kibi-core 0.11.0 → 0.12.0

package/src/requirement_proof.pl

@@ -4,6 +4,7 @@
 :- module(requirement_proof, [
     requirement_proof_context/1,
     requirement_proof_context/4,
+    requirement_proof_context/6,
     requirement_proof/4
 ]).
 
@@ -19,12 +20,23 @@
 ]).
 :- use_module('logic_ir.pl', [logic_rule_safety/2]).
 
-proof_version('kibi.requirement-proof.v2').
+proof_version('kibi.requirement-proof.v3').
 
 requirement_proof_context(Context) :-
     requirement_proof_context(unknown, '1970-01-01T00:00:00Z', 604800, Context).
 
 requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds, Context) :-
+    requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds,
+                              strict_snapshot, _{}, Context).
+
+% Per-contract receipt binding (W2): BindingMode is strict_snapshot (the
+% default: a receipt is current only against the whole-workspace snapshot it
+% was proven on) or per_contract (a receipt carrying a binding_hash is current
+% while its contract + receipt-stripped test document are unchanged, via the
+% TestBindings dict TestId -> BindingHash; receipts without a binding_hash
+% still fall back to the snapshot match).
+requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds,
+                          BindingMode, TestBindings, Context) :-
     check_domain_contradictions_and_witnesses(Contradictions, ContradictionWitnesses),
     check_rule_safety(UnsafeRules),
     check_rule_verifiability(UnverifiableRules),
@@ -32,36 +44,41 @@ requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds, Contex
     normalize_atom(CheckedAt, CheckedAtAtom),
     (catch(parse_time(CheckedAtAtom, CheckedAtStamp), _, fail) -> true ; CheckedAtStamp = -1),
     normalize_integer(MaxAgeSeconds, MaxAge),
+    normalize_atom(BindingMode, BindingModeAtom),
     Context = _{
         contradictions: Contradictions,
         contradictionWitnesses: ContradictionWitnesses,
         unsafeRules: UnsafeRules,
         unverifiableRules: UnverifiableRules,
-        verificationSnapshot: Snapshot,
-        verificationCheckedAt: CheckedAtAtom,
-        verificationCheckedAtStamp: CheckedAtStamp,
-        verificationMaxAgeSeconds: MaxAge
+        proofSnapshot: Snapshot,
+        proofCheckedAt: CheckedAtAtom,
+        proofCheckedAtStamp: CheckedAtStamp,
+        proofMaxAgeSeconds: MaxAge,
+        proofBindingMode: BindingModeAtom,
+        proofTestBindings: TestBindings
     }.
 
+% implements REQ-kibi-proof-applicability-reason
+% Exemption first: a current requirement explicitly marked proof_exempt with a
+% reason is intentionally outside E2E-proof scope and must never fall through
+% to the ladder (which would report misleading receipt gaps).
+requirement_proof(ReqId, ReqProps, _Context, Proof) :-
+    kb:current_req(ReqId),
+    proof_exempt(ReqProps, Reason),
+    !,
+    exempt_requirement_proof(Reason, Proof).
 requirement_proof(ReqId, _ReqProps, _Context, Proof) :-
     \+ kb:current_req(ReqId),
     !,
-    proof_version(Version),
-    Proof = _{
-        proofVersion: Version,
-        proofStatus: not_applicable,
-        proofGaps: [],
-        proofAdvisories: [],
-        proofRepairs: [],
-        proofStages: _{applicability: _{status: not_applicable}}
-    }.
+    applicability_exclusion_reason(ReqId, Reason),
+    exempt_requirement_proof(Reason, Proof).
 requirement_proof(ReqId, ReqProps, Context, Proof) :-
     semantic_inventory_stage(ReqProps, SemanticStage, Inventory),
     logic_grounding_stage(ReqId, ReqProps, Inventory, Context, LogicStage),
     contradiction_stage(ReqId, LogicStage.status, Context, ContradictionStage),
     scenario_stage(ReqId, ScenarioStage, ScenarioIds),
-    scenario_test_stage(ScenarioIds, ScenarioTestStage, ScenarioTests),
-    passing_e2e_stage(ScenarioTests, Context, PassingE2eStage, PassingE2eTests),
+    scenario_test_stage(ScenarioIds, ScenarioTestStage, _ScenarioTests),
+    passing_e2e_stage(ScenarioTestStage, Context, PassingE2eStage, PassingE2eTests),
     executable_symbol_stage(PassingE2eTests, ExecutableStage, ExecutableSymbols),
     production_symbol_stage(ReqId, PassingE2eTests, ProductionStage, ProductionSymbols),
     source_coordinate_stage(ReqProps, ExecutableSymbols, ProductionSymbols, CoordinateStage),
@@ -89,6 +106,45 @@ requirement_proof(ReqId, ReqProps, Context, Proof) :-
         proofStages: Stages
     }.
 
+exempt_requirement_proof(Reason, Proof) :-
+    proof_version(Version),
+    Proof = _{
+        proofVersion: Version,
+        proofStatus: not_applicable,
+        proofGaps: [],
+        proofAdvisories: [],
+        proofRepairs: [],
+        proofStages: _{applicability: _{status: not_applicable, reason: Reason}}
+    }.
+
+%% proof_exempt(+Props, -Reason)
+% A current requirement is exempt from E2E-proof scope when its author set
+% proof_exempt to a truthy value AND supplied a non-empty proof_exempt_reason.
+% Without the reason the exemption does not apply, so an author cannot park a
+% requirement silently; upsert validation enforces the same pairing.
+proof_exempt(Props, Reason) :-
+    memberchk(proof_exempt=RawFlag, Props),
+    normalize_atom(RawFlag, Flag),
+    memberchk(Flag, [true, yes, on, '1']),
+    memberchk(proof_exempt_reason=RawReason, Props),
+    normalize_atom(RawReason, Reason),
+    Reason \= ''.
+
+%% applicability_exclusion_reason(+ReqId, -Reason)
+% Typed reason a requirement fails current_req/1: superseded lifecycle, or a
+% status outside the canonical+legacy requirement vocabulary (e.g. the ADR
+% vocabulary 'accepted').
+applicability_exclusion_reason(ReqId, "requirement is superseded by a newer requirement") :-
+    kb_relationship(supersedes, _, ReqId),
+    !.
+applicability_exclusion_reason(ReqId, Reason) :-
+    kb_entity(ReqId, req, Props),
+    memberchk(status=Status, Props),
+    normalize_term_atom(Status, StatusAtom),
+    format(atom(Reason), "status '~w' is not a current requirement status", [StatusAtom]),
+    !.
+applicability_exclusion_reason(_ReqId, "requirement is not current").
+
 semantic_inventory_stage(Props, Stage, Entries) :-
     (   memberchk(semantic_inventory=RawInventory, Props),
         inventory_entries(RawInventory, Entries0),
@@ -435,31 +491,94 @@ violation_for_entity(Violations, EntityId) :-
 
 scenario_stage(ReqId, Stage, ScenarioIds) :-
     findall(ScenarioId,
-        (kb_relationship(specified_by, ReqId, ScenarioId), kb_entity(ScenarioId, scenario, _)),
-        ScenarioIds0),
-    sort(ScenarioIds0, ScenarioIds),
-    (ScenarioIds = [] -> Status = missing ; Status = passed),
+        kb_relationship(specified_by, ReqId, ScenarioId),
+        ScenarioTargets0),
+    sort(ScenarioTargets0, ScenarioTargets),
+    include(existing_scenario, ScenarioTargets, ScenarioIds),
+    findall(ScenarioId,
+        (member(ScenarioId, ScenarioTargets), \+ existing_scenario(ScenarioId)),
+        InvalidScenarioTargets),
+    ((ScenarioIds = [] ; InvalidScenarioTargets \= []) -> Status = missing ; Status = passed),
     maplist(entity_source_ref, ScenarioIds, Sources),
-    Stage = _{status: Status, scenarios: ScenarioIds, sources: Sources}.
+    Stage = _{
+        status: Status,
+        scenarios: ScenarioIds,
+        scenarioTargets: ScenarioTargets,
+        invalidScenarioTargets: InvalidScenarioTargets,
+        sources: Sources
+    }.
+
+existing_scenario(ScenarioId) :-
+    kb_entity(ScenarioId, scenario, _).
 
 scenario_test_stage(ScenarioIds, Stage, ScenarioTests) :-
+    maplist(scenario_test_obligation, ScenarioIds, Obligations),
     findall(TestId,
-        (member(ScenarioId, ScenarioIds), scenario_test(ScenarioId, TestId)),
+        (member(Obligation, Obligations), member(TestId, Obligation.tests)),
         ScenarioTests0),
     sort(ScenarioTests0, ScenarioTests),
-    (ScenarioTests = [] -> Status = missing ; Status = passed),
+    findall(TestId,
+        (member(Obligation, Obligations), member(TestId, Obligation.scenarioTestTargets)),
+        ScenarioTestTargets0),
+    sort(ScenarioTestTargets0, ScenarioTestTargets),
+    findall(TestId,
+        (member(Obligation, Obligations), member(TestId, Obligation.invalidScenarioTestTargets)),
+        InvalidScenarioTestTargets0),
+    sort(InvalidScenarioTestTargets0, InvalidScenarioTestTargets),
+    (   ScenarioIds == []
+    ->  Status = missing
+    ;   member(Obligation, Obligations), Obligation.status == missing
+    ->  Status = missing
+    ;   Status = passed
+    ),
     maplist(entity_source_ref, ScenarioTests, Sources),
-    Stage = _{status: Status, tests: ScenarioTests, sources: Sources}.
+    Stage = _{
+        status: Status,
+        scenarios: ScenarioIds,
+        tests: ScenarioTests,
+        scenarioTestTargets: ScenarioTestTargets,
+        invalidScenarioTestTargets: InvalidScenarioTestTargets,
+        sources: Sources,
+        obligations: Obligations
+    }.
 
-scenario_test(ScenarioId, TestId) :-
-    kb_relationship(verified_by, ScenarioId, TestId),
+scenario_test_obligation(ScenarioId, Obligation) :-
+    findall(TestId, declared_scenario_test_target(ScenarioId, TestId), TestTargets0),
+    sort(TestTargets0, TestTargets),
+    include(existing_test, TestTargets, TestIds),
+    findall(TestId,
+        (member(TestId, TestTargets), \+ existing_test(TestId)),
+        InvalidScenarioTestTargets),
+    maplist(entity_source_ref, TestIds, Sources),
+    (   (TestIds == [] ; InvalidScenarioTestTargets \= [])
+    ->  Status = missing
+    ;   Status = passed
+    ),
+    Obligation = _{
+        scenarioId: ScenarioId,
+        status: Status,
+        scenarioTestTargets: TestTargets,
+        invalidScenarioTestTargets: InvalidScenarioTestTargets,
+        tests: TestIds,
+        sources: Sources
+    }.
+
+declared_scenario_test_target(ScenarioId, TestId) :-
+    kb_relationship(verified_by, ScenarioId, TestId).
+declared_scenario_test_target(ScenarioId, TestId) :-
+    kb_relationship(validates, TestId, ScenarioId).
+
+existing_test(TestId) :-
     kb_entity(TestId, test, _).
+
 scenario_test(ScenarioId, TestId) :-
-    kb_relationship(validates, TestId, ScenarioId),
-    kb_entity(TestId, test, _).
+    declared_scenario_test_target(ScenarioId, TestId),
+    existing_test(TestId).
 
-passing_e2e_stage(ScenarioTests, Context, Stage, PassingE2eTests) :-
-    maplist(test_receipt_evidence(Context), ScenarioTests, Evidence),
+passing_e2e_stage(ScenarioTestStage, Context, Stage, PassingE2eTests) :-
+    maplist(scenario_passing_e2e_obligation(Context), ScenarioTestStage.obligations, ScenarioObligations),
+    findall(Item, (member(Obligation, ScenarioObligations), member(Item, Obligation.evidence)), Evidence0),
+    unique_evidence_by_test(Evidence0, Evidence),
     evidence_tests_with_state(Evidence, passed, PassingE2eTests),
     evidence_tests_with_state(Evidence, missing, MissingReceiptTests),
     evidence_tests_with_state(Evidence, stale, StaleReceiptTests),
@@ -468,10 +587,11 @@ passing_e2e_stage(ScenarioTests, Context, Stage, PassingE2eTests) :-
     evidence_tests_with_state(Evidence, contract_mismatch, ContractMismatchReceiptTests),
     evidence_tests_with_state(Evidence, snapshot_unavailable, SnapshotUnavailableTests),
     evidence_tests_with_state(Evidence, not_end_to_end, NonEndToEndTests),
-    passing_e2e_status(PassingE2eTests, InvalidReceiptTests, ContractMismatchReceiptTests, SnapshotUnavailableTests, Status),
+    passing_e2e_status(ScenarioObligations, Status),
     Stage = _{
         status: Status,
         tests: PassingE2eTests,
+        scenarioObligations: ScenarioObligations,
         receiptEvidence: Evidence,
         missingReceiptTests: MissingReceiptTests,
         staleReceiptTests: StaleReceiptTests,
@@ -480,16 +600,104 @@ passing_e2e_stage(ScenarioTests, Context, Stage, PassingE2eTests) :-
         contractMismatchReceiptTests: ContractMismatchReceiptTests,
         snapshotUnavailableTests: SnapshotUnavailableTests,
         nonEndToEndTests: NonEndToEndTests,
-        currentCodeSnapshot: Context.verificationSnapshot,
-        checkedAt: Context.verificationCheckedAt,
-        maxAgeSeconds: Context.verificationMaxAgeSeconds
+        currentCodeSnapshot: Context.proofSnapshot,
+        checkedAt: Context.proofCheckedAt,
+        maxAgeSeconds: Context.proofMaxAgeSeconds
+    }.
+
+unique_evidence_by_test(Evidence0, Evidence) :-
+    findall(TestId,
+        (member(Item, Evidence0), TestId = Item.testId),
+        TestIds0),
+    sort(TestIds0, TestIds),
+    maplist(first_evidence_for_test(Evidence0), TestIds, Evidence).
+
+first_evidence_for_test(Evidence, TestId, Item) :-
+    member(Item, Evidence),
+    Item.testId == TestId,
+    !.
+
+scenario_passing_e2e_obligation(Context, TestObligation, Obligation) :-
+    maplist(test_receipt_evidence(Context), TestObligation.tests, Evidence),
+    include(e2e_evidence, Evidence, E2eEvidence),
+    include(non_e2e_evidence, Evidence, NonEndToEndEvidence),
+    evidence_tests_with_state(E2eEvidence, passed, PassingE2eTests),
+    evidence_tests_with_state(E2eEvidence, missing, MissingReceiptTests),
+    evidence_tests_with_state(E2eEvidence, stale, StaleReceiptTests),
+    evidence_tests_with_state(E2eEvidence, failed, FailedReceiptTests),
+    evidence_tests_with_state(E2eEvidence, invalid, InvalidReceiptTests),
+    evidence_tests_with_state(E2eEvidence, contract_mismatch, ContractMismatchReceiptTests),
+    evidence_tests_with_state(E2eEvidence, snapshot_unavailable, SnapshotUnavailableTests),
+    evidence_tests_with_state(NonEndToEndEvidence, not_end_to_end, NonEndToEndTests),
+    scenario_obligation_gaps(TestObligation, E2eEvidence, Gaps),
+    scenario_obligation_status(TestObligation, E2eEvidence, Status),
+    findall(TestId,
+        (member(Item, E2eEvidence), TestId = Item.testId),
+        E2eTests0),
+    sort(E2eTests0, E2eTests),
+    Obligation = _{
+        scenarioId: TestObligation.scenarioId,
+        status: Status,
+        scenarioTestTargets: TestObligation.scenarioTestTargets,
+        invalidScenarioTestTargets: TestObligation.invalidScenarioTestTargets,
+        tests: TestObligation.tests,
+        e2eTests: E2eTests,
+        nonEndToEndTests: NonEndToEndTests,
+        evidence: Evidence,
+        gaps: Gaps,
+        passingE2eTests: PassingE2eTests,
+        missingReceiptTests: MissingReceiptTests,
+        staleReceiptTests: StaleReceiptTests,
+        failedReceiptTests: FailedReceiptTests,
+        invalidReceiptTests: InvalidReceiptTests,
+        contractMismatchReceiptTests: ContractMismatchReceiptTests,
+        snapshotUnavailableTests: SnapshotUnavailableTests
     }.
 
-passing_e2e_status(Passing, _, _, _, passed) :- Passing \= [], !.
-passing_e2e_status([], Invalid, _, _, unresolved) :- Invalid \= [], !.
-passing_e2e_status([], _, ContractMismatch, _, unresolved) :- ContractMismatch \= [], !.
-passing_e2e_status([], _, _, SnapshotUnavailable, unresolved) :- SnapshotUnavailable \= [], !.
-passing_e2e_status([], _, _, _, missing).
+e2e_evidence(Item) :- Item.state \= not_end_to_end.
+non_e2e_evidence(Item) :- Item.state == not_end_to_end.
+
+scenario_obligation_gaps(TestObligation, E2eEvidence, Gaps) :-
+    findall(Gap, scenario_obligation_gap(TestObligation, E2eEvidence, Gap), Gaps0),
+    sort(Gaps0, Gaps).
+
+scenario_obligation_gap(TestObligation, _E2eEvidence, missing_scenario_test) :-
+    TestObligation.status == missing.
+scenario_obligation_gap(TestObligation, E2eEvidence, missing_passing_e2e) :-
+    TestObligation.status == passed,
+    E2eEvidence == [].
+scenario_obligation_gap(_TestObligation, Evidence, missing_proof_receipt) :-
+    member(Item, Evidence), Item.state == missing.
+scenario_obligation_gap(_TestObligation, Evidence, stale_proof_receipt) :-
+    member(Item, Evidence), Item.state == stale.
+scenario_obligation_gap(_TestObligation, Evidence, failed_proof_receipt) :-
+    member(Item, Evidence), Item.state == failed.
+scenario_obligation_gap(_TestObligation, Evidence, invalid_proof_receipt) :-
+    member(Item, Evidence), Item.state == invalid.
+scenario_obligation_gap(_TestObligation, Evidence, proof_contract_mismatch) :-
+    member(Item, Evidence), Item.state == contract_mismatch.
+scenario_obligation_gap(_TestObligation, Evidence, proof_snapshot_unavailable) :-
+    member(Item, Evidence), Item.state == snapshot_unavailable.
+
+scenario_obligation_status(TestObligation, _E2eEvidence, missing) :-
+    TestObligation.status == missing,
+    !.
+scenario_obligation_status(_TestObligation, [], missing) :-
+    !.
+scenario_obligation_status(_TestObligation, Evidence, passed) :-
+    Evidence \= [],
+    forall(member(Item, Evidence), Item.state == passed),
+    !.
+scenario_obligation_status(_TestObligation, _Evidence, unresolved).
+
+passing_e2e_status([], missing) :- !.
+passing_e2e_status(Obligations, passed) :-
+    forall(member(Obligation, Obligations), Obligation.status == passed),
+    !.
+passing_e2e_status(Obligations, missing) :-
+    member(Obligation, Obligations), Obligation.status == missing,
+    !.
+passing_e2e_status(_Obligations, unresolved).
 
 evidence_tests_with_state(Evidence, State, TestIds) :-
     findall(TestId,
@@ -502,9 +710,9 @@ test_receipt_evidence(Context, TestId, Evidence) :-
     test_scope(Props, Scope),
     (   Scope \= end_to_end
     ->  Evidence = _{testId: TestId, state: not_end_to_end, scope: Scope}
-    ;   Context.verificationSnapshot == unknown
+    ;   Context.proofSnapshot == unknown
     ->  Evidence = _{testId: TestId, state: snapshot_unavailable, scope: Scope}
-    ;   verification_receipt_entries(Props, Receipts, ReceiptPropertyPresent),
+    ;   proof_receipt_entries(Props, Receipts, ReceiptPropertyPresent),
         receipt_evidence_state(TestId, Scope, Props, Receipts, ReceiptPropertyPresent, Context, Evidence)
     ).
 
@@ -513,18 +721,18 @@ receipt_evidence_state(TestId, Scope, _Props, [], false, _Context,
 receipt_evidence_state(TestId, Scope, Props, Receipts, _Present, _Context,
         _{testId: TestId, state: invalid, scope: Scope, receiptCount: Count}) :-
     length(Receipts, Count),
-    verification_contract_binding(Props, ContractBinding),
+    proof_contract_binding(Props, ContractBinding),
     (ContractBinding == invalid
     ; Receipts == []
     ; member(Receipt, Receipts), \+ valid_receipt_shape(TestId, Receipt)
     ; \+ chronological_receipt_history(Receipts)),
     !.
 receipt_evidence_state(TestId, Scope, Props, Receipts, _Present, Context, Evidence) :-
-    include(receipt_for_snapshot(Context.verificationSnapshot), Receipts, SnapshotReceipts),
+    receipt_for_current_mode(TestId, Context, Receipts, SnapshotReceipts),
     (   SnapshotReceipts == []
     ->  length(Receipts, Count),
         Evidence = _{testId: TestId, state: stale, scope: Scope, receiptCount: Count}
-    ;   verification_contract_binding(Props, ContractBinding),
+    ;   proof_contract_binding(Props, ContractBinding),
         include(receipt_matches_current_binding(Scope, ContractBinding), SnapshotReceipts, CurrentReceipts),
         (   CurrentReceipts == []
         ->  receipt_contract_mismatch_evidence(TestId, Scope, SnapshotReceipts, ContractBinding, Evidence)
@@ -534,8 +742,8 @@ receipt_evidence_state(TestId, Scope, Props, Receipts, _Present, Context, Eviden
         )
     ).
 
-verification_receipt_entries(Props, Receipts, Present) :-
-    (   memberchk(verification_receipts=Raw, Props)
+proof_receipt_entries(Props, Receipts, Present) :-
+    (   memberchk(proof_receipts=Raw, Props)
     ->  Present = true,
         inventory_entries(Raw, Receipts)
     ;   Present = false,
@@ -544,16 +752,11 @@ verification_receipt_entries(Props, Receipts, Present) :-
 
 valid_receipt_shape(TestId, Receipt) :-
     inventory_entry_field(Receipt, version, RawVersion),
-    normalize_receipt_atom(RawVersion, Version),
-    memberchk(Version, ['kibi.verification-receipt.v1', 'kibi.verification-receipt.v2']),
+    normalize_receipt_atom(RawVersion, 'kibi.proof-receipt.v1'),
     inventory_entry_field(Receipt, receipt_id, RawReceiptId),
     normalize_receipt_atom(RawReceiptId, ReceiptId), valid_receipt_id(ReceiptId),
     inventory_entry_field(Receipt, test_id, RawTestId),
     normalize_receipt_atom(RawTestId, TestId),
-    inventory_entry_field(Receipt, runner, RawRunner),
-    normalize_receipt_atom(RawRunner, Runner), Runner \= '',
-    inventory_entry_field(Receipt, command, RawCommand),
-    normalize_receipt_atom(RawCommand, Command), Command \= '',
     inventory_entry_field(Receipt, scope, RawScope),
     normalize_receipt_atom(RawScope, ReceiptScope),
     memberchk(ReceiptScope, [unit, integration, end_to_end]),
@@ -566,55 +769,83 @@ valid_receipt_shape(TestId, Receipt) :-
     normalize_receipt_atom(RawEnvironmentHash, EnvironmentHash), valid_sha256(EnvironmentHash),
     inventory_entry_field(Receipt, artifact_digest, RawArtifactDigest),
     normalize_receipt_atom(RawArtifactDigest, ArtifactDigest), valid_sha256(ArtifactDigest),
-    receipt_timestamp(Receipt, started_at, StartedStamp),
-    receipt_timestamp(Receipt, finished_at, FinishedStamp),
-    FinishedStamp >= StartedStamp,
-    valid_receipt_version_fields(Version, Receipt).
-
-valid_receipt_version_fields('kibi.verification-receipt.v1', _Receipt).
-valid_receipt_version_fields('kibi.verification-receipt.v2', Receipt) :-
+    inventory_entry_field(Receipt, contract_hash, RawContractHash),
+    normalize_receipt_atom(RawContractHash, ContractHash), valid_sha256(ContractHash),
+    inventory_entry_field(Receipt, fingerprint, RawFingerprint),
+    normalize_receipt_atom(RawFingerprint, Fingerprint), valid_sha256(Fingerprint),
+    valid_fingerprint_components(Receipt),
+    inventory_entry_field(Receipt, integration_id, RawIntegrationId),
+    normalize_receipt_atom(RawIntegrationId, IntegrationId), IntegrationId \= '',
+    inventory_entry_field(Receipt, producer, RawProducer),
+    receipt_producer_name(RawProducer, ProducerName), ProducerName \= '',
     inventory_entry_field(Receipt, command_argv, RawCommandArgv),
     is_list(RawCommandArgv),
     RawCommandArgv \= [],
     maplist(nonempty_receipt_atom, RawCommandArgv),
-    inventory_entry_field(Receipt, contract_hash, RawContractHash),
-    normalize_receipt_atom(RawContractHash, ContractHash),
-    valid_sha256(ContractHash),
-    inventory_entry_field(Receipt, case_results, RawCases),
-    is_list(RawCases),
-    RawCases \= [],
-    maplist(valid_receipt_case, RawCases),
-    findall(Key,
-        (member(Case, RawCases), receipt_case_key(Case, Key)), Keys),
-    sort(Keys, UniqueKeys),
-    length(Keys, KeyCount),
-    length(UniqueKeys, KeyCount).
+    (   inventory_entry_field(Receipt, binding_hash, RawBindingHash)
+    ->  normalize_receipt_atom(RawBindingHash, BindingHash),
+        valid_sha256(BindingHash)
+    ;   true
+    ),
+    inventory_entry_field(Receipt, run_outcome, RawRunOutcome),
+    normalize_receipt_atom(RawRunOutcome, RunOutcome),
+    memberchk(RunOutcome, [passed, failed, errored, cancelled, timed_out, interrupted, no_results]),
+    inventory_entry_field(Receipt, proof_results, RawResults),
+    is_list(RawResults),
+    maplist(valid_receipt_proof_result, RawResults),
+    receipt_timestamp(Receipt, started_at, StartedStamp),
+    receipt_timestamp(Receipt, finished_at, FinishedStamp),
+    FinishedStamp >= StartedStamp.
+
+receipt_producer_name(Producer, Name) :-
+    inventory_entry_field(Producer, name, RawName),
+    normalize_receipt_atom(RawName, Name).
+
+valid_fingerprint_components(Receipt) :-
+    inventory_entry_field(Receipt, fingerprint_components, Components),
+    forall(member(Key, [contract, integration, command, bindings, producer]),
+           (inventory_entry_field(Components, Key, Raw),
+            normalize_receipt_atom(Raw, Value),
+            valid_sha256(Value))),
+    !.
 
 nonempty_receipt_atom(Value) :-
     normalize_receipt_atom(Value, Atom),
     Atom \= ''.
 
-valid_receipt_case(Case) :-
-    inventory_entry_field(Case, symbol_id, RawSymbolId),
+valid_receipt_proof_result(Result) :-
+    inventory_entry_field(Result, symbol_id, RawSymbolId),
     nonempty_receipt_atom(RawSymbolId),
-    inventory_entry_field(Case, project, RawProject),
-    nonempty_receipt_atom(RawProject),
-    inventory_entry_field(Case, outcome, RawOutcome),
-    normalize_receipt_atom(RawOutcome, Outcome),
-    memberchk(Outcome, [passed, failed, timed_out, skipped, interrupted]),
-    inventory_entry_field(Case, retries, Retries),
-    normalize_integer(Retries, RetryCount),
-    RetryCount >= 0,
-    inventory_entry_field(Case, duration_ms, Duration),
-    normalize_integer(Duration, DurationMs),
-    DurationMs >= 0.
-
-receipt_case_key(Case, Key) :-
-    inventory_entry_field(Case, project, Project),
-    inventory_entry_field(Case, symbol_id, SymbolId),
-    normalize_receipt_atom(Project, ProjectAtom),
-    normalize_receipt_atom(SymbolId, SymbolAtom),
-    atomic_list_concat([ProjectAtom, SymbolAtom], '/', Key).
+    inventory_entry_field(Result, target, RawTarget),
+    nonempty_receipt_atom(RawTarget),
+    inventory_entry_field(Result, outcome, RawOutcome),
+    normalize_receipt_atom(RawOutcome, ResultOutcome),
+    memberchk(ResultOutcome, [passed, failed, timed_out, skipped, interrupted, errored]),
+    inventory_entry_field(Result, binding, RawBinding),
+    normalize_receipt_atom(RawBinding, Binding),
+    memberchk(Binding, [native_case, aggregate_run]),
+    valid_receipt_attempts(Result).
+
+valid_receipt_attempts(Result) :-
+    inventory_entry_field(Result, attempts, Attempts),
+    inventory_entry_field(Attempts, status, RawStatus),
+    normalize_receipt_atom(RawStatus, Status),
+    valid_attempt_status(Status, Attempts).
+
+valid_attempt_status(unavailable, Attempts) :-
+    \+ inventory_entry_field(Attempts, entries, _Present), !.
+valid_attempt_status(unavailable, Attempts) :-
+    inventory_entry_field(Attempts, entries, Entries),
+    Entries == [], !.
+valid_attempt_status(complete, Attempts) :-
+    inventory_entry_field(Attempts, entries, Entries),
+    is_list(Entries),
+    Entries \= [],
+    forall(member(Entry, Entries),
+           (inventory_entry_field(Entry, outcome, RawEntryOutcome),
+            normalize_receipt_atom(RawEntryOutcome, EntryOutcome),
+            memberchk(EntryOutcome, [passed, failed, timed_out, skipped, interrupted, errored]))),
+    !.
 
 valid_sha256(Value) :-
     atom_length(Value, 64),
@@ -622,7 +853,7 @@ valid_sha256(Value) :-
     forall(member(Char, Chars), memberchk(Char, ['0','1','2','3','4','5','6','7','8','9',a,b,c,d,e,f])).
 
 valid_receipt_id(Value) :-
-    re_match('^VR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$', Value).
+    re_match('^PR-[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$', Value).
 
 receipt_timestamp(Receipt, Field, Stamp) :-
     inventory_entry_field(Receipt, Field, RawValue),
@@ -647,6 +878,29 @@ receipt_for_snapshot(Snapshot, Receipt) :-
     inventory_entry_field(Receipt, code_snapshot, RawSnapshot),
     normalize_receipt_atom(RawSnapshot, Snapshot).
 
+% Per-contract binding selector (W2). In per_contract mode a receipt carrying
+% a binding_hash is current when it matches the test's current binding hash;
+% receipts without one keep the strict snapshot semantics so older evidence
+% stays valid until each contract is re-proven.
+receipt_for_current_mode(TestId, Context, Receipts, SnapshotReceipts) :-
+    (   Context.proofBindingMode == per_contract,
+        get_dict(TestId, Context.proofTestBindings, CurrentBinding)
+    ->  include(receipt_with_binding_hash, Receipts, BoundReceipts),
+        include(receipt_for_binding(CurrentBinding), BoundReceipts, SnapshotReceipts),
+        (   SnapshotReceipts == []
+        ->  include(receipt_for_snapshot(Context.proofSnapshot), Receipts, SnapshotReceipts)
+        ;   true
+        )
+    ;   include(receipt_for_snapshot(Context.proofSnapshot), Receipts, SnapshotReceipts)
+    ).
+
+receipt_with_binding_hash(Receipt) :-
+    inventory_entry_field(Receipt, binding_hash, _).
+
+receipt_for_binding(Binding, Receipt) :-
+    inventory_entry_field(Receipt, binding_hash, RawBinding),
+    normalize_receipt_atom(RawBinding, Binding).
+
 receipt_matches_current_binding(Scope, ContractBinding, Receipt) :-
     inventory_entry_field(Receipt, scope, RawScope),
     normalize_receipt_atom(RawScope, Scope),
@@ -655,7 +909,7 @@ receipt_matches_current_binding(Scope, ContractBinding, Receipt) :-
 receipt_matches_current_contract(none, _Receipt).
 receipt_matches_current_contract(hash(ExpectedHash), Receipt) :-
     inventory_entry_field(Receipt, version, RawVersion),
-    normalize_receipt_atom(RawVersion, 'kibi.verification-receipt.v2'),
+    normalize_receipt_atom(RawVersion, 'kibi.proof-receipt.v1'),
     inventory_entry_field(Receipt, contract_hash, RawContractHash),
     normalize_receipt_atom(RawContractHash, ExpectedHash).
 
@@ -680,26 +934,26 @@ receipt_contract_mismatch_evidence(TestId, Scope, Receipts, ContractBinding, Evi
 current_contract_hash_value(hash(Hash), Hash).
 current_contract_hash_value(none, none).
 
-verification_contract_binding(Props, Binding) :-
-    (   memberchk(verification_contract=RawContract, Props)
-    ->  (verification_contract_hash(RawContract, Hash) -> Binding = hash(Hash) ; Binding = invalid)
+proof_contract_binding(Props, Binding) :-
+    (   memberchk(proof_contract=RawContract, Props)
+    ->  (proof_contract_hash(RawContract, Hash) -> Binding = hash(Hash) ; Binding = invalid)
     ;   Binding = none
     ).
 
-verification_contract_hash(RawContract, Hash) :-
-    verification_contract_dict(RawContract, Contract),
+proof_contract_hash(RawContract, Hash) :-
+    proof_contract_dict(RawContract, Contract),
     canonical_json_value(Contract, Canonical),
     crypto_data_hash(Canonical, Hash, [algorithm(sha256), encoding(utf8)]).
 
-verification_contract_dict(^^(Value, _), Contract) :- !,
-    verification_contract_dict(Value, Contract).
-verification_contract_dict(literal(type(_, Value)), Contract) :- !,
-    verification_contract_dict(Value, Contract).
-verification_contract_dict(literal(Value), Contract) :- !,
-    verification_contract_dict(Value, Contract).
-verification_contract_dict(Contract, Contract) :-
+proof_contract_dict(^^(Value, _), Contract) :- !,
+    proof_contract_dict(Value, Contract).
+proof_contract_dict(literal(type(_, Value)), Contract) :- !,
+    proof_contract_dict(Value, Contract).
+proof_contract_dict(literal(Value), Contract) :- !,
+    proof_contract_dict(Value, Contract).
+proof_contract_dict(Contract, Contract) :-
     is_dict(Contract), !.
-verification_contract_dict(Raw, Contract) :-
+proof_contract_dict(Raw, Contract) :-
     (atom(Raw) ; string(Raw)),
     catch(atom_json_dict(Raw, Contract, [value_string_as(string)]), _, fail),
     is_dict(Contract).
@@ -731,23 +985,21 @@ latest_receipt(Receipts, Latest, FinishedStamp) :-
     last(Sorted, FinishedStamp-Latest).
 
 receipt_runtime_state(_Receipt, FinishedStamp, Context, invalid, AgeSeconds) :-
-    AgeSeconds is Context.verificationCheckedAtStamp - FinishedStamp,
+    AgeSeconds is Context.proofCheckedAtStamp - FinishedStamp,
     AgeSeconds < -300,
     !.
 receipt_runtime_state(_Receipt, FinishedStamp, Context, stale, AgeSeconds) :-
-    AgeSeconds is Context.verificationCheckedAtStamp - FinishedStamp,
-    AgeSeconds > Context.verificationMaxAgeSeconds,
+    AgeSeconds is Context.proofCheckedAtStamp - FinishedStamp,
+    AgeSeconds > Context.proofMaxAgeSeconds,
     !.
 receipt_runtime_state(Receipt, FinishedStamp, Context, State, AgeSeconds) :-
-    AgeSeconds is Context.verificationCheckedAtStamp - FinishedStamp,
+    AgeSeconds is Context.proofCheckedAtStamp - FinishedStamp,
     inventory_entry_field(Receipt, outcome, RawOutcome),
     normalize_receipt_atom(RawOutcome, Outcome),
     (Outcome == passed -> State = passed ; State = failed).
 
 receipt_evidence_dict(TestId, Scope, Receipt, State, AgeSeconds, Evidence) :-
     receipt_string_field(Receipt, receipt_id, ReceiptId),
-    receipt_string_field(Receipt, runner, Runner),
-    receipt_string_field(Receipt, command, Command),
     receipt_string_field(Receipt, outcome, Outcome),
     receipt_string_field(Receipt, code_snapshot, CodeSnapshot),
     receipt_string_field(Receipt, environment_hash, EnvironmentHash),
@@ -759,8 +1011,6 @@ receipt_evidence_dict(TestId, Scope, Receipt, State, AgeSeconds, Evidence) :-
         state: State,
         scope: Scope,
         receiptId: ReceiptId,
-        runner: Runner,
-        command: Command,
         outcome: Outcome,
         codeSnapshot: CodeSnapshot,
         environmentHash: EnvironmentHash,
@@ -828,15 +1078,19 @@ production_symbol_stage(ReqId, PassingE2eTests, Stage, ProductionSymbols) :-
     include(type_shape_symbol_with_structural_contract, ImplementingSymbols, StructuralSymbols),
     exclude(type_shape_symbol_with_structural_contract, ImplementingSymbols, ProductionSymbols),
     include(symbol_not_covered_by_tests(PassingE2eTests), ProductionSymbols, UncoveredSymbols),
-    production_stage_status(ProductionSymbols, StructuralSymbols, PassingE2eTests, UncoveredSymbols, Status),
+    production_stage_status(ProductionSymbols, StructuralSymbols, PassingE2eTests, UncoveredSymbols, Status, StatusReason),
     maplist(symbol_coordinate_ref, ProductionSymbols, Coordinates),
-    Stage = _{
+    StageBase = _{
         status: Status,
         symbols: ProductionSymbols,
         structuralSymbols: StructuralSymbols,
         uncoveredSymbols: UncoveredSymbols,
         coordinates: Coordinates
-    }.
+    },
+    (   Status == passed
+    ->  Stage = StageBase
+    ;   put_dict(reason, StageBase, StatusReason, Stage)
+    ).
 
 type_shape_symbol_with_structural_contract(SymbolId) :-
     kb_entity(SymbolId, symbol, SymbolProps),
@@ -849,10 +1103,26 @@ type_shape_symbol_with_structural_contract(SymbolId) :-
     normalize_atom(RawStatus, Status),
     memberchk(Status, [active, passing]).
 
-production_stage_status([], [], _, _, missing) :- !.
-production_stage_status(_, _, [], _, blocked) :- !.
-production_stage_status(_, _, _, [], passed) :- !.
-production_stage_status(_, _, _, _, missing).
+% Stage status plus a typed reason, from a single total clause so status and
+% reason can never disagree (the Align stale-receipts case reported `blocked`
+% with no indication that fresh receipts were the unblock). Clause order keeps
+% the historical precedence: no production symbols at all is `missing` even
+% when E2E evidence is also absent; only then does absent E2E evidence read
+% as `blocked`.
+production_stage_status(ProductionSymbols, StructuralSymbols, PassingE2eTests, UncoveredSymbols, Status, Reason) :-
+    (   ProductionSymbols == [],
+        StructuralSymbols == []
+    ->  Status = missing,
+        Reason = "no production symbols implement this requirement; link at least one with implements"
+    ;   PassingE2eTests == []
+    ->  Status = blocked,
+        Reason = "no passing E2E test evidence is available for the current snapshot; run kibi prove so this stage can evaluate production symbol coverage"
+    ;   UncoveredSymbols == []
+    ->  Status = passed
+    ;   Status = missing,
+        length(UncoveredSymbols, Count),
+        format(atom(Reason), "~w production symbol(s) lack covered_by links to the passing E2E tests", [Count])
+    ).
 
 symbol_not_covered_by_tests(Tests, SymbolId) :-
     \+ (member(TestId, Tests), kb_relationship(covered_by, SymbolId, TestId)).
@@ -988,8 +1258,9 @@ proof_advisories(Stages, Advisories) :-
     proof_issues(Stages, _, Advisories).
 
 % implements REQ-kibi-conservative-requirement-proof
-% proofGaps are blocking only. Receipt-completeness codes become
-% proofAdvisories when passingE2e already supplies strict proof.
+% Every linked scenario is a mandatory proof obligation. Receipt-completeness
+% failures therefore remain blocking even when another scenario has a passing
+% receipt; unit/integration-only evidence stays nonblocking in the E2E lane.
 % Invariant: proofStatus == proven implies proofGaps == [].
 proof_issues(Stages, Gaps, Advisories) :-
     findall(Gap,
@@ -1003,15 +1274,14 @@ proof_issues(Stages, Gaps, Advisories) :-
          proof_issue_advisory(Gap, Stages)),
         Advisories).
 
-receipt_completeness_issue(missing_verification_receipt).
-receipt_completeness_issue(stale_verification_receipt).
-receipt_completeness_issue(failed_verification_receipt).
-receipt_completeness_issue(invalid_verification_receipt).
-receipt_completeness_issue(verification_contract_mismatch).
+receipt_completeness_issue(missing_proof_receipt).
+receipt_completeness_issue(stale_proof_receipt).
+receipt_completeness_issue(failed_proof_receipt).
+receipt_completeness_issue(invalid_proof_receipt).
+receipt_completeness_issue(proof_contract_mismatch).
 
-proof_issue_advisory(Gap, Stages) :-
-    receipt_completeness_issue(Gap),
-    Stages.passingE2e.status == passed.
+proof_issue_advisory(_Gap, _Stages) :-
+    fail.
 
 proof_gap_present(missing_semantic_inventory, Stages) :- Stages.semanticInventory.propositionCount =:= 0.
 proof_gap_present(incomplete_semantic_inventory, Stages) :- Stages.semanticInventory.missingCount > 0.
@@ -1028,12 +1298,12 @@ proof_gap_present(contradiction_check_incomplete, Stages) :- Stages.contradictio
 proof_gap_present(missing_scenario, Stages) :- Stages.scenarios.status == missing.
 proof_gap_present(missing_scenario_test, Stages) :- Stages.scenarios.status == passed, Stages.scenarioTests.status == missing.
 proof_gap_present(missing_passing_e2e, Stages) :- Stages.passingE2e.status == missing.
-proof_gap_present(missing_verification_receipt, Stages) :- Stages.passingE2e.missingReceiptTests \= [].
-proof_gap_present(stale_verification_receipt, Stages) :- Stages.passingE2e.staleReceiptTests \= [].
-proof_gap_present(failed_verification_receipt, Stages) :- Stages.passingE2e.failedReceiptTests \= [].
-proof_gap_present(invalid_verification_receipt, Stages) :- Stages.passingE2e.invalidReceiptTests \= [].
-proof_gap_present(verification_contract_mismatch, Stages) :- Stages.passingE2e.contractMismatchReceiptTests \= [].
-proof_gap_present(verification_snapshot_unavailable, Stages) :- Stages.passingE2e.snapshotUnavailableTests \= [].
+proof_gap_present(missing_proof_receipt, Stages) :- Stages.passingE2e.missingReceiptTests \= [].
+proof_gap_present(stale_proof_receipt, Stages) :- Stages.passingE2e.staleReceiptTests \= [].
+proof_gap_present(failed_proof_receipt, Stages) :- Stages.passingE2e.failedReceiptTests \= [].
+proof_gap_present(invalid_proof_receipt, Stages) :- Stages.passingE2e.invalidReceiptTests \= [].
+proof_gap_present(proof_contract_mismatch, Stages) :- Stages.passingE2e.contractMismatchReceiptTests \= [].
+proof_gap_present(proof_snapshot_unavailable, Stages) :- Stages.passingE2e.snapshotUnavailableTests \= [].
 proof_gap_present(missing_executable_test_symbol, Stages) :- Stages.executableSymbols.status == missing.
 proof_gap_present(missing_production_symbol, Stages) :-
     Stages.productionSymbols.symbols == [],
@@ -1055,12 +1325,12 @@ gap_definition(contradiction_check_incomplete, 41, contradictions, "Complete log
 gap_definition(missing_scenario, 50, scenarios, "Add a specified_by scenario for the requirement.").
 gap_definition(missing_scenario_test, 51, scenario_tests, "Link the scenario to a test with verified_by or validates.").
 gap_definition(missing_passing_e2e, 52, passing_e2e, "Record fresh passing end-to-end evidence on a scenario-backed test.").
-gap_definition(missing_verification_receipt, 53, passing_e2e, "Run the exact current verification contract through kibi verify and append its kibi.verification-receipt.v2 result for the scenario-backed E2E test.").
-gap_definition(stale_verification_receipt, 54, passing_e2e, "Re-run the E2E test against the current code snapshot and append its receipt.").
-gap_definition(failed_verification_receipt, 55, passing_e2e, "Repair the failing E2E behavior and append a newer passing receipt for the same snapshot.").
-gap_definition(invalid_verification_receipt, 56, passing_e2e, "Repair malformed, future-dated, mismatched, or otherwise uncheckable receipt evidence.").
-gap_definition(verification_contract_mismatch, 57, passing_e2e, "Run the current verification contract and append its receipt without rewriting historical evidence.").
-gap_definition(verification_snapshot_unavailable, 58, passing_e2e, "Run coverage through a CLI or MCP runtime that exposes the deterministic workspace snapshot.").
+gap_definition(missing_proof_receipt, 53, passing_e2e, "Run the configured proof integration through kibi prove and append its kibi.proof-receipt.v1 result for the scenario-backed proof-bearing test.").
+gap_definition(stale_proof_receipt, 54, passing_e2e, "Re-run kibi prove against the current code snapshot and append fresh receipts.").
+gap_definition(failed_proof_receipt, 55, passing_e2e, "Repair the failing proof obligation and append a newer passing receipt for the same snapshot.").
+gap_definition(invalid_proof_receipt, 56, passing_e2e, "Repair malformed, future-dated, mismatched, or otherwise uncheckable receipt evidence.").
+gap_definition(proof_contract_mismatch, 57, passing_e2e, "Run kibi prove so the receipt carries the current proof contract hash and execution fingerprint without rewriting historical evidence.").
+gap_definition(proof_snapshot_unavailable, 58, passing_e2e, "Run coverage through a CLI or MCP runtime that exposes the deterministic workspace snapshot.").
 gap_definition(missing_executable_test_symbol, 60, executable_symbols, "Link executable test code to every qualifying E2E test with executable_for.").
 gap_definition(missing_production_symbol, 70, production_symbols, "Link at least one production symbol to the requirement with implements.").
 gap_definition(missing_production_symbol_coverage, 71, production_symbols, "Link every runtime implementing production symbol to a qualifying E2E test with covered_by; type-shape symbols retain structural unit contracts instead.").