mdkg 0.1.10 → 0.3.0

package/dist/cli.js

@@ -20,6 +20,7 @@ const format_1 = require("./commands/format");
 const doctor_1 = require("./commands/doctor");
 const db_1 = require("./commands/db");
 const capability_1 = require("./commands/capability");
+const spec_1 = require("./commands/spec");
 const archive_1 = require("./commands/archive");
 const bundle_1 = require("./commands/bundle");
 const subgraph_1 = require("./commands/subgraph");
@@ -63,6 +64,7 @@ function printUsage(log) {
     log("  pack        Generate a context pack");
     log("  skill       Create, list, show, search, and validate skills");
     log("  capability  List, search, show, and resolve cached capability surfaces");
+    log("  spec        List, show, and validate optional SPEC.md capability records");
     log("  archive     Add, list, show, verify, and compress archive sidecars");
     log("  bundle      Create, list, show, and verify full graph snapshot bundles");
     log("  subgraph    Register, sync, materialize, and verify read-only child graph snapshots");
@@ -194,18 +196,41 @@ function printDbHelp(log, subcommand) {
             return;
         case "snapshot":
             log("Usage:");
-            log("  mdkg db snapshot seal [--json]");
+            log("  mdkg db snapshot seal [--queue-policy drain|paused] [--json]");
             log("  mdkg db snapshot verify [--json]");
             log("  mdkg db snapshot status [--json]");
             log("  mdkg db snapshot dump [--snapshot <path>] [--output <path>] [--json]");
             log("  mdkg db snapshot diff <left-snapshot> <right-snapshot> [--json]");
             log("\nBoundaries:");
             log("  - snapshot seal writes a clean opt-in sealed project DB checkpoint");
+            log("  - default queue policy is drain: no ready or leased queue messages");
+            log("  - paused queue policy allows ready messages only in paused queues and never leased messages");
             log("  - snapshot verify/status read `.mdkg/db/state/project.sqlite` and its manifest");
             log("  - snapshot dump/diff are deterministic review aids, not source of truth");
             log("  - active runtime/WAL files remain ignored by default");
             printGlobalOptions(log);
             return;
+        case "queue":
+            log("Usage:");
+            log("  mdkg db queue create <queue> [--paused] [--reason <text>] [--json]");
+            log("  mdkg db queue pause <queue> [--reason <text>] [--json]");
+            log("  mdkg db queue resume <queue> [--json]");
+            log("  mdkg db queue enqueue <queue> <message-id> --payload-json <json>|--payload-file <path> [--dedupe-key <key>] [--available-at-ms <ms>] [--max-attempts <n>] [--json]");
+            log("  mdkg db queue claim <queue> --lease-owner <owner> --lease-ms <ms> [--json]");
+            log("  mdkg db queue ack <queue> <message-id> --lease-owner <owner> [--json]");
+            log("  mdkg db queue fail <queue> <message-id> --lease-owner <owner> --error <text> [--retry-after-ms <ms>] [--json]");
+            log("  mdkg db queue dead-letter <queue> <message-id> --lease-owner <owner> --error <text> [--json]");
+            log("  mdkg db queue release-expired [queue] [--json]");
+            log("  mdkg db queue stats [queue] [--json]");
+            log("  mdkg db queue list <queue> [--status ready|leased|acked|dead_letter|all] [--limit <n>] [--json]");
+            log("  mdkg db queue show <queue> <message-id> [--json]");
+            log("\nSemantics:");
+            log("  - queues are durable local delivery state, not canonical event history");
+            log("  - paused queues reject enqueue and claim");
+            log("  - ack, fail, dead-letter, and release-expired are allowed while paused so leased work can settle");
+            log("  - no raw SQL or hosted queue dependency is exposed");
+            printGlobalOptions(log);
+            return;
         default:
             log("Usage:");
             log("  mdkg db index rebuild [--tolerant] [--json]");
@@ -215,7 +240,13 @@ function printDbHelp(log, subcommand) {
             log("  mdkg db migrate [--json]");
             log("  mdkg db verify [--json]");
             log("  mdkg db stats [--json]");
-            log("  mdkg db snapshot seal [--json]");
+            log("  mdkg db queue create <queue> [--paused] [--reason <text>] [--json]");
+            log("  mdkg db queue enqueue <queue> <message-id> --payload-json <json>|--payload-file <path> [--json]");
+            log("  mdkg db queue claim <queue> --lease-owner <owner> --lease-ms <ms> [--json]");
+            log("  mdkg db queue ack|fail|dead-letter <queue> <message-id> --lease-owner <owner> [--json]");
+            log("  mdkg db queue pause|resume <queue> [--json]");
+            log("  mdkg db queue stats|list|show ... [--json]");
+            log("  mdkg db snapshot seal [--queue-policy drain|paused] [--json]");
             log("  mdkg db snapshot verify [--json]");
             log("  mdkg db snapshot status [--json]");
             log("  mdkg db snapshot dump [--snapshot <path>] [--output <path>] [--json]");
@@ -227,14 +258,15 @@ function printDbHelp(log, subcommand) {
             log("  - `mdkg db init` does not create an active runtime SQLite database");
             log("  - `mdkg db migrate` creates/updates the active runtime SQLite database");
             log("  - `mdkg db migrate` applies mdkg-owned foundation plus internal queue, event, receipt, reducer, and lease migrations");
-            log("  - queue tables are internal local delivery state; no public `mdkg db queue` CLI is exposed");
+            log("  - `mdkg db queue ...` exposes local durable queue delivery operations");
+            log("  - paused queues reject enqueue/claim and can be sealed with explicit paused snapshot policy");
             log("  - event rows are durable local history; receipts, reducers, and writer leases remain internal helper surfaces");
             log("  - no public `mdkg db event`, `mdkg db reducer`, or `mdkg db lease` CLI is exposed");
             log("  - `mdkg db verify` checks config, layout, SQLite integrity, migrations, and transient files");
             log("  - `mdkg db stats` reports table counts, migration state, DB size, and receipt counts");
             log("  - `mdkg db snapshot ...` manages opt-in sealed checkpoints and review dumps");
             log("  - active `.mdkg/db/runtime` and transient DB files are ignored by default");
-            log("  - no raw SQL, hosted queue/event store, profile, public queue/event/reducer/lease command, or publish behavior is exposed here");
+            log("  - no raw SQL, hosted queue/event store, profile, public event/reducer/lease command, or publish behavior is exposed here");
             printGlobalOptions(log);
     }
 }
@@ -405,6 +437,41 @@ function printCapabilityHelp(log, subcommand) {
             printGlobalOptions(log);
     }
 }
+function printSpecHelp(log, subcommand) {
+    switch ((subcommand ?? "").toLowerCase()) {
+        case "list":
+            log("Usage:");
+            log("  mdkg spec list [--json]");
+            log("\nNotes:");
+            log("  SPEC.md is optional and declares reusable capability surfaces.");
+            printGlobalOptions(log);
+            return;
+        case "show":
+            log("Usage:");
+            log("  mdkg spec show <id-or-qid-or-alias> [--json]");
+            log("\nNotes:");
+            log("  Shows one optional SPEC.md capability record from the capability index.");
+            printGlobalOptions(log);
+            return;
+        case "validate":
+            log("Usage:");
+            log("  mdkg spec validate [<id-or-qid-or-alias>] [--json]");
+            log("\nNotes:");
+            log("  With no reference, validates the graph and all optional SPEC.md capability records.");
+            log("  With a reference, also ensures that specific SPEC.md capability exists.");
+            printGlobalOptions(log);
+            return;
+        default:
+            log("Usage:");
+            log("  mdkg spec list [--json]");
+            log("  mdkg spec show <id-or-qid-or-alias> [--json]");
+            log("  mdkg spec validate [<id-or-qid-or-alias>] [--json]");
+            log("\nNotes:");
+            log("  SPEC.md is optional and reusable-capability oriented.");
+            log("  Use `mdkg capability ...` for broader skill, SPEC.md, WORK.md, core-doc, and design-doc discovery.");
+            printGlobalOptions(log);
+    }
+}
 function printArchiveHelp(log, subcommand) {
     switch ((subcommand ?? "").toLowerCase()) {
         case "add":
@@ -550,15 +617,31 @@ function printWorkHelp(log, subcommand) {
             log("Usage:");
             log('  mdkg work contract new "<title>" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]');
             break;
+        case "trigger":
+            log("Usage:");
+            log('  mdkg work trigger <work-or-capability-ref> [--id <order.id>] [--title "<title>"] [--requester <ref>] [--enqueue <queue>] [--json]');
+            log("\nExample:");
+            log("  mdkg work trigger work.example --id order.example-1 --requester user://example --json");
+            log("\nNotes:");
+            log("  Accepted targets: direct WORK.md ref, or SPEC.md ref with exactly one resolvable work contract.");
+            log("  Creates a deterministic WORK_ORDER.md semantic mirror and does not execute work.");
+            log("  Queue enqueue requires a valid project DB plus an explicitly created active queue and never executes work.");
+            break;
         case "order":
             log("Usage:");
-            log('  mdkg work order new "<title>" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--input-refs <...>] [--requested-outputs <...>] [--json]');
-            log("  mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-artifacts <...>] [--json]");
+            log('  mdkg work order new "<title>" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]');
+            log("  mdkg work order status <id-or-qid> [--json]");
+            log("  mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-queue-refs <...>] [--add-artifacts <...>] [--json]");
+            log("\nNotes:");
+            log("  work order status is read-only and reports deterministic JSON order state plus linked receipts.");
             break;
         case "receipt":
             log("Usage:");
-            log('  mdkg work receipt new "<title>" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--json]');
-            log("  mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--json]");
+            log('  mdkg work receipt new "<title>" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]');
+            log("  mdkg work receipt verify <id-or-qid> [--json]");
+            log("  mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--add-evidence-hashes <sha256:...>] [--json]");
+            log("\nNotes:");
+            log("  work receipt verify is read-only and reports deterministic JSON linkage, evidence, hash, outcome, and redaction checks.");
             break;
         case "artifact":
             log("Usage:");
@@ -567,8 +650,9 @@ function printWorkHelp(log, subcommand) {
         default:
             log("Usage:");
             log("  mdkg work contract new ...");
-            log("  mdkg work order new|update ...");
-            log("  mdkg work receipt new|update ...");
+            log("  mdkg work trigger <work-or-capability-ref> ...");
+            log("  mdkg work order new|status|update ...");
+            log("  mdkg work receipt new|verify|update ...");
             log("  mdkg work artifact add ...");
             log("\nNotes:");
             log("  - work commands mutate semantic mirror files only");
@@ -807,6 +891,9 @@ function printCommandHelp(log, command, subcommand) {
         case "capability":
             printCapabilityHelp(log, subcommand);
             return;
+        case "spec":
+            printSpecHelp(log, subcommand);
+            return;
         case "archive":
             printArchiveHelp(log, subcommand);
             return;
@@ -922,6 +1009,16 @@ function parseNumberFlag(flag, value) {
     }
     return parsed;
 }
+function parseQueuePolicyFlag(value) {
+    const raw = requireFlagValue("--queue-policy", value);
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (raw === "drain" || raw === "paused") {
+        return raw;
+    }
+    throw new errors_1.UsageError("--queue-policy must be drain or paused");
+}
 function parseEdgesFlag(value) {
     if (value === undefined) {
         return undefined;
@@ -1109,6 +1206,107 @@ function runDbSubcommand(parsed, root) {
             (0, db_1.runDbStatsCommand)({ root, json: parseBooleanFlag("--json", parsed.flags["--json"]) });
             return 0;
         }
+        case "queue": {
+            const action = (parsed.positionals[2] ?? "").toLowerCase();
+            const json = parseBooleanFlag("--json", parsed.flags["--json"]);
+            const queueName = parsed.positionals[3];
+            const messageId = parsed.positionals[4];
+            const common = {
+                root,
+                json,
+                queueName,
+                messageId,
+                leaseOwner: requireFlagValue("--lease-owner", parsed.flags["--lease-owner"]),
+                leaseMs: parseNumberFlag("--lease-ms", parsed.flags["--lease-ms"]),
+                payloadJson: requireFlagValue("--payload-json", parsed.flags["--payload-json"]),
+                payloadFile: requireFlagValue("--payload-file", parsed.flags["--payload-file"]),
+                dedupeKey: requireFlagValue("--dedupe-key", parsed.flags["--dedupe-key"]),
+                availableAtMs: parseNumberFlag("--available-at-ms", parsed.flags["--available-at-ms"]),
+                maxAttempts: parseNumberFlag("--max-attempts", parsed.flags["--max-attempts"]),
+                retryAfterMs: parseNumberFlag("--retry-after-ms", parsed.flags["--retry-after-ms"]),
+                error: requireFlagValue("--error", parsed.flags["--error"]),
+                paused: parseBooleanFlag("--paused", parsed.flags["--paused"]),
+                reason: requireFlagValue("--reason", parsed.flags["--reason"]),
+                status: requireFlagValue("--status", parsed.flags["--status"]),
+                limit: parseNumberFlag("--limit", parsed.flags["--limit"]),
+            };
+            switch (action) {
+                case "create":
+                    if (!queueName || parsed.positionals.length > 4) {
+                        throw new errors_1.UsageError("mdkg db queue create requires <queue>");
+                    }
+                    (0, db_1.runDbQueueCreateCommand)(common);
+                    return 0;
+                case "pause":
+                    if (!queueName || parsed.positionals.length > 4) {
+                        throw new errors_1.UsageError("mdkg db queue pause requires <queue>");
+                    }
+                    (0, db_1.runDbQueuePauseCommand)(common);
+                    return 0;
+                case "resume":
+                    if (!queueName || parsed.positionals.length > 4) {
+                        throw new errors_1.UsageError("mdkg db queue resume requires <queue>");
+                    }
+                    (0, db_1.runDbQueueResumeCommand)(common);
+                    return 0;
+                case "enqueue":
+                    if (!queueName || !messageId || parsed.positionals.length > 5) {
+                        throw new errors_1.UsageError("mdkg db queue enqueue requires <queue> <message-id>");
+                    }
+                    (0, db_1.runDbQueueEnqueueCommand)(common);
+                    return 0;
+                case "claim":
+                    if (!queueName || parsed.positionals.length > 4) {
+                        throw new errors_1.UsageError("mdkg db queue claim requires <queue>");
+                    }
+                    (0, db_1.runDbQueueClaimCommand)(common);
+                    return 0;
+                case "ack":
+                    if (!queueName || !messageId || parsed.positionals.length > 5) {
+                        throw new errors_1.UsageError("mdkg db queue ack requires <queue> <message-id>");
+                    }
+                    (0, db_1.runDbQueueAckCommand)(common);
+                    return 0;
+                case "fail":
+                    if (!queueName || !messageId || parsed.positionals.length > 5) {
+                        throw new errors_1.UsageError("mdkg db queue fail requires <queue> <message-id>");
+                    }
+                    (0, db_1.runDbQueueFailCommand)(common);
+                    return 0;
+                case "dead-letter":
+                    if (!queueName || !messageId || parsed.positionals.length > 5) {
+                        throw new errors_1.UsageError("mdkg db queue dead-letter requires <queue> <message-id>");
+                    }
+                    (0, db_1.runDbQueueDeadLetterCommand)(common);
+                    return 0;
+                case "release-expired":
+                    if (parsed.positionals.length > 4) {
+                        throw new errors_1.UsageError("mdkg db queue release-expired accepts at most one queue");
+                    }
+                    (0, db_1.runDbQueueReleaseExpiredCommand)(common);
+                    return 0;
+                case "stats":
+                    if (parsed.positionals.length > 4) {
+                        throw new errors_1.UsageError("mdkg db queue stats accepts at most one queue");
+                    }
+                    (0, db_1.runDbQueueStatsCommand)(common);
+                    return 0;
+                case "list":
+                    if (!queueName || parsed.positionals.length > 4) {
+                        throw new errors_1.UsageError("mdkg db queue list requires <queue>");
+                    }
+                    (0, db_1.runDbQueueListCommand)(common);
+                    return 0;
+                case "show":
+                    if (!queueName || !messageId || parsed.positionals.length > 5) {
+                        throw new errors_1.UsageError("mdkg db queue show requires <queue> <message-id>");
+                    }
+                    (0, db_1.runDbQueueShowCommand)(common);
+                    return 0;
+                default:
+                    throw new errors_1.UsageError("mdkg db queue requires create/pause/resume/enqueue/claim/ack/fail/dead-letter/release-expired/stats/list/show");
+            }
+        }
         case "snapshot": {
             const action = (parsed.positionals[2] ?? "").toLowerCase();
             const json = parseBooleanFlag("--json", parsed.flags["--json"]);
@@ -1117,7 +1315,7 @@ function runDbSubcommand(parsed, root) {
                     if (parsed.positionals.length > 3) {
                         throw new errors_1.UsageError("mdkg db snapshot seal does not accept positional arguments");
                     }
-                    (0, db_1.runDbSnapshotSealCommand)({ root, json });
+                    (0, db_1.runDbSnapshotSealCommand)({ root, json, queuePolicy: parseQueuePolicyFlag(parsed.flags["--queue-policy"]) });
                     return 0;
                 case "verify":
                     if (parsed.positionals.length > 3) {
@@ -1154,7 +1352,7 @@ function runDbSubcommand(parsed, root) {
             }
         }
         default:
-            throw new errors_1.UsageError("mdkg db requires index/init/migrate/verify/stats/snapshot");
+            throw new errors_1.UsageError("mdkg db requires index/init/migrate/verify/stats/queue/snapshot");
     }
 }
 function runCapabilitySubcommand(parsed, root) {
@@ -1212,6 +1410,45 @@ function runCapabilitySubcommand(parsed, root) {
             throw new errors_1.UsageError("capability requires list/search/show/resolve");
     }
 }
+function runSpecSubcommand(parsed, root) {
+    const subcommand = (parsed.positionals[1] ?? "").toLowerCase();
+    switch (subcommand) {
+        case "list": {
+            if (parsed.positionals.length > 2) {
+                throw new errors_1.UsageError("spec list does not accept positional arguments");
+            }
+            const json = parseBooleanFlag("--json", parsed.flags["--json"]);
+            const noCache = parseBooleanFlag("--no-cache", parsed.flags["--no-cache"]);
+            const noReindex = parseBooleanFlag("--no-reindex", parsed.flags["--no-reindex"]);
+            (0, spec_1.runSpecListCommand)({ root, json, noCache, noReindex });
+            return 0;
+        }
+        case "show": {
+            const id = parsed.positionals[2];
+            if (!id || parsed.positionals.length > 3) {
+                throw new errors_1.UsageError("spec show requires <id-or-qid-or-alias>");
+            }
+            const json = parseBooleanFlag("--json", parsed.flags["--json"]);
+            const noCache = parseBooleanFlag("--no-cache", parsed.flags["--no-cache"]);
+            const noReindex = parseBooleanFlag("--no-reindex", parsed.flags["--no-reindex"]);
+            (0, spec_1.runSpecShowCommand)({ root, id, json, noCache, noReindex });
+            return 0;
+        }
+        case "validate": {
+            const id = parsed.positionals[2];
+            if (parsed.positionals.length > 3) {
+                throw new errors_1.UsageError("spec validate accepts at most one SPEC reference");
+            }
+            const json = parseBooleanFlag("--json", parsed.flags["--json"]);
+            const noCache = parseBooleanFlag("--no-cache", parsed.flags["--no-cache"]);
+            const noReindex = parseBooleanFlag("--no-reindex", parsed.flags["--no-reindex"]);
+            (0, spec_1.runSpecValidateCommand)({ root, id, json, noCache, noReindex });
+            return 0;
+        }
+        default:
+            throw new errors_1.UsageError("spec requires list/show/validate");
+    }
+}
 function runArchiveSubcommand(parsed, root) {
     const subcommand = (parsed.positionals[1] ?? "").toLowerCase();
     switch (subcommand) {
@@ -1446,6 +1683,18 @@ function runWorkSubcommand(parsed, root) {
     const action = (parsed.positionals[2] ?? "").toLowerCase();
     const ws = requireFlagValue("--ws", parsed.flags["--ws"]);
     const json = parseBooleanFlag("--json", parsed.flags["--json"]);
+    if (domain === "trigger") {
+        const targetRef = parsed.positionals[2];
+        if (!targetRef || parsed.positionals.length > 3) {
+            throw new errors_1.UsageError("work trigger requires <work-or-capability-ref>");
+        }
+        const id = requireFlagValue("--id", parsed.flags["--id"]);
+        const title = requireFlagValue("--title", parsed.flags["--title"]);
+        const requester = requireFlagValue("--requester", parsed.flags["--requester"]);
+        const enqueue = requireFlagValue("--enqueue", parsed.flags["--enqueue"]);
+        (0, work_1.runWorkTriggerCommand)({ root, ws, targetRef, id, title, requester, enqueue, json });
+        return 0;
+    }
     if (domain === "contract" && action === "new") {
         const title = parsed.positionals.slice(3).join(" ");
         const id = requireFlagValue("--id", parsed.flags["--id"]);
@@ -1482,7 +1731,10 @@ function runWorkSubcommand(parsed, root) {
             throw new errors_1.UsageError("work order new requires title, --id, --work-id, and --requester");
         }
         const requestRef = requireFlagValue("--request-ref", parsed.flags["--request-ref"]);
+        const triggerRef = requireFlagValue("--trigger-ref", parsed.flags["--trigger-ref"]);
+        const payloadHash = requireFlagValue("--payload-hash", parsed.flags["--payload-hash"]);
         const inputRefs = requireFlagValue("--input-refs", parsed.flags["--input-refs"]);
+        const queueRefs = requireFlagValue("--queue-refs", parsed.flags["--queue-refs"]);
         const requestedOutputs = requireFlagValue("--requested-outputs", parsed.flags["--requested-outputs"]);
         const constraintRefs = requireFlagValue("--constraint-refs", parsed.flags["--constraint-refs"]);
         (0, work_1.runWorkOrderNewCommand)({
@@ -1493,7 +1745,10 @@ function runWorkSubcommand(parsed, root) {
             workId,
             requester,
             requestRef,
+            triggerRef,
+            payloadHash,
             inputRefs,
+            queueRefs,
             requestedOutputs,
             constraintRefs,
             json,
@@ -1507,8 +1762,17 @@ function runWorkSubcommand(parsed, root) {
         }
         const status = requireFlagValue("--status", parsed.flags["--status"]);
         const addInputRefs = requireFlagValue("--add-input-refs", parsed.flags["--add-input-refs"]);
+        const addQueueRefs = requireFlagValue("--add-queue-refs", parsed.flags["--add-queue-refs"]);
         const addArtifacts = requireFlagValue("--add-artifacts", parsed.flags["--add-artifacts"]);
-        (0, work_1.runWorkOrderUpdateCommand)({ root, ws, id, status, addInputRefs, addArtifacts, json });
+        (0, work_1.runWorkOrderUpdateCommand)({ root, ws, id, status, addInputRefs, addQueueRefs, addArtifacts, json });
+        return 0;
+    }
+    if (domain === "order" && action === "status") {
+        const id = parsed.positionals[3];
+        if (!id || parsed.positionals.length > 4) {
+            throw new errors_1.UsageError("work order status requires <id-or-qid>");
+        }
+        (0, work_1.runWorkOrderStatusCommand)({ root, ws, id, json });
         return 0;
     }
     if (domain === "receipt" && action === "new") {
@@ -1521,9 +1785,11 @@ function runWorkSubcommand(parsed, root) {
         }
         const receiptStatus = requireFlagValue("--receipt-status", parsed.flags["--receipt-status"]);
         const costRef = requireFlagValue("--cost-ref", parsed.flags["--cost-ref"]);
+        const redactionPolicy = requireFlagValue("--redaction-policy", parsed.flags["--redaction-policy"]);
         const artifacts = requireFlagValue("--artifacts", parsed.flags["--artifacts"]);
         const proofRefs = requireFlagValue("--proof-refs", parsed.flags["--proof-refs"]);
         const attestationRefs = requireFlagValue("--attestation-refs", parsed.flags["--attestation-refs"]);
+        const evidenceHashes = requireFlagValue("--evidence-hashes", parsed.flags["--evidence-hashes"]);
         const inputHashes = requireFlagValue("--input-hashes", parsed.flags["--input-hashes"]);
         const outputHashes = requireFlagValue("--output-hashes", parsed.flags["--output-hashes"]);
         (0, work_1.runWorkReceiptNewCommand)({
@@ -1535,9 +1801,11 @@ function runWorkSubcommand(parsed, root) {
             outcome,
             receiptStatus,
             costRef,
+            redactionPolicy,
             artifacts,
             proofRefs,
             attestationRefs,
+            evidenceHashes,
             inputHashes,
             outputHashes,
             json,
@@ -1553,6 +1821,7 @@ function runWorkSubcommand(parsed, root) {
         const addArtifacts = requireFlagValue("--add-artifacts", parsed.flags["--add-artifacts"]);
         const addProofRefs = requireFlagValue("--add-proof-refs", parsed.flags["--add-proof-refs"]);
         const addAttestationRefs = requireFlagValue("--add-attestation-refs", parsed.flags["--add-attestation-refs"]);
+        const addEvidenceHashes = requireFlagValue("--add-evidence-hashes", parsed.flags["--add-evidence-hashes"]);
         (0, work_1.runWorkReceiptUpdateCommand)({
             root,
             ws,
@@ -1561,10 +1830,19 @@ function runWorkSubcommand(parsed, root) {
             addArtifacts,
             addProofRefs,
             addAttestationRefs,
+            addEvidenceHashes,
             json,
         });
         return 0;
     }
+    if (domain === "receipt" && action === "verify") {
+        const id = parsed.positionals[3];
+        if (!id || parsed.positionals.length > 4) {
+            throw new errors_1.UsageError("work receipt verify requires <id-or-qid>");
+        }
+        (0, work_1.runWorkReceiptVerifyCommand)({ root, ws, id, json });
+        return 0;
+    }
     if (domain === "artifact" && action === "add") {
         const targetId = parsed.positionals[3];
         const file = parsed.positionals[4];
@@ -2034,6 +2312,8 @@ function runCommand(parsed, root, runtime) {
             return runSkillSubcommand(parsed, root);
         case "capability":
             return runCapabilitySubcommand(parsed, root);
+        case "spec":
+            return runSpecSubcommand(parsed, root);
         case "archive":
             return runArchiveSubcommand(parsed, root);
         case "bundle":

package/dist/commands/capability.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCapabilityRecords = loadCapabilityRecords;
+exports.filterCapabilityRecords = filterCapabilityRecords;
+exports.resolveCapabilityRecord = resolveCapabilityRecord;
 exports.runCapabilityListCommand = runCapabilityListCommand;
 exports.runCapabilitySearchCommand = runCapabilitySearchCommand;
 exports.runCapabilityShowCommand = runCapabilityShowCommand;
@@ -29,7 +32,7 @@ function normalizeVisibility(value) {
     }
     throw new errors_1.UsageError(`--visibility must be one of ${capabilities_indexer_1.CAPABILITY_VISIBILITIES.join(", ")}`);
 }
-function loadRecords(options) {
+function loadCapabilityRecords(options) {
     const config = (0, config_1.loadConfig)(options.root);
     const { index, stale, rebuilt } = (0, capabilities_index_cache_1.loadCapabilitiesIndex)({
         root: options.root,
@@ -46,7 +49,7 @@ function loadRecords(options) {
     }
     return [...index.records, ...subgraph.records];
 }
-function applyFilters(records, options) {
+function filterCapabilityRecords(records, options) {
     const kind = normalizeKind(options.kind);
     const visibility = normalizeVisibility(options.visibility);
     return records.filter((record) => {
@@ -78,6 +81,7 @@ function capabilitySearchText(record) {
         ...record.headings.map((heading) => heading.text),
         JSON.stringify(record.spec ?? {}),
         JSON.stringify(record.work ?? {}),
+        JSON.stringify(record.linkage ?? {}),
         JSON.stringify(record.skill ?? {}),
     ]
         .filter((value) => typeof value === "string" && value.length > 0)
@@ -117,6 +121,7 @@ function requirementMatch(record, required) {
         ...record.tags,
         JSON.stringify(record.spec ?? {}),
         JSON.stringify(record.work ?? {}),
+        JSON.stringify(record.linkage ?? {}),
         JSON.stringify(record.skill ?? {}),
     ]
         .join(" ")
@@ -199,7 +204,7 @@ function printCapabilityList(records, json, query) {
         console.log(`${record.qid} | ${record.kind} | ${record.visibility} | ${label} | ${record.title}`);
     }
 }
-function resolveCapability(records, id) {
+function resolveCapabilityRecord(records, id) {
     const normalized = id.toLowerCase();
     const exact = records.find((record) => record.qid === id || record.id === id);
     if (exact) {
@@ -233,19 +238,19 @@ function printCapability(record, json) {
     console.log(`path: ${record.path}`);
 }
 function runCapabilityListCommand(options) {
-    const records = applyFilters(loadRecords(options), options);
+    const records = filterCapabilityRecords(loadCapabilityRecords(options), options);
     printCapabilityList(records, options.json);
 }
 function runCapabilitySearchCommand(options) {
-    const records = applyFilters(loadRecords(options), options).filter((record) => matchesQuery(record, options.query));
+    const records = filterCapabilityRecords(loadCapabilityRecords(options), options).filter((record) => matchesQuery(record, options.query));
     printCapabilityList(records, options.json, options.query);
 }
 function runCapabilityShowCommand(options) {
-    const records = loadRecords(options);
-    printCapability(resolveCapability(records, options.id), options.json);
+    const records = loadCapabilityRecords(options);
+    printCapability(resolveCapabilityRecord(records, options.id), options.json);
 }
 function runCapabilityResolveCommand(options) {
-    const records = applyFilters(loadRecords(options), options);
+    const records = filterCapabilityRecords(loadCapabilityRecords(options), options);
     const items = resolveCapabilities(records, options).map((record, rank) => ({
         rank: rank + 1,
         score: resolveScore(record, options),