kibi-cli 2.31.1 → 2.35.1

package/src/public/operations/evidence-floor.ts

@@ -0,0 +1,203 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { readKbManifest } from "../../utils/kb-manifest.js";
+import type { Violation } from "../../utils/rule-registry.js";
+import { PROOF_RECEIPT_MAX_AGE_SECONDS } from "../proof-receipt.js";
+import { runOperationJsonQuery, toPrologAtom } from "./prolog-json.js";
+import type { OperationContext } from "./runtime-types.js";
+import { readWorkspaceSnapshot } from "./workspace-snapshot.js";
+
+/**
+ * The schema version from which a current requirement's evidence level must
+ * reach its floor; older KBs get the floor with their schema upgrade, whose
+ * migration records the floor of firm requirements without a proof path.
+ */
+// implements REQ-kibi-evidence-floors
+export const EVIDENCE_FLOOR_SCHEMA_VERSION = 11;
+
+/** A current requirement's evidence level must reach its floor. */
+// implements REQ-kibi-evidence-floors
+export const EVIDENCE_FLOOR_RULE = "evidence-floor";
+
+// implements REQ-kibi-evidence-floors
+export type EvidenceFloorRow = Readonly<{
+  id: string;
+  evidenceLevel: string;
+  requiredEvidence: string;
+  requiredEvidenceSource: string;
+  status: "below" | "pending_reproof";
+  proofStatus: string;
+  proofGaps: readonly string[];
+  /** The tests and symbols behind the gaps; empty lists are left out. */
+  gapDetails?: Readonly<Record<string, readonly string[]>>;
+}>;
+
+type EvidenceFloorPayload = {
+  readonly evaluated?: number;
+  readonly rows?: readonly EvidenceFloorRow[];
+};
+
+export type EvidenceFloorOptions = Readonly<{
+  /**
+   * Judge receipts as they are: stale receipts no longer count as pending
+   * re-proof, and the proof snapshot must be clean. CI uses it right after
+   * `kibi prove --all`.
+   */
+  freshEvidence?: boolean;
+}>;
+
+function floorSource(row: EvidenceFloorRow): string {
+  return row.requiredEvidenceSource === "explicit"
+    ? "its required_evidence"
+    : row.requiredEvidence === "tested"
+      ? "the floor of a firm requirement"
+      : "its floor";
+}
+
+const GAP_DETAIL_LABELS: Readonly<Record<string, string>> = {
+  failedReceiptTests: "failing receipts",
+  missingReceiptTests: "no receipt",
+  staleReceiptTests: "stale receipts",
+  invalidReceiptTests: "invalid receipts",
+  contractMismatchReceiptTests: "receipts for an older contract",
+  uncoveredSymbols: "production symbols without qualifying coverage",
+  missingCoordinateSymbols: "symbols without source coordinates",
+  unprovedClaims: "claims no certificate derives",
+};
+
+/** The entities behind the gaps, for a person reading kibi check's text. */
+// implements REQ-kibi-evidence-floors
+export function gapDetailLines(row: EvidenceFloorRow): string[] {
+  return Object.entries(row.gapDetails ?? {}).flatMap(([key, ids]) =>
+    ids.length === 0
+      ? []
+      : [
+          `${GAP_DETAIL_LABELS[key] ?? key}: ${ids.slice(0, 8).join(", ")}${ids.length > 8 ? ` (+${ids.length - 8} more)` : ""}`,
+        ],
+  );
+}
+
+function suggestionFor(row: EvidenceFloorRow): string {
+  if (row.status === "pending_reproof")
+    return `Run kibi prove for the tests behind ${row.id} so its receipts match the current code, then rerun kibi check --fresh-evidence.`;
+  switch (row.requiredEvidence) {
+    case "proved":
+      return `Prove every applicable claim of ${row.id}${(row.gapDetails?.unprovedClaims ?? []).length > 0 ? ` (unproved: ${(row.gapDetails?.unprovedClaims ?? []).join(", ")})` : ""}: model each as a set fact (prove it with exhaustive or typecheck), a numeric fact (arithmetic or smt), a rule, predicate or set fact about a predicate (rule or state_machine) or a string fact (regex), name it in a certificate test's proof_contract.proves, and run kibi prove; kibi proof explain ${row.id} shows each claim's bindings. A claim with no such fact can only be attested, so lower required_evidence to tested with the reason in the requirement if that is enough.`;
+    case "tested":
+      return `Link ${row.id} to a scenario with an end-to-end test that has a proof contract, run kibi prove, and fix its proof gaps (${row.proofGaps.join(", ") || "none listed"}${gapDetailLines(row).length > 0 ? `; ${gapDetailLines(row).join("; ")}` : ""}); kibi proof explain ${row.id} shows each one. Or lower required_evidence if a person decides it does not need tests.`;
+    default:
+      return `Have a person approve ${row.id} (origin.approved_by) or state it as firm with origin.ref to their words, or lower required_evidence.`;
+  }
+}
+
+/** One finding per current requirement whose evidence is below its floor. */
+// implements REQ-kibi-evidence-floors
+export function evidenceFloorViolations(
+  rows: readonly EvidenceFloorRow[],
+  options: EvidenceFloorOptions = {},
+): Violation[] {
+  return rows
+    .filter((row) => options.freshEvidence === true || row.status === "below")
+    .map((row) => ({
+      rule: EVIDENCE_FLOOR_RULE,
+      entityId: row.id,
+      description:
+        row.status === "pending_reproof"
+          ? `${row.id} is ${row.evidenceLevel} but needs ${row.requiredEvidence} (${floorSource(row)}); its receipts are older than the code`
+          : `${row.id} is ${row.evidenceLevel} but needs ${row.requiredEvidence} (${floorSource(row)})`,
+      suggestion: suggestionFor(row),
+      evidence: {
+        evidenceLevel: row.evidenceLevel,
+        requiredEvidence: row.requiredEvidence,
+        requiredEvidenceSource: row.requiredEvidenceSource,
+        status: row.status,
+        proofStatus: row.proofStatus,
+        proofGaps: row.proofGaps,
+        ...(row.gapDetails === undefined ? {} : { gapDetails: row.gapDetails }),
+      },
+    }));
+}
+
+/**
+ * Every current requirement whose evidence is below its floor (status below
+ * or pending_reproof), judged on the attached store with the same
+ * per-contract receipt binding kb_coverage uses. Unlike the check rule this
+ * ignores the schema version, so a migration can read the floor the ladder
+ * will apply before it records the new schema.
+ */
+// implements REQ-kibi-evidence-floors
+export async function readEvidenceFloorRows(
+  context: OperationContext,
+  snapshotEvidence?: Awaited<ReturnType<typeof readWorkspaceSnapshot>>,
+): Promise<readonly EvidenceFloorRow[]> {
+  const prolog = context.prolog ?? (await context.ensureProlog?.());
+  if (prolog === undefined) return [];
+  const evidence = snapshotEvidence ?? (await readWorkspaceSnapshot(context));
+  const snapshot = evidence.available ? evidence.snapshot.hash : "unknown";
+  const { perContractTestBindings } = await import("./specs/reporting.js");
+  const bindings = await perContractTestBindings({ ...context, prolog });
+  const checkedAt = context.clock().toISOString();
+  const goal = `discovery:evidence_floor_json(${bindings === null ? "strict_snapshot, _{}" : `per_contract, ${bindings}`}, ${toPrologAtom(snapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`;
+  const payload = await runOperationJsonQuery<EvidenceFloorPayload>(
+    prolog,
+    "discovery.pl",
+    goal,
+    "Evidence floor evaluation",
+  );
+  return payload.rows ?? [];
+}
+
+/**
+ * Evaluate the evidence-floor rule against the attached store, with the same
+ * per-contract receipt binding kb_coverage uses.
+ */
+// implements REQ-kibi-evidence-floors
+export async function collectEvidenceFloorViolations(
+  context: OperationContext,
+  rules: ReadonlySet<string>,
+  options: EvidenceFloorOptions = {},
+): Promise<Violation[]> {
+  if (!rules.has(EVIDENCE_FLOOR_RULE) || context.prolog === undefined)
+    return [];
+  // A store without a manifest predates schema 11 as much as an old one.
+  const schemaVersion = readKbManifest(context.workspaceRoot)?.schemaVersion;
+  if (
+    schemaVersion === undefined ||
+    schemaVersion < EVIDENCE_FLOOR_SCHEMA_VERSION
+  )
+    return [];
+  const snapshotEvidence = await readWorkspaceSnapshot(context);
+  const rows = await readEvidenceFloorRows(context, snapshotEvidence);
+  const violations = evidenceFloorViolations(rows, options);
+  if (options.freshEvidence === true) {
+    const clean =
+      snapshotEvidence.available && snapshotEvidence.snapshot.dirty === false;
+    if (!clean)
+      violations.unshift({
+        rule: EVIDENCE_FLOOR_RULE,
+        entityId: "proof-snapshot",
+        description: snapshotEvidence.available
+          ? "--fresh-evidence needs a clean proof snapshot, but the working tree has uncommitted changes"
+          : `--fresh-evidence needs a proof snapshot, but none is available: ${snapshotEvidence.error}`,
+        suggestion:
+          "Commit or stash working-tree changes (or run inside a Git checkout), run kibi prove, then rerun kibi check --fresh-evidence.",
+      });
+  }
+  return violations;
+}

package/src/public/operations/migration-plan.ts

@@ -297,8 +297,11 @@ export function mergeMigrationPlans(
   });
 }
 
+/** How many automatic actions a plan digest lists by id. */
+const DIGEST_AUTOMATIC_ACTIONS = 20;
+
 export const MIGRATION_PLAN_DIGEST_VERSION =
-  "kibi.migration-plan-digest.v1" as const;
+  "kibi.migration-plan-digest.v2" as const;
 
 export type MigrationPlanDigest = Readonly<{
   version: typeof MIGRATION_PLAN_DIGEST_VERSION;
@@ -307,7 +310,20 @@ export type MigrationPlanDigest = Readonly<{
   expected: MigrationPlan["expected"];
   scope: MigrationPlan["scope"];
   summary: MigrationPlan["summary"];
-  automaticActions: readonly MigrationAction[];
+  /** The first automatic actions, by id; automaticSummary counts them all. */
+  automaticActions: readonly Readonly<{
+    id: string;
+    code: string;
+    state: MigrationActionState;
+    autoApplicable: boolean;
+    dependsOn: readonly string[];
+  }>[];
+  automaticSummary: Readonly<{
+    total: number;
+    ready: number;
+    blocked: number;
+    omitted: number;
+  }>;
   actionGroups: readonly Readonly<{
     code: string;
     safety: MigrationSafety;
@@ -320,9 +336,10 @@ export type MigrationPlanDigest = Readonly<{
 
 /**
  * A bounded summary of a plan for responses that report what is left rather
- * than hand over a plan to apply: automatic actions stay whole, every other
- * action is counted by code. The full plan comes from status, check and
- * coverage.
+ * than hand over a plan to apply: the first automatic actions are listed by
+ * id and all of them counted, every other action is counted by code. The full
+ * plan comes from status, check and coverage, so a response stays small even
+ * when hundreds of actions remain.
  */
 // implements REQ-agent-guided-migration-orchestration
 export function digestMigrationPlan(plan: MigrationPlan): MigrationPlanDigest {
@@ -365,7 +382,23 @@ export function digestMigrationPlan(plan: MigrationPlan): MigrationPlanDigest {
     expected: plan.expected,
     scope: plan.scope,
     summary: plan.summary,
-    automaticActions,
+    automaticActions: automaticActions
+      .slice(0, DIGEST_AUTOMATIC_ACTIONS)
+      .map((action) => ({
+        id: action.id,
+        code: action.code,
+        state: action.state,
+        autoApplicable: action.autoApplicable,
+        dependsOn: action.dependsOn,
+      })),
+    automaticSummary: {
+      total: automaticActions.length,
+      ready: automaticActions.filter(
+        (action) => action.state === "ready" && action.autoApplicable,
+      ).length,
+      blocked: blockedAutomatic,
+      omitted: Math.max(0, automaticActions.length - DIGEST_AUTOMATIC_ACTIONS),
+    },
     actionGroups: [...groups.values()].sort(
       (left, right) =>
         right.count - left.count ||

package/src/public/operations/node-ports.ts

@@ -79,7 +79,9 @@ function isReceiptOnlyMarkdownChange(
     const committed = execFileSync(
       "git",
       ["-C", workspaceRoot, "show", `HEAD:${relativePath}`],
-      { encoding: "buffer", maxBuffer: 64 * 1024 * 1024 },
+      // A file staged but not committed yet has no HEAD blob; git's error is
+      // expected here and must not reach the terminal.
+      { encoding: "buffer", maxBuffer: 64 * 1024 * 1024, stdio: "pipe" },
     ) as Buffer;
     return working.equals(snapshotFileContent(relativePath, committed));
   } catch {

package/src/public/operations/proof-contract-claims.ts

@@ -0,0 +1,103 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { readKbManifest } from "../../utils/kb-manifest.js";
+import type { Violation } from "../../utils/rule-registry.js";
+import { runOperationJsonQuery } from "./prolog-json.js";
+import type { OperationContext } from "./runtime-types.js";
+
+/**
+ * The schema version from which every certificate-kind proof contract must
+ * name the claims it proves; older KBs get the rule with their schema
+ * upgrade, whose migration pins proves where the claim is unambiguous.
+ */
+// implements REQ-kibi-claim-bound-proofs
+export const CLAIM_BINDING_SCHEMA_VERSION = 12;
+
+/** A certificate-kind proof contract must name provable claims in proves. */
+// implements REQ-kibi-claim-bound-proofs
+export const PROOF_CONTRACT_CLAIMS_RULE = "proof-contract-claims";
+
+// implements REQ-kibi-claim-bound-proofs
+export type ProofContractClaimIssue = Readonly<{
+  test_id: string;
+  claim_key?: string;
+  reason: string;
+}>;
+
+/**
+ * Every certificate-kind proof contract that names no claims, and every
+ * named claim no certificate of its kind could prove. Ignores the schema
+ * version, so a migration can read what the rule will report.
+ */
+// implements REQ-kibi-claim-bound-proofs
+export async function readProofContractClaimIssues(
+  context: OperationContext,
+): Promise<readonly ProofContractClaimIssue[]> {
+  const prolog = context.prolog ?? (await context.ensureProlog?.());
+  if (prolog === undefined) return [];
+  return runOperationJsonQuery<ProofContractClaimIssue[]>(
+    prolog,
+    "claim_obligations.pl",
+    "claim_obligations:proof_contract_claim_issues_json(JsonString)",
+    "Proof contract claims",
+  );
+}
+
+/** One finding per contract without proves and per unprovable claim key. */
+// implements REQ-kibi-claim-bound-proofs
+export function proofContractClaimViolations(
+  issues: readonly ProofContractClaimIssue[],
+): Violation[] {
+  return issues.map((issue) => ({
+    rule: PROOF_CONTRACT_CLAIMS_RULE,
+    entityId: issue.test_id,
+    description:
+      issue.claim_key === undefined
+        ? `${issue.test_id}: ${issue.reason}`
+        : `${issue.test_id} proves ${issue.claim_key}: ${issue.reason}`,
+    suggestion:
+      issue.claim_key === undefined
+        ? `Add proof_contract.proves to ${issue.test_id} with the claim keys (CLAIM-...) of the requirement its certificate establishes; kibi proof explain on the requirement lists its claims.`
+        : `Name a modeled claim of a requirement ${issue.test_id} reaches through its scenarios, grounded by a fact this proof kind can express (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt, a rule, predicate or set fact for rule or state_machine, a string fact for regex), or remove ${issue.claim_key} from proves.`,
+    evidence: {
+      testId: issue.test_id,
+      ...(issue.claim_key === undefined ? {} : { claimKey: issue.claim_key }),
+      reason: issue.reason,
+    },
+  }));
+}
+
+/** Evaluate the proof-contract-claims rule from schema 12. */
+// implements REQ-kibi-claim-bound-proofs
+export async function collectProofContractClaimViolations(
+  context: OperationContext,
+  rules: ReadonlySet<string>,
+): Promise<Violation[]> {
+  if (!rules.has(PROOF_CONTRACT_CLAIMS_RULE) || context.prolog === undefined)
+    return [];
+  const schemaVersion = readKbManifest(context.workspaceRoot)?.schemaVersion;
+  if (
+    schemaVersion === undefined ||
+    schemaVersion < CLAIM_BINDING_SCHEMA_VERSION
+  )
+    return [];
+  return proofContractClaimViolations(
+    await readProofContractClaimIssues(context),
+  );
+}

package/src/public/operations/specs/check-rules.generated.ts

@@ -65,9 +65,11 @@ export const SELECTABLE_RULE_NAMES: readonly string[] = [
   "policy-markers",
   "kb-consistency",
   "kb-consistency-unresolved",
+  "evidence-floor",
+  "proof-contract-claims",
 ];
 
 // implements REQ-006
 /** Comma-separated "Allowed:" fragment for the kb_check rules description. */
 export const SELECTABLE_RULES_ALLOWED =
-  "must-priority-coverage, symbol-coverage, symbol-traceability, symbol-granularity, no-dangling-refs, source-relationship-parity, branch-store-not-compiled, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged, decision-firm-unreferenced, decision-firm-superseded, decision-firm-edited, supersedes-reason-missing, supersedes-reason-acknowledged, policy-ownership, policy-markers, kb-consistency, kb-consistency-unresolved";
+  "must-priority-coverage, symbol-coverage, symbol-traceability, symbol-granularity, no-dangling-refs, source-relationship-parity, branch-store-not-compiled, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged, decision-firm-unreferenced, decision-firm-superseded, decision-firm-edited, supersedes-reason-missing, supersedes-reason-acknowledged, policy-ownership, policy-markers, kb-consistency, kb-consistency-unresolved, evidence-floor, proof-contract-claims";

package/src/public/operations/specs/modeling.ts

@@ -55,13 +55,32 @@ export const modelRequirementSpec = {
       },
       operator: {
         type: "string",
-        enum: ["eq", "gt", "gte", "lt", "lte", "neq", "bool", "polarity"],
-        description:
-          "Optional extracted semantic claim operator. Use gt/lt for strict bounds ('greater than zero' is gt 0, not gte 0). Example: 'eq'.",
+        enum: [
+          "eq",
+          "gt",
+          "gte",
+          "lt",
+          "lte",
+          "neq",
+          "bool",
+          "polarity",
+          "matches",
+          "includes",
+          "subset_of",
+          "excludes",
+        ],
+        description:
+          "Optional extracted semantic claim operator. Use gt/lt for strict bounds ('greater than zero' is gt 0, not gte 0). A set claim takes a list value with eq (exactly these), includes (at least these), subset_of (only these) or excludes (none of these); matches takes a regular expression string. Example: 'eq'.",
       },
       value: {
-        description:
-          "Optional extracted semantic claim value. Accepts string, number, or boolean.",
+        anyOf: [
+          { type: "string" },
+          { type: "number" },
+          { type: "boolean" },
+          { type: "array", items: { type: "string" }, minItems: 1 },
+        ],
+        description:
+          "Optional extracted semantic claim value: a string, number or boolean, or a list of strings for a set claim. Example: ['requireAuth'] with operator includes.",
       },
       provenance: {
         type: "string",

package/src/public/operations/specs/mutation-schemas.ts

@@ -1,4 +1,5 @@
 import { ENTITY_ORIGIN_SCHEMA } from "../../entity-origin.js";
+import { EVIDENCE_LEVELS } from "../../evidence-levels.js";
 import {
   PROOF_BINDINGS_SCHEMA,
   PROOF_CONTRACT_SCHEMA,
@@ -131,6 +132,12 @@ export const ENTITY_PROPERTIES_SCHEMA = {
       description:
         "req/adr only. firm = a human stated it as a rule (needs origin.ref to their words); its title, meaning or firmness changes only with new human words (a new origin.ref) or by supersede. default = delegated or agent choice; exploratory = flagged guess. Absent = default if an agent wrote it, else firm.",
     },
+    required_evidence: {
+      type: "string",
+      enum: [...EVIDENCE_LEVELS],
+      description:
+        "Requirement-only. Weakest evidence level it accepts; the evidence-floor rule fails below it. Absent = tested if firm, else unverified.",
+    },
     rationale: {
       type: "string",
       minLength: 1,
@@ -237,15 +244,26 @@ export const ENTITY_PROPERTIES_SCHEMA = {
     },
     operator: {
       type: "string",
-      enum: ["eq", "neq", "lt", "lte", "gt", "gte"],
+      enum: [
+        "eq",
+        "neq",
+        "lt",
+        "lte",
+        "gt",
+        "gte",
+        "matches",
+        "includes",
+        "subset_of",
+        "excludes",
+      ],
       description:
-        "Optional comparison operator for property_value facts. Example: 'eq'.",
+        "Optional comparison operator for property_value facts. Example: 'eq'. 'matches' (string facts only): value_string is a JavaScript regular expression (u flag) every value must match as a whole. Set facts only: 'includes' means every member of value_set has the property and other members may have it too; 'subset_of' means every member that has the property is in value_set ('every env var the server reads is one of ...'); 'excludes' means no member of value_set has it ('never imports md5'); 'eq' on a set means exactly those members.",
     },
     value_type: {
       type: "string",
-      enum: ["string", "int", "number", "bool"],
+      enum: ["string", "int", "number", "bool", "set"],
       description:
-        "Optional typed value discriminator for property_value facts. Pair with exactly one value_string, value_int, value_number, or value_bool; do not use generic value.",
+        "Optional typed value discriminator for property_value facts. Pair with exactly one value_string, value_int, value_number, value_bool, or value_set (set: a list of members, with operator eq, includes, subset_of or excludes); do not use generic value.",
     },
     value_string: {
       type: "string",
@@ -263,6 +281,14 @@ export const ENTITY_PROPERTIES_SCHEMA = {
       type: "boolean",
       description: "Optional boolean value for property_value facts.",
     },
+    value_set: {
+      type: "array",
+      items: { type: "string", minLength: 1 },
+      minItems: 1,
+      uniqueItems: true,
+      description:
+        "Optional exact set of values for property_value facts with value_type set, such as the members a domain must have.",
+    },
     unit: {
       type: "string",
       description: "Optional unit for numeric property_value facts.",

package/src/public/operations/specs/reporting.ts

@@ -242,7 +242,7 @@ export async function perContractTestBindings(
 ): Promise<string | null> {
   if (currentProofBindingMode() !== "per_contract") return null;
   const { loadEntities } = await import("../discovery-entities.js");
-  const { currentReceiptBindingHash, loadCoveredBySymbolsByTest } =
+  const { currentReceiptBindingHashes, loadCoveredBySymbolsByTest } =
     await import("../../../operations/proof/code-scope.js");
   // Only the contract, scoped code, and authored source feed the binding
   // hash. The paged projection never materializes receipt histories, which
@@ -269,14 +269,19 @@ export async function perContractTestBindings(
     if (testId === "" || fs === undefined) continue;
     // The same computation ingest uses to write binding_hash. Unreadable or
     // non-markdown documents keep strict snapshot semantics for that test.
-    const binding = await currentReceiptBindingHash({
+    const bindings = await currentReceiptBindingHashes({
       workspaceRoot: context.workspaceRoot,
       readFile: (absolute) => fs.readFile(absolute),
       test,
       coveredBySymbols: coveredBy.get(testId) ?? [],
     });
-    if (binding !== undefined) {
-      entries.push(`${toPrologAtom(testId)}: ${toPrologAtom(binding)}`);
+    if (bindings !== undefined) {
+      // One hash, or the current and the earlier binding a receipt may carry.
+      const value =
+        bindings.length === 1
+          ? toPrologAtom(bindings[0] as string)
+          : `[${bindings.map(toPrologAtom).join(", ")}]`;
+      entries.push(`${toPrologAtom(testId)}: ${value}`);
     }
   }
   if (entries.length === 0) return null;
@@ -332,16 +337,21 @@ export async function executeCoverage(
     const statuses = (input.statuses ?? []).map((status) =>
       validateCoverageStatus(status),
     );
+    // A status filter judges receipts with the same per-contract binding as
+    // the unfiltered report; otherwise its rows and summary disagree with
+    // every other proof view.
     const bindingsDict =
-      statuses.length === 0 && (input.by ?? "req") === "req"
+      (input.by ?? "req") === "req"
         ? await perContractTestBindings(context)
         : null;
     const goalFor = (limit: number, offset: number): string =>
-      bindingsDict !== null
-        ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, per_contract, ${bindingsDict}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
-        : statuses.length > 0
-          ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${toPrologList(statuses)}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
-          : `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`;
+      bindingsDict !== null && statuses.length > 0
+        ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${toPrologList(statuses)}, per_contract, ${bindingsDict}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
+        : bindingsDict !== null
+          ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, per_contract, ${bindingsDict}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
+          : statuses.length > 0
+            ? `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${toPrologList(statuses)}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`
+            : `discovery:coverage_report_json('${input.by ?? "req"}', ${toPrologList(input.tags)}, ${input.includePassing ?? false}, ${input.includeTransitive ?? true}, ${limit}, ${offset}, ${toPrologAtom(codeSnapshot)}, ${toPrologAtom(checkedAt)}, ${PROOF_RECEIPT_MAX_AGE_SECONDS}, JsonString)`;
     const payload = await readCoveragePages(
       requireProlog(context),
       goalFor,