(`${JSON.stringify(summary)}\n`);
         completed = true;
         await runtime.afterSuccess(ingestProofSpec, context);
@@ -424,6 +646,69 @@ export async function proveCommand(options, deps = {}) {
             : { status: "error", error: 1 });
     }
 }
+/** Read every certificate a run left in its certificate directory. */
+// implements REQ-kibi-code-proof-kinds
+export async function readCertificateDir(directory) {
+    let names;
+    try {
+        names = (await readdir(directory)).filter((name) => name.endsWith(".json"));
+    }
+    catch {
+        return [];
+    }
+    const certificates = [];
+    for (const name of names.sort()) {
+        let parsed;
+        try {
+            parsed = JSON.parse(await readFile(path.join(directory, name), "utf8"));
+        }
+        catch {
+            throw new Error(`certificate ${name} is not valid JSON`);
+        }
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error(`certificate ${name} is not a JSON object`);
+        certificates.push(parsed);
+    }
+    return certificates;
+}
+/**
+ * Give each artifact the certificates of its own tests, so a partition is
+ * never evaluated against another test's certificate. A test may leave at
+ * most one certificate per run.
+ */
+// implements REQ-kibi-code-proof-kinds
+export function attachCertificates(evaluated, certificates) {
+    if (certificates.length === 0)
+        return evaluated;
+    const seen = new Set();
+    for (const certificate of certificates) {
+        const id = String(certificate.test_id ?? "");
+        if (seen.has(id))
+            throw new Error(`the run left more than one certificate for ${id}`);
+        seen.add(id);
+    }
+    const withOwn = (artifact, testIds) => {
+        const own = certificates.filter((certificate) => testIds.includes(String(certificate.test_id ?? "")));
+        return own.length === 0
+            ? artifact
+            : {
+                ...artifact,
+                certificates: [...(artifact.certificates ?? []), ...own],
+            };
+    };
+    return {
+        ...evaluated,
+        artifacts: evaluated.artifacts.map((entry) => ({
+            ...entry,
+            artifact: withOwn(entry.artifact, entry.testIds),
+        })),
+        ...(evaluated.wholeRun === undefined
+            ? {}
+            : {
+                wholeRun: withOwn(evaluated.wholeRun, evaluated.artifacts.flatMap((entry) => entry.testIds)),
+            }),
+    };
+}
 /** Read a command integration's optional per-test report and attribute it. */
 // implements REQ-kibi-fresh-verification-receipts-v2
 export async function readCommandAttribution(reportPath, selectedTestIds, exitCode) {

package/dist/commands/report.d.ts

@@ -5,6 +5,7 @@ export type ReportOptions = Readonly<{
     open?: boolean;
     tag?: string;
     limit?: string;
+    certificates?: string;
 }>;
 type ReportCoverage = Readonly<{
     requirements: HtmlReportCoverage;

package/dist/commands/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/commands/report.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,KAAK,cAAc,GAAG,QAAQ,CAAC;IAC7B,YAAY,EAAE,kBAAkB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B,CAAC,CAAC;AA+HH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChE;AAeD,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAyEjB"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/commands/report.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AAEH,KAAK,cAAc,GAAG,QAAQ,CAAC;IAC7B,YAAY,EAAE,kBAAkB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B,CAAC,CAAC;AA+HH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChE;AA8DD,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAgHjB"}

package/dist/commands/report.js

@@ -1,6 +1,6 @@
 import { execFileSync, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { coverageSpec } from "../public/operations/specs/reporting.js";
@@ -146,6 +146,41 @@ function assertCompleteRequirementRows(coverage, limit) {
         throw new Error(`Report requires complete requirement rows, but ${coverage.rows.length} of ${total} were returned. Increase --limit above ${limit}.`);
     }
 }
+const KB_CERTIFICATES_VERSION = "kibi.certificates.v1";
+/**
+ * Read a saved kibi check --write-certificates bundle, so the report can
+ * publish it next to the page and say how many certificates it holds.
+ */
+// implements REQ-kibi-kb-certificates
+async function readKbCertificates(bundlePath) {
+    const raw = await readFile(bundlePath, "utf8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`report: ${bundlePath} is not JSON`);
+    }
+    const bundle = parsed !== null && typeof parsed === "object"
+        ? parsed
+        : {};
+    if (bundle.version !== KB_CERTIFICATES_VERSION ||
+        !Array.isArray(bundle.certificates))
+        throw new Error(`report: ${bundlePath} is not a ${KB_CERTIFICATES_VERSION} bundle (write one with kibi check --write-certificates)`);
+    return { raw, certificates: bundle.certificates };
+}
+function certificateKinds(certificates) {
+    const kinds = {};
+    for (const certificate of certificates) {
+        const kind = certificate !== null &&
+            typeof certificate === "object" &&
+            typeof certificate.kind === "string"
+            ? certificate.kind
+            : "unknown";
+        kinds[kind] = (kinds[kind] ?? 0) + 1;
+    }
+    return kinds;
+}
 // implements REQ-kibi-html-health-report
 export async function reportCommand(options, deps = {}) {
     const limit = parseLimit(options.limit);
@@ -154,16 +189,31 @@ export async function reportCommand(options, deps = {}) {
     assertCompleteRequirementRows(coverage.requirements, limit);
     const now = (deps.now ?? (() => new Date()))();
     const workspace = (deps.cwd ?? (() => process.cwd()))();
+    const outputPath = reportTarget(workspace, options.output);
+    const requestedOutput = options.output?.trim() || "kibi-report";
+    const outputIsHtmlFile = [".html", ".htm"].includes(path.extname(requestedOutput).toLowerCase());
+    const kbCertificatesSource = options.certificates?.trim() === undefined ||
+        options.certificates.trim() === ""
+        ? undefined
+        : await readKbCertificates(path.resolve(workspace, options.certificates.trim()));
+    const kbCertificatesPath = outputIsHtmlFile
+        ? path.join(path.dirname(outputPath), `${path.basename(outputPath, path.extname(outputPath))}.kb-certificates.json`)
+        : path.join(path.dirname(outputPath), "kb-certificates.json");
+    const kbCertificates = kbCertificatesSource === undefined
+        ? undefined
+        : {
+            count: kbCertificatesSource.certificates.length,
+            kinds: certificateKinds(kbCertificatesSource.certificates),
+            href: path.basename(kbCertificatesPath),
+        };
     const html = renderHtmlReport({
         requirements: coverage.requirements,
         symbols: coverage.symbols,
         branch: coverage.branch,
         generatedAt: now,
         repository: deps.repository ?? loadReportRepository(workspace, coverage.branch),
+        ...(kbCertificates === undefined ? {} : { kbCertificates }),
     });
-    const outputPath = reportTarget(workspace, options.output);
-    const requestedOutput = options.output?.trim() || "kibi-report";
-    const outputIsHtmlFile = [".html", ".htm"].includes(path.extname(requestedOutput).toLowerCase());
     const badgePath = outputIsHtmlFile
         ? path.join(path.dirname(outputPath), `${path.basename(outputPath, path.extname(outputPath))}.badge.svg`)
         : path.join(path.dirname(outputPath), "badge.svg");
@@ -177,12 +227,23 @@ export async function reportCommand(options, deps = {}) {
         : Math.round((tested / currentRequirements) * 100);
     const hasContradiction = coverage.requirements.rows.some((row) => Array.isArray(row.proofGaps) &&
         row.proofGaps.includes("blocking_contradiction"));
+    // implements REQ-kibi-evidence-floors
+    // A requirement below its evidence floor fails kibi check, like a
+    // contradiction, so the badge turns red whatever the tested share.
+    const belowFloor = coverage.requirements.rows.some((row) => {
+        const floor = row.evidenceFloor;
+        return (row.proofStatus !== "not_applicable" &&
+            floor !== null &&
+            typeof floor === "object" &&
+            floor.status === "below" &&
+            floor.required !== "unverified");
+    });
     const snapshotStale = coverage.requirements.meta?.dirty === true ||
         coverage.requirements.meta?.proofSnapshotDirty === true;
     const badgeMessage = currentRequirements === 0 ? "no requirements" : `${proofPercent}% tested`;
     const badgeColor = currentRequirements === 0
         ? KIBI_BRAND.rail
-        : hasContradiction
+        : hasContradiction || belowFloor
             ? KIBI_BRAND.danger
             : snapshotStale
                 ? KIBI_BRAND.warning
@@ -196,8 +257,12 @@ export async function reportCommand(options, deps = {}) {
     const badge = renderKibiBadge(badgeMessage, badgeColor);
     await writeAtomically(outputPath, html);
     await writeAtomically(badgePath, badge);
+    if (kbCertificatesSource !== undefined)
+        await writeAtomically(kbCertificatesPath, kbCertificatesSource.raw);
     console.log(`Kibi report written to ${outputPath}`);
     console.log(`Kibi badge written to ${badgePath}`);
+    if (kbCertificatesSource !== undefined)
+        console.log(`KB certificates written to ${kbCertificatesPath}`);
     if (options.open === true) {
         await (deps.openReport ?? openReport)(outputPath);
         console.log("Opened Kibi report in the default browser");

package/dist/commands/signoff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signoff.d.ts","sourceRoot":"","sources":["../../src/commands/signoff.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACpC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GACjD,QAAQ,CAAC;IACP,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD,CAAC,CAAC;AAKL,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAGxD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAGnE;AAuFD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,WAAW,CAAC,CA4EtB"}
+{"version":3,"file":"signoff.d.ts","sourceRoot":"","sources":["../../src/commands/signoff.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACpC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GACjD,QAAQ,CAAC;IACP,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD,CAAC,CAAC;AAKL,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAGxD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAGnE;AA6GD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,WAAW,CAAC,CA4EtB"}

package/dist/commands/signoff.js

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { mkdir, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { coverageSpec } from "../public/operations/specs/reporting.js";
-import { earliestUnmetGate } from "../report/html-report.js";
+import { certificateRejectionLines, earliestUnmetGate, } from "../report/html-report.js";
 import { collectSignoffQuestions, collectSignoffSummary, parseSignoffQuestionsInput, } from "../signoff/collect.js";
 import { renderSignoffHtml } from "../signoff/html.js";
 import { renderQuestionsMarkdownBody, renderSignoffChatMarkdown, renderSignoffMarkdown, renderSummaryMarkdownBody, } from "../signoff/markdown.js";
@@ -37,6 +37,21 @@ async function writeAtomically(filePath, contents) {
         throw error;
     }
 }
+// implements REQ-kibi-evidence-floors
+function signoffFloor(value) {
+    const floor = record(value);
+    return typeof floor.required === "string" &&
+        floor.required !== "unverified" &&
+        typeof floor.status === "string"
+        ? {
+            evidenceFloor: {
+                required: floor.required,
+                source: typeof floor.source === "string" ? floor.source : "explicit",
+                status: floor.status,
+            },
+        }
+        : {};
+}
 function record(value) {
     return value !== null && typeof value === "object"
         ? value
@@ -78,6 +93,10 @@ async function loadProof() {
             ...(typeof row.evidenceLevel === "string"
                 ? { evidenceLevel: row.evidenceLevel }
                 : {}),
+            ...signoffFloor(row.evidenceFloor),
+            ...(certificateRejectionLines(row).length > 0
+                ? { certificateRejections: certificateRejectionLines(row) }
+                : {}),
             contradictions: conflicts
                 .map(record)
                 .filter((conflict) => conflict.status === "contradiction")

package/dist/commands/sync/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../src/commands/sync/manifest.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,aAAa,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAML,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,KAAK,mBAAmB,EACxB,uBAAuB,EACxB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,0BAA0B,EAG3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAG5E,UAAU,YAAY;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,YAAY,EAAE,OAAO,YAAY,CAAC;IAClC,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,aAAa,EAAE,OAAO,aAAa,CAAC;IACpC,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,2BAA2B,EAAE,OAAO,2BAA2B,CAAC;CACjE;AAkBD,eAAO,MAAM,8BAA8B,QAc1C,CAAC;AAeF;;;;;;;;;GASG;AACH,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAG7E;AAyHD,wBAAsB,0BAA0B,CAE9C,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;IAC7B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GACA,OAAO,CAAC,IAAI,CAAC,CA0Mf;AAED;;;;;;;;GAQG;AAEH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC3B,MAAM,GAAG,IAAI,CAWf;AAED,wBAAgB,0BAA0B,CAExC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAOT;AAED,wBAAgB,8BAA8B,CAE5C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC3B,OAAO,CAST"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../src/commands/sync/manifest.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,aAAa,EACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAML,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,KAAK,mBAAmB,EACxB,uBAAuB,EACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,0BAA0B,EAG3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAI5E,UAAU,YAAY;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,YAAY,EAAE,OAAO,YAAY,CAAC;IAClC,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,aAAa,EAAE,OAAO,aAAa,CAAC;IACpC,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,2BAA2B,EAAE,OAAO,2BAA2B,CAAC;CACjE;AAkBD,eAAO,MAAM,8BAA8B,QAc1C,CAAC;AA0BF;;;;;;;;;GASG;AACH,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAG7E;AAyHD,wBAAsB,0BAA0B,CAE9C,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;IAC7B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAsNf;AAED;;;;;;;;GAQG;AAEH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC3B,MAAM,GAAG,IAAI,CAWf;AAED,wBAAgB,0BAA0B,CAExC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAOT;AAED,wBAAgB,8BAA8B,CAE5C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC3B,OAAO,CAST"}