kibi-cli 2.32.0 → 2.36.0

package/src/schemas/entity.schema.json

@@ -785,13 +785,40 @@
             "exhaustive",
             "typecheck",
             "arithmetic",
-            "smt"
+            "smt",
+            "rule",
+            "state_machine",
+            "regex",
+            "source"
           ],
-          "description": "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic and smt must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved."
+          "description": "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic, smt, rule, state_machine and regex must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved. source reads the contract's source itself: the run may leave {version, kind: source, test_id, source} or nothing, and Kibi stores its own read as the certificate."
+        },
+        "source": {
+          "type": "object",
+          "description": "source: the project source a source proof reads. A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.",
+          "required": [
+            "reader"
+          ],
+          "properties": {
+            "reader": {
+              "type": "string",
+              "enum": [
+                "json",
+                "yaml",
+                "glob",
+                "openapi",
+                "references",
+                "schema",
+                "routes",
+                "validator"
+              ]
+            }
+          },
+          "additionalProperties": true
         },
         "domain_source": {
           "type": "object",
-          "description": "exhaustive and typecheck: the symbol that defines the finite domain. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.",
+          "description": "exhaustive and typecheck: the symbol that defines the finite domain (typecheck: also the type whose fields a required_fields fact names). state_machine: the transition table or next-state function. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.",
           "required": [
             "symbol_id"
           ],
@@ -824,7 +851,7 @@
         },
         "proves": {
           "type": "array",
-          "description": "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt); a claim with no such derivation is only attested and never counts as proved.",
+          "description": "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt, a rule, predicate or set fact for rule and state_machine, a string fact for regex); a claim with no such derivation is only attested and never counts as proved.",
           "minItems": 1,
           "items": {
             "type": "string",
@@ -834,9 +861,59 @@
         },
         "value_source": {
           "type": "array",
-          "description": "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base.",
+          "description": "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base. With measure count the value is the size of a list, set, map or object export, so a count claim reads the collection itself. An entry {source, measure: count} counts the members Kibi reads from a project source (routes, tables, environment variables).",
           "minItems": 1,
           "items": {
+            "type": "object",
+            "properties": {
+              "symbol_id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "export": {
+                "type": "string",
+                "minLength": 1
+              },
+              "source": {
+                "type": "object",
+                "description": "A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.",
+                "required": [
+                  "reader"
+                ],
+                "properties": {
+                  "reader": {
+                    "type": "string",
+                    "enum": [
+                      "json",
+                      "yaml",
+                      "glob",
+                      "openapi",
+                      "references",
+                      "schema",
+                      "routes",
+                      "validator"
+                    ]
+                  }
+                },
+                "additionalProperties": true
+              },
+              "measure": {
+                "type": "string",
+                "enum": [
+                  "value",
+                  "count"
+                ],
+                "description": "value (default for an export): the export is a number. count (the only measure of a source): the number of members of a list, set, map or object export, or of a source."
+              }
+            },
+            "additionalProperties": false
+          }
+        },
+        "predicate_source": {
+          "type": "object",
+          "description": "rule: the code function behind each predicate a claim's rule, predicate or set fact names, keyed by predicate name. Each export takes the predicate's arguments in order and returns a boolean; Kibi calls it on every combination of its argument domains.",
+          "minProperties": 1,
+          "additionalProperties": {
             "type": "object",
             "required": [
               "symbol_id"
@@ -848,12 +925,116 @@
               },
               "export": {
                 "type": "string",
-                "minLength": 1
+                "minLength": 1,
+                "description": "The exported function's name in the symbol's source file. Without it Kibi reads the export named by the symbol's title."
+              },
+              "harness_for": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "description": "The predicate is a test harness that decides the predicate by driving these code symbols (for example by calling the handler with each role). The symbols must be covered_by the test; a claim the harness proves is bound with scope harness."
               }
             },
             "additionalProperties": false
           }
         },
+        "domains": {
+          "type": "object",
+          "description": "rule: the finite domain of each argument type, keyed by type name (an array, Set, Map or object export, or a Python list, set, dict or Enum), or {source} for the members Kibi reads from a project source (every route, every table, every environment variable). state_machine with a next-state function: the `state` and `event` domains it is called on.",
+          "minProperties": 1,
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "object",
+                "required": [
+                  "symbol_id"
+                ],
+                "properties": {
+                  "symbol_id": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "export": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "required": [
+                  "source"
+                ],
+                "properties": {
+                  "source": {
+                    "type": "object",
+                    "description": "A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.",
+                    "required": [
+                      "reader"
+                    ],
+                    "properties": {
+                      "reader": {
+                        "type": "string",
+                        "enum": [
+                          "json",
+                          "yaml",
+                          "glob",
+                          "openapi",
+                          "references",
+                          "schema",
+                          "routes",
+                          "validator"
+                        ]
+                      }
+                    },
+                    "additionalProperties": true
+                  }
+                },
+                "additionalProperties": false
+              }
+            ]
+          }
+        },
+        "initial_source": {
+          "type": "object",
+          "required": [
+            "symbol_id"
+          ],
+          "properties": {
+            "symbol_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "export": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false,
+          "description": "state_machine: the export holding the initial state (or states), needed for initial_states and reachable_states facts."
+        },
+        "pattern_source": {
+          "type": "object",
+          "required": [
+            "symbol_id"
+          ],
+          "properties": {
+            "symbol_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "export": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false,
+          "description": "regex: the export holding the code's pattern (a RegExp, or a Python re.Pattern) or string constant that a string fact is about."
+        },
         "constraint_source": {
           "type": "object",
           "description": "arithmetic and smt: the typed numeric property_value facts the certificate's assumptions come from. Kibi checks the assumptions (or the query's assertions) are exactly these facts' constraints, so the proof is about the knowledge base, not numbers the test chose.",
@@ -1199,7 +1380,11 @@
               "exhaustive",
               "typecheck",
               "arithmetic",
-              "smt"
+              "smt",
+              "rule",
+              "state_machine",
+              "regex",
+              "source"
             ]
           },
           "evidence_level": {
@@ -1254,6 +1439,8 @@
                   "type": "string",
                   "enum": [
                     "code",
+                    "source",
+                    "harness",
                     "intent"
                   ]
                 },
@@ -1338,7 +1525,11 @@
         "lt",
         "lte",
         "gt",
-        "gte"
+        "gte",
+        "matches",
+        "includes",
+        "subset_of",
+        "excludes"
       ]
     },
     "value_type": {

package/dist/traceability/reviewed-coordinate-refresh.d.ts

@@ -1,10 +0,0 @@
-import type { HostSourceAnalysisResultV2, SourceAnalysisService } from "../plugins/source-analysis-service.js";
-import type { GitChangeSnapshot } from "./git-change-snapshot.js";
-import type { Fingerprint } from "./impact-review.js";
-/** Authorize lexical coordinate migration only from a captured local staged review.
- * Protected PR hosts must use their target-base evaluator, not this HEAD policy. */
-export declare function createReviewedDecoratorCoordinateVerifier(snapshot: GitChangeSnapshot, service: SourceAnalysisService, bindings: {
-    providerSetFingerprint: Fingerprint;
-    evaluatorFingerprint: Fingerprint;
-}): (path: string, analysis: HostSourceAnalysisResultV2) => Promise<void>;
-//# sourceMappingURL=reviewed-coordinate-refresh.d.ts.map

package/dist/traceability/reviewed-coordinate-refresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reviewed-coordinate-refresh.d.ts","sourceRoot":"","sources":["../../src/traceability/reviewed-coordinate-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;oFACoF;AACpF,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE;IACR,sBAAsB,EAAE,WAAW,CAAC;IACpC,oBAAoB,EAAE,WAAW,CAAC;CACnC,GACA,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CA4DvE"}

package/dist/traceability/reviewed-coordinate-refresh.js

@@ -1,49 +0,0 @@
-import { analyzeSourceChanges } from "../plugins/source-change-analysis.js";
-import { evaluateImpactReview, loadBaseImpactPolicy, } from "./impact-evaluator.js";
-/** Authorize lexical coordinate migration only from a captured local staged review.
- * Protected PR hosts must use their target-base evaluator, not this HEAD policy. */
-export function createReviewedDecoratorCoordinateVerifier(snapshot, service, bindings) {
-    if (process.env.CI)
-        throw new Error("Reviewed partial coordinate migration is unavailable in CI without a protected target-base snapshot");
-    const policy = loadBaseImpactPolicy(snapshot);
-    let reviewValidation;
-    return async (path, analysis) => {
-        snapshot.assertUnchanged();
-        if (analysis.status !== "partial" ||
-            analysis.language !== "python" ||
-            analysis.sourceFile !== path ||
-            analysis.module.analysisMode !== "parser" ||
-            analysis.stamp?.pluginId !== "kibi-plugin-treesitter" ||
-            analysis.uncoveredRanges.length === 0 ||
-            analysis.providerId !== "kibi-plugin-treesitter.tree-sitter.v2" ||
-            analysis.diagnostics.length === 0 ||
-            analysis.providerFingerprint === null ||
-            !analysis.diagnostics.every((diagnostic) => diagnostic.code === "TREESITTER_DECORATOR_EXPANSION_UNAVAILABLE" &&
-                policy.allowedPartial.some((allowed) => allowed.providerId === analysis.providerId &&
-                    allowed.providerFingerprint ===
-                        `sha256:${analysis.providerFingerprint}` &&
-                    allowed.diagnosticCode === diagnostic.code &&
-                    allowed.limitationClass === "python-decorator-expansion")))
-            throw new Error(`Decorator coordinates for ${path} are not allowed by the captured base policy`);
-        reviewValidation ??= (async () => {
-            const analyses = await analyzeSourceChanges(snapshot.inventory, service);
-            // Use the same host normalization as staged check, without changing the
-            // original captured inventory used by the generated-byte comparison.
-            const evaluatedSnapshot = {
-                ...snapshot,
-                inventory: snapshot.inventory.map((file) => analyses.get(file.path)?.after?.status === "ok"
-                    ? { ...file, analysisDepth: "symbol", disposition: "checked" }
-                    : { ...file }),
-            };
-            const result = evaluateImpactReview(evaluatedSnapshot, {
-                ...bindings,
-                analyses,
-            });
-            if (!result.passed)
-                throw new Error(`Reviewed coordinate migration failed: ${result.diagnostics.map((diagnostic) => diagnostic.message).join("; ")}`);
-            snapshot.assertUnchanged();
-        })();
-        await reviewValidation;
-        snapshot.assertUnchanged();
-    };
-}