kibi-cli 2.32.0 → 2.35.1

package/src/public/schemas/entity.ts

@@ -35,7 +35,17 @@ type FactKind =
   | "predicate"
   | "rule_schema"
   | "rule";
-type Operator = "eq" | "neq" | "lt" | "lte" | "gt" | "gte";
+type Operator =
+  | "eq"
+  | "neq"
+  | "lt"
+  | "lte"
+  | "gt"
+  | "gte"
+  | "matches"
+  | "includes"
+  | "subset_of"
+  | "excludes";
 type ValueType = "string" | "int" | "number" | "bool";
 type Polarity = "require" | "forbid" | "assert" | "deny";
 type VerificationScope = "unit" | "integration" | "end_to_end";
@@ -549,7 +559,27 @@ const entitySchema: Record<string, unknown> = {
     },
     subject_key: { type: "string" },
     property_key: { type: "string" },
-    operator: { type: "string", enum: ["eq", "neq", "lt", "lte", "gt", "gte"] },
+    // matches: value_string is a JavaScript regular expression (u flag) the
+    // property's values match as a whole; only string facts use it.
+    // includes: every member of value_set has the property (the members
+    // that have it include the set); subset_of: every member that has the
+    // property is in value_set; excludes: no member of value_set has it.
+    // Only set facts use these three.
+    operator: {
+      type: "string",
+      enum: [
+        "eq",
+        "neq",
+        "lt",
+        "lte",
+        "gt",
+        "gte",
+        "matches",
+        "includes",
+        "subset_of",
+        "excludes",
+      ],
+    },
     value_type: {
       type: "string",
       enum: ["string", "int", "number", "bool", "set"],

package/src/public/skills/kibi-commit-review/SKILL.md

@@ -1,8 +1,8 @@
 ---
 id: kibi-commit-review
 name: kibi-commit-review
-description: "Use when kibi check --staged or the Kibi pre-commit hook blocks a commit (kibi_impact_evidence_missing, symbols_manifest_stale, symbol_granularity_violation, symbol-coverage, kibi check-generated drift, Staged impact review failed), or when preparing a commit or pull-request impact review. Covers reading the per-file Detail lines, authoring .kb/symbols.yaml symbol entries through kb_upsert, kibi sync --refresh-symbol-coordinates, staging the tracked Kibi evidence with git add, kb_prepare_impact_review for a staged or diff scope, the kibi signoff requirements summary to show before a commit, and how merge commits and migration renames are judged."
-version: 1.2.2
+description: "Use when kibi check --staged or the Kibi pre-commit hook blocks a commit (kibi_impact_evidence_missing, symbols_manifest_stale, symbol_granularity_violation, symbol-coverage, kibi check-generated drift, Staged impact review failed), or when preparing a commit or pull-request impact review. Covers reading the per-file Detail lines, authoring .kb/symbols.yaml symbol entries through kb_upsert, staging the tracked Kibi evidence with git add (symbol coordinates are derived and never staged), kb_prepare_impact_review for a staged or diff scope, the kibi signoff requirements summary to show before a commit, and how merge commits and migration renames are judged."
+version: 1.3.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -55,17 +55,17 @@ Never read or open any file under `.kb`, not even read-only with a file tool to
    - New or uncovered symbols: author a `symbol` entity per listed symbol
      through `kb_upsert` (`title` = the member the extractor names,
      `sourceFile`, `status: active`, `symbol_role: behavioral`, `implements`
-     to the requirement, `covered_by` to the test). Then run
-     `kibi sync --refresh-symbol-coordinates`.
-   - Only coordinates moved: `kibi sync --refresh-symbol-coordinates`.
+     to the requirement, `covered_by` to the test).
+   - Only lines moved: nothing to do. Symbol coordinates are derived locally
+     by every sync and never committed.
    - No behavior change (a genuine false positive): see the audited
      no-impact note in `resources/staged-gate.md`; it never covers a real
      behavior change.
 4. **Stage the evidence.** Kibi authors tracked files but never Git-stages or
    commits them. `git status --short .kb` lists what it wrote; `git add` the
-   entity Markdown, `.kb/relationships/` shards, `.kb/symbols.yaml` and
-   `.kb/symbol-coordinates.yaml` that belong to this change (use `git add -p`
-   when the files hold unrelated edits).
+   entity Markdown, `.kb/relationships/` shards and `.kb/symbols.yaml` that
+   belong to this change (use `git add -p` when the files hold unrelated
+   edits). `.kb/symbol-coordinates.yaml` is gitignored; never stage it.
 5. **Re-run** `kibi check --staged` (and `kibi check-generated --staged` when it
    failed) until it passes. Never bypass the hook (`--no-verify`) unless the
    person says so.

package/src/public/skills/kibi-commit-review/resources/staged-gate.md

@@ -8,10 +8,10 @@ not the working tree, so a fix counts only once it is staged.
 ## Reading a finding
 
 ```text
-symbols_manifest_stale: .kb/symbol-coordinates.yaml is stale or missing for staged source files: src/billing/refund.ts
+symbols_manifest_stale: .kb/symbols.yaml does not cover the declarations of staged source files: src/billing/refund.ts
   Detail: src/billing/refund.ts — extraction finds 4 symbol(s), evidence covers 3.
       Not in .kb/symbols.yaml: approveRefund (line 42)
-  Suggestion: Author .kb/symbols.yaml entries for the uncovered symbols (kibi upsert, with implements/covered_by links), then run kibi sync --refresh-symbol-coordinates && git add .kb/symbol-coordinates.yaml .kb/symbols.yaml, then re-run kibi check --staged.
+  Suggestion: Author .kb/symbols.yaml entries for the uncovered symbols (kibi upsert, with implements/covered_by links). Stage .kb/symbols.yaml with the behavior edit, then re-run kibi check --staged.
 ```
 
 - Detail lines name every symbol, never a shortened list. `Evidence without a
@@ -24,15 +24,15 @@ symbols_manifest_stale: .kb/symbol-coordinates.yaml is stale or missing for stag
 
 | Id or message | Cause | Fix |
 | --- | --- | --- |
-| `kibi_impact_evidence_missing` | A staged behavior edit (changed lines in exported or behavior-bearing code, not comments or formatting) has no staged Kibi evidence. Test-only edits do not need it unless they add executable test symbols. | Query the owning knowledge; update it when behavior changed; stage entity Markdown under `.kb/`, authored `.kb/symbols.yaml` entries for the listed symbols, or refreshed `.kb/symbol-coordinates.yaml`. |
-| `symbols_manifest_stale` | Extraction output changed and the staged coordinates (or manifest) do not match it. | Author entries for the listed symbols first, then `kibi sync --refresh-symbol-coordinates`, then stage both manifests. |
+| `kibi_impact_evidence_missing` | A staged behavior edit (changed lines in exported or behavior-bearing code, not comments or formatting) has no staged Kibi evidence. Test-only edits do not need it unless they add executable test symbols. | Query the owning knowledge; update it when behavior changed; stage entity Markdown under `.kb/` or authored `.kb/symbols.yaml` entries for the listed symbols. A file whose every declaration already has a `.kb/symbols.yaml` entry needs nothing more. |
+| `symbols_manifest_stale` | A staged behavior file declares symbols `.kb/symbols.yaml` has no entry for, or an entry names a declaration that is gone. | Author entries for the listed symbols, re-point or retire entries whose declaration is gone, and stage `.kb/symbols.yaml`. Coordinates are derived locally and never staged. |
 | `symbol_granularity_violation` | A changed behavioral member is owned only by a coarse class or module symbol while a narrower declaration exists. | Add a symbol for the member itself (`title` = `Class.method` or the exported function) with its own links; use `granularity_reason` (`config-artifact`, `module-level-behavior`, `extractor-miss`, `legacy-link`, `test-suite`) only when it is true. |
 | `symbol-coverage` | A changed symbol, or a symbol whose staged manifest entry changed, fails the full-check rule on the staged knowledge. | The symbol `implements` the requirement and is `covered_by` a test that verifies it: through the requirement's scenario (`verified_by` scenario -> test) when it has one, else `verified_by` requirement -> test. A direct requirement -> test link does not count while a scenario exists. The finding's suggestion names the missing link (see `kibi-traceability`). |
 | `kibi_impact_override_missing_rationale` | A `Kibi-Impact: none` declaration has no `Rationale:` line. | Add the rationale, or drop the declaration and stage real evidence. |
 | `entity-context-missing` (staged entity) | A staged requirement, scenario, test, ADR or observation fact has fewer than 12 words of context. | Upsert a sectioned `document.body` (see `kibi-usage`, Entity body contract). |
 | `domain-contradictions`, `kb-consistency`, `scenario-feasibility`, `exception-claim-keys` (staged `.kb/` change) | The staged knowledge introduces a violation the last commit did not have. `kb-consistency` also catches facts that contradict only together and names their requirements. | Fix the knowledge; a contradiction with a recorded rule goes to the person (`kibi-decisions`). |
 | Proposition-complete ingestion | A staged requirement's semantic inventory is missing or no longer matches its prose. | Re-derive it (`kb_model` analyze with the complete prose) or run `kibi migrate` for drift. |
-| `kibi check-generated --staged` drift | The staged `.kb/symbols.yaml` or `.kb/symbol-coordinates.yaml` differs from a refresh computed from the index. | `kibi sync --refresh-symbol-coordinates`, review the diff, stage only the intended hunks (`git add -p`). |
+| `kibi check-generated --staged` drift | The staged `.kb/symbols.yaml` is not in the layout sync writes, or `.kb/symbol-coordinates.yaml` is tracked. | `kibi sync --refresh-symbol-coordinates`, review the diff, stage only the intended hunks (`git add -p`); untrack a tracked coordinates file with `kibi migrate` (or `git rm --cached`). |
 | `Staged impact review failed: impact_review_invalid: ...` | The base commit has `.kibi/impact-policy.json` and the staged `.kibi/impact-review.json` is missing, stale or incomplete. The message names the cause (missing review path, stale fingerprint, ...). | Prepare a fresh record (below). Any later staged change makes the fingerprints stale again, so prepare it last. |
 
 The staged gate does not judge evidence levels: the `evidence-floor` rule
@@ -98,6 +98,6 @@ does not prove it. Put the person's id there only when they reviewed it.
 npx --no-install kibi check --staged                    # the gate
 npx --no-install kibi check --staged --format json      # with full evidence
 npx --no-install kibi check-generated --staged          # manifest drift
-npx --no-install kibi sync --refresh-symbol-coordinates # refresh coordinates
+npx --no-install kibi sync --refresh-symbol-coordinates # rebuild local coordinates
 git status --short .kb                                  # what Kibi wrote
 ```

package/src/public/skills/kibi-decisions/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-decisions
 name: kibi-decisions
 description: "Use when the person states a rule or decision (must, never, always, from now on, we decided), when a Kibi hook asks to confirm or warns about an edit to code that implements a firm requirement, when the Stop hook says source files changed but nothing was recorded, when kb_check quotes requirement_statement_unverified, or when a request conflicts with a recorded requirement or ADR. Covers reading firmness and origin, recording a person's rule as firm with origin.ref, superseding with a Why this changed section, the kb_compile_intent unresolved/reviewCandidates/conflictReviews loop, asking before overriding a firm rule, and putting decisions to the person as one numbered kibi signoff --questions view."
-version: 1.3.0
+version: 1.4.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -80,7 +80,10 @@ name the missing capability. Never read or edit `.kb/` files directly.
   run `kibi prove`. Otherwise set `required_evidence: asserted`, say in the
   body that no end-to-end test proves the rule yet, and report it as
   asserted, not tested. Kibi's bootstrap and migration give an untested firm
-  rule the same floor.
+  rule the same floor. When the rule is a claim a certificate kind checks
+  (allowed values, transitions, a pattern, a rule over roles, a config,
+  route or schema read), a certificate test proves it instead: see
+  Certificate proof kinds in kibi-usage `resources/proof.md`.
 - **The person changes a rule:** supersede it (new requirement linked
   `supersedes` new -> old, `firmness: firm` when the old one was firm, a
   `## Why this changed` section of at least 12 words naming their instruction

package/src/public/skills/kibi-decisions/resources/decision-records.md

@@ -62,7 +62,10 @@ validation, not the write.
   the `evidence-floor` check while it is recorded. Drop it (the floor goes
   back to `tested`) once an end-to-end test with a proof contract and a
   passing `kibi prove` receipt covers the rule's scenario; never set it below
-  `asserted` on a firm rule.
+  `asserted` on a firm rule. A rule that a certificate kind checks (allowed
+  values, transitions, a pattern, a rule over roles, a config, route or
+  schema read) can instead be proved by a certificate test; see Certificate
+  proof kinds in kibi-usage `resources/proof.md`.
 - Your own choice is `default`; a guess is `exploratory`. Write the value
   explicitly whenever you record a decision.
 - For strict modeling (claim keys, predicate facts) follow `kibi-usage`,

package/src/public/skills/kibi-freshness/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-freshness
 name: kibi-freshness
 description: Check exact Git attachment, branch migration/quarantine, compiled-store freshness, source linkage, and repair state before decisions or writes.
-version: 2.2.0
+version: 2.3.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -68,7 +68,7 @@ For every freshness, branch, or completion question, call `kb_status` first, the
 - If entities look stale, refresh context through an approved Kibi capability and then re-query.
 - When asked whether a requirement is proven, quote its `evidenceLevel` and
   `evidenceFloor` from `kb_coverage`. `pending_reproof` (receipts older than
-  the code) is stale evidence, not proof; `kibi prove` refreshes it, and
+  the code, or than a file a `source` proof read) is stale evidence, not proof; `kibi prove` refreshes it, and
   `kibi check --fresh-evidence` is the check that fails on it.
 - Preserve source-file traceability by carrying `sourceFile`, text references, and validation evidence through discovery, mutation, and completion.
 - Do not read or edit files inside `.kb` directly; use the selected Kibi interface instead.

package/src/public/skills/kibi-traceability/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-traceability
 name: kibi-traceability
 description: Maintain source-first requirement, scenario, test, symbol, and proof traceability through Kibi's peer interfaces.
-version: 2.2.0
+version: 2.3.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -67,7 +67,8 @@ coverage and a green check are not proof by themselves.
 
 Report each requirement's `evidenceLevel` from `kb_coverage` as it is:
 `proved` only when certificate proofs (exhaustive, typecheck, arithmetic,
-smt) derive every applicable claim, named in each contract's `proves`
+smt, rule, state_machine, regex, source) bound at code or harness scope
+derive every applicable claim (intent-scope bindings stay `tested`), named in each contract's `proves`
 (`claimSummary` and `unprovedClaims` say which are missing), `tested` for fresh passing E2E receipts,
 `asserted` when only a person stands behind it, `unverified` otherwise. Its
 `evidenceFloor` says what `kb_check`'s `evidence-floor` rule requires:

package/src/public/skills/kibi-usage/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-usage
 name: Kibi Usage
 description: Use Kibi's source-first, exact-Git, migration-aware, proof-aware operations safely across MCP or the trusted local CLI, including partial completion repair.
-version: 2.27.0
+version: 2.32.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -436,8 +436,10 @@ For an existing product KB that needs semantic backfill, read
 `resources/kb-improvement.md`, and `resources/proof.md` for the proof workflow.
 Each current requirement has an evidence floor (`required_evidence`, else
 `tested` when firm); certificate proof kinds (exhaustive, typecheck,
-arithmetic, smt) reach `proved` for the claims their contract names in
-`proves`, and a requirement is proved only when every claim is. When the `evidence-floor` rule fails, follow Debugging
+arithmetic, smt, rule, state_machine, regex, source) reach `proved` for the claims their contract names in
+`proves`, and a requirement is proved only when every claim is. A rule
+predicate bound with `harness_for` (scope `harness`) also counts toward
+`proved`; an intent-scope binding stays `tested`. When the `evidence-floor` rule fails, follow Debugging
 proof regressions in `resources/proof.md` and use `kibi proof explain`.
 
 ## Predicate Ontology Decision Tree

package/src/public/skills/kibi-usage/resources/proof.md

@@ -178,8 +178,14 @@ left:
   goes unhandled (a switch ending in a `never` assignment, or a
   `satisfies Record<Domain, ...>` map). Set `witness.path` and
   `domain_source`; the witness must import the domain. Kibi compiles the
-  witness itself (strict, with the workspace's TypeScript), so `typescript`
-  must be installed in the workspace.
+  witness itself (strict, with the workspace's TypeScript and the import
+  resolution and declaration files of the nearest `tsconfig.json`), so
+  `typescript` must be
+  installed in the workspace (TypeScript 7 has no compiler API: add
+  `typescript@6` as a dev dependency). With `proves`, Kibi decides each
+  claim with its own witness and reports the fields or members that break
+  it. When the test's compile failed, the rejection adds the first error
+  Kibi's own compile of the witness reports.
 - `arithmetic`: a claim on one `int` or `real` variable decided exactly from
   typed facts. Set `constraint_source: { fact_ids: [FACT-...] }` to the
   numeric `property_value` facts (one subject and property); the
@@ -187,10 +193,93 @@ left:
   exactly their constraints. To read the value from the code instead, set
   `value_source: [{ symbol_id: SYM-<constant>, export: <name> }]`; Kibi
   evaluates the number export itself and adds `variable eq value` as an
-  assumption.
+  assumption. For a count claim over a collection ("exactly 32 tools") add
+  `measure: count` and name the list, set, map or object export; Kibi uses
+  its size, so do not add a number export just for the proof. A count
+  claim needs only `value_source`. Naming the claim's own fact in
+  `constraint_source` assumes the claim: without `value_source` Kibi counts
+  that derivation as intent only (tested), and with it a code value that
+  breaks the claim shows up as contradictory assumptions, which the
+  rejection names.
+  A claim that every member of a closed set has a property ("Every currency
+  in GBP, ILS and ZAR must fail closed") is a set fact whose `property_key`
+  names the property, whose `value_set` is the members and whose operator
+  is `includes` (other members may have the property too, so two such
+  claims over different sets do not contradict). Prove it with `rule`: Kibi
+  checks the property on each listed member. The kinds that compare the
+  whole set (`exhaustive`, `state_machine`) reject an `includes` fact.
 - `smt`: an SMT-LIB query that declares the facts' property as a constant,
   asserts each `constraint_source` fact constraint and then the claim's
   negation. Kibi re-runs z3 or cvc5 on it and accepts only `unsat`.
+- `rule`: decisions over finite domains. Set `predicate_source: {<predicate>:
+  { symbol_id }}` to the function behind each predicate the claim uses (it
+  takes the arguments in order and returns a boolean) and `domains: {<type>:
+  { symbol_id }}` to the export listing each argument type's values. Kibi
+  calls every function on every combination and model checks the claim's
+  fact: a `kibi.logic.v1` rule fact (from `kb_model_requirement` with
+  `logic`) must hold for every assignment, a predicate fact must be decided
+  as it says, and a set fact whose `property_key` names a predicate needs it
+  true for every member. A type name is also a one-argument predicate
+  (`role(R)`) to range a variable. A failure names the assignment. A domain
+  can come from the project instead of an export (`domains: {<type>:
+  {source: {...}}}`, see `source` below). When the predicate is a test
+  harness that drives real code (it calls the handler with each role), add
+  `harness_for: [SYM-...]` naming that code; the claim binds with scope
+  `harness`, which proves, and those symbols must be `covered_by` the test.
+  Add `export: <name>` to a `predicate_source` entry when the function's
+  export is not the symbol's title.
+- `state_machine`: set `domain_source` to the transition table (object or
+  Map from state to next states, or `[from, to]` pairs) or to a
+  `next(state, event)` function with `domains: {state, event}`;
+  `initial_source` names the initial state. Model "transitions must be one of
+  a -> b, ..." as a `transitions` set fact (members `a->b`), and terminal,
+  initial or reachable states as `terminal_states`, `initial_states` or
+  `reachable_states` set facts; Kibi checks that projection exactly.
+  Temporal claims use two more projections: "a cancelled invoice can never
+  become paid" is a `reachable_pairs` fact with `operator: excludes` and
+  member `cancelled->paid`, and "every path from draft to paid must pass
+  through approved" is a `required_waypoints` fact with member
+  `draft->paid via approved` (paid must be reachable from draft, and not
+  once approved is removed). Any projection also takes `includes`,
+  `subset_of` and `excludes`. Rules over a machine use `transition`,
+  `reachable`, `initial`, `terminal`, `state`.
+- `regex`: set `pattern_source` to a `RegExp`, a Python `re.compile(...)` or
+  a string constant. Model "X must match `re`" as a string fact with
+  `operator: matches` (a JavaScript pattern with the `u` flag, matched
+  whole); Kibi decides exact language equality and reports the shortest
+  string only one side accepts. Backreferences, lookaround, `\b`, the `g`,
+  `y`, `m` and `v` flags, Python `\d`/`\w` without `re.ASCII` and
+  non-ASCII letters under `i` are refused with the reason. An exact string
+  fact (`eq`/`neq`) checks a constant.
+- `source`: Kibi reads a project source itself and checks a set fact
+  against what it read, so the test only runs the proof (it may write
+  nothing, or `sourceCertificate({ testId })`). Set `source: {reader, ...}`:
+  `json`/`yaml` (`file`, `path`, `select`), `glob` (`pattern`, `capture`),
+  `openapi` (`file`, `select: operations|unsecured_operations|...`),
+  `references` (`files`, `extract: env|imports|calls|string_args|thrown|
+  property`), `schema` (`format: drizzle|prisma|sql`, `select:
+  tables|columns|required_columns|nullable_columns|foreign_keys`), `routes`
+  (Hono or Express app export, `path_prefix`, `names_from`, `select:
+  routes|middleware`) or `validator` (zod, valibot or pydantic, `select:
+  fields|required_fields|optional_fields`). A member Kibi cannot read
+  statically (a computed env name, a dynamic import, an env object handed
+  to a variable) fails the read with its location, and so does an empty
+  read (a glob matching no file, migrations with no `CREATE TABLE`), so a
+  read is never silently partial. Model the claim as a set fact: `eq`
+  (exactly), `includes` (at least), `subset_of` ("must be one of"),
+  `excludes` ("must never use"); `property_key: required_fields` or
+  `nullable_fields` (only `eq`/`includes`) with bare members `name` for
+  "every table" (it also covers tables added later) or `table.name` for
+  one; `middleware` with `includes` for "every route under /p must use M"
+  (Kibi checks each route). Name middleware with `names_from`: a
+  zero-argument factory export such as `requireAuth()` names the
+  middleware it returns `requireAuth`. Write the fact with `kb_model`
+  (requirement mode, `operator` plus a list `value`) or `kb_upsert`. The
+  receipt stales when a file the read touched changes, and the claim binds
+  with scope `source`. `value_source` accepts `{source, measure: count}`.
+  The builders need kibi-cli 2.33.0 or newer in the project. The env
+  extractor reads `process.env`, `import.meta.env`, `Bun.env`,
+  `Deno.env.get`, `os.environ` and `os.getenv`, through casts.
 
 `arithmetic` and `smt` from `constraint_source` alone prove that the
 knowledge base's facts entail the claim, not that code follows the facts:
@@ -202,8 +291,11 @@ Every certificate contract names the claims it proves in `proves:
 [CLAIM-...]` (blocking `proof-contract-claims` from schema 12). Kibi derives
 each claim's obligation from its grounding fact: a set fact (`value_type:
 set`, `value_set: [...]`) needs the `exhaustive` domain or the `typecheck`
-domain type to be exactly the set; a numeric fact needs the `arithmetic`
-claim or the negated `smt` assertion to be its constraint. The receipt
+domain type to be exactly the set (with `property_key: required_fields`,
+`typecheck` instead needs every member to be a required, non-nullable field
+of the domain type); a numeric fact needs the `arithmetic` claim or the
+negated `smt` assertion to be its constraint; rule, predicate, machine and
+string facts need the `rule`, `state_machine` or `regex` checks above. The receipt
 records one binding per claim: `derived` (checked, the only kind that
 proves), `attested` (the fact has no derivation; counts as tested) or
 `rejected` with the reason. Model an enumerated claim as a set fact and a
@@ -212,13 +304,16 @@ REQ-...` shows each claim with its bindings.
 
 Build the certificate with `kibi-cli/proof-certificates`
 (`exhaustiveCertificate`, `typecheckCertificate`, `arithmeticCertificate`,
-`smtCertificate`), fail the test when it records a failure
-(`failedMembers`), and call `writeCodeCertificate`; it writes to the
+`smtCertificate`, `ruleCertificate`, `stateMachineCertificate`,
+`regexCertificate`, `sourceCertificate`; `readProjectSource` returns Kibi's
+read for a test that wants to assert on it), fail the test when it records a failure
+(`failedMembers`, `failedCalls`), and call `writeCodeCertificate`; it writes to the
 directory `kibi prove` sets in `KIBI_PROOF_CERTIFICATES` and does nothing
 elsewhere. A Python test writes the same `kibi.code-certificate.v1` JSON
 to that directory itself. Wire the KB: the proof file symbol is
 `executable_for` the test and named in `required_proofs`; the domain symbol
-`implements` the requirement and is `covered_by` the test; the test
+(and every symbol a rule, machine or pattern contract names) `implements`
+the requirement and is `covered_by` the test; the test
 `validates` one of the requirement's scenarios. `proved` is per claim: a
 multi-claim requirement is proved only when certificates derive every
 applicable claim, and reads `tested` with `n/m claims proved` otherwise. A
@@ -296,7 +391,8 @@ re-run `kibi prove --stale` (or the affected selection), then confirm
 unit test count only while that unit test has a current passing receipt, so
 prove unit tests that cover type-shape symbols too.
 
-Full reference: `docs/proving-requirements.md`.
+Full reference: [Proving requirements](https://looted.github.io/kibi/reference/proving.html)
+(`docs/proving-requirements.md` in the Kibi repository).
 
 ## Debugging proof regressions