quoxcli 0.0.0-stage → 0.3.1

package/lib/quoxon/objects/ladder.js

@@ -0,0 +1,71 @@
+/**
+ * E7 rules precedence: three layers that are visibly different and never confused.
+ *   advisory  QUOX.md files this client found (sent as context; cannot grant or bypass anything)
+ *   pack      the signed core dev pack on this machine (~/.claude/skills/.pack-version and
+ *             .pack-rights.json, written by the collector's skill-pack installer): team guidance for
+ *             coding agents, still advisory
+ *   enforced  ARMED governance policies on the server (GET /orgs/:org/governance/policies): the only
+ *             layer that can stop an action
+ * The effective layer is the highest one that has rules. An unreadable layer is reported, and never
+ * treated as empty when deciding what is effective.
+ */
+import { seg, fit, plural } from './model.js';
+
+/** Pure: read the pack marker files through an injected reader (fs.readFileSync-like, may throw). */
+export function packFrom(read) {
+  let marker = null, rights = null;
+  try { marker = String(read('.pack-version')).trim(); } catch { /* absent */ }
+  try { rights = JSON.parse(read('.pack-rights.json')); } catch { /* absent */ }
+  if (!marker && !rights) return { state: 'none' };
+  let m = null;
+  try { m = marker ? JSON.parse(marker) : null; } catch { m = null; }
+  const version = rights?.version ?? m?.version ?? (marker && !m ? marker : null);
+  return { state: 'installed', version: version != null ? String(version) : null, packId: rights?.packId ?? m?.packId ?? null, skills: Array.isArray(rights?.rights) ? rights.rights.length : null };
+}
+
+/**
+ * d: { quoxmd: loadRules() result | null, enabled: boolean, pack: packFrom() result,
+ *      policies: { ok: true, list } | { ok: false, error } }
+ */
+export function rulesLadder(d, cols) {
+  const nw = cols < 66;
+  const rows = [];
+  const files = d.quoxmd?.files || [];
+  const pol = d.policies || { ok: false, error: 'not read' };
+  const armed = pol.ok ? (pol.list || []).filter(p => p.state === 'armed') : [];
+  const staged = pol.ok ? (pol.list || []).filter(p => p.state === 'draft') : [];
+  const layers = [
+    { tag: 'advisory', role: 'muted', has: files.length > 0 && d.enabled !== false,
+      src: !files.length ? 'no QUOX.md found' : d.enabled === false ? `QUOX.md (${files.length}) · off this session` : `QUOX.md (${plural(files.length, 'file')}${d.quoxmd?.truncated ? ', cut' : ''})`,
+      scope: nw ? 'local' : 'you, this machine · guides only' },
+    { tag: 'pack', role: 'teal', has: d.pack?.state === 'installed',
+      src: d.pack?.state === 'installed' ? `core dev pack${d.pack.version ? ` v${d.pack.version}` : ''}${d.pack.skills != null && !nw ? ` · ${d.pack.skills} skills` : ''}` : 'not installed here',
+      scope: nw ? 'team' : 'team, signed · guides only' },
+    { tag: 'enforced', role: 'indigo', has: armed.length > 0, unknown: !pol.ok,
+      src: pol.ok ? (armed.length ? `${plural(armed.length, 'governance policy', 'governance policies')} armed` : 'no armed policy') : `could not read (${fit(pol.error, 28)})`,
+      scope: nw ? 'server' : 'server, cannot be bypassed' }
+  ];
+  const top = pol.ok ? [...layers].reverse().find(l => l.has) : null;
+  rows.push([seg('rules ', 'muted'), seg(nw ? 'precedence, top wins' : 'precedence · the highest layer with rules wins', 'value', true)]);
+  for (const l of [...layers].reverse()) {
+    const on = top === l;
+    const lose = top && !on && l.has;
+    rows.push([
+      seg(on ? '▸ ' : '  ', on ? 'value' : 'faint', true),
+      seg(l.tag.padEnd(9), lose ? 'faint' : l.unknown ? 'warn' : l.role, on),
+      seg(fit(l.src, nw ? cols - 14 : 34).padEnd(nw ? 0 : 35), l.unknown ? 'warn' : lose ? 'muted' : 'value', on),
+      ...(nw ? [] : [seg(fit(l.scope, Math.max(0, cols - 50)), 'muted')])
+    ]);
+  }
+  for (const p of armed.slice(0, 4)) rows.push([seg('    · ', 'faint'), seg(fit(`"${p.rule_text}"`, cols - 24), 'value'), seg(` → ${p.policy?.effect || 'enforced'}`, 'indigo')]);
+  if (armed.length > 4) rows.push([seg(`    … ${armed.length - 4} more armed`, 'muted')]);
+  if (staged.length) rows.push([seg(`    ${plural(staged.length, 'draft')} not armed (enforce nothing until armed)`, 'muted')]);
+  let eff;
+  if (!pol.ok) eff = [seg(nw ? 'effective: unknown (policies unreadable)' : 'effective: unknown · the server\'s policies could not be read, so nothing here is called enforced', 'warn')];
+  else if (top?.tag === 'enforced') eff = [seg(nw ? 'effective: enforced (server wins)' : 'effective: enforced · server policy outranks pack and QUOX.md', 'indigo')];
+  else if (top) eff = [seg(nw ? `effective: ${top.tag} (advisory only)` : `effective: ${top.tag} · advisory, guides the agent but enforces nothing`, top.role === 'muted' ? 'value' : top.role)];
+  else eff = [seg('effective: none · no rules at any layer', 'muted')];
+  rows.push(eff);
+  rows.push([seg(nw ? '/rules files: the QUOX.md text' : '/rules files shows the QUOX.md text · /rules off|on', 'faint')]);
+  return { rows };
+}

package/lib/quoxon/objects/memory.js

@@ -0,0 +1,44 @@
+/**
+ * E6 memory facts with provenance, from GET /api/memory/search (memory service). Each fact shows what
+ * the record says about where it came from (provenance, type, source conversation or agent), how old
+ * and how trusted it is (confidence, verification, use), and any conflict state (superseded or
+ * invalid) in plain sight, never hidden.
+ */
+import { seg, fit, ago, short, plural } from './model.js';
+
+const PROVENANCE = {
+  model_inference: 'inferred by a model', user_stated: 'stated by a user', user_confirmed: 'confirmed by a user',
+  tool_output: 'from a tool result', document: 'from a document', imported: 'imported', system: 'system'
+};
+export const provenanceWord = (p) => (p ? PROVENANCE[p] || String(p).replace(/_/g, ' ') : null);
+
+/** d: { query, results: [...], total?, now } */
+export function memoryFacts(d, cols, { max = 5 } = {}) {
+  const now = d.now ?? Date.now();
+  const nw = cols < 70;
+  const inner = Math.max(20, cols - 6);
+  const rows = [];
+  const res = (d.results || []).slice(0, max);
+  if (!res.length) return { rows: [[seg(`No memory matches "${fit(d.query, 40)}".`, 'muted')]] };
+  rows.push([seg(`${plural((d.results || []).length, 'fact')} for "${fit(d.query, 40)}"${(d.results || []).length > max ? `, showing ${max}` : ''}`, 'muted')]);
+  const L = (label, text, role = 'value') => [seg('  '), seg(label.padEnd(7), 'muted'), seg(fit(text, inner - 9), role)];
+  for (const m of res) {
+    rows.push([seg(' ')]);
+    rows.push([seg('◆ ', 'indigo', true), seg(m.memory_role === 'fact' || !m.memory_role ? 'fact ' : `${m.memory_role} `, 'muted'), seg(fit(m.content, inner - 8), 'value', true)]);
+    const src = [provenanceWord(m.provenance), m.memory_type].filter(Boolean);
+    if (m.source_conversation_id) src.push(nw ? `chat ${short(m.source_conversation_id, 8)}` : `conversation ${short(m.source_conversation_id, 10)}`);
+    if (m.agent_id) src.push(`agent ${m.agent_id}`);
+    if (src.length) rows.push(L('source', src.join(' · ')));
+    const age = [];
+    const created = m.created_at || m.createdAt;
+    if (created) age.push(`${ago(created, now)} old`);
+    if (m.confidence != null) age.push(`confidence ${Math.round(Number(m.confidence) * 100)}%`);
+    if (m.verified_at) age.push(`verified${m.verified_by ? ` by ${short(m.verified_by, 10)}` : ''} ${ago(m.verified_at, now)} ago`);
+    else age.push('not verified');
+    if (m.access_count) age.push(`used ${plural(Number(m.access_count), 'time')}`);
+    rows.push(L('age', age.join(' · '), 'muted'));
+    if (m.superseded_by) rows.push(L('status', `superseded by ${short(m.superseded_by, 12)}`, 'warn'));
+    else if (m.valid === false || m.valid === 0) rows.push(L('status', 'marked invalid', 'error'));
+  }
+  return { rows };
+}

package/lib/quoxon/objects/mirror.js

@@ -0,0 +1,137 @@
+/**
+ * /mirror: the Mirror, what CommanderQ sees about this org right now. Read from GET /api/v1/mind/mirror,
+ * the org-scoped object the collector builds from each owning service and injects into CommanderQ's
+ * [SELF-KNOWLEDGE]. Sectioned: identity, health, implants, capabilities, plugins, memory, codebase,
+ * then every unknown with its code, service and message. `/mirror agents` lists the agents.
+ * Text wraps to width, never clipped. No grey roles: 'value' text, 'sky' headings, 'ok'/'warn' state.
+ */
+import { seg, boxWidth, len } from './model.js';
+
+const age = (ms) => {
+  if (!Number.isFinite(ms)) return '';
+  const s = Math.max(0, Math.floor(ms / 1000));
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  return h < 48 ? `${h}h` : `${Math.floor(h / 24)}d`;
+};
+
+/** Word-wrap to n display chars; a word longer than n is hard-split. Nothing is dropped. */
+export function wrapText(text, n) {
+  const out = [];
+  for (const para of String(text ?? '').split('\n')) {
+    let line = '';
+    for (let w of para.split(/\s+/).filter(Boolean)) {
+      while (len(w) > n) {
+        if (line) { out.push(line); line = ''; }
+        out.push([...w].slice(0, n).join('')); w = [...w].slice(n).join('');
+      }
+      if (!line) line = w;
+      else if (len(line) + 1 + len(w) <= n) line += ' ' + w;
+      else { out.push(line); line = w; }
+    }
+    out.push(line);
+  }
+  return out;
+}
+
+const ICON = { healthy: '✔', degraded: '⚠', weak: '⚠', collecting: '◐', 'license-required': '⛔', unreachable: '✖', 'not-reported': '◐' };
+const unk = (u) => `unknown: ${u.code} (${u.service}: ${u.message})`;
+const isUnk = (v) => v && typeof v === 'object' && v.unknown;
+
+/** d: GET /api/v1/mind/mirror body (+ view: 'agents'). -> view { box, rows } */
+export function mirrorCard(d, cols) {
+  const w = boxWidth(cols, 100), inner = w - 4;
+  const rows = [];
+  const put = (t, role = 'value', indent = 0) => { const pad = ' '.repeat(indent); for (const l of wrapText(t, inner - indent)) rows.push([seg(pad + l, role)]); };
+  const head = (t) => { if (rows.length) rows.push([seg(' ')]); rows.push([seg(t, 'sky', true)]); };
+  const m = d?.mirror;
+  const a = age(d?.age_ms);
+  const right = `${a ? `${a} old · ` : ''}${d?.fresh ? 'fresh' : 'stale'}`;
+  const box = (title) => ({ width: w, title, titleRole: 'value', right, rightRole: d?.fresh ? 'ok' : 'warn', border: d?.fresh ? 'indigo' : 'warn' });
+  if (!m) {
+    put(`The Mirror could not be read: ${d?.error || d?.reason || 'the server returned no mirror'}.`, 'warn'); // RESTORE-TUI: say the server's reason (an unbuilt mirror says why)
+    return { box: { ...box('The Mirror'), right: 'not available', rightRole: 'warn', border: 'warn' }, rows };
+  }
+
+  if (d.view === 'agents') {
+    const ag = m.capabilities?.agents;
+    if (isUnk(ag)) put(`Agents ${unk(ag.unknown)}`, 'warn');
+    else {
+      put(`${ag.count} agents, ${ag.entitled} entitled for this org.`);
+      rows.push([seg(' ')]);
+      for (const x of ag.list || []) put(`${x.entitled === false ? '⛔' : '✔'} ${x.name || x.id} (${x.id})${x.role ? ` · ${x.role}` : ''}${x.level != null ? ` · level ${x.level}` : ''}${x.entitled === false ? ' · not entitled' : ''}`, x.entitled === false ? 'warn' : 'value');
+    }
+    return { box: box('The Mirror · agents'), rows };
+  }
+
+  head('Identity');
+  put(`${m.identity?.name || 'CommanderQ'}: ${m.identity?.role || ''}. This is what CommanderQ is told about this org on every turn, built ${m.generatedAt || 'now'} from server reads.`);
+
+  head('Health');
+  if (isUnk(m.health)) put(unk(m.health.unknown), 'warn');
+  else {
+    const h = m.health;
+    put(`${h.score}% · ${h.activeServices}/${h.totalServices} services up${h.down?.length ? ` · down: ${h.down.join(', ')}` : ''}${h.degraded?.length ? ` · degraded: ${h.degraded.join(', ')}` : ''}`, h.score >= 90 ? 'ok' : 'warn');
+  }
+
+  head('Implants');
+  if (isUnk(m.implants)) put(unk(m.implants.unknown), 'warn');
+  else {
+    const s = m.implantSummary;
+    if (s) put(`${s.healthy}/${s.total} healthy (${Object.entries(s.by_status || {}).map(([k, v]) => `${v} ${k}`).join(', ')})`);
+    for (const i of m.implants || []) {
+      const bad = i.status !== 'healthy';
+      put(`${ICON[i.status] || '◐'} ${i.name}${i.tier ? ` [${i.tier}]` : ''} · ${i.status}${typeof i.health === 'number' ? ` ${i.health}` : ''}${i.metric ? ` · ${i.metric}` : ''}`, bad ? 'warn' : 'value', 1);
+      if (i.reason && bad) put(`${i.reason.code} (${i.reason.service}: ${i.reason.message})`, 'warn', 4);
+    }
+  }
+
+  head('Capabilities');
+  const c = m.capabilities || {};
+  put(isUnk(c.tools) ? `Tools ${unk(c.tools.unknown)}` : `Tools: ${c.tools.total} (${c.tools.platform} platform, ${c.tools.org} installed for this org)`, isUnk(c.tools) ? 'warn' : 'value');
+  put(isUnk(c.workflows) ? `Workflows ${unk(c.workflows.unknown)}` : `Workflows: ${c.workflows}`, isUnk(c.workflows) ? 'warn' : 'value');
+  put(isUnk(c.agents) ? `Agents ${unk(c.agents.unknown)}` : `Agents: ${c.agents.count} (${c.agents.entitled} entitled) · /mirror agents lists them`, isUnk(c.agents) ? 'warn' : 'value');
+
+  head('Plugins');
+  if (isUnk(m.plugins)) put(unk(m.plugins.unknown), 'warn');
+  else put(`${m.plugins.installed} installed, ${m.plugins.enabled} enabled${m.plugins.list?.length ? `: ${m.plugins.list.map((p) => p.id).join(', ')}` : ''}`);
+
+  head('Memory');
+  if (isUnk(m.memory)) put(unk(m.memory.unknown), 'warn');
+  else {
+    const mm = m.memory;
+    put(`${mm.total} memories, ${mm.entities} entities, ${mm.relations} relations, across ${mm.users} users of this org`);
+    const types = Object.entries(mm.by_type || {}).sort((x, y) => y[1] - x[1]);
+    if (types.length) put(types.map(([k, v]) => `${k} ${v}`).join(' · '), 'value', 1);
+  }
+
+  head('Codebase');
+  const f = m.codebaseFabric || {};
+  if (isUnk(f)) put(unk(f.unknown), 'warn');
+  else {
+    if (f.repobrain_unknown) put(`RepoBrain ${unk(f.repobrain_unknown)}`, 'warn');
+    else {
+      put(`RepoBrain: ${f.repos} repos indexed${f.indexedFiles != null ? `, ${f.indexedFiles} files` : ''}`);
+      if (f.indexedFiles_reason) put(`files ${f.indexedFiles_reason.code} (${f.indexedFiles_reason.service}: ${f.indexedFiles_reason.message})`, 'warn', 1);
+    }
+    if (f.projects_unknown) put(`Scans ${unk(f.projects_unknown)}`, 'warn');
+    else if (f.projectCount != null) put(`Scans: ${f.projectCount} projects, ${f.totalRoutes} routes, ${f.totalServices} services, invariants ${f.invariantStatus}${f.lastScan ? `, last ${f.lastScan}` : ''}`);
+    if (f.lastScan_reason) put(`${f.lastScan_reason.code} (${f.lastScan_reason.service}: ${f.lastScan_reason.message})`, 'warn', 1);
+  }
+
+  const un = m.unknowns || [];
+  head(`Unknown (${un.length})`);
+  if (!un.length) put('Every section above was read from its service.', 'ok');
+  for (const u of un) put(`${u.section}: ${u.code} (${u.service}: ${u.message})`, 'warn');
+  return { box: box('The Mirror'), rows };
+}
+
+/** A failed fetch as one plain line: the HTTP status, the error code and the server's own reason. */
+export function mirrorErrorNote(e) {
+  const body = e?.body && typeof e.body === 'object' ? e.body : {};
+  const reason = body.error || body.message || e?.message || 'failed';
+  const code = body.code || (typeof e?.code === 'string' ? e.code : '');
+  return `mirror: could not read the Mirror (${e?.status ? `HTTP ${e.status}: ` : ''}${code ? `${code}: ` : ''}${reason}). Nothing is assumed.`;
+}

package/lib/quoxon/objects/model.js

@@ -0,0 +1,118 @@
+/**
+ * Inline object views (QUOXON plan E2/E3, lab group E and D): shared, pure helpers.
+ *
+ * A view is { box?, rows } where a row is an array of segments { text, role, bold? }. Roles are theme
+ * roles ('value', 'muted', 'ok', 'warn', 'error', 'key', 'sky', 'teal', 'indigo', 'violet', 'faint') or
+ * 'agent:<name>', 'provider:<id>', 'proto:<aee|aocl|volt|ward>'. Nothing here does I/O or reads a clock:
+ * time arrives as `now`. Rule for every builder: a field the server did not supply is omitted, never
+ * invented, and an unreachable source is said plainly.
+ */
+import { KANA } from '../qhello.js';
+
+export const seg = (text, role = 'value', bold = false) => ({ text: String(text ?? ''), role, bold });
+export const len = (s) => [...String(s ?? '')].length;
+export const rowText = (row) => row.map(s => s.text).join('');
+export const rowLen = (row) => len(rowText(row));
+
+/** Clip a string to n display chars with an ellipsis (the lab's fit()). */
+export const fit = (s, n) => {
+  const g = [...String(s ?? '').replace(/\s+/g, ' ').trim()];
+  if (n <= 0) return '';
+  return g.length > n ? g.slice(0, Math.max(0, n - 1)).join('') + '…' : g.join('');
+};
+
+/** Clip a row of segments to n chars total; later segments shrink first, the last one gets the ellipsis. */
+export function fitRow(row, n) {
+  const out = [];
+  let used = 0;
+  for (const s of row) {
+    const room = n - used;
+    if (room <= 0) break;
+    const l = len(s.text);
+    if (l <= room) { out.push(s); used += l; continue; }
+    out.push({ ...s, text: fit(s.text, room) });
+    used = n;
+    break;
+  }
+  return out;
+}
+
+/** Pad a row to exactly n chars (clip first). */
+export function padRow(row, n) {
+  const r = fitRow(row, n);
+  const l = rowLen(r);
+  return l < n ? [...r, seg(' '.repeat(n - l), 'muted')] : r;
+}
+
+/** Server timestamps: epoch ms, ISO, or SQLite "YYYY-MM-DD HH:MM:SS" (UTC). */
+export function parseTs(v) {
+  if (v == null || v === '') return null;
+  if (typeof v === 'number') return v;
+  const s = String(v);
+  const t = Date.parse(/^\d{4}-\d\d-\d\d \d\d:\d\d(:\d\d)?$/.test(s) ? s.replace(' ', 'T') + 'Z' : s);
+  return Number.isFinite(t) ? t : null;
+}
+
+/** "45s", "3m", "2h", "28d" between two epoch ms. '' when unknown. */
+export function ago(ts, now) {
+  const t = parseTs(ts);
+  if (t == null || !Number.isFinite(now)) return '';
+  const s = Math.max(0, Math.floor((now - t) / 1000));
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  if (h < 48) return `${h}h`;
+  return `${Math.floor(h / 24)}d`;
+}
+
+/** Duration in ms -> "0.4s", "3.4s", "2m05". */
+export function dur(ms) {
+  if (ms == null || !Number.isFinite(ms)) return '';
+  if (ms < 60000) return `${(Math.max(0, ms) / 1000).toFixed(1)}s`;
+  const s = Math.round(ms / 1000);
+  return `${Math.floor(s / 60)}m${String(s % 60).padStart(2, '0')}`;
+}
+
+/** "21:20 UTC" from a timestamp (UTC on purpose: the box and the owner are in different zones). */
+export function hhmm(ts) {
+  const t = parseTs(ts);
+  return t == null ? '' : `${new Date(t).toISOString().slice(11, 16)} UTC`;
+}
+export const day = (ts) => { const t = parseTs(ts); return t == null ? '' : new Date(t).toISOString().slice(0, 10); };
+export const short = (id, n = 8) => { const s = String(id ?? ''); return s.length > n + 1 ? s.slice(0, n) + '…' : s; };
+export const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+/** Box geometry the lab uses: the box is at most `max` wide and never wider than the terminal less 2. */
+export const boxWidth = (cols, max) => Math.max(20, Math.min((cols || 80) - 2, max));
+
+// ---- decode-in (the lab's text arrival) --------------------------------------------------------------
+// Katakana flicker just ahead of the reveal edge; resolved letters keep their role. Pure: t and t0 in
+// seconds, salt keeps rows distinct. The colour-only afterglow is left to the renderer (it maps `glow`).
+const LEAD = 0.07, GLOW = 0.6, PER_CHAR = 0.012;
+const hash = (a, b, c) => { let h = (a * 374761393 + b * 668265263 + c * 2147483647) | 0; h = Math.imul(h ^ (h >>> 13), 1274126177); return ((h ^ (h >>> 16)) >>> 0) / 4294967296; };
+
+/**
+ * -> cells [{ ch, role, bold, glyph, glow }] for one row at time t (seconds since the object arrived).
+ * t = Infinity (or quiet) gives the settled row. A row starts at t0 and resolves left to right over dur.
+ */
+export function decodeRow(row, t, t0 = 0, d = 0.25, salt = 1) {
+  const chars = [];
+  for (const s of row) for (const ch of s.text) chars.push({ ch, role: s.role, bold: Boolean(s.bold) });
+  if (!Number.isFinite(t)) return chars.map(c => ({ ...c, glyph: false, glow: 0 }));
+  const n = chars.length;
+  const span = Math.max(d, n * PER_CHAR);
+  return chars.map((c, i) => {
+    if (c.ch === ' ') return { ...c, glyph: false, glow: 0 };
+    const r = t0 + (n > 1 ? (i / (n - 1)) * span : 0), dt = t - r;
+    if (dt < -LEAD) return { ch: ' ', role: c.role, bold: false, glyph: false, glow: 0 };
+    if (dt < 0) return { ch: KANA[Math.floor(hash(i, Math.floor(t * 30), salt) * KANA.length)], role: 'sky', bold: false, glyph: true, glow: 0 };
+    return { ...c, bold: c.bold || dt < 0.05, glyph: false, glow: dt < GLOW ? (1 - dt / GLOW) ** 1.6 : 0 };
+  });
+}
+
+/** Seconds the arrival of a view takes: rows start 0.1 s apart and each resolves over 0.25 s. */
+export function arrivalSeconds(view) {
+  const rows = view?.rows?.length || 0;
+  return rows ? 0.1 * (rows - 1) + Math.max(0.25, Math.max(...view.rows.map(r => rowLen(r))) * PER_CHAR) + GLOW : 0;
+}

package/lib/quoxon/objects/peek.js

@@ -0,0 +1,17 @@
+/**
+ * PEEK card: the hit of `/peek <id>` as an inline object (the box layout keeps the label column; a note would
+ * re-flow it). Fields come from core/peek.js ROWS, the same list `quox peek` prints. d: a peekId result.
+ */
+import { seg, fit, boxWidth } from './model.js';
+import { KIND_LABEL, ROWS, MORE } from '../../core/peek.js';
+
+export function peekCard(d, cols) {
+  const w = boxWidth(cols, 84), inner = w - 4;
+  const { kind, data } = d.hit || {};
+  const rows = [];
+  const L = (label, value, role = 'value') => [seg(label.padEnd(10), 'muted'), seg(fit(value, inner - 10), role)];
+  for (const [k, v] of (ROWS[kind] ? ROWS[kind](data || {}) : [])) if (v) rows.push(L(k, v));
+  if (d.also?.length) rows.push(L('also', `an id of the same value: ${d.also.map(k => KIND_LABEL[k]).join(', ')}`, 'muted'));
+  if (MORE[kind]) rows.push(L('more', MORE[kind](d.id), 'muted'));
+  return { box: { width: w, title: `◇ ${KIND_LABEL[kind] || 'id'} ${d.id}`, titleRole: 'sky', right: 'read only', rightRole: 'muted', border: 'sky' }, rows };
+}

package/lib/quoxon/objects/proof.js

@@ -0,0 +1,110 @@
+/**
+ * D1 evidence integrity chain and D3 reconciliation for one tool call of this session.
+ *   AEE   the call's envelope, read back (GET /aee/:envelope_id)
+ *   AOCL  aocl.* envelopes on the same correlation id (GET /aee/query?corr=)
+ *   TOOL  what the server recorded for the call (payload.success / tool_name) vs what the stream said
+ *   WARD  the envelope's inclusion receipt (POST /ward/verify-receipt, server-verified, bounded)
+ * A link is drawn confirmed only when its read succeeded and said so. Nothing is recomputed locally,
+ * so the card says the server's WARD verified it, never "recomputed locally".
+ *
+ * D3: a tool that ended effect_unknown is reconciled against the server's own record of the call
+ * (the ops.tool envelope's payload.success). No envelope id means it cannot be reconciled from here.
+ */
+import { seg, fit, short, plural } from './model.js';
+
+const LINKS = ['AEE', 'AOCL', 'TOOL', 'WARD'];
+
+/** -> [{ name, ok: true|false|null, sub }] in chain order. ok null = not confirmed (unknown). */
+export function chainLinks(d) {
+  const t = d.tool || {};
+  const env = d.envelope?.ok ? d.envelope.env : null;
+  const out = [];
+  out.push(env ? { name: 'AEE', ok: true, sub: `envelope ${short(env.id || t.envelopeId, 14)}` }
+    : { name: 'AEE', ok: d.envelope?.status === 404 ? false : null, sub: d.envelope?.status === 404 ? 'envelope not found' : `envelope not read${d.envelope?.error ? ` (${fit(d.envelope.error, 24)})` : ''}` });
+  const aocl = d.aocl?.ok ? d.aocl.list || [] : null;
+  if (aocl && aocl.length) {
+    const has = (i) => aocl.some(e => e.intent === i);
+    const pol = aocl.filter(e => e.intent === 'aocl.policy.evaluated');
+    const polOk = pol.length ? pol.every(e => e.payload?.allPassed !== false) : null;
+    const bits = [];
+    if (has('aocl.identity.verified')) bits.push('identity');
+    if (polOk != null) bits.push(polOk ? 'policy ok' : 'policy blocked');
+    out.push({ name: 'AOCL', ok: polOk === false ? false : true, sub: bits.length ? bits.join(' + ') : plural(aocl.length, 'AOCL record') });
+  } else out.push({ name: 'AOCL', ok: null, sub: aocl ? 'no AOCL record on this corr' : `not read${d.aocl?.error ? ` (${fit(d.aocl.error, 20)})` : ''}` });
+  const rec = env?.payload || null;
+  if (rec && rec.success != null) {
+    const want = t.status === 'ok';
+    const match = Boolean(rec.success) === want || t.status === 'effect_unknown';
+    out.push({ name: 'TOOL', ok: match && Boolean(rec.success), sub: `${rec.tool_name || t.tool || 'tool'} ${rec.success ? 'succeeded' : 'failed'}${match ? '' : ` (stream said ${t.status})`}` });
+  } else out.push({ name: 'TOOL', ok: null, sub: `${t.tool || 'tool'} ${t.status || ''} (no server record)`.trim() });
+  const r = d.receipt?.ok ? d.receipt.result : null;
+  if (r?.status === 'WITNESSED') out.push({ name: 'WARD', ok: true, sub: `witnessed seq ${r.entry?.seq}` });
+  else if (r?.status === 'UNTIPPED') out.push({ name: 'WARD', ok: null, sub: `seq ${r.entry?.seq}, no signed tip yet` });
+  else if (r?.status === 'NOT_WITNESSED') out.push({ name: 'WARD', ok: null, sub: 'not witnessed yet' });
+  else if (r?.status) out.push({ name: 'WARD', ok: false, sub: `${r.status}${r.reason ? ` ${r.reason}` : ''}` });
+  else out.push({ name: 'WARD', ok: null, sub: d.receipt?.timeout ? `no answer in ${d.receipt.timeout}s` : `not checked${d.receipt?.error ? ` (${fit(d.receipt.error, 24)})` : ''}` });
+  return out;
+}
+
+const markOf = (ok) => (ok === true ? ['✔', 'ok'] : ok === false ? ['✖', 'error'] : ['○', 'faint']);
+
+/** d: { tool, envelope, aocl, receipt } -> view { rows } (wide row at >= 90 cols, vertical below). */
+export function proofChain(d, cols) {
+  const links = chainLinks(d);
+  const rows = [];
+  rows.push([seg('proof ', 'muted'), seg(fit(`${d.tool?.tool || 'tool call'}${d.tool?.envelopeId ? ` · ${short(d.tool.envelopeId, 18)}` : ''}`, cols - 10), 'value', true)]);
+  if (cols >= 90) {
+    const head = [], sub = [], cw = Math.max(23, Math.floor((cols - 4) / 4));
+    links.forEach((l, i) => {
+      const role = `proto:${l.name.toLowerCase() === 'tool' ? 'volt' : l.name.toLowerCase()}`;
+      head.push(seg(l.name, l.name === 'TOOL' ? 'value' : role, true));
+      sub.push(seg(fit(l.sub, cw - 1).padEnd(i < 3 ? cw : 0), l.ok === false ? 'error' : 'muted'));
+      if (i < 3) {
+        const linked = l.ok === true && links[i + 1].ok === true;
+        head.push(seg(' ' + (linked ? '━' : '╌').repeat(cw - 2 - l.name.length) + ' ', linked ? 'indigo' : 'faint'));
+      }
+    });
+    rows.push(head, sub);
+  } else {
+    links.forEach((l, i) => {
+      const role = `proto:${l.name.toLowerCase() === 'tool' ? 'volt' : l.name.toLowerCase()}`;
+      const [m, mr] = markOf(l.ok);
+      rows.push([seg(m, mr), seg(' '), seg(l.name.padEnd(5), l.name === 'TOOL' ? 'value' : role, true), seg(fit(l.sub, cols - 12), l.ok === false ? 'error' : 'muted')]);
+      if (i < 3) rows.push([seg(l.ok === true && links[i + 1].ok === true ? '┃' : '╎', l.ok === true && links[i + 1].ok === true ? 'indigo' : 'faint')]);
+    });
+  }
+  const n = links.filter(l => l.ok === true).length;
+  const bad = links.filter(l => l.ok === false).length;
+  if (n === 4) rows.push([seg('✔ ', 'ok'), seg(cols < 60 ? 'chain verified · 4 links' : 'chain verified · 4 links · WARD receipt checked by the server', 'value')]);
+  else rows.push([seg(bad ? '✖ ' : '◐ ', bad ? 'error' : 'warn'), seg(`${n} of 4 links confirmed${bad ? ` · ${bad} contradicted` : ''}`, bad ? 'error' : 'warn')]);
+  return { rows, links };
+}
+
+/** One effect_unknown call reconciled against the server's record of it. */
+export function reconcileItem(it) {
+  if (!it.envelopeId) return { mark: '?', role: 'muted', state: 'unverified', why: 'no envelope id, cannot be checked from here' };
+  if (!it.record) return { mark: '?', role: 'muted', state: 'unverified', why: it.error ? `record not read (${fit(it.error, 30)})` : 'not checked' };
+  if (!it.record.ok) return { mark: '?', role: 'muted', state: 'unverified', why: it.record.status === 404 ? 'no server record of the call' : `record not read (${fit(it.record.error || '', 30)})` };
+  const ok = it.record.env?.payload?.success;
+  if (ok === true) return { mark: '✔', role: 'ok', state: 'confirmed', why: 'server recorded success' };
+  if (ok === false) return { mark: '✖', role: 'error', state: 'mismatch', why: 'server recorded a failure, not done' };
+  return { mark: '?', role: 'muted', state: 'unverified', why: 'server record has no outcome' };
+}
+
+/** d: { items: [{ tool, envelopeId, record }] } -> view { rows } */
+export function reconcileView(d, cols) {
+  const nw = cols < 60;
+  const items = d.items || [];
+  const rows = [[seg(nw ? `reconcile · ${items.length} unknown` : `reconcile · ${plural(items.length, 'call')} ended with effect unknown, checking each`, 'muted')]];
+  let conf = 0, mis = 0;
+  for (const it of items) {
+    const r = reconcileItem(it);
+    if (r.state === 'confirmed') conf++; else if (r.state === 'mismatch') mis++;
+    const row = [seg(r.mark, r.role), seg(' '), seg(fit(it.tool || 'tool', 15).padEnd(16), 'value'), seg(r.state.padEnd(12), r.role === 'muted' ? 'muted' : r.role, r.state !== 'unverified')];
+    if (!nw) row.push(seg(fit(r.why, cols - 34), 'muted'));
+    rows.push(row);
+  }
+  const un = items.length - conf - mis;
+  rows.push([seg(`${conf} confirmed · ${mis} mismatch · ${un} unverified`, mis ? 'warn' : 'muted')]);
+  return { rows };
+}

package/lib/quoxon/objects/prove.js

@@ -0,0 +1,130 @@
+/**
+ * /prove: independently verify the last turn's tool calls. Two independent checks per call:
+ *   1. the receipt chain (the same reads as /proof: AEE envelope, the server's own record of the call,
+ *      the WARD inclusion receipt), and
+ *   2. a TRUTH read: for a write whose effect we know how to read back (VERIFIERS below), read it back
+ *      from the system of record and see whether it is really there.
+ * Per call: proven (chain agrees and, for a mapped write, the effect is there), unproven (cannot be shown:
+ * an unmapped write, a read that failed, no receipt) or contradicts (the stream said ok and the server or
+ * the truth read disagrees, or the call failed). An unmapped write is never called proven.
+ *
+ * Extending: push an entry on VERIFIERS: { id, tools: [tool names], keys: [arg names to find in the call
+ * summary], read: (reads, target) -> true | false | null, describe: (target, found) -> text }.
+ */
+import { seg, fit, fitRow, short, boxWidth } from './model.js';
+import { chainLinks } from './proof.js';
+
+export const VERIFIERS = [
+  { id: 'slot_create', tools: ['slot_create'], keys: ['name', 'slot'], read: (r, t) => r.slotExists(t), describe: (t, f) => (f ? `slot "${t}" exists` : `slot "${t}" not found`) },
+  { id: 'memory_save', tools: ['memory_save'], keys: ['content', 'text', 'fact'], read: (r, t) => r.memoryFind(t), describe: (t, f) => (f ? `memory "${fit(t, 24)}" is stored` : `memory "${fit(t, 24)}" not found`) }
+];
+
+export const verifierFor = (tool) => VERIFIERS.find(v => v.tools.includes(tool)) || null;
+
+/** Tools that only read: their receipt chain is the whole proof (nothing changed to read back). */
+const READ_RE = /_(list|read|get|search|stats|history|usage|brief|notes|roadmaps|streams|folders|zones|pending|accounts|blocked|proposals|latest|query|status|show)$/;
+export const isReadTool = (tool) => READ_RE.test(String(tool || ''));
+
+/** The thing to check, from the call summary: key=value, key: "value", else the first quoted string. */
+export function targetOf(tool, summary) {
+  const s = String(summary || '');
+  const v = verifierFor(tool);
+  for (const k of v?.keys || ['name']) {
+    const m = new RegExp(`\\b${k}\\s*[=:]\\s*(?:"([^"]+)"|'([^']+)'|([\\w.\\-]+))`, 'i').exec(s);
+    if (m) return m[1] || m[2] || m[3];
+  }
+  const q = /["“]([^"”]+)["”]/.exec(s);
+  return q ? q[1] : null;
+}
+
+/** -> { mapped:false } | { mapped:true, found: true|false|null, what?, error?, noTarget? }. Never throws. */
+export async function runTruth(call, reads) {
+  const v = verifierFor(call.tool);
+  if (!v) return { mapped: false };
+  const target = targetOf(call.tool, call.summary);
+  if (!target) return { mapped: true, found: null, noTarget: true };
+  try {
+    const found = await v.read(reads, target);
+    return { mapped: true, found: found === true ? true : found === false ? false : null, what: v.describe(target, found === true) };
+  } catch (e) {
+    return { mapped: true, found: null, error: e?.status ? `HTTP ${e.status}` : e?.message || 'failed' };
+  }
+}
+
+/** Settled tool calls after the last user message of `items` (history + live blocks). */
+export function lastTurnCalls(items) {
+  const list = items || [];
+  let from = 0;
+  for (let i = list.length - 1; i >= 0; i--) if (list[i]?.kind === 'user' && !list[i].echo) { from = i + 1; break; }
+  return list.slice(from).filter(b => b && b.kind === 'tool' && b.status !== 'running');
+}
+
+const V = (state, why, call) => ({ state, mark: state === 'proven' ? '✔' : state === 'contradicts' ? '✖' : '⚠', why, envelopeId: call.envelopeId || null });
+
+/** { call, proof, truth } -> { state, mark, why, envelopeId }. Pure. */
+export function verdictFor({ call, proof, truth }) {
+  const bad = !['ok', 'effect_unknown'].includes(call.status);
+  if (bad) return V('contradicts', `the call ${call.status || 'did not finish'}, so the task did not get done`, call);
+  if (!call.envelopeId) return V('unproven', 'no receipt id on this call', call);
+  const links = proof ? chainLinks(proof) : [];
+  const by = Object.fromEntries(links.map(l => [l.name, l]));
+  if (by.TOOL?.ok === false) return V('contradicts', by.TOOL.sub, call);
+  if (by.WARD?.ok === false) return V('contradicts', `WARD: ${by.WARD.sub}`, call);
+  if (by.AEE?.ok !== true) return V('unproven', `receipt not confirmed (${by.AEE?.sub || 'not read'})`, call);
+  if (by.TOOL?.ok !== true) return V('unproven', 'no server record of the call outcome', call);
+  if (truth?.mapped) {
+    if (truth.found === true) return V('proven', `${truth.what || 'effect found'} · server recorded success`, call);
+    if (truth.found === false) return V('contradicts', `${truth.what || 'effect not found'}, though the call reported ok`, call);
+    return V('unproven', truth.noTarget ? 'could not tell which thing to check from the call' : `effect not read back (${truth.error || 'no answer'})`, call);
+  }
+  if (isReadTool(call.tool)) return V('proven', 'read call · receipt chain checked', call);
+  return V('unproven', `no read mapping for ${call.tool}: receipt checked, effect not independently read`, call);
+}
+
+/** d: { items: [{ call, proof, truth }] } -> view { box, rows } */
+export function proveView(d, cols) {
+  const w = boxWidth(cols, 90), inner = w - 4, nw = w < 60;
+  const rows = [];
+  const tally = { proven: 0, unproven: 0, contradicts: 0 };
+  const items = d.items || [];
+  for (const it of items) {
+    const v = verdictFor(it);
+    tally[v.state]++;
+    const role = v.state === 'proven' ? 'ok' : v.state === 'contradicts' ? 'error' : 'warn';
+    rows.push([seg(v.mark, role, true), seg(' '), seg(fit(it.call.tool || 'tool', 14).padEnd(15), 'value', true), seg(v.state.padEnd(12), role, true), ...(nw ? [] : [seg(fit(v.why, inner - 30), 'muted')])]);
+    rows.push([seg('  '), ...(nw ? [seg(fit(v.why, inner - 2), 'muted')] : []), seg(v.envelopeId ? `${nw ? '' : '  '}receipt ${short(v.envelopeId, nw ? 12 : 22)}` : '  no receipt', 'muted')]);
+  }
+  if (!items.length) rows.push([seg('no tool calls to check', 'muted')]);
+  rows.push([seg(`${tally.proven} proven · ${tally.unproven} unproven · ${tally.contradicts} contradicts`, tally.contradicts ? 'error' : tally.unproven ? 'warn' : 'ok', true)]);
+  return { box: { width: w, title: 'Prove · last turn', titleRole: 'indigo', border: 'indigo' }, rows: rows.map(r => fitRow(r, inner)), tally };
+}
+
+/** Fetchers for createObjectsApi. deps: { self (the objects api, for proof), get, listOf, resolveEndpoint } */
+export function proveFetchers({ self, get, listOf, resolveEndpoint }) {
+  const reads = {
+    async slotExists(name) {
+      const ep = resolveEndpoint('v1.slots.list');
+      const rows = listOf(await get('collector', ep.path, undefined, 10000), 'slots');
+      return rows.some(s => String(s.name || '').toLowerCase() === String(name).toLowerCase());
+    },
+    async memoryFind(text) {
+      const d = await get('memory', '/api/memory/search', { q: text, limit: 10 }, 10000);
+      const want = String(text).toLowerCase().slice(0, 60);
+      return listOf(d, 'results', 'memories', 'data').some(m => JSON.stringify(m).toLowerCase().includes(want));
+    }
+  };
+  return {
+    reads,
+    /** calls: tool blocks { tool, status, summary, envelopeId, callId } -> { data: { items } } */
+    async prove(calls) {
+      const items = await Promise.all((calls || []).slice(-12).map(async (call) => {
+        const [proof, truth] = await Promise.all([
+          call.envelopeId ? self.proof({ tool: call.tool, status: call.status, envelopeId: call.envelopeId, callId: call.callId }).then(r => r.data).catch(() => null) : null,
+          runTruth(call, reads)
+        ]);
+        return { call: { tool: call.tool, status: call.status, summary: call.summary, envelopeId: call.envelopeId || null }, proof, truth };
+      }));
+      return { data: { items } };
+    }
+  };
+}