kibi-cli 2.39.0 → 2.40.0

package/src/public/proof-protocol.ts

@@ -279,21 +279,29 @@ export const PROOF_RUN_ARTIFACT_SCHEMA = {
   additionalProperties: false,
 } as const;
 
+const ARG_SCHEMA = {
+  type: "integer",
+  minimum: 1,
+  description:
+    "A SWI-Prolog predicate's argument (1-based) whose solutions Kibi reads, when the predicate takes more than one argument (operator/2 with arg 1 lists each operator's name).",
+} as const;
+
 const SOURCE_REFERENCE_SCHEMA = {
   type: "object",
   required: ["symbol_id"],
   properties: {
     symbol_id: { type: "string", minLength: 1 },
     export: { type: "string", minLength: 1 },
+    arg: ARG_SCHEMA,
   },
   additionalProperties: false,
 } as const;
 
-// implements REQ-kibi-source-proof-kinds
+// implements REQ-kibi-source-proof-kinds, REQ-kibi-prolog-source-readers
 const SOURCE_SPEC_SCHEMA = {
   type: "object",
   description:
-    "A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.",
+    "A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?} over TypeScript, JavaScript, Python and SWI-Prolog files. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. prolog: {file, functor: Name/Arity, arg?} reads one argument of every fact with that functor in a SWI-Prolog file (requires/1 in pack.pl), without running it. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.",
   required: ["reader"],
   properties: {
     reader: { type: "string", enum: [...SOURCE_READERS] },
@@ -382,6 +390,7 @@ export const PROOF_CONTRACT_SCHEMA = {
           description:
             "exhaustive: when the export is a list of records, the field of each record that names a domain member (a catalog's name).",
         },
+        arg: ARG_SCHEMA,
       },
       additionalProperties: false,
     },
@@ -411,6 +420,7 @@ export const PROOF_CONTRACT_SCHEMA = {
         properties: {
           symbol_id: { type: "string", minLength: 1 },
           export: { type: "string", minLength: 1 },
+          arg: ARG_SCHEMA,
           source: SOURCE_SPEC_SCHEMA,
           measure: {
             type: "string",
@@ -819,17 +829,30 @@ function proofContractKindErrors(contract: Record<string, unknown>): string[] {
       !nonEmptyString(row.symbol_id) ||
       (row.export !== undefined && !nonEmptyString(row.export)) ||
       (row.field !== undefined && !nonEmptyString(row.field)) ||
+      (row.arg !== undefined && !isArgIndex(row.arg)) ||
       Object.keys(row).some(
-        (key) => key !== "symbol_id" && key !== "export" && key !== "field",
+        (key) =>
+          key !== "symbol_id" &&
+          key !== "export" &&
+          key !== "field" &&
+          key !== "arg",
       )
     )
       errors.push(
-        "proof_contract.domain_source must be {symbol_id, export?, field?} naming the symbol that defines the domain, the export to read when its title is not the export name, and the record field that names each member",
+        "proof_contract.domain_source must be {symbol_id, export?, field?, arg?} naming the symbol that defines the domain, the export to read when its title is not the export name, the record field that names each member, and for a SWI-Prolog predicate the argument (1-based) that names it",
+      );
+    else if (row.field !== undefined && row.arg !== undefined)
+      errors.push(
+        "proof_contract.domain_source takes field (a record field) or arg (a Prolog argument), not both",
       );
     else if (row.field !== undefined && kind !== "exhaustive")
       errors.push(
         `proof_contract.domain_source.field applies only to kind exhaustive, not ${String(kind ?? "e2e")}`,
       );
+    else if (row.arg !== undefined && kind !== "exhaustive")
+      errors.push(
+        `proof_contract.domain_source.arg applies only to kind exhaustive, not ${String(kind ?? "e2e")}`,
+      );
   } else if (kind === "exhaustive" || kind === "typecheck")
     errors.push(
       `proof_contract.domain_source is required for kind ${String(kind)}: name the symbol the proof reads its domain from`,
@@ -878,9 +901,13 @@ function proofContractKindErrors(contract: Record<string, unknown>): string[] {
             `proof_contract.value_source[${index}].source`,
           ),
         );
-        if (row.symbol_id !== undefined || row.export !== undefined)
+        if (
+          row.symbol_id !== undefined ||
+          row.export !== undefined ||
+          row.arg !== undefined
+        )
           errors.push(
-            `proof_contract.value_source[${index}] names a source, so it takes no symbol_id or export`,
+            `proof_contract.value_source[${index}] names a source, so it takes no symbol_id, export or arg`,
           );
         if (row.measure !== undefined && row.measure !== "count")
           errors.push(
@@ -897,18 +924,22 @@ function proofContractKindErrors(contract: Record<string, unknown>): string[] {
           row !== null &&
           nonEmptyString(row.symbol_id) &&
           (row.export === undefined || nonEmptyString(row.export)) &&
+          (row.arg === undefined || isArgIndex(row.arg)) &&
           (row.measure === undefined ||
             row.measure === "value" ||
             row.measure === "count") &&
           Object.keys(row).every(
             (key) =>
-              key === "symbol_id" || key === "export" || key === "measure",
+              key === "symbol_id" ||
+              key === "export" ||
+              key === "arg" ||
+              key === "measure",
           )
         );
       })
     )
       errors.push(
-        "proof_contract.value_source must be [{symbol_id, export?, measure?: value|count} or {source, measure?: count}] naming the code constants or project sources the assumptions read",
+        "proof_contract.value_source must be [{symbol_id, export?, arg?, measure?: value|count} or {source, measure?: count}] naming the code constants or project sources the assumptions read",
       );
     else if (kind !== "arithmetic" && kind !== "smt")
       errors.push(
@@ -938,13 +969,23 @@ function proofContractKindErrors(contract: Record<string, unknown>): string[] {
   return errors;
 }
 
-function isSourceReference(value: unknown): boolean {
+function isArgIndex(value: unknown): boolean {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1;
+}
+
+function isSourceReference(
+  value: unknown,
+  options: Readonly<{ arg?: boolean }> = { arg: true },
+): boolean {
   const row = record(value);
   return (
     row !== null &&
     nonEmptyString(row.symbol_id) &&
     (row.export === undefined || nonEmptyString(row.export)) &&
-    Object.keys(row).every((key) => key === "symbol_id" || key === "export")
+    (row.arg === undefined || (options.arg === true && isArgIndex(row.arg))) &&
+    Object.keys(row).every(
+      (key) => key === "symbol_id" || key === "export" || key === "arg",
+    )
   );
 }
 
@@ -964,11 +1005,12 @@ function isSourceMap(
 
 function isPredicateReference(value: unknown): boolean {
   const row = record(value);
+  // A predicate is called with every argument, so it projects none.
   if (row === null || row.harness_for === undefined)
-    return isSourceReference(value);
+    return isSourceReference(value, { arg: false });
   const { harness_for: harness, ...reference } = row;
   return (
-    isSourceReference(reference) &&
+    isSourceReference(reference, { arg: false }) &&
     Array.isArray(harness) &&
     harness.length > 0 &&
     harness.every(nonEmptyString)
@@ -998,7 +1040,7 @@ function sourceContractErrors(contract: Record<string, unknown>): string[] {
       );
   } else if (kind === "source")
     errors.push(
-      "proof_contract.source is required for kind source: name the project source Kibi reads (reader json, yaml, glob, openapi, references, schema, routes or validator)",
+      "proof_contract.source is required for kind source: name the project source Kibi reads (reader json, yaml, glob, openapi, references, schema, routes, validator or prolog)",
     );
   const domains = record(contract.domains);
   for (const [type, entry] of Object.entries(domains ?? {}))
@@ -1046,12 +1088,12 @@ function nonNumericContractErrors(contract: Record<string, unknown>): string[] {
     )
   )
     errors.push(
-      "proof_contract.domains must map each argument type to {symbol_id, export?} naming the export that lists its values, or {source} naming the project source Kibi reads them from",
+      "proof_contract.domains must map each argument type to {symbol_id, export?, arg?} naming the export (or SWI-Prolog predicate and argument) that lists its values, or {source} naming the project source Kibi reads them from",
     );
   for (const field of ["initial_source", "pattern_source"])
     if (contract[field] !== undefined && !isSourceReference(contract[field]))
       errors.push(
-        `proof_contract.${field} must be {symbol_id, export?} naming the export Kibi reads`,
+        `proof_contract.${field} must be {symbol_id, export?, arg?} naming the export (or SWI-Prolog predicate and argument) Kibi reads`,
       );
   only("predicate_source", ["rule"]);
   only("domains", ["rule", "state_machine"]);
@@ -1113,7 +1155,12 @@ export function optionalProofContractFields(
 > {
   const fields: {
     kind?: ProofKind;
-    domain_source?: { symbol_id: string; export?: string; field?: string };
+    domain_source?: {
+      symbol_id: string;
+      export?: string;
+      field?: string;
+      arg?: number;
+    };
     witness?: { path: string };
     constraint_source?: { fact_ids: string[] };
     value_source?: ValueSourceEntry[];
@@ -1132,6 +1179,7 @@ export function optionalProofContractFields(
       symbol_id: domain.symbol_id,
       ...(typeof domain.export === "string" ? { export: domain.export } : {}),
       ...(typeof domain.field === "string" ? { field: domain.field } : {}),
+      ...(isArgIndex(domain.arg) ? { arg: domain.arg as number } : {}),
     };
   const witness = record(contract.witness);
   if (witness && typeof witness.path === "string")
@@ -1154,6 +1202,7 @@ export function optionalProofContractFields(
         return {
           symbol_id: row.symbol_id,
           ...(typeof row.export === "string" ? { export: row.export } : {}),
+          ...(isArgIndex(row.arg) ? { arg: row.arg as number } : {}),
           ...(row.measure === "value" || row.measure === "count"
             ? { measure: row.measure }
             : {}),
@@ -1177,10 +1226,19 @@ export function optionalProofContractFields(
   return fields;
 }
 
-type SourceReference = { symbol_id: string; export?: string };
-type PredicateReference = SourceReference & { harness_for?: string[] };
+type SourceReference = { symbol_id: string; export?: string; arg?: number };
+type PredicateReference = {
+  symbol_id: string;
+  export?: string;
+  harness_for?: string[];
+};
 type ValueSourceEntry =
-  | { symbol_id: string; export?: string; measure?: "value" | "count" }
+  | {
+      symbol_id: string;
+      export?: string;
+      arg?: number;
+      measure?: "value" | "count";
+    }
   | { source: SourceSpec; measure: "count" };
 
 function predicateMap(
@@ -1229,6 +1287,7 @@ function sourceReference(value: unknown): SourceReference | undefined {
   return {
     symbol_id: row.symbol_id,
     ...(typeof row.export === "string" ? { export: row.export } : {}),
+    ...(isArgIndex(row.arg) ? { arg: row.arg as number } : {}),
   };
 }
 

package/src/public/proof-sources.ts

@@ -22,8 +22,9 @@
  * JSON or YAML file, the files a glob matches, an OpenAPI document, the
  * references the code makes (environment variables, imports, calls, string
  * arguments, thrown error codes, property values), a data schema (drizzle,
- * Prisma or SQL migrations), a web app's route table (Hono, Express) and a
- * validator object (zod and anything with safeParse).
+ * Prisma or SQL migrations), a web app's route table (Hono, Express), a
+ * validator object (zod and anything with safeParse) and the facts of a
+ * SWI-Prolog file (a pack's requires/1).
  *
  * Every reader is exact or refuses: a member Kibi cannot read statically (a
  * computed environment variable name, a dynamic import, an ALTER TABLE form
@@ -47,6 +48,7 @@ export const SOURCE_READERS = [
   "schema",
   "routes",
   "validator",
+  "prolog",
 ] as const;
 
 export type SourceReader = (typeof SOURCE_READERS)[number];
@@ -148,6 +150,7 @@ const KEYS: Readonly<Record<SourceReader, readonly string[]>> = {
     "select",
   ],
   validator: ["reader", "file", "export", "select"],
+  prolog: ["reader", "file", "functor", "arg"],
 };
 
 function record(value: unknown): Record<string, unknown> | null {
@@ -322,6 +325,23 @@ export function sourceSpecErrors(value: unknown, label: string): string[] {
           `${label}.export is required for reader validator: name the object schema`,
         );
       break;
+    case "prolog":
+      file("file", true);
+      if (
+        typeof row.functor !== "string" ||
+        !/^[a-z][A-Za-z0-9_]*\/(?:0|[1-9][0-9]*)$/.test(row.functor)
+      )
+        errors.push(
+          `${label}.functor is required for reader prolog: name the facts read as Name/Arity (requires/1)`,
+        );
+      if (
+        row.arg !== undefined &&
+        !(Number.isInteger(row.arg) && (row.arg as number) >= 1)
+      )
+        errors.push(
+          `${label}.arg must be the 1-based argument of each fact that holds the member`,
+        );
+      break;
   }
   return errors;
 }
@@ -352,15 +372,28 @@ export function matchWorkspaceFiles(
   workspaceRoot: string,
   patterns: readonly string[],
   ignore: readonly string[] = [],
+  caseSensitive = true,
 ): string[] {
+  // A symbolic link to a file is read as that file (git and compilers read
+  // it so); links to folders are not walked.
   return fg
     .sync([...patterns], {
       cwd: workspaceRoot,
       ignore: [...DEFAULT_IGNORE, ...ignore],
+      caseSensitiveMatch: caseSensitive,
       dot: true,
-      onlyFiles: true,
+      onlyFiles: false,
+      markDirectories: true,
       followSymbolicLinks: false,
     })
+    .filter((file) => {
+      if (file.endsWith("/")) return false;
+      try {
+        return statSync(path.join(workspaceRoot, file)).isFile();
+      } catch {
+        return false;
+      }
+    })
     .map((file) => file.split(path.sep).join("/"))
     .sort();
 }
@@ -451,6 +484,9 @@ export function sourceDependencies(
       addFile(String(spec.file));
       for (const file of globList(spec.names_from)) addFile(file);
       break;
+    case "prolog":
+      addFile(String(spec.file));
+      break;
   }
   if (
     spec.reader === "routes" ||
@@ -1617,6 +1653,14 @@ export async function readSource(
       ok: true,
       model: { members: sortedUnique(evaluated.members ?? []) },
     };
+  if (spec.reader === "prolog")
+    return {
+      ok: true,
+      model: {
+        members: sortedUnique(evaluated.members ?? []),
+        sequence: evaluated.sequence ?? [],
+      },
+    };
   if (spec.reader === "routes") {
     const routes = selectedRoutes(spec, evaluated.routes ?? []).sort((a, b) =>
       `${a.path} ${a.method}` < `${b.path} ${b.method}` ? -1 : 1,
@@ -1644,6 +1688,8 @@ export type SourceCodeEvaluation =
   | {
       ok: true;
       members?: string[];
+      /** The prolog reader's members in file order, duplicates kept. */
+      sequence?: string[];
       entities?: SourceEntity[];
       routes?: SourceRoute[];
     }
@@ -1671,6 +1717,8 @@ export function describeSource(spec: SourceSpec): string {
       return `routes of ${spec.export} in ${spec.file}${spec.path_prefix ? ` under ${spec.path_prefix}` : ""}`;
     case "validator":
       return `validator ${spec.export} in ${spec.file}`;
+    case "prolog":
+      return `${spec.functor} facts in ${spec.file}${spec.arg ? ` (argument ${spec.arg})` : ""}`;
   }
 }
 

package/src/public/skills/kibi-usage/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-usage
 name: Kibi Usage
 description: Use Kibi's source-first, exact-Git, migration-aware, proof-aware operations safely across MCP or the trusted local CLI, including partial completion repair.
-version: 2.37.0
+version: 2.40.1
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -20,6 +20,7 @@ resources:
   - resources/fact-lanes.md
   - resources/workflows.md
   - resources/proof.md
+  - resources/prolog-proofs.md
   - resources/ui-requirements.md
   - resources/logic-ir.md
   - resources/kb-improvement.md
@@ -94,8 +95,10 @@ it is a pointer to the knowledge, never proof. Each line answers one question:
   requirement first. Read the lead requirement with `kb_query({id})` before
   changing behavior; add `includeBody: true` to see its authored prose, and
   fix a stale sentence there with `kb_upsert` `document.body`.
-- `REQ-… must keep true: FACT-…` (edit only): the ground facts the lead
-  requirement requires. An edit that breaks one of them is a requirement
+- `REQ-… must keep true: <claim>` (edit only): what the lead requirement
+  requires, as the claims its facts model (with the operator and members,
+  such as "The greet function must not call console.log") or, without
+  them, its own statement. An edit that breaks one of them is a requirement
   change: ask before changing the rule (see Decision firmness), and never
   code around the fact.
 - `Decision: ADR-…` (edit only): the decision behind the lead requirement.

package/src/public/skills/kibi-usage/resources/prolog-proofs.md

@@ -0,0 +1,207 @@
+# SWI-Prolog Code Proofs
+
+Kibi reads code models from SWI-Prolog files (`.pl`, `.plt`) with the
+SWI-Prolog it runs on (KIBI_SWIPL, the bundled runtime, then `swipl` on
+PATH). It loads the file a symbol names (a module, or a plain file into
+`user`) and reads a predicate named by its indicator, the symbol's title
+(`operator/2`, `lists:append/3`, `greeting//1`) or `export`.
+
+- A domain (`exhaustive`, `domains`, `value_source` with `measure: count`)
+  is the distinct solutions of one argument. A one-argument predicate needs
+  nothing more; for more arguments set `arg` (1-based) to the one that names
+  each member: `domain_source: {symbol_id: SYM-operator, arg: 1}` lists every
+  `Name` of `operator(Name, Description)`. A solution that leaves that
+  argument unbound refuses the read.
+- A value (`value_source`) is the single number a constant holds:
+  `hard_limit_seconds(10).` Zero or several solutions refuse the read.
+- A `rule` predicate is called once per row of its argument domains; success
+  is true, failure false, an exception an error row (which rejects).
+- A `state_machine` transition table is a `Name/2` (from, to) or `Name/3`
+  (from, event, to) fact table: every solution is an edge. With `domains:
+  {state, event}` a `Name/3` next-state predicate is called on every state
+  and event. `initial_source` names an `initial/1`-style fact.
+- A `regex` reads an atom or string constant as a `type: string` pattern;
+  Kibi decides string facts on it. Patterns for `library(pcre)` are not read.
+
+Loading a module runs its directives, the same trust a JavaScript import
+gives. The proof file must name the predicate and load its file
+(`use_module`, `ensure_loaded`, `consult`, a `:- [..]` load list, or
+`library(X)` for a pack's `prolog/X.pl`), or be the plunit `.plt` file
+beside it; otherwise Kibi treats the domain as hand-listed. `arg` on a
+TypeScript, JavaScript or Python export is refused, and so is `field` on a
+Prolog predicate.
+
+## Writing the certificate
+
+A Prolog test writes the `kibi.code-certificate.v1` JSON into the directory
+`kibi prove` sets in `KIBI_PROOF_CERTIFICATES`. Copy this module into the
+project's test directory (for example `test/kibi_certificate.pl`) and call it
+from the proof. Read members from the code with `findall/3` over the domain
+predicate; never list them by hand.
+
+```prolog
+:- module(kibi_certificate,
+          [ kibi_exhaustive_certificate/5,  % +TestId, +SymbolId, +Members, :Check, -Certificate
+            kibi_rule_certificate/4,        % +TestId, +Domains, +Predicates, -Certificate
+            kibi_machine_certificate/5,     % +TestId, +SymbolId, +Edges, +Initial, -Certificate
+            kibi_pattern_certificate/4,     % +TestId, +SymbolId, +Text, -Certificate
+            kibi_write_certificate/1        % +Certificate
+          ]).
+:- use_module(library(http/json)).
+:- use_module(library(apply)).
+:- use_module(library(lists)).
+
+:- meta_predicate
+    kibi_exhaustive_certificate(+, +, +, 1, -).
+
+% Members as Kibi reads them: atoms and strings as text, numbers as written,
+% other terms quoted.
+kibi_text(Value, Text) :- string(Value), !, Text = Value.
+kibi_text(Value, Text) :- atom(Value), !, atom_string(Value, Text).
+kibi_text(Value, Text) :- number(Value), !, number_string(Value, Text).
+kibi_text(Value, Text) :- format(string(Text), "~q", [Value]).
+
+%!  kibi_exhaustive_certificate(+TestId, +SymbolId, +Members, :Check, -Certificate)
+%
+%   Run Check on every member of the domain and record each outcome. Read
+%   Members from the code (findall over the domain predicate), never list
+%   them by hand: Kibi re-reads the predicate and rejects a different set.
+kibi_exhaustive_certificate(TestId, SymbolId, Members, Check, Certificate) :-
+    maplist(kibi_text, Members, Texts),
+    maplist(exhaustive_result(Check), Members, Texts, Results),
+    Certificate = _{version: "kibi.code-certificate.v1", kind: "exhaustive",
+                    test_id: TestId,
+                    domain: _{symbol_id: SymbolId, members: Texts},
+                    results: Results}.
+
+exhaustive_result(Check, Member, Text, Result) :-
+    catch(( call(Check, Member)
+          -> Result = _{member: Text, outcome: "passed"}
+          ;  Result = _{member: Text, outcome: "failed", message: "the check failed"}
+          ),
+          Error,
+          ( message_to_text(Error, Message),
+            Result = _{member: Text, outcome: "failed", message: Message} )).
+
+%!  kibi_rule_certificate(+TestId, +Domains, +Predicates, -Certificate)
+%
+%   Domains is a list of domain(Type, SymbolId, Members); Predicates a list
+%   of predicate(Name, SymbolId, ArgTypes, Goal), where Goal is called with
+%   one argument per type appended and decides the row by success or
+%   failure.
+kibi_rule_certificate(TestId, Domains, Predicates, Certificate) :-
+    findall(Type-_{symbol_id: SymbolId, members: Texts},
+            ( member(domain(Type, SymbolId, Members), Domains), maplist(kibi_text, Members, Texts) ),
+            DomainPairs),
+    dict_pairs(DomainDict, _, DomainPairs),
+    findall(Name-_{symbol_id: SymbolId, arg_types: ArgTypes, rows: Rows},
+            ( member(predicate(Name, SymbolId, ArgTypes, Goal), Predicates),
+              maplist(domain_members(Domains), ArgTypes, Lists),
+              findall(Row, (maplist(member, Tuple, Lists), rule_row(Goal, Tuple, Row)), Rows)
+            ),
+            PredicatePairs),
+    dict_pairs(PredicateDict, _, PredicatePairs),
+    Certificate = _{version: "kibi.code-certificate.v1", kind: "rule",
+                    test_id: TestId, domains: DomainDict, predicates: PredicateDict}.
+
+domain_members(Domains, Type, Members) :-
+    memberchk(domain(Type, _, Members), Domains).
+
+rule_row(Goal, Tuple, Row) :-
+    maplist(kibi_text, Tuple, Args),
+    Call =.. [call, Goal|Tuple],
+    catch(( once(Call) -> Row = _{args: Args, value: true} ; Row = _{args: Args, value: false} ),
+          Error,
+          ( message_to_text(Error, Message), Row = _{args: Args, error: Message} )).
+
+%!  kibi_machine_certificate(+TestId, +SymbolId, +Edges, +Initial, -Certificate)
+%
+%   Edges is the list of From-To pairs of the transition table (findall over
+%   it); Initial is the list of initial states, or [] when the contract names
+%   no initial_source.
+kibi_machine_certificate(TestId, SymbolId, Edges, Initial, Certificate) :-
+    findall([F, T], (member(From-To, Edges), kibi_text(From, F), kibi_text(To, T)), Pairs0),
+    sort(Pairs0, Pairs),
+    findall(S, (member([A, B], Pairs), member(S, [A, B])), Ends),
+    sort(Ends, States),
+    Machine0 = _{symbol_id: SymbolId, states: States, transitions: Pairs},
+    (   Initial == []
+    ->  Machine = Machine0
+    ;   maplist(kibi_text, Initial, InitialTexts0),
+        sort(InitialTexts0, InitialTexts),
+        Machine = Machine0.put(initial, InitialTexts)
+    ),
+    Certificate = _{version: "kibi.code-certificate.v1", kind: "state_machine",
+                    test_id: TestId, machine: Machine}.
+
+%!  kibi_pattern_certificate(+TestId, +SymbolId, +Text, -Certificate)
+%
+%   The string or atom constant a string claim is about.
+kibi_pattern_certificate(TestId, SymbolId, Value, Certificate) :-
+    kibi_text(Value, Text),
+    Certificate = _{version: "kibi.code-certificate.v1", kind: "regex", test_id: TestId,
+                    pattern: _{symbol_id: SymbolId, type: "string", value: Text}}.
+
+%!  kibi_write_certificate(+Certificate)
+%
+%   Leave the certificate where kibi prove reads it (the directory in
+%   KIBI_PROOF_CERTIFICATES). Does nothing outside a kibi prove run.
+kibi_write_certificate(Certificate) :-
+    (   getenv('KIBI_PROOF_CERTIFICATES', Directory), Directory \== ''
+    ->  make_directory_path(Directory),
+        format(atom(Name), "~w.json", [Certificate.test_id]),
+        directory_file_path(Directory, Name, File),
+        setup_call_cleanup(open(File, write, Out, [encoding(utf8)]),
+                           json_write_dict(Out, Certificate, [width(0)]),
+                           close(Out))
+    ;   true
+    ).
+
+message_to_text(Error, Text) :-
+    catch(message_to_codes(Error, Text), _, fail), !.
+message_to_text(Error, Text) :- format(string(Text), "~q", [Error]).
+
+message_to_codes(Error, Text) :-
+    '$messages':translate_message(Error, Lines, []),
+    with_output_to(string(Raw), print_message_lines(current_output, '', Lines)),
+    split_string(Raw, "", "\n ", [Text]).
+```
+
+A proof that the operators are exactly the claimed set:
+
+```prolog
+:- use_module('../prolog/operators').
+:- use_module(kibi_certificate).
+:- initialization(main, main).
+
+main :-
+    findall(Name, operator(Name, _), Names0),
+    list_to_set(Names0, Names),
+    kibi_exhaustive_certificate('TEST-operator-set', 'SYM-operator', Names,
+                                [Name]>>operator(Name, _), Certificate),
+    kibi_write_certificate(Certificate).
+```
+
+Its contract: `kind: exhaustive`, `domain_source: {symbol_id: SYM-operator,
+arg: 1}`, `proves: [CLAIM-...]`. A rule proof passes
+`[domain(status, 'SYM-status', Statuses)]` and
+`[predicate(detected, 'SYM-detected', [status], detected)]`; its contract
+names `predicate_source: {detected: {symbol_id: SYM-detected}}` and
+`domains: {status: {symbol_id: SYM-status}}`.
+
+## Source proofs over Prolog code
+
+A `source` proof needs no certificate: Kibi reads the Prolog files itself,
+term by term, and never runs them. Use the `references` reader on `.pl` and
+`.plt` files for what modules load (`extract: imports`, members as written:
+`library(lists)`, `helpers`), call (`calls`, `Name/Arity` or
+`Module:Name/Arity`), read from the environment (`env`, `getenv/2`), pass as
+a first argument (`string_args` with `callee`) and throw (`thrown`: the error
+of `error(type_error(...), _)` is `type_error`). Use the `prolog` reader for
+facts: `{reader: prolog, file: pack.pl, functor: requires/1}` lists a pack's
+requirements, and `arg` picks the argument of a fact with several. A goal or
+closure held in a variable (`call(Goal)`, `maplist(G, L)`), a goal with a
+variable module, a clause asserted from a variable and `:- if(...)` fail the
+read with their place: name the predicate instead. The claim cannot be
+decided for a file the read refuses; never drop a file the claim is about
+from `files`.