diff --git a/Tools/README.md b/Tools/README.md index c42b2b5..b0e8c94 100644 --- a/Tools/README.md +++ b/Tools/README.md @@ -43,7 +43,7 @@ The core distribution tools are `check_links`, `check_vocab`, `check_moc`, `check_structure`, `compose_page_contract`, `check_page_contract`, `check_boundary_contract`, `render_boundary_projection`, `render_structure_projection`, `project_page_state`, -`record_gate_attestation`, `record_gate_result`, `apply_metadata_transition`, +`record_batch_judgment`, `record_gate_attestation`, `record_gate_result`, `apply_metadata_transition`, `check_residual_content`, `scaffold_profile`, `profile_onboarding_status`, `profile_contract`, `profile_admission`, `metadata_execution_contract`, `metadata_gate_runtime`, `metadata_property_state`, `stamp_cards`, `run_gates`, @@ -90,7 +90,7 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `seal_receipts.py` | Receipt cold-chain writer 1.4.0 (K12/07 Receipt Sealing). **`--apply` is a maintenance-window operation**: run it only in a declared quiet window, after confirming no other Cambium or adopter writer, checker or receipt appender is active against the repository. Moves verified frozen rows of closed batches -- each batch's close-bundle trio as one unit, whole per-batch registers, page-contract snapshots -- verbatim into `.cambium/receipts/cold/segments/`, appends one manifest entry per segment and one thin projection per receipt, rewrites the hot registers without the sealed rows, and adopts into the manifest only those born-cold close-evidence files a current attestation binds by hash. Refuses to run unless the complete runtime validation passes with zero errors, no writer lock is active, and no delta application is pending; every byte the plan was computed from is re-compared inside the locks. The shared receipt append mutex (`.cambium/tmp/receipt-append.free`/`.held`, a rename because mounts that refuse `unlink` cannot release a lock directory) is a guard against the accident of running a writer beside a seal, not a proof of mutual exclusion under arbitrary concurrency -- it is re-entrant per process and binds only appenders using the shared primitive. Publication is journalled -- a `begin` row and a hash-bound pending record before the first segment byte, a `complete` row only after every postcondition is re-proved -- so an interrupted seal fails every later run closed; `--reconcile --apply` automatically finishes the publication paths this tool implements and refuses a live writer's lock or a drifted pending record, while any other interruption is resolved by the runbook below. What sealing retires is deserialization, not integrity: `check_queue` re-hashes every segment, re-proves every projection against the sealed line it names, and re-proves both cold registers against this tool's receipt on every run. Never seals: transition history, Standards adoptions, amendments, its own register, activation/confirmation gates, batch-review wrappers, the Standards-revalidation aggregate a recorded Queue transition consumed (its replay reads `revalidation_bindings` and `invalidated_by`, which no projection carries), anything bound to a non-closed batch, or a receipt currently named by Coverage `property_state`. A live page review keeps its reviewer attestation hot; a live Delta pointer keeps its close trio and the full body-level replay closure hot until a later owner transition supersedes it | `python3 Tools/seal_receipts.py . --apply` | | `compile_queue.py` | Queue compiler 1.5.0 deterministically compiles Queue structure from explicit Required Coverage assignments plus top-level `batch_specs`; never infers semantic dependencies or backlinks. Every spec explicitly declares both Work Spec fields: null/null for a simple batch, or one exact `.cambium/work_specs/*.yaml` path/SHA pair for a complex batch. Initial `--apply` is integrator-only and writes the unique origin receipt into Progress. A same-scope replan consumes a complete `.cambium/deltas/replans/*.coverage.yaml` proposal—never pre-edited canonical Coverage—and a matching current registration written by `register_amendment.py`; it commits Coverage/Queue/Progress under one shared lock after exact three-file CAS, registration/Amendment/diff binding, and conflict checks. Registration binds either explicit-user authority or the Task Contract's exact delegated change classes, which are re-derived before write. Terminal history remains immutable; interrupted/incompletely rolled-back writes retain the lock | `python3 Tools/compile_queue.py . --coverage-proposal .cambium/deltas/replans/A1.coverage.yaml --output .cambium/tmp/queue-replan.yaml` | | `update_task.py` | Sole Progress task-state transition writer. Dry-run-first and integrator-only; compare-and-swaps current Progress and Queue SHAs under the shared lock, records a transition receipt and restart checkpoint, and requires a reason for pause/block. One successful entry runtime admission freezes the Profile/K00 authority pair for the whole transaction: proposed, locked, and post-write validation inject it without rerunning Profile load, while both sides of every Progress/receipt write perform currency CAS. A build task consumes a current Queue-complete receipt to enter `completion-candidate`, then a canonical `check_proof` 1.17 pass receipt to enter `complete`; the proof and transition repeat its Profile closure and repository snapshot, and the writer rechecks the repository before/after state and receipt publication. A maintenance task never enters `completion-candidate`; its `planned` or `active` state enters `complete` only by consuming a current `check_queue --require-maintenance-complete` receipt through `--maintenance-completion-receipt`. Direct `planned -> active` remains rejected; `update_queue.py` invokes that owner only while opening the first batch | `python3 Tools/update_task.py . --transition paused --checkpoint-summary "waiting for source" --expected-progress-sha256 sha256:... --expected-queue-sha256 sha256:... --actor-role integrator --apply` | -| `update_queue.py` | Lifecycle writer 1.7.0, dry-run-first, integrator-only lifecycle/hold transition with legal-state enforcement, current contract-conformant gate/confirmation/batch receipts, exact managed delta validation and frozen SHA, optimistic revision/SHA checks, the shared writer lock, rollback, result-state revalidation, and before/after receipt history. Queue writes require task state `active`; the first open atomically invokes the task-state owner for `planned -> active`. The `open -> merge-ready` edge proves and binds the prospective routed-gap settlement before freezing the Delta. Opening freezes the exact semantic-content baseline for every manifest page. Close requires the exact `apply_delta` receipt, derives Coverage `next_batch`, consumes one exact-content review receipt per page, and commits `last_reviewed` owner records plus page projections in the same transaction. Cancellation goes through a registered `apply_amendment.py` transaction | `python3 Tools/update_queue.py . --id B1 --transition open --gate-receipt RECEIPT --expected-state-revision 0 --expected-sha256 sha256:... --actor-role integrator --apply` | +| `update_queue.py` | Lifecycle writer 1.8.0, dry-run-first, integrator-only lifecycle/hold transition with legal-state enforcement, current contract-conformant gate/confirmation/batch receipts, exact managed delta validation and frozen SHA, optimistic revision/SHA checks, the shared writer lock, rollback, result-state revalidation, and before/after receipt history. Queue writes require task state `active`; the first open atomically invokes the task-state owner for `planned -> active`. The `open -> merge-ready` edge proves and binds the prospective routed-gap settlement before freezing the Delta. Opening freezes the exact semantic-content baseline for every manifest page. Close requires the exact `apply_delta` receipt, derives Coverage `next_batch`, consumes one exact-content review receipt per page, and commits `last_reviewed` owner records plus page projections in the same transaction. Cancellation goes through a registered `apply_amendment.py` transaction | `python3 Tools/update_queue.py . --id B1 --transition open --gate-receipt RECEIPT --expected-state-revision 0 --expected-sha256 sha256:... --actor-role integrator --apply` | | `register_amendment.py` | Sole registration writer 1.4.0 of executable operational Amendment rows for same-scope Queue replans, scope replans, batch cancellation, narrow gap-routing reconciliation, and the bounded legacy `property_state` migration. It derives the closed impact/change-class set and chooses explicit-user or matching contract-delegated authority; unknown or nondelegable classes fail closed. It accepts only the current state schema, defaults to dry-run; `--decision-mode auto|contract-delegated|explicit-user` makes the authority source explicit, requires an integrator plus exact Coverage/Queue/Progress SHA compare-and-swap, and rechecks repository-contained proposals/plans under the shared lock. It publishes the append-only receipt first, then one approved pending Progress row that names it; an unreferenced receipt is inert, so interruption cannot leave Progress pointing at absent evidence. A pending receipt is current authorization and must bind the live Progress bytes; a verified execution must bridge its three before-SHAs and time to registration, after which the registration is historical evidence only. At most one operational Amendment may be pending. `--withdraw --reason "..."` retires a pending registration whose execution can no longer validate (K13/06): it publishes an append-only withdrawal receipt naming the registration receipt and sets the row's status to `withdrawn` with write-back still false; the bound plan/proposal bytes stay verified immutable evidence and the amendment ID is never reused | `python3 Tools/register_amendment.py . --operation scope-replan --plan .cambium/deltas/amendments/A1.yaml --date YYYY-MM-DD --summary "Approved scope change" --approval-reference APPROVAL --expected-coverage-sha256 sha256:... --expected-progress-sha256 sha256:... --expected-queue-sha256 sha256:... --actor-role integrator --apply` | | `apply_amendment.py` | Cross-Ledger writer 1.4.0 consumes one registered approved scope/disposition change as a guarded Coverage/Queue/Progress transaction. The plan and registration receipt bind exact before revisions and all three SHAs to a complete Coverage proposal; `scope-replan` recompiles current Queue structure, `cancel-batch` retires one queued/open leaf, and `gap-routing-reconciliation` closes or reroutes existing gaps without creating findings; `property-state-migration` moves legacy page values into explicit Coverage observations while removing their unauthoritative page copies; every operation preserves terminal history. The writer re-derives the registered authority impact under lock. A durable prepare receipt plus lock-owner fingerprints make an interrupted multi-file write diagnosable; commit/abort receipts record the consumed registration and outcome. It does not write non-scope Task Contract changes; direct post-materialization edits fail closed and currently require a preserved successor task | `python3 Tools/apply_amendment.py . --plan .cambium/deltas/amendments/A1.yaml --expected-coverage-sha256 sha256:... --expected-progress-sha256 sha256:... --expected-queue-sha256 sha256:... --actor-role integrator --apply` | | `adopt_standards.py` | Sole active-task Standards/Profile adoption writer 1.6.0 (K12/10 semantics; K13/15 transaction). Its closed YAML plan binds approved K00/03 bytes and upstream identity, deterministic after Kernel/Profile snapshots, Task/Contract identity, Queue revisions, three state SHAs, changed semantic predicates, dimension/boundary-specific invalidated evidence, the capability-registry projection from leaves to owner Gates, the complete derived after-load contract, and the root-owned profile-load-input fingerprint. The candidate `selected_profile_manifest_after` must pass full `profile-load` before any state write. Admission captures receipt-free snapshot/contract/input evidence; apply reruns and compares it under the writer lock before state writes, after state writes, and immediately before and after final receipt publication. Candidate evaluation never enters the current Queue receipt catalog. Drift before a durable commit restores the three before images and records abort; drift after commit evidence additionally retains the recovery lock. A `profile-load` invalidation boundary targets exactly that after-image manifest and requires the `profile-load` Gate; admission itself is not batch-scoped and is omitted from the batch rerun union, while any downstream Gates named by the same boundary keep their declared batch/Terminal reachability obligations. The Read Set closure is not a hand-picked sample: selected Read Sets are transitively closed, profile supplemental routes remain inside the selected Profile and declared route namespace, and ordinary boundary targets are all loaded modules. Dry-run is default; apply accepts only `active`/`paused`, rejects incompatible Work Specs, affected `merge-ready` batches, or affected `open` batches without `revalidation-required`, and changes no lifecycle/hold itself. It requires all three canonical state objects to satisfy the current schema, synchronizes identity/load set, advances Queue/Progress `queue_revision` once, records append-only adoption history, and consumes immediate Queue consistency before commit. Only `required-queue-consistency` is an immediate raw claim; native review, close, and completion owners remain required by their ordinary transitions, and raw leaf receipts cannot discharge them early. Sealed pre-1.3 history may omit the typed-contract fingerprint, sealed pre-1.4 history may omit the root-input fingerprint, and sealed pre-1.5 history may omit the upstream identity pair; historical receipts are not rewritten and remain catalogued, but only compatible producer protocols may satisfy the live execution chain. Prepare/commit/abort plus the lock recover partial writes; no Markdown adoption report is produced | `python3 Tools/adopt_standards.py . --plan .cambium/deltas/standards-adoptions/SA-001.yaml --apply --actor-role integrator` | @@ -113,6 +113,7 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `profile_admission.py` | Shared consumer adapter, not a command. It selects the explicit or K00/03-approved Profile, performs exactly one complete `profile-load`, exposes the authorized immutable Profile snapshot and typed slot paths/text, and rechecks Profile-tree, root-input, and active-selection currency before a consumer emits a pass result or writes an artifact. Profile-dependent tools use this view instead of reopening the manifest or slot files under a later revision | imported by the Profile-dependent scripts above; no command-line entry point | | `metadata_execution_contract.py` | Closed metadata-execution authority compiler and loader 1.0.0. It compiles Kernel field/transition rules with the installed operation capability registry, requires exact rule/operation coverage, and requires every writer/consumer/producer/receipt-schema capability to name canonical `Tools/*.py` implementation paths. Stable no-follow hashes of the complete implementation set enter `compiled/metadata-execution-contract.json`; the loader refuses source, implementation-byte, or artifact drift. Its pure path API lets `profile-load` freeze those files inside the same canonical root-input view | `python3 Tools/metadata_execution_contract.py --root . --check` | | `record_gate_attestation.py` | Manual Extension Gate evidence producer 1.0.0. It resolves one exact Gate only from the current snapshot-bound typed Profile contract, requires the Gate's registered pass-authority role and completion enum, and emits a `manual-gate-attestation-v1` receipt binding the page's projection-neutral semantic fingerprint, exact page bytes, selected Profile manifest/tree/typed-contract/root-input fingerprints, active K00 revision, and metadata execution contract. It writes no state or page; dry-run is default | `python3 Tools/record_gate_attestation.py . --gate-id P:: --page --value --actor-role --statement "Bounded judgment" --apply` | +| `record_batch_judgment.py` | Sole per-target Batch Review judgment scribe 1.0.0 (K12/14): answers one frozen Batch Review Requirement record for one open batch — validates the target against the activation-frozen expansion, the reviewer against the Profile's registered pass-authority role, and binds the judgment to the batch's current activation receipt, the target's semantic content fingerprint, and the authorized Profile contract fingerprint, so reopening the batch, editing the page, or revising the Profile invalidates the evidence. Rebuilds every binding under the runtime write lock immediately before publication and fails closed on any drift. Changes no page, Ledger, or Queue state; `update_queue.py` consumes the exact record set at `open -> merge-ready` through the batch-review wrapper. | `python3 Tools/record_batch_judgment.py . --batch --judgment-item --target --reviewer-role --statement "..." --apply` | | `record_gate_result.py` | Deterministic Extension Gate evidence adapter 1.0.0. It resolves one exact typed Gate and the Gate's exact Registered Scan from the same authorized Profile view, stages the no-follow-hashed scanner, its closed Python runtime inputs, and the Profile-snapshot configuration as immutable execution inputs, then runs the compiled shell-free command with adapter-owned temporary receipt output. It accepts only a clean pass set and exact final scan/input identities, rejects repository or live-tool drift, and wraps the source summary into `deterministic-gate-result-v1`. The result binds the sole Gate completion value, exact semantic page/Profile/K00/metadata identities, source receipt/set/command/tool/config/runtime/execution-input hashes, and current repository snapshot. It writes no owner/page state; apply appends only the bound Gate result under the shared writer lock | `python3 Tools/record_gate_result.py . --gate-id P:: --page --apply` | | `apply_metadata_transition.py` | Sole `metadata-transition-integrator-v1` consumer 1.0.0 for typed Profile Extension Gates. It accepts only a matching pass receipt in the current filtered catalog, derives the enum field/value and generic Coverage owner rule from the authorized Gate rather than caller-supplied schema, writes `Coverage.pages[].property_state`, and projects the page through the common page-state composite transaction. Profile, K00, metadata-contract, Coverage and page identities are CAS-bound under the shared writer lock; Coverage and the exact page before-image roll back together before receipt publication, while uncertain append/cleanup retains recovery evidence. Dry-run is default and apply is Integrator-only | `python3 Tools/apply_metadata_transition.py . --gate-id P:: --page --value --gate-receipt --actor-role integrator --expected-coverage-sha256 sha256: --expected-page-sha256 sha256: --apply` | | `metadata_gate_runtime.py` | Shared closed adapter for typed Extension Gate execution. It consumes the one authorized Profile view, resolves one exact Gate, verifies installed producer/schema/consumer capabilities, derives a single evidence-backed enum projection rule, constructs the common receipt binding, and validates current-catalog evidence. It performs no writes and accepts no policy callback | imported by the three Extension Gate CLIs above; no command-line entry point | diff --git a/Tools/card_activation.py b/Tools/card_activation.py index 90affb4..65ae353 100644 --- a/Tools/card_activation.py +++ b/Tools/card_activation.py @@ -20,19 +20,45 @@ import kblib -ACTIVATION_PROTOCOL = "card-first-readback-v1" +# v1 delivered the Card Bundle alone. v2 additionally freezes the Profile's +# Batch Review Requirement expansion at admission and carries its set hash, so +# `open` can bind the exact judgment obligations the batch was activated with. +# Sealed v1 receipts replay under their own era and never gain the field. +ACTIVATION_PROTOCOL = "card-first-readback-v2" +LEGACY_ACTIVATION_PROTOCOL = "card-first-readback-v1" +SUPPORTED_ACTIVATION_PROTOCOLS = frozenset(( + LEGACY_ACTIVATION_PROTOCOL, ACTIVATION_PROTOCOL)) +BATCH_REVIEW_PLAN_PROTOCOL = "batch-review-plan-v1" READBACK_PROTOCOL = "card-readback-addendum-v1" EXECUTION_CONTEXT_ENV = "CAMBIUM_EXECUTION_CONTEXT_ID" CARD_INDEX_PATH = "kernel/Cards/Card Index.md" SHA12_RE = re.compile(r"[0-9a-f]{12}") +SHA256_RE = re.compile(r"sha256:[0-9a-f]{64}") READBACK_POLICIES = frozenset(("none", "declared", "activation")) -ACTIVATION_CONTEXT_FIELDS = ( +LEGACY_ACTIVATION_CONTEXT_FIELDS = ( "activation_protocol", "task_contract_sha256", "reading_plan_sha256", "readback_plan_sha256", "card_bundle_sha256", "activation_bundle_manifest", "delivery_mode", "delivery_assurance", "execution_context_id", ) -ACTIVATION_BUNDLE_FIELDS = ACTIVATION_CONTEXT_FIELDS[:6] +ACTIVATION_CONTEXT_FIELDS = ( + "activation_protocol", "task_contract_sha256", "reading_plan_sha256", + "readback_plan_sha256", "review_requirement_set_sha256", + "card_bundle_sha256", + "activation_bundle_manifest", "delivery_mode", "delivery_assurance", + "execution_context_id", +) +ACTIVATION_BUNDLE_FIELDS = ACTIVATION_CONTEXT_FIELDS[:7] + + +def activation_context_fields(context_or_protocol): + """Return the closed field tuple for one activation era.""" + protocol = context_or_protocol + if isinstance(context_or_protocol, dict): + protocol = context_or_protocol.get("activation_protocol") + if protocol == LEGACY_ACTIVATION_PROTOCOL: + return LEGACY_ACTIVATION_CONTEXT_FIELDS + return ACTIVATION_CONTEXT_FIELDS RUNTIME_STATE_BINDING_FIELDS = ( "required_queue_sha256", "coverage_ledger_sha256", "progress_ledger_sha256", "queue_revision", "queue_state_revision", @@ -258,11 +284,82 @@ def _activation_bundle_manifest(bundle): return manifest +def expand_batch_review_requirements(profile_contract, item): + """Expand the Profile's requirements against one frozen batch manifest. + + The result is deterministic: sorted records of exactly the (batch, + target, judgment item) obligations this batch must answer before + `merge-ready`. A page-selector row expands over the manifest; a + batch-selector row expands to the batch itself. No natural-language + applicability exists by construction. + """ + batch_id = item.get("id") if isinstance(item, dict) else None + if not isinstance(batch_id, str) or not batch_id: + raise ActivationError("review expansion batch has no id") + requirements = () + if profile_contract is not None: + if not getattr(profile_contract, "authorized", False): + raise ActivationError( + "review expansion requires one authorized typed Profile " + "contract") + requirements = getattr( + profile_contract, "batch_review_requirements", ()) + manifest = item.get("manifest") + if not isinstance(manifest, list) or not all( + isinstance(page, str) and page for page in manifest): + raise ActivationError("review expansion manifest must be a string list") + records = [] + for requirement in requirements: + if requirement.target_selector == "each-manifest-page": + targets = sorted(set(manifest)) + elif requirement.target_selector == "batch": + targets = [batch_id] + else: + raise ActivationError( + "review expansion target selector %r is unsupported" % + requirement.target_selector) + for target in targets: + records.append({ + "batch_id": batch_id, + "target": target, + "judgment_item_id": requirement.judgment_item_id, + "target_selector": requirement.target_selector, + "trigger": requirement.trigger, + "producer_kind": requirement.producer_kind, + "receipt_schema": requirement.receipt_schema, + "pass_authority_role_id": requirement.pass_authority_role_id, + }) + records.sort(key=lambda row: (row["judgment_item_id"], row["target"])) + return records + + +def review_requirement_set_sha256(records): + """Hash only the closed obligation identity of one expansion.""" + identity = [ + { + "batch_id": row["batch_id"], + "target": row["target"], + "judgment_item_id": row["judgment_item_id"], + } + for row in records + ] + return kblib.sha256_bytes(kblib.canonical_json_bytes(identity)) + + def build_activation_context(root, progress, item, *, runtime_state, - execution_context_id=None): + execution_context_id=None, + profile_contract=None): """Return receipt extension fields for one exact activation delivery.""" contract, contract_sha = _contract_fingerprint(progress) runtime_bindings = _runtime_bindings(runtime_state) + if profile_contract is None: + view = runtime_state.get("_profile_authorized_view") + profile_contract = (view or {}).get("_contract") if isinstance( + view, dict) else None + if profile_contract is None or not getattr( + profile_contract, "authorized", False): + raise ActivationError( + "activation requires one authorized typed Profile contract") batch_id = item.get("id") if isinstance(item, dict) else None if not isinstance(batch_id, str) or not batch_id: raise ActivationError("activation batch has no id") @@ -380,6 +477,8 @@ def build_activation_context(root, progress, item, *, runtime_state, kblib.canonical_json_bytes(reading_plan)) readback_plan_sha = kblib.sha256_bytes( kblib.canonical_json_bytes(readback_plan)) + review_records = expand_batch_review_requirements(profile_contract, item) + review_set_sha = review_requirement_set_sha256(review_records) bundle = { "activation_protocol": ACTIVATION_PROTOCOL, "task_id": progress.get("task_id"), @@ -396,6 +495,11 @@ def build_activation_context(root, progress, item, *, runtime_state, "cards": cards, "startup_readbacks": startup, "readback_plan": readback_plan, + "batch_review_plan": { + "protocol": BATCH_REVIEW_PLAN_PROTOCOL, + "review_requirement_set_sha256": review_set_sha, + "requirements": review_records, + }, } manifest = _activation_bundle_manifest(bundle) bundle_sha = kblib.sha256_bytes(kblib.canonical_json_bytes(manifest)) @@ -404,6 +508,7 @@ def build_activation_context(root, progress, item, *, runtime_state, "task_contract_sha256": contract_sha, "reading_plan_sha256": reading_plan_sha, "readback_plan_sha256": readback_plan_sha, + "review_requirement_set_sha256": review_set_sha, "card_bundle_sha256": bundle_sha, "activation_bundle_manifest": manifest, "activation_delivery_payload": bundle, @@ -416,13 +521,57 @@ def activation_context_errors(context): errors = [] if not isinstance(context, dict): return ["activation context must be a mapping"] - if context.get("activation_protocol") != ACTIVATION_PROTOCOL: - errors.append("activation_protocol is not %s" % ACTIVATION_PROTOCOL) + protocol = context.get("activation_protocol") + if protocol not in SUPPORTED_ACTIVATION_PROTOCOLS: + errors.append("activation_protocol is not one of %s" % + ", ".join(sorted(SUPPORTED_ACTIVATION_PROTOCOLS))) + return errors manifest = context.get("activation_bundle_manifest") if not isinstance(manifest, dict): return errors + ["activation_bundle_manifest must be a mapping"] - if manifest.get("activation_protocol") != ACTIVATION_PROTOCOL: + if manifest.get("activation_protocol") != protocol: errors.append("activation bundle protocol is invalid") + if protocol == LEGACY_ACTIVATION_PROTOCOL: + # Sealed v1 evidence replays under its own era: the review fields + # must be absent rather than null, exactly as they were written. + if "review_requirement_set_sha256" in context: + errors.append( + "a %s context must not carry review_requirement_set_sha256" % + LEGACY_ACTIVATION_PROTOCOL) + if "batch_review_plan" in manifest: + errors.append( + "a %s bundle must not carry batch_review_plan" % + LEGACY_ACTIVATION_PROTOCOL) + else: + review_sha = context.get("review_requirement_set_sha256") + plan = manifest.get("batch_review_plan") + if not isinstance(review_sha, str) or not SHA256_RE.fullmatch( + review_sha or ""): + errors.append( + "review_requirement_set_sha256 must be a sha256 value") + if not isinstance(plan, dict): + errors.append("activation bundle batch_review_plan must be a " + "mapping") + else: + if plan.get("protocol") != BATCH_REVIEW_PLAN_PROTOCOL: + errors.append("batch_review_plan protocol is invalid") + records = plan.get("requirements") + if not isinstance(records, list): + errors.append("batch_review_plan requirements must be a list") + else: + try: + recomputed = review_requirement_set_sha256(records) + except (KeyError, TypeError) as exc: + recomputed = None + errors.append( + "batch_review_plan requirements are malformed: %s" % + exc) + if recomputed is not None and ( + plan.get("review_requirement_set_sha256") != + recomputed or review_sha != recomputed): + errors.append( + "review_requirement_set_sha256 does not bind the " + "frozen requirement expansion") expected_bundle_sha = kblib.sha256_bytes( kblib.canonical_json_bytes(manifest)) if context.get("card_bundle_sha256") != expected_bundle_sha: @@ -502,7 +651,8 @@ def activation_context_errors(context): def activation_receipt_binding(context): """Return the closed manifest fields persisted in receipt JSONL.""" - return {field: context.get(field) for field in ACTIVATION_CONTEXT_FIELDS} + return {field: context.get(field) + for field in activation_context_fields(context)} def activation_bundle_binding(context): @@ -539,7 +689,8 @@ def context_from_receipt(receipt): """Project only the closed activation extension from a gate receipt.""" if not isinstance(receipt, dict): return None - return {field: receipt.get(field) for field in ACTIVATION_CONTEXT_FIELDS} + return {field: receipt.get(field) + for field in activation_context_fields(receipt)} def build_readback_addendum(root, activation_context, rule_id, *, diff --git a/Tools/check_profile.py b/Tools/check_profile.py index b16e94f..1e7d761 100644 --- a/Tools/check_profile.py +++ b/Tools/check_profile.py @@ -258,6 +258,8 @@ def authorized(self): "registered-scans-empty", "registered-scans-row-empty", "extension-gates-configured-empty", + "batch-review-configured-empty", + "batch-review-requirements-row-empty", "extension-gates-row-empty", )) @@ -373,6 +375,21 @@ def authorized(self): # typed Profile extension Gate execution contract "extension-gates-registration", "extension-gates-none-with-rows", + "batch-review-judgment-duplicate", + "batch-review-judgment-reference", + "batch-review-none-with-rows", + "batch-review-producer-kind", + "batch-review-receipt-schema", + "batch-review-requirements-row-shape", + "batch-review-requirements-section-count", + "batch-review-requirements-table-count", + "batch-review-requirements-table-header", + "batch-review-requirements-table-separator", + "batch-review-requirements-table-shape", + "batch-review-role-reference", + "batch-review-role-registry", + "batch-review-target-selector", + "batch-review-trigger", "extension-gate-deterministic-completion", "extension-gate-id-invalid", "extension-gate-id-duplicate", diff --git a/Tools/check_queue.py b/Tools/check_queue.py index e265f83..6441cf6 100644 --- a/Tools/check_queue.py +++ b/Tools/check_queue.py @@ -5842,6 +5842,199 @@ def substantive_review_errors(result, item): return errors +def judgment_record_set_sha256(records): + """Hash the exact actual judgment set the batch-review wrapper binds.""" + identity = sorted( + ( + { + "target": row["target"], + "judgment_item_id": row["judgment_item_id"], + "receipt_id": row["receipt_id"], + } + for row in records + ), + key=lambda row: (row["judgment_item_id"], row["target"], + row["receipt_id"]), + ) + return kblib.sha256_bytes(kblib.canonical_json_bytes(identity)) + + +def batch_review_judgment_errors(result, item, wrapper_receipt): + """Prove the Profile's frozen judgment obligations are exactly answered. + + Expected records come from the authorized Profile's Batch Review + Requirements expanded over the frozen manifest — the same expansion the + activation receipt froze at `queued -> open`. Actual records come from + the current `profile_batch_judgment` receipts the wrapper binds. One + missing, extra, duplicated, drifted, mis-roled, or reused record refuses + the transition. A batch activated under the pre-review era carries no + obligations and must carry no judgment bindings: sealed history keeps + its own shape. + """ + errors = [] + item_id = item.get("id") + catalog = current_receipt_catalog(result) + activation_entry = catalog.get(item.get("activation_receipt")) if isinstance(item.get("activation_receipt"), str) else None + activation = activation_entry[1] if activation_entry else None + protocol = activation.get("activation_protocol") if isinstance( + activation, dict) else None + # A batch whose activation predates delivery receipts entirely — or + # was activated under v1 — predates the review era. It owes nothing + # and must carry nothing; the runtime validator, not this gate, is + # what guarantees a current-era batch cannot shed its activation + # receipt to slip into this branch. + legacy = protocol != card_activation.ACTIVATION_PROTOCOL + wrapper_fields = ( + "review_requirement_set_sha256", "judgment_receipt_ids", + "judgment_record_set_sha256") + if legacy: + for field in wrapper_fields: + if field in (wrapper_receipt or {}): + errors.append( + "%s was activated under %s; its batch-review wrapper " + "must not carry %s" % (item_id, protocol, field)) + return errors + + view = result.get("_profile_authorized_view") or {} + contract = view.get("_contract") + if contract is None or not getattr(contract, "authorized", False): + errors.append( + "%s judgment validation requires one authorized typed Profile " + "contract" % item_id) + return errors + try: + expected = card_activation.expand_batch_review_requirements( + contract, item) + except (TypeError, ValueError) as exc: + errors.append("%s requirement expansion failed: %s" % (item_id, exc)) + return errors + expected_sha = card_activation.review_requirement_set_sha256(expected) + if activation.get("review_requirement_set_sha256") != expected_sha: + errors.append( + "%s current Profile/manifest expansion no longer matches the " + "activation-frozen requirement set; the batch must be " + "reactivated" % item_id) + return errors + requirements = { + row.judgment_item_id: row + for row in getattr(contract, "batch_review_requirements", ()) + } + + wrapper = wrapper_receipt or {} + if not expected: + # A Profile with no requirements owes nothing: an absent binding IS + # the empty set, so requirement-free adopters keep their exact + # current wrapper shape. A wrapper that does carry the fields must + # still carry them correctly. + if not any(field in wrapper for field in wrapper_fields): + return errors + if wrapper.get("review_requirement_set_sha256") != expected_sha: + errors.append( + "%s batch review wrapper must bind " + "review_requirement_set_sha256=%s" % (item_id, expected_sha)) + bound = wrapper.get("judgment_receipt_ids") + if not isinstance(bound, list) or not all( + _nonempty_string(value) for value in bound): + errors.append( + "%s batch review wrapper judgment_receipt_ids must be an " + "explicit string list" % item_id) + return errors + if bound != sorted(set(bound)): + errors.append( + "%s batch review wrapper judgment_receipt_ids must be sorted " + "and unique" % item_id) + return errors + + current_fingerprint = view.get("profile_contract_fingerprint") + actual = [] + seen = {} + for receipt_id in bound: + entry = catalog.get(receipt_id) + receipt = entry[1] if entry else None + if not isinstance(receipt, dict): + errors.append( + "%s judgment receipt %s is absent from the current catalog" % + (item_id, receipt_id)) + continue + label = "%s judgment receipt %s" % (item_id, receipt_id) + if receipt.get("invalidated_by") is not None: + errors.append("%s is invalidated" % label) + continue + if (receipt.get("tool") != "record_batch_judgment" or + receipt.get("check") != "profile_batch_judgment" or + receipt.get("result") != "pass"): + errors.append("%s is not a passing profile_batch_judgment" % + label) + continue + if receipt.get("task_id") != result["queue"].get("task_id"): + errors.append("%s binds a different task" % label) + if receipt.get("batch_id") != item_id: + errors.append("%s binds a different batch" % label) + if receipt.get("opening_transition_receipt") != item.get( + "activation_receipt"): + errors.append( + "%s binds a different activation; a reopened batch redoes " + "its judgments" % label) + if receipt.get("review_requirement_set_sha256") != expected_sha: + errors.append("%s binds a different requirement set" % label) + if receipt.get("profile_contract_fingerprint") != current_fingerprint: + errors.append("%s binds a superseded Profile contract" % label) + target = receipt.get("target") + judgment_item_id = receipt.get("judgment_item_id") + requirement = requirements.get(judgment_item_id) + if requirement is None: + errors.append("%s names an unregistered Judgment Item" % label) + continue + if receipt.get("reviewer_role") != requirement.pass_authority_role_id: + errors.append( + "%s reviewer_role %r is not the registered pass authority " + "%r" % (label, receipt.get("reviewer_role"), + requirement.pass_authority_role_id)) + if receipt.get("receipt_schema") != requirement.receipt_schema: + errors.append("%s carries the wrong receipt schema" % label) + if requirement.target_selector == "each-manifest-page": + try: + _snapshot, semantic_sha = metadata_property_state. semantic_page_snapshot(result["root"], target) + except (OSError, TypeError, UnicodeError, ValueError) as exc: + errors.append("%s target cannot be snapshotted: %s" % + (label, exc)) + semantic_sha = None + if semantic_sha is not None and receipt.get( + "semantic_content_sha256") != semantic_sha: + errors.append( + "%s was judged against different page bytes; the " + "changed page must be re-judged" % label) + key = (target, judgment_item_id) + if key in seen: + errors.append( + "%s duplicates the judgment %s already bound for %r" % + (label, seen[key], key)) + continue + seen[key] = receipt_id + actual.append({ + "target": target, + "judgment_item_id": judgment_item_id, + "receipt_id": receipt_id, + }) + + expected_keys = {(row["target"], row["judgment_item_id"]) + for row in expected} + actual_keys = set(seen) + for target, judgment_item_id in sorted(expected_keys - actual_keys): + errors.append( + "%s is missing the required judgment (%s, %s)" % + (item_id, target, judgment_item_id)) + for target, judgment_item_id in sorted(actual_keys - expected_keys): + errors.append( + "%s binds the unexpected judgment (%s, %s)" % + (item_id, target, judgment_item_id)) + if not errors and wrapper.get("judgment_record_set_sha256") != judgment_record_set_sha256(actual): + errors.append( + "%s batch review wrapper judgment_record_set_sha256 does not " + "bind the exact actual judgment set" % item_id) + return errors + + def batch_review_receipt_errors(catalog, receipt_id, *, item_id, task_id, delta_page_receipt_ids): """Validate the current batch-level authorization around page evidence. diff --git a/Tools/compiled/cli-contract.yaml b/Tools/compiled/cli-contract.yaml index 7b253bb..df65e2a 100644 --- a/Tools/compiled/cli-contract.yaml +++ b/Tools/compiled/cli-contract.yaml @@ -5,7 +5,7 @@ # by hand, and a hand edit is reported by --check as a HOLD. # regenerate with: python3 Tools/compile_cli_contract.py . # verify with: python3 Tools/compile_cli_contract.py . --check -# `source_hash` covers the manifest of the 44 tool sources listed +# `source_hash` covers the manifest of the 45 tool sources listed # under source_files, each with its own sha256. # A positional argument is one whose `option_strings` is empty. # `choices` is the admissible SET in canonical order, not the @@ -49,6 +49,7 @@ source_files: - Tools/metadata_execution_contract.py - Tools/profile_onboarding_status.py - Tools/project_page_state.py + - Tools/record_batch_judgment.py - Tools/record_corpus_acceptance.py - Tools/record_gate_attestation.py - Tools/record_gate_result.py @@ -64,7 +65,7 @@ source_files: - Tools/stamp_cards.py - Tools/update_queue.py - Tools/update_task.py -source_hash: sha256:89e88488109fc3a99fcd7e6fe88374d152b66a3bfcfd142ddee0d48d154f38c2 +source_hash: sha256:0851f552ac8080f96d888a5a236abf93aa1b7af5fa541b1bf6e62dfe690a23f6 receipt_shape: base_fields: - receipt_id @@ -79,7 +80,7 @@ receipt_shape: conditional_fields: - gate_id extension_policy: derived-per-tool-from-source -tool_count: 44 +tool_count: 45 tools: - tool: adopt_standards module: Tools/adopt_standards.py @@ -1588,7 +1589,7 @@ tools: receipt_extensions_extraction: complete - tool: check_profile module: Tools/check_profile.py - source_hash: sha256:cda331e1d5afd149bd006b009e09cf9293095a2e9e07f15895815a579646b7e5 + source_hash: sha256:0e61d05d11252616881369f348140b8840a15b5f84bec4c77ef82e5795d19106 description: Profile manifest completeness and unfilled-template check arguments: - dest: profile_dir @@ -1766,7 +1767,7 @@ tools: receipt_extensions_extraction: partial - tool: check_queue module: Tools/check_queue.py - source_hash: sha256:60cef999292bf58f4888812a623502df76b27a18032c0dc03770bedf562d65e4 + source_hash: sha256:137aeeffc12be70bb699b7a8243c07a95dce6c2bf2a37228b655c3fe44c639ce description: Validate canonical Required Queue state arguments: - dest: root @@ -2969,6 +2970,124 @@ tools: mutually_exclusive_groups: [] receipt_extensions: [] receipt_extensions_extraction: complete + - tool: record_batch_judgment + module: Tools/record_batch_judgment.py + source_hash: sha256:ae6b734b1de1712e9967265217112a9aaf4db0941ff761c3ab464acc78ec345f + description: Record one snapshot-bound Batch Review judgment + arguments: + - dest: root + option_strings: [] + required: true + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: adopting repository root + - dest: batch + option_strings: + - --batch + required: true + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: exact open Queue batch ID + - dest: judgment_item + option_strings: + - --judgment-item + required: true + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: registered Batch Review Requirement Judgment Item ID + - dest: target + option_strings: + - --target + required: true + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: manifest page path, or the batch ID for a batch-selector requirement + - dest: reviewer_role + option_strings: + - --reviewer-role + required: true + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: declared pass-authority Profile role ID + - dest: statement + option_strings: + - --statement + required: true + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: bounded judgment statement (the concrete verdict, not "reviewed") + - dest: receipts + option_strings: + - --receipts + required: false + default: .cambium/receipts/batch-judgments.jsonl + default_type: str + choices: null + nargs: null + action: store + type: null + help: receipt JSONL path under .cambium/receipts + - dest: apply + option_strings: + - --apply + required: false + default: false + default_type: bool + choices: null + nargs: 0 + action: store_true + type: null + help: append the evidence; omit for a dry run + - dest: json + option_strings: + - --json + required: false + default: false + default_type: bool + choices: null + nargs: 0 + action: store_true + type: null + help: write the applied receipt as one JSON array + mutually_exclusive_groups: [] + receipt_extensions: + - batch_id + - judgment_item_id + - opening_transition_receipt + - pass_authority_role_id + - profile_contract_fingerprint + - profile_snapshot_sha256 + - receipt_schema + - review_requirement_set_sha256 + - reviewer_role + - root + - semantic_content_sha256 + - target_selector + receipt_extensions_extraction: complete - tool: record_corpus_acceptance module: Tools/record_corpus_acceptance.py source_hash: sha256:daf0221fda93476856e57f0047a0f95ebd6b6bb421c3705cdb4e388555548521 @@ -4083,7 +4202,7 @@ tools: receipt_extensions_extraction: complete - tool: update_queue module: Tools/update_queue.py - source_hash: sha256:d8e77856ffc69c37ac665516b376804cc53e4ad6e0e579753b975f635b679d35 + source_hash: sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae description: Apply one Required Queue transition arguments: - dest: root diff --git a/Tools/compiled/host-configs/claude-code.mcp.json b/Tools/compiled/host-configs/claude-code.mcp.json index f5cab51..528984d 100644 --- a/Tools/compiled/host-configs/claude-code.mcp.json +++ b/Tools/compiled/host-configs/claude-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:1616f81bbd18e401cd4d34c9cda9a217b95cc9743fbab8975d488a5e1bf3b20c","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/host-configs/codex.config.toml b/Tools/compiled/host-configs/codex.config.toml index f0e56fc..a4a3c8a 100644 --- a/Tools/compiled/host-configs/codex.config.toml +++ b/Tools/compiled/host-configs/codex.config.toml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:1616f81bbd18e401cd4d34c9cda9a217b95cc9743fbab8975d488a5e1bf3b20c +# source_hash: sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -35,5 +35,5 @@ command = "python3" cwd = "" [mcp_servers.cambium.env] -CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:1616f81bbd18e401cd4d34c9cda9a217b95cc9743fbab8975d488a5e1bf3b20c" +CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db" CAMBIUM_WORKSPACE_ROOT = "" diff --git a/Tools/compiled/host-configs/dsh-profile-patch.yaml b/Tools/compiled/host-configs/dsh-profile-patch.yaml index de5be82..974df86 100644 --- a/Tools/compiled/host-configs/dsh-profile-patch.yaml +++ b/Tools/compiled/host-configs/dsh-profile-patch.yaml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:1616f81bbd18e401cd4d34c9cda9a217b95cc9743fbab8975d488a5e1bf3b20c +# source_hash: sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # diff --git a/Tools/compiled/host-configs/dsh.env b/Tools/compiled/host-configs/dsh.env index c85a0f3..63d90ba 100644 --- a/Tools/compiled/host-configs/dsh.env +++ b/Tools/compiled/host-configs/dsh.env @@ -4,7 +4,7 @@ # carries: binding # server name: cambium # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:1616f81bbd18e401cd4d34c9cda9a217b95cc9743fbab8975d488a5e1bf3b20c +# source_hash: sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -21,5 +21,5 @@ # valid absolute path on any of these hosts, so an un-substituted copy # fails at launch instead of resolving to something. -CAMBIUM_INTERFACE_SOURCE_HASH="sha256:1616f81bbd18e401cd4d34c9cda9a217b95cc9743fbab8975d488a5e1bf3b20c" +CAMBIUM_INTERFACE_SOURCE_HASH="sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db" CAMBIUM_WORKSPACE_ROOT="" diff --git a/Tools/compiled/host-configs/kimi-code.mcp.json b/Tools/compiled/host-configs/kimi-code.mcp.json index f5cab51..528984d 100644 --- a/Tools/compiled/host-configs/kimi-code.mcp.json +++ b/Tools/compiled/host-configs/kimi-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:1616f81bbd18e401cd4d34c9cda9a217b95cc9743fbab8975d488a5e1bf3b20c","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/mcp-tools.json b/Tools/compiled/mcp-tools.json index c836879..d03e8c0 100644 --- a/Tools/compiled/mcp-tools.json +++ b/Tools/compiled/mcp-tools.json @@ -1 +1 @@ -{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:6c62b0e4ebb720aa167dc57bcff9f1ae2c2bf5fcef7127d7fdf65bcf158d0c25","source_manifest_hash":"sha256:89e88488109fc3a99fcd7e6fe88374d152b66a3bfcfd142ddee0d48d154f38c2","source_schema_version":1,"tool_count":44,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"transaction receipt JSONL destination (default: .receipts.jsonl beside the plan; never .cambium/)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no .cambium/ may exist anywhere under it)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. K00/03 selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the active K00/03 Standards Control","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the active K00/03 Standards Control","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} +{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:cc99ee0f1ccf61190350aa47d4a6173f654cb17b73b7507416aebbf8e2803187","source_manifest_hash":"sha256:0851f552ac8080f96d888a5a236abf93aa1b7af5fa541b1bf6e62dfe690a23f6","source_schema_version":1,"tool_count":45,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"transaction receipt JSONL destination (default: .receipts.jsonl beside the plan; never .cambium/)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no .cambium/ may exist anywhere under it)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. K00/03 selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the active K00/03 Standards Control","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the active K00/03 Standards Control","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record one snapshot-bound Batch Review judgment","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"batch":{"description":"exact open Queue batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"judgment_item":{"description":"registered Batch Review Requirement Judgment Item ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--judgment-item"]}},"receipts":{"default":".cambium/receipts/batch-judgments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reviewer_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer-role"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded judgment statement (the concrete verdict, not \"reviewed\")","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"target":{"description":"manifest page path, or the batch ID for a batch-selector requirement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--target"]}}},"required":["root","batch","judgment_item","target","reviewer_role","statement"],"type":"object"},"name":"record_batch_judgment"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} diff --git a/Tools/compiled/metadata-execution-contract.json b/Tools/compiled/metadata-execution-contract.json index 1f2502e..7f67821 100644 --- a/Tools/compiled/metadata-execution-contract.json +++ b/Tools/compiled/metadata-execution-contract.json @@ -1 +1 @@ -{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:79491294aa3fc3703bd3059895ac187f1db501e6902667820d2878638afd251c"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:60cef999292bf58f4888812a623502df76b27a18032c0dc03770bedf562d65e4"},{"path":"Tools/mcp_server.py","sha256":"sha256:9242ac64abe3baf24d8e6e9586c9bf8bd08ac708e802ee6bd12de00a267db270"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:d8e77856ffc69c37ac665516b376804cc53e4ad6e0e579753b975f635b679d35"}],"contract_fingerprint":"sha256:217a041d8bb2e2360314e846100beaa2625db80d8ce1130a8639215d3455a2d9","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} +{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:a5106bf4db90eccfd078ffbd436846c753de5c1a01eb4fb3842ed934b5cecf97"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:137aeeffc12be70bb699b7a8243c07a95dce6c2bf2a37228b655c3fe44c639ce"},{"path":"Tools/mcp_server.py","sha256":"sha256:9242ac64abe3baf24d8e6e9586c9bf8bd08ac708e802ee6bd12de00a267db270"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae"}],"contract_fingerprint":"sha256:c4f40a153e53affdef051e54e45e072fd27aa30385c752ecbe7b57def2c9538e","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} diff --git a/Tools/profile_contract.py b/Tools/profile_contract.py index 2a137a0..ee37855 100644 --- a/Tools/profile_contract.py +++ b/Tools/profile_contract.py @@ -106,6 +106,19 @@ "Bound actor or system ID/name", "Responsibility", ) +BATCH_REVIEW_SECTION = "Batch Review Requirements" +BATCH_REVIEW_HEADER = ( + "Judgment Item ID reference", + "Target selector: `each-manifest-page` or `batch`", + "Trigger: `before-merge-ready`", + "Producer kind: `manual-attestation`", + "Receipt schema", + "Pass-authority Role ID reference", +) +BATCH_REVIEW_TARGET_SELECTORS = frozenset(("each-manifest-page", "batch")) +BATCH_REVIEW_TRIGGERS = frozenset(("before-merge-ready",)) +BATCH_REVIEW_PRODUCER_KINDS = frozenset(("manual-attestation",)) +BATCH_REVIEW_RECEIPT_SCHEMAS = frozenset(("page-batch-judgment-v1",)) BASE_DIMENSIONS = frozenset(( "structure_and_links", @@ -272,6 +285,26 @@ class ExtensionGate: field_values: Tuple[str, ...] = () +@dataclass(frozen=True) +class BatchReviewRequirement: + """One Profile obligation the batch-review wrapper must prove complete. + + Unlike an Extension Gate, a requirement changes no persisted property. + It declares that one registered Judgment Item must be judged for every + applicable target of a batch before that batch may leave ``open``, and + binds the producer class, receipt schema, and pass-authority role its + per-target evidence must carry. + """ + + judgment_item_id: str + target_selector: str + trigger: str + producer_kind: str + receipt_schema: str + pass_authority_role_id: str + source: SourceCell + + @dataclass(frozen=True) class ProfileContract: root: str @@ -291,6 +324,8 @@ class ProfileContract: dependency_edges: Tuple[DependencyEdge, ...] source_cells: Tuple[SourceCell, ...] diagnostics: Tuple[Diagnostic, ...] + batch_review_registration: Optional[str] = None + batch_review_requirements: Tuple[BatchReviewRequirement, ...] = () @property def authorized(self): @@ -349,6 +384,21 @@ def profile_contract_fingerprint(self): for gate in self.extension_gates ], } + if self.batch_review_requirements: + # Conditional inclusion keeps every requirement-free Profile's + # fingerprint byte-identical to its pre-requirement value, so + # shipping this slot forces no adopter re-fingerprint. + value["batch_review_requirements"] = [ + { + "judgment_item_id": row.judgment_item_id, + "target_selector": row.target_selector, + "trigger": row.trigger, + "producer_kind": row.producer_kind, + "receipt_schema": row.receipt_schema, + "pass_authority_role_id": row.pass_authority_role_id, + } + for row in self.batch_review_requirements + ] encoded = json.dumps( value, ensure_ascii=False, sort_keys=True, separators=(",", ":"), @@ -1678,6 +1728,137 @@ def _capability_supports(builder, supports, capability_id, operation, source, return result +def _parse_batch_review_requirements(builder, text, source_path, + role_text, role_path, judgments): + """Parse the Batch Review Requirements registry into typed IR. + + A configured row is an executable per-batch obligation, not a prose + reminder: its Judgment Item must be registered, its role must resolve, + and every enum cell comes from a closed first-version set. Natural- + language applicability is deliberately excluded so a declared rule can + never again be one the machine does not know when to apply. + """ + # An absent section is the unregistered state, not a defect: this slot + # ships after profiles already exist, and forcing every routing registry + # to grow an empty table would turn the rollout itself into a break. + matches = [item for item in _sections(text) + if item.heading == BATCH_REVIEW_SECTION] + if not matches: + return None, () + if len(matches) > 1: + builder.add( + "batch-review-requirements-section-count", source_path, + "expected at most one `## %s` section; found %d" % + (BATCH_REVIEW_SECTION, len(matches))) + return None, () + section = matches[0] + registration = _section_registration( + builder, section, source_path, "batch-review-requirements") + rows = builder.table( + section, BATCH_REVIEW_HEADER, source_path, + "batch-review-requirements") + if registration == "None" and rows: + builder.add( + "batch-review-none-with-rows", source_path, + "`Registration: None` requires an empty Batch Review " + "Requirements table; found %d data row(s)" % len(rows)) + if registration == "Configured" and not rows: + builder.add( + "batch-review-configured-empty", source_path, + "`Registration: Configured` requires at least one Batch Review " + "Requirement row") + if not rows: + return registration, () + + if role_text is None: + builder.add( + "batch-review-role-registry", source_path, + "configured Batch Review Requirements require a readable Role " + "Registry") + role_ids = frozenset(KERNEL_ROLE_IDS) + else: + role_ids = _extension_role_ids(builder, role_text, role_path) + judgment_ids = {item.judgment_item_id for item in judgments} + + parsed = [] + seen = set() + for row_number, row in enumerate(rows, 1): + cells = builder.cells( + row, BATCH_REVIEW_HEADER, source_path, + BATCH_REVIEW_SECTION, row_number, "batch-review-requirements") + if cells is None: + continue + judgment_id = _literal(cells[0].raw) + target_selector = _literal(cells[1].raw) + trigger = _literal(cells[2].raw) + producer_kind = _literal(cells[3].raw) + receipt_schema = _literal(cells[4].raw) + role_id = _literal(cells[5].raw) + valid = True + if judgment_id not in judgment_ids: + builder.add( + "batch-review-judgment-reference", cells[0].target, + "Judgment Item ID %r is not registered in this Profile's " + "Judgment Items" % judgment_id, cells[0]) + valid = False + if judgment_id in seen: + builder.add( + "batch-review-judgment-duplicate", cells[0].target, + "Judgment Item ID %r is required more than once" % + judgment_id, cells[0]) + valid = False + seen.add(judgment_id) + if target_selector not in BATCH_REVIEW_TARGET_SELECTORS: + builder.add( + "batch-review-target-selector", cells[1].target, + "target selector %r must be one of: %s" % + (target_selector, + ", ".join(sorted(BATCH_REVIEW_TARGET_SELECTORS))), cells[1]) + valid = False + if trigger not in BATCH_REVIEW_TRIGGERS: + builder.add( + "batch-review-trigger", cells[2].target, + "trigger %r must be one of: %s" % + (trigger, ", ".join(sorted(BATCH_REVIEW_TRIGGERS))), cells[2]) + valid = False + if producer_kind not in BATCH_REVIEW_PRODUCER_KINDS: + builder.add( + "batch-review-producer-kind", cells[3].target, + "producer kind %r must be one of: %s" % + (producer_kind, + ", ".join(sorted(BATCH_REVIEW_PRODUCER_KINDS))), cells[3]) + valid = False + if receipt_schema not in BATCH_REVIEW_RECEIPT_SCHEMAS: + builder.add( + "batch-review-receipt-schema", cells[4].target, + "receipt schema %r must be one of: %s" % + (receipt_schema, + ", ".join(sorted(BATCH_REVIEW_RECEIPT_SCHEMAS))), cells[4]) + valid = False + if role_id not in role_ids: + builder.add( + "batch-review-role-reference", cells[5].target, + "Pass-authority Role ID %r is not a registered role" % + role_id, cells[5]) + valid = False + if not valid: + continue + builder.edges.append(DependencyEdge( + kind="batch-review-judgment", + owner_id="batch-review:%s" % judgment_id, + target_id=judgment_id)) + parsed.append(BatchReviewRequirement( + judgment_item_id=judgment_id, + target_selector=target_selector, + trigger=trigger, + producer_kind=producer_kind, + receipt_schema=receipt_schema, + pass_authority_role_id=role_id, + source=cells[0], + )) + return registration, tuple(parsed) + + def _parse_extension_gates(builder, text, source_path, profile_repo_dir, profile_id, role_text, role_path, vocabulary_text, vocabulary_path, @@ -2246,6 +2427,7 @@ def load_profile_contract(root, manifest_path, sentinel="TODO(profile)", target_id=scan.judgment_item_id, )) + review_registration, review_requirements = None, () if routing_text is not None: declared_profile_id, _identity_errors = kblib.profile_identity( manifest_text, os.path.basename(profile_repo_dir)) @@ -2256,6 +2438,10 @@ def load_profile_contract(root, manifest_path, sentinel="TODO(profile)", metadata_text, metadata_path, judgments, scans, root_input_snapshots=root_input_snapshots) + review_registration, review_requirements = \ + _parse_batch_review_requirements( + builder, routing_text, routing_path, + role_text, role_path, judgments) edges = tuple(sorted( builder.edges, @@ -2278,6 +2464,8 @@ def load_profile_contract(root, manifest_path, sentinel="TODO(profile)", registered_scans=tuple(scans), extension_gate_registration=gate_registration, extension_gates=tuple(gates), + batch_review_registration=review_registration, + batch_review_requirements=tuple(review_requirements), dependency_edges=edges, source_cells=tuple(builder.source_cells), diagnostics=tuple(builder.diagnostics), diff --git a/Tools/record_batch_judgment.py b/Tools/record_batch_judgment.py new file mode 100644 index 0000000..d07a98a --- /dev/null +++ b/Tools/record_batch_judgment.py @@ -0,0 +1,251 @@ +#!/usr/bin/env python3 +"""Record one per-target judgment a Batch Review Requirement demands. + +The Profile's ``Batch Review Requirements`` registry, not command-line +options, supplies which Judgment Item applies, over which targets, under +which pass-authority role, and in which receipt schema. One invocation +answers exactly one frozen obligation record: the judgment is bound to the +batch's current activation (so a reopened batch cannot reuse it), to the +target's exact semantic content (so a drifted page cannot keep it), and to +the authorized Profile contract fingerprint (so a revised Profile cannot +keep it). The machine does not certify that the human judgment is right; +it certifies that the judgment happened, against these bytes, by the +declared role, for this attempt. + +`open -> merge-ready` consumes these receipts through the batch-review +wrapper: expected records and actual records must match exactly. This tool +changes no page, Ledger, or Queue state. +""" + +import os +import sys + +sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) +import card_activation +import check_queue +import kblib +import metadata_property_state + + +TOOL = "record_batch_judgment" +TOOL_VERSION = "1.0.0" +JUDGMENT_CHECK = "profile_batch_judgment" +DEFAULT_RECEIPTS = ".cambium/receipts/batch-judgments.jsonl" + + +def _requirement(contract, judgment_item_id): + rows = [row for row in getattr(contract, "batch_review_requirements", ()) + if row.judgment_item_id == judgment_item_id] + if not rows: + raise ValueError( + "Judgment Item %r is not a registered Batch Review Requirement " + "of the selected Profile" % judgment_item_id) + return rows[0] + + +def build_judgment_receipt(runtime, contract, item, judgment_item_id, + target, reviewer_role, statement, seq=1): + """Build one judgment receipt for one frozen obligation record.""" + requirement = _requirement(contract, judgment_item_id) + if reviewer_role != requirement.pass_authority_role_id: + raise ValueError( + "reviewer role %r cannot answer %s; the Profile registers %r" % + (reviewer_role, judgment_item_id, + requirement.pass_authority_role_id)) + if not isinstance(statement, str) or not statement.strip(): + raise ValueError("a batch judgment requires a non-empty statement") + if item.get("state") != "open": + raise ValueError( + "batch %s is %s; judgments are recorded only while it is open" % + (item.get("id"), item.get("state"))) + + expected = card_activation.expand_batch_review_requirements( + contract, item) + record = [row for row in expected + if row["target"] == target and + row["judgment_item_id"] == judgment_item_id] + if not record: + raise ValueError( + "(%s, %s) is not an expected obligation of batch %s" % + (target, judgment_item_id, item.get("id"))) + expected_sha = card_activation.review_requirement_set_sha256(expected) + + activation_id = item.get("activation_receipt") + catalog = runtime.get("current_receipt_catalog", + runtime.get("receipt_catalog", {})) + entry = catalog.get(activation_id) if isinstance( + activation_id, str) else None + activation = entry[1] if entry else None + if not isinstance(activation, dict): + raise ValueError( + "batch %s has no current activation receipt to bind" % + item.get("id")) + if activation.get( + "activation_protocol") != card_activation.ACTIVATION_PROTOCOL: + raise ValueError( + "batch %s was activated under %r; judgments bind only %s " + "activations — reactivate the batch first" % + (item.get("id"), activation.get("activation_protocol"), + card_activation.ACTIVATION_PROTOCOL)) + frozen_sha = activation.get("review_requirement_set_sha256") + if frozen_sha != expected_sha: + raise ValueError( + "the current Profile/manifest expansion no longer matches the " + "activation-frozen requirement set; reactivate the batch " + "before judging") + + semantic_sha = None + if requirement.target_selector == "each-manifest-page": + _snapshot, semantic_sha = metadata_property_state.\ + semantic_page_snapshot(runtime["root"], target) + + view = runtime.get("_profile_authorized_view") or {} + receipt = kblib.make_receipt( + TOOL, TOOL_VERSION, JUDGMENT_CHECK, target, "pass", + statement.strip(), seq, root=runtime["root"]) + receipt.update({ + "batch_id": item.get("id"), + "judgment_item_id": judgment_item_id, + "target_selector": requirement.target_selector, + "receipt_schema": requirement.receipt_schema, + "pass_authority_role_id": requirement.pass_authority_role_id, + "reviewer_role": reviewer_role, + "opening_transition_receipt": activation_id, + "review_requirement_set_sha256": frozen_sha, + "semantic_content_sha256": semantic_sha, + "profile_contract_fingerprint": view.get( + "profile_contract_fingerprint"), + "profile_snapshot_sha256": view.get("profile_snapshot_sha256"), + }) + return receipt + + +def main(argv=None): + parser = kblib.ArgumentParser( + description="Record one snapshot-bound Batch Review judgment") + parser.add_argument("root", help="adopting repository root") + parser.add_argument("--batch", required=True, + help="exact open Queue batch ID") + parser.add_argument("--judgment-item", required=True, + help="registered Batch Review Requirement Judgment " + "Item ID") + parser.add_argument("--target", required=True, + help="manifest page path, or the batch ID for a " + "batch-selector requirement") + parser.add_argument("--reviewer-role", required=True, + help="declared pass-authority Profile role ID") + parser.add_argument("--statement", required=True, + help="bounded judgment statement (the concrete " + "verdict, not \"reviewed\")") + parser.add_argument("--receipts", default=DEFAULT_RECEIPTS, + help="receipt JSONL path under .cambium/receipts") + parser.add_argument("--apply", action="store_true", + help="append the evidence; omit for a dry run") + parser.add_argument("--json", action="store_true", + help="write the applied receipt as one JSON array") + args = parser.parse_args(argv) + + root = os.path.realpath(os.path.abspath(args.root)) + try: + runtime = check_queue.validate_runtime(root) + if runtime.get("errors"): + raise ValueError("current runtime is inconsistent: %s" % + "; ".join(runtime["errors"])) + authority = check_queue.runtime_authority_context(runtime) + view = runtime.get("_profile_authorized_view") or {} + contract = view.get("_contract") + if contract is None or not getattr(contract, "authorized", False): + raise ValueError( + "runtime has no authorized typed Profile contract") + item = (runtime.get("items_by_id") or {}).get(args.batch) + if not isinstance(item, dict): + raise ValueError("batch %s is not in the Required Queue" % + args.batch) + receipt = build_judgment_receipt( + runtime, contract, item, args.judgment_item, args.target, + args.reviewer_role, args.statement) + receipt_path = kblib.managed_repository_path( + root, args.receipts, ".cambium/receipts", + suffixes=(".jsonl",), must_exist=False) + except (OSError, TypeError, UnicodeError, ValueError) as exc: + print("[FAIL] %s" % exc, file=sys.stderr) + return 1 + + if not args.apply: + if args.json: + # A dry run publishes no receipt, matching the other writers. + return 0 + print("[PLAN] %s answers (%s, %s) for batch %s" % + (args.reviewer_role, args.target, args.judgment_item, + args.batch)) + print("dry run; add --apply to publish the bound judgment") + return 0 + + operation = { + "tool": TOOL, + "action": "record-batch-review-judgment", + "batch_id": args.batch, + "judgment_item_id": args.judgment_item, + "target": args.target, + "receipt_id": receipt["receipt_id"], + "receipt_path": args.receipts, + "before_coverage_sha256": runtime.get("coverage_sha256"), + "planned_after_coverage_sha256": runtime.get("coverage_sha256"), + "before_required_queue_sha256": runtime.get("queue_sha256"), + "planned_after_required_queue_sha256": runtime.get("queue_sha256"), + "before_progress_sha256": runtime.get("progress_sha256"), + "planned_after_progress_sha256": runtime.get("progress_sha256"), + } + operation.update(check_queue.runtime_authority_lock_fields(authority)) + try: + authority_kwargs = check_queue.runtime_authority_validation_kwargs( + authority) + with kblib.runtime_write_lock( + root, owner_metadata=operation) as lease: + with kblib.no_authoritative_write_guard(lease): + locked = check_queue.validate_runtime( + root, **authority_kwargs) + if locked.get("errors"): + raise ValueError( + "runtime changed before evidence publication: %s" % + "; ".join(locked["errors"])) + locked_item = (locked.get("items_by_id") or {}).get( + args.batch) + locked_contract = (locked.get( + "_profile_authorized_view") or {}).get("_contract") + # Rebuild under the lock so a drifted page, Profile, or + # reopened batch cannot slip between plan and publication. + locked_receipt = build_judgment_receipt( + locked, locked_contract, locked_item, + args.judgment_item, args.target, args.reviewer_role, + args.statement) + for field in ("receipt_id", "checked_at"): + locked_receipt[field] = receipt[field] + if locked_receipt != receipt: + raise ValueError( + "judgment bindings changed before publication") + before = kblib.receipt_append_observation( + receipt_path, [receipt]) + outcome, error, _observation = kblib.write_receipts_observed( + receipt_path, [receipt], before=before) + if outcome != "present" or error is not None: + if outcome == "absent": + lease.mark_reconciled() + raise ValueError( + "batch judgment publication outcome=%s error=%s" % + (outcome, error)) + except (OSError, TypeError, ValueError, + kblib.RuntimeStateLockedError) as exc: + print("[FAIL] %s" % exc, file=sys.stderr) + return 1 + + if args.json: + sys.stdout.write( + kblib.canonical_json_bytes([receipt]).decode("utf-8") + "\n") + else: + print("[PASS] batch judgment recorded: %s" % receipt["receipt_id"]) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/Tools/schemas/receipt.template.jsonl b/Tools/schemas/receipt.template.jsonl index 461f4e5..ab879bd 100644 --- a/Tools/schemas/receipt.template.jsonl +++ b/Tools/schemas/receipt.template.jsonl @@ -176,6 +176,19 @@ # gate_receipts # Page receipts may be valid historical evidence. They never authorize the # lifecycle edge without this current wrapper, and invalidated IDs are rejected. +# When the selected Profile registers Batch Review Requirements the wrapper +# additionally binds the frozen judgment set: +# review_requirement_set_sha256 : the expansion hash the activation froze +# judgment_receipt_ids : sorted unique profile_batch_judgment IDs +# judgment_record_set_sha256 : hash over the exact actual records +# Each member receipt is produced by `record_batch_judgment` (check: +# profile_batch_judgment) and binds batch_id, judgment_item_id, +# target_selector, receipt_schema, reviewer_role, the batch's current +# activation as opening_transition_receipt, the target's +# semantic_content_sha256 (page targets), and the Profile contract +# fingerprint; `open -> merge-ready` refuses one missing, extra, duplicated, +# drifted, mis-roled, or reused record. A requirement-free Profile and any +# pre-review-era activation carry none of these fields. # Receipt cold chain (K12/07): `.cambium/receipts/cold/` is never scanned # by the hot catalog. `cold/manifest.jsonl` binds each sealed segment's # exact bytes/hash/record count and seal identity; `cold/index.jsonl` keeps diff --git a/Tools/tests/test_update_queue.py b/Tools/tests/test_update_queue.py index 9106577..b92cf60 100644 --- a/Tools/tests/test_update_queue.py +++ b/Tools/tests/test_update_queue.py @@ -3557,5 +3557,289 @@ def test_two_merge_failures_preserve_append_only_invalidation_history(self): self.assertEqual(entry, transition["invalidation"]) +class BatchReviewRequirementTests(UpdateQueueTests): + """The Profile's frozen judgment obligations gate `open -> merge-ready`.""" + + REQUIREMENT_SECTION = ( + "\n## Batch Review Requirements\n\n" + "- Registration: Configured\n\n" + "| Judgment Item ID reference | Target selector: `each-manifest-page`" + " or `batch` | Trigger: `before-merge-ready` | Producer kind:" + " `manual-attestation` | Receipt schema | Pass-authority Role ID" + " reference |\n" + "|---|---|---|---|---|---|\n" + "| `test-profile-foundation-depth` | `each-manifest-page` |" + " `before-merge-ready` | `manual-attestation` |" + " `page-batch-judgment-v1` | `executor` |\n" + ) + + ROLE_SECTIONS = ( + "\n## Process Roles\n\n" + "| Kernel role | Bound actor or system ID/name |\n|---|---|\n" + "| `proposer` | Model proposal |\n" + "| `gatekeeper` | Harness control |\n" + "| `executor` | External executor |\n" + "| `stopper` | Human authority |\n" + "\n## Knowledge Host\n\n" + "| Kernel role | Binding |\n|---|---|\n" + "| `knowledge-host` | Fixture vault |\n" + "| `knowledge-host UI` | Fixture UI |\n" + "\n## Extension Roles\n\n" + "- Registration: None\n\n" + "| Role ID | Bound actor or system ID/name | Responsibility |\n" + "|---|---|---|\n" + ) + + def enable_requirement(self): + slots = self.root / "profiles/test-profile/slots.md" + slots.write_text( + slots.read_text(encoding="utf-8") + self.ROLE_SECTIONS + + self.REQUIREMENT_SECTION, + encoding="utf-8") + + def activation_receipt(self): + queue = kblib.load_yaml_file(self.root / check_queue.QUEUE_PATH) + item = next(row for row in queue["required_queue"] + if row["id"] == "B1") + records = [json.loads(line) for line in + (self.root / ".cambium/receipts/gates.jsonl").read_text( + encoding="utf-8").splitlines()] + return next(record for record in records + if record["receipt_id"] == item["activation_receipt"]) + + def judge(self, target="Topics/A.md", *, role="executor", + item_id="test-profile-foundation-depth", expect=0): + completed = subprocess.run( + [sys.executable, str(TOOLS / "record_batch_judgment.py"), + str(self.root), "--batch", "B1", "--judgment-item", item_id, + "--target", target, "--reviewer-role", role, + "--statement", "class 4: natural prose, smoothed only", + "--apply", "--json"], + text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, + check=False) + self.assertEqual(expect, completed.returncode, completed.stdout) + if expect != 0: + return completed.stdout + return json.loads(completed.stdout)[0] + + def merge_with_wrapper(self, judgment_receipts, *, wrapper_extra=None, + expect=0): + self.append_receipt("audit-page-1", target="Topics/A.md") + expected_sha = self.activation_receipt()[ + "review_requirement_set_sha256"] + actual = [ + { + "target": receipt["target"], + "judgment_item_id": receipt["judgment_item_id"], + "receipt_id": receipt["receipt_id"], + } + for receipt in judgment_receipts + ] + fields = { + "review_requirement_set_sha256": expected_sha, + "judgment_receipt_ids": sorted( + row["receipt_id"] for row in actual), + "judgment_record_set_sha256": + check_queue.judgment_record_set_sha256(actual), + } + fields.update(wrapper_extra or {}) + self.append_receipt("audit-batch-1", check="batch_gate", **fields) + delta = self.root / ".cambium/deltas/B1.yaml" + delta.parent.mkdir(parents=True, exist_ok=True) + delta.write_text( + "batch: B1\ngenerated_at: 2026-08-04T02:00:00Z\n" + "pages:\n - path: Topics/A.md\n" + " gate_receipts:\n - audit-page-1\n" + "open_gaps_added: []\nopen_gaps_closed: []\n" + "next_batch_updates: []\nwatermark_advance: null\n", + encoding="utf-8", + ) + revision, fingerprint = self.expected() + completed = self.command( + "--id", "B1", "--transition", "merge-ready", + "--delta-path", ".cambium/deltas/B1.yaml", + "--batch-receipt", "audit-batch-1", + "--expected-state-revision", revision, + "--expected-sha256", fingerprint, + "--actor-role", "integrator", "--at", "2026-08-04T02:00:00Z", + "--apply", + ) + self.assertEqual(expect, completed.returncode, completed.stdout) + return completed + + def test_exact_judgment_set_reaches_merge_ready(self): + self.enable_requirement() + self.open_b1() + receipt = self.judge() + self.assertEqual( + self.activation_receipt()["review_requirement_set_sha256"], + receipt["review_requirement_set_sha256"]) + self.merge_with_wrapper([receipt]) + + def test_missing_judgment_refuses_merge_ready(self): + self.enable_requirement() + self.open_b1() + completed = self.merge_with_wrapper([], expect=1) + self.assertIn("missing the required judgment", completed.stdout) + + def test_wrapper_without_bindings_refuses_merge_ready(self): + self.enable_requirement() + self.open_b1() + self.judge() + self.append_receipt("audit-page-1", target="Topics/A.md") + self.append_receipt("audit-batch-1", check="batch_gate") + delta = self.root / ".cambium/deltas/B1.yaml" + delta.parent.mkdir(parents=True, exist_ok=True) + delta.write_text( + "batch: B1\ngenerated_at: 2026-08-04T02:00:00Z\n" + "pages:\n - path: Topics/A.md\n" + " gate_receipts:\n - audit-page-1\n" + "open_gaps_added: []\nopen_gaps_closed: []\n" + "next_batch_updates: []\nwatermark_advance: null\n", + encoding="utf-8", + ) + revision, fingerprint = self.expected() + completed = self.command( + "--id", "B1", "--transition", "merge-ready", + "--delta-path", ".cambium/deltas/B1.yaml", + "--batch-receipt", "audit-batch-1", + "--expected-state-revision", revision, + "--expected-sha256", fingerprint, + "--actor-role", "integrator", "--at", "2026-08-04T02:00:00Z", + "--apply", + ) + self.assertEqual(1, completed.returncode, completed.stdout) + self.assertIn("review_requirement_set_sha256", completed.stdout) + + def test_duplicate_judgment_refuses_merge_ready(self): + self.enable_requirement() + self.open_b1() + first = self.judge() + second = self.judge() + completed = self.merge_with_wrapper([first, second], expect=1) + self.assertIn("duplicates the judgment", completed.stdout) + + def test_wrong_reviewer_role_is_refused_at_recording(self): + self.enable_requirement() + self.open_b1() + output = self.judge(role="gatekeeper", expect=1) + self.assertIn("cannot answer", output) + + def test_forged_reviewer_role_refuses_merge_ready(self): + self.enable_requirement() + self.open_b1() + receipt = self.judge() + self.rewrite_receipt_for_negative_test( + receipt["receipt_id"], + lambda record: record.update({"reviewer_role": "gatekeeper"})) + completed = self.merge_with_wrapper([receipt], expect=1) + self.assertIn("not the registered pass authority", completed.stdout) + + def test_unregistered_target_is_refused_at_recording(self): + self.enable_requirement() + self.open_b1() + output = self.judge(target="Topics/Missing.md", expect=1) + self.assertIn("not an expected obligation", output) + + def test_page_drift_after_judgment_refuses_merge_ready(self): + self.enable_requirement() + self.open_b1() + receipt = self.judge() + page = self.root / "Topics/A.md" + page.write_text( + page.read_text(encoding="utf-8") + "\ndrifted after judgment\n", + encoding="utf-8") + completed = self.merge_with_wrapper([receipt], expect=1) + self.assertIn("judged against different page bytes", + completed.stdout) + + def test_reused_activation_binding_refuses_merge_ready(self): + self.enable_requirement() + self.open_b1() + receipt = self.judge() + self.rewrite_receipt_for_negative_test( + receipt["receipt_id"], + lambda record: record.update( + {"opening_transition_receipt": "audit-stale-activation"})) + completed = self.merge_with_wrapper([receipt], expect=1) + self.assertIn("binds a different activation", completed.stdout) + + def test_requirement_free_profile_keeps_its_exact_shape(self): + # The whole pre-requirement suite exercises this continuously; this + # case pins it explicitly: no requirements, no judgment bindings, + # merge-ready unchanged. + self.merge_b1() + + def test_legacy_activation_era_carries_no_obligations(self): + self.enable_requirement() + self.open_b1() + activation = self.activation_receipt() + legacy_manifest = dict(activation["activation_bundle_manifest"]) + legacy_manifest["activation_protocol"] = "card-first-readback-v1" + legacy_manifest.pop("batch_review_plan", None) + legacy_bundle_sha = kblib.sha256_bytes( + kblib.canonical_json_bytes(legacy_manifest)) + + def downgrade(record): + record["activation_protocol"] = "card-first-readback-v1" + record.pop("review_requirement_set_sha256", None) + if "activation_bundle_manifest" in record: + record["activation_bundle_manifest"] = legacy_manifest + record["card_bundle_sha256"] = legacy_bundle_sha + + self.rewrite_receipt_for_negative_test( + activation["receipt_id"], downgrade) + transitions = [ + json.loads(line) for line in + (self.root / ".cambium/receipts/queue-transitions.jsonl" + ).read_text(encoding="utf-8").splitlines() if line.strip()] + opening = next(record for record in transitions + if record.get("target") == "B1" and + record.get("after_state") == "open") + self.rewrite_receipt_for_negative_test( + opening["receipt_id"], downgrade) + self.merge_b1_body_without_open() + + def merge_b1_body_without_open(self): + self.append_receipt("audit-page-1", target="Topics/A.md") + self.append_receipt("audit-batch-1", check="batch_gate") + delta = self.root / ".cambium/deltas/B1.yaml" + delta.parent.mkdir(parents=True, exist_ok=True) + delta.write_text( + "batch: B1\ngenerated_at: 2026-08-04T02:00:00Z\n" + "pages:\n - path: Topics/A.md\n" + " gate_receipts:\n - audit-page-1\n" + "open_gaps_added: []\nopen_gaps_closed: []\n" + "next_batch_updates: []\nwatermark_advance: null\n", + encoding="utf-8", + ) + revision, fingerprint = self.expected() + completed = self.command( + "--id", "B1", "--transition", "merge-ready", + "--delta-path", ".cambium/deltas/B1.yaml", + "--batch-receipt", "audit-batch-1", + "--expected-state-revision", revision, + "--expected-sha256", fingerprint, + "--actor-role", "integrator", "--at", "2026-08-04T02:00:00Z", + "--apply", + ) + self.assertEqual(0, completed.returncode, completed.stdout) + return completed + + +# The requirement class inherits UpdateQueueTests only for its fixture +# helpers. Rerunning every inherited test under the subclass doubles the +# shard's wall clock for zero new coverage — the s-z CI shard sits near its +# 15-minute budget — so the inherited tests are explicitly skipped here and +# keep running exactly once, on the base class. +for _name in dir(UpdateQueueTests): + if _name.startswith("test_"): + setattr( + BatchReviewRequirementTests, _name, + unittest.skip("runs once on UpdateQueueTests")( + getattr(UpdateQueueTests, _name))) +del _name + + if __name__ == "__main__": unittest.main() diff --git a/Tools/update_queue.py b/Tools/update_queue.py index ae5be73..d959134 100644 --- a/Tools/update_queue.py +++ b/Tools/update_queue.py @@ -26,7 +26,7 @@ import metadata_property_state import project_page_state -TOOL_VERSION = "1.7.0" +TOOL_VERSION = "1.8.0" # The lifecycle map moved to `kblib` so `check_queue` can read it without # importing this writer, which imports it. The name stays here because it is # this tool's transition guard and every existing reference reads it here. @@ -612,6 +612,22 @@ def require_standards_revalidation(): raise ValueError( "open -> merge-ready requires the K12/12 substantive " "review evidence: %s" % "; ".join(review_errors)) + # Batch Review Requirements: the Profile's frozen per-target + # judgment obligations are counted here, not attested in prose. + # The activation froze the expected set; the wrapper must bind the + # exact actual set. A batch activated before the review era + # carries no obligations and must carry no judgment bindings — + # sealed evidence keeps its own shape, exactly like the K12/12 + # guard above. + wrapper_entry = check_queue.current_receipt_catalog(result).get( + args.batch_receipt[0]) + wrapper_receipt = wrapper_entry[1] if wrapper_entry else None + judgment_errors = check_queue.batch_review_judgment_errors( + result, item, wrapper_receipt) + if judgment_errors: + raise ValueError( + "open -> merge-ready requires the Profile batch-review " + "judgment set: %s" % "; ".join(judgment_errors)) item["state"] = "merge-ready" item["merge_ready_at"] = now item["delta_path"] = args.delta_path diff --git a/kernel/Cards/R01 Core Bootstrap Card.md b/kernel/Cards/R01 Core Bootstrap Card.md index 77827be..55b4f9c 100644 --- a/kernel/Cards/R01 Core Bootstrap Card.md +++ b/kernel/Cards/R01 Core Bootstrap Card.md @@ -20,8 +20,8 @@ source_files: - kernel/K13 Task Runtime and Execution Control/11 Completion Policy.md readback_sources: [] readback_policy: none -source_hash: '533f217cfa9d' -compiled_source_hash: '533f217cfa9d' +source_hash: 'edf230597940' +compiled_source_hash: 'edf230597940' --- # R01 Core Bootstrap Card diff --git a/kernel/Cards/R03 Module Build Card.md b/kernel/Cards/R03 Module Build Card.md index 6677fa2..911d8ee 100644 --- a/kernel/Cards/R03 Module Build Card.md +++ b/kernel/Cards/R03 Module Build Card.md @@ -38,8 +38,8 @@ readback_sources: - kernel/K10 Writing and Formatting/01 Naming Language and Prose.md - kernel/K12 Quality Assurance/11 Content-level Propagation.md readback_policy: declared -source_hash: 'ffad8bf5c4de' -compiled_source_hash: 'ffad8bf5c4de' +source_hash: '18b36ade39d3' +compiled_source_hash: '18b36ade39d3' --- # R03 Module Build Card diff --git a/kernel/Cards/R05 Expression Layer Card.md b/kernel/Cards/R05 Expression Layer Card.md index 5e6f0a2..81648c0 100644 --- a/kernel/Cards/R05 Expression Layer Card.md +++ b/kernel/Cards/R05 Expression Layer Card.md @@ -29,8 +29,8 @@ readback_sources: - kernel/K12 Quality Assurance/02 Rendering Verification.md - kernel/K12 Quality Assurance/13 Visual Verification Escalation.md readback_policy: declared -source_hash: '76d695a14fa5' -compiled_source_hash: '76d695a14fa5' +source_hash: '09aa326d154c' +compiled_source_hash: '09aa326d154c' --- # R05 Expression Layer Card diff --git a/kernel/Cards/R06 Migration and Refactor Card.md b/kernel/Cards/R06 Migration and Refactor Card.md index f3933f7..314e93f 100644 --- a/kernel/Cards/R06 Migration and Refactor Card.md +++ b/kernel/Cards/R06 Migration and Refactor Card.md @@ -27,8 +27,8 @@ source_files: readback_sources: - kernel/K03 Note Types and Ownership/02 Ownership and Canonical Notes.md readback_policy: declared -source_hash: 'bc854fe288cf' -compiled_source_hash: 'bc854fe288cf' +source_hash: '73ce5eb88eaa' +compiled_source_hash: '73ce5eb88eaa' --- # R06 Migration and Refactor Card diff --git a/kernel/Cards/R07 Long-running Execution Card.md b/kernel/Cards/R07 Long-running Execution Card.md index 9cb81c5..f2e4e94 100644 --- a/kernel/Cards/R07 Long-running Execution Card.md +++ b/kernel/Cards/R07 Long-running Execution Card.md @@ -46,8 +46,8 @@ readback_sources: - kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md - kernel/K13 Task Runtime and Execution Control/16 Resume Next Action Vocabulary.md readback_policy: declared -source_hash: 'fa8a13023c7d' -compiled_source_hash: 'fa8a13023c7d' +source_hash: '6dcf3f22e9b9' +compiled_source_hash: '6dcf3f22e9b9' --- # R07 Long-running Execution Card @@ -71,7 +71,7 @@ Run a multi-batch task, sustain checkpoints, resume after interruption, maintain ## During -Each batch follows the fixed loop: version/Guidance self-check → `check_queue.py --require-ready` → integrator records `queued -> open` → execute the frozen manifest → build one AuditPlan, finish in-batch QA, and write the delta → integrator records `open -> merge-ready` → serially applies the delta and global gates → reconciles Coverage/Queue/Progress → records `merge-ready -> closed`. +Each batch follows the fixed loop: version/Guidance self-check → `check_queue.py --require-ready` → integrator records `queued -> open` → execute the frozen manifest → build one AuditPlan, finish in-batch QA — including one `record_batch_judgment.py` receipt per record of the activation-delivered Batch Review plan — and write the delta → integrator records `open -> merge-ready` → serially applies the delta and global gates → reconciles Coverage/Queue/Progress → records `merge-ready -> closed`. - Concurrent batches have disjoint manifests and merged prerequisites; only the integrator writes shared control state and hub pages. - In-batch QA is not satisfied by producing the close evidence set alone: each M-tier manifest page passes, page by page, the M-tier Gate Checklist surfaced by the kernel Single Note Authoring Card (K12/14 folds note-level acceptance into Batch Review), including the sources-role and page-contract items; the per-page conclusion is recorded in that page's attestation, not asserted once in the batch wrapper. diff --git a/kernel/Cards/R09 Standards Governance Card.md b/kernel/Cards/R09 Standards Governance Card.md index 4735e36..71a50b2 100644 --- a/kernel/Cards/R09 Standards Governance Card.md +++ b/kernel/Cards/R09 Standards Governance Card.md @@ -38,8 +38,8 @@ readback_sources: - kernel/K12 Quality Assurance/02 Rendering Verification.md - kernel/K12 Quality Assurance/05 Automated and Manual Checks.md readback_policy: activation -source_hash: '59f10d84b0bc' -compiled_source_hash: '59f10d84b0bc' +source_hash: '618c93c9da94' +compiled_source_hash: '618c93c9da94' --- # R09 Standards Governance Card diff --git a/kernel/Cards/R10 Maintenance Run Card.md b/kernel/Cards/R10 Maintenance Run Card.md index 58f0978..5616898 100644 --- a/kernel/Cards/R10 Maintenance Run Card.md +++ b/kernel/Cards/R10 Maintenance Run Card.md @@ -26,8 +26,8 @@ readback_sources: - kernel/K12 Quality Assurance/11 Content-level Propagation.md - kernel/K12 Quality Assurance/12 Substantive Correctness Review.md readback_policy: declared -source_hash: 'ce997729d09d' -compiled_source_hash: 'ce997729d09d' +source_hash: '37481f0b4cc3' +compiled_source_hash: '37481f0b4cc3' --- # R10 Maintenance Run Card diff --git a/kernel/K00 Standards Control/12 Control Registry.md b/kernel/K00 Standards Control/12 Control Registry.md index f931101..fb8e650 100644 --- a/kernel/K00 Standards Control/12 Control Registry.md +++ b/kernel/K00 Standards Control/12 Control Registry.md @@ -21,7 +21,7 @@ The [[kernel/K00 Standards Control/11 Standards Map and Rule Registry#Cross-doma | `required-queue-admission` | Readiness, dependencies, confirmation, concurrent-write conflicts, and the K13/10 condition-2 hub classification, whose inputs are the manifest pages' own frontmatter and the selected profile's `Expression Layer Entry` rows | K13/10 `check_queue.py --require-ready ` | Activation consumes the batch-bound receipt; no other layer recreates readiness | | `required-queue-completion` | Build Queue exhaustion and completion readiness | K13/12 `check_queue.py --require-complete` | Entry to build `completion-candidate` consumes the frozen Queue-complete receipt | | `maintenance-completion` | Maintenance Queue exhaustion, candidate partition, and maintenance evidence closure | K13/12 `check_queue.py --require-maintenance-complete` | Maintenance task completion consumes the frozen maintenance-complete receipt | -| `batch-review` | In-batch review authorization for one exact Delta evidence set | K12/14 current `manual-attestation` batch-review gate | `open -> merge-ready` consumes exactly one current gate that binds the Delta's page receipt IDs; page receipts alone never authorize the transition | +| `batch-review` | In-batch review authorization for one exact Delta evidence set | K12/14 current `manual-attestation` batch-review gate | `open -> merge-ready` consumes exactly one current gate that binds the Delta's page receipt IDs and, when the selected Profile registers Batch Review Requirements, the exact frozen judgment set; page or judgment receipts alone never authorize the transition | | `batch-close` | Complete merged-snapshot batch-close bundle | K12/09 `check_batch_close.py` batch-close aggregator | Every close reruns the full current scan. A prior verified close may carry forward only an explicitly durable, byte-exact unchanged candidate disposition; the close transition consumes the resulting current bundle | | `page-contract` | Compiled frontmatter page contract: applicability modes, writer/projection persistence, relationship shapes and targets, and the unknown-field closure | K08/06 `Tools/check_page_contract.py` page-contract receipt, over the contract composed by `Tools/compose_page_contract.py` | Whole-corpus backlog remains advisory, while K12/09 consumes the current manifest-page slice at batch close; other pages never become that batch's ticket | | `boundary-contract` | Page boundary blocks: K08/09 schema and self-consistency, owner resolvability, reciprocity, corpus-wide concern uniqueness, and boundary projection freshness against `Tools/render_boundary_projection.py` output | K08/09 `Tools/check_boundary_contract.py` boundary-contract receipt, over the same compiled contract's projection labels | Advisory under the K08/09 Enablement rule: candidates support migration planning and no existing gate consumes them; the `boundary` field's presence, mode, and unknown-field closure stay with `page-contract`, and concern vocabulary membership stays with `frontmatter-vocabulary`; promotion to a blocking gate is a separate governance decision under K12/10. Invalidation: a `boundary` block, a page referenced as an owner, the profile's `boundary_projection` labels or concern vocabulary, or the tool version changes; the rerun boundary is every in-scope page carrying a `boundary` block plus every page referenced as an owner | diff --git a/kernel/K00 Standards Control/16 Leaf Module Size Register.md b/kernel/K00 Standards Control/16 Leaf Module Size Register.md index 2da8856..3afaa46 100644 --- a/kernel/K00 Standards Control/16 Leaf Module Size Register.md +++ b/kernel/K00 Standards Control/16 Leaf Module Size Register.md @@ -12,7 +12,7 @@ This page carries the exception register that [[kernel/K00 Standards Control/03 | Exception register | Active entries | |---|---| -| Leaf module exceptions | 21 active; registered below | +| Leaf module exceptions | 23 active; registered below | | Control-plane exceptions | None; register is open for an authorized governance change | | Leaf module exception | Measured | Necessity | Growth cap | Follow-up | @@ -33,7 +33,9 @@ This page carries the exception register that [[kernel/K00 Standards Control/03 | [[kernel/K12 Quality Assurance/10 Standards Version Adoption\|Standards Version Adoption]] | 15721 bytes | One transaction. Trigger, adoption plan, branches, and acceptance are the ordered steps of a single adoption; both routed consumers run them in order in a single pass | 16KB | Re-measure whenever an adoption branch or an invariant is added; raised from 13.5KB to 16KB when current plans gained the closed semantic-leaf-to-owner projection, claim-edge enforcement, native-transition deferral, and producer-era replay boundary. These are authorization rules of the same adoption transaction, not a new routed tenant; raised from 13KB to 13.5KB when the 1.5 producer's upstream identity pair joined the same producer-era paragraph -- a recorded input of the existing transaction, not a new branch. Raised from 12.5KB to 13KB when the same transaction gained the root-owned profile-load-input fingerprint, approved K00/03 identity binding, and producer-era-compatible compare-and-swap at every publication edge. These are atomicity inputs of the existing adoption, not a separable branch. The earlier 10KB-to-12.5KB raise applies when the existing adoption transaction was required to persist the typed Profile contract fingerprint, preserve its pre-1.3 replay boundary, and re-CAS the admitted Profile before/after state and final receipt publication, including the different recovery rule once commit evidence may be durable. Those rules determine whether this same transaction may publish or must roll back; splitting them would make the transaction defer its own atomicity contract elsewhere. The earlier raise carries the after-image boundary, deferred-rerun exclusion, corrective-adoption asymmetry, lifecycle-position claims, and producer-era identity. The split condition is a routed consumer that enters one branch without holding the plan that selected it | | [[kernel/K12 Quality Assurance/15 Terminal Audit and Convergence\|Terminal Audit and Convergence]] | 6715 bytes | Its two sections are the Terminal Audit and the findings that audit produces. `#Terminal Audit` is anchored four times corpus-wide and the convergence rules decide nothing without the run that produced the findings, so separating them would leave each half deferring to the other | 7KB | Re-measure whenever a Terminal Audit review or a convergence rule is added; the split condition is a routed consumer that resolves a finding without having run the audit | | [[kernel/K12 Quality Assurance/16 Terminal Proof Contract\|Terminal Proof Contract]] | 11042 bytes | The proof contract, the gate that consumes it, and the trust boundary that scopes it are one answer to whether a task may close. Its single routed consumer, the Audit and Completion Read Set, loads all three | 11KB | Re-measure whenever a proof field or a gate item is added. Raised from 10KB to 11KB when Terminal Proof was required to consume one shared Profile/runtime view and bind/recheck the root-owned profile-load inputs alongside the Profile snapshot, typed contract, and exact repository snapshot later consumed by the completion writer. This is a currentness condition of the same proof. The earlier 9.5KB-to-10KB raise applies when root validation was required to rerun `profile-load` and keep its closure outside the five loaded-set lists. That is a condition of the existing proof, not a new proof object. The earlier raise carries the exact five-list binding. The next split MUST be `Evidence Trust Boundary`, the only part carrying an anchor of its own, once a routed consumer reaches it without the contract | -| [[kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract\|Gate Receipt Payload Contract]] | 10270 bytes | Gate identity fields, producer-specific additions, recording authority, and rejection are one current-authorization payload contract. R07 loads the page when a receipt is offered and needs all four to decide whether it authorizes the boundary | 10.5KB | Raised from 8.5KB to 10.5KB when current Gate authorization separated raw semantic leaves from their registered owners and required native owner member chains while preserving producer-era replay. These are acceptance and rejection rules of the same receipt payload, not a second payload contract. Raised from 7KB to 8.5KB when profile-load and Profile-derived Gate receipts gained their root-input and compiled-artifact and terminal repository fingerprints; these are producer-specific fields under the same shared acceptance/rejection contract. Originally registered when `profile-load` added its pre-Queue manifest identity plus Profile snapshot and typed-contract fingerprints. Those fields specialize the one payload contract and splitting them would create a second owner of what a Gate receipt carries. Re-measure whenever a producer adds required authorization fields; split only when a routed consumer can validate one receipt class without the shared payload and rejection rules | +| [[kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract\|Gate Receipt Payload Contract]] | 10454 bytes | Gate identity fields, producer-specific additions, recording authority, and rejection are one current-authorization payload contract. R07 loads the page when a receipt is offered and needs all four to decide whether it authorizes the boundary | 10.5KB | Raised from 8.5KB to 10.5KB when current Gate authorization separated raw semantic leaves from their registered owners and required native owner member chains while preserving producer-era replay. These are acceptance and rejection rules of the same receipt payload, not a second payload contract. Raised from 7KB to 8.5KB when profile-load and Profile-derived Gate receipts gained their root-input and compiled-artifact and terminal repository fingerprints; these are producer-specific fields under the same shared acceptance/rejection contract. Originally registered when `profile-load` added its pre-Queue manifest identity plus Profile snapshot and typed-contract fingerprints. Those fields specialize the one payload contract and splitting them would create a second owner of what a Gate receipt carries. Re-measured to 10454 bytes when the batch-review wrapper gained its frozen judgment-set binding — the same one-wrapper contract, extended, not a second payload owner. Re-measure whenever a producer adds required authorization fields; split only when a routed consumer can validate one receipt class without the shared payload and rejection rules | +| [[kernel/K12 Quality Assurance/14 Batch Review\|Batch Review]] | 7328 bytes | The two checklist groups and the wrapper's binding contract are one merge-ready boundary: the in-batch items say what a batch owes, and the wrapper paragraph says how the one consuming receipt proves it, now including the frozen Batch Review judgment set. A reader given either half would rebuild the other from prose | 7.5KB | Registered when the wrapper gained the judgment-set binding (`review_requirement_set_sha256`, `judgment_receipt_ids`, `judgment_record_set_sha256`) and the in-batch items gained the per-record `record_batch_judgment` obligation — the binding belongs beside the wrapper it extends and nowhere else. Re-measure when a wrapper field or in-batch item is added; split only when a routed consumer can validate the wrapper without the in-batch items that produce its members | +| [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | 7226 bytes | The Bundle, the Frozen Review Plan, progressive read-back, and resume redelivery are one delivery boundary read at every activation; splitting the plan from the Bundle would let one recompile and not the other | 7.5KB | Registered when protocol v2 added the Frozen Review Plan section: the plan freezes at the same admission, recompiles at the same `queued -> open`, and is delivered in the same payload, so its contract belongs on the page that owns that boundary. Re-measure when the activation payload gains a commitment; split only when a consumer can validate one commitment without the shared delivery/era rules | | [[kernel/K13 Task Runtime and Execution Control/06 Amendment Log and Controlled Replanning\|Amendment Log and Controlled Replanning]] | 9557 bytes | The Guidance record, the Amendment state machine, and the registration/withdrawal writer contract are one log discipline: both routed consumers load the page whole to decide what a Guidance or operational change may do next, and no page anchors a section of it. The withdrawal rule that took the page over the cap belongs beside the one-pending rule it protects — a pending registration whose execution can never validate would otherwise wedge every future operational Amendment — and nowhere else. The Contract Amendment section joined for the same reason: the guarded writer for the one amendable contract field is part of the same discipline that says what an approved decision may and may not execute, and a reader deciding whether a contract change is amendable or successor-bound needs the whole state machine in hand | 9.5KB | Re-measure whenever an Amendment state, registration rule, or versioning rule is added; raised from 8KB to 9.5KB when the Task Contract gained a closed delegated-authority record, operational registration began deriving and binding its exact impact under lock, and narrow gap-route reconciliation received an explicit-user writer. These are authorization rules of the existing Amendment state machine. Earlier: re-measured at 8185 bytes when the Contract Amendment section gained the writer's own authorization conditions (effective-policy fingerprint, joint ceiling, merge-ready refusal) -- invocation rules of the same writer, not a new discipline. The cap moved from 7KB to 8KB when the Contract Amendment writer landed, under the same standing necessity. The split condition is a routed consumer that resolves a registration or withdrawal without holding the Guidance state machine it serves | | [[kernel/K13 Task Runtime and Execution Control/08 Required Queue Contract and Lifecycle\|Required Queue Contract and Lifecycle]] | 9198 bytes | The Queue document contract, the Work Spec binding, and the batch lifecycle are one object read from three angles, and the routed consumers load the page whole. The Batch Reference Settlement table cannot be split from the lifecycle it settles: it states what each reference to a batch ID must become when that batch reaches a terminal state, so a reader holding the lifecycle without the table would have exactly the gap the table was written to close | 9KB | Raised from 8.5KB to 9KB when routed-gap settlement moved before Delta freeze, bound the prospective after-image, and retained landed/close rechecks so the terminal gate is defense in depth rather than first discovery. Registered here as a governance change under [[kernel/K00 Standards Control/03 Standards Governance#Leaf Module Size Budget\|Leaf Module Size Budget]]. The page passed the 6KB soft cap when it gained the settlement table; the table is a closed list of the four places a batch ID is referenced, added because three of the four had each been discovered as a separate production incident, and it belongs beside the terminal transition that consumes it. Re-measure whenever a reference kind or a lifecycle edge is added — adding a reference kind means amending the table and the close settlement in the same revision; the split condition is a routed consumer that resolves a batch transition without needing the reference contract it settles | | [[kernel/K13 Task Runtime and Execution Control/10 Batch Admission Transitions and Serial Integration\|Batch Admission Transitions and Serial Integration]] | 9200 bytes | Concurrent-batch admission and the transition gates that admit them are one state machine. Three routed consumers load it whole, and no page links a section of it | 9KB | Re-measured at 9200 bytes when Card delivery was delegated to K13/19 while Queue `open` remained the admission boundary; the state-machine split test still fails. Re-measure whenever a transition or a concurrency rule is added; the split condition is a routed consumer that evaluates a transition gate without holding the concurrency rules it guards. Raised from 7.5KB to 9KB when condition 2 gained its reporting-channel rule: the paragraph explains why one admission condition is time-invariant and therefore reported over the whole Queue while the others stay readiness-only, which belongs beside the conditions it distinguishes and nowhere else, and the split test above still fails — the consumers that evaluate a transition gate need those concurrency rules in hand | diff --git a/kernel/K12 Quality Assurance/14 Batch Review.md b/kernel/K12 Quality Assurance/14 Batch Review.md index db4b14b..996e3c8 100644 --- a/kernel/K12 Quality Assurance/14 Batch Review.md +++ b/kernel/K12 Quality Assurance/14 Batch Review.md @@ -15,7 +15,7 @@ Gate merge rules (for tier determination see [[kernel/K00 Standards Control/07 E - M-tier pages pass, page by page within the batch gate, the canonical [[kernel/K12 Quality Assurance/01 Quality Dimensions and Single Note Review#M-tier Gate Checklist|M-tier Gate Checklist]] as surfaced by the kernel Single Note Authoring Card. - L-tier pages keep an independent note gate, executed in full per [[kernel/K12 Quality Assurance/01 Quality Dimensions and Single Note Review|K12/01]], and are not folded into this section. -The batch close checklist has two groups: **in-batch items** are completed by the batch before it is eligible for `merge-ready` (may run in parallel with other batches); the integrator verifies that boundary, records one current `batch-review` Gate receipt, and writes the Queue transition. The receipt is a `manual-attestation` protocol `1.0.0` pass with `gate_id: batch-review`, `check: batch_gate`, the exact Batch ID as `target` and `batch_id`, the current Task ID, and `delta_page_receipt_ids` equal to the sorted unique receipt IDs carried by every Delta page. Those page receipts may remain valid historical evidence, but they do not authorize the lifecycle edge by themselves. The transition consumes the wrapper as its `evidence_receipt`; an invalidated wrapper or page receipt is rejected. **Global items** are verified by the integrator during serial merge. The serial zone performs only deterministic actions and global verification, not in-batch manual review. +The batch close checklist has two groups: **in-batch items** are completed by the batch before it is eligible for `merge-ready` (may run in parallel with other batches); the integrator verifies that boundary, records one current `batch-review` Gate receipt, and writes the Queue transition. The receipt is a `manual-attestation` protocol `1.0.0` pass with `gate_id: batch-review`, `check: batch_gate`, the exact Batch ID as `target` and `batch_id`, the current Task ID, and `delta_page_receipt_ids` equal to the sorted unique receipt IDs carried by every Delta page. Those page receipts may remain valid historical evidence, but they do not authorize the lifecycle edge by themselves. The transition consumes the wrapper as its `evidence_receipt`; an invalidated wrapper or page receipt is rejected. When the selected Profile registers Batch Review Requirements, the wrapper additionally binds the frozen judgment set: `review_requirement_set_sha256` equal to the value the activation receipt froze at `queued -> open`, `judgment_receipt_ids` as the sorted unique current `profile_batch_judgment` receipts, and `judgment_record_set_sha256` over the exact actual `(target, judgment item, receipt)` records. `open -> merge-ready` recomputes the expected expansion from the authorized Profile and the frozen manifest and refuses the batch on one missing, extra, duplicated, drifted, mis-roled, or reused record; each judgment receipt binds the batch's current activation, the target's semantic content fingerprint, and the Profile contract fingerprint, so a reopened batch, a changed page, or a revised Profile invalidates the evidence rather than carrying it. A requirement-free Profile owes nothing and its wrapper keeps its exact prior shape; a batch activated before the review era replays under its own producer protocol and must not carry the fields. **Global items** are verified by the integrator during serial merge. The serial zone performs only deterministic actions and global verification, not in-batch manual review. In-batch items (merge-ready preconditions): @@ -26,6 +26,7 @@ In-batch items (merge-ready preconditions): - An AuditPlan has been generated from changed objects, acceptance predicates, and dependency changes; still-valid historical evidence has an explicit `reused_receipt_id`, and new checks produce dimension-specific AuditReceipts. - Page frontmatter projections of every page the batch touched agree with the post-delta Coverage owner state, per [[kernel/K08 Metadata and Status/07 Frontmatter Writer and Projection Authority|K08/07]]. A substantive change advances evidence-bound `last_content_modified` and invalidates the old review; `last_reviewed` returns only from review evidence for the current semantic fingerprint. Any `last_verified` change cites the separate verification evidence that earned it. +- Every Batch Review Requirement the selected Profile registers has its per-target judgment recorded through `Tools/record_batch_judgment.py` — one current receipt per expected record, produced before this boundary, never reconstructed at close. - The delta has been written out; no unverified modifications are left to the next batch. Global items (verified by the integrator during serial merge): diff --git a/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md b/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md index ac49fb5..589a730 100644 --- a/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md +++ b/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md @@ -36,7 +36,7 @@ identity and MUST NOT combine the live before Task/Standards identity with the after manifest. A current-use receipt for the already-selected Profile carries all three live identity fields normally. -A Gate whose owner requires more binds more, and that owner states the addition: the `batch-review` wrapper additionally binds the batch and the exact Delta page receipt IDs per [[kernel/K12 Quality Assurance/14 Batch Review#Batch Review|Batch Review]], and the close bundle binds the merged-snapshot digest and member chain per [[kernel/K12 Quality Assurance/09 Batch-close Closed List#Batch-close Closed List|Batch-close Closed List]]. +A Gate whose owner requires more binds more, and that owner states the addition: the `batch-review` wrapper additionally binds the batch, the exact Delta page receipt IDs, and — when the selected Profile registers Batch Review Requirements — the frozen judgment set (`review_requirement_set_sha256`, `judgment_receipt_ids`, `judgment_record_set_sha256`) per [[kernel/K12 Quality Assurance/14 Batch Review#Batch Review|Batch Review]], and the close bundle binds the merged-snapshot digest and member chain per [[kernel/K12 Quality Assurance/09 Batch-close Closed List#Batch-close Closed List|Batch-close Closed List]]. A `profile-load` receipt additionally carries `profile_snapshot_sha256`, `profile_contract_fingerprint`, and `profile_load_inputs_sha256`. The first is diff --git a/kernel/K13 Task Runtime and Execution Control Standard.md b/kernel/K13 Task Runtime and Execution Control Standard.md index b06da73..db483e5 100644 --- a/kernel/K13 Task Runtime and Execution Control Standard.md +++ b/kernel/K13 Task Runtime and Execution Control Standard.md @@ -30,7 +30,7 @@ This page is the stable entry point of the Task Runtime and Execution Control st | [[kernel/K13 Task Runtime and Execution Control/16 Resume Next Action Vocabulary\|Resume Next Action Vocabulary]] | `Purpose And Boundary`, `Token Table`, `Tokens Without An Automated Path`, `Related` | | [[kernel/K13 Task Runtime and Execution Control/17 Escalation Policy\|Escalation Policy]] | `Purpose And Boundary`, `The Kernel Trigger`, `Profile-declared Triggers`, `Firing And Resuming`, `A Trigger Is Not A Gate`, `Control Accretion Decision`, `Related` | | [[kernel/K13 Task Runtime and Execution Control/18 Initial Task Planning Transaction\|Initial Task Planning Transaction]] | `Purpose And Boundary`, `What The Plan Supplies And What It May Never Infer`, `Where The Transaction Stops`, `Guarded Write Protocol`, `Applying It Twice`, `Control Accretion Decision`, `Related` | -| [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | `Purpose And Boundary`, `Frozen Reading Plan`, `Card Activation Bundle`, `Execution-context Delivery`, `Progressive Read-back`, `Resume Reassignment And Failure`, `Related` | +| [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | `Purpose And Boundary`, `Frozen Reading Plan`, `Card Activation Bundle`, `Execution-context Delivery`, `Frozen Review Plan`, `Progressive Read-back`, `Resume Reassignment And Failure`, `Related` | ## Applicable Read Sets diff --git a/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md b/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md index 14f0129..bb7181f 100644 --- a/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md +++ b/kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery.md @@ -84,6 +84,24 @@ still be written by a human integrator because it is admission, not worker execution. A runtime or adapter MUST NOT claim machine-enforced Card delivery from that degraded record. +## Frozen Review Plan + +Protocol `card-first-readback-v2` adds one delivery-independent commitment to +the Bundle: the Profile's Batch Review Requirements expanded against the +frozen manifest. The expansion is deterministic — each `each-manifest-page` +row over the sorted manifest, each `batch` row over the batch itself — and +its identity hash is `review_requirement_set_sha256`, carried in the +admission receipt and recompiled to exact equality at `queued -> open`. The +Bundle's `batch_review_plan` delivers the same records readably, so the +executing Agent starts with its judgment obligations in context rather than +discovering them at refusal. Per-record evidence is produced by +`Tools/record_batch_judgment.py` while the batch is `open`; +`open -> merge-ready` consumes the exact set through the batch-review +wrapper per [[kernel/K12 Quality Assurance/14 Batch Review|K12/14]]. A v1 +activation predates the plan: it replays under its own protocol, carries no +review field, and imposes no judgment obligations — reactivation under the +current protocol is what upgrades an in-flight batch. + ## Progressive Read-back Each Runtime Card declares one closed policy alongside `readback_sources`: diff --git a/profiles/_template/registries/routing-and-gates.md b/profiles/_template/registries/routing-and-gates.md index c5cfba3..0ff46ab 100644 --- a/profiles/_template/registries/routing-and-gates.md +++ b/profiles/_template/registries/routing-and-gates.md @@ -30,6 +30,32 @@ there is no readiness axis, so no readiness gate is required. | Judgment Item ID reference | Applicability / trigger predicate | Verification procedure or existing Scan/receipt-source reference | Evidence-reuse predicate/boundary | |---|---|---|---| +## Batch Review Requirements + +- Registration: None + +`None` keeps the table empty. A configured row makes one registered Judgment +Item a standing per-batch obligation with machine-checked completion: at +`queued -> open` the row expands against the frozen manifest into an exact +expected record set delivered with the Card Activation Bundle, each expected +record must be answered by one current `profile_batch_judgment` receipt from +`Tools/record_batch_judgment.py`, and `open -> merge-ready` refuses the batch +until the batch-review wrapper binds exactly that set. A requirement differs +from an Extension Gate on purpose: a Gate changes one persisted property +after a judgment, while a requirement proves the judgment happened for every +applicable target and writes nothing back to any page. The first-version +enums are closed — target selector `each-manifest-page` or `batch`, trigger +`before-merge-ready`, producer kind `manual-attestation`, receipt schema +`page-batch-judgment-v1` — and natural-language applicability is deliberately +not accepted, so a declared rule can never be one the machine does not know +when to apply. The Judgment Item and the pass-authority role must both +resolve during `profile-load`; each Judgment Item may be required at most +once. An absent section means no requirements and changes nothing for an +existing Profile. + +| Judgment Item ID reference | Target selector: `each-manifest-page` or `batch` | Trigger: `before-merge-ready` | Producer kind: `manual-attestation` | Receipt schema | Pass-authority Role ID reference | +|---|---|---|---|---|---| + ## Extension Gates - Registration: None diff --git a/profiles/examples/agent-atlas/registries/audit-dimensions.md b/profiles/examples/agent-atlas/registries/audit-dimensions.md index e843762..09f788d 100644 --- a/profiles/examples/agent-atlas/registries/audit-dimensions.md +++ b/profiles/examples/agent-atlas/registries/audit-dimensions.md @@ -19,6 +19,7 @@ Interface: [Audit Dimension Registry slot](../../../README.md#audit-dimension-re | `agent-atlas-interview-readiness-acceptance` | `interview` | `Single Note Review` | One Interview Card and its bound canonical topics presented for `interview-ready` promotion satisfy the registered readiness predicate. | `emits` | `profiles/examples/agent-atlas/registries/audit-dimensions.md#Interview Readiness Acceptance` | | `agent-atlas-profile-wide-interview-acceptance` | `interview` | `Specialized Audit` | The complete in-scope Agent Systems Atlas snapshot satisfies the registered profile-wide Interview-layer acceptance predicate. | `emits` | `profiles/examples/agent-atlas/registries/audit-dimensions.md#Profile-wide Interview Acceptance` | | `agent-atlas-interview-residual-disposition` | `coverage_and_integration` | `Batch Review` | The merged in-scope snapshot's Interview-answer residual candidates outside `Interview Preparation/` all have an accepted disposition. | `emits` | `profiles/examples/agent-atlas/registries/audit-dimensions.md#Residual-content Disposition` | +| `agent-atlas-content-form-classification` | `content_and_depth` | `Batch Review` | Every page on one batch's frozen manifest carries an explicit four-class content-form classification judged against the registered criteria. | `emits` | `profiles/examples/agent-atlas/registries/audit-dimensions.md#Content Form Classification` | ## Interview Card Review @@ -66,3 +67,19 @@ The Agent Systems Atlas interview layer is profile-wide complete only when: - the Interview Overview reflects the actual artifact set without becoming a second answer owner. This profile-wide verdict consumes the applicable Card, link, residual-scan, source, and coverage evidence; it does not replace their individual judgments. +## Content Form Classification + +Judge one manifest page against the four-class content-form criteria: + +- class 1: contract enumerations (goals, non-goals, ownership assertions) sink + into the frontmatter `boundary` block and the body cites its projection; +- class 2: natural tables, diagrams, code, formulas, and closed query-style + enumerations keep their form; +- class 3: flattened causal or layered narratives — entries a reader must + understand in order — are rewritten as causal prose; +- class 4: natural prose is only smoothed, applying the Term Band Rule per + word. + +An explicit "judged natural record, no migration needed" verdict is a pass; +an absent verdict is not. The judgment covers every page of the frozen +manifest exactly once. diff --git a/profiles/examples/agent-atlas/registries/roles.md b/profiles/examples/agent-atlas/registries/roles.md index d331e1f..a8bab39 100644 --- a/profiles/examples/agent-atlas/registries/roles.md +++ b/profiles/examples/agent-atlas/registries/roles.md @@ -40,3 +40,4 @@ These bindings apply when Atlas reports evaluated metrics, whether the measureme | Role ID | Bound actor or system ID/name | Responsibility | |---|---|---| | `interview-reviewer` | Human authority or explicitly delegated qualified reviewer | Judge Interview Card acceptance and authorize promotion to `interview-ready`. | +| `content-reviewer` | Human authority or explicitly delegated qualified reviewer | Judge the per-page content-form classification a batch must complete before `merge-ready`. | diff --git a/profiles/examples/agent-atlas/registries/routing-and-gates.md b/profiles/examples/agent-atlas/registries/routing-and-gates.md index 3848059..256ad31 100644 --- a/profiles/examples/agent-atlas/registries/routing-and-gates.md +++ b/profiles/examples/agent-atlas/registries/routing-and-gates.md @@ -26,6 +26,14 @@ Interface: [Routing And Gate Registry slot](../../../README.md#routing-and-gate- |---|---|---|---| | `agent-atlas-profile-wide-interview-acceptance` | A terminal or release claim declares the Agent Systems Atlas Interview layer profile-wide complete. | Apply `profiles/examples/agent-atlas/registries/audit-dimensions.md#Profile-wide Interview Acceptance`, including the latest residual-scan evidence. | Reuse only still-valid canonical content, source, link, residual, and coverage receipts whose fingerprints cover the complete in-scope snapshot; never infer profile-wide Interview acceptance from a Card-level or other status-axis verdict. | +## Batch Review Requirements + +- Registration: Configured + +| Judgment Item ID reference | Target selector: `each-manifest-page` or `batch` | Trigger: `before-merge-ready` | Producer kind: `manual-attestation` | Receipt schema | Pass-authority Role ID reference | +|---|---|---|---|---|---| +| `agent-atlas-content-form-classification` | `each-manifest-page` | `before-merge-ready` | `manual-attestation` | `page-batch-judgment-v1` | `content-reviewer` | + ## Extension Gates - Registration: Configured