kibi-cursor 0.6.0 → 1.0.1

package/skills/kibi-usage/resources/branch-lifecycle.md

@@ -0,0 +1,31 @@
+# Branch lifecycle
+
+Kibi attaches to the exact Git ref: `KIBI_BRANCH` when set, otherwise Git's
+symbolic HEAD. Names are not normalized, and `main`, `master`, detached HEAD,
+slash names, `@`, and Unicode refs remain distinct identities.
+
+Compiled state lives under `.kb/branches/<sha256-hash>/branch.json`. The
+manifest records the exact ref and hash; a mismatch is a hard attachment
+failure. A missing store is compiled by `kibi sync` from the current checkout's
+tracked sources. `branch ensure` may create only the empty identity fence; use
+`kibi sync` before relying on compiled state. Kibi never copies another
+branch's store and never chooses merge winners. Git owns merges; unresolved
+conflicts in authored files block compilation.
+
+Legacy literal-path stores are read-only compatibility attachments. Preview an
+explicit migration with both identities, then apply it only with the exact
+preview hash (`kibi branch migrate --from <old> --to <new> --apply
+--approval-hash <preview-hash>`) while attached to the exact new ref. The
+approval is mandatory and binds the source bytes and identities; do not infer a
+rename from commits. For a legacy literal store on the current branch, `<old>`
+and `<new>` must be the same exact identity. Every cross-identity pair is
+refused, including `main` to `master`; migration changes only the storage
+format from literal to hashed for the active exact branch. Deleted local branches may be quarantined for the
+configured retention period; `branch restore --branch <exact-ref> --apply` is
+reversible during retention and purge is explicit. Remote-only refs do not keep
+a local compiled store alive.
+
+If migration is interrupted, use the journal's exact recovery action:
+`kibi branch migrate --recover-journal <id>` previews the deterministic
+roll-forward or verified-backup restore, and `--apply` performs it. Do not
+resolve the live branch attachment while the migration journal is ambiguous.

package/skills/kibi-usage/resources/kb-improvement.md

@@ -0,0 +1,38 @@
+# Existing Product KB Improvement
+
+Use this resource when an existing product KB already has REQ → SCEN → TEST →
+symbol traceability and the task is to add typed facts so normative claims are
+queryable and contradiction-checkable.
+
+Keep the original requirement prose readable. Facts add semantics; they do not
+replace the requirement body. Lane choice, field names, and predicate routing
+are in `resources/fact-lanes.md` and the Predicate-First workflow in
+`resources/workflows.md`.
+
+## Claim routing
+
+| Claim type | Model as | Relationship |
+| --- | --- | --- |
+| Measurable normative property | `subject` + `property_value` | `constrains` + `requires_property` |
+| Domain invariant or behavior relation | `predicate` | `requires_predicate` |
+| Bug, workaround, or observed evidence | `observation` | usually `relates_to` |
+| Process or governance note | `meta` | usually `relates_to` |
+| Runtime or config gate | `flag` | `guards` |
+
+Call `kb_semantic_advisor` on the complete requirement body before encoding a
+clause. Apply a predicate only when a returned schema fits; otherwise leave an
+ontology-gap observation.
+
+## Source and RDF reconciliation
+
+After each approved write:
+
+1. Query the exact fact IDs.
+2. Confirm `fact_kind`, `predicate_name` or `property_key`, and `canonical_key`
+   appear through Kibi tools, not only in authored Markdown.
+3. Graph from the requirement with `requires_predicate` and `requires_property`.
+4. If Markdown has predicate or property fields but queries do not, report a
+   sync or import issue before creating duplicates.
+
+Treat active tool query results as operational truth. Authored Markdown is
+evidence of intent, not proof of active KB state.

package/skills/kibi-usage/resources/operation-access.md

@@ -1,44 +1,42 @@
 # Kibi Operation Access Catalog
 
-This table is the machine-readable interface map for Kibi's shared operation catalog. Every CLI route shown is dedicated; there is no generic operation runner. `--input JSON or flags` means the route supports exact MCP-shaped JSON from a file or stdin as well as its established human flags. `--input JSON` means the dedicated parity route is JSON-only.
-
-| MCP tool name | CLI route | Input mode | Mutability | Requires Prolog | Effects | Interface |
-|---|---|---|---|---|---|---|
-| `kb_skills_list` | `skills-list` | `--input JSON` | read | no | `local-read` | peer; capability-selected |
-| `kb_skills_load` | `skills-load` | `--input JSON` | read | no | `local-read` | peer; capability-selected |
-| `kb_skills_read` | `skills-read` | `--input JSON` | read | no | `local-read` | peer; capability-selected |
-| `kb_query` | `query` | `--input JSON or flags` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_search` | `search` | `--input JSON or flags` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_status` | `status` | `--input JSON or flags` | read | yes | `kb-read, workspace-read` | peer; capability-selected |
-| `kb_find_gaps` | `find-gaps` | `--input JSON or flags` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_coverage` | `coverage` | `--input JSON or flags` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_graph` | `graph` | `--input JSON or flags` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_semantic_advisor` | `semantic-advisor` | `--input JSON` | read | no | `local-read` | peer; capability-selected |
-| `kb_model_requirement` | `model-requirement` | `--input JSON` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_suggest_predicates` | `suggest-predicates` | `--input JSON` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_autopilot_generate` | `autopilot-generate` | `--input JSON` | read | no | `workspace-read` | peer; capability-selected |
-| `kb_validate_upsert` | `validate-upsert` | `--input JSON` | read | yes | `kb-read` | peer; capability-selected |
-| `kb_upsert` | `upsert` | `--input JSON` | write | yes | `kb-write, workspace-write` | peer; capability-selected |
-| `kb_delete` | `delete` | `--input JSON` | write | yes | `kb-write, workspace-write` | peer; capability-selected |
-| `kb_check` | `check` | `--input JSON or flags` | read | yes | `kb-read, workspace-read` | peer; capability-selected |
-| `kb_sparql_remote` | `sparql-remote` | `--input JSON` | read | no | `network-read` | peer; capability-selected |
-
-## JSON execution recipes
-
-Use the project-local, non-installing runner from a trusted workspace. Stdin must contain exactly one UTF-8 JSON object.
-
-```bash
-echo '{"query":"authentication","type":"req","limit":10}' | npx --no-install kibi search --input -
-```
+Generated from the public `OperationSpec` catalog. CLI JSON and MCP structured
+content use the same `KibiResult` envelope (protocol 1); result data is versioned
+per operation. Effects are authoritative for mutability and adapter annotations.
+
+| MCP tool name | CLI route | Input mode | Mutability | Requires Prolog | Effects | Interface | Result version | Destructive | Retry safety | Open-world | Output schema |
+|---|---|---|---|---|---|---|---|---|---|---|---|
+| `kb_skills_list` | `skills-list` | --input JSON | read | no | local-read | peer; capability-selected | kibi.kb_skills_list.v1 | no | safe | no | yes |
+| `kb_skills_load` | `skills-load` | --input JSON | read | no | local-read | peer; capability-selected | kibi.kb_skills_load.v1 | no | safe | no | yes |
+| `kb_skills_read` | `skills-read` | --input JSON | read | no | local-read | peer; capability-selected | kibi.kb_skills_read.v1 | no | safe | no | yes |
+| `kb_query` | `query` | --input JSON or flags | read | yes | kb-read | peer; capability-selected | kibi.kb_query.v1 | no | safe | no | yes |
+| `kb_search` | `search` | --input JSON or flags | read | yes | kb-read | peer; capability-selected | kibi.kb_search.v1 | no | safe | no | yes |
+| `kb_status` | `status` | --input JSON or flags | read | no | kb-read, workspace-read | peer; capability-selected | kibi.kb_status.v1 | no | safe | no | yes |
+| `kb_find_gaps` | `find-gaps` | --input JSON or flags | read | yes | kb-read | peer; capability-selected | kibi.kb_find_gaps.v1 | no | safe | no | yes |
+| `kb_coverage` | `coverage` | --input JSON or flags | read | yes | kb-read | peer; capability-selected | kibi.kb_coverage.v1 | no | safe | no | yes |
+| `kb_graph` | `graph` | --input JSON or flags | read | yes | kb-read | peer; capability-selected | kibi.kb_graph.v1 | no | safe | no | yes |
+| `kb_semantic_advisor` | `semantic-advisor` | --input JSON | read | no | local-read | peer; capability-selected | kibi.kb_semantic_advisor.v1 | no | safe | no | yes |
+| `kb_model_requirement` | `model-requirement` | --input JSON | read | yes | kb-read | peer; capability-selected | kibi.kb_model_requirement.v1 | no | safe | no | yes |
+| `kb_suggest_predicates` | `suggest-predicates` | --input JSON | read | yes | kb-read | peer; capability-selected | kibi.kb_suggest_predicates.v1 | no | safe | no | yes |
+| `kb_plan_bootstrap` | `plan-bootstrap` | --input JSON | read | no | workspace-read | peer; capability-selected | kibi.kb_plan_bootstrap.v1 | no | safe | no | yes |
+| `kb_validate_upsert` | `validate-upsert` | --input JSON | read | yes | kb-read | peer; capability-selected | kibi.kb_validate_upsert.v1 | no | safe | no | yes |
+| `kb_upsert` | `upsert` | --input JSON | write | yes | kb-write, workspace-write | peer; capability-selected | kibi.kb_upsert.v1 | yes | unsafe | no | yes |
+| `kb_delete` | `delete` | --input JSON | write | yes | kb-write, workspace-write | peer; capability-selected | kibi.kb_delete.v1 | yes | unsafe | no | yes |
+| `kb_check` | `check` | --input JSON or flags | read | yes | kb-read, workspace-read | peer; capability-selected | kibi.kb_check.v1 | no | safe | no | yes |
+| `kb_sparql_remote` | `sparql-remote` | --input JSON | read | no | network-read | peer; capability-selected | kibi.kb_sparql_remote.v1 | no | safe | yes | yes |
+| `kb_compile_intent` | `compile-intent` | --input JSON | read | yes | kb-read, workspace-read | peer; capability-selected | kibi.kb_compile_intent.v1 | no | safe | no | yes |
+| `kb_apply_plan` | `apply-plan` | --input JSON | write | yes | kb-read, kb-write, workspace-read, workspace-write | peer; capability-selected | kibi.kb_apply_plan.v1 | yes | unsafe | no | yes |
+| `kb_ingest_proof` | `ingest-proof` | --input JSON | write | yes | kb-read, kb-write, workspace-read | peer; capability-selected | kibi.kb_ingest_proof.v1 | yes | unsafe | no | yes |
+
+## JSON execution recipe
+
+Use a trusted project-local, non-installing runner. Stdin contains one UTF-8 JSON
+object and stdout contains the versioned result envelope:
 
 ```bash
-echo '{"type":"req","id":"REQ-001","properties":{"title":"Test","status":"open"}}' | npx --no-install kibi upsert --input -
+printf '%s\n' '{"query":"authentication","limit":10}' | npx --no-install kibi search --input -
 ```
 
-```bash
-echo '{"rules":["required-fields","no-dangling-refs"]}' | bunx --no-install kibi check --input -
-```
-
-## Telemetry handling
-
-`_diagnostic_telemetry` is adapter metadata, not business input. In CLI JSON mode the adapter may validate and extract it for CLI usage logging before shared execution. In MCP diagnostic mode the adapter enforces its configured telemetry requirement and strips the field before shared execution. Never copy telemetry into entity properties or operation business input.
+`_diagnostic_telemetry` is adapter metadata, not business input. Never copy it
+into entity properties. On `committed_with_repairs`, follow typed required
+`nextActions` and do not retry the original mutation.

package/skills/kibi-usage/resources/proof.md

@@ -0,0 +1,105 @@
+# Proof and Verification Workflow
+
+Use this resource when a requirement must be proven before handoff, when
+wiring a proof-bearing test, or when `kb_ingest_proof` or `kibi prove`
+rejected evidence.
+
+Kibi does not support test runners. Kibi supports proof evidence. Any
+producer (Playwright, pytest, JUnit, TAP, shell commands, database harnesses)
+reports what happened as `kibi.proof-run.v1`; Kibi evaluates proof.
+
+## Golden path
+
+1. Query the test (`kb_query`, `type: test`) and read its
+   `kibi.proof-contract.v1`, `proof_bindings`, and `verification_scope`.
+2. Run the configured producer through the canonical command:
+
+   ```bash
+   kibi prove --test TEST-<id>
+   # or: kibi prove --requirement REQ-<id> | --integration <id> | --all
+   ```
+
+   `kibi prove` captures the workspace snapshot, runs each integration's
+   producer once (`shell: false`), revalidates the snapshot, evaluates the
+   artifact against every selected contract, and appends idempotent
+   `kibi.proof-receipt.v1` receipts.
+3. Confirm with `kb_status` (fresh, current snapshot) and `kb_coverage`.
+
+Never hand-write receipts. Kibi derives them from validated
+`kibi.proof-run.v1` artifacts only.
+
+## Proof contracts
+
+A proof-bearing test declares explicit obligations (never a Cartesian
+cases-times-projects matrix):
+
+```yaml
+verification_scope: end_to_end
+verification_perspective: consumer
+proof_contract:
+  version: kibi.proof-contract.v1
+  integration: web-e2e          # id from .kb/proof/integrations.json
+  required_proofs:
+    - symbol_id: SYM-PW-4F2A9C61B7D03E85
+      target: chromium          # browser, runtime, db, device, or default
+  success_policy: all_required_first_attempt
+proof_bindings:                 # optional provenance metadata
+  - symbol_id: SYM-PW-4F2A9C61B7D03E85
+    target: chromium
+    native_id: tests/checkout.spec.ts::accepts a card
+```
+
+Provenance lives in `proof_bindings`; the contract stays semantic.
+
+## Integration configuration
+
+`.kb/proof/integrations.json` (`kibi.proof-integration.v1`) is tracked,
+Kibi-managed configuration describing evidence production only:
+
+- `producer: command` — Kibi synthesizes the envelope from the process
+  outcome; obligations are bound with `aggregate_run` provenance and the
+  single process invocation counts as the known first attempt.
+- `producer: playwright` (or custom) — the child emits `kibi.proof-run.v1`
+  itself (bundled reporter: `kibi-cli/playwright-reporter`).
+- `producer: junit` / `tap` — Kibi converts the native report at `artifact`
+  using each test's `proof_bindings`; standard formats carry no retry
+  history, so attempts are reported as `unavailable` and fail the strict
+  first-attempt policy closed.
+
+Cosmetic edits (descriptions, labels) never stale proof. Execution-relevant
+edits (command, artifact, targets, options, bindings, contract) change the
+effective fingerprint and do.
+
+## Attempt semantics (factual, never optimistic)
+
+- `attempts: {status: "complete", entries: [...]}` — known history; the
+  strict policy requires a passing **first** entry.
+- `attempts: {status: "unavailable"}` — unknown native history; the strict
+  policy fails closed, except `aggregate_run` results, which are satisfied by
+  the Kibi-launched process attempt when the run passed with exit code 0.
+- `run.outcome` is authoritative: a failed, errored, cancelled, interrupted,
+  or `no_results` run proves nothing, even with passing individual results.
+
+## Common rejections
+
+- `No proof integration configuration` — bootstrap has not configured proof
+  for this repository yet; do not hand-wave, run the bootstrap proof step.
+- `captured snapshot is not the live workspace snapshot` — the tree changed
+  between capture and ingest; re-run `kibi prove`.
+- `artifact command_argv does not match the configured command` — the
+  artifact came from a different command than `integrations.json` configures.
+- `attempt history unavailable` — the producer could not prove first-attempt
+  success for a native-case obligation; use a producer with complete history
+  or accept aggregate provenance.
+- `proof_receipts is append-only` — receipts are append-only; update tests
+  through the engine (which appends) or include the existing history when
+  authoring test files directly.
+
+## After code changes
+
+Receipts bind to the snapshot, contract hash, and execution fingerprint at
+run time. Any code or source change moves the snapshot and stales receipts:
+re-run `kibi prove` for the affected selection, then confirm `kb_status` and
+`kb_coverage` before handoff.
+
+Full reference: `docs/proving-requirements.md`.

package/skills/kibi-usage/resources/relationship-directions.md

@@ -11,7 +11,7 @@
 | `executable_for` | symbol -> test | Test symbol (code) is executable code for a test entity |
 | `constrains` | req -> fact(subject) | Requirement constrains a strict-lane domain fact |
 | `requires_property` | req -> fact(property_value) | Requirement requires a specific property value fact |
-| `supersedes` | old-req -> new-req | Old requirement is formally replaced by a new requirement |
+| `supersedes` | new-req -> old-req | New requirement formally replaces an old requirement |
 | `covered_by` | symbol -> test | Production symbol has test coverage evidence |
 
 ## Valid Payload Examples
@@ -76,8 +76,8 @@ relationships:
 ```yaml
 relationships:
   - type: supersedes
-    from: REQ-001
-    to: REQ-001-v2
+    from: REQ-001-v2
+    to: REQ-001
 ```
 
 ### covered_by

package/skills/kibi-usage/resources/source-authoring.md

@@ -0,0 +1,31 @@
+# Source-first authoring
+
+Tracked Markdown, YAML, symbol manifests, and relationship shards are the
+authoritative project memory. Prolog/RDF state is a rebuildable compiled
+artifact. Kibi may transactionally write tracked files, but it never stages or
+commits them; ordinary Git workflows remain responsible for review and merge.
+
+`kb_upsert` accepts `document.path` and `document.body`. Existing entities use
+their authored source by default and preserve body bytes when `body` is omitted.
+New requirements use `semantic_text` as their body. If a new entity has zero or
+multiple configured writable targets, provide an explicit workspace-relative
+`document.path`; absolute, traversal, and symlink escapes are rejected.
+
+New files are compiled only while their exact bytes are covered by a pending-
+source receipt. Sync compiles Git-tracked files plus those hash-bound pending
+files; arbitrary untracked files are ignored. Stage the file in Git to absorb
+and remove its receipt. A changed or missing pending file is a blocking hash
+drift diagnostic. Unresolved Git index conflicts are likewise blocking; Kibi
+never chooses a merge winner.
+
+Relationship upserts and relationship deletes patch only the canonical shard,
+preserving unrelated records. Authored entity deletion returns a hash-bound
+plan; approve that plan through `kb_apply_plan`. Evolve requirements with a new
+requirement and `supersedes`, rather than deleting the old semantic claim.
+
+On `committed_with_repairs`, inspect `effects` and execute the typed required
+`nextActions`. Never retry the original mutation after its authoritative commit.
+Cancellation follows the same rule: wait for the terminal journal state. A
+pre-commit rollback is retryable, a committed source with a failed derivative
+is repairable, and an indeterminate outcome is non-retryable until its recovery
+action resolves the journal.

package/skills/kibi-usage/resources/workflows.md

@@ -1,5 +1,38 @@
 # Workflows
 
+## Closeout contract
+
+End every task with these five independent fields (not a single inferred
+success flag):
+
+```text
+taskOutcome: complete | interim | blocked
+kbState: clean_fresh | stale | dirty | legacy_compat | not_evaluated
+verificationState: fresh | dirty | unavailable | not_evaluated
+proofState: proven | mixed | unresolved | not_evaluated
+limitationDisposition: none | accepted | unaccepted | not_applicable
+```
+
+`taskOutcome` describes whether the requested objective was completed. The
+other fields describe observed system state. A clean check can coexist with a
+stale or dirty KB; unresolved proof can coexist with a complete maintenance
+task. An accepted limitation is an auditable operator decision, never logical
+grounding, receipt editing, or proof. For every quality diagnostic, record its
+ID, one of `fixed`, `accepted`, or `deferred`, and a rationale. Keep accepted
+ontology gaps and historical telemetry limitations explicit.
+
+Receipt reuse is safe only when the live verification snapshot, contract hash,
+freshness window, and every required case result still match. Otherwise rerun
+the contracted command. If the contract changed, retain every older receipt
+unchanged, append evidence for the current contract, and keep proof unresolved
+with `proof_contract_mismatch` until that current receipt exists.
+Obsolete symbols require current extraction or Git evidence before
+remap/deletion; transfer coverage only when existing test evidence supports it,
+then sync and read back status. Same-version packages with different export
+surfaces are a release defect: require a new package version and label any
+project override temporary. This skill never selects a package manager or
+edits dependency configuration.
+
 ## Discovery to Validation Sequence
 
 The canonical workflow for any KB operation follows this pattern:
@@ -13,7 +46,7 @@ The canonical workflow for any KB operation follows this pattern:
 7. **Create endpoints**: validated `kb_upsert` for new entities, sequentially
 8. **Link**: validated `kb_upsert` with `requires_rule`, `requires_predicate`, `constrains`, or `requires_property`, sequentially
 9. **Validate coverage and consistency**: targeted `rule-safety`, `rule-verifiability`, `semantic-completeness`, `logic-coverage`, `predicate-verifiability`, and `domain-contradictions`, then final full `kb_check`
-10. **Prove execution**: read `kb_status.verificationSnapshot`, run each scenario-backed E2E command, append its `kibi.verification-receipt.v1`, and re-run `kb_coverage`; never promote durable test status into fresh evidence
+10. **Prove execution**: read `kb_status.proofSnapshot`, run `kibi prove` so each configured integration executes once and its `kibi.proof-run.v1` artifact is evaluated against every selected test's `kibi.proof-contract.v1` obligations, appending idempotent `kibi.proof-receipt.v1` receipts; then re-run `kb_coverage`. Never promote durable test status into fresh evidence.
 11. **Repair incrementally**: require `kb_coverage.repairPlan.scope.complete`, apply only one `ready` dependency batch per requirement, validate before every sequential write, and rerun coverage before selecting the next batch
 12. **Gate workflow evidence**: when `.kb/usage.log` exists, run `kibi usage-metrics --format json --require-acceptance`; repair ranked telemetry diagnostics and never treat stale or insufficient evidence as a pass
 
@@ -23,6 +56,26 @@ Every current requirement without `logic_claims` remains visible as non-blocking
 
 `kibi.telemetry-acceptance.v1` evaluates the latest 200 usage events and keeps process health separate from graph correctness. It requires at least 95% complete diagnostic telemetry and, when applicable, exact recent validation before every upsert and a same-requirement/current-hash advisor pass before requirement writes. It also evaluates source lookup misses, comparable complete-scope proof-gap recovery, receipt-specific coverage gaps, and mutation targets retried three or more times. Failed metrics become ranked `category: telemetry` quality diagnostics; missing current coverage fields or evidence older than seven days stays `insufficient_evidence`.
 
+## Agent-guided migration
+
+`kb_status`, unfiltered `kb_check`, and complete-scope `kb_coverage` may return
+the shared `kibi.migration-plan.v2`. Treat it as a typed action graph: inspect
+the canonical `planHash`, scope completeness, dependencies, safety class,
+preconditions, postconditions, and evidence. Apply only ready automatic actions
+with `autoApplicable: true` through an explicitly approved `kb_apply_plan` or
+`kibi migrate --apply-safe` request containing the exact hash and action IDs.
+Never infer an operation from a prose suggestion, and never apply a partial
+plan's destructive symbol or relationship action.
+
+The migration engine may normalize schema/config metadata, cut over validated
+legacy storage with backups, migrate the exact historical branch attachment,
+refresh coordinates, and perform provenance-proven stale cleanup. It does not
+choose package managers, ground semantic claims, resolve contradictions, rerun
+E2E tests, rewrite receipt history, remap authored symbols, or accept
+limitations. Those actions remain explicit review/operator/execution steps.
+
+For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run `kibi prove --requirement <id>` (or the covering integration); this appends proof receipts idempotently and preserves history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
+
 ## Creating a New Feature
 ```
 1. kb_search to discover existing requirements and related knowledge
@@ -48,12 +101,12 @@ Do not create a test-fact pair. Facts describe invariants; requirements or scena
 ## Fresh E2E Receipt Workflow
 
 1. Confirm the exact `REQ -> SCEN -> TEST` path and require typed `verification_scope: end_to_end`; direct requirement-to-test links do not satisfy the conservative scenario stage.
-2. Read `kb_status` and retain its available `verificationSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
+2. Read `kb_status` and retain its available `proofSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
 3. Run the exact E2E command against that snapshot. Record runner, command, start/finish timestamps, outcome, an environment SHA-256, and an artifact/output SHA-256. Do not mint a passed receipt from an authored test status or from an unexecuted assertion.
-4. Preserve every existing receipt byte-for-byte and append a unique `kibi.verification-receipt.v1` object with strictly later `finished_at`. Mutation and incremental sync reject history removal, rewriting, and reordering.
+4. Preserve every existing receipt byte-for-byte and append the derived `kibi.proof-receipt.v1` object with strictly later `finished_at`. Earlier receipts may bind older contracts or fingerprints; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
 5. Re-read `kb_status`; if the snapshot changed during the run, discard the candidate as proof and rerun against the new snapshot. Then run `kb_coverage` and inspect `proofStages.passingE2e.receiptEvidence` plus gap codes.
 
-Only the newest receipt for the live snapshot qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot history is retained but stale for current proof. `missing_verification_receipt`, `stale_verification_receipt`, `failed_verification_receipt`, `invalid_verification_receipt`, and `verification_snapshot_unavailable` are repair states, not warnings to waive.
+Only the newest receipt matching the live snapshot, current contract hash, and current execution fingerprint qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_proof_receipt`, `stale_proof_receipt`, `failed_proof_receipt`, `invalid_proof_receipt`, `proof_contract_mismatch`, and `proof_snapshot_unavailable` are repair states, not warnings to waive.
 
 ## Predicate-First Requirement Modeling
 

package/agent-plugin/skills/init-kibi/SKILL.md

@@ -1,62 +0,0 @@
----
-id: init-kibi
-name: init-kibi
-description: Bootstrap and model knowledge safely using approved Kibi MCP initialization and mutation workflow.
-version: 1.0.0
-kibiCompatibility: "*"
-tags:
-  - kibi
-  - mcp
-  - bootstrap
-  - agent-guidance
----
-## Goal
-
-Set up or refresh Kibi knowledge for the current branch through approved Kibi interfaces only. Maintain source-file traceability for every repository-backed claim, and require explicit operator approval before any mutation.
-
-## Interface Selection
-
-1. If approved Kibi MCP tools are visible, use the MCP route.
-2. Otherwise, in a trusted workspace, use the canonical project-local CLI fallback: `npx --no-install kibi ...` or `bunx --no-install kibi ...`.
-3. If neither approved MCP tools nor the project-local CLI are available, stop and tell the operator to enable or install Kibi for this workspace.
-4. Never use a global fallback, an installing runner, or any route outside the approved Kibi interface.
-
-Use `kibi-usage/resources/operation-access.md` for the exact operation-to-route mapping. The CLI preview route accepts the same JSON object as `kb_autopilot_generate`:
-
-```bash
-echo '{"maxCandidates":25,"minConfidence":0.8}' | npx --no-install kibi autopilot-generate --input -
-```
-
-## Capability Workflow
-
-- Generate a read-only bootstrap preview with `kb_autopilot_generate`, or the dedicated CLI route `autopilot-generate --input`.
-- Show the generated preview and obtain explicit approval before writes.
-- Apply reviewed entity creation or updates with `kb_upsert`, or `upsert --input`.
-- If cleanup is needed, use `kb_delete`, or `delete --input`, only after checking dependencies and obtaining approval for the specific removal.
-- Finish with `kb_check`, or `check --input`, to validate the branch snapshot.
-
-## Guidance
-
-- Keep mutation requests explicit, small, and sequential.
-- Prefer source-linked entities so future `kb_query` lookups can verify repository context against source files.
-- Preserve traceability by linking facts, claims, scenarios, and tests to concrete project files whenever repository evidence supports it.
-- Do not read or edit files inside `.kb` directly; all changes go through the selected Kibi interface.
-- Ask at most four bounded context questions, and only when repository evidence is insufficient.
-- Stop at the documented operator repair boundary if the setup appears partial, inconsistent, or unsupported by the approved interface.
-
-## Public Training Trajectories
-
-- `init-kibi-bootstrap-analysis-train-1`: Analyze the cold-start repository and produce a read-only bootstrap preview using only the public Kibi MCP surface.
-- `init-kibi-bootstrap-analysis-train-2`: Analyze the cold-start repository and produce a read-only bootstrap preview using only the public Kibi MCP surface.
-- `init-kibi-bounded-context-questions-train-1`: Ask only the bounded context questions needed before bootstrap synthesis using only the public Kibi MCP surface.
-- `init-kibi-bounded-context-questions-train-2`: Ask only the bounded context questions needed before bootstrap synthesis using only the public Kibi MCP surface.
-- `init-kibi-approval-sequential-writes-train-1`: Apply the approved bootstrap plan sequentially and finish with validation using only the public Kibi MCP surface.
-- `init-kibi-approval-sequential-writes-train-2`: Apply the approved bootstrap plan sequentially and finish with validation using only the public Kibi MCP surface.
-- `init-kibi-repair-escalation-train-1`: Identify the partial setup and stop at the documented operator repair boundary using only the public Kibi MCP surface.
-- `init-kibi-repair-escalation-train-2`: Identify the partial setup and stop at the documented operator repair boundary using only the public Kibi MCP surface.
-
-## Training Data
-
-```json
-[{"taskId":"init-kibi-bootstrap-analysis-train-1","family":"bootstrap-analysis","reflection":"Analyze the cold-start repository and produce a read-only bootstrap preview. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-bootstrap-analysis-train-2","family":"bootstrap-analysis","reflection":"Analyze the cold-start repository and produce a read-only bootstrap preview. This is train case 2; use only the public Kibi MCP surface."},{"taskId":"init-kibi-bounded-context-questions-train-1","family":"bounded-context-questions","reflection":"Ask only the bounded context questions needed before bootstrap synthesis. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-bounded-context-questions-train-2","family":"bounded-context-questions","reflection":"Ask only the bounded context questions needed before bootstrap synthesis. This is train case 2; use only the public Kibi MCP surface."},{"taskId":"init-kibi-approval-sequential-writes-train-1","family":"approval-sequential-writes","reflection":"Apply the approved bootstrap plan sequentially and finish with validation. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-approval-sequential-writes-train-2","family":"approval-sequential-writes","reflection":"Apply the approved bootstrap plan sequentially and finish with validation. This is train case 2; use only the public Kibi MCP surface."},{"taskId":"init-kibi-repair-escalation-train-1","family":"repair-escalation","reflection":"Identify the partial setup and stop at the documented operator repair boundary. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-repair-escalation-train-2","family":"repair-escalation","reflection":"Identify the partial setup and stop at the documented operator repair boundary. This is train case 2; use only the public Kibi MCP surface."}]
-```

package/commands/init-kibi.md

@@ -1,21 +0,0 @@
----
-name: init-kibi
-description: Bootstrap Kibi knowledge for the current branch using the MCP autopilot workflow
----
-
-# Initialize Kibi
-
-Bootstrap repo-local Kibi memory without editing `.kb/` files directly.
-
-## Workflow
-
-1. Run `kb_autopilot_generate` for read-only synthesis.
-2. Show the preview and get explicit approval before writes.
-3. Apply approved entities with sequential `kb_upsert`.
-4. Finish with `kb_check`.
-
-## Guidance
-
-- Ask at most four bounded context questions when repository evidence is insufficient.
-- Prefer source-linked entities so future `kb_query` lookups can verify context.
-- Keep mutation batches small and reviewable.

package/dist/commands/init-kibi.md

@@ -1,21 +0,0 @@
----
-name: init-kibi
-description: Bootstrap Kibi knowledge for the current branch using the MCP autopilot workflow
----
-
-# Initialize Kibi
-
-Bootstrap repo-local Kibi memory without editing `.kb/` files directly.
-
-## Workflow
-
-1. Run `kb_autopilot_generate` for read-only synthesis.
-2. Show the preview and get explicit approval before writes.
-3. Apply approved entities with sequential `kb_upsert`.
-4. Finish with `kb_check`.
-
-## Guidance
-
-- Ask at most four bounded context questions when repository evidence is insufficient.
-- Prefer source-linked entities so future `kb_query` lookups can verify context.
-- Keep mutation batches small and reviewable.

package/dist/skills/init-kibi/SKILL.md

@@ -1,62 +0,0 @@
----
-id: init-kibi
-name: init-kibi
-description: Bootstrap and model knowledge safely using approved Kibi MCP initialization and mutation workflow.
-version: 1.0.0
-kibiCompatibility: "*"
-tags:
-  - kibi
-  - mcp
-  - bootstrap
-  - agent-guidance
----
-## Goal
-
-Set up or refresh Kibi knowledge for the current branch through approved Kibi interfaces only. Maintain source-file traceability for every repository-backed claim, and require explicit operator approval before any mutation.
-
-## Interface Selection
-
-1. If approved Kibi MCP tools are visible, use the MCP route.
-2. Otherwise, in a trusted workspace, use the canonical project-local CLI fallback: `npx --no-install kibi ...` or `bunx --no-install kibi ...`.
-3. If neither approved MCP tools nor the project-local CLI are available, stop and tell the operator to enable or install Kibi for this workspace.
-4. Never use a global fallback, an installing runner, or any route outside the approved Kibi interface.
-
-Use `kibi-usage/resources/operation-access.md` for the exact operation-to-route mapping. The CLI preview route accepts the same JSON object as `kb_autopilot_generate`:
-
-```bash
-echo '{"maxCandidates":25,"minConfidence":0.8}' | npx --no-install kibi autopilot-generate --input -
-```
-
-## Capability Workflow
-
-- Generate a read-only bootstrap preview with `kb_autopilot_generate`, or the dedicated CLI route `autopilot-generate --input`.
-- Show the generated preview and obtain explicit approval before writes.
-- Apply reviewed entity creation or updates with `kb_upsert`, or `upsert --input`.
-- If cleanup is needed, use `kb_delete`, or `delete --input`, only after checking dependencies and obtaining approval for the specific removal.
-- Finish with `kb_check`, or `check --input`, to validate the branch snapshot.
-
-## Guidance
-
-- Keep mutation requests explicit, small, and sequential.
-- Prefer source-linked entities so future `kb_query` lookups can verify repository context against source files.
-- Preserve traceability by linking facts, claims, scenarios, and tests to concrete project files whenever repository evidence supports it.
-- Do not read or edit files inside `.kb` directly; all changes go through the selected Kibi interface.
-- Ask at most four bounded context questions, and only when repository evidence is insufficient.
-- Stop at the documented operator repair boundary if the setup appears partial, inconsistent, or unsupported by the approved interface.
-
-## Public Training Trajectories
-
-- `init-kibi-bootstrap-analysis-train-1`: Analyze the cold-start repository and produce a read-only bootstrap preview using only the public Kibi MCP surface.
-- `init-kibi-bootstrap-analysis-train-2`: Analyze the cold-start repository and produce a read-only bootstrap preview using only the public Kibi MCP surface.
-- `init-kibi-bounded-context-questions-train-1`: Ask only the bounded context questions needed before bootstrap synthesis using only the public Kibi MCP surface.
-- `init-kibi-bounded-context-questions-train-2`: Ask only the bounded context questions needed before bootstrap synthesis using only the public Kibi MCP surface.
-- `init-kibi-approval-sequential-writes-train-1`: Apply the approved bootstrap plan sequentially and finish with validation using only the public Kibi MCP surface.
-- `init-kibi-approval-sequential-writes-train-2`: Apply the approved bootstrap plan sequentially and finish with validation using only the public Kibi MCP surface.
-- `init-kibi-repair-escalation-train-1`: Identify the partial setup and stop at the documented operator repair boundary using only the public Kibi MCP surface.
-- `init-kibi-repair-escalation-train-2`: Identify the partial setup and stop at the documented operator repair boundary using only the public Kibi MCP surface.
-
-## Training Data
-
-```json
-[{"taskId":"init-kibi-bootstrap-analysis-train-1","family":"bootstrap-analysis","reflection":"Analyze the cold-start repository and produce a read-only bootstrap preview. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-bootstrap-analysis-train-2","family":"bootstrap-analysis","reflection":"Analyze the cold-start repository and produce a read-only bootstrap preview. This is train case 2; use only the public Kibi MCP surface."},{"taskId":"init-kibi-bounded-context-questions-train-1","family":"bounded-context-questions","reflection":"Ask only the bounded context questions needed before bootstrap synthesis. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-bounded-context-questions-train-2","family":"bounded-context-questions","reflection":"Ask only the bounded context questions needed before bootstrap synthesis. This is train case 2; use only the public Kibi MCP surface."},{"taskId":"init-kibi-approval-sequential-writes-train-1","family":"approval-sequential-writes","reflection":"Apply the approved bootstrap plan sequentially and finish with validation. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-approval-sequential-writes-train-2","family":"approval-sequential-writes","reflection":"Apply the approved bootstrap plan sequentially and finish with validation. This is train case 2; use only the public Kibi MCP surface."},{"taskId":"init-kibi-repair-escalation-train-1","family":"repair-escalation","reflection":"Identify the partial setup and stop at the documented operator repair boundary. This is train case 1; use only the public Kibi MCP surface."},{"taskId":"init-kibi-repair-escalation-train-2","family":"repair-escalation","reflection":"Identify the partial setup and stop at the documented operator repair boundary. This is train case 2; use only the public Kibi MCP surface."}]
-```