kibi-runtime 2.13.0 → 2.13.2

package/dist/index.js

@@ -6757,7 +6757,7 @@ function manifestVersion(manifestPath, expectedName) {
 }
 function cliVersion() {
   if (true)
-    return "2.15.0";
+    return "2.17.0";
   return manifestVersion(path2.join(moduleDirectory, "..", "package.json"), "kibi-cli") ?? "unknown";
 }
 function coreVersion() {
@@ -12218,7 +12218,7 @@ var init_search_answer = __esm(() => {
 });
 
 // ../cli/dist/utils/branch-store.js
-import { existsSync as existsSync10, readFileSync as readFileSync9, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync6 } from "node:fs";
 import * as path15 from "node:path";
 function inspectBranchStore(workspaceRoot, branch) {
   const storePath = branchStorePath(workspaceRoot, branch);
@@ -12354,9 +12354,86 @@ function branchStoreReason(inspection) {
     remediation: inspection.recoveryRequired ? { command_argv: ["kibi", "branch", "recover"], applyRequired: true } : { command_argv: ["kibi", "branch", "ensure"], applyRequired: false }
   };
 }
+function countFiles(directory, extension) {
+  let count = 0;
+  let entries;
+  try {
+    entries = readdirSync4(directory, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      count += countFiles(path15.join(directory, entry.name), extension);
+    } else if (entry.isFile() && entry.name.endsWith(extension)) {
+      count += 1;
+    }
+  }
+  return count;
+}
+function countAuthoredKbSources(workspaceRoot) {
+  const kbRoot = path15.join(workspaceRoot, KB_ROOT);
+  return AUTHORED_SOURCE_DIRECTORIES.reduce((total, [directory, extension]) => total + countFiles(path15.join(kbRoot, directory), extension), 0);
+}
+function branchStoreCompilation(inspection) {
+  if (inspection.state === "missing") {
+    return { compiled: false, generation: null };
+  }
+  const currentPath = path15.join(inspection.path, "CURRENT");
+  let current = "";
+  try {
+    current = existsSync10(currentPath) ? readFileSync9(currentPath, "utf8").trim() : "";
+  } catch {
+    current = "";
+  }
+  if (current === "") {
+    return { compiled: inspection.state === "healthy", generation: null };
+  }
+  const sequence = Number(current.split(":").at(-1));
+  return {
+    compiled: Number.isFinite(sequence) && sequence > 0 || journalHoldsGraphData(inspection.path),
+    generation: current
+  };
+}
+function journalHoldsGraphData(storePath) {
+  try {
+    return readdirSync4(path15.join(storePath, "rdf")).some((entry) => entry !== "lock" && !entry.startsWith("."));
+  } catch {
+    return false;
+  }
+}
+function uncompiledBranchStoreReason(workspaceRoot, inspection, branch) {
+  if (inspection.state !== "healthy" && inspection.state !== "missing") {
+    return null;
+  }
+  const compilation = branchStoreCompilation(inspection);
+  if (compilation.compiled)
+    return null;
+  const authoredSources = countAuthoredKbSources(workspaceRoot);
+  if (authoredSources === 0)
+    return null;
+  const storeState = inspection.state === "missing" ? "does not exist yet" : `is empty (${compilation.generation ?? "no generation"}: nothing compiled)`;
+  return {
+    code: BRANCH_STORE_NOT_COMPILED,
+    path: inspection.path,
+    entityIds: [],
+    detail: `The KB store for branch ${branch} ${storeState}, while .kb/ holds ${authoredSources} authored source file(s). Kibi compiles one store per branch and never copies another branch's, so every query and check reads an empty KB until this branch is compiled.`,
+    remediation: { command_argv: ["kibi", "sync"], applyRequired: false },
+    blocking: true,
+    authoredSources,
+    ...compilation.generation !== null ? { generation: compilation.generation } : {}
+  };
+}
+var BRANCH_STORE_NOT_COMPILED = "branch_store_not_compiled", BRANCH_STORE_NOT_COMPILED_RULE = "branch-store-not-compiled", AUTHORED_SOURCE_DIRECTORIES;
 var init_branch_store = __esm(() => {
   init_store_lock();
   init_branch_store_locator();
+  init_kb_paths();
+  AUTHORED_SOURCE_DIRECTORIES = [
+    ...ENTITY_LANES.map((lane) => [lane, ".md"]),
+    ["adrs", ".md"],
+    ["relationships", ".yaml"]
+  ];
 });
 
 // ../cli/dist/utils/config.js
@@ -13381,8 +13458,27 @@ function buildActionsFromStatus(input) {
       autoApplicable: configStatus.status !== "newer"
     }));
   }
+  const uncompiled = (input.staleReasons ?? []).find((reason) => reason.code === BRANCH_STORE_NOT_COMPILED);
+  if (uncompiled !== undefined) {
+    actions.push(migrationAction({
+      id: "branch-store-compile",
+      code: BRANCH_STORE_NOT_COMPILED,
+      category: "storage",
+      safety: "automatic",
+      invocation: { kind: "cli", command_argv: ["kibi", "sync"] },
+      affectedFiles: [
+        typeof store?.path === "string" ? store.path : ".kb/branches"
+      ],
+      evidence: { reason: uncompiled },
+      dependsOn: actions.map((action) => action.id).filter((id) => id === "branch-store-ensure" || id === "schema-config-upgrade"),
+      postconditions: [{ branchStore: "compiled" }],
+      autoApplicable: true
+    }));
+  }
   for (const reason of input.staleReasons ?? []) {
     const code = typeof reason.code === "string" ? reason.code : "stale_source";
+    if (code === BRANCH_STORE_NOT_COMPILED)
+      continue;
     const file = typeof reason.path === "string" ? reason.path : "";
     actions.push(migrationAction({
       id: `freshness-${code}-${file}`,
@@ -13448,6 +13544,7 @@ function buildActionsFromStatus(input) {
 }
 var MIGRATION_PLAN_VERSION = "kibi.migration-plan.v2", PREDICATE_SCHEMA_ALIGNMENT_CODE = "predicate_schema_alignment";
 var init_migration_plan = __esm(() => {
+  init_branch_store();
   init_config();
   init_kb_manifest();
   init_schema6_check_actions();
@@ -13659,7 +13756,8 @@ async function executeStatus(_input, context) {
       }
     const snapshotEvidence = await readWorkspaceSnapshot(context);
     const existingReasons = payload.staleReasons ?? [];
-    const storeReason = branchStoreReason(store);
+    const storeReason = uncompiledBranchStoreReason(context.workspaceRoot, store, attachment.kbBranch) ?? branchStoreReason(store);
+    const storeUncompiled = storeReason?.code === BRANCH_STORE_NOT_COMPILED;
     const lockReason = storeLockJournalReason(store.path);
     const compilerReason = compilerFingerprintReason(store.path);
     const engineReason = engineStatus ? {
@@ -13682,6 +13780,7 @@ async function executeStatus(_input, context) {
     const enrichedPayload = {
       ...payload,
       ...compilerReason ? { syncState: "stale", dirty: true } : {},
+      ...storeUncompiled ? { syncState: "stale", dirty: true } : {},
       branchAttachment: attachment,
       branchStore: store,
       ...engineStatus ? { engineStatus } : {},
@@ -13786,7 +13885,7 @@ async function executeStatus(_input, context) {
       content: [
         {
           type: "text",
-          text: `Branch ${payload.branch} is ${payload.syncState} (snapshot ${payload.snapshotId}, dirty=${payload.dirty}, proofSnapshot=${enrichedPayload.proofSnapshot})`
+          text: `Branch ${payload.branch} is ${enrichedPayload.syncState} (snapshot ${payload.snapshotId}, dirty=${enrichedPayload.dirty}, proofSnapshot=${enrichedPayload.proofSnapshot})${storeUncompiled ? `. Blocking: ${String(storeReason?.detail)} Run kibi sync.` : ""}`
         }
       ],
       structuredContent: statusWithPlan
@@ -13988,10 +14087,21 @@ function sourceOf(payload) {
 function normalizeKey(value) {
   return value.trim().toLowerCase().replace(/['’]/g, "").replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
-function singularize(value) {
-  if (["status", "results"].includes(value))
+function singularizeToken(value, keep = []) {
+  if (value.length <= 3 || keep.includes(value))
     return value;
-  return value.endsWith("s") && value.length > 3 ? value.slice(0, -1) : value;
+  if (value.endsWith("ies") && value.length > 4) {
+    return `${value.slice(0, -3)}y`;
+  }
+  if (ES_PLURAL_SUFFIXES.some((suffix) => value.endsWith(suffix))) {
+    return value.slice(0, -2);
+  }
+  if (!value.endsWith("s") || /(?:ss|us|is)$/.test(value))
+    return value;
+  return value.slice(0, -1);
+}
+function singularize(value) {
+  return singularizeToken(value, ["status", "results"]);
 }
 function normalizeSubjectKey(value) {
   return normalizeKey(value).split("_").map(singularize).join(".");
@@ -14121,9 +14231,10 @@ function predicateSuggestion(payload, evidence, name, args, rationale, polarity
     } : null
   };
 }
-var SEMANTIC_INVENTORY_VERSION = "kibi.semantic-inventory.v1";
+var SEMANTIC_INVENTORY_VERSION = "kibi.semantic-inventory.v1", ES_PLURAL_SUFFIXES;
 var init_shared = __esm(() => {
   init_clauses();
+  ES_PLURAL_SUFFIXES = ["ches", "shes", "sses", "xes"];
 });
 
 // ../cli/dist/operations/semantic-advisor/ingestion-boundary.js
@@ -23280,6 +23391,12 @@ var init_rule_registry_generated = __esm(() => {
       enforcementClass: "canonical",
       category: "integrity"
     },
+    {
+      name: "branch-store-not-compiled",
+      description: "The current branch's KB store must be compiled from the authored .kb/ sources; a missing or empty store is reported once, naming kibi sync, instead of every store-backed rule reading an empty KB",
+      enforcementClass: "canonical",
+      category: "integrity"
+    },
     {
       name: "source-path-dangling",
       description: "An authored entity's source field must name an existing workspace path (a #anchor suffix is ignored), an existing entity id, or an http(s) URL; a missing source is allowed",
@@ -23614,7 +23731,9 @@ function buildStableRequirementIds(claim) {
 function buildStrictWriteSet(input) {
   const statement = normalizeStatement(input.statement);
   const confidence = normalizeConfidence(input.claim.confidence);
-  const ids = buildStableRequirementIds(input.claim);
+  const minted = buildStableRequirementIds(input.claim);
+  const requirementId = input.requirementId?.trim();
+  const ids = requirementId ? { ...minted, reqId: requirementId } : minted;
   const textRef = normalizeTextRef(input.claim.provenance, input.claim.source);
   const metadataTags = buildMetadataTags({
     confidence,
@@ -23904,6 +24023,9 @@ function normalizeEntityDirectory(directory) {
 function buildEntitySourcePath(directory, entityId) {
   return `${directory}/${entityId}.md`;
 }
+function factSourcePath(factId) {
+  return buildEntitySourcePath(resolveEntitySourcePaths().facts, factId);
+}
 var STRICT_CONFIDENCE_THRESHOLD = 0.7, SUBJECT_KEY_CONVENTION, ORDERING_OPERATORS;
 var init_strict_modeling = __esm(() => {
   init_kb_paths();
@@ -27187,7 +27309,11 @@ function reuseExistingSubject(writeSet, existingFactId) {
       subjectFact: {
         ...writeSet.subjectFact,
         id: existingFactId,
-        properties: { ...writeSet.subjectFact.properties, id: existingFactId }
+        properties: {
+          ...writeSet.subjectFact.properties,
+          id: existingFactId,
+          source: factSourcePath(existingFactId)
+        }
       },
       relationships: writeSet.relationships.map((relationship) => relationship.type === "constrains" ? { ...relationship, to: existingFactId } : relationship)
     }
@@ -27213,10 +27339,11 @@ function possibleDuplicateObservation(claimKey, statement, source, candidates) {
     }))
   };
 }
-async function applyVocabularyAlignment(context, extracted, claimKey) {
+async function applyVocabularyAlignment(context, extracted, claimKey, requirementId) {
   const initial = buildStrictWriteSet({
     claim: extracted.claim,
-    statement: extracted.statement
+    statement: extracted.statement,
+    ...requirementId !== undefined ? { requirementId } : {}
   });
   const unchanged = {
     writeSet: initial,
@@ -27244,7 +27371,8 @@ async function applyVocabularyAlignment(context, extracted, claimKey) {
     if (followsVocabulary) {
       const rebuilt = buildStrictWriteSet({
         claim: { ...extracted.claim, subjectKey: subject.subjectKey },
-        statement: extracted.statement
+        statement: extracted.statement,
+        ...requirementId !== undefined ? { requirementId } : {}
       });
       ({ writeSet, replacedSubjectId } = reuseExistingSubject(rebuilt, subject.existingFactId));
     } else {
@@ -27534,7 +27662,7 @@ async function handleKbModelRequirement(_prolog, args, workspaceRoot, context) {
   if (conditional?.kind === "unparsed")
     return unresolvedConditionalResult(args, extracted, conditional.reason, workspaceRoot);
   const claimKey = semanticClaimKey(extracted.statement);
-  const aligned = await applyVocabularyAlignment(context, extracted, claimKey);
+  const aligned = await applyVocabularyAlignment(context, extracted, claimKey, normalizeOptionalString(args.requirementId));
   const writeSet = aligned.writeSet;
   const logicClaims = Array.from(new Set([...args.existingLogicClaims ?? [], claimKey]));
   const plan = aligned.adjustPlan(strictWriteSetToApplyPlan(writeSet));
@@ -43258,13 +43386,34 @@ function coverageForRequirement(result, manifestResults, entities) {
     scenarioTests
   };
 }
+function supersededRequirementIds(manifestResults) {
+  return new Set(manifestResults.flatMap((result) => result.entity.type === "req" ? result.relationships.flatMap((relationship) => relationship.type === "supersedes" ? [relationship.to] : []) : []));
+}
+function isReviewableRequirement(requirement, superseded) {
+  if (superseded.has(requirement.id))
+    return false;
+  const status = requirement.status.trim().toLowerCase();
+  if (REVIEWED_REQUIREMENT_STATUSES.has(status))
+    return true;
+  return status === "closed" && (requirement.tags ?? []).includes("implemented");
+}
 function createCoverageDepthQualityDiagnostics(manifestResults, proofByRequirement = new Map) {
   const entities = entitiesById(manifestResults);
-  return manifestResults.filter((result) => result.entity.type === "req").flatMap((result) => {
+  const superseded = supersededRequirementIds(manifestResults);
+  return manifestResults.filter((result) => result.entity.type === "req" && isReviewableRequirement(result.entity, superseded)).flatMap((result) => {
     const diagnostic = createDiagnostic(coverageForRequirement(result, manifestResults, entities), proofByRequirement.get(result.entity.id));
     return diagnostic === undefined ? [] : [diagnostic];
   }).toSorted((left, right) => (left.entityId ?? "").localeCompare(right.entityId ?? ""));
 }
+var REVIEWED_REQUIREMENT_STATUSES;
+var init_coverage_depth_quality = __esm(() => {
+  REVIEWED_REQUIREMENT_STATUSES = new Set([
+    "open",
+    "in_progress",
+    "active",
+    "approved"
+  ]);
+});
 
 // ../cli/dist/public/impact/requirement-quality.js
 function isRequirement2(result) {
@@ -43937,6 +44086,7 @@ var init_full_kb_quality = __esm(() => {
   init_proof_receipt();
   init_relationship();
   init_telemetry_acceptance();
+  init_coverage_depth_quality();
   init_requirement_quality();
   init_symbol_quality();
   RELATIONSHIP_TYPES = relationship_default.properties.type.enum;
@@ -44852,13 +45002,13 @@ var init_check_policy_rules = __esm(() => {
 });
 
 // ../cli/dist/operations/migration/kb-sources.js
-import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync24, readdirSync as readdirSync5, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync24, readdirSync as readdirSync6, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import path45 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 function walkMarkdown(directory, files) {
   let entries;
   try {
-    entries = readdirSync5(directory, { withFileTypes: true, encoding: "utf8" });
+    entries = readdirSync6(directory, { withFileTypes: true, encoding: "utf8" });
   } catch {
     return;
   }
@@ -53447,7 +53597,7 @@ var require_out4 = __commonJS(function(exports2, module2) {
 import { execFile } from "node:child_process";
 import { createHash as createHash24 } from "node:crypto";
 import * as fs7 from "node:fs";
-import { existsSync as existsSync23, readFileSync as readFileSync27, readdirSync as readdirSync6, unlinkSync as unlinkSync4 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync27, readdirSync as readdirSync7, unlinkSync as unlinkSync4 } from "node:fs";
 import * as path49 from "node:path";
 import { promisify } from "node:util";
 async function gitTrackedPaths(cwd) {
@@ -53461,7 +53611,7 @@ function pendingSourcePaths(cwd, recoverMissing) {
   }
   const paths = new Map;
   const recoveredReceipts = [];
-  for (const name of readdirSync6(root)) {
+  for (const name of readdirSync7(root)) {
     if (!name.endsWith(".json"))
       continue;
     const receiptPath = path49.join(root, name);
@@ -53614,7 +53764,7 @@ async function discoverSourceFiles(cwd, options2 = {}) {
     }
     const pendingRoot = path49.join(cwd, ".kb", "recovery", "pending-sources");
     if (options2.consumeTrackedPendingReceipts !== false && existsSync23(pendingRoot)) {
-      for (const name of readdirSync6(pendingRoot)) {
+      for (const name of readdirSync7(pendingRoot)) {
         if (!name.endsWith(".json"))
           continue;
         try {
@@ -54176,7 +54326,8 @@ __export(exports_check_executor, {
   buildSummary: () => buildSummary,
   executeCheck: () => executeCheck,
   getEffectiveRules: () => getEffectiveRules,
-  resolveCheckRules: () => resolveCheckRules
+  resolveCheckRules: () => resolveCheckRules,
+  uncompiledBranchStoreViolation: () => uncompiledBranchStoreViolation
 });
 function requireProlog2(context) {
   if (context.prolog === undefined) {
@@ -54212,6 +54363,33 @@ async function readStatusMigrationPlan(context) {
     throw error;
   }
 }
+function uncompiledBranchStoreViolation(context, workspaceRoot) {
+  let attachment;
+  try {
+    attachment = context.branchAttachment ?? resolveBranchAttachment(workspaceRoot);
+  } catch {
+    return null;
+  }
+  if ("error" in attachment)
+    return null;
+  const store = inspectBranchStore(workspaceRoot, attachment.kbBranch);
+  const reason = uncompiledBranchStoreReason(workspaceRoot, store, attachment.kbBranch);
+  if (reason === null)
+    return null;
+  return {
+    rule: BRANCH_STORE_NOT_COMPILED_RULE,
+    entityId: attachment.kbBranch,
+    description: String(reason.detail),
+    suggestion: "Run kibi sync to compile this branch's store from the authored .kb/ sources (or apply the branch-store-compile action of the returned migrationPlan with kb_apply_plan), then rerun kb_check. Run kibi init once to install the git hooks that compile a new branch on checkout.",
+    source: store.path,
+    evidence: {
+      store: { state: store.state, path: store.path },
+      authoredSources: reason.authoredSources,
+      ...reason.generation !== undefined ? { generation: reason.generation } : {},
+      remediation: reason.remediation
+    }
+  };
+}
 async function executeCheck(args, context, options2 = {}) {
   try {
     const workspaceRoot = args.workspaceRoot ?? context.workspaceRoot;
@@ -54227,6 +54405,39 @@ async function executeCheck(args, context, options2 = {}) {
       ...stagedEntityIdStyleDiagnostics(workspaceRoot, args)
     ];
     const maxDiagnosticsOption = args.maxDiagnostics !== undefined ? { maxDiagnostics: args.maxDiagnostics } : {};
+    const uncompiled = context.branchAttachment !== undefined || options2.branchStoreAttached === true ? uncompiledBranchStoreViolation(context, workspaceRoot) : null;
+    if (uncompiled !== null) {
+      const violations = [uncompiled];
+      const statusPlan = await readStatusMigrationPlan(context);
+      const migrationPlan = await migrationPlanForCheck(context, violations, [], statusPlan);
+      return {
+        content: [
+          {
+            type: "text",
+            text: buildSummary({
+              violations,
+              impactResult,
+              qualityDiagnostics: []
+            })
+          }
+        ],
+        structuredContent: buildStructuredContent({
+          violations,
+          diagnostics: [
+            {
+              category: "SYNC_ERROR",
+              severity: "error",
+              message: uncompiled.description,
+              ...uncompiled.source !== undefined ? { file: uncompiled.source } : {},
+              ...uncompiled.suggestion !== undefined ? { suggestion: uncompiled.suggestion } : {}
+            }
+          ],
+          qualityDiagnostics: [],
+          impactResult,
+          migrationPlan
+        })
+      };
+    }
     if (rulesAllowlist.size === 0) {
       const qualityDiagnostics = hasExplicitRules && options2.collectFullQualityDiagnosticsForExplicitRules !== true ? [] : impactResult ? impactQualityDiagnostics : await collectFullKbQualityDiagnostics({
         prolog,
@@ -54327,6 +54538,8 @@ async function executeCheck(args, context, options2 = {}) {
 }
 var init_check_executor = __esm(() => {
   init_aggregated_checks();
+  init_branch_resolver();
+  init_branch_store();
   init_impact_diagnostics();
   init_check_helpers();
   init_check_policy_rules();
@@ -54340,7 +54553,7 @@ var init_check_executor = __esm(() => {
 });
 
 // ../cli/dist/public/operations/specs/check-rules.generated.js
-var SELECTABLE_RULE_NAMES, SELECTABLE_RULES_ALLOWED = "must-priority-coverage, symbol-coverage, symbol-traceability, no-dangling-refs, source-relationship-parity, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged, policy-ownership, policy-markers";
+var SELECTABLE_RULE_NAMES, SELECTABLE_RULES_ALLOWED = "must-priority-coverage, symbol-coverage, symbol-traceability, no-dangling-refs, source-relationship-parity, branch-store-not-compiled, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged, policy-ownership, policy-markers";
 var init_check_rules_generated = __esm(() => {
   SELECTABLE_RULE_NAMES = [
     "must-priority-coverage",
@@ -54348,6 +54561,7 @@ var init_check_rules_generated = __esm(() => {
     "symbol-traceability",
     "no-dangling-refs",
     "source-relationship-parity",
+    "branch-store-not-compiled",
     "source-path-dangling",
     "no-cycles",
     "required-fields",
@@ -55417,9 +55631,7 @@ function normalizePredicateToken(value) {
   return value.trim().replace(/\b(?:a|an|the)\b\s*/gi, "").replace(/['’]/g, "").replace(/\s+/g, "_").replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^_+|_+$/g, "");
 }
 function singularize2(value) {
-  if (["changes", "status", "results"].includes(value))
-    return value;
-  return value.endsWith("s") && value.length > 3 ? value.slice(0, -1) : value;
+  return singularizeToken(value, ["changes", "status", "results"]);
 }
 function normalizeSubjectKey3(value) {
   return slug2(value).split("_").map(singularize2).join(".");
@@ -55491,7 +55703,9 @@ function inferEvent(text) {
   return eventName ?? "domain_event";
 }
 var DEFAULT_MIN_SCORE = 0.35;
-var init_predicate_utils = () => {};
+var init_predicate_utils = __esm(() => {
+  init_shared();
+});
 
 // ../cli/dist/operations/modeling/predicate-ranker.js
 function tokens3(value) {
@@ -55836,7 +56050,10 @@ var init_predicate_applicability = __esm(() => {
     permission_rule: {
       allOf: [
         [/only|may|can|allowed|denied|forbidden|must\s+not|cannot/i],
-        [/delete|export|access|read|write|update|remove|manage|permission/i]
+        [
+          /delete|export|access|read|write|update|remove|manage|permission/i,
+          /\b(?:may|can|cannot|can't|must\s+(?:not|never)|never|(?:is|are)\s+(?:not\s+)?(?:allowed|permitted|forbidden)\s+to)\s+(?:only\s+)?(?:publish|unpublish|approve|assign|view|see|edit|modify|create|submit|share|invite|upload|download|comment|post|complete|archive|restore|grant|revoke|purchase|cancel|execute|invoke|configure|moderate|ban|join|book|reserve|transfer|close|reopen|merge)\b/i
+        ]
       ]
     },
     resource_constraint: {
@@ -57028,8 +57245,9 @@ function buildSuggestion(schema, text, subject, score, argumentBindings = {}, po
       constrainedSubjects
     })
   ]));
-  const subjectKey = constrainedSubjects.length === 0 ? null : subjectArgument >= 0 ? predicateArgs[subjectArgument] ?? null : reviewedSubject ?? null;
-  const subjectPairing = constrainedSubjects.length === 0 ? "not_required" : subjectKey !== null && constrainedSubjects.includes(subjectKey) ? "paired" : "unpaired";
+  const plannedSubjects = constrainedSubjects.length > 0 ? constrainedSubjects : explicitSubject ? [subject] : [];
+  const subjectKey = plannedSubjects.length === 0 ? null : subjectArgument >= 0 ? predicateArgs[subjectArgument] ?? null : reviewedSubject ?? null;
+  const subjectPairing = plannedSubjects.length === 0 ? "not_required" : subjectKey !== null && plannedSubjects.includes(subjectKey) ? "paired" : "unpaired";
   const bindingProvenance = aggregateBindingProvenance(Object.values(bindingProvenanceByArgument));
   const unboundArguments = schema.argument_names.filter((name) => undeclaredArguments.has(name) || !bindingCanBeApplied(bindingProvenanceByArgument[name] ?? "placeholder"));
   if (subjectPairing === "unpaired") {
@@ -57831,7 +58049,7 @@ var init_modeling = __esm(() => {
         },
         requirementId: {
           type: "string",
-          description: "Optional existing requirement ID to receive the requires_rule relationship."
+          description: "Optional requirement ID. The strict write set updates this requirement instead of minting a REQ-AUTO id, and a typed logic rule attaches its requires_rule relationship to it."
         },
         claimKey: {
           type: "string",
@@ -61714,7 +61932,7 @@ var init_validation3 = __esm(() => {
 });
 
 // ../cli/dist/public/skill-system/loader.js
-import { existsSync as existsSync25, readFileSync as readFileSync29, readdirSync as readdirSync7, realpathSync as realpathSync8 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync29, readdirSync as readdirSync8, realpathSync as realpathSync8 } from "node:fs";
 import { dirname as dirname11, join as join20, resolve as resolve16 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function listBundledSkills() {
@@ -61735,7 +61953,7 @@ function readBundledSkillResource(id, resourcePath) {
 function listFrom(dir) {
   if (!existsSync25(dir))
     return [];
-  return readdirSync7(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join20(dir, entry.name)).filter((root) => existsSync25(join20(root, SKILL_FILE_NAME))).map((root) => parseSkillBundle(root).manifest).sort((a, b) => a.id.localeCompare(b.id));
+  return readdirSync8(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join20(dir, entry.name)).filter((root) => existsSync25(join20(root, SKILL_FILE_NAME))).map((root) => parseSkillBundle(root).manifest).sort((a, b) => a.id.localeCompare(b.id));
 }
 function findRoot(dir, id) {
   return listRoots(dir).find((root) => parseSkillBundle(root).manifest.id === id);
@@ -61743,7 +61961,7 @@ function findRoot(dir, id) {
 function listRoots(dir) {
   if (!existsSync25(dir))
     return [];
-  return readdirSync7(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join20(dir, entry.name)).filter((root) => existsSync25(join20(root, SKILL_FILE_NAME)));
+  return readdirSync8(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join20(dir, entry.name)).filter((root) => existsSync25(join20(root, SKILL_FILE_NAME)));
 }
 function readBundle(bundle, id, resourcePath) {
   const resource = normalizeResourcePath(resourcePath);
@@ -61898,6 +62116,28 @@ function requiredFields(spec) {
   const required = spec.businessInputSchema.required;
   return Array.isArray(required) ? required : [];
 }
+function foreignParameterWarnings(selector, choice, routes, rest) {
+  const route = routes[choice];
+  if (route === undefined)
+    return [];
+  const own = new Set(Object.keys(properties2(route)));
+  const equivalents = route.name === undefined ? {} : EQUIVALENT_PARAMETERS[route.name] ?? {};
+  const warnings = [];
+  for (const parameter of Object.keys(rest)) {
+    if (own.has(parameter) || rest[parameter] === undefined)
+      continue;
+    const owners = Object.entries(routes).filter(([other, otherRoute]) => other !== choice && (parameter in properties2(otherRoute))).map(([other]) => `${selector}: ${other}`);
+    if (owners.length === 0)
+      continue;
+    const equivalent = equivalents[parameter];
+    warnings.push({
+      parameter,
+      message: `${parameter} is a ${owners.join(" / ")} argument; ${selector}: ${choice} ignored it.`,
+      nextAction: equivalent !== undefined ? `Use ${equivalent} in ${selector}: ${choice}.` : `Drop ${parameter}, or switch to ${owners.join(" / ")} if that is what you meant.`
+    });
+  }
+  return warnings;
+}
 async function dispatchComposite(selector, routes, input, context) {
   const choice = input[selector];
   const route = typeof choice === "string" ? routes[choice] : undefined;
@@ -61916,16 +62156,46 @@ async function dispatchComposite(selector, routes, input, context) {
   const structured = wrapped ? result.structuredContent : result;
   const payload = isRecord(structured) ? structured : {};
   const content = wrapped && Array.isArray(result.content) ? result.content : [{ type: "text", text: `${selector} ${String(choice)} completed` }];
+  const ignored = foreignParameterWarnings(selector, String(choice), routes, rest);
+  if (ignored.length === 0) {
+    return {
+      content,
+      structuredContent: { [selector]: choice, ...payload }
+    };
+  }
+  const asRecords = route.name !== undefined && RECORD_WARNING_OPERATIONS.has(route.name);
+  const routedWarnings = Array.isArray(payload.warnings) ? {
+    warnings: [
+      ...payload.warnings,
+      ...ignored.map((warning) => asRecords ? {
+        kind: "parameter_ignored",
+        message: warning.message,
+        nextAction: warning.nextAction
+      } : `${warning.message} ${warning.nextAction}`)
+    ]
+  } : {};
   return {
-    content,
-    structuredContent: { [selector]: choice, ...payload }
+    content: [
+      ...content,
+      {
+        type: "text",
+        text: ignored.map((warning) => `${warning.message} ${warning.nextAction}`).join(`
+`)
+      }
+    ],
+    structuredContent: { [selector]: choice, ...payload, ...routedWarnings }
   };
 }
-var SKILL_ROUTES, MODEL_ROUTES, skillsSpec, modelSpec;
+var EQUIVALENT_PARAMETERS, RECORD_WARNING_OPERATIONS, SKILL_ROUTES, MODEL_ROUTES, skillsSpec, modelSpec;
 var init_composite = __esm(() => {
   init_modeling();
   init_semantic();
   init_skills2();
+  EQUIVALENT_PARAMETERS = {
+    kb_suggest_predicates: { subjectKey: "subjectHint" },
+    kb_model_requirement: { subjectHint: "subjectKey" }
+  };
+  RECORD_WARNING_OPERATIONS = new Set(["kb_model_requirement"]);
   SKILL_ROUTES = {
     list: skillsListSpec,
     load: skillsLoadSpec,
@@ -64193,7 +64463,7 @@ var init_source_authoring = __esm(() => {
 
 // ../cli/dist/operations/mutation/plan-apply-journal.js
 import { createHash as createHash28, randomUUID as randomUUID3 } from "node:crypto";
-import { closeSync as closeSync3, existsSync as existsSync26, fsyncSync as fsyncSync2, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync30, readdirSync as readdirSync8, renameSync as renameSync5, statSync as statSync10, unlinkSync as unlinkSync5, writeSync as writeSync2 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync26, fsyncSync as fsyncSync2, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync30, readdirSync as readdirSync9, renameSync as renameSync5, statSync as statSync10, unlinkSync as unlinkSync5, writeSync as writeSync2 } from "node:fs";
 import path53 from "node:path";
 function planApplyJournalId(planHash) {
   return `plan-apply-${planHash.slice(0, 16).toLowerCase()}`;
@@ -64433,7 +64703,7 @@ function removeOrphanedStagedFiles(workspaceRoot, files) {
     const prefix = `${path53.basename(absolute)}.kibi-stage-`;
     let names;
     try {
-      names = readdirSync8(path53.dirname(absolute));
+      names = readdirSync9(path53.dirname(absolute));
     } catch {
       continue;
     }
@@ -64572,7 +64842,7 @@ async function recoverPendingPlanApplyJournals(context, options2) {
   for (const directory of location.all) {
     let names;
     try {
-      names = readdirSync8(directory);
+      names = readdirSync9(directory);
     } catch {
       continue;
     }
@@ -68895,7 +69165,7 @@ var init_staging = __esm(() => {
 // ../cli/dist/commands/sync.js
 import { execSync as execSync4 } from "node:child_process";
 import { createHash as createHash32 } from "node:crypto";
-import { existsSync as existsSync34, mkdirSync as mkdirSync12, readFileSync as readFileSync40, readdirSync as readdirSync9, renameSync as renameSync10, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync12, readFileSync as readFileSync40, readdirSync as readdirSync10, renameSync as renameSync10, writeFileSync as writeFileSync15 } from "node:fs";
 import * as path66 from "node:path";
 function relationshipKey2(relationship) {
   return `${relationship.type}\x00${relationship.from}\x00${relationship.to}`;
@@ -68940,7 +69210,7 @@ function trackedRelationshipFiles(workspaceRoot, relationshipsDir, recoverMissin
   const pending = new Set;
   const pendingRoot = path66.join(workspaceRoot, ".kb", "recovery", "pending-sources");
   if (existsSync34(pendingRoot)) {
-    for (const receiptName of readdirSync9(pendingRoot)) {
+    for (const receiptName of readdirSync10(pendingRoot)) {
       if (!receiptName.endsWith(".json"))
         continue;
       let receipt;
@@ -68982,7 +69252,7 @@ function trackedRelationshipFiles(workspaceRoot, relationshipsDir, recoverMissin
     }
   }
   try {
-    return readdirSync9(relationshipsDir).filter((file) => file.endsWith(".yaml") || file.endsWith(".yml")).map((file) => path66.join(relationshipsDir, file)).filter((file) => {
+    return readdirSync10(relationshipsDir).filter((file) => file.endsWith(".yaml") || file.endsWith(".yml")).map((file) => path66.join(relationshipsDir, file)).filter((file) => {
       const relative = path66.relative(workspaceRoot, file).replaceAll(path66.sep, "/");
       return tracked.has(relative) || pending.has(relative);
     }).sort();
@@ -70946,7 +71216,7 @@ ${KIBI_BIN_RESOLVER}
 
 // ../cli/dist/commands/legacy-storage-migration.js
 import { createHash as createHash35 } from "node:crypto";
-import { existsSync as existsSync37, mkdirSync as mkdirSync15, readFileSync as readFileSync43, readdirSync as readdirSync11, renameSync as renameSync12, rmSync as rmSync5, statSync as statSync12, writeFileSync as writeFileSync18 } from "node:fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync15, readFileSync as readFileSync43, readdirSync as readdirSync12, renameSync as renameSync12, rmSync as rmSync5, statSync as statSync12, writeFileSync as writeFileSync18 } from "node:fs";
 import * as path72 from "node:path";
 function stripGlobToRoot(pattern) {
   const normalized = pattern.replaceAll("\\", "/").replace(/\/+$/, "");
@@ -71103,7 +71373,7 @@ function pruneEmptyLegacyDirs(cwd, plan) {
   const ordered = [...roots].sort((a, b) => b.length - a.length);
   for (const dir of ordered) {
     try {
-      if (statSync12(dir).isDirectory() && readdirSync11(dir).length === 0) {
+      if (statSync12(dir).isDirectory() && readdirSync12(dir).length === 0) {
         rmSync5(dir, { recursive: true });
       }
     } catch {}
@@ -71115,7 +71385,7 @@ function rewritePendingSourceReceiptPaths(cwd, moves) {
     return 0;
   const moveByFrom = new Map(moves.map((move) => [move.from, move.to]));
   let rewritten = 0;
-  for (const name of readdirSync11(pendingRoot)) {
+  for (const name of readdirSync12(pendingRoot)) {
     if (!name.endsWith(".json"))
       continue;
     const receiptPath = path72.join(pendingRoot, name);
@@ -71412,7 +71682,7 @@ var init_entity_body_context2 = __esm(() => {
 });
 
 // ../cli/dist/public/ignore-policy.js
-import { existsSync as existsSync38, readFileSync as readFileSync44, readdirSync as readdirSync12 } from "node:fs";
+import { existsSync as existsSync38, readFileSync as readFileSync44, readdirSync as readdirSync13 } from "node:fs";
 import * as path73 from "node:path";
 function readIgnoreFileLines(filePath) {
   if (!existsSync38(filePath))
@@ -71437,7 +71707,7 @@ function createRepoIgnorePolicy(workspaceRoot) {
   function walk(dirAbs) {
     let entries;
     try {
-      entries = readdirSync12(dirAbs, { withFileTypes: true });
+      entries = readdirSync13(dirAbs, { withFileTypes: true });
     } catch {
       return;
     }
@@ -74732,6 +75002,17 @@ var init_cli_operation_metadata = __esm(() => {
 // ../cli/dist/cli-validate.js
 var init_cli_validate = () => {};
 
+// ../cli/dist/operations/planning/migration-refusal.js
+var MigrationActionRefusedError, MIGRATION_PLAN_REFUSED = "MIGRATION_PLAN_REFUSED";
+var init_migration_refusal = __esm(() => {
+  MigrationActionRefusedError = class MigrationActionRefusedError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "MigrationActionRefusedError";
+    }
+  };
+});
+
 // ../cli/dist/public/operations/result-envelope.js
 function record4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -74823,23 +75104,33 @@ function extraFailedEffects(declared, data) {
 function resultVersion(spec) {
   return spec.resultVersion ?? `kibi.${spec.name}.v1`;
 }
+function refusalDetail(row) {
+  const results = Array.isArray(row.actionResults) ? row.actionResults : [];
+  const failure = results.find((entry) => record4(entry) && entry.outcome === "failed");
+  return record4(failure) && typeof failure.detail === "string" ? failure.detail : "";
+}
 function toKibiResult(spec, data, options2 = {}) {
   const row = record4(data) ? data : undefined;
+  const migrationRefused = row?.version === "kibi.migration-apply-result.v1" && row.outcome === "refused";
   let status = options2.status;
   if (!status) {
     status = "success";
     if (row?.status === "committed_with_repairs")
       status = "committed_with_repairs";
-    if (row?.status === "rejected")
+    if (row?.status === "rejected" || migrationRefused)
       status = "error";
   }
   const terminalError = row?.status === "rejected" ? {
     code: "BOOTSTRAP_PLAN_REJECTED",
     message: "Bootstrap stopped at a deterministic failure. Inspect actionResults for committed actions and re-plan from the current state.",
     retryable: false
+  } : migrationRefused ? {
+    code: MIGRATION_PLAN_REFUSED,
+    message: `Migration plan refused; nothing was changed. ${refusalDetail(row)}`.trim(),
+    retryable: false
   } : undefined;
   const resultError = options2.error ?? terminalError;
-  const outcome = effectOutcome(status, options2);
+  const outcome = effectOutcome(status, migrationRefused && options2.attempted === undefined ? { ...options2, attempted: false } : options2);
   return {
     kibiProtocol: KIBI_PROTOCOL_VERSION,
     operation: spec.name,
@@ -74888,6 +75179,9 @@ function appendPayloadCountField(fields, countKey, noun, payload) {
   fields.result_summary = count === null ? `${noun} count unavailable` : `${count} ${noun}`;
 }
 var KIBI_PROTOCOL_VERSION = 1;
+var init_result_envelope = __esm(() => {
+  init_migration_refusal();
+});
 
 // ../cli/dist/cli-protocol.js
 var import__2020, outputValidator;
@@ -74897,6 +75191,7 @@ var init_cli_protocol = __esm(() => {
   init_cli_operation_metadata();
   init_cli_validate();
   init_engine_limits();
+  init_result_envelope();
   init_detached_snapshot();
   import__2020 = __toESM(require__2020(), 1);
   outputValidator = new import__2020.default({ strict: false, allErrors: true });
@@ -74905,6 +75200,7 @@ var init_cli_protocol = __esm(() => {
 // ../cli/dist/public/diagnostic-usage.js
 var RECEIPT_GAP_CODES;
 var init_diagnostic_usage = __esm(() => {
+  init_result_envelope();
   RECEIPT_GAP_CODES = new Set([
     "missing_proof_receipt",
     "stale_proof_receipt",
@@ -75632,9 +75928,221 @@ var init_migrate = __esm(() => {
   ]);
 });
 
-// ../cli/dist/operations/planning/compile-intent.js
-import { createHash as createHash39 } from "node:crypto";
+// ../cli/dist/proof/integrations.js
+import { existsSync as existsSync41, readFileSync as readFileSync48 } from "node:fs";
 import path79 from "node:path";
+function integrationsPath(workspaceRoot) {
+  return path79.join(workspaceRoot, PROOF_INTEGRATIONS_PATH);
+}
+function proofIntegrationErrors(value) {
+  const file = record5(value);
+  if (!file)
+    return [
+      `${PROOF_INTEGRATIONS_PATH} must be an object with version and integrations`
+    ];
+  const errors = [];
+  if (file.version !== PROOF_INTEGRATION_VERSION)
+    errors.push(`version must be ${PROOF_INTEGRATION_VERSION}; received ${JSON.stringify(file.version ?? null)}`);
+  if (!Array.isArray(file.integrations) || file.integrations.length === 0) {
+    errors.push("integrations must be a non-empty array");
+    return errors;
+  }
+  const seen = new Set;
+  file.integrations.forEach((entry, index) => {
+    const row = record5(entry);
+    const label = `integrations[${index}]`;
+    if (!row) {
+      errors.push(`${label} must be an object`);
+      return;
+    }
+    if (!nonEmpty(row.id))
+      errors.push(`${label}.id must be a non-empty string`);
+    else {
+      if (seen.has(String(row.id)))
+        errors.push(`${label}.id duplicates '${String(row.id)}'`);
+      seen.add(String(row.id));
+    }
+    if (!nonEmpty(row.producer))
+      errors.push(`${label}.producer must be one of: ${PRODUCER_KINDS.join(", ")} (or a custom producer id)`);
+    if (!Array.isArray(row.command) || row.command.length === 0 || !row.command.every((argument) => nonEmpty(argument)))
+      errors.push(`${label}.command must be a non-empty argv array`);
+    if (nonEmpty(row.producer) && (row.producer === "junit" || row.producer === "tap") && !nonEmpty(row.artifact))
+      errors.push(`${label}.artifact is required for producer '${String(row.producer)}' (path of the native report to convert)`);
+    if (row.targets !== undefined) {
+      if (!Array.isArray(row.targets) || row.targets.length === 0 || !row.targets.every((target) => nonEmpty(target)))
+        errors.push(`${label}.targets must be a non-empty array of target names`);
+    }
+    if (row.options !== undefined && !record5(row.options))
+      errors.push(`${label}.options must be an object when present`);
+    if (row.description !== undefined && !nonEmpty(row.description))
+      errors.push(`${label}.description must be a non-empty string when present`);
+  });
+  return errors;
+}
+function loadProofIntegrations(workspaceRoot) {
+  const filePath = integrationsPath(workspaceRoot);
+  if (!existsSync41(filePath)) {
+    return {
+      available: false,
+      error: `No proof integration configuration at ${PROOF_INTEGRATIONS_PATH}. Run kibi proof inspect --json and apply its integrationPlan with kb_apply_plan to configure one.`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync48(filePath, "utf8"));
+  } catch (error) {
+    return {
+      available: false,
+      error: `${PROOF_INTEGRATIONS_PATH} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  const errors = proofIntegrationErrors(parsed);
+  if (errors.length > 0)
+    return {
+      available: false,
+      error: `Invalid ${PROOF_INTEGRATIONS_PATH}: ${errors.join("; ")}`
+    };
+  return { available: true, integrations: parsed };
+}
+function resolveIntegration(integrations, id) {
+  return integrations.integrations.find((entry) => entry.id === id) ?? null;
+}
+function toExecution(integration) {
+  return {
+    id: integration.id,
+    producer: integration.producer,
+    ...integration.producer_version !== undefined ? { producer_version: integration.producer_version } : {},
+    command: integration.command,
+    ...integration.artifact !== undefined ? { artifact: integration.artifact } : {},
+    ...integration.targets !== undefined ? { targets: integration.targets } : {},
+    ...integration.options !== undefined ? { options: integration.options } : {}
+  };
+}
+function record5(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+var PROOF_INTEGRATIONS_PATH = ".kb/proof/integrations.json", PRODUCER_KINDS;
+var init_integrations = __esm(() => {
+  init_proof_protocol();
+  PRODUCER_KINDS = [
+    "command",
+    "playwright",
+    "junit",
+    "tap"
+  ];
+});
+
+// ../cli/dist/proof/integration-plan.js
+import { createHash as createHash39 } from "node:crypto";
+import { existsSync as existsSync42, mkdirSync as mkdirSync17, readFileSync as readFileSync49, renameSync as renameSync14, writeFileSync as writeFileSync20 } from "node:fs";
+import path80 from "node:path";
+function sha2563(bytes) {
+  return createHash39("sha256").update(bytes).digest("hex");
+}
+function fileHash3(filePath) {
+  try {
+    return sha2563(readFileSync49(filePath));
+  } catch {
+    return null;
+  }
+}
+function sourceHashes(root) {
+  const hashes = {};
+  for (const file of PROPOSAL_SOURCES) {
+    const hash = fileHash3(path80.join(root, file));
+    if (hash !== null)
+      hashes[file] = hash;
+  }
+  return hashes;
+}
+function readIntegrationsFile(root) {
+  try {
+    const parsed = JSON.parse(readFileSync49(integrationsPath(root), "utf8"));
+    return proofIntegrationErrors(parsed).length === 0 ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function isRecord22(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function applyProofIntegrationAction(action, root) {
+  const evidence = action.evidence;
+  const integration = evidence.integration;
+  if (evidence.path !== PROOF_INTEGRATIONS_PATH || evidence.mode !== "create" && evidence.mode !== "update" || !isRecord22(integration) || typeof integration.id !== "string")
+    throw new MigrationActionRefusedError(`Proof integration action '${action.id}' is malformed; rerun kibi proof inspect for a new plan.`);
+  const planned = isRecord22(evidence.sourceHashes) ? evidence.sourceHashes : {};
+  const live = sourceHashes(root);
+  const changed = [
+    ...new Set([...Object.keys(planned), ...Object.keys(live)])
+  ].filter((file) => planned[file] !== live[file]);
+  if (changed.length > 0)
+    throw new MigrationActionRefusedError(`Proof integration plan refused: ${changed.join(", ")} changed since planning; rerun kibi proof inspect and review the new plan.`);
+  const filePath = integrationsPath(root);
+  let integrations;
+  if (evidence.mode === "create") {
+    if (existsSync42(filePath))
+      throw new MigrationActionRefusedError(`Proof integration plan refused: ${PROOF_INTEGRATIONS_PATH} already exists and this plan only creates it. Run kibi proof inspect --update <integration id> for a plan that adds or replaces one named integration.`);
+    integrations = [integration];
+  } else {
+    if (fileHash3(filePath) !== evidence.previousFileHash)
+      throw new MigrationActionRefusedError(`Proof integration plan refused: ${PROOF_INTEGRATIONS_PATH} changed since planning; rerun kibi proof inspect --update ${integration.id}.`);
+    const current = readIntegrationsFile(root);
+    if (current === null)
+      throw new MigrationActionRefusedError(`Proof integration plan refused: ${PROOF_INTEGRATIONS_PATH} is not a valid ${PROOF_INTEGRATION_VERSION} file.`);
+    integrations = current.integrations.some((entry) => entry.id === integration.id) ? current.integrations.map((entry) => entry.id === integration.id ? integration : entry) : [...current.integrations, integration];
+  }
+  const file = { version: PROOF_INTEGRATION_VERSION, integrations };
+  const errors = proofIntegrationErrors(file);
+  if (errors.length > 0)
+    throw new MigrationActionRefusedError(`Proof integration plan refused: the result would be invalid (${errors.join("; ")}).`);
+  mkdirSync17(path80.dirname(filePath), { recursive: true });
+  const temporary = `${filePath}.${process.pid}.tmp`;
+  writeFileSync20(temporary, `${JSON.stringify(file, null, 2)}
+`, "utf8");
+  renameSync14(temporary, filePath);
+}
+var PROOF_INTEGRATION_CONFIGURE = "proof_integration_configure", PROPOSAL_SOURCES;
+var init_integration_plan = __esm(() => {
+  init_migration_refusal();
+  init_migration_plan();
+  init_proof_protocol();
+  init_integrations();
+  PROPOSAL_SOURCES = [
+    "package.json",
+    "bun.lock",
+    "bun.lockb",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "playwright.config.ts",
+    "playwright.config.mjs",
+    "playwright.config.js",
+    "vitest.config.ts",
+    "vitest.config.mjs",
+    "vitest.config.js",
+    "jest.config.ts",
+    "jest.config.mjs",
+    "jest.config.js",
+    "pytest.ini",
+    "pyproject.toml",
+    "setup.cfg",
+    "tox.ini",
+    "go.mod",
+    "Cargo.toml",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "Gemfile",
+    "Rakefile"
+  ];
+});
+
+// ../cli/dist/operations/planning/compile-intent.js
+import { createHash as createHash40 } from "node:crypto";
+import path81 from "node:path";
 function compilePlanHash(plan) {
   const { planHash: _ignored, ...body } = plan;
   return hash2(body);
@@ -75643,7 +76151,7 @@ function text7(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function hash2(value) {
-  return createHash39("sha256").update(canonicalize(value)).digest("hex");
+  return createHash40("sha256").update(canonicalize(value)).digest("hex");
 }
 function shortHash2(value, length = 8) {
   return hash2(value).slice(0, length);
@@ -75671,7 +76179,7 @@ function requiredIntent(args) {
   return intent;
 }
 function validateLocation(location) {
-  if (!text7(location.path) || path79.isAbsolute(location.path) || location.path.split(/[\\/]/).includes("..")) {
+  if (!text7(location.path) || path81.isAbsolute(location.path) || location.path.split(/[\\/]/).includes("..")) {
     throw new Error("Compile intent failed: sourceLocations.path must be workspace-relative");
   }
 }
@@ -75701,25 +76209,25 @@ function mergeSteps(steps) {
       merged.set(key, {
         ...step,
         ...Array.isArray(step.relationships) ? {
-          relationships: mergeRelationships(step.relationships.filter(isRecord22))
+          relationships: mergeRelationships(step.relationships.filter(isRecord23))
         } : {}
       });
       continue;
     }
     const properties = {
-      ...isRecord22(previous.properties) ? previous.properties : {},
-      ...isRecord22(step.properties) ? step.properties : {}
+      ...isRecord23(previous.properties) ? previous.properties : {},
+      ...isRecord23(step.properties) ? step.properties : {}
     };
     const relationships = mergeRelationships([
-      ...Array.isArray(previous.relationships) ? previous.relationships.filter(isRecord22) : [],
-      ...Array.isArray(step.relationships) ? step.relationships.filter(isRecord22) : []
+      ...Array.isArray(previous.relationships) ? previous.relationships.filter(isRecord23) : [],
+      ...Array.isArray(step.relationships) ? step.relationships.filter(isRecord23) : []
     ]);
     merged.set(key, { ...previous, ...step, properties, relationships });
   }
   const rank = (step) => ({ test: 1, scenario: 2, req: 3 })[text7(step.type)] ?? 0;
   return [...merged.values()].sort((left, right) => rank(left) - rank(right) || text7(left.id).localeCompare(text7(right.id)));
 }
-function isRecord22(value) {
+function isRecord23(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function withRequirementInventory(steps, requirementId, receipt, propositions) {
@@ -75740,7 +76248,7 @@ function withRequirementInventory(steps, requirementId, receipt, propositions) {
   return steps.map((step) => {
     if (text7(step.type) !== "req" || text7(step.id) !== requirementId)
       return step;
-    const properties = isRecord22(step.properties) ? step.properties : {};
+    const properties = isRecord23(step.properties) ? step.properties : {};
     return {
       ...step,
       properties: {
@@ -75785,12 +76293,12 @@ function propositionDisposition2(proposition, suggestion) {
 function sourceFilesFor(locations) {
   return Array.from(new Set((locations ?? []).map((location) => location.path.trim()).filter(Boolean))).sort();
 }
-async function sourceHashes(context, locations) {
+async function sourceHashes2(context, locations) {
   const hashes = {};
   for (const relative of sourceFilesFor(locations)) {
     try {
-      const contents = context.fs ? await context.fs.readFile(path79.join(context.workspaceRoot, relative)) : null;
-      hashes[relative] = contents === null ? null : createHash39("sha256").update(contents).digest("hex");
+      const contents = context.fs ? await context.fs.readFile(path81.join(context.workspaceRoot, relative)) : null;
+      hashes[relative] = contents === null ? null : createHash40("sha256").update(contents).digest("hex");
     } catch {
       hashes[relative] = null;
     }
@@ -75812,12 +76320,12 @@ async function withDocumentTargets(context, prolog, steps, requirement, now) {
   for (const step of steps) {
     const type = text7(step.type);
     const id = text7(step.id);
-    const properties = isRecord22(step.properties) ? step.properties : {};
+    const properties = isRecord23(step.properties) ? step.properties : {};
     if (type === "symbol" || Object.keys(properties).length === 0) {
       targeted.push(step);
       continue;
     }
-    const stepDocument = isRecord22(step.document) ? step.document : {};
+    const stepDocument = isRecord23(step.document) ? step.document : {};
     const document = type === "req" && id === requirement.id ? {
       ...requirement.body !== undefined ? { body: requirement.body } : {},
       ...requirement.path !== undefined ? { path: requirement.path } : {}
@@ -75827,7 +76335,7 @@ async function withDocumentTargets(context, prolog, steps, requirement, now) {
       type,
       id,
       properties,
-      relationships: Array.isArray(step.relationships) ? step.relationships.filter(isRecord22) : [],
+      relationships: Array.isArray(step.relationships) ? step.relationships.filter(isRecord23) : [],
       document
     };
     const { entity } = validateUpsertInput(input, now);
@@ -75846,7 +76354,7 @@ async function existingRequirementBody(context, source) {
   if (!context.fs || !source.endsWith(".md"))
     return;
   try {
-    const raw = await context.fs.readFile(path79.join(context.workspaceRoot, source));
+    const raw = await context.fs.readFile(path81.join(context.workspaceRoot, source));
     return readAuthoredEntity(String(raw), source)?.body ?? undefined;
   } catch {
     return;
@@ -75857,12 +76365,12 @@ function generatedRequirementId(intent) {
 }
 function planWhatIfGoal(steps, now) {
   return buildWhatIfAnalysisGoal(steps.map((step) => {
-    const relationships = (Array.isArray(step.relationships) ? step.relationships.filter(isRecord22) : []).map((relationship) => ({
+    const relationships = (Array.isArray(step.relationships) ? step.relationships.filter(isRecord23) : []).map((relationship) => ({
       type: text7(relationship.type),
       from: text7(relationship.from),
       to: text7(relationship.to)
     }));
-    const properties = isRecord22(step.properties) ? step.properties : {};
+    const properties = isRecord23(step.properties) ? step.properties : {};
     if (Object.keys(properties).length === 0) {
       return {
         entity: { id: text7(step.id), type: text7(step.type) },
@@ -75894,7 +76402,7 @@ function whatIfWitness(witness) {
   };
 }
 function whatIfWitnesses(value) {
-  return (Array.isArray(value) ? value.filter(isRecord22) : []).map(whatIfWitness);
+  return (Array.isArray(value) ? value.filter(isRecord23) : []).map(whatIfWitness);
 }
 function parseWhatIfAnalysis(raw) {
   if (typeof raw !== "string")
@@ -75911,7 +76419,7 @@ function parseWhatIfAnalysis(raw) {
     const after = whatIfWitnesses(parsed);
     return { after, introduced: after, removed: [], unchanged: [] };
   }
-  if (!isRecord22(parsed))
+  if (!isRecord23(parsed))
     return null;
   return {
     after: whatIfWitnesses(parsed.after),
@@ -75986,7 +76494,7 @@ function applyAcceptedProposals(steps, proposals) {
     if (!existing)
       continue;
     const relationships = mergeRelationships([
-      ...Array.isArray(existing.relationships) ? existing.relationships.filter(isRecord22) : [],
+      ...Array.isArray(existing.relationships) ? existing.relationships.filter(isRecord23) : [],
       proposal.relationship
     ]);
     byId.set(targetId, { ...existing, relationships });
@@ -76294,7 +76802,7 @@ async function executeCompileIntent(args, context) {
     diagnostics.push("Change mode to update and supply requirementId to revise an existing requirement.");
   const unresolved = propositions.some((proposition) => proposition.status === "ambiguous" || proposition.status === "ontology_gap") || diagnostics.some((entry) => entry.includes("unresolved") || entry.includes("not found") || entry.includes("different content"));
   let statusValue = contradictions.outcome === "conflict" ? "blocked" : unresolved ? "needs_resolution" : "ready";
-  const sourceHashMap = await sourceHashes(context, args.sourceLocations);
+  const sourceHashMap = await sourceHashes2(context, args.sourceLocations);
   let planSteps = stepsWithAcceptedProposals;
   const sourceInput = {
     excerpt: args.sourceExcerpt,
@@ -76375,21 +76883,21 @@ var init_compile_intent = __esm(() => {
 });
 
 // ../cli/dist/operations/planning/apply-plan.js
-import { createHash as createHash40, randomUUID as randomUUID6 } from "node:crypto";
-import path80 from "node:path";
+import { createHash as createHash41, randomUUID as randomUUID6 } from "node:crypto";
+import path82 from "node:path";
 function text8(value) {
   return typeof value === "string" ? value.trim() : "";
 }
-function isRecord23(value) {
+function isRecord24(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function digest4(value) {
-  return createHash40("sha256").update(value).digest("hex");
+  return createHash41("sha256").update(value).digest("hex");
 }
 function relationships(step) {
   if (!Array.isArray(step.relationships))
     return [];
-  return step.relationships.filter(isRecord23).map((relationship) => {
+  return step.relationships.filter(isRecord24).map((relationship) => {
     const type = text8(relationship.type);
     const from = text8(relationship.from);
     const to = text8(relationship.to);
@@ -76405,8 +76913,8 @@ function asUpsert(step) {
     throw new Error(`Apply plan failed: unsupported step entity type '${type}'`);
   if (!id)
     throw new Error("Apply plan failed: every step needs an entity id");
-  const properties = isRecord23(step.properties) ? step.properties : {};
-  const document = isRecord23(step.document) ? {
+  const properties = isRecord24(step.properties) ? step.properties : {};
+  const document = isRecord24(step.document) ? {
     ...typeof step.document.path === "string" ? { path: step.document.path } : {},
     ...typeof step.document.body === "string" ? { body: step.document.body } : {}
   } : undefined;
@@ -76419,7 +76927,7 @@ function asUpsert(step) {
   };
 }
 function validateCompilePlanShape(args) {
-  if (!isRecord23(args.plan))
+  if (!isRecord24(args.plan))
     throw new Error("Apply plan failed: plan must be an object");
   if (args.plan.version !== "kibi.compile-plan.v1")
     throw new Error("Apply plan failed: unsupported plan version");
@@ -76441,7 +76949,7 @@ function isBootstrapApplyArgs(args) {
   return "plan" in args && args.plan.version === "kibi.bootstrap-plan.v1";
 }
 function assertSourceWriteStaysInWorkspace(root, absolute, writePath) {
-  if (absolute !== root && !absolute.startsWith(`${root}${path80.sep}`)) {
+  if (absolute !== root && !absolute.startsWith(`${root}${path82.sep}`)) {
     throw new Error(`Apply plan failed: sourceWrites.path escapes workspace: ${writePath}`);
   }
 }
@@ -76459,7 +76967,7 @@ function orderBootstrapActions(actions, completed = new Set) {
   for (const action of actions) {
     if (!action.id || byId.has(action.id))
       throw new Error("Bootstrap apply failed: action IDs must be unique");
-    if (action.kind !== "upsert" || !isRecord23(action.payload))
+    if (action.kind !== "upsert" || !isRecord24(action.payload))
       throw new Error(`Bootstrap apply failed: action '${action.id}' is invalid`);
     byId.set(action.id, action);
   }
@@ -76548,7 +77056,7 @@ function validateEntityDeletionPlan(args) {
     throw new Error("Entity deletion apply failed: approvedPlanHash does not match planHash");
   }
   const { planHash: _ignored, ...body } = args.plan;
-  if (createHash40("sha256").update(JSON.stringify(body)).digest("hex") !== args.plan.planHash) {
+  if (createHash41("sha256").update(JSON.stringify(body)).digest("hex") !== args.plan.planHash) {
     throw new Error("Entity deletion apply failed: planHash does not match the canonical plan body");
   }
   if (!Array.isArray(args.plan.entityIds) || args.plan.entityIds.length === 0) {
@@ -76559,7 +77067,7 @@ function validateEntityDeletionPlan(args) {
   }
 }
 function validateMigrationPlanShape(args) {
-  if (!isRecord23(args.plan))
+  if (!isRecord24(args.plan))
     throw new Error("Migration apply failed: plan must be an object");
   if (args.plan.version !== "kibi.migration-plan.v2")
     throw new Error("Migration apply failed: unsupported plan version");
@@ -76621,13 +77129,13 @@ function topologicalActions(actions) {
 async function validateSources(context, sourceHashes) {
   let checked = 0;
   for (const [relative, expected] of Object.entries(sourceHashes)) {
-    if (!relative || path80.isAbsolute(relative) || relative.split(/[\\/]/).includes(".."))
+    if (!relative || path82.isAbsolute(relative) || relative.split(/[\\/]/).includes(".."))
       throw new Error("Apply plan failed: source hash paths must be workspace-relative");
     if (!context.fs)
       throw new Error("Apply plan failed: source hashes require a filesystem-capable runtime");
     let actual;
     try {
-      actual = digest4(await context.fs.readFile(path80.join(context.workspaceRoot, relative)));
+      actual = digest4(await context.fs.readFile(path82.join(context.workspaceRoot, relative)));
     } catch {
       actual = null;
     }
@@ -76638,19 +77146,19 @@ async function validateSources(context, sourceHashes) {
   return checked;
 }
 async function resolveSourceWriteTarget(workspaceRoot, fsPort, write) {
-  if (!write.path || path80.isAbsolute(write.path) || write.path.split(/[\\/]/).includes("..")) {
+  if (!write.path || path82.isAbsolute(write.path) || write.path.split(/[\\/]/).includes("..")) {
     throw new Error(`Apply plan failed: sourceWrites.path must be workspace-relative: ${write.path}`);
   }
-  const absolute = path80.resolve(workspaceRoot, write.path);
-  const root = path80.resolve(workspaceRoot);
+  const absolute = path82.resolve(workspaceRoot, write.path);
+  const root = path82.resolve(workspaceRoot);
   assertSourceWriteStaysInWorkspace(root, absolute, write.path);
-  const relative = path80.relative(root, absolute).split(path80.sep).join("/");
+  const relative = path82.relative(root, absolute).split(path82.sep).join("/");
   if (relative === ".kb" || isDerivedKbPath(relative)) {
     throw new Error("Apply plan failed: sourceWrites.path cannot target Kibi's derived .kb runtime trees");
   }
   const realRoot = canonicalFilesystemPath(root);
   const realExisting = canonicalFilesystemPath(absolute);
-  if (realExisting !== realRoot && !realExisting.startsWith(`${realRoot}${path80.sep}`)) {
+  if (realExisting !== realRoot && !realExisting.startsWith(`${realRoot}${path82.sep}`)) {
     throw new Error(`Apply plan failed: sourceWrites.path follows a symlink outside the workspace: ${write.path}`);
   }
   const existing = await fsPort.readFile(absolute).catch(() => {
@@ -76681,7 +77189,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
     throw new Error("Apply plan failed: sourceWrites require a filesystem-capable runtime");
   }
   const fsPort = context.fs;
-  const journalPath = path80.join(context.workspaceRoot, ".kb", "recovery", `source-writes-${planHash.slice(0, 16)}.json`);
+  const journalPath = path82.join(context.workspaceRoot, ".kb", "recovery", `source-writes-${planHash.slice(0, 16)}.json`);
   const journalId = `source-writes-${planHash.slice(0, 16)}`;
   const sameEntries = (entries) => entries.length === writes.length && entries.every((entry) => writes.some((write) => write.path === entry.path && (write.mode ?? "write") === entry.mode && write.beforeHash === entry.beforeHash && write.afterHash === entry.afterHash));
   const readJournal = async () => {
@@ -76704,7 +77212,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
     let allAfter = true;
     for (const entry of prior.entries) {
       try {
-        const current = await context.fs.readFile(path80.resolve(context.workspaceRoot, entry.path));
+        const current = await context.fs.readFile(path82.resolve(context.workspaceRoot, entry.path));
         if (entry.afterHash === null || digest4(current) !== entry.afterHash) {
           allAfter = false;
         }
@@ -76726,7 +77234,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
   }
   if (prior && (prior.state === "prepared" || prior.state === "publishing_sources")) {
     for (const entry of prior.entries) {
-      const absolute = path80.resolve(context.workspaceRoot, entry.path);
+      const absolute = path82.resolve(context.workspaceRoot, entry.path);
       let current;
       try {
         current = await context.fs.readFile(absolute);
@@ -76759,7 +77267,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
       const { absolute, existing, mode } = await resolveSourceWriteTarget(context.workspaceRoot, fsPort, write);
       originals.push({ absolute, body: existing });
       paths.push(write.path);
-      const stageBase = path80.join(context.workspaceRoot, ".kb", "recovery", `${journalId}-${entries.length}`);
+      const stageBase = path82.join(context.workspaceRoot, ".kb", "recovery", `${journalId}-${entries.length}`);
       entries.push({
         path: write.path,
         mode,
@@ -76770,7 +77278,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
         afterStage: `${stageBase}.after`
       });
     }
-    await context.fs.mkdir(path80.dirname(journalPath));
+    await context.fs.mkdir(path82.dirname(journalPath));
     for (let index = 0;index < writes.length; index += 1) {
       const original = originals[index];
       const entry = entries[index];
@@ -76791,7 +77299,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
       const write = writes[index];
       if (!absolute || !write)
         continue;
-      await context.fs.mkdir(path80.dirname(absolute));
+      await context.fs.mkdir(path82.dirname(absolute));
       await context.fs.writeFile(journalPath, `${JSON.stringify({ version: 1, planHash, state: "publishing_sources", entries }, null, 2)}
 `);
       if ((write.mode ?? "write") === "delete") {
@@ -76843,7 +77351,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
       } catch {}
     }
     try {
-      await context.fs.mkdir(path80.dirname(journalPath));
+      await context.fs.mkdir(path82.dirname(journalPath));
       await context.fs.writeFile(journalPath, `${JSON.stringify({ version: 1, planHash, state: "rolled_back", entries }, null, 2)}
 `);
     } catch {}
@@ -76860,7 +77368,7 @@ async function applySourceWrites(context, writes, planHash, allowReplay = false,
 async function markSourceJournal(context, journalId, state) {
   if (!journalId || !context.fs)
     return;
-  const journalPath = path80.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
+  const journalPath = path82.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
   try {
     const current = JSON.parse(await context.fs.readFile(journalPath));
     await context.fs.writeFile(journalPath, `${JSON.stringify({ ...current, state }, null, 2)}
@@ -76875,7 +77383,7 @@ async function executeSourceRecovery(args, context, onCommitted = () => {
   if (!/^[A-Za-z0-9._-]+$/.test(args.recoveryJournalId)) {
     throw new Error("Source recovery journal ID is invalid");
   }
-  const journalPath = path80.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
+  const journalPath = path82.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
   const journal = JSON.parse(await context.fs.readFile(journalPath));
   if (journal.version !== 1 || typeof journal.planHash !== "string" || !Array.isArray(journal.entries) || !["sources_committed", "compiled_published", "repair_required"].includes(journal.state ?? "")) {
     throw new Error("Source recovery requires a committed or repair_required journal");
@@ -76952,7 +77460,7 @@ async function assertBootstrapPlanCurrent(args, operationContext) {
 async function preflightApplyPlan(args, context) {
   if (!("plan" in args))
     return;
-  if (!isRecord23(args.plan))
+  if (!isRecord24(args.plan))
     throw new Error("Apply plan failed: plan must be an object");
   if (typeof args.approvedPlanHash !== "string" || !/^[a-f0-9]{64}$/i.test(args.approvedPlanHash))
     throw new Error("Apply plan failed: approvedPlanHash must be the SHA-256 planHash returned with the plan");
@@ -76991,7 +77499,7 @@ async function executeBootstrapPlan(args, context, recovery = false, remainingAc
   if (!status)
     throw new Error("Bootstrap apply failed: status returned no payload");
   const journalId = `bootstrap-${args.plan.planHash.slice(0, 16)}`;
-  const journalPath = path80.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
+  const journalPath = path82.join(context.workspaceRoot, ".kb", "recovery", `${journalId}.json`);
   if (!recovery && context.fs) {
     try {
       await context.fs.readFile(journalPath);
@@ -77024,7 +77532,7 @@ async function executeBootstrapPlan(args, context, recovery = false, remainingAc
   const writeJournal = async (state, activeActionId, currentCheckpoint = lastCheckpoint) => {
     if (!context.fs)
       return;
-    await context.fs.mkdir(path80.dirname(journalPath));
+    await context.fs.mkdir(path82.dirname(journalPath));
     await context.fs.writeFile(journalPath, `${JSON.stringify({
       version: 2,
       kind: "bootstrap",
@@ -77294,7 +77802,7 @@ async function dispatchApplyPlan(args, context, onCommitted, recovered) {
         throw new Error("Bootstrap recovery requires a filesystem-capable runtime");
       if (!/^bootstrap-[a-f0-9]{16}$/.test(args.recoveryJournalId))
         throw new Error("Bootstrap recovery journal ID is invalid");
-      const journalPath = path80.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
+      const journalPath = path82.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
       const journal = JSON.parse(await context.fs.readFile(journalPath));
       if (journal.version !== 2 || journal.kind !== "bootstrap" || !journal.plan)
         throw new Error("Bootstrap recovery journal is invalid");
@@ -77478,7 +77986,7 @@ async function planFileWrites(context, prolog, fsPort, sourceWrites, steps, now)
     const relative = canonicalSourcePath(context, step.input, step.entity, existing);
     let file = files.get(relative);
     if (file === undefined) {
-      const existingBytes = await fsPort.readFile(path80.join(workspaceRoot, relative)).catch(() => {
+      const existingBytes = await fsPort.readFile(path82.join(workspaceRoot, relative)).catch(() => {
         return;
       });
       const before = existingBytes ?? null;
@@ -77503,8 +78011,8 @@ async function planFileWrites(context, prolog, fsPort, sourceWrites, steps, now)
     file.after = after;
     file.afterHash = contentHash(after);
   }
-  const root = path80.resolve(workspaceRoot);
-  const kbRoot = path80.join(workspaceRoot, ".kb");
+  const root = path82.resolve(workspaceRoot);
+  const kbRoot = path82.join(workspaceRoot, ".kb");
   const createdAt = now.toISOString();
   for (const step of steps) {
     for (const relationship of step.relationships) {
@@ -77515,7 +78023,7 @@ async function planFileWrites(context, prolog, fsPort, sourceWrites, steps, now)
         continue;
       const shardPath = computeShardPath(kbRoot, from);
       assertRelationshipShardContained(workspaceRoot, shardPath);
-      const relative = path80.relative(root, path80.resolve(shardPath)).split(path80.sep).join("/");
+      const relative = path82.relative(root, path82.resolve(shardPath)).split(path82.sep).join("/");
       let file = files.get(relative);
       if (file === undefined) {
         const existing = await fsPort.readFile(shardPath).catch(() => null);
@@ -77967,7 +78475,7 @@ function withRecoveryReport(result, recovered) {
     action: recovery.action,
     restoredPaths: recovery.restoredPaths
   }));
-  if (isRecord23(structured.validationSummary)) {
+  if (isRecord24(structured.validationSummary)) {
     const summary = structured.validationSummary;
     return {
       content,
@@ -78000,7 +78508,7 @@ async function applyingBootstrapJournal(args, context) {
     return;
   if (!/^bootstrap-[a-f0-9]{16}$/.test(args.recoveryJournalId))
     return;
-  const journalPath = path80.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
+  const journalPath = path82.join(context.workspaceRoot, ".kb", "recovery", `${args.recoveryJournalId}.json`);
   try {
     const journal = JSON.parse(await context.fs.readFile(journalPath));
     return journal.kind === "bootstrap" && journal.state === "applying" ? journalPath : undefined;
@@ -78087,6 +78595,8 @@ async function applyMigrationPlan(args, context, onCommitted = () => {
   }
   const results = [];
   let failed = false;
+  let refusals = 0;
+  let failures = 0;
   for (const action of actions) {
     if (failed) {
       results.push({
@@ -78106,6 +78616,9 @@ async function applyMigrationPlan(args, context, onCommitted = () => {
       });
     } catch (error) {
       failed = true;
+      failures += 1;
+      if (error instanceof MigrationActionRefusedError)
+        refusals += 1;
       results.push({
         actionId: action.id,
         outcome: "failed",
@@ -78152,7 +78665,7 @@ async function applyMigrationPlan(args, context, onCommitted = () => {
       });
     }
   }
-  const outcome = failed ? results.some((result) => result.outcome === "applied") ? "partially_applied" : "reconciliation_required" : "applied";
+  const outcome = failed ? results.some((result) => result.outcome === "applied") ? "partially_applied" : failures > 0 && refusals === failures ? "refused" : "reconciliation_required" : "applied";
   const kbState = finalStatus.branchAttachment?.migrationRequired ? "legacy_compat" : finalStatus.syncState === "stale" ? "stale" : finalStatus.dirty ? "dirty" : finalStatus.syncState === "fresh" ? "clean_fresh" : "not_evaluated";
   const snapshotState = finalStatus.proofSnapshotAvailable === false ? "unavailable" : finalStatus.proofSnapshotDirty === true ? "dirty" : finalStatus.proofSnapshotDirty === false ? "fresh" : "not_evaluated";
   const proven = coverageSummary?.proofProven;
@@ -78173,7 +78686,7 @@ async function applyMigrationPlan(args, context, onCommitted = () => {
     ],
     ...remainingPlan !== undefined ? { remainingPlan } : {},
     closeout: {
-      taskOutcome: outcome === "applied" ? "complete" : outcome === "reconciliation_required" ? "blocked" : "interim",
+      taskOutcome: outcome === "applied" ? "complete" : outcome === "reconciliation_required" || outcome === "refused" ? "blocked" : "interim",
       kbState,
       snapshotState,
       proofState,
@@ -78184,7 +78697,7 @@ async function applyMigrationPlan(args, context, onCommitted = () => {
     content: [
       {
         type: "text",
-        text: `${outcome === "applied" ? "Applied" : "Stopped after"} migration plan ${args.plan.planHash.slice(0, 12)}.`
+        text: outcome === "applied" ? `Applied migration plan ${args.plan.planHash.slice(0, 12)}.` : outcome === "refused" ? `Refused migration plan ${args.plan.planHash.slice(0, 12)}; nothing was changed.` : `Stopped after migration plan ${args.plan.planHash.slice(0, 12)}.`
       }
     ],
     structuredContent: payload
@@ -78214,6 +78727,14 @@ async function applyMigrationAction(action, context) {
     case "missing_exact_branch_store":
       await branchEnsureCommand({ workspaceRoot: context.workspaceRoot });
       return;
+    case BRANCH_STORE_NOT_COMPILED: {
+      const result = await syncCommand({
+        workspaceRoot: context.workspaceRoot
+      });
+      if (!result.success)
+        throw new Error("Compiling the branch store (kibi sync) did not complete successfully.");
+      return;
+    }
     case "damaged_exact_branch_store":
       await branchRecoverCommand({
         apply: true,
@@ -78243,21 +78764,24 @@ async function applyMigrationAction(action, context) {
     case PREDICATE_SCHEMA_ALIGNMENT_CODE:
       await applyPredicateSchemaAlignment(action, context);
       return;
+    case PROOF_INTEGRATION_CONFIGURE:
+      applyProofIntegrationAction(action, context.workspaceRoot);
+      return;
     default:
       if (SCHEMA6_AUTOMATIC_CODES.has(action.code)) {
         await applySchema6MigrationAction(action, context);
         return;
       }
-      throw new Error(`Migration action '${action.code}' has no automatic executor.`);
+      throw new MigrationActionRefusedError(`Migration action '${action.code}' has no automatic executor.`);
   }
 }
 async function applyPredicateSchemaAlignment(action, context) {
   const invocation = action.invocation;
   if (invocation.kind !== "operation" || invocation.name !== "kb_upsert")
-    throw new Error("Predicate schema alignment requires its planned kb_upsert invocation.");
+    throw new MigrationActionRefusedError("Predicate schema alignment requires its planned kb_upsert invocation.");
   const input = asUpsert(invocation.input);
   if (input.type !== "fact")
-    throw new Error("Predicate schema alignment only rewrites fact entities.");
+    throw new MigrationActionRefusedError("Predicate schema alignment only rewrites fact entities.");
   const prolog = context.prolog ?? await context.ensureProlog?.();
   if (!prolog)
     throw new Error("Predicate schema alignment requires a Prolog runtime.");
@@ -78267,9 +78791,9 @@ async function applyPredicateSchemaAlignment(action, context) {
   const currentNamespace = typeof current?.predicate_namespace === "string" && current.predicate_namespace !== "" ? current.predicate_namespace : "default";
   const currentArgs = Array.isArray(current?.predicate_args) ? current.predicate_args : [];
   const rewrites = Array.isArray(evidence.rewrites) ? evidence.rewrites : [];
-  const unchanged = current !== undefined && current.fact_kind === "predicate" && currentNamespace === evidence.namespace && rewrites.every((rewrite) => isRecord23(rewrite) && typeof rewrite.index === "number" && currentArgs[rewrite.index] === rewrite.from);
+  const unchanged = current !== undefined && current.fact_kind === "predicate" && currentNamespace === evidence.namespace && rewrites.every((rewrite) => isRecord24(rewrite) && typeof rewrite.index === "number" && currentArgs[rewrite.index] === rewrite.from);
   if (!unchanged)
-    throw new Error(`Predicate fact ${input.id} changed since planning; rerun kibi check and approve the new plan.`);
+    throw new MigrationActionRefusedError(`Predicate fact ${input.id} changed since planning; rerun kibi check and approve the new plan.`);
   await executeUpsert(input, operationContext);
 }
 var PLAN_APPLY_RESULT_VERSION = "kibi.plan-apply-result.v1", ENTITY_TYPES4;
@@ -78278,11 +78802,13 @@ var init_apply_plan = __esm(() => {
   init_branch();
   init_migrate();
   init_sync();
+  init_integration_plan();
   init_discovery_entities();
   init_discovery_executors();
   init_migration_plan();
   init_migration_plan();
   init_shards();
+  init_branch_store();
   init_canonical_path();
   init_kb_paths();
   init_types();
@@ -78295,6 +78821,7 @@ var init_apply_plan = __esm(() => {
   init_upsert();
   init_workspace_mutation_lock();
   init_compile_intent();
+  init_migration_refusal();
   ENTITY_TYPES4 = new Set([
     "req",
     "scenario",
@@ -78719,113 +79246,6 @@ function evaluateContractAgainstRun(artifact, contract) {
 }
 var MAX_ATTRIBUTED_MEMBERS = 5;
 
-// ../cli/dist/proof/integrations.js
-import { existsSync as existsSync41, readFileSync as readFileSync48 } from "node:fs";
-import path81 from "node:path";
-function integrationsPath(workspaceRoot) {
-  return path81.join(workspaceRoot, PROOF_INTEGRATIONS_PATH);
-}
-function proofIntegrationErrors(value) {
-  const file = record5(value);
-  if (!file)
-    return [
-      `${PROOF_INTEGRATIONS_PATH} must be an object with version and integrations`
-    ];
-  const errors = [];
-  if (file.version !== PROOF_INTEGRATION_VERSION)
-    errors.push(`version must be ${PROOF_INTEGRATION_VERSION}; received ${JSON.stringify(file.version ?? null)}`);
-  if (!Array.isArray(file.integrations) || file.integrations.length === 0) {
-    errors.push("integrations must be a non-empty array");
-    return errors;
-  }
-  const seen = new Set;
-  file.integrations.forEach((entry, index) => {
-    const row = record5(entry);
-    const label = `integrations[${index}]`;
-    if (!row) {
-      errors.push(`${label} must be an object`);
-      return;
-    }
-    if (!nonEmpty(row.id))
-      errors.push(`${label}.id must be a non-empty string`);
-    else {
-      if (seen.has(String(row.id)))
-        errors.push(`${label}.id duplicates '${String(row.id)}'`);
-      seen.add(String(row.id));
-    }
-    if (!nonEmpty(row.producer))
-      errors.push(`${label}.producer must be one of: ${PRODUCER_KINDS.join(", ")} (or a custom producer id)`);
-    if (!Array.isArray(row.command) || row.command.length === 0 || !row.command.every((argument) => nonEmpty(argument)))
-      errors.push(`${label}.command must be a non-empty argv array`);
-    if (nonEmpty(row.producer) && (row.producer === "junit" || row.producer === "tap") && !nonEmpty(row.artifact))
-      errors.push(`${label}.artifact is required for producer '${String(row.producer)}' (path of the native report to convert)`);
-    if (row.targets !== undefined) {
-      if (!Array.isArray(row.targets) || row.targets.length === 0 || !row.targets.every((target) => nonEmpty(target)))
-        errors.push(`${label}.targets must be a non-empty array of target names`);
-    }
-    if (row.options !== undefined && !record5(row.options))
-      errors.push(`${label}.options must be an object when present`);
-    if (row.description !== undefined && !nonEmpty(row.description))
-      errors.push(`${label}.description must be a non-empty string when present`);
-  });
-  return errors;
-}
-function loadProofIntegrations(workspaceRoot) {
-  const filePath = integrationsPath(workspaceRoot);
-  if (!existsSync41(filePath)) {
-    return {
-      available: false,
-      error: `No proof integration configuration at ${PROOF_INTEGRATIONS_PATH}. Run bootstrap for this repository to configure proof producers.`
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync48(filePath, "utf8"));
-  } catch (error) {
-    return {
-      available: false,
-      error: `${PROOF_INTEGRATIONS_PATH} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
-    };
-  }
-  const errors = proofIntegrationErrors(parsed);
-  if (errors.length > 0)
-    return {
-      available: false,
-      error: `Invalid ${PROOF_INTEGRATIONS_PATH}: ${errors.join("; ")}`
-    };
-  return { available: true, integrations: parsed };
-}
-function resolveIntegration(integrations, id) {
-  return integrations.integrations.find((entry) => entry.id === id) ?? null;
-}
-function toExecution(integration) {
-  return {
-    id: integration.id,
-    producer: integration.producer,
-    ...integration.producer_version !== undefined ? { producer_version: integration.producer_version } : {},
-    command: integration.command,
-    ...integration.artifact !== undefined ? { artifact: integration.artifact } : {},
-    ...integration.targets !== undefined ? { targets: integration.targets } : {},
-    ...integration.options !== undefined ? { options: integration.options } : {}
-  };
-}
-function record5(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function nonEmpty(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
-var PROOF_INTEGRATIONS_PATH = ".kb/proof/integrations.json", PRODUCER_KINDS;
-var init_integrations = __esm(() => {
-  init_proof_protocol();
-  PRODUCER_KINDS = [
-    "command",
-    "playwright",
-    "junit",
-    "tap"
-  ];
-});
-
 // ../cli/dist/operations/mutation/entity-projection.js
 function projectEntityProperties(entity) {
   const relationshipKeys = new Set(RELATIONSHIP_TYPES2);
@@ -79324,11 +79744,11 @@ function validateInput(input) {
   }
   return endpoint;
 }
-function isRecord24(value) {
+function isRecord25(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function decodeRows(payload) {
-  if (!isRecord24(payload) || !isRecord24(payload.results)) {
+  if (!isRecord25(payload) || !isRecord25(payload.results)) {
     throw new Error("SPARQL endpoint returned an invalid result document");
   }
   const bindings = payload.results.bindings;
@@ -79336,12 +79756,12 @@ function decodeRows(payload) {
     throw new Error("SPARQL endpoint returned an invalid bindings array");
   }
   const rows = bindings.map((binding) => {
-    if (!isRecord24(binding)) {
+    if (!isRecord25(binding)) {
       throw new Error("SPARQL endpoint returned an invalid binding");
     }
     const row = {};
     for (const [variable, term] of Object.entries(binding)) {
-      if (!isRecord24(term) || typeof term.value !== "string") {
+      if (!isRecord25(term) || typeof term.value !== "string") {
         throw new Error(`SPARQL endpoint returned an invalid ${variable} term`);
       }
       row[variable] = term.value;
@@ -79625,10 +80045,10 @@ init_generate();
 init_presentation();
 init_ir();
 // src/skill-operations.ts
-import { createHash as createHash41 } from "node:crypto";
+import { createHash as createHash42 } from "node:crypto";
 
 // src/skill-system/loader.ts
-import { existsSync as existsSync44, readFileSync as readFileSync50, readdirSync as readdirSync13, realpathSync as realpathSync10 } from "node:fs";
+import { existsSync as existsSync45, readFileSync as readFileSync51, readdirSync as readdirSync14, realpathSync as realpathSync10 } from "node:fs";
 import { dirname as dirname22, join as join34, resolve as resolve29 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
@@ -79675,7 +80095,7 @@ class SkillOversizeError2 extends Error {
 }
 
 // src/skill-system/paths.ts
-import { existsSync as existsSync42, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync43, statSync as statSync13 } from "node:fs";
 import { isAbsolute as isAbsolute19, join as join33, normalize as normalize3, relative as relative20, resolve as resolve27 } from "node:path";
 var SKILL_FILE_NAME2 = "SKILL.md";
 function normalizeResourcePath2(pathLike) {
@@ -79691,7 +80111,7 @@ function isWithinRoot3(rootDir, candidatePath) {
 }
 function resolveSkillFilePath2(pathLike) {
   const resolved = resolve27(pathLike);
-  if (existsSync42(resolved) && statSync13(resolved).isDirectory())
+  if (existsSync43(resolved) && statSync13(resolved).isDirectory())
     return join33(resolved, SKILL_FILE_NAME2);
   return resolved.endsWith(SKILL_FILE_NAME2) ? resolved : join33(resolved, SKILL_FILE_NAME2);
 }
@@ -79816,7 +80236,7 @@ function isStringArray2(value) {
 var moduleDir = dirname22(fileURLToPath5(import.meta.url));
 var overrideSkillsDir;
 function defaultBundledSkillsDir2() {
-  return existsSync44(resolve29(moduleDir, "skills")) ? resolve29(moduleDir, "skills") : resolve29(moduleDir, "../skills");
+  return existsSync45(resolve29(moduleDir, "skills")) ? resolve29(moduleDir, "skills") : resolve29(moduleDir, "../skills");
 }
 function setBundledSkillsDir2(dir) {
   overrideSkillsDir = dir;
@@ -79846,17 +80266,17 @@ function readBundledSkillResourceFrom2(skillsDir, id, resourcePath) {
   return readBundle2(loadBundledSkillFrom2(skillsDir, id), id, resourcePath);
 }
 function listFrom2(dir) {
-  if (!existsSync44(dir))
+  if (!existsSync45(dir))
     return [];
-  return readdirSync13(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join34(dir, entry.name)).filter((root) => existsSync44(join34(root, SKILL_FILE_NAME2))).map((root) => parseSkillBundle2(root).manifest).sort((a, b) => a.id.localeCompare(b.id));
+  return readdirSync14(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join34(dir, entry.name)).filter((root) => existsSync45(join34(root, SKILL_FILE_NAME2))).map((root) => parseSkillBundle2(root).manifest).sort((a, b) => a.id.localeCompare(b.id));
 }
 function findRoot2(dir, id) {
   return listRoots2(dir).find((root) => parseSkillBundle2(root).manifest.id === id);
 }
 function listRoots2(dir) {
-  if (!existsSync44(dir))
+  if (!existsSync45(dir))
     return [];
-  return readdirSync13(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join34(dir, entry.name)).filter((root) => existsSync44(join34(root, SKILL_FILE_NAME2)));
+  return readdirSync14(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join34(dir, entry.name)).filter((root) => existsSync45(join34(root, SKILL_FILE_NAME2)));
 }
 function readBundle2(bundle, id, resourcePath) {
   const resource = normalizeResourcePath2(resourcePath);
@@ -79874,7 +80294,7 @@ function readBundle2(bundle, id, resourcePath) {
     throw new SkillResourceNotFoundError2(id, resourcePath);
   }
   assertMaxBytes2(candidate, RESOURCE_MAX_BYTES2);
-  return readFileSync50(candidate, "utf8");
+  return readFileSync51(candidate, "utf8");
 }
 // src/skill-operations.ts
 function assertNonEmptyString2(value, field) {
@@ -79897,7 +80317,7 @@ async function executeSkillsLoad2(input, _context) {
   assertNonEmptyString2(id, "id");
   const bundle = loadBundledSkill2(id);
   const resources = bundle.manifest.resources ?? [];
-  const contentHash = createHash41("sha256").update(bundle.body, "utf8").digest("hex");
+  const contentHash = createHash42("sha256").update(bundle.body, "utf8").digest("hex");
   const resourceList = resources.length === 0 ? "none" : resources.join(", ");
   return {
     content: [
@@ -79997,6 +80417,7 @@ init_branch_store_locator();
 init_detached_snapshot();
 
 // src/index.ts
+init_result_envelope();
 init_engine();
 
 // ../cli/dist/public/prolog/index.js
@@ -80031,7 +80452,7 @@ init_symbols_coordinator2();
 // ../cli/dist/env/bootstrap.js
 import fs13 from "node:fs";
 import os2 from "node:os";
-import path82 from "node:path";
+import path83 from "node:path";
 var WORKSPACE_ENV_KEYS = [
   "KIBI_WORKSPACE",
   "KIBI_PROJECT_ROOT",
@@ -80057,13 +80478,13 @@ function readFirstEnv(env, keys) {
   return null;
 }
 function nextAncestorDirectory2(current) {
-  const parent = path82.dirname(current);
+  const parent = path83.dirname(current);
   return parent === current ? undefined : parent;
 }
 function findUpwards(startDir, marker) {
-  let current = path82.resolve(startDir);
+  let current = path83.resolve(startDir);
   while (current !== undefined) {
-    if (fs13.existsSync(path82.join(current, marker))) {
+    if (fs13.existsSync(path83.join(current, marker))) {
       return current;
     }
     current = nextAncestorDirectory2(current);
@@ -80073,24 +80494,24 @@ function findUpwards(startDir, marker) {
 function resolveKibiWorkspaceRoot(startDir = process.cwd(), env = process.env) {
   const envRoot = readFirstEnv(env, WORKSPACE_ENV_KEYS);
   if (envRoot)
-    return path82.resolve(envRoot);
+    return path83.resolve(envRoot);
   const kbRoot = findUpwards(startDir, ".kb");
   if (kbRoot)
     return kbRoot;
   const gitRoot = findUpwards(startDir, ".git");
   if (gitRoot)
     return gitRoot;
-  return path82.resolve(startDir);
+  return path83.resolve(startDir);
 }
 function resolveEnvFilePath(envFileName, workspaceRoot) {
-  if (path82.isAbsolute(envFileName))
+  if (path83.isAbsolute(envFileName))
     return envFileName;
-  return path82.resolve(workspaceRoot, envFileName);
+  return path83.resolve(workspaceRoot, envFileName);
 }
 function resolveKibiUserEnvPath(options2 = {}) {
   const env = options2.env ?? process.env;
-  const xdg = options2.xdgConfigHome?.trim() || env.XDG_CONFIG_HOME?.trim() || path82.join(options2.homedir ?? os2.homedir(), ".config");
-  return path82.join(xdg, "kibi", "env");
+  const xdg = options2.xdgConfigHome?.trim() || env.XDG_CONFIG_HOME?.trim() || path83.join(options2.homedir ?? os2.homedir(), ".config");
+  return path83.join(xdg, "kibi", "env");
 }
 function resolveKibiProjectEnvPath(workspaceRoot, env = process.env) {
   const override = env.KIBI_ENV_FILE?.trim();