kibi-cli 2.31.1 → 2.35.1

package/dist/public/skills/kibi-usage/resources/proof.md

@@ -17,12 +17,18 @@ reports what happened as `kibi.proof-run.v1`; Kibi evaluates proof.
    ```bash
    kibi prove --test TEST-<id>
    # or: kibi prove --requirement REQ-<id> | --integration <id> | --all
+   # add --stale to rerun only tests without a current passing receipt
+   # add --resume to continue an interrupted run (same selector)
    ```
 
+   With `--test`, `--requirement` or `--stale`, a direct `playwright test`
+   integration runs only the selected tests' `proof_bindings[].source_file`
+   specs; wrappers get them as `KIBI_PROOF_SOURCE_FILES`.
+
    `kibi prove` captures the workspace snapshot, runs each integration's
    producer once (`shell: false`), revalidates the snapshot, evaluates the
    artifact against every selected contract, and appends idempotent
-   `kibi.proof-receipt.v1` receipts.
+   `kibi.proof-receipt.v2` receipts (v1 receipts stay valid).
 3. Confirm with `kb_status` (fresh, current snapshot) and `kb_coverage`.
 
 Never hand-write receipts. Kibi derives them from validated
@@ -51,6 +57,13 @@ proof_bindings:                 # optional provenance metadata
 
 Provenance lives in `proof_bindings`; the contract stays semantic.
 
+`success_policy: own_results_first_attempt` judges each obligation by its own
+`native_case` result when the run failed only in execution (other cases
+failed), so one unrelated failing case does not fail every receipt of a
+Playwright suite. Aggregate-run obligations, run-level errors, timeouts,
+interruptions and setup failures still refuse every obligation. Keep
+`all_required_first_attempt` unless the user wants per-case judgement.
+
 - Every `required_proofs[].symbol_id` must name an existing `symbol` entity,
   or `kb_check` reports `proof-contract-symbols`. Create the symbols first
   (`kb_upsert`, narrow method-level granularity, never a `type-shape`
@@ -85,7 +98,10 @@ replacing one named integration.
   `--command` the proposal is the `package.json` `test` script or the
   detected runner again), or make the run attributable per test: have the
   command write a `kibi.proof-test-report.v1` to the path in
-  `KIBI_PROOF_TEST_REPORT` so each test is judged by its own steps.
+  `KIBI_PROOF_TEST_REPORT` so each test is judged by its own steps. The
+  shipped `kibi proof run-steps` does that from `proof/steps.json`
+  (`[{test_id, steps: [[argv...]]}]`); use it as the integration command
+  instead of writing a producer script.
 - `producer: playwright` (or custom) — the child emits `kibi.proof-run.v1`
   itself (bundled reporter: `kibi-cli/playwright-reporter`).
 - `producer: junit` / `tap` — Kibi converts the native report at `artifact`
@@ -126,8 +142,11 @@ Every requirement row also carries `evidenceLevel`, the strength of what backs
 it, and `evidence`, the entries that earned it (each with `kind`, `scope` and
 `level`):
 
-- `proved`: a re-checkable certificate covers every case. No proof kind issues
-  certificates yet, so nothing reaches it today.
+- `proved`: the requirement is `tested` and every applicable claim has a
+  derived, code-scope binding from a fresh certificate that still re-checks
+  (see Certificate proof kinds). The entry has `kind: certificate` and lists
+  the tests. `claimSummary` counts claims per level and `unprovedClaims`
+  lists the claims below proved.
 - `tested`: `proofStatus` is `tested`; fresh E2E receipts cover every linked
   scenario.
 - `asserted`: a person stands behind the statement (approved, or firm by
@@ -138,6 +157,189 @@ Report the level as it is. Never call an `asserted` or `unverified`
 requirement proven or tested, and never call `tested` proved. Firmness is a
 separate axis: it says how sure the person is, not how strong the evidence is.
 
+## Certificate proof kinds
+
+A contract's `kind` says what its evidence can reach. The runner kinds `e2e`
+(the default), `example` and `property` support `tested`. The certificate
+kinds support `proved`, and only when Kibi re-checks the certificate the test
+left:
+
+- `exhaustive`: the test runs a check on every member of a finite domain.
+  Set `domain_source: { symbol_id: SYM-<domain> }` to the symbol that defines
+  the domain (add `export: <name>` when the export is not named like the
+  symbol's title), and import that symbol in the proof file. Kibi loads the
+  export itself (bun, the workspace's tsx, or node; for a `.py` domain
+  `KIBI_PYTHON`, the active or project `.venv`/`venv`, then `python3`:
+  Enum values, dict keys, list/tuple/set items) and rejects a
+  certificate that does not cover exactly its members, so a hand-listed or
+  partial domain stays `tested`. An import from build output is mapped back
+  to its source through `tsconfig.json` `outDir`/`rootDir`.
+- `typecheck`: a witness file that stops compiling when a domain member
+  goes unhandled (a switch ending in a `never` assignment, or a
+  `satisfies Record<Domain, ...>` map). Set `witness.path` and
+  `domain_source`; the witness must import the domain. Kibi compiles the
+  witness itself (strict, with the workspace's TypeScript and the import
+  resolution and declaration files of the nearest `tsconfig.json`), so
+  `typescript` must be
+  installed in the workspace (TypeScript 7 has no compiler API: add
+  `typescript@6` as a dev dependency). With `proves`, Kibi decides each
+  claim with its own witness and reports the fields or members that break
+  it. When the test's compile failed, the rejection adds the first error
+  Kibi's own compile of the witness reports.
+- `arithmetic`: a claim on one `int` or `real` variable decided exactly from
+  typed facts. Set `constraint_source: { fact_ids: [FACT-...] }` to the
+  numeric `property_value` facts (one subject and property); the
+  certificate's variable is their `property_key` and its assumptions are
+  exactly their constraints. To read the value from the code instead, set
+  `value_source: [{ symbol_id: SYM-<constant>, export: <name> }]`; Kibi
+  evaluates the number export itself and adds `variable eq value` as an
+  assumption. For a count claim over a collection ("exactly 32 tools") add
+  `measure: count` and name the list, set, map or object export; Kibi uses
+  its size, so do not add a number export just for the proof. A count
+  claim needs only `value_source`. Naming the claim's own fact in
+  `constraint_source` assumes the claim: without `value_source` Kibi counts
+  that derivation as intent only (tested), and with it a code value that
+  breaks the claim shows up as contradictory assumptions, which the
+  rejection names.
+  A claim that every member of a closed set has a property ("Every currency
+  in GBP, ILS and ZAR must fail closed") is a set fact whose `property_key`
+  names the property, whose `value_set` is the members and whose operator
+  is `includes` (other members may have the property too, so two such
+  claims over different sets do not contradict). Prove it with `rule`: Kibi
+  checks the property on each listed member. The kinds that compare the
+  whole set (`exhaustive`, `state_machine`) reject an `includes` fact.
+- `smt`: an SMT-LIB query that declares the facts' property as a constant,
+  asserts each `constraint_source` fact constraint and then the claim's
+  negation. Kibi re-runs z3 or cvc5 on it and accepts only `unsat`.
+- `rule`: decisions over finite domains. Set `predicate_source: {<predicate>:
+  { symbol_id }}` to the function behind each predicate the claim uses (it
+  takes the arguments in order and returns a boolean) and `domains: {<type>:
+  { symbol_id }}` to the export listing each argument type's values. Kibi
+  calls every function on every combination and model checks the claim's
+  fact: a `kibi.logic.v1` rule fact (from `kb_model_requirement` with
+  `logic`) must hold for every assignment, a predicate fact must be decided
+  as it says, and a set fact whose `property_key` names a predicate needs it
+  true for every member. A type name is also a one-argument predicate
+  (`role(R)`) to range a variable. A failure names the assignment. A domain
+  can come from the project instead of an export (`domains: {<type>:
+  {source: {...}}}`, see `source` below). When the predicate is a test
+  harness that drives real code (it calls the handler with each role), add
+  `harness_for: [SYM-...]` naming that code; the claim binds with scope
+  `harness`, which proves, and those symbols must be `covered_by` the test.
+  Add `export: <name>` to a `predicate_source` entry when the function's
+  export is not the symbol's title.
+- `state_machine`: set `domain_source` to the transition table (object or
+  Map from state to next states, or `[from, to]` pairs) or to a
+  `next(state, event)` function with `domains: {state, event}`;
+  `initial_source` names the initial state. Model "transitions must be one of
+  a -> b, ..." as a `transitions` set fact (members `a->b`), and terminal,
+  initial or reachable states as `terminal_states`, `initial_states` or
+  `reachable_states` set facts; Kibi checks that projection exactly.
+  Temporal claims use two more projections: "a cancelled invoice can never
+  become paid" is a `reachable_pairs` fact with `operator: excludes` and
+  member `cancelled->paid`, and "every path from draft to paid must pass
+  through approved" is a `required_waypoints` fact with member
+  `draft->paid via approved` (paid must be reachable from draft, and not
+  once approved is removed). Any projection also takes `includes`,
+  `subset_of` and `excludes`. Rules over a machine use `transition`,
+  `reachable`, `initial`, `terminal`, `state`.
+- `regex`: set `pattern_source` to a `RegExp`, a Python `re.compile(...)` or
+  a string constant. Model "X must match `re`" as a string fact with
+  `operator: matches` (a JavaScript pattern with the `u` flag, matched
+  whole); Kibi decides exact language equality and reports the shortest
+  string only one side accepts. Backreferences, lookaround, `\b`, the `g`,
+  `y`, `m` and `v` flags, Python `\d`/`\w` without `re.ASCII` and
+  non-ASCII letters under `i` are refused with the reason. An exact string
+  fact (`eq`/`neq`) checks a constant.
+- `source`: Kibi reads a project source itself and checks a set fact
+  against what it read, so the test only runs the proof (it may write
+  nothing, or `sourceCertificate({ testId })`). Set `source: {reader, ...}`:
+  `json`/`yaml` (`file`, `path`, `select`), `glob` (`pattern`, `capture`),
+  `openapi` (`file`, `select: operations|unsecured_operations|...`),
+  `references` (`files`, `extract: env|imports|calls|string_args|thrown|
+  property`), `schema` (`format: drizzle|prisma|sql`, `select:
+  tables|columns|required_columns|nullable_columns|foreign_keys`), `routes`
+  (Hono or Express app export, `path_prefix`, `names_from`, `select:
+  routes|middleware`) or `validator` (zod, valibot or pydantic, `select:
+  fields|required_fields|optional_fields`). A member Kibi cannot read
+  statically (a computed env name, a dynamic import, an env object handed
+  to a variable) fails the read with its location, and so does an empty
+  read (a glob matching no file, migrations with no `CREATE TABLE`), so a
+  read is never silently partial. Model the claim as a set fact: `eq`
+  (exactly), `includes` (at least), `subset_of` ("must be one of"),
+  `excludes` ("must never use"); `property_key: required_fields` or
+  `nullable_fields` (only `eq`/`includes`) with bare members `name` for
+  "every table" (it also covers tables added later) or `table.name` for
+  one; `middleware` with `includes` for "every route under /p must use M"
+  (Kibi checks each route). Name middleware with `names_from`: a
+  zero-argument factory export such as `requireAuth()` names the
+  middleware it returns `requireAuth`. Write the fact with `kb_model`
+  (requirement mode, `operator` plus a list `value`) or `kb_upsert`. The
+  receipt stales when a file the read touched changes, and the claim binds
+  with scope `source`. `value_source` accepts `{source, measure: count}`.
+  The builders need kibi-cli 2.33.0 or newer in the project. The env
+  extractor reads `process.env`, `import.meta.env`, `Bun.env`,
+  `Deno.env.get`, `os.environ` and `os.getenv`, through casts.
+
+`arithmetic` and `smt` from `constraint_source` alone prove that the
+knowledge base's facts entail the claim, not that code follows the facts:
+their claim bindings have scope `intent` and the claim stays `tested`. Use
+`value_source` (its symbols `covered_by` the test) for scope `code`. A test
+whose numbers are not in typed facts or code constants stays `tested`.
+
+Every certificate contract names the claims it proves in `proves:
+[CLAIM-...]` (blocking `proof-contract-claims` from schema 12). Kibi derives
+each claim's obligation from its grounding fact: a set fact (`value_type:
+set`, `value_set: [...]`) needs the `exhaustive` domain or the `typecheck`
+domain type to be exactly the set (with `property_key: required_fields`,
+`typecheck` instead needs every member to be a required, non-nullable field
+of the domain type); a numeric fact needs the `arithmetic` claim or the
+negated `smt` assertion to be its constraint; rule, predicate, machine and
+string facts need the `rule`, `state_machine` or `regex` checks above. The receipt
+records one binding per claim: `derived` (checked, the only kind that
+proves), `attested` (the fact has no derivation; counts as tested) or
+`rejected` with the reason. Model an enumerated claim as a set fact and a
+bound as a numeric fact before writing its certificate. `kibi proof explain
+REQ-...` shows each claim with its bindings.
+
+Build the certificate with `kibi-cli/proof-certificates`
+(`exhaustiveCertificate`, `typecheckCertificate`, `arithmeticCertificate`,
+`smtCertificate`, `ruleCertificate`, `stateMachineCertificate`,
+`regexCertificate`, `sourceCertificate`; `readProjectSource` returns Kibi's
+read for a test that wants to assert on it), fail the test when it records a failure
+(`failedMembers`, `failedCalls`), and call `writeCodeCertificate`; it writes to the
+directory `kibi prove` sets in `KIBI_PROOF_CERTIFICATES` and does nothing
+elsewhere. A Python test writes the same `kibi.code-certificate.v1` JSON
+to that directory itself. Wire the KB: the proof file symbol is
+`executable_for` the test and named in `required_proofs`; the domain symbol
+(and every symbol a rule, machine or pattern contract names) `implements`
+the requirement and is `covered_by` the test; the test
+`validates` one of the requirement's scenarios. `proved` is per claim: a
+multi-claim requirement is proved only when certificates derive every
+applicable claim, and reads `tested` with `n/m claims proved` otherwise. A
+rejected certificate leaves the receipt at `tested` with
+`certificate_rejection` naming why; fix the proof, never the receipt. If a
+stored certificate stops re-checking later, coverage and `kibi proof
+explain` list it under `certificateRejections`. Use a
+certificate kind only when the domain or claim is genuinely finite or
+decidable; an e2e test that samples cases stays `tested`.
+
+## Evidence floors
+
+Each current requirement accepts a weakest level, its floor: the
+`required_evidence` field (`proved`, `tested`, `asserted` or `unverified`),
+or, when absent, `tested` for a firm requirement and no floor otherwise.
+`kb_check`'s `evidence-floor` rule fails while the level is below the floor;
+coverage rows show it as `evidenceFloor` (`required`, `source`, `status`).
+A requirement whose receipts are only older than the code is
+`pending_reproof` and passes a plain check; `kibi check --fresh-evidence`
+fails it, and is what CI runs after `kibi prove`.
+
+Fix a finding by raising the level: add the scenario, the end-to-end
+test with a proof contract and the receipts, or have a person approve the
+requirement. Lower `required_evidence` only when a person decides the
+requirement does not need that evidence, and say why in the requirement.
+
 ## Knowledge-base certificates
 
 `kb_check` (`kibi check`) proves facts about the KB itself in its
@@ -182,19 +384,23 @@ feasibility are not certified yet; their own rules still decide them.
 
 ## After code changes
 
-Receipts bind to the snapshot, contract hash, and execution fingerprint at
-run time. Any code or source change moves the snapshot and stales receipts:
-re-run `kibi prove` for the affected selection, then confirm `kb_status` and
-`kb_coverage` before handoff.
+Receipts bind to the contract, the test document (its links excluded) and
+the code of the symbols they cover. A change to that code stales them:
+re-run `kibi prove --stale` (or the affected selection), then confirm
+`kb_status` and `kb_coverage` before handoff. Type-shape symbols covered by a
+unit test count only while that unit test has a current passing receipt, so
+prove unit tests that cover type-shape symbols too.
 
-Full reference: `docs/proving-requirements.md`.
+Full reference: [Proving requirements](https://looted.github.io/kibi/reference/proving.html)
+(`docs/proving-requirements.md` in the Kibi repository).
 
 ## Debugging proof regressions
 
-When a proof ratchet fails, diagnose first. Do not treat
-`proof/baseline.json` as the thing to edit.
+When the `evidence-floor` rule fails, diagnose first. Do not lower
+`required_evidence` to make it pass.
 
-1. Do not refresh `proof/baseline.json` as the first fix.
+1. Read the finding: it names the requirement, its level, its floor and where
+   the floor comes from (`explicit` or `firmness`).
 2. Identify the exact requirement and symbol responsible for the regression.
 3. Use Kibi proof diagnostics rather than reverse-engineering
    `requirement_proof.pl`:
@@ -202,14 +408,9 @@ When a proof ratchet fails, diagnose first. Do not treat
    ```bash
    kibi proof explain REQ-<id>
    kibi proof explain SYM-<id>
-   kibi proof impact
+   kibi check --rules evidence-floor
    ```
 
-   `kibi proof impact` compares the current Proof projection to
-   `HEAD:proof/baseline.json` (the committed ratchet snapshot, not the
-   working-tree file). It is diagnostic: fingerprint differences are reported
-   and the command exits 0 on successful evaluation. The strict ratchet remains
-   `scripts/check-proof-baseline.mjs`.
 4. For `missing_production_symbol_coverage`, inspect symbol role, owning
    requirement, `covered_by`, candidate test scope, the requirement scenario
    chain, and the current proof receipt. `kibi proof explain` prints those as
@@ -231,5 +432,5 @@ When a proof ratchet fails, diagnose first. Do not treat
    `covered_by` relationship semantically correct.
 10. Prefer one meaningful E2E scenario covering multiple internal functions
     plus focused unit tests for edge cases, rather than an E2E test per helper.
-11. Refresh the baseline only after a genuine intentional proof-state
-    improvement requires the ratchet snapshot to be updated.
+11. A `pending_reproof` finding under `--fresh-evidence` needs `kibi prove`
+    for the tests behind the requirement, not a KB change.

package/dist/public/skills/kibi-usage/resources/workflows.md

@@ -116,7 +116,7 @@ The canonical workflow for any KB operation follows this pattern:
 7. **Create endpoints**: validated `kb_upsert` for new entities, sequentially
 8. **Link**: validated `kb_upsert` with `requires_rule`, `requires_predicate`, `constrains`, or `requires_property`, sequentially
 9. **Validate coverage and consistency**: targeted `rule-safety`, `rule-verifiability`, `semantic-completeness`, `logic-coverage`, `predicate-verifiability`, and `domain-contradictions`, then final full `kb_check`
-10. **Prove execution**: read `kb_status.proofSnapshot`, run `kibi prove` so each configured integration executes once and its `kibi.proof-run.v1` artifact is evaluated against every selected test's `kibi.proof-contract.v1` obligations, appending idempotent `kibi.proof-receipt.v1` receipts; then re-run `kb_coverage`. Never promote durable test status into fresh evidence.
+10. **Prove execution**: read `kb_status.proofSnapshot`, run `kibi prove` so each configured integration executes once and its `kibi.proof-run.v1` artifact is evaluated against every selected test's `kibi.proof-contract.v1` obligations, appending idempotent `kibi.proof-receipt.v2` receipts; then re-run `kb_coverage` and read each requirement's `evidenceLevel` and `evidenceFloor`. Never promote durable test status into fresh evidence.
 11. **Repair incrementally**: require `kb_coverage.repairPlan.scope.complete`, apply only one `ready` dependency batch per requirement, validate before every sequential write, and rerun coverage before selecting the next batch
 12. **Gate workflow evidence**: when `.kb/usage.log` exists, run `kibi usage-metrics --format json --require-acceptance`; repair ranked telemetry diagnostics and never treat stale or insufficient evidence as a pass
 
@@ -144,7 +144,7 @@ choose package managers, ground semantic claims, resolve contradictions, rerun
 E2E tests, rewrite receipt history, remap authored symbols, or accept
 limitations. Those actions remain explicit review/operator/execution steps.
 
-For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run `kibi prove --requirement <id>` (or the covering integration); this appends proof receipts idempotently and preserves history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
+For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run `kibi prove --requirement <id>` (or the covering integration); this appends proof receipts idempotently and preserves history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved. For `coarse_anchor_only_review`, the requirement is implemented only by whole-file anchors: link the functions, methods or types that implement it (with `covered_by` to their tests) so its `tested` evidence is tied to that code.
 
 ## Creating a New Feature
 ```
@@ -172,8 +172,8 @@ Do not create a test-fact pair. Facts describe invariants; requirements or scena
 
 1. Confirm the exact `REQ -> SCEN -> TEST` path and require typed `verification_scope: end_to_end`; direct requirement-to-test links do not satisfy the conservative scenario stage.
 2. Read `kb_status` and retain its available `proofSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
-3. Run the exact E2E command against that snapshot. Record runner, command, start/finish timestamps, outcome, an environment SHA-256, and an artifact/output SHA-256. Do not mint a passed receipt from an authored test status or from an unexecuted assertion.
-4. Preserve every existing receipt byte-for-byte and append the derived `kibi.proof-receipt.v1` object with strictly later `finished_at`. Earlier receipts may bind older contracts or fingerprints; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
+3. Run `kibi prove --test TEST-<id>` (or `--requirement`, `--integration`, `--all`). It runs the configured producer once against that snapshot and appends a `kibi.proof-receipt.v2` receipt per evaluated contract. Never hand-write a receipt, and never mint a passed receipt from an authored test status or from an unexecuted assertion.
+4. Receipts are append-only. Earlier receipts, including `kibi.proof-receipt.v1` ones, may bind older contracts or fingerprints; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
 5. Re-read `kb_status`; if the snapshot changed during the run, discard the candidate as proof and rerun against the new snapshot. Then run `kb_coverage` and inspect `proofStages.passingE2e.receiptEvidence` plus gap codes.
 
 Only the newest receipt matching the live snapshot, current contract hash, and current execution fingerprint qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_proof_receipt`, `stale_proof_receipt`, `failed_proof_receipt`, `invalid_proof_receipt`, `proof_contract_mismatch`, and `proof_snapshot_unavailable` are repair states, not warnings to waive.

package/dist/report/html-report.css

@@ -203,7 +203,7 @@ h1 span {
 }
 .metrics {
   display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(148px, 1fr));
+  grid-template-columns: repeat(6, minmax(0, 1fr));
   overflow: hidden;
   margin: 0 0 62px;
   border: 1px solid var(--line);
@@ -217,9 +217,13 @@ h1 span {
   border-right: 1px solid var(--line);
   border-bottom: 1px solid var(--line);
 }
-.metric:last-child {
+/* Twelve tiles: two full rows of six, four of three, or six of two. */
+.metric:nth-child(6n) {
   border-right: 0;
 }
+.metric:nth-last-child(-n + 6) {
+  border-bottom: 0;
+}
 .metric span {
   display: block;
   min-height: 32px;
@@ -363,6 +367,24 @@ h1 span {
   text-transform: uppercase;
   letter-spacing: .06em;
 }
+.claims-proved {
+  margin-left: 6px;
+  opacity: 0.75;
+  font-weight: 400;
+}
+.evidence-floor {
+  margin-left: 6px;
+  font-weight: 400;
+  opacity: 0.75;
+}
+.evidence-floor--below {
+  color: var(--red);
+  opacity: 1;
+}
+.evidence-floor--pending_reproof {
+  color: var(--amber);
+  opacity: 1;
+}
 .requirement__id {
   margin-bottom: 7px;
   color: var(--muted);
@@ -392,6 +414,11 @@ h1 span {
   color: var(--green);
   background: rgba(98, 230, 167, 0.08);
 }
+.proof-badge--proved {
+  border-color: rgba(98, 230, 167, 0.45);
+  color: var(--green);
+  background: rgba(98, 230, 167, 0.16);
+}
 .proof-badge--unresolved {
   border-color: rgba(255, 125, 144, 0.25);
   color: var(--red);
@@ -529,13 +556,17 @@ footer {
     min-height: 290px;
   }
   .metrics {
-    grid-template-columns: repeat(3, 1fr);
+    grid-template-columns: repeat(3, minmax(0, 1fr));
   }
-  .metric:nth-child(3) {
+  .metric {
+    border-right: 1px solid var(--line);
+    border-bottom: 1px solid var(--line);
+  }
+  .metric:nth-child(3n) {
     border-right: 0;
   }
-  .metric:nth-child(-n + 3) {
-    border-bottom: 1px solid var(--line);
+  .metric:nth-last-child(-n + 3) {
+    border-bottom: 0;
   }
 }
 @media (max-width: 760px) {
@@ -572,9 +603,10 @@ footer {
 }
 @media (max-width: 520px) {
   .metrics {
-    grid-template-columns: repeat(2, 1fr);
+    grid-template-columns: repeat(2, minmax(0, 1fr));
   }
   .metric {
+    border-right: 1px solid var(--line);
     border-bottom: 1px solid var(--line);
   }
   .metric:nth-child(2n) {
@@ -825,7 +857,7 @@ h1 {
 }
 .proof-rail {
   display: grid;
-  grid-template-columns: repeat(5, minmax(0, 1fr));
+  grid-template-columns: repeat(6, minmax(0, 1fr));
   margin: 0;
   padding: 0;
   list-style: none;
@@ -849,7 +881,6 @@ h1 {
   text-align: left;
   cursor: pointer;
 }
-.proof-gate:last-child,
 .proof-rail > li:last-child .proof-gate {
   padding-right: 0;
 }
@@ -882,6 +913,33 @@ h1 {
   color: var(--danger);
   background: var(--carbon);
 }
+.proof-gate:disabled {
+  cursor: default;
+}
+.gate-status {
+  display: flex;
+  gap: 10px;
+  align-items: center;
+  margin: 0 0 14px;
+  color: var(--mist);
+  font-size: 13px;
+  scroll-margin-top: 110px;
+}
+.gate-status[hidden] {
+  display: none;
+}
+.gate-status__clear {
+  padding: 4px 10px;
+  border: 1px solid var(--line);
+  border-radius: 999px;
+  color: var(--ice);
+  background: transparent;
+  font: inherit;
+  cursor: pointer;
+}
+.proof-gate--optional {
+  border-top-style: dashed;
+}
 .proof-gate__count {
   font: 750 28px / 1 var(--mono);
   letter-spacing: -.05em;
@@ -1036,6 +1094,11 @@ h1 {
   color: var(--success);
   background: rgba(99, 201, 154, 0.07);
 }
+.proof-badge--proved {
+  border-color: rgba(99, 201, 154, 0.55);
+  color: var(--success);
+  background: rgba(99, 201, 154, 0.16);
+}
 .proof-badge--unresolved {
   border-color: rgba(240, 113, 120, 0.3);
   color: var(--danger);
@@ -1043,6 +1106,9 @@ h1 {
 }
 .stages {
   grid-template-columns: repeat(5, minmax(0, 1fr));
+}
+.stages:has(> :nth-child(6)) {
+  grid-template-columns: repeat(6, minmax(0, 1fr));
   gap: 0;
 }
 .stage {
@@ -1132,7 +1198,7 @@ footer {
 }
 @media (max-width: 960px) {
   .proof-rail {
-    grid-template-columns: repeat(5, 180px);
+    grid-template-columns: repeat(6, 180px);
     overflow-x: auto;
     padding-top: 8px;
   }
@@ -1178,7 +1244,8 @@ footer {
   .proof-path__header p {
     text-align: left;
   }
-  .stages {
+  .stages,
+  .stages:has(> :nth-child(6)) {
     grid-template-columns: 1fr;
   }
   .stage {
@@ -1245,3 +1312,8 @@ footer {
     color: inherit;
   }
 }
+.kb-certificates {
+  margin: 14px 0 28px;
+  color: var(--muted);
+  font-size: 13px;
+}

package/dist/report/html-report.d.ts

@@ -8,14 +8,22 @@ export type HtmlReportCoverage = Readonly<{
     rows: readonly UnknownRecord[];
     meta?: UnknownRecord;
 }>;
+/** A kibi.certificates.v1 bundle published next to the report. */
+export type HtmlReportKbCertificates = Readonly<{
+    count: number;
+    kinds: Readonly<Record<string, number>>;
+    href: string;
+}>;
 export type HtmlReportInput = Readonly<{
     requirements: HtmlReportCoverage;
     symbols: HtmlReportCoverage;
     branch: string;
     generatedAt: Date;
     repository?: ReportRepository;
+    kbCertificates?: HtmlReportKbCertificates;
 }>;
 export declare function firstFailingProofGate(gates: readonly ProofGateKey[], passes: (gate: ProofGateKey) => boolean): ProofGateKey | "tested";
 export declare function earliestUnmetGate(row: UnknownRecord): ProofGateKey | "tested";
+export declare function certificateRejectionLines(row: UnknownRecord): readonly string[];
 export declare function renderHtmlReport(input: HtmlReportInput): string;
 //# sourceMappingURL=html-report.d.ts.map

package/dist/report/html-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-report.d.ts","sourceRoot":"","sources":["../../src/report/html-report.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAuB9D,eAAO,MAAM,UAAU,6FACqE,CAAC;AAG7F,eAAO,MAAM,wBAAwB,gEAC0B,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,YAAY,EAAE,kBAAkB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B,CAAC,CAAC;AAkNH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GACtC,YAAY,GAAG,QAAQ,CAKzB;AAID,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,CAM7E;AAqZD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAuM/D"}
+{"version":3,"file":"html-report.d.ts","sourceRoot":"","sources":["../../src/report/html-report.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAuB9D,eAAO,MAAM,UAAU,6FACqE,CAAC;AAG7F,eAAO,MAAM,wBAAwB,gEAC0B,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,YAAY,EAAE,kBAAkB,CAAC;IACjC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,cAAc,CAAC,EAAE,wBAAwB,CAAC;CAC3C,CAAC,CAAC;AA2NH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GACtC,YAAY,GAAG,QAAQ,CAKzB;AAID,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,CAM7E;AAgYD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,aAAa,GACjB,SAAS,MAAM,EAAE,CAWnB;AA2MD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CA+N/D"}