kibi-cli 2.31.1 → 2.35.1

package/dist/public/proof-receipt.d.ts

@@ -1,15 +1,22 @@
 import { type ProofFingerprintComponents } from "./proof-fingerprint.js";
-import { PROOF_RECEIPT_VERSION, PROOF_RESULT_OUTCOMES, PROOF_RUN_OUTCOMES, type ProofContract } from "./proof-protocol.js";
+import { PROOF_RECEIPT_VERSIONS, PROOF_RESULT_OUTCOMES, PROOF_RUN_OUTCOMES, type ProofContract, type ProofKind } from "./proof-protocol.js";
 export declare const PROOF_RECEIPT_MAX_AGE_SECONDS: number;
+/**
+ * How a certificate binds to a claim its contract names in proves: derived
+ * (Kibi checked it against the claim's fact; the only verdict that proves),
+ * attested (the fact has no derivation; the author vouches) or rejected.
+ */
+export declare const CLAIM_BINDING_VERDICTS: readonly ["derived", "attested", "rejected"];
+export type ClaimBindingVerdict = (typeof CLAIM_BINDING_VERDICTS)[number];
 export declare const PROOF_RECEIPT_OUTCOMES: readonly ["passed", "failed", "errored", "cancelled", "skipped", "timed_out", "interrupted"];
 export declare const PROOF_RECEIPT_SCHEMA: {
     readonly type: "object";
-    readonly description: "Kibi-derived kibi.proof-receipt.v1. Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.";
+    readonly description: "Kibi-derived kibi.proof-receipt.v2 (kibi.proof-receipt.v1 entries are still read). Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.";
     readonly required: readonly ["version", "receipt_id", "test_id", "scope", "outcome", "code_snapshot", "environment_hash", "started_at", "finished_at", "artifact_digest", "contract_hash", "fingerprint", "fingerprint_components", "integration_id", "producer", "command_argv", "run_outcome", "proof_results"];
     readonly properties: {
         readonly version: {
             readonly type: "string";
-            readonly const: "kibi.proof-receipt.v1";
+            readonly enum: readonly ["kibi.proof-receipt.v1", "kibi.proof-receipt.v2"];
         };
         readonly receipt_id: {
             readonly type: "string";
@@ -191,6 +198,63 @@ export declare const PROOF_RECEIPT_SCHEMA: {
                 readonly additionalProperties: false;
             };
         };
+        readonly kind: {
+            readonly type: "string";
+            readonly enum: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt", "rule", "state_machine", "regex", "source"];
+        };
+        readonly evidence_level: {
+            readonly type: "string";
+            readonly enum: readonly ["proved", "tested"];
+        };
+        readonly certificate: {
+            readonly type: "object";
+        };
+        readonly certificate_digest: {
+            readonly type: "string";
+            readonly pattern: "^[a-f0-9]{64}$";
+        };
+        readonly certificate_rejection: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly claim_bindings: {
+            readonly type: "array";
+            readonly description: "Certificate kinds: how the certificate binds to each claim its contract names in proves, judged at ingest. derived means Kibi derived the certificate's obligation from the claim's grounding fact and the certificate satisfies it; attested means no derivation exists and the author vouches for it (never proved); rejected names why.";
+            readonly items: {
+                readonly type: "object";
+                readonly required: readonly ["claim_key", "binding"];
+                readonly properties: {
+                    readonly claim_key: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly requirement_id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly fact_id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly binding: {
+                        readonly type: "string";
+                        readonly enum: readonly ["derived", "attested", "rejected"];
+                    };
+                    readonly scope: {
+                        readonly type: "string";
+                        readonly enum: readonly ["code", "source", "harness", "intent"];
+                    };
+                    readonly obligation: {
+                        readonly type: "object";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+                readonly additionalProperties: false;
+            };
+        };
         readonly gaps: {
             readonly type: "array";
             readonly items: {
@@ -217,7 +281,7 @@ export declare const PROOF_RECEIPT_SCHEMA: {
     readonly additionalProperties: false;
 };
 export type ProofReceipt = Readonly<{
-    version: typeof PROOF_RECEIPT_VERSION;
+    version: (typeof PROOF_RECEIPT_VERSIONS)[number];
     receipt_id: string;
     test_id: string;
     scope: "unit" | "integration" | "end_to_end";
@@ -259,13 +323,33 @@ export type ProofReceipt = Readonly<{
         readonly target: string;
         readonly reason: string;
     }[];
+    /** v2: what the contract's checker establishes. */
+    kind?: ProofKind;
+    /** v2: proved only for a passed certificate kind whose certificate re-checked. */
+    evidence_level?: "proved" | "tested";
+    certificate?: Readonly<Record<string, unknown>>;
+    certificate_digest?: string;
+    certificate_rejection?: string;
+    /** Certificate kinds: the binding to each claim the contract names in proves. */
+    claim_bindings?: readonly ClaimBinding[];
+}>;
+/** How one certificate binds to one requirement claim, judged at ingest. */
+export type ClaimBinding = Readonly<{
+    claim_key: string;
+    requirement_id?: string;
+    fact_id?: string;
+    binding: ClaimBindingVerdict;
+    /** What the proof rests on: evaluated code, project files Kibi read (source), a test harness, or the knowledge base alone (intent). */
+    scope?: "code" | "source" | "harness" | "intent";
+    obligation?: Readonly<Record<string, unknown>>;
+    reason?: string;
 }>;
 export declare function finishedAtPrecedesStartedAt(startedAt: number | null, finishedAt: number | null): boolean;
-/** Structural validation of one kibi.proof-receipt.v1 entry. */
+/** Structural validation of one kibi.proof-receipt.v1 or v2 entry. */
 export declare function validProofReceiptShape(testId: string, receipt: unknown): boolean;
 /**
  * Full-history validation for proof_receipts: unique ids, per-test binding,
- * supported scope, ordered timestamps, and structurally valid v1 entries.
+ * supported scope, ordered timestamps, and structurally valid v1 or v2 entries.
  */
 export declare function proofReceiptHistoryErrors(testId: string, verificationScope: unknown, receipts: readonly Readonly<Record<string, unknown>>[]): readonly string[];
 /** The current receipt must match the live scope, contract hash, and fingerprint. */

package/dist/public/proof-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof-receipt.d.ts","sourceRoot":"","sources":["../../src/public/proof-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,eAAO,MAAM,sBAAsB,8FAQzB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyIvB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC7C,OAAO,EAAE,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,SAAS;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,eAAe,CAAC;QAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EACb;YACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;YAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;gBACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;aAC/B,EAAE,CAAC;SACL,GACD;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;SAAE,CAAC;KACxC,EAAE,CAAC;IACJ,IAAI,CAAC,EAAE,SAAS;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,EAAE,CAAC;CACL,CAAC,CAAC;AAEH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAET;AA6ED,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAmET;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GACrD,SAAS,MAAM,EAAE,CAuCnB;AAED,qFAAqF;AACrF,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,QAAQ,CAAC,EAAE,aAAa,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,SAAS,MAAM,EAAE,CAgCnB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAoBrC,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,EACtD,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,SAAS,GAC7D,SAAS,MAAM,EAAE,CAqBnB"}
+{"version":3,"file":"proof-receipt.d.ts","sourceRoot":"","sources":["../../src/public/proof-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;;GAIG;AAEH,eAAO,MAAM,sBAAsB,8CAIzB,CAAC;AAGX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB,8FAQzB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuKvB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,OAAO,EAAE,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC7C,OAAO,EAAE,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,SAAS;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,eAAe,CAAC;QAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EACb;YACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;YAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;gBACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;aAC/B,EAAE,CAAC;SACL,GACD;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;SAAE,CAAC;KACxC,EAAE,CAAC;IACJ,IAAI,CAAC,EAAE,SAAS;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,EAAE,CAAC;IACJ,mDAAmD;IACnD,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,kFAAkF;IAClF,cAAc,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,cAAc,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEH,4EAA4E;AAE5E,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,uIAAuI;IACvI,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACjD,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAET;AA6ED,sEAAsE;AACtE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAsET;AAsDD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GACrD,SAAS,MAAM,EAAE,CAuCnB;AAED,qFAAqF;AACrF,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,QAAQ,CAAC,EAAE,aAAa,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,SAAS,MAAM,EAAE,CAgCnB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAoBrC,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,EACtD,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,SAAS,GAC7D,SAAS,MAAM,EAAE,CAqBnB"}

package/dist/public/proof-receipt.js

@@ -1,6 +1,17 @@
 import { canonicalJson, proofContractHash, } from "./proof-fingerprint.js";
-import { PROOF_RECEIPT_VERSION, PROOF_RESULT_OUTCOMES, PROOF_RUN_OUTCOMES, } from "./proof-protocol.js";
+import { PROOF_KINDS, PROOF_RECEIPT_VERSION, PROOF_RECEIPT_VERSIONS, PROOF_RESULT_OUTCOMES, PROOF_RUN_OUTCOMES, isCertificateProofKind, } from "./proof-protocol.js";
 export const PROOF_RECEIPT_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
+/**
+ * How a certificate binds to a claim its contract names in proves: derived
+ * (Kibi checked it against the claim's fact; the only verdict that proves),
+ * attested (the fact has no derivation; the author vouches) or rejected.
+ */
+// implements REQ-kibi-claim-bound-proofs
+export const CLAIM_BINDING_VERDICTS = [
+    "derived",
+    "attested",
+    "rejected",
+];
 export const PROOF_RECEIPT_OUTCOMES = [
     "passed",
     "failed",
@@ -12,7 +23,7 @@ export const PROOF_RECEIPT_OUTCOMES = [
 ];
 export const PROOF_RECEIPT_SCHEMA = {
     type: "object",
-    description: "Kibi-derived kibi.proof-receipt.v1. Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.",
+    description: "Kibi-derived kibi.proof-receipt.v2 (kibi.proof-receipt.v1 entries are still read). Receipts are never caller-authored; kb_ingest_proof derives them from kibi.proof-run.v1 artifacts.",
     required: [
         "version",
         "receipt_id",
@@ -34,7 +45,7 @@ export const PROOF_RECEIPT_SCHEMA = {
         "proof_results",
     ],
     properties: {
-        version: { type: "string", const: PROOF_RECEIPT_VERSION },
+        version: { type: "string", enum: [...PROOF_RECEIPT_VERSIONS] },
         receipt_id: {
             type: "string",
             pattern: "^PR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$",
@@ -131,6 +142,35 @@ export const PROOF_RECEIPT_SCHEMA = {
                 additionalProperties: false,
             },
         },
+        kind: { type: "string", enum: [...PROOF_KINDS] },
+        evidence_level: { type: "string", enum: ["proved", "tested"] },
+        certificate: { type: "object" },
+        certificate_digest: { type: "string", pattern: "^[a-f0-9]{64}$" },
+        certificate_rejection: { type: "string", minLength: 1 },
+        claim_bindings: {
+            type: "array",
+            description: "Certificate kinds: how the certificate binds to each claim its contract names in proves, judged at ingest. derived means Kibi derived the certificate's obligation from the claim's grounding fact and the certificate satisfies it; attested means no derivation exists and the author vouches for it (never proved); rejected names why.",
+            items: {
+                type: "object",
+                required: ["claim_key", "binding"],
+                properties: {
+                    claim_key: { type: "string", minLength: 1 },
+                    requirement_id: { type: "string", minLength: 1 },
+                    fact_id: { type: "string", minLength: 1 },
+                    binding: {
+                        type: "string",
+                        enum: [...CLAIM_BINDING_VERDICTS],
+                    },
+                    scope: {
+                        type: "string",
+                        enum: ["code", "source", "harness", "intent"],
+                    },
+                    obligation: { type: "object" },
+                    reason: { type: "string", minLength: 1 },
+                },
+                additionalProperties: false,
+            },
+        },
         gaps: {
             type: "array",
             items: {
@@ -209,12 +249,14 @@ function validFingerprintComponents(value) {
         hex64(row.bindings) &&
         hex64(row.producer));
 }
-/** Structural validation of one kibi.proof-receipt.v1 entry. */
+/** Structural validation of one kibi.proof-receipt.v1 or v2 entry. */
 export function validProofReceiptShape(testId, receipt) {
     const row = isRecord(receipt) ? receipt : null;
     if (!row)
         return false;
-    if (row.version !== PROOF_RECEIPT_VERSION)
+    if (!PROOF_RECEIPT_VERSIONS.includes(row.version))
+        return false;
+    if (row.version === PROOF_RECEIPT_VERSION && !validV2Fields(row))
         return false;
     if (typeof row.receipt_id !== "string" ||
         !/^PR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(row.receipt_id))
@@ -268,9 +310,48 @@ export function validProofReceiptShape(testId, receipt) {
         return false;
     return !finishedAtPrecedesStartedAt(startedAt, finishedAt);
 }
+// implements REQ-kibi-code-proof-kinds
+function validV2Fields(row) {
+    if (!PROOF_KINDS.includes(row.kind))
+        return false;
+    if (row.evidence_level !== "proved" && row.evidence_level !== "tested")
+        return false;
+    if (row.evidence_level === "proved" &&
+        (row.outcome !== "passed" ||
+            !isCertificateProofKind(row.kind) ||
+            !isRecord(row.certificate) ||
+            !hex64(row.certificate_digest) ||
+            row.certificate_rejection !== undefined))
+        return false;
+    if (row.certificate !== undefined && !isRecord(row.certificate))
+        return false;
+    if (row.certificate_digest !== undefined && !hex64(row.certificate_digest))
+        return false;
+    if (row.certificate_rejection !== undefined &&
+        !nonEmptyString(row.certificate_rejection))
+        return false;
+    if (row.claim_bindings !== undefined &&
+        !validClaimBindings(row.claim_bindings))
+        return false;
+    return true;
+}
+// implements REQ-kibi-claim-bound-proofs
+function validClaimBindings(value) {
+    return (Array.isArray(value) &&
+        value.every((entry) => isRecord(entry) &&
+            nonEmptyString(entry.claim_key) &&
+            CLAIM_BINDING_VERDICTS.includes(entry.binding) &&
+            (entry.scope === undefined ||
+                entry.scope === "code" ||
+                entry.scope === "source" ||
+                entry.scope === "harness" ||
+                entry.scope === "intent") &&
+            (entry.obligation === undefined || isRecord(entry.obligation)) &&
+            (entry.reason === undefined || nonEmptyString(entry.reason))));
+}
 /**
  * Full-history validation for proof_receipts: unique ids, per-test binding,
- * supported scope, ordered timestamps, and structurally valid v1 entries.
+ * supported scope, ordered timestamps, and structurally valid v1 or v2 entries.
  */
 export function proofReceiptHistoryErrors(testId, verificationScope, receipts) {
     const errors = [];
@@ -291,7 +372,7 @@ export function proofReceiptHistoryErrors(testId, verificationScope, receipts) {
             errors.push(`${prefix}.test_id must equal '${testId}'`);
         }
         if (!validProofReceiptShape(testId, receipt)) {
-            errors.push(`${prefix} must be a structurally valid kibi.proof-receipt.v1 bound to '${testId}'`);
+            errors.push(`${prefix} must be a structurally valid kibi.proof-receipt.v2 (or v1) bound to '${testId}'`);
             continue;
         }
         const finishedAt = timestamp(receipt.finished_at);

package/dist/public/proof-sources.d.ts

@@ -0,0 +1,102 @@
+export declare const SOURCE_READERS: readonly ["json", "yaml", "glob", "openapi", "references", "schema", "routes", "validator"];
+export type SourceReader = (typeof SOURCE_READERS)[number];
+/** A source spec as a proof contract states it; see sourceSpecErrors. */
+export type SourceSpec = Readonly<Record<string, unknown>> & Readonly<{
+    reader: SourceReader;
+}>;
+/** A column of a table, or a field of a validator object. */
+export type SourceColumn = {
+    name: string;
+    nullable: boolean;
+    optional: boolean;
+};
+/** A table (schema reader) or object (validator reader). */
+export type SourceEntity = {
+    name: string;
+    columns: SourceColumn[];
+    foreign_keys: string[];
+};
+/** One endpoint of a route table and the middleware that runs before it. */
+export type SourceRoute = {
+    method: string;
+    path: string;
+    middleware: string[];
+};
+/**
+ * What Kibi read: the selected members (sorted, unique), and for schema,
+ * validator and routes readers the structure the field and middleware
+ * obligations are decided on.
+ */
+export type SourceModel = {
+    members: string[];
+    entities?: SourceEntity[];
+    routes?: SourceRoute[];
+};
+export type SourceRead = {
+    ok: true;
+    model: SourceModel;
+} | {
+    ok: false;
+    reason: string;
+};
+/** A place in a file Kibi could not read statically. */
+export type UnresolvedReference = Readonly<{
+    file: string;
+    line: number;
+    text: string;
+}>;
+export declare const REFERENCE_EXTRACTS: readonly ["env", "imports", "calls", "string_args", "thrown", "property"];
+/**
+ * Why a source spec is not one Kibi can read, or [] when it is. `label`
+ * names the field in the messages (proof_contract.source, ...).
+ */
+export declare function sourceSpecErrors(value: unknown, label: string): string[];
+/** The spec with only the keys its reader takes, for contract hashing. */
+export declare function normalizeSourceSpec(value: unknown): SourceSpec | undefined;
+/** Workspace-relative files a glob list matches, sorted. */
+export declare function matchWorkspaceFiles(workspaceRoot: string, patterns: readonly string[], ignore?: readonly string[]): string[];
+export type SourceDependency = Readonly<{
+    id: string;
+    hash: string;
+}>;
+/**
+ * What a read of `spec` depends on, so a receipt goes stale when any of it
+ * changes: each file the reader parses (its contents), the set of files a
+ * glob matches (their paths), and for the readers that evaluate a module
+ * (drizzle schemas, route tables, validators) every workspace module that
+ * module imports through relative or tsconfig path imports.
+ */
+export declare function sourceDependencies(workspaceRoot: string, spec: SourceSpec): SourceDependency[];
+/**
+ * The workspace modules `file` imports, directly or not, through relative
+ * imports, the nearest tsconfig's `paths` aliases (following `extends`) and
+ * workspace packages linked into node_modules (packages installed from a
+ * registry are left out: a lockfile change stales nothing here).
+ */
+export declare function importClosure(workspaceRoot: string, file: string): string[];
+/** The entities (tables or validator objects) a spec's table filter selects. */
+export declare function selectedEntities(spec: SourceSpec, model: SourceModel): SourceEntity[];
+/** The routes a spec's path_prefix selects. */
+export declare function selectedRoutes(spec: SourceSpec, routes: SourceRoute[]): SourceRoute[];
+/**
+ * Read `spec` from the workspace. Readers that evaluate code (drizzle
+ * schemas, route tables, validators) and the references reader go through
+ * `evaluate`, which the CLI supplies; a read without it refuses those.
+ */
+export declare function readSource(workspaceRoot: string, spec: SourceSpec, evaluate?: SourceCodeEvaluator): Promise<SourceRead>;
+/** What the CLI's code evaluator returns for a reader that runs code. */
+export type SourceCodeEvaluation = {
+    ok: true;
+    members?: string[];
+    entities?: SourceEntity[];
+    routes?: SourceRoute[];
+} | {
+    ok: false;
+    reason: string;
+};
+export type SourceCodeEvaluator = (workspaceRoot: string, spec: SourceSpec) => Promise<SourceCodeEvaluation>;
+/** A short description of a spec, for messages. */
+export declare function describeSource(spec: SourceSpec): string;
+/** Unresolved references, as one rejection reason naming the first few. */
+export declare function unresolvedReason(what: string, unresolved: readonly UnresolvedReference[]): string;
+//# sourceMappingURL=proof-sources.d.ts.map

package/dist/public/proof-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-sources.d.ts","sourceRoot":"","sources":["../../src/public/proof-sources.ts"],"names":[],"mappings":"AAwCA,eAAO,MAAM,cAAc,6FASjB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,yEAAyE;AAEzE,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,QAAQ,CAAC;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAErC,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AAEH,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,wDAAwD;AACxD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAsBH,eAAO,MAAM,kBAAkB,2EAOrB,CAAC;AAuCX;;;GAGG;AAEH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CA6IxE;AAED,0EAA0E;AAE1E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAS1E;AASD,4DAA4D;AAE5D,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,MAAM,GAAE,SAAS,MAAM,EAAO,GAC7B,MAAM,EAAE,CAWV;AAgBD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEtE;;;;;;GAMG;AAEH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,UAAU,GACf,gBAAgB,EAAE,CA4EpB;AA2MD;;;;;GAKG;AAEH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB3E;AAkvBD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,WAAW,GACjB,YAAY,EAAE,CAKhB;AAmED,+CAA+C;AAC/C,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,WAAW,EAAE,GACpB,WAAW,EAAE,CAWf;AAED;;;;GAIG;AAEH,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,UAAU,EAChB,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,UAAU,CAAC,CA6DrB;AAED,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,MAAM,mBAAmB,GAAG,CAChC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,UAAU,KACb,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEnC,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAiBvD;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,mBAAmB,EAAE,GACzC,MAAM,CAMR"}