kibi-cursor 1.0.0 → 1.0.1

package/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kibi-cursor",
   "displayName": "Kibi",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Optional Cursor adapter for Kibi. Requires SWI-Prolog 9+ and project-local kibi-cli, kibi-mcp, and kibi-core before the bundled MCP server can start.",
   "license": "AGPL-3.0-or-later",
   "author": {

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # kibi-cursor
 
+## 1.0.1
+
+### Patch Changes
+
+- Cursor agents now get an always-on CLI recipe when Kibi MCP tools are missing, instead of treating Kibi as unavailable.
+
+  - Put the exact `npx --no-install kibi <route> --input -` command, MCP-to-CLI name mapping, and Shell-approval language in the always-applied workflow rule.
+  - Keep published plugin hooks advisory and untrusted by default; dogfood still opts into `--trusted-workspace` locally.
+  - Document the operator prerequisites (Agent mode, Shell, trusted workspace, project-local CLI) for the fallback to run.
+
 ## 1.0.0
 
 ### Major Changes

package/README.md

@@ -135,6 +135,21 @@ Per the thin-adapter architecture, `kibi-cursor` does not:
 - **Editor-specific value**: Cursor hooks for read/write reminders and session freshness follow-ups
 - **Foundation**: `kibi-core`, `kibi-cli`, and `kibi-mcp` remain required for project-local operations
 
+## CLI fallback when MCP is unavailable
+
+The always-on `kibi-workflow` rule selects the trusted project-local CLI when Kibi MCP tools are not in the tool list. Hooks stay advisory and never execute that CLI themselves.
+
+For the agent to actually run the fallback, the Cursor session needs:
+
+- Agent mode with Shell enabled (Ask mode cannot run the CLI)
+- A trusted workspace, or explicit operator approval of the project-local CLI
+- Project-local `kibi-cli` (use `npx --no-install kibi` or `bunx --no-install kibi`; never a global or installing runner)
+- Plugin rules loaded in the Cursor harness
+
+If MCP tools are visible, use MCP and do not use this CLI path. If Shell is unavailable or the workspace is untrusted, stop and ask the operator; do not probe the CLI.
+
+A Cursor model invoked outside Cursor's plugin harness will not load this rule. Inject the same always-on guidance into that host's system prompt or `AGENTS.md`.
+
 ## License
 
 AGPL-3.0-or-later

package/agent-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "kibi",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Repo-local, per-branch, queryable knowledge base. Portable Agent Plugin packaging Kibi's Agent Skills and MCP server.",
   "author": { "name": "Kibi" },
   "homepage": "https://github.com/Looted/kibi/blob/develop/docs/install.md",

package/agent-plugin/skills/kibi-freshness/SKILL.md

@@ -39,7 +39,7 @@ echo '{}' | npx --no-install kibi status --input -
   matching `branch.json`; a `legacy_compat` attachment is read-only until an
   explicit old/new migration is approved.
 - Inspect bounded `staleReasons` (indexed source missing/newer or documentation
-  source newer) and `verificationSnapshotChanges`. Kibi deliberately reports
+  source newer) and `proofSnapshotChanges`. Kibi deliberately reports
   editor/config paths such as editor dot-directories; do not silently ignore them.
 - Use `kb_query`, or `query --input`, with `sourceFile` and text references for source-linked discovery.
 - Re-run `kb_search`, or `search --input`, after sync gaps or stale context are detected.

package/agent-plugin/skills/kibi-usage/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-usage
 name: Kibi Usage
 description: Use Kibi's source-first, exact-Git, migration-aware, proof-aware operations safely across MCP or the trusted local CLI, including partial completion repair.
-version: 2.1.0
+version: 2.1.1
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -19,6 +19,7 @@ resources:
   - resources/relationship-directions.md
   - resources/fact-lanes.md
   - resources/workflows.md
+  - resources/proof.md
   - resources/ui-requirements.md
   - resources/logic-ir.md
   - resources/kb-improvement.md
@@ -67,13 +68,28 @@ mutability, and Prolog requirements of each operation.
    Kibi never Git-stages or commits those files. Do not read or edit `.kb`
    directly.
 5. Finish with targeted and final `kb_check`, then read status/coverage and
-   state freshness, verification, proof, and limitations separately.
+   report the five independent closeout fields (not one inferred success flag).
 
 Run `kb_check` with specific rules during iteration and the unfiltered final
 check. Never fire `kb_upsert` calls in parallel; create or confirm endpoint
 entities before linking them. The canonical MCP names are `kb_search`,
 `kb_query`, `kb_upsert`, and `kb_check`.
 
+## Closeout fields
+
+End every task with these five independent fields:
+
+```text
+taskOutcome: complete | interim | blocked
+kbState: clean_fresh | stale | dirty | legacy_compat | not_evaluated
+verificationState: fresh | dirty | unavailable | not_evaluated
+proofState: proven | mixed | unresolved | not_evaluated
+limitationDisposition: none | accepted | unaccepted | not_applicable
+```
+
+`taskOutcome` is whether the requested work finished. The other fields are
+observed system state. A clean check can coexist with unresolved proof.
+
 ## Exact Git attachment
 
 The active ref is the exact KB identity. `KIBI_BRANCH` is used verbatim; Git's
@@ -114,22 +130,31 @@ safe normative claims; use `observation` or `meta` for bug/workaround notes and
 `flag` only for actual runtime/config gates. Requirements require scenarios,
 tests, symbol ownership, and fresh proof-bearing receipts before claiming proof.
 For an existing product KB that needs semantic backfill, read
-`resources/kb-improvement.md`.
+`resources/kb-improvement.md`, and `resources/proof.md` for the proof workflow.
 
 ## Predicate Ontology Decision Tree
 
-Call `kb_semantic_advisor`, `kb_model_requirement`, or `kb_suggest_predicates`
-before encoding a normative clause. Use `fact_kind: predicate` with
-`requires_predicate` when a suitable schema exists; use `fact_kind: observation`
-for an ontology gap. Keep the `REQ -> TEST` chain and use `verified_by` for
-proof-bearing links. Relationship direction is fixed, and every `from` in a
-relationship batch must equal the upserted entity ID.
+Call `kb_semantic_advisor` on the complete prose before encoding a clause.
+Set requirement `logic_claims` to exactly the assertive `claim_key` values.
+For each relational clause, call `kb_suggest_predicates` with that clause and
+`existingLogicClaims`. If lexical rank is a false positive, retry with the
+reviewed `schemaId`. If `binding_status` is `incomplete`, supply
+`argumentBindings` and retry. Persist `fact_kind: predicate` with the same
+`claim_key` / `claim_text`, then link `REQ -> fact` with `requires_predicate`.
+Use `kb_model_requirement` for strict scalar clauses. Use
+`fact_kind: observation` only for a true ontology gap. The manifest is not
+grounding: run `logic-coverage` so each key binds to one ground fact.
+Relationship direction is fixed, and every `from` in a relationship batch
+must equal the upserted entity ID.
 
 ## Symbol-First Traceability
 
-Represent implementation ownership with a `symbol` entity and an `implements`
-relationship from the symbol to the requirement. Do not rely on legacy
-`// implements REQ-xxx` comments as the traceability record.
+Represent implementation ownership with a `symbol` entity that has
+`sourceFile`, `implements` to the requirement, and `covered_by` to the test.
+Prolog `symbol-coverage` also requires the test to `validates` the requirement
+(or the requirement `verified_by` the test). `covered_by` alone is not
+enough. Do not rely on legacy `// implements REQ-xxx` comments as the
+traceability record.
 
 ## Complete Logical Coverage
 

package/agent-plugin/skills/kibi-usage/resources/operation-access.md

@@ -26,7 +26,7 @@ per operation. Effects are authoritative for mutability and adapter annotations.
 | `kb_sparql_remote` | `sparql-remote` | --input JSON | read | no | network-read | peer; capability-selected | kibi.kb_sparql_remote.v1 | no | safe | yes | yes |
 | `kb_compile_intent` | `compile-intent` | --input JSON | read | yes | kb-read, workspace-read | peer; capability-selected | kibi.kb_compile_intent.v1 | no | safe | no | yes |
 | `kb_apply_plan` | `apply-plan` | --input JSON | write | yes | kb-read, kb-write, workspace-read, workspace-write | peer; capability-selected | kibi.kb_apply_plan.v1 | yes | unsafe | no | yes |
-| `kb_ingest_verification` | `ingest-verification` | --input JSON | write | yes | kb-read, kb-write, workspace-read | peer; capability-selected | kibi.kb_ingest_verification.v1 | yes | unsafe | no | yes |
+| `kb_ingest_proof` | `ingest-proof` | --input JSON | write | yes | kb-read, kb-write, workspace-read | peer; capability-selected | kibi.kb_ingest_proof.v1 | yes | unsafe | no | yes |
 
 ## JSON execution recipe
 

package/agent-plugin/skills/kibi-usage/resources/proof.md

@@ -0,0 +1,105 @@
+# Proof and Verification Workflow
+
+Use this resource when a requirement must be proven before handoff, when
+wiring a proof-bearing test, or when `kb_ingest_proof` or `kibi prove`
+rejected evidence.
+
+Kibi does not support test runners. Kibi supports proof evidence. Any
+producer (Playwright, pytest, JUnit, TAP, shell commands, database harnesses)
+reports what happened as `kibi.proof-run.v1`; Kibi evaluates proof.
+
+## Golden path
+
+1. Query the test (`kb_query`, `type: test`) and read its
+   `kibi.proof-contract.v1`, `proof_bindings`, and `verification_scope`.
+2. Run the configured producer through the canonical command:
+
+   ```bash
+   kibi prove --test TEST-<id>
+   # or: kibi prove --requirement REQ-<id> | --integration <id> | --all
+   ```
+
+   `kibi prove` captures the workspace snapshot, runs each integration's
+   producer once (`shell: false`), revalidates the snapshot, evaluates the
+   artifact against every selected contract, and appends idempotent
+   `kibi.proof-receipt.v1` receipts.
+3. Confirm with `kb_status` (fresh, current snapshot) and `kb_coverage`.
+
+Never hand-write receipts. Kibi derives them from validated
+`kibi.proof-run.v1` artifacts only.
+
+## Proof contracts
+
+A proof-bearing test declares explicit obligations (never a Cartesian
+cases-times-projects matrix):
+
+```yaml
+verification_scope: end_to_end
+verification_perspective: consumer
+proof_contract:
+  version: kibi.proof-contract.v1
+  integration: web-e2e          # id from .kb/proof/integrations.json
+  required_proofs:
+    - symbol_id: SYM-PW-4F2A9C61B7D03E85
+      target: chromium          # browser, runtime, db, device, or default
+  success_policy: all_required_first_attempt
+proof_bindings:                 # optional provenance metadata
+  - symbol_id: SYM-PW-4F2A9C61B7D03E85
+    target: chromium
+    native_id: tests/checkout.spec.ts::accepts a card
+```
+
+Provenance lives in `proof_bindings`; the contract stays semantic.
+
+## Integration configuration
+
+`.kb/proof/integrations.json` (`kibi.proof-integration.v1`) is tracked,
+Kibi-managed configuration describing evidence production only:
+
+- `producer: command` — Kibi synthesizes the envelope from the process
+  outcome; obligations are bound with `aggregate_run` provenance and the
+  single process invocation counts as the known first attempt.
+- `producer: playwright` (or custom) — the child emits `kibi.proof-run.v1`
+  itself (bundled reporter: `kibi-cli/playwright-reporter`).
+- `producer: junit` / `tap` — Kibi converts the native report at `artifact`
+  using each test's `proof_bindings`; standard formats carry no retry
+  history, so attempts are reported as `unavailable` and fail the strict
+  first-attempt policy closed.
+
+Cosmetic edits (descriptions, labels) never stale proof. Execution-relevant
+edits (command, artifact, targets, options, bindings, contract) change the
+effective fingerprint and do.
+
+## Attempt semantics (factual, never optimistic)
+
+- `attempts: {status: "complete", entries: [...]}` — known history; the
+  strict policy requires a passing **first** entry.
+- `attempts: {status: "unavailable"}` — unknown native history; the strict
+  policy fails closed, except `aggregate_run` results, which are satisfied by
+  the Kibi-launched process attempt when the run passed with exit code 0.
+- `run.outcome` is authoritative: a failed, errored, cancelled, interrupted,
+  or `no_results` run proves nothing, even with passing individual results.
+
+## Common rejections
+
+- `No proof integration configuration` — bootstrap has not configured proof
+  for this repository yet; do not hand-wave, run the bootstrap proof step.
+- `captured snapshot is not the live workspace snapshot` — the tree changed
+  between capture and ingest; re-run `kibi prove`.
+- `artifact command_argv does not match the configured command` — the
+  artifact came from a different command than `integrations.json` configures.
+- `attempt history unavailable` — the producer could not prove first-attempt
+  success for a native-case obligation; use a producer with complete history
+  or accept aggregate provenance.
+- `proof_receipts is append-only` — receipts are append-only; update tests
+  through the engine (which appends) or include the existing history when
+  authoring test files directly.
+
+## After code changes
+
+Receipts bind to the snapshot, contract hash, and execution fingerprint at
+run time. Any code or source change moves the snapshot and stales receipts:
+re-run `kibi prove` for the affected selection, then confirm `kb_status` and
+`kb_coverage` before handoff.
+
+Full reference: `docs/proving-requirements.md`.

package/agent-plugin/skills/kibi-usage/resources/workflows.md

@@ -25,7 +25,7 @@ Receipt reuse is safe only when the live verification snapshot, contract hash,
 freshness window, and every required case result still match. Otherwise rerun
 the contracted command. If the contract changed, retain every older receipt
 unchanged, append evidence for the current contract, and keep proof unresolved
-with `verification_contract_mismatch` until that current receipt exists.
+with `proof_contract_mismatch` until that current receipt exists.
 Obsolete symbols require current extraction or Git evidence before
 remap/deletion; transfer coverage only when existing test evidence supports it,
 then sync and read back status. Same-version packages with different export
@@ -46,7 +46,7 @@ The canonical workflow for any KB operation follows this pattern:
 7. **Create endpoints**: validated `kb_upsert` for new entities, sequentially
 8. **Link**: validated `kb_upsert` with `requires_rule`, `requires_predicate`, `constrains`, or `requires_property`, sequentially
 9. **Validate coverage and consistency**: targeted `rule-safety`, `rule-verifiability`, `semantic-completeness`, `logic-coverage`, `predicate-verifiability`, and `domain-contradictions`, then final full `kb_check`
-10. **Prove execution**: read `kb_status.verificationSnapshot`, run each scenario-backed E2E command exactly as declared by its `verification_contract.v1` through `kibi verify`, append the derived `kibi.verification-receipt.v2`, and re-run `kb_coverage`; never promote durable test status into fresh evidence
+10. **Prove execution**: read `kb_status.proofSnapshot`, run `kibi prove` so each configured integration executes once and its `kibi.proof-run.v1` artifact is evaluated against every selected test's `kibi.proof-contract.v1` obligations, appending idempotent `kibi.proof-receipt.v1` receipts; then re-run `kb_coverage`. Never promote durable test status into fresh evidence.
 11. **Repair incrementally**: require `kb_coverage.repairPlan.scope.complete`, apply only one `ready` dependency batch per requirement, validate before every sequential write, and rerun coverage before selecting the next batch
 12. **Gate workflow evidence**: when `.kb/usage.log` exists, run `kibi usage-metrics --format json --require-acceptance`; repair ranked telemetry diagnostics and never treat stale or insufficient evidence as a pass
 
@@ -74,7 +74,7 @@ choose package managers, ground semantic claims, resolve contradictions, rerun
 E2E tests, rewrite receipt history, remap authored symbols, or accept
 limitations. Those actions remain explicit review/operator/execution steps.
 
-For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run its exact current contract through `kibi verify`; this appends v2 evidence and preserves older history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
+For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run `kibi prove --requirement <id>` (or the covering integration); this appends proof receipts idempotently and preserves history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
 
 ## Creating a New Feature
 ```
@@ -101,12 +101,12 @@ Do not create a test-fact pair. Facts describe invariants; requirements or scena
 ## Fresh E2E Receipt Workflow
 
 1. Confirm the exact `REQ -> SCEN -> TEST` path and require typed `verification_scope: end_to_end`; direct requirement-to-test links do not satisfy the conservative scenario stage.
-2. Read `kb_status` and retain its available `verificationSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
+2. Read `kb_status` and retain its available `proofSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
 3. Run the exact E2E command against that snapshot. Record runner, command, start/finish timestamps, outcome, an environment SHA-256, and an artifact/output SHA-256. Do not mint a passed receipt from an authored test status or from an unexecuted assertion.
-4. Preserve every existing receipt byte-for-byte and append the derived `kibi.verification-receipt.v2` object with strictly later `finished_at`. Earlier receipts may bind older contracts; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
+4. Preserve every existing receipt byte-for-byte and append the derived `kibi.proof-receipt.v1` object with strictly later `finished_at`. Earlier receipts may bind older contracts or fingerprints; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
 5. Re-read `kb_status`; if the snapshot changed during the run, discard the candidate as proof and rerun against the new snapshot. Then run `kb_coverage` and inspect `proofStages.passingE2e.receiptEvidence` plus gap codes.
 
-Only the newest receipt matching both the live snapshot and current contract qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_verification_receipt`, `stale_verification_receipt`, `failed_verification_receipt`, `invalid_verification_receipt`, `verification_contract_mismatch`, and `verification_snapshot_unavailable` are repair states, not warnings to waive.
+Only the newest receipt matching the live snapshot, current contract hash, and current execution fingerprint qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_proof_receipt`, `stale_proof_receipt`, `failed_proof_receipt`, `invalid_proof_receipt`, `proof_contract_mismatch`, and `proof_snapshot_unavailable` are repair states, not warnings to waive.
 
 ## Predicate-First Requirement Modeling
 

package/dist/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kibi-cursor",
   "displayName": "Kibi",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Optional Cursor adapter for Kibi. Requires SWI-Prolog 9+ and project-local kibi-cli, kibi-mcp, and kibi-core before the bundled MCP server can start.",
   "license": "AGPL-3.0-or-later",
   "author": {

package/dist/rules/kibi-workflow.mdc

@@ -3,7 +3,22 @@ description: Kibi capability-based discovery-first workflow and KB mutation disc
 alwaysApply: true
 ---
 
-Use Kibi via MCP tools when available, or via CLI JSON routes when MCP is unavailable. If MCP tools are visible, use MCP. If MCP availability is unknown and a trusted project-local CLI is available, use `kibi <route> --input <file|->`. If neither interface is available, stop and tell the operator. Do not infer MCP availability from config file existence. Do not read or edit `.kb/` files directly.
+Use Kibi via MCP tools when available, or via CLI JSON routes when MCP is unavailable.
+
+Interface selection:
+1. If any `kb_*` or `kibi_kb_*` tool is in the tool list, use MCP only. Do not use the CLI path.
+2. Else if Shell (or equivalent) is available and the project-local CLI is trusted, run the non-installing JSON recipe below. Missing MCP tools does not mean Kibi is unavailable.
+3. Else stop and tell the operator. Do not probe the CLI, do not install packages, and do not infer MCP availability from config file existence.
+4. Shell is in-policy only for the trusted project-local `npx --no-install kibi ...` (or `bunx --no-install kibi ...`) command when step 2 applies.
+5. Never use a global fallback, an installing runner, or an unapproved route. Do not read or edit `.kb/` files directly.
+
+CLI JSON recipe (stdin is one UTF-8 JSON object):
+
+```bash
+printf '%s\n' '{"query":"checkout","limit":10}' | npx --no-install kibi search --input -
+```
+
+Map canonical MCP names to CLI routes by dropping the `kb_` prefix and replacing `_` with `-` (`kb_search` → `search`, `kb_find_gaps` → `find-gaps`, `kb_query` → `query`, `kb_status` → `status`, `kb_check` → `check`, `kb_upsert` → `upsert`).
 
 Discovery workflow:
 - Start with `kb_search` for broad discovery.

package/dist/skills/.canon-hash.json

@@ -4,7 +4,7 @@
   "kibi-bootstrap/resources/branch-lifecycle.md": "c854264ce888439140883a3fc636db5e522f020dd27b30a5c1ecc4105b64ed13",
   "kibi-bootstrap/resources/operation-access.md": "b5a6a59e72d800c376e7fad79132897623c32a0ce152a1e8d73f9628b444db51",
   "kibi-bootstrap/resources/source-authoring.md": "bf296e62f69474e01797d6cb9469bf624551dca834dd188abb6e705bd96fa586",
-  "kibi-freshness/SKILL.md": "67c3eda1c7c12bbbc320e84119bd7a179d2dfc0189964d2f052e032b21a8af10",
+  "kibi-freshness/SKILL.md": "fa90d34663ddd6f03468008fb26e4417211f7b7d46ffde082291747743464c54",
   "kibi-freshness/resources/branch-lifecycle.md": "ebc01b19fe3dca8df5fc0175978963f6f1204f71f7c805cb2a5fb1b277ac78e4",
   "kibi-freshness/resources/operation-access.md": "4e1db9294ee540cd29b8b3a2532a81e7894d5b4228b39e99ba48b37212f489f3",
   "kibi-freshness/resources/source-authoring.md": "41a0547ce4d2a112a0f3671d36720f07c447864db3b473e94eb88a8ce2d371ff",
@@ -13,14 +13,15 @@
   "kibi-traceability/resources/operation-access.md": "39f7972ab7f4ae7479e78f7072bb50e8e6c4cdf4f857425f69d2522d37db437c",
   "kibi-traceability/resources/source-authoring.md": "408c6ee2bef1b84e0194c0538ef929c26a0a617e631b2234247388140dbbdd08",
   "kibi-traceability/resources/traceability.md": "38c290a0bc71bd1692e115f22694743946e2f69630e134acfd43cee5f613fb88",
-  "kibi-usage/SKILL.md": "3d347a430cb8be2017df34d22d151355abc5083173988dafb4c8433ee81281da",
+  "kibi-usage/SKILL.md": "ed42d8f6caf8048b81c05f670018c5f341e0667e3fa4aff2bf11277e9deb3c2f",
   "kibi-usage/resources/branch-lifecycle.md": "f1bf359e9826e83c548f3cd0287f8175a62456527b0132b06b3f9f74aa59b7d6",
   "kibi-usage/resources/fact-lanes.md": "41b28023a57593009867ea0ebc8e9f3f05c3bd837144772d12844423f922e763",
   "kibi-usage/resources/kb-improvement.md": "17e8b6cf6a0dd43b443a2bfd92e7205d099647a5f1c75fe85413a6cea63d86c6",
   "kibi-usage/resources/logic-ir.md": "151675d0ffa813cb9e271084102a3af42de369b8f9a0c64866af0cdc4d924063",
-  "kibi-usage/resources/operation-access.md": "b33c5be8cab5c27dfa68b7655fad8a52cead6d3adacd2488f1779a1176007fbf",
+  "kibi-usage/resources/operation-access.md": "e8b4a3676892d2f7e2cfd708ec4ad1f41b6f296e1eb3a5ecc047f43322b4a92a",
+  "kibi-usage/resources/proof.md": "e1a44ea4bf342afebb0aaa7800221067a511f6607c687ac38db6392b7e3d9f9a",
   "kibi-usage/resources/relationship-directions.md": "a357072d3370db9b7d80e505795f952909a68778cc18b1d089970de91e4fda46",
   "kibi-usage/resources/source-authoring.md": "ac4f1a9b5785462f8c3530bdcdb82ad9a0ee1f4049454ae28bf4df09ff267ebd",
   "kibi-usage/resources/ui-requirements.md": "b7c31ab1affa3ab25ae5242d8fd8c4d546532d1cafc65d84088375317c1682cc",
-  "kibi-usage/resources/workflows.md": "1c6b8a2c40d3a3c3f4bdfe9165b3dae4a669b8ddb7808be9ff5b670cecceded8"
+  "kibi-usage/resources/workflows.md": "776b97a794325e7012a230d2b9fc32fc89b2a51df45dfd8498cad49170bdc43d"
 }

package/dist/skills/kibi-freshness/SKILL.md

@@ -39,7 +39,7 @@ echo '{}' | npx --no-install kibi status --input -
   matching `branch.json`; a `legacy_compat` attachment is read-only until an
   explicit old/new migration is approved.
 - Inspect bounded `staleReasons` (indexed source missing/newer or documentation
-  source newer) and `verificationSnapshotChanges`. Kibi deliberately reports
+  source newer) and `proofSnapshotChanges`. Kibi deliberately reports
   editor/config paths such as editor dot-directories; do not silently ignore them.
 - Use `kb_query`, or `query --input`, with `sourceFile` and text references for source-linked discovery.
 - Re-run `kb_search`, or `search --input`, after sync gaps or stale context are detected.

package/dist/skills/kibi-usage/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-usage
 name: Kibi Usage
 description: Use Kibi's source-first, exact-Git, migration-aware, proof-aware operations safely across MCP or the trusted local CLI, including partial completion repair.
-version: 2.1.0
+version: 2.1.1
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -19,6 +19,7 @@ resources:
   - resources/relationship-directions.md
   - resources/fact-lanes.md
   - resources/workflows.md
+  - resources/proof.md
   - resources/ui-requirements.md
   - resources/logic-ir.md
   - resources/kb-improvement.md
@@ -67,13 +68,28 @@ mutability, and Prolog requirements of each operation.
    Kibi never Git-stages or commits those files. Do not read or edit `.kb`
    directly.
 5. Finish with targeted and final `kb_check`, then read status/coverage and
-   state freshness, verification, proof, and limitations separately.
+   report the five independent closeout fields (not one inferred success flag).
 
 Run `kb_check` with specific rules during iteration and the unfiltered final
 check. Never fire `kb_upsert` calls in parallel; create or confirm endpoint
 entities before linking them. The canonical MCP names are `kb_search`,
 `kb_query`, `kb_upsert`, and `kb_check`.
 
+## Closeout fields
+
+End every task with these five independent fields:
+
+```text
+taskOutcome: complete | interim | blocked
+kbState: clean_fresh | stale | dirty | legacy_compat | not_evaluated
+verificationState: fresh | dirty | unavailable | not_evaluated
+proofState: proven | mixed | unresolved | not_evaluated
+limitationDisposition: none | accepted | unaccepted | not_applicable
+```
+
+`taskOutcome` is whether the requested work finished. The other fields are
+observed system state. A clean check can coexist with unresolved proof.
+
 ## Exact Git attachment
 
 The active ref is the exact KB identity. `KIBI_BRANCH` is used verbatim; Git's
@@ -114,22 +130,31 @@ safe normative claims; use `observation` or `meta` for bug/workaround notes and
 `flag` only for actual runtime/config gates. Requirements require scenarios,
 tests, symbol ownership, and fresh proof-bearing receipts before claiming proof.
 For an existing product KB that needs semantic backfill, read
-`resources/kb-improvement.md`.
+`resources/kb-improvement.md`, and `resources/proof.md` for the proof workflow.
 
 ## Predicate Ontology Decision Tree
 
-Call `kb_semantic_advisor`, `kb_model_requirement`, or `kb_suggest_predicates`
-before encoding a normative clause. Use `fact_kind: predicate` with
-`requires_predicate` when a suitable schema exists; use `fact_kind: observation`
-for an ontology gap. Keep the `REQ -> TEST` chain and use `verified_by` for
-proof-bearing links. Relationship direction is fixed, and every `from` in a
-relationship batch must equal the upserted entity ID.
+Call `kb_semantic_advisor` on the complete prose before encoding a clause.
+Set requirement `logic_claims` to exactly the assertive `claim_key` values.
+For each relational clause, call `kb_suggest_predicates` with that clause and
+`existingLogicClaims`. If lexical rank is a false positive, retry with the
+reviewed `schemaId`. If `binding_status` is `incomplete`, supply
+`argumentBindings` and retry. Persist `fact_kind: predicate` with the same
+`claim_key` / `claim_text`, then link `REQ -> fact` with `requires_predicate`.
+Use `kb_model_requirement` for strict scalar clauses. Use
+`fact_kind: observation` only for a true ontology gap. The manifest is not
+grounding: run `logic-coverage` so each key binds to one ground fact.
+Relationship direction is fixed, and every `from` in a relationship batch
+must equal the upserted entity ID.
 
 ## Symbol-First Traceability
 
-Represent implementation ownership with a `symbol` entity and an `implements`
-relationship from the symbol to the requirement. Do not rely on legacy
-`// implements REQ-xxx` comments as the traceability record.
+Represent implementation ownership with a `symbol` entity that has
+`sourceFile`, `implements` to the requirement, and `covered_by` to the test.
+Prolog `symbol-coverage` also requires the test to `validates` the requirement
+(or the requirement `verified_by` the test). `covered_by` alone is not
+enough. Do not rely on legacy `// implements REQ-xxx` comments as the
+traceability record.
 
 ## Complete Logical Coverage
 

package/dist/skills/kibi-usage/resources/operation-access.md

@@ -26,7 +26,7 @@ per operation. Effects are authoritative for mutability and adapter annotations.
 | `kb_sparql_remote` | `sparql-remote` | --input JSON | read | no | network-read | peer; capability-selected | kibi.kb_sparql_remote.v1 | no | safe | yes | yes |
 | `kb_compile_intent` | `compile-intent` | --input JSON | read | yes | kb-read, workspace-read | peer; capability-selected | kibi.kb_compile_intent.v1 | no | safe | no | yes |
 | `kb_apply_plan` | `apply-plan` | --input JSON | write | yes | kb-read, kb-write, workspace-read, workspace-write | peer; capability-selected | kibi.kb_apply_plan.v1 | yes | unsafe | no | yes |
-| `kb_ingest_verification` | `ingest-verification` | --input JSON | write | yes | kb-read, kb-write, workspace-read | peer; capability-selected | kibi.kb_ingest_verification.v1 | yes | unsafe | no | yes |
+| `kb_ingest_proof` | `ingest-proof` | --input JSON | write | yes | kb-read, kb-write, workspace-read | peer; capability-selected | kibi.kb_ingest_proof.v1 | yes | unsafe | no | yes |
 
 ## JSON execution recipe
 

package/dist/skills/kibi-usage/resources/proof.md

@@ -0,0 +1,105 @@
+# Proof and Verification Workflow
+
+Use this resource when a requirement must be proven before handoff, when
+wiring a proof-bearing test, or when `kb_ingest_proof` or `kibi prove`
+rejected evidence.
+
+Kibi does not support test runners. Kibi supports proof evidence. Any
+producer (Playwright, pytest, JUnit, TAP, shell commands, database harnesses)
+reports what happened as `kibi.proof-run.v1`; Kibi evaluates proof.
+
+## Golden path
+
+1. Query the test (`kb_query`, `type: test`) and read its
+   `kibi.proof-contract.v1`, `proof_bindings`, and `verification_scope`.
+2. Run the configured producer through the canonical command:
+
+   ```bash
+   kibi prove --test TEST-<id>
+   # or: kibi prove --requirement REQ-<id> | --integration <id> | --all
+   ```
+
+   `kibi prove` captures the workspace snapshot, runs each integration's
+   producer once (`shell: false`), revalidates the snapshot, evaluates the
+   artifact against every selected contract, and appends idempotent
+   `kibi.proof-receipt.v1` receipts.
+3. Confirm with `kb_status` (fresh, current snapshot) and `kb_coverage`.
+
+Never hand-write receipts. Kibi derives them from validated
+`kibi.proof-run.v1` artifacts only.
+
+## Proof contracts
+
+A proof-bearing test declares explicit obligations (never a Cartesian
+cases-times-projects matrix):
+
+```yaml
+verification_scope: end_to_end
+verification_perspective: consumer
+proof_contract:
+  version: kibi.proof-contract.v1
+  integration: web-e2e          # id from .kb/proof/integrations.json
+  required_proofs:
+    - symbol_id: SYM-PW-4F2A9C61B7D03E85
+      target: chromium          # browser, runtime, db, device, or default
+  success_policy: all_required_first_attempt
+proof_bindings:                 # optional provenance metadata
+  - symbol_id: SYM-PW-4F2A9C61B7D03E85
+    target: chromium
+    native_id: tests/checkout.spec.ts::accepts a card
+```
+
+Provenance lives in `proof_bindings`; the contract stays semantic.
+
+## Integration configuration
+
+`.kb/proof/integrations.json` (`kibi.proof-integration.v1`) is tracked,
+Kibi-managed configuration describing evidence production only:
+
+- `producer: command` — Kibi synthesizes the envelope from the process
+  outcome; obligations are bound with `aggregate_run` provenance and the
+  single process invocation counts as the known first attempt.
+- `producer: playwright` (or custom) — the child emits `kibi.proof-run.v1`
+  itself (bundled reporter: `kibi-cli/playwright-reporter`).
+- `producer: junit` / `tap` — Kibi converts the native report at `artifact`
+  using each test's `proof_bindings`; standard formats carry no retry
+  history, so attempts are reported as `unavailable` and fail the strict
+  first-attempt policy closed.
+
+Cosmetic edits (descriptions, labels) never stale proof. Execution-relevant
+edits (command, artifact, targets, options, bindings, contract) change the
+effective fingerprint and do.
+
+## Attempt semantics (factual, never optimistic)
+
+- `attempts: {status: "complete", entries: [...]}` — known history; the
+  strict policy requires a passing **first** entry.
+- `attempts: {status: "unavailable"}` — unknown native history; the strict
+  policy fails closed, except `aggregate_run` results, which are satisfied by
+  the Kibi-launched process attempt when the run passed with exit code 0.
+- `run.outcome` is authoritative: a failed, errored, cancelled, interrupted,
+  or `no_results` run proves nothing, even with passing individual results.
+
+## Common rejections
+
+- `No proof integration configuration` — bootstrap has not configured proof
+  for this repository yet; do not hand-wave, run the bootstrap proof step.
+- `captured snapshot is not the live workspace snapshot` — the tree changed
+  between capture and ingest; re-run `kibi prove`.
+- `artifact command_argv does not match the configured command` — the
+  artifact came from a different command than `integrations.json` configures.
+- `attempt history unavailable` — the producer could not prove first-attempt
+  success for a native-case obligation; use a producer with complete history
+  or accept aggregate provenance.
+- `proof_receipts is append-only` — receipts are append-only; update tests
+  through the engine (which appends) or include the existing history when
+  authoring test files directly.
+
+## After code changes
+
+Receipts bind to the snapshot, contract hash, and execution fingerprint at
+run time. Any code or source change moves the snapshot and stales receipts:
+re-run `kibi prove` for the affected selection, then confirm `kb_status` and
+`kb_coverage` before handoff.
+
+Full reference: `docs/proving-requirements.md`.

package/dist/skills/kibi-usage/resources/workflows.md

@@ -25,7 +25,7 @@ Receipt reuse is safe only when the live verification snapshot, contract hash,
 freshness window, and every required case result still match. Otherwise rerun
 the contracted command. If the contract changed, retain every older receipt
 unchanged, append evidence for the current contract, and keep proof unresolved
-with `verification_contract_mismatch` until that current receipt exists.
+with `proof_contract_mismatch` until that current receipt exists.
 Obsolete symbols require current extraction or Git evidence before
 remap/deletion; transfer coverage only when existing test evidence supports it,
 then sync and read back status. Same-version packages with different export
@@ -46,7 +46,7 @@ The canonical workflow for any KB operation follows this pattern:
 7. **Create endpoints**: validated `kb_upsert` for new entities, sequentially
 8. **Link**: validated `kb_upsert` with `requires_rule`, `requires_predicate`, `constrains`, or `requires_property`, sequentially
 9. **Validate coverage and consistency**: targeted `rule-safety`, `rule-verifiability`, `semantic-completeness`, `logic-coverage`, `predicate-verifiability`, and `domain-contradictions`, then final full `kb_check`
-10. **Prove execution**: read `kb_status.verificationSnapshot`, run each scenario-backed E2E command exactly as declared by its `verification_contract.v1` through `kibi verify`, append the derived `kibi.verification-receipt.v2`, and re-run `kb_coverage`; never promote durable test status into fresh evidence
+10. **Prove execution**: read `kb_status.proofSnapshot`, run `kibi prove` so each configured integration executes once and its `kibi.proof-run.v1` artifact is evaluated against every selected test's `kibi.proof-contract.v1` obligations, appending idempotent `kibi.proof-receipt.v1` receipts; then re-run `kb_coverage`. Never promote durable test status into fresh evidence.
 11. **Repair incrementally**: require `kb_coverage.repairPlan.scope.complete`, apply only one `ready` dependency batch per requirement, validate before every sequential write, and rerun coverage before selecting the next batch
 12. **Gate workflow evidence**: when `.kb/usage.log` exists, run `kibi usage-metrics --format json --require-acceptance`; repair ranked telemetry diagnostics and never treat stale or insufficient evidence as a pass
 
@@ -74,7 +74,7 @@ choose package managers, ground semantic claims, resolve contradictions, rerun
 E2E tests, rewrite receipt history, remap authored symbols, or accept
 limitations. Those actions remain explicit review/operator/execution steps.
 
-For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run its exact current contract through `kibi verify`; this appends v2 evidence and preserves older history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
+For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run `kibi prove --requirement <id>` (or the covering integration); this appends proof receipts idempotently and preserves history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
 
 ## Creating a New Feature
 ```
@@ -101,12 +101,12 @@ Do not create a test-fact pair. Facts describe invariants; requirements or scena
 ## Fresh E2E Receipt Workflow
 
 1. Confirm the exact `REQ -> SCEN -> TEST` path and require typed `verification_scope: end_to_end`; direct requirement-to-test links do not satisfy the conservative scenario stage.
-2. Read `kb_status` and retain its available `verificationSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
+2. Read `kb_status` and retain its available `proofSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
 3. Run the exact E2E command against that snapshot. Record runner, command, start/finish timestamps, outcome, an environment SHA-256, and an artifact/output SHA-256. Do not mint a passed receipt from an authored test status or from an unexecuted assertion.
-4. Preserve every existing receipt byte-for-byte and append the derived `kibi.verification-receipt.v2` object with strictly later `finished_at`. Earlier receipts may bind older contracts; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
+4. Preserve every existing receipt byte-for-byte and append the derived `kibi.proof-receipt.v1` object with strictly later `finished_at`. Earlier receipts may bind older contracts or fingerprints; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
 5. Re-read `kb_status`; if the snapshot changed during the run, discard the candidate as proof and rerun against the new snapshot. Then run `kb_coverage` and inspect `proofStages.passingE2e.receiptEvidence` plus gap codes.
 
-Only the newest receipt matching both the live snapshot and current contract qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_verification_receipt`, `stale_verification_receipt`, `failed_verification_receipt`, `invalid_verification_receipt`, `verification_contract_mismatch`, and `verification_snapshot_unavailable` are repair states, not warnings to waive.
+Only the newest receipt matching the live snapshot, current contract hash, and current execution fingerprint qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_proof_receipt`, `stale_proof_receipt`, `failed_proof_receipt`, `invalid_proof_receipt`, `proof_contract_mismatch`, and `proof_snapshot_unavailable` are repair states, not warnings to waive.
 
 ## Predicate-First Requirement Modeling
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kibi-cursor",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Kibi Cursor plugin - thin adapter for Cursor MCP integration and editor hooks",
   "type": "module",
   "main": "dist/index.js",

package/rules/kibi-workflow.mdc

@@ -3,7 +3,22 @@ description: Kibi capability-based discovery-first workflow and KB mutation disc
 alwaysApply: true
 ---
 
-Use Kibi via MCP tools when available, or via CLI JSON routes when MCP is unavailable. If MCP tools are visible, use MCP. If MCP availability is unknown and a trusted project-local CLI is available, use `kibi <route> --input <file|->`. If neither interface is available, stop and tell the operator. Do not infer MCP availability from config file existence. Do not read or edit `.kb/` files directly.
+Use Kibi via MCP tools when available, or via CLI JSON routes when MCP is unavailable.
+
+Interface selection:
+1. If any `kb_*` or `kibi_kb_*` tool is in the tool list, use MCP only. Do not use the CLI path.
+2. Else if Shell (or equivalent) is available and the project-local CLI is trusted, run the non-installing JSON recipe below. Missing MCP tools does not mean Kibi is unavailable.
+3. Else stop and tell the operator. Do not probe the CLI, do not install packages, and do not infer MCP availability from config file existence.
+4. Shell is in-policy only for the trusted project-local `npx --no-install kibi ...` (or `bunx --no-install kibi ...`) command when step 2 applies.
+5. Never use a global fallback, an installing runner, or an unapproved route. Do not read or edit `.kb/` files directly.
+
+CLI JSON recipe (stdin is one UTF-8 JSON object):
+
+```bash
+printf '%s\n' '{"query":"checkout","limit":10}' | npx --no-install kibi search --input -
+```
+
+Map canonical MCP names to CLI routes by dropping the `kb_` prefix and replacing `_` with `-` (`kb_search` → `search`, `kb_find_gaps` → `find-gaps`, `kb_query` → `query`, `kb_status` → `status`, `kb_check` → `check`, `kb_upsert` → `upsert`).
 
 Discovery workflow:
 - Start with `kb_search` for broad discovery.

package/skills/.canon-hash.json

@@ -4,7 +4,7 @@
   "kibi-bootstrap/resources/branch-lifecycle.md": "c854264ce888439140883a3fc636db5e522f020dd27b30a5c1ecc4105b64ed13",
   "kibi-bootstrap/resources/operation-access.md": "b5a6a59e72d800c376e7fad79132897623c32a0ce152a1e8d73f9628b444db51",
   "kibi-bootstrap/resources/source-authoring.md": "bf296e62f69474e01797d6cb9469bf624551dca834dd188abb6e705bd96fa586",
-  "kibi-freshness/SKILL.md": "67c3eda1c7c12bbbc320e84119bd7a179d2dfc0189964d2f052e032b21a8af10",
+  "kibi-freshness/SKILL.md": "fa90d34663ddd6f03468008fb26e4417211f7b7d46ffde082291747743464c54",
   "kibi-freshness/resources/branch-lifecycle.md": "ebc01b19fe3dca8df5fc0175978963f6f1204f71f7c805cb2a5fb1b277ac78e4",
   "kibi-freshness/resources/operation-access.md": "4e1db9294ee540cd29b8b3a2532a81e7894d5b4228b39e99ba48b37212f489f3",
   "kibi-freshness/resources/source-authoring.md": "41a0547ce4d2a112a0f3671d36720f07c447864db3b473e94eb88a8ce2d371ff",
@@ -13,14 +13,15 @@
   "kibi-traceability/resources/operation-access.md": "39f7972ab7f4ae7479e78f7072bb50e8e6c4cdf4f857425f69d2522d37db437c",
   "kibi-traceability/resources/source-authoring.md": "408c6ee2bef1b84e0194c0538ef929c26a0a617e631b2234247388140dbbdd08",
   "kibi-traceability/resources/traceability.md": "38c290a0bc71bd1692e115f22694743946e2f69630e134acfd43cee5f613fb88",
-  "kibi-usage/SKILL.md": "3d347a430cb8be2017df34d22d151355abc5083173988dafb4c8433ee81281da",
+  "kibi-usage/SKILL.md": "ed42d8f6caf8048b81c05f670018c5f341e0667e3fa4aff2bf11277e9deb3c2f",
   "kibi-usage/resources/branch-lifecycle.md": "f1bf359e9826e83c548f3cd0287f8175a62456527b0132b06b3f9f74aa59b7d6",
   "kibi-usage/resources/fact-lanes.md": "41b28023a57593009867ea0ebc8e9f3f05c3bd837144772d12844423f922e763",
   "kibi-usage/resources/kb-improvement.md": "17e8b6cf6a0dd43b443a2bfd92e7205d099647a5f1c75fe85413a6cea63d86c6",
   "kibi-usage/resources/logic-ir.md": "151675d0ffa813cb9e271084102a3af42de369b8f9a0c64866af0cdc4d924063",
-  "kibi-usage/resources/operation-access.md": "b33c5be8cab5c27dfa68b7655fad8a52cead6d3adacd2488f1779a1176007fbf",
+  "kibi-usage/resources/operation-access.md": "e8b4a3676892d2f7e2cfd708ec4ad1f41b6f296e1eb3a5ecc047f43322b4a92a",
+  "kibi-usage/resources/proof.md": "e1a44ea4bf342afebb0aaa7800221067a511f6607c687ac38db6392b7e3d9f9a",
   "kibi-usage/resources/relationship-directions.md": "a357072d3370db9b7d80e505795f952909a68778cc18b1d089970de91e4fda46",
   "kibi-usage/resources/source-authoring.md": "ac4f1a9b5785462f8c3530bdcdb82ad9a0ee1f4049454ae28bf4df09ff267ebd",
   "kibi-usage/resources/ui-requirements.md": "b7c31ab1affa3ab25ae5242d8fd8c4d546532d1cafc65d84088375317c1682cc",
-  "kibi-usage/resources/workflows.md": "1c6b8a2c40d3a3c3f4bdfe9165b3dae4a669b8ddb7808be9ff5b670cecceded8"
+  "kibi-usage/resources/workflows.md": "776b97a794325e7012a230d2b9fc32fc89b2a51df45dfd8498cad49170bdc43d"
 }

package/skills/kibi-freshness/SKILL.md

@@ -39,7 +39,7 @@ echo '{}' | npx --no-install kibi status --input -
   matching `branch.json`; a `legacy_compat` attachment is read-only until an
   explicit old/new migration is approved.
 - Inspect bounded `staleReasons` (indexed source missing/newer or documentation
-  source newer) and `verificationSnapshotChanges`. Kibi deliberately reports
+  source newer) and `proofSnapshotChanges`. Kibi deliberately reports
   editor/config paths such as editor dot-directories; do not silently ignore them.
 - Use `kb_query`, or `query --input`, with `sourceFile` and text references for source-linked discovery.
 - Re-run `kb_search`, or `search --input`, after sync gaps or stale context are detected.

package/skills/kibi-usage/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-usage
 name: Kibi Usage
 description: Use Kibi's source-first, exact-Git, migration-aware, proof-aware operations safely across MCP or the trusted local CLI, including partial completion repair.
-version: 2.1.0
+version: 2.1.1
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -19,6 +19,7 @@ resources:
   - resources/relationship-directions.md
   - resources/fact-lanes.md
   - resources/workflows.md
+  - resources/proof.md
   - resources/ui-requirements.md
   - resources/logic-ir.md
   - resources/kb-improvement.md
@@ -67,13 +68,28 @@ mutability, and Prolog requirements of each operation.
    Kibi never Git-stages or commits those files. Do not read or edit `.kb`
    directly.
 5. Finish with targeted and final `kb_check`, then read status/coverage and
-   state freshness, verification, proof, and limitations separately.
+   report the five independent closeout fields (not one inferred success flag).
 
 Run `kb_check` with specific rules during iteration and the unfiltered final
 check. Never fire `kb_upsert` calls in parallel; create or confirm endpoint
 entities before linking them. The canonical MCP names are `kb_search`,
 `kb_query`, `kb_upsert`, and `kb_check`.
 
+## Closeout fields
+
+End every task with these five independent fields:
+
+```text
+taskOutcome: complete | interim | blocked
+kbState: clean_fresh | stale | dirty | legacy_compat | not_evaluated
+verificationState: fresh | dirty | unavailable | not_evaluated
+proofState: proven | mixed | unresolved | not_evaluated
+limitationDisposition: none | accepted | unaccepted | not_applicable
+```
+
+`taskOutcome` is whether the requested work finished. The other fields are
+observed system state. A clean check can coexist with unresolved proof.
+
 ## Exact Git attachment
 
 The active ref is the exact KB identity. `KIBI_BRANCH` is used verbatim; Git's
@@ -114,22 +130,31 @@ safe normative claims; use `observation` or `meta` for bug/workaround notes and
 `flag` only for actual runtime/config gates. Requirements require scenarios,
 tests, symbol ownership, and fresh proof-bearing receipts before claiming proof.
 For an existing product KB that needs semantic backfill, read
-`resources/kb-improvement.md`.
+`resources/kb-improvement.md`, and `resources/proof.md` for the proof workflow.
 
 ## Predicate Ontology Decision Tree
 
-Call `kb_semantic_advisor`, `kb_model_requirement`, or `kb_suggest_predicates`
-before encoding a normative clause. Use `fact_kind: predicate` with
-`requires_predicate` when a suitable schema exists; use `fact_kind: observation`
-for an ontology gap. Keep the `REQ -> TEST` chain and use `verified_by` for
-proof-bearing links. Relationship direction is fixed, and every `from` in a
-relationship batch must equal the upserted entity ID.
+Call `kb_semantic_advisor` on the complete prose before encoding a clause.
+Set requirement `logic_claims` to exactly the assertive `claim_key` values.
+For each relational clause, call `kb_suggest_predicates` with that clause and
+`existingLogicClaims`. If lexical rank is a false positive, retry with the
+reviewed `schemaId`. If `binding_status` is `incomplete`, supply
+`argumentBindings` and retry. Persist `fact_kind: predicate` with the same
+`claim_key` / `claim_text`, then link `REQ -> fact` with `requires_predicate`.
+Use `kb_model_requirement` for strict scalar clauses. Use
+`fact_kind: observation` only for a true ontology gap. The manifest is not
+grounding: run `logic-coverage` so each key binds to one ground fact.
+Relationship direction is fixed, and every `from` in a relationship batch
+must equal the upserted entity ID.
 
 ## Symbol-First Traceability
 
-Represent implementation ownership with a `symbol` entity and an `implements`
-relationship from the symbol to the requirement. Do not rely on legacy
-`// implements REQ-xxx` comments as the traceability record.
+Represent implementation ownership with a `symbol` entity that has
+`sourceFile`, `implements` to the requirement, and `covered_by` to the test.
+Prolog `symbol-coverage` also requires the test to `validates` the requirement
+(or the requirement `verified_by` the test). `covered_by` alone is not
+enough. Do not rely on legacy `// implements REQ-xxx` comments as the
+traceability record.
 
 ## Complete Logical Coverage
 

package/skills/kibi-usage/resources/operation-access.md

@@ -26,7 +26,7 @@ per operation. Effects are authoritative for mutability and adapter annotations.
 | `kb_sparql_remote` | `sparql-remote` | --input JSON | read | no | network-read | peer; capability-selected | kibi.kb_sparql_remote.v1 | no | safe | yes | yes |
 | `kb_compile_intent` | `compile-intent` | --input JSON | read | yes | kb-read, workspace-read | peer; capability-selected | kibi.kb_compile_intent.v1 | no | safe | no | yes |
 | `kb_apply_plan` | `apply-plan` | --input JSON | write | yes | kb-read, kb-write, workspace-read, workspace-write | peer; capability-selected | kibi.kb_apply_plan.v1 | yes | unsafe | no | yes |
-| `kb_ingest_verification` | `ingest-verification` | --input JSON | write | yes | kb-read, kb-write, workspace-read | peer; capability-selected | kibi.kb_ingest_verification.v1 | yes | unsafe | no | yes |
+| `kb_ingest_proof` | `ingest-proof` | --input JSON | write | yes | kb-read, kb-write, workspace-read | peer; capability-selected | kibi.kb_ingest_proof.v1 | yes | unsafe | no | yes |
 
 ## JSON execution recipe
 

package/skills/kibi-usage/resources/proof.md

@@ -0,0 +1,105 @@
+# Proof and Verification Workflow
+
+Use this resource when a requirement must be proven before handoff, when
+wiring a proof-bearing test, or when `kb_ingest_proof` or `kibi prove`
+rejected evidence.
+
+Kibi does not support test runners. Kibi supports proof evidence. Any
+producer (Playwright, pytest, JUnit, TAP, shell commands, database harnesses)
+reports what happened as `kibi.proof-run.v1`; Kibi evaluates proof.
+
+## Golden path
+
+1. Query the test (`kb_query`, `type: test`) and read its
+   `kibi.proof-contract.v1`, `proof_bindings`, and `verification_scope`.
+2. Run the configured producer through the canonical command:
+
+   ```bash
+   kibi prove --test TEST-<id>
+   # or: kibi prove --requirement REQ-<id> | --integration <id> | --all
+   ```
+
+   `kibi prove` captures the workspace snapshot, runs each integration's
+   producer once (`shell: false`), revalidates the snapshot, evaluates the
+   artifact against every selected contract, and appends idempotent
+   `kibi.proof-receipt.v1` receipts.
+3. Confirm with `kb_status` (fresh, current snapshot) and `kb_coverage`.
+
+Never hand-write receipts. Kibi derives them from validated
+`kibi.proof-run.v1` artifacts only.
+
+## Proof contracts
+
+A proof-bearing test declares explicit obligations (never a Cartesian
+cases-times-projects matrix):
+
+```yaml
+verification_scope: end_to_end
+verification_perspective: consumer
+proof_contract:
+  version: kibi.proof-contract.v1
+  integration: web-e2e          # id from .kb/proof/integrations.json
+  required_proofs:
+    - symbol_id: SYM-PW-4F2A9C61B7D03E85
+      target: chromium          # browser, runtime, db, device, or default
+  success_policy: all_required_first_attempt
+proof_bindings:                 # optional provenance metadata
+  - symbol_id: SYM-PW-4F2A9C61B7D03E85
+    target: chromium
+    native_id: tests/checkout.spec.ts::accepts a card
+```
+
+Provenance lives in `proof_bindings`; the contract stays semantic.
+
+## Integration configuration
+
+`.kb/proof/integrations.json` (`kibi.proof-integration.v1`) is tracked,
+Kibi-managed configuration describing evidence production only:
+
+- `producer: command` — Kibi synthesizes the envelope from the process
+  outcome; obligations are bound with `aggregate_run` provenance and the
+  single process invocation counts as the known first attempt.
+- `producer: playwright` (or custom) — the child emits `kibi.proof-run.v1`
+  itself (bundled reporter: `kibi-cli/playwright-reporter`).
+- `producer: junit` / `tap` — Kibi converts the native report at `artifact`
+  using each test's `proof_bindings`; standard formats carry no retry
+  history, so attempts are reported as `unavailable` and fail the strict
+  first-attempt policy closed.
+
+Cosmetic edits (descriptions, labels) never stale proof. Execution-relevant
+edits (command, artifact, targets, options, bindings, contract) change the
+effective fingerprint and do.
+
+## Attempt semantics (factual, never optimistic)
+
+- `attempts: {status: "complete", entries: [...]}` — known history; the
+  strict policy requires a passing **first** entry.
+- `attempts: {status: "unavailable"}` — unknown native history; the strict
+  policy fails closed, except `aggregate_run` results, which are satisfied by
+  the Kibi-launched process attempt when the run passed with exit code 0.
+- `run.outcome` is authoritative: a failed, errored, cancelled, interrupted,
+  or `no_results` run proves nothing, even with passing individual results.
+
+## Common rejections
+
+- `No proof integration configuration` — bootstrap has not configured proof
+  for this repository yet; do not hand-wave, run the bootstrap proof step.
+- `captured snapshot is not the live workspace snapshot` — the tree changed
+  between capture and ingest; re-run `kibi prove`.
+- `artifact command_argv does not match the configured command` — the
+  artifact came from a different command than `integrations.json` configures.
+- `attempt history unavailable` — the producer could not prove first-attempt
+  success for a native-case obligation; use a producer with complete history
+  or accept aggregate provenance.
+- `proof_receipts is append-only` — receipts are append-only; update tests
+  through the engine (which appends) or include the existing history when
+  authoring test files directly.
+
+## After code changes
+
+Receipts bind to the snapshot, contract hash, and execution fingerprint at
+run time. Any code or source change moves the snapshot and stales receipts:
+re-run `kibi prove` for the affected selection, then confirm `kb_status` and
+`kb_coverage` before handoff.
+
+Full reference: `docs/proving-requirements.md`.

package/skills/kibi-usage/resources/workflows.md

@@ -25,7 +25,7 @@ Receipt reuse is safe only when the live verification snapshot, contract hash,
 freshness window, and every required case result still match. Otherwise rerun
 the contracted command. If the contract changed, retain every older receipt
 unchanged, append evidence for the current contract, and keep proof unresolved
-with `verification_contract_mismatch` until that current receipt exists.
+with `proof_contract_mismatch` until that current receipt exists.
 Obsolete symbols require current extraction or Git evidence before
 remap/deletion; transfer coverage only when existing test evidence supports it,
 then sync and read back status. Same-version packages with different export
@@ -46,7 +46,7 @@ The canonical workflow for any KB operation follows this pattern:
 7. **Create endpoints**: validated `kb_upsert` for new entities, sequentially
 8. **Link**: validated `kb_upsert` with `requires_rule`, `requires_predicate`, `constrains`, or `requires_property`, sequentially
 9. **Validate coverage and consistency**: targeted `rule-safety`, `rule-verifiability`, `semantic-completeness`, `logic-coverage`, `predicate-verifiability`, and `domain-contradictions`, then final full `kb_check`
-10. **Prove execution**: read `kb_status.verificationSnapshot`, run each scenario-backed E2E command exactly as declared by its `verification_contract.v1` through `kibi verify`, append the derived `kibi.verification-receipt.v2`, and re-run `kb_coverage`; never promote durable test status into fresh evidence
+10. **Prove execution**: read `kb_status.proofSnapshot`, run `kibi prove` so each configured integration executes once and its `kibi.proof-run.v1` artifact is evaluated against every selected test's `kibi.proof-contract.v1` obligations, appending idempotent `kibi.proof-receipt.v1` receipts; then re-run `kb_coverage`. Never promote durable test status into fresh evidence.
 11. **Repair incrementally**: require `kb_coverage.repairPlan.scope.complete`, apply only one `ready` dependency batch per requirement, validate before every sequential write, and rerun coverage before selecting the next batch
 12. **Gate workflow evidence**: when `.kb/usage.log` exists, run `kibi usage-metrics --format json --require-acceptance`; repair ranked telemetry diagnostics and never treat stale or insufficient evidence as a pass
 
@@ -74,7 +74,7 @@ choose package managers, ground semantic claims, resolve contradictions, rerun
 E2E tests, rewrite receipt history, remap authored symbols, or accept
 limitations. Those actions remain explicit review/operator/execution steps.
 
-For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run its exact current contract through `kibi verify`; this appends v2 evidence and preserves older history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
+For `e2e_receipt_freshness_low`, query each listed requirement/test gap and run `kibi prove --requirement <id>` (or the covering integration); this appends proof receipts idempotently and preserves history. If `coverage_depth_review` conflicts with a coverage row whose `proofStages.passingE2e.status` is `passed`, report the diagnostic as a stale heuristic and keep any independent proof gaps unresolved.
 
 ## Creating a New Feature
 ```
@@ -101,12 +101,12 @@ Do not create a test-fact pair. Facts describe invariants; requirements or scena
 ## Fresh E2E Receipt Workflow
 
 1. Confirm the exact `REQ -> SCEN -> TEST` path and require typed `verification_scope: end_to_end`; direct requirement-to-test links do not satisfy the conservative scenario stage.
-2. Read `kb_status` and retain its available `verificationSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
+2. Read `kb_status` and retain its available `proofSnapshot`. Stop if the runtime reports `unknown`; proof must fail closed when the code identity cannot be computed.
 3. Run the exact E2E command against that snapshot. Record runner, command, start/finish timestamps, outcome, an environment SHA-256, and an artifact/output SHA-256. Do not mint a passed receipt from an authored test status or from an unexecuted assertion.
-4. Preserve every existing receipt byte-for-byte and append the derived `kibi.verification-receipt.v2` object with strictly later `finished_at`. Earlier receipts may bind older contracts; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
+4. Preserve every existing receipt byte-for-byte and append the derived `kibi.proof-receipt.v1` object with strictly later `finished_at`. Earlier receipts may bind older contracts or fingerprints; they remain audit history but cannot prove the current contract. Mutation and incremental sync reject history removal, rewriting, and reordering.
 5. Re-read `kb_status`; if the snapshot changed during the run, discard the candidate as proof and rerun against the new snapshot. Then run `kb_coverage` and inspect `proofStages.passingE2e.receiptEvidence` plus gap codes.
 
-Only the newest receipt matching both the live snapshot and current contract qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_verification_receipt`, `stale_verification_receipt`, `failed_verification_receipt`, `invalid_verification_receipt`, `verification_contract_mismatch`, and `verification_snapshot_unavailable` are repair states, not warnings to waive.
+Only the newest receipt matching the live snapshot, current contract hash, and current execution fingerprint qualifies, and it must be passed, no more than seven days old, and no more than five minutes in the future. Wrong-snapshot and older-contract history is retained but cannot prove the current test. `missing_proof_receipt`, `stale_proof_receipt`, `failed_proof_receipt`, `invalid_proof_receipt`, `proof_contract_mismatch`, and `proof_snapshot_unavailable` are repair states, not warnings to waive.
 
 ## Predicate-First Requirement Modeling